@openrig/cli 0.6.11 → 0.6.12

package/daemon/dist/domain/seat-lifecycle-service.js

@@ -1,3 +1,4 @@
+import { shellQuote } from "../adapters/shell-quote.js";
 import { deriveCanonicalFromEntry, getNodeInventory } from "./node-inventory.js";
 import { deriveSessionName, parseSessionName } from "./session-name.js";
 import { resolveStartupProof } from "./startup-resolver.js";
@@ -7,7 +8,14 @@ import { observeSolePane } from "./pane-binding-observation.js";
 import { createHash } from "node:crypto";
 import { NativePermissionStore } from "./native-permission-store.js";
 import { validateNativePermissionSelection, unresolvedClaudePermissionModes } from "./native-permission-selection.js";
+import { resolvePermissionPolicyAttachment, validatePermissionPolicyRef } from "./permission-policy/policy-ref.js";
+import { effortPrecedence, emittedEffortFromArgv, readNativeEffort, resolveSeatEffort, unknownLevelWarning, } from "./seat-effort.js";
+import { claudeCommandSessionToken, codexCommandResumeToken, observeClaudePaneRuntime, observeCodexPaneProcess, processArgv, } from "./native-process-lineage.js";
+import { defaultInPlaceRestartIo } from "./seat-restart-in-place.js";
+import nodePath from "node:path";
 import { CodexInPlaceRestart, } from "./seat-restart-in-place.js";
+import { seatAdapter } from "../adapters/community-harness-runtime-adapter.js";
+import { sessionCommunityHarnessSelect } from "./session-registry.js";
 /**
  * S5 (OPR.0.5.4.7) — the seat-lifecycle verb surface: set-model, single-seat stop,
  * dead-session clean. One coherent design (KI-5.3-9):
@@ -40,6 +48,7 @@ export class SeatLifecycleService {
     inPlaceRestartIo;
     inPlaceRestartTiming;
     inPlaceRestartDaemonStartedAt;
+    transcripts;
     constructor(deps) {
         if (deps.db !== deps.rigRepo.db)
             throw new Error("SeatLifecycleService: rigRepo must share the same db handle");
@@ -61,6 +70,7 @@ export class SeatLifecycleService {
         this.inPlaceRestartIo = deps.inPlaceRestartIo;
         this.inPlaceRestartTiming = deps.inPlaceRestartTiming;
         this.inPlaceRestartDaemonStartedAt = deps.inPlaceRestartDaemonStartedAt;
+        this.transcripts = deps.transcripts ?? null;
     }
     async setModel(input) {
         const required = this.requireReason(input.reason);
@@ -98,6 +108,193 @@ export class SeatLifecycleService {
             this.eventBus.notifySubscribers(persisted);
         return { ok: true, seat, from, to: model, changed: true };
     }
+    /** OPR.0.7.0.7 — save one seat's effort for its next managed continuation. Like set-model it
+     *  validates, writes, and persists an audited event in the same transaction; it never restarts
+     *  the seat or touches its peers, model or account. `effort: null` clears the explicit choice. */
+    async setEffort(input) {
+        const required = this.requireReason(input.reason);
+        if (required)
+            return required;
+        const requested = input.effort === null ? null : input.effort.trim();
+        if (requested !== null) {
+            if (!requested)
+                return { ok: false, code: "missing_effort", message: "An effort level is required (--effort <level>), or pass --clear." };
+            // Levels are the runtime's own (they differ by model and client), so only the shape is checked here.
+            if (!/^[A-Za-z][A-Za-z0-9_-]{0,31}$/.test(requested)) {
+                return { ok: false, code: "invalid_effort", message: `"${requested}" isn't an effort level: use the runtime's level name, such as low, medium or high.` };
+            }
+        }
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const seat = this.describe(resolved);
+        const runtime = resolved.entry.runtime ?? "unknown";
+        if (runtime !== "claude-code" && runtime !== "codex") {
+            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${input.seatRef}" runs ${runtime}; reasoning effort applies to claude-code and codex seats only.` };
+        }
+        const from = this.readEffort(seat.nodeId);
+        if (!from) {
+            return { ok: false, code: "effort_unavailable", message: "This daemon's database has no per-seat effort choice (checked: nodes.effort_choice column); nothing was saved." };
+        }
+        let changed = false;
+        if (from.choice !== requested) {
+            let persisted = null;
+            this.db.transaction(() => {
+                if (!this.rigRepo.setNodeEffortChoice(seat.nodeId, requested))
+                    return;
+                changed = true;
+                persisted = this.eventBus.persistWithinTransaction({
+                    type: "node.effort_changed",
+                    rigId: seat.rigId,
+                    nodeId: seat.nodeId,
+                    logicalId: seat.logicalId,
+                    from: from.choice,
+                    to: requested,
+                    reason: input.reason.trim(),
+                    operator: input.operator ?? null,
+                });
+            })();
+            if (persisted)
+                this.eventBus.notifySubscribers(persisted);
+            if (!changed) {
+                return { ok: false, code: "effort_unavailable", message: `The effort choice for seat "${input.seatRef}" was not saved (no node row was updated); nothing changed.` };
+            }
+        }
+        const saved = this.readEffort(seat.nodeId) ?? from;
+        const running = await this.runningState(seat.nodeId);
+        const effect = requested === null
+            ? `Cleared: the seat has no saved effort choice now, so it goes back to ${saved.source === "authored" ? `the spec's authored effort ${saved.authored}` : "no effort flag (the runtime's own default)"} at its next managed launch, resume, restore or spec refresh. An in-place restart keeps the running effort and refuses if it would change it. The running process is unchanged; nothing was restarted.`
+            : `Saved for the seat's next managed continuation. The running process is unchanged; nothing was restarted.`;
+        return {
+            ok: true, seat, runtime, requested, from, saved, changed,
+            running: running.state, ...(running.detail ? { runningDetail: running.detail } : {}),
+            emitted: "not_yet", observed: "not_observed", effect,
+            ...(unknownLevelWarning(runtime, requested) ? { warning: unknownLevelWarning(runtime, requested) } : {}),
+        };
+    }
+    /** OPR.0.7.0.7 — requested, saved, emitted at launch and observed in the native session, each from
+     *  its own source. Reads only. An unseen value is reported as unknown or NOT VERIFIED, never guessed. */
+    async effortReport(seatRef) {
+        const resolved = this.resolveSeat(seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const seat = this.describe(resolved);
+        const runtime = resolved.entry.runtime ?? "unknown";
+        if (runtime !== "claude-code" && runtime !== "codex") {
+            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${seatRef}" runs ${runtime}; reasoning effort applies to claude-code and codex seats only.` };
+        }
+        const saved = this.readEffort(seat.nodeId);
+        if (!saved) {
+            return { ok: false, code: "effort_unavailable", message: "This daemon's database has no per-seat effort choice (checked: nodes.effort_choice column)." };
+        }
+        const requested = this.lastRequestedEffort(seat.nodeId);
+        const precedence = { decided: effortPrecedence.decided, detail: effortPrecedence.detail };
+        let emitted;
+        let observed;
+        const session = this.latestSession(seat.nodeId);
+        const binding = this.sessionRegistry.getBindingForNode(seat.nodeId);
+        const target = binding?.tmuxPane ?? binding?.tmuxSession ?? null;
+        if (!session || TERMINAL_SESSION_STATUSES.has(session.status) || !target) {
+            emitted = { state: "unknown", detail: "The seat has no running session, so no launch to read." };
+            observed = { state: "not_verified", detail: "The seat has no running session." };
+        }
+        else {
+            const observe = runtime === "claude-code" ? observeClaudePaneRuntime : observeCodexPaneProcess;
+            const process = (await observe({ target, tmux: this.tmuxAdapter, ...(this.listProcesses ? { listProcesses: this.listProcesses } : {}) }))?.process;
+            if (!process) {
+                emitted = { state: "unknown", detail: `No single ${runtime === "claude-code" ? "Claude" : "Codex"} process could be read in the seat's pane.` };
+                observed = { state: "not_verified", detail: "The running process could not be read, so no turn can be tied to its launch." };
+            }
+            else {
+                const flag = emittedEffortFromArgv(runtime, processArgv(process.command));
+                const value = flag.flag === "present" ? flag.value : null;
+                emitted = { state: "observed", value, pid: process.pid, startedAt: process.startedAt ?? null, matchesSaved: value === saved.effective };
+                // Native effort is attributed only from the transcript of the conversation this process is on.
+                const joined = await this.joinedTranscript(runtime, session, process);
+                const native = "detail" in joined ? { state: "not_verified", detail: joined.detail }
+                    : readNativeEffort(runtime, joined.path, process.startedAt ?? null);
+                observed = native.state === "observed" ? { ...native, matchesEmitted: native.value === value } : native;
+            }
+        }
+        return { ok: true, seat, runtime, requested, saved, emitted, observed, precedence, summary: effortSummary(saved, emitted, observed) };
+    }
+    lastRequestedEffort(nodeId) {
+        const row = this.db.prepare("SELECT payload, created_at FROM events WHERE node_id = ? AND type = 'node.effort_changed' ORDER BY seq DESC LIMIT 1")
+            .get(nodeId);
+        if (!row)
+            return null;
+        try {
+            const payload = JSON.parse(row.payload);
+            return { value: payload.to ?? null, at: row.created_at, reason: payload.reason ?? "", operator: payload.operator ?? null };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The transcript of the conversation the observed process is on, or why that join can't be made.
+     *  The recorded conversation (Codex: the session's resume token; Claude: the status sidecar's session)
+     *  must be the one the process itself names, by argv or, for a Codex that names none, by its own logs. */
+    async joinedTranscript(runtime, session, process) {
+        if (!this.transcripts)
+            return { detail: "The native transcript for this session isn't known to OpenRig." };
+        const mismatch = "The process in the pane isn't on the conversation recorded for this seat (or its conversation couldn't be read), so no native turn can be attributed to it.";
+        try {
+            if (runtime === "codex") {
+                const recorded = this.sessionResumeToken(session.id);
+                if (!recorded)
+                    return { detail: "No Codex conversation is recorded for this session yet." };
+                let own = codexCommandResumeToken(process.command) ?? undefined;
+                if (own === undefined && process.startedAt) {
+                    const io = { ...defaultInPlaceRestartIo(), ...this.inPlaceRestartIo };
+                    const facts = await io.readProcess(process.pid);
+                    const home = facts?.env.CODEX_HOME ?? (facts?.env.HOME ? nodePath.join(facts.env.HOME, ".codex") : undefined);
+                    own = home ? await io.readThreadId(process.pid, process.startedAt, home) : undefined;
+                }
+                if (own !== recorded)
+                    return { detail: mismatch };
+                return { path: this.transcripts.readCodexTranscriptPath(recorded) };
+            }
+            const sidecar = this.transcripts.readSidecar(session.session_name);
+            if (!sidecar.ok)
+                return { detail: "Claude's status sidecar for this session isn't available, so its transcript isn't known." };
+            const recorded = sidecar.data.session_id ?? null;
+            const own = claudeCommandSessionToken(process.command);
+            // A resumed Claude can rotate to a new session id; the registry's recorded rotation from the
+            // launched id to the sidecar's joins them too.
+            const rotated = this.db.prepare("SELECT 1 FROM sessions WHERE id = ? AND resume_token = ? AND resume_rotated_from = ?")
+                .get(session.id, recorded, own);
+            if (!recorded || !own || (own !== recorded && !rotated))
+                return { detail: mismatch };
+            return { path: sidecar.data.transcript_path ?? null };
+        }
+        catch {
+            return { detail: mismatch };
+        }
+    }
+    readEffort(nodeId) {
+        let row;
+        try {
+            row = this.db.prepare("SELECT effort, effort_choice FROM nodes WHERE id = ?").get(nodeId);
+        }
+        catch {
+            return null; // an older database without the columns
+        }
+        if (!row)
+            return null;
+        return resolveSeatEffort({ effort: row.effort, effortChoice: row.effort_choice });
+    }
+    /** Whether the seat's latest session is live now. Never a guess: an indeterminate probe is unknown. */
+    async runningState(nodeId) {
+        const session = this.latestSession(nodeId);
+        if (!session)
+            return { state: "no", detail: "no session recorded" };
+        if (TERMINAL_SESSION_STATUSES.has(session.status))
+            return { state: "no", detail: `latest session ${session.status}` };
+        const probe = await this.probeLiveness(session.session_name, "running is reported as unknown");
+        if ("code" in probe)
+            return { state: "unknown", detail: probe.message };
+        return probe.state === "present" ? { state: "yes" } : { state: "no", detail: "tmux session absent" };
+    }
     async setPermissions(input) {
         input = { ...input };
         const required = this.requireReason(input.reason);
@@ -143,6 +340,71 @@ export class SeatLifecycleService {
             return { ok: false, code: "permission_selection_refused", message: error.message };
         }
     }
+    /** `rig policy apply <name> --seat`: re-point an existing seat's own permission_policy. This writes
+     *  the raw ref and the provenance the instantiator would persist for the same member ref; restore,
+     *  resume and launches that read the seat's stored state use that provenance, while a launch from a
+     *  spec that declares a policy re-applies the spec's. The ref is validated exactly as a spec
+     *  member's is; the running process is untouched. */
+    async setPolicy(input) {
+        const required = this.requireReason(input.reason);
+        if (required)
+            return required;
+        const invalid = validatePermissionPolicyRef(input.ref, "permission_policy");
+        if (invalid)
+            return { ok: false, code: "invalid_policy", message: invalid };
+        const ref = input.ref;
+        // Built-ins and `none` resolve from the ref alone; only a custom file reads its declaring directory.
+        const attachment = resolvePermissionPolicyAttachment(ref, "", { readFile: () => { throw new Error("no declaring spec"); } });
+        if (attachment.origin === "custom") {
+            return {
+                ok: false, code: "invalid_policy",
+                message: `permission_policy: '${ref}' is a custom policy file, which resolves relative to the rig spec that declares it; a seat has no spec directory of its own.`,
+                guidance: "Use builtin:<name> or none here, or declare the custom ref in the rig spec.",
+            };
+        }
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const seat = this.describe(resolved);
+        if (resolved.entry.runtime === "terminal") {
+            return { ok: false, code: "invalid_policy", message: "permission_policy: not valid on terminal members (a terminal node is not an agent seat)" };
+        }
+        const row = this.db.prepare("SELECT permission_policy FROM nodes WHERE id = ?").get(seat.nodeId);
+        const from = row?.permission_policy ?? null;
+        const provenance = {
+            origin: attachment.origin,
+            resolvedTarget: attachment.resolvedTarget ?? null,
+            declaringDir: attachment.declaringDir ?? null,
+            launchPosture: attachment.launchPosture,
+        };
+        const before = this.rigRepo.getNodePolicyProvenance(seat.nodeId);
+        const changed = from !== ref || !before || before.origin !== provenance.origin || before.resolvedTarget !== provenance.resolvedTarget
+            || before.declaringDir !== provenance.declaringDir || before.launchPosture !== provenance.launchPosture;
+        if (changed) {
+            let persisted = null;
+            this.db.transaction(() => {
+                this.rigRepo.setNodePermissionPolicy(seat.nodeId, ref);
+                this.rigRepo.setNodePolicyProvenance(seat.nodeId, provenance);
+                persisted = this.eventBus.persistWithinTransaction({
+                    type: "node.policy_changed", rigId: seat.rigId, nodeId: seat.nodeId, logicalId: seat.logicalId,
+                    from, to: ref, launchPosture: attachment.launchPosture, reason: input.reason.trim(), operator: input.actor.trim(),
+                });
+            })();
+            if (persisted)
+                this.eventBus.notifySubscribers(persisted);
+        }
+        let selection = false;
+        // An unreadable selection refuses the launch by itself (NativePermissionStore.read); nothing to add here.
+        try {
+            selection = new NativePermissionStore(this.db).read(seat.nodeId) !== null;
+        }
+        catch { /* see above */ }
+        const effect = "Restore, resume and launches that read this seat's stored state use this policy, unless an explicit native selection (rig seat set-permissions) takes precedence. "
+            + "`rig up <rig name>` uses it; a launch from a spec that declares a policy replaces it with the spec's policy, which later restores then use. "
+            + "The running process and the rig spec file are unchanged; nothing was restarted."
+            + (selection ? " This seat has an explicit native permission selection, so that selection takes precedence at launch." : "");
+        return { ok: true, seat, from, to: ref, launchPosture: attachment.launchPosture, changed, effect };
+    }
     async stopSeat(input) {
         const required = this.requireReason(input.reason);
         if (required)
@@ -224,11 +486,14 @@ export class SeatLifecycleService {
             if ("code" in probed)
                 return probed;
             if (probed.state === "present") {
+                const latest = this.latestSession(resolved.nodeId);
                 return {
                     ok: false,
                     code: "session_live",
                     message: `Session "${name}" is alive in tmux (checked: tmux has-session, against EVERY session row clean would mutate) — clean only operates on dead seats.`,
-                    guidance: "Stop a live seat first with: rig seat stop",
+                    guidance: latest?.session_name === name && latest.origin !== "claimed"
+                        ? "Stop a live seat first with: rig seat stop"
+                        : `Check that session (rig capture -- ${shellQuote(name)}) and end it yourself if it is no longer needed, then retry; rig seat stop targets the seat's latest session, not a selected historical session.`,
                 };
             }
         }
@@ -264,19 +529,19 @@ export class SeatLifecycleService {
             this.eventBus.notifySubscribers(persisted);
         return { ok: true, seat, actions: { sessionsExited, bindingCleared: binding !== null } };
     }
-    /** Finish context delivery to the same fresh occupant after its native gate.
+    /** Finish context delivery to the same fresh or forked occupant after its native gate.
      * This never launches a process or replays an uncertain/finished delivery.
      */
-    async continueFreshStartup(seatRef) {
+    async continueStartup(seatRef) {
         const resolved = this.resolveSeat(seatRef);
         if ("code" in resolved)
             return resolved;
         const guard = this.tmuxAdapter.deliveryGuard;
         return guard
-            ? guard.lifecycle([resolved.nodeId], () => this.continueFreshStartupUnchecked(seatRef))
-            : this.continueFreshStartupUnchecked(seatRef);
+            ? guard.lifecycle([resolved.nodeId], () => this.continueStartupUnchecked(seatRef))
+            : this.continueStartupUnchecked(seatRef);
     }
-    async continueFreshStartupUnchecked(seatRef) {
+    async continueStartupUnchecked(seatRef) {
         const resolved = this.resolveSeat(seatRef);
         if ("code" in resolved)
             return resolved;
@@ -284,14 +549,15 @@ export class SeatLifecycleService {
         const node = this.rigRepo.getRig(seat.rigId)?.nodes.find((n) => n.id === seat.nodeId);
         const session = this.latestSession(seat.nodeId);
         const binding = this.sessionRegistry.getBindingForNode(seat.nodeId);
+        const pending = session && this.startupOrchestrator?.pendingStartupContext(seat.nodeId, session.id);
         if (!node || !session || !binding?.tmuxSession || !this.startupOrchestrator
-            || !this.startupOrchestrator.canContinueFresh(node.id, session.id)) {
-            return { ok: false, code: "continuation_unavailable", message: "No verified pending fresh-context delivery exists for this occupant. Refresh to inspect its actual state." };
+            || !pending) {
+            return { ok: false, code: "continuation_unavailable", message: "No verified pending startup-context delivery exists for this occupant. Refresh to inspect its actual state." };
         }
         const pane = await observeSolePane(this.tmuxAdapter, binding.tmuxSession);
         if (!pane.ok || pane.pane !== binding.tmuxPane)
             return { ok: false, code: "binding_changed", message: "The managed terminal binding changed; context was not delivered." };
-        const adapter = node.runtime ? this.runtimeAdapters[node.runtime] : undefined;
+        const adapter = seatAdapter(this.runtimeAdapters, node.runtime, session.community_harness);
         if (!adapter)
             return { ok: false, code: "runtime_adapter_missing", message: "The configured runtime adapter is unavailable." };
         const ready = await adapter.checkReady({ ...binding, cwd: node.cwd ?? "." });
@@ -305,16 +571,17 @@ export class SeatLifecycleService {
         // Recheck after the asynchronous native observation; startNode immediately
         // records pending before its first await, consuming the retained permission.
         if (this.latestSession(node.id)?.id !== session.id || this.sessionRegistry.getBindingForNode(node.id)?.tmuxPane !== pane.pane
-            || !this.startupOrchestrator.canContinueFresh(node.id, session.id))
+            || !this.stillPending(node.id, session.id, pending))
             return { ok: false, code: "continuation_unavailable", message: "Startup changed during the readiness check. Refresh." };
         const result = await this.startupOrchestrator.startNode({
             rigId: seat.rigId, nodeId: node.id, sessionId: session.id,
-            binding: { ...binding, cwd: node.cwd ?? ".", model: node.model ?? undefined, effort: node.effort ?? undefined, codexConfigProfile: node.codexConfigProfile ?? undefined },
+            binding: { ...binding, cwd: node.cwd ?? ".", model: node.model ?? undefined, effort: resolveSeatEffort(node).effective ?? undefined, codexConfigProfile: node.codexConfigProfile ?? undefined },
             adapter, plan: startup.context.plan, resolvedStartupFiles: startup.context.resolvedStartupFiles,
-            startupActions: startup.context.startupActions, isRestore: false,
-            sessionName: session.session_name, skipHarnessLaunch: true, continueFreshStartup: true, includeDurableObligations: true, allowFreshFallback: false,
+            startupActions: startup.context.startupActions, isRestore: pending.mode === "fork" && pending.isRestore,
+            sessionName: session.session_name, skipHarnessLaunch: true, continueFreshStartup: pending.mode === "fresh", includeDurableObligations: true, allowFreshFallback: false,
+            ...(pending.mode === "fork" ? { forkSource: { kind: "native_id", value: pending.parentToken } } : {}),
         });
-        return { ...result, message: result.ok ? "Configured context delivered to the existing fresh conversation." : result.errors.join("; ") };
+        return { ...result, message: result.ok ? "Configured context delivered to the existing conversation." : result.errors.join("; ") };
     }
     /**
      * Resolve a seat snapshot into current launch settings and persisted startup context.
@@ -342,7 +609,7 @@ export class SeatLifecycleService {
                 message: `Persisted startup context runtime '${startup.context.runtime}' does not match current node runtime '${node.runtime ?? "missing"}'.`,
             };
         }
-        const adapter = this.runtimeAdapters[node.runtime];
+        const adapter = seatAdapter(this.runtimeAdapters, node.runtime, this.latestSession(node.id)?.community_harness);
         if (!adapter) {
             return {
                 ok: false,
@@ -360,6 +627,13 @@ export class SeatLifecycleService {
      * mismatched sessions. Return its session row or a refusal, including unknown pane
      * observations, without stopping, repairing, or starting a tmux server.
      */
+    /** Whether the context found before the native check is still owed. A fork continuation needs the exact
+     *  same pending event: its child is verified against that attempt. A fresh continuation keeps main's
+     *  check (fresh context still pending for this occupant), so another pending event doesn't refuse it. */
+    stillPending(nodeId, sessionId, pending) {
+        const now = this.startupOrchestrator?.pendingStartupContext(nodeId, sessionId);
+        return pending.mode === "fork" ? now?.eventSeq === pending.eventSeq : now?.mode === "fresh";
+    }
     async validateFreshCollision(resolved, canonicalSessionName, stop) {
         const currentSession = this.latestSession(resolved.nodeId);
         const currentBinding = this.sessionRegistry.getBindingForNode(resolved.nodeId);
@@ -645,7 +919,7 @@ export class SeatLifecycleService {
                 newGeneration: null,
                 startupPolicyHash: startup.hash,
                 model: node.model,
-                effort: node.effort ?? null,
+                effort: resolveSeatEffort(node).effective,
                 reason: input.reason,
                 operator: input.operator,
                 errors: ["new occupant generation was not persisted"],
@@ -666,7 +940,7 @@ export class SeatLifecycleService {
                 ...launch.binding,
                 cwd: node.cwd ?? ".",
                 model: node.model ?? undefined,
-                effort: node.effort ?? undefined,
+                effort: resolveSeatEffort(node).effective ?? undefined,
                 codexConfigProfile: node.codexConfigProfile ?? undefined,
                 launchPosture,
             },
@@ -688,7 +962,7 @@ export class SeatLifecycleService {
                 newGeneration: generation,
                 startupPolicyHash: startup.hash,
                 model: node.model,
-                effort: node.effort ?? null,
+                effort: resolveSeatEffort(node).effective,
                 reason: input.reason,
                 operator: input.operator,
                 errors: startupResult.errors,
@@ -750,7 +1024,7 @@ export class SeatLifecycleService {
                 nativeSessionId,
                 ...(nativeSessionId ? {} : { nativeSessionIdReason: "scrape_miss" }),
                 model: node.model,
-                effort: node.effort ?? null,
+                effort: resolveSeatEffort(node).effective,
                 startupPolicyHash: startup.hash,
                 reason: input.reason.trim(),
                 operator: input.operator ?? null,
@@ -782,7 +1056,7 @@ export class SeatLifecycleService {
             sessionId: launch.session.id,
             generation,
             model: node.model,
-            effort: node.effort ?? undefined,
+            effort: resolveSeatEffort(node).effective ?? undefined,
             startupPolicyHash: startup.hash,
             supersededSessionIds,
             warnings: startupResult.warnings,
@@ -887,13 +1161,15 @@ export class SeatLifecycleService {
             ?? this.rigRepo.getNodePolicyProvenance(node.id)?.launchPosture
             ?? this.rigRepo.getRigPolicyProvenance(seat.rigId)?.launchPosture
             ?? "floor";
+        // OPR.0.7.0.7: an in-place restart is a managed continuation, so it relaunches with the seat's saved effort.
+        const savedEffort = resolveSeatEffort(node);
         return {
             seat, sessionId: session.id, sessionName: session.session_name,
-            saved: { model: node.model ?? null, effort: node.effort ?? null, codexConfigProfile: node.codexConfigProfile ?? null },
+            saved: { model: node.model ?? null, effort: savedEffort.effective, codexConfigProfile: node.codexConfigProfile ?? null, effortSource: savedEffort.source },
             binding: {
                 ...binding, cwd: node.cwd ?? ".",
                 ...(node.model ? { model: node.model } : {}),
-                ...(node.effort ? { effort: node.effort } : {}),
+                ...(savedEffort.effective ? { effort: savedEffort.effective } : {}),
                 ...(node.codexConfigProfile ? { codexConfigProfile: node.codexConfigProfile } : {}),
                 launchPosture, kernelAuthority: permissionOverride.kernelAuthority, teamPermissionDefault: permissionOverride.teamPermissionDefault,
                 nonInterruptive: this.rigRepo.getRigNonInterruptive(seat.rigId),
@@ -1164,7 +1440,7 @@ export class SeatLifecycleService {
         };
     }
     latestSession(nodeId) {
-        const row = this.db.prepare("SELECT id, session_name, status, origin FROM sessions WHERE node_id = ? ORDER BY id DESC LIMIT 1").get(nodeId);
+        const row = this.db.prepare(`SELECT id, session_name, status, origin, ${sessionCommunityHarnessSelect(this.db, "sessions")} AS community_harness FROM sessions WHERE node_id = ? ORDER BY id DESC LIMIT 1`).get(nodeId);
         return row ?? null;
     }
     /** The ONE resolution path, mirroring SeatStatusService.findMatches semantics
@@ -1239,4 +1515,23 @@ function isOptionalOneOf(value, allowed) {
 function isStringArrayOf(value, allowed) {
     return Array.isArray(value) && value.every((entry) => isOneOf(entry, allowed));
 }
+/** One line naming where the four values agree, and where they can't be seen. */
+function effortSummary(saved, emitted, observed) {
+    const savedText = saved.effective ? `${saved.effective} (${saved.source === "seat_choice" ? "seat choice" : "authored"})` : "no flag (the runtime's own default)";
+    if (emitted.state !== "observed")
+        return `Saved: ${savedText}. Launch: unknown (${emitted.detail}) Native effort: NOT VERIFIED.`;
+    const launch = emitted.value ?? "no flag";
+    const launchNote = emitted.matchesSaved ? "" : " This differs from the saved value: it applies at the seat's next managed continuation.";
+    if (observed.state !== "observed")
+        return `Saved: ${savedText}. Launch sent: ${launch}.${launchNote} Native effort: NOT VERIFIED (${observed.detail})`;
+    const sent = observed.matchesEmitted === false
+        ? `${observed.value}, not the ${launch} the launch sent (changed or overridden inside the session)`
+        : observed.value;
+    const verdict = observed.outcome === "accepted" ? "accepted by the service for that turn"
+        : observed.outcome === "rejected" ? `REJECTED (${observed.detail})`
+            : observed.outcome === "failed" || observed.outcome === "interrupted" ? (observed.detail ?? "not judged").replace(/\.$/, "")
+                : observed.outcome === "pending" ? "its turn hasn't finished, so not yet known whether it was taken"
+                    : "applied level NOT VERIFIED (whether this is after any model fallback isn't shown)";
+    return `Saved: ${savedText}. Launch sent: ${launch}.${launchNote} The session sent ${sent} with its latest turn (${observed.source}, ${observed.at}): ${verdict}.`;
+}
 //# sourceMappingURL=seat-lifecycle-service.js.map