@teamvibe/poller 0.8.2-rc.2 → 0.8.3-rc.4

package/dist/claude-spawner.js

@@ -1,16 +1,24 @@
+import { logPoolFetch, logPoolUsageWrite, poolInfo, poolLabel } from './pool-logging.js';
+import { accountUsageTelemetry, emitCandidateUsage, poolRunTelemetry } from './pool-telemetry.js';
 import { spawn } from 'child_process';
 import { join } from 'path';
 import { readFileSync, existsSync } from 'fs';
+import { mkdir } from 'fs/promises';
 import { WebClient } from '@slack/web-api';
 import { config } from './config.js';
 import { logger } from './logger.js';
 import { getBaseBrainPath } from './brain-manager.js';
 import { getPollerId } from './auth-provider.js';
 import { sendSlackMessage } from './slack-client.js';
-import { emitError } from './event-queue.js';
+import { emitError, emitEvent } from './event-queue.js';
 import { createWorktree, removeWorktree, isWorktreeIsolationEnabled } from './worktree-manager.js';
 import { fetchSecretsForSpawn, buildSecretsReminder } from './secrets-client.js';
 import { fetchConfigForSpawn } from './config-client.js';
+import { parseClaudeRateLimitInfo } from './claude-rate-limit.js';
+import { parseClaudeQuotaFailure } from './claude-quota.js';
+import { accountPin, preparePool, fetchRuntimePool, validateAccount, poolDeferredError, PoolDeferredError } from './subscription-runtime.js';
+import { selectPoolForResolvedModel } from './subscription-pool.js';
+import { isQuotaPaused, QuotaPausedError } from './quota-pause.js';
 /**
  * Maps tool names (or prefixes) to human-readable status messages.
  * More specific patterns are checked first.
@@ -462,6 +470,17 @@ export function buildSpawnEnv(params) {
         // drops against this var so they land somewhere still being
         // watched after the session (and worktree) is gone. See tv#265.
         POLLER_BRAIN_PATH: params.brainPath,
+        ...(params.subscriptionAccount ? {
+            CLAUDE_CODE_OAUTH_TOKEN: params.subscriptionAccount.credential.unwrap(),
+            ANTHROPIC_API_KEY: undefined,
+            ANTHROPIC_AUTH_TOKEN: undefined,
+            ANTHROPIC_BASE_URL: undefined,
+            ANTHROPIC_CUSTOM_HEADERS: undefined,
+            CLAUDE_CODE_OAUTH_TOKEN_FILE: undefined,
+            CLAUDE_CODE_USE_BEDROCK: undefined,
+            CLAUDE_CODE_USE_VERTEX: undefined,
+            CLAUDE_CODE_USE_FOUNDRY: undefined,
+        } : {}),
     };
 }
 export function buildPrompt(msg, contextHint) {
@@ -737,7 +756,51 @@ function resolveTypingStatusDetail(event, assistantText) {
 export function resolveTypingStatus(event, assistantText) {
     return resolveTypingStatusDetail(event, assistantText)?.text ?? null;
 }
-async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirstMessage = true, lastMessageTs, onMessageSent, typingIndicator) {
+function existingResultMetrics(event, pooled) {
+    // Preserve the legacy extractor exactly for non-pool spawns.
+    if (!pooled)
+        return {
+            duration_ms: event.duration_ms || 0,
+            duration_api_ms: event.duration_api_ms || 0,
+            num_turns: event.num_turns || 0,
+            total_cost_usd: event.total_cost_usd || 0,
+            input_tokens: event.usage?.input_tokens || 0,
+            output_tokens: event.usage?.output_tokens || 0,
+            cache_read_input_tokens: event.usage?.cache_read_input_tokens || 0,
+            cache_creation_input_tokens: event.usage?.cache_creation_input_tokens || 0,
+            model: Object.keys(event.modelUsage || {})[0] || 'unknown',
+        };
+    const result = {};
+    for (const key of ['duration_ms', 'duration_api_ms', 'num_turns', 'total_cost_usd']) {
+        if (typeof event[key] === 'number' && Number.isFinite(event[key]) && event[key] >= 0)
+            result[key] = event[key];
+    }
+    for (const key of ['input_tokens', 'output_tokens', 'cache_read_input_tokens', 'cache_creation_input_tokens']) {
+        if (typeof event.usage?.[key] === 'number' && Number.isFinite(event.usage[key]) && event.usage[key] >= 0)
+            result[key] = event.usage[key];
+    }
+    const model = Object.keys(event.modelUsage || {})[0];
+    if (model)
+        result.model = model;
+    return result;
+}
+// Context occupancy is one model call's input, never the accumulated result usage.
+function resultMetrics(event, pooled, lastAssistant) {
+    const metrics = existingResultMetrics(event, pooled);
+    const usage = lastAssistant?.usage;
+    const inputs = [usage?.input_tokens, usage?.cache_read_input_tokens, usage?.cache_creation_input_tokens];
+    if (inputs.every(value => typeof value === 'number' && Number.isFinite(value) && value >= 0)) {
+        const tokens = inputs.reduce((sum, value) => sum + value, 0);
+        if (Number.isFinite(tokens))
+            metrics.context_tokens = tokens;
+    }
+    const model = lastAssistant?.model ?? Object.keys(event.modelUsage || {})[0];
+    const window = event.modelUsage?.[model]?.contextWindow;
+    if (typeof window === 'number' && Number.isFinite(window) && window > 0)
+        metrics.context_window = window;
+    return metrics;
+}
+async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirstMessage = true, lastMessageTs, onMessageSent, typingIndicator, runtime) {
     const slackContext = msg.response_context.slack;
     const isCronMessage = msg.source === 'cron';
     const isMaintenance = msg.source === 'maintenance';
@@ -757,7 +820,7 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
     // the more informative signal. Logic extracted into buildContextHint for
     // unit testability — the counters are injected so tests don't need to mock
     // the Slack WebClient module.
-    const contextHint = await buildContextHint({
+    const contextHint = runtime?.resumePending ? undefined : await buildContextHint({
         isFirstMessage,
         lastMessageTs,
         slack: slackContext,
@@ -779,17 +842,25 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
     // Fetch scoped model config for this spawn — same hoisting rationale as
     // secrets above. Fail-soft: returns {} on any error, which resolveModel
     // treats as "nothing at this tier" and falls through to the env default.
-    const ddbModelConfig = await fetchConfigForSpawn({
+    const ddbModelConfig = runtime ? {} : await fetchConfigForSpawn({
         pollerId: getPollerId() || '',
         workspaceId: msg.teamvibe.workspaceId,
         channelId: msg.teamvibe.channelId,
     });
+    if (runtime?.account)
+        await validateAccount(runtime.account, runtime.resolved);
     return new Promise((resolve) => {
-        const prompt = buildPrompt(msg, contextHint);
+        // Preparation above awaits remote config/context. Another thread may
+        // have exhausted the shared account meanwhile. No awaits before spawn.
+        if (!runtime?.account && isQuotaPaused())
+            throw new QuotaPausedError();
+        if (runtime?.shouldStop())
+            throw new PoolDeferredError();
+        const prompt = runtime?.resumePending ? 'Continue the pending work in this session from the last completed action. Do not repeat completed actions or messages.' : buildPrompt(msg, contextHint);
         // teamvibe.ai#293 bug 2: decides plain-text vs. stream-json stdin. Empty
         // `extraArgs`/single-chunk `stdinChunks` (the overwhelming majority of
         // sessions — no inline images) reproduces the exact prior behavior.
-        const spawnStdinPlan = buildSpawnStdinPlan(prompt, msg.inlineImages);
+        const spawnStdinPlan = buildSpawnStdinPlan(prompt, runtime?.resumePending ? undefined : msg.inlineImages);
         // MCP server config passed via --mcp-config flag (no temp files needed)
         const mcpServerPath = join(getBaseBrainPath(), 'mcp', 'slack.mjs');
         const teamvibeApiServerPath = join(getBaseBrainPath(), 'mcp', 'teamvibe-api.mjs');
@@ -819,10 +890,14 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
         // > CLAUDE_MODEL env default. See resolveModel's docstring for why
         // settings.json stays on top (known, accepted blind spot).
         const brainSettingsModel = typeof brainSettings['model'] === 'string' ? brainSettings['model'] : undefined;
-        const { model, modelSource } = resolveModel(brainSettingsModel, ddbModelConfig, config.CLAUDE_MODEL);
+        const { model, modelSource } = runtime?.resolved ?? resolveModel(brainSettingsModel, ddbModelConfig, config.CLAUDE_MODEL);
         if (model) {
             args.push('--model', model);
-            sessionLog.info(`Using model: ${model} (source: ${modelSource ?? 'unknown'})`);
+            // The service normalized the scoped config; only describe that mapping
+            // when this tier actually supplied the flag (brain settings stay verbatim).
+            const normalizedFrom = runtime?.modelNormalizedFrom ?? (model === ddbModelConfig.model && modelSource === ddbModelConfig.modelSource
+                ? ddbModelConfig.modelNormalizedFrom : undefined);
+            sessionLog.info(`Using model: ${model} (source: ${modelSource ?? 'unknown'})${normalizedFrom ? ` (normalized from ${normalizedFrom})` : ''}`);
         }
         // Inbox protocol: instruct Claude to check for mid-task messages (thread-scoped)
         const inboxNewDir = `.inbox/${msg.thread_id}/new`;
@@ -864,13 +939,15 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
         const envPath = config.PERSISTENT_STORAGE_PATH
             ? `${config.PERSISTENT_STORAGE_PATH}/bin:${process.env['PATH'] || ''}`
             : process.env['PATH'];
+        if (runtime?.account)
+            poolInfo(sessionLog, `token target account=${poolLabel(runtime.account)} session=${JSON.stringify(sessionId ?? 'new')} credential=selected account token`);
         const proc = spawn(config.CLAUDE_CLI_PATH, args, {
             cwd,
             env: buildSpawnEnv({
                 spawnSecretsEnv: spawnSecrets.env.unwrap(),
                 processEnv: process.env,
                 envPath,
-                claudeConfigDir: getBaseBrainPath(),
+                claudeConfigDir: runtime?.claudeConfigDir ?? getBaseBrainPath(),
                 persistentStoragePath: config.PERSISTENT_STORAGE_PATH,
                 slackContext,
                 teamvibeApiUrl: config.TEAMVIBE_API_URL,
@@ -881,6 +958,7 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
                 teamvibePollerId: getPollerId() || '',
                 inboxThreadId: msg.thread_id,
                 brainPath,
+                subscriptionAccount: runtime?.account,
             }),
             stdio: ['pipe', 'pipe', 'pipe'],
             // teamvibeai/teamvibe.ai#73: run `claude` (via setsid) as the leader of
@@ -903,7 +981,11 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
         let stdout = '';
         let stderr = '';
         let stdoutBuffer = '';
+        // Retain CLI error/result evidence, not the full parsed assistant/tool stream.
+        const failureEvents = [];
+        let rateLimitInfo;
         let metrics;
+        let lastAssistant;
         // teamvibe.ai#284 (poller-brain#235): end-of-turn guard state — tracked
         // across the whole run so the `close` handler can tell poller.ts whether
         // a successful turn actually delivered anything to Slack.
@@ -958,6 +1040,12 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
             for (const line of lines) {
                 try {
                     const event = JSON.parse(line);
+                    if (event?.type === 'rate_limit_event') {
+                        rateLimitInfo = parseClaudeRateLimitInfo(event.rate_limit_info);
+                    }
+                    if (event?.type === 'result' || event?.type === 'error' || (event?.type === 'assistant' && event.error)) {
+                        failureEvents.push(event);
+                    }
                     // Capture the pre-event activity timestamp BEFORE the unconditional
                     // overwrite below — needed to compute the "original 10min deadline
                     // from silence start" for a compact_boundary line, since that line
@@ -993,20 +1081,12 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
                         sessionLog.info('[Watchdog] Activity resumed after compaction, reverting to normal idle watchdog');
                         compactionKillDeadline = null;
                     }
+                    if (event.type === 'assistant')
+                        lastAssistant = { usage: event.message?.usage, model: event.message?.model };
                     // Extract metrics from result event
                     if (event.type === 'result') {
-                        metrics = {
-                            duration_ms: event.duration_ms || 0,
-                            duration_api_ms: event.duration_api_ms || 0,
-                            num_turns: event.num_turns || 0,
-                            total_cost_usd: event.total_cost_usd || 0,
-                            input_tokens: event.usage?.input_tokens || 0,
-                            output_tokens: event.usage?.output_tokens || 0,
-                            cache_read_input_tokens: event.usage?.cache_read_input_tokens || 0,
-                            cache_creation_input_tokens: event.usage?.cache_creation_input_tokens || 0,
-                            model: Object.keys(event.modelUsage || {})[0] || 'unknown',
-                        };
-                        sessionLog.info(`[Metrics] Cost: $${metrics.total_cost_usd.toFixed(4)}, ` +
+                        metrics = resultMetrics(event, !!runtime?.account, lastAssistant);
+                        sessionLog.info(`[Metrics] Cost: $${metrics.total_cost_usd?.toFixed(4) ?? 'unknown'}, ` +
                             `Duration: ${metrics.duration_ms}ms, ` +
                             `Turns: ${metrics.num_turns}, ` +
                             `Tokens: ${metrics.input_tokens}in/${metrics.output_tokens}out`);
@@ -1169,8 +1249,29 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
             // not something shutdown() awaits.
             void sweepProcessGroup(proc, CLOSE_SWEEP_GRACE_MS, { unref: true });
             const killReason = killReasonByProc.get(proc);
+            // Preserve a final unterminated stream-json error/result and its metrics.
+            if (stdoutBuffer.trim()) {
+                try {
+                    const event = JSON.parse(stdoutBuffer);
+                    if (event?.type === 'rate_limit_event') {
+                        rateLimitInfo = parseClaudeRateLimitInfo(event.rate_limit_info);
+                    }
+                    failureEvents.push(event);
+                    if (event?.type === 'assistant')
+                        lastAssistant = { usage: event.message?.usage, model: event.message?.model };
+                    if (event?.type === 'result')
+                        metrics = resultMetrics(event, !!runtime?.account, lastAssistant);
+                }
+                catch {
+                    // Non-JSON stdout is not trusted CLI error evidence.
+                }
+            }
+            const quota = parseClaudeQuotaFailure({ exitCode: code, stderr, events: failureEvents, rateLimitInfo }, new Date());
             const result = {
-                success: code === 0,
+                success: code === 0 && !quota,
+                attemptedSessionId: sessionId,
+                ...(quota ? { quota } : {}),
+                ...(rateLimitInfo ? { rateLimitInfo } : {}),
                 output: stdout,
                 exitCode: code,
                 metrics,
@@ -1191,6 +1292,9 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
             else if (killReason === 'zombie') {
                 result.error = 'Killed as zombie process (stale session lock)';
             }
+            else if (quota) {
+                result.error = 'Claude subscription usage limit reached.';
+            }
             else if (code !== 0) {
                 // `signal` matters here specifically: a process terminated by a
                 // signal reports `code: null`, not a numeric exit code — e.g. a
@@ -1220,6 +1324,8 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
                 output: stdout,
                 exitCode: null,
                 error: error.message,
+                ...(rateLimitInfo ? { rateLimitInfo } : {}),
+                attemptedSessionId: sessionId,
                 sawSendMessageCall,
                 lastPlainTextContent,
             });
@@ -1246,9 +1352,11 @@ function shouldIsolateInWorktree(msg) {
  * createSession() placeholder forever and the thread's next message does
  * `--resume <id-claude-code-never-used>`, which fails 100% of the time.
  * (teamvibe.ai#77, DevGuru review round)
+ * Quota failures also report the attempted ID, even on the first turn, so
+ * later pool orchestration can continue that same session (#401).
  */
 export function finalizeSpawnResult(retryResult, isFirstMessage, effectiveSessionId) {
-    if (isFirstMessage && retryResult.success && effectiveSessionId) {
+    if (isFirstMessage && (retryResult.success || retryResult.quota) && effectiveSessionId) {
         return { ...retryResult, newSessionId: effectiveSessionId };
     }
     return retryResult;
@@ -1282,14 +1390,14 @@ export async function spawnClaudeCode(msg, sessionLog, cwd, sessionId, isFirstMe
         const result = await runClaudeCode(msg, sessionLog, effectiveCwd, cwd, effectiveSessionId, isFirstMessage, lastMessageTs, onMessageSent, typingIndicator);
         // If --resume failed, retry as a fresh session (session files may have been lost on container restart)
         let retryResult = result;
-        if (!result.success && effectiveSessionId && !isFirstMessage) {
+        if (!result.success && !result.quota && effectiveSessionId && !isFirstMessage) {
             sessionLog.info('Resume failed, retrying as fresh session (session files may have been lost)');
             retryResult = await runClaudeCode(msg, sessionLog, effectiveCwd, cwd, effectiveSessionId, true, lastMessageTs, onMessageSent, typingIndicator);
         }
         // If session ID is "already in use" (stale lock file), retry immediately with a
         // fresh ID — no zombie kill first. Zombie cleanup is #73's concern, not spawn
         // retry's (teamvibe.ai#77 acceptance criteria: "no zombie kill needed first").
-        if (!retryResult.success && effectiveSessionId && retryResult.error?.includes('already in use')) {
+        if (!retryResult.success && !retryResult.quota && effectiveSessionId && retryResult.error?.includes('already in use')) {
             sessionLog.info('Session ID already in use (stale lock), retrying with fresh session ID');
             const { randomUUID } = await import('crypto');
             const freshId = randomUUID();
@@ -1306,6 +1414,196 @@ export async function spawnClaudeCode(msg, sessionLog, cwd, sessionId, isFirstMe
         }
     }
 }
+// Configured-pool orchestration is deliberately separate from legacy spawns.
+export async function spawnPoolClaudeCode(msg, sessionLog, cwd, sessionId, isFirstMessage = true, lastMessageTs, onMessageSent, typingIndicator, poolRuntime) {
+    // Worktree isolation: spawned (non-foreground) sessions run in
+    // <brain>/.worktrees/<thread_id>/ so the sync-watchdog's reset --hard on
+    // the main working dir can't trample in-flight writes or pre-push commits.
+    // See teamvibe.ai#120. cwd remains the main brain path on fallback / failure.
+    let effectiveCwd = cwd;
+    let loggingPool = false;
+    let retainWorktree = poolRuntime?.pin?.resumePending === true;
+    const poolAttempts = poolRuntime?.attempts?.slice(-1000) ?? [];
+    let worktreeOwner;
+    if (poolRuntime?.pin?.resumePending && poolRuntime.pin.effectiveCwd) {
+        const pinnedCwd = poolRuntime.pin.effectiveCwd;
+        if (pinnedCwd !== cwd && pinnedCwd !== join(cwd, '.worktrees', msg.thread_id))
+            throw new PoolDeferredError();
+        if (!existsSync(pinnedCwd)) {
+            sessionLog.warn(`[Worktree] Pinned worktree missing; recreating ${pinnedCwd} for pending session ${sessionId ?? 'unknown'}`);
+            try {
+                if (pinnedCwd === cwd)
+                    await mkdir(cwd, { recursive: true });
+                else
+                    await createWorktree(cwd, msg.thread_id);
+            }
+            catch {
+                sessionLog.warn('[Worktree] Pinned worktree recreation failed; pending work retained for the next recheck');
+                throw new PoolDeferredError();
+            }
+        }
+        effectiveCwd = pinnedCwd;
+        if (effectiveCwd !== cwd)
+            worktreeOwner = { brainPath: cwd, id: msg.thread_id };
+    }
+    else if (shouldIsolateInWorktree(msg)) {
+        try {
+            effectiveCwd = await createWorktree(cwd, msg.thread_id);
+            worktreeOwner = { brainPath: cwd, id: msg.thread_id };
+            sessionLog.info(`[Worktree] Spawned session running in ${effectiveCwd}`);
+        }
+        catch (err) {
+            sessionLog.warn(`[Worktree] Failed to create worktree, falling back to main brain dir: ${err instanceof Error ? err.message : err}`);
+        }
+    }
+    try {
+        // First-message spawns always mint a fresh session ID rather than
+        // recycling whatever placeholder DynamoDB currently holds for this
+        // thread (teamvibe.ai#77) — --resume on non-first messages is unchanged.
+        let effectiveSessionId = sessionId;
+        if (isFirstMessage && !poolRuntime?.pin?.resumePending) {
+            const { randomUUID } = await import('crypto');
+            effectiveSessionId = randomUUID();
+        }
+        const fetchedPool = poolRuntime ? poolRuntime.pool ?? await fetchRuntimePool(msg) : undefined;
+        loggingPool = fetchedPool !== undefined && fetchedPool.kind !== 'no_accounts_configured';
+        if (fetchedPool)
+            logPoolFetch(sessionLog, fetchedPool);
+        const scoped = poolRuntime ? await fetchConfigForSpawn({ pollerId: getPollerId() || '', workspaceId: msg.teamvibe.workspaceId, channelId: msg.teamvibe.channelId }) : undefined;
+        const settings = readBrainSettings(effectiveCwd);
+        const resolved = fetchedPool?.kind !== 'no_accounts_configured' && poolRuntime?.pin?.workspaceId === msg.teamvibe.workspaceId
+            ? { model: poolRuntime.pin.model, modelSource: poolRuntime.pin.modelSource }
+            : resolveModel(typeof settings['model'] === 'string' ? settings['model'] : undefined, scoped ?? {}, config.CLAUDE_MODEL);
+        const prepared = poolRuntime ? await preparePool(msg, resolved, poolRuntime.pin, fetchedPool, sessionLog) : undefined;
+        const claudeConfigDir = poolRuntime?.pin?.resumePending ? poolRuntime.pin.claudeConfigDir ?? getBaseBrainPath() : getBaseBrainPath();
+        const modelNormalizedFrom = scoped?.model === resolved.model && scoped?.modelSource === resolved.modelSource
+            ? scoped?.modelNormalizedFrom : undefined;
+        const runtime = poolRuntime ? { resolved, modelNormalizedFrom, claudeConfigDir, account: prepared?.account, shouldStop: poolRuntime.shouldStop, resumePending: fetchedPool?.kind !== 'no_accounts_configured' && poolRuntime.pin?.resumePending === true } : undefined;
+        let sawSendMessageCall = poolRuntime?.pin?.resumePending === true && poolRuntime.pin.sawSendMessageCall === true;
+        const attempt = async (id, first) => {
+            if (prepared?.account && id && poolRuntime) {
+                try {
+                    await poolRuntime.persist(id, { ...accountPin(prepared.account, resolved), effectiveCwd, claudeConfigDir, resumePending: runtime?.resumePending, sawSendMessageCall }, poolAttempts);
+                }
+                catch {
+                    throw new PoolDeferredError();
+                }
+            }
+            // Only a quota continuation shares delivery history. A fresh-session
+            // fallback must report the fresh attempt's delivery flags independently.
+            if (!runtime?.resumePending)
+                sawSendMessageCall = false;
+            const result = await runClaudeCode(msg, sessionLog, effectiveCwd, cwd, id, runtime?.resumePending ? false : first, lastMessageTs, onMessageSent, typingIndicator, runtime);
+            sawSendMessageCall ||= result.sawSendMessageCall === true;
+            if (prepared?.account) {
+                if (poolAttempts.length >= 1000)
+                    poolAttempts.shift();
+                poolAttempts.push({ workspaceId: prepared.account.workspaceId, accountId: prepared.account.accountId, credentialVersion: prepared.account.credentialVersion, accountLabel: prepared.account.label ?? prepared.account.accountId, observedAt: Date.now(), rateLimitInfo: result.rateLimitInfo, sessionId: id, model: resolved.model ?? result.metrics?.model, success: result.success, exitCode: result.exitCode, killedByPoller: result.killedByPoller, quota: result.quota, metrics: result.metrics });
+                emitEvent('pool.account_attempted', msg.teamvibe.channelId, { workspaceId: msg.teamvibe.workspaceId, threadId: msg.thread_id, ...poolRunTelemetry(poolAttempts, poolRuntime?.quotaDeferEpisodes) });
+                if (result.success && id && poolRuntime) {
+                    // Complete the inbox before any fallible post-inference store writes.
+                    // The loop retains bookkeeping independently of the original prompt.
+                    const bookkeepingComplete = await poolRuntime.complete(id, { ...accountPin(prepared.account, resolved), effectiveCwd, claudeConfigDir, resumePending: false }, poolAttempts, result.rateLimitInfo);
+                    if (bookkeepingComplete !== false)
+                        await emitCandidateUsage(msg, [prepared.account], prepared.store);
+                    retainWorktree = false;
+                    return result;
+                }
+                if (result.quota && !result.killedByPoller) {
+                    runtime.resumePending = true;
+                    retainWorktree = true;
+                }
+                // A failure in one store must not prevent the other stores from
+                // retaining the attempt. Selection waits for all writes before switching.
+                const writes = [];
+                if (result.quota && !result.killedByPoller)
+                    writes.push(logPoolUsageWrite(sessionLog, prepared.account, result.quota.window ? { rateLimitType: result.quota.window } : undefined, () => prepared.store.recordQuota(prepared.account, result.quota, Date.now(), { expireFutureObservations: true }), 'quota'));
+                if (result.rateLimitInfo)
+                    writes.push(logPoolUsageWrite(sessionLog, prepared.account, result.rateLimitInfo, () => prepared.store.recordPassive(prepared.account, result.rateLimitInfo, Date.now(), { expireFutureObservations: true })));
+                if (id && poolRuntime)
+                    writes.push(poolRuntime.persist(id, { ...accountPin(prepared.account, resolved), effectiveCwd, claudeConfigDir, resumePending: runtime?.resumePending, sawSendMessageCall }, poolAttempts));
+                const outcomes = await Promise.allSettled(writes);
+                if (outcomes.some(outcome => outcome.status === 'rejected'))
+                    throw new PoolDeferredError();
+            }
+            return result;
+        };
+        const attemptedAccounts = new Set();
+        let switched = false;
+        const finishQuota = async (initial) => {
+            let result = initial;
+            while (prepared?.account && result.quota && !result.killedByPoller && poolRuntime && runtime) {
+                attemptedAccounts.add(prepared.account.accountId);
+                if (poolRuntime.shouldStop() || attemptedAccounts.size >= 1000)
+                    throw new PoolDeferredError();
+                prepared.pool = await fetchRuntimePool(msg);
+                logPoolFetch(sessionLog, prepared.pool);
+                if (prepared.pool.kind === 'ready')
+                    await emitCandidateUsage(msg, prepared.pool.accounts, prepared.store);
+                // Reactive evidence was persisted by attempt() before choosing another account.
+                if (prepared.pool.kind === 'ready')
+                    for (const account of prepared.pool.accounts) {
+                        if (attemptedAccounts.has(account.accountId))
+                            poolInfo(sessionLog, `skipped account=${poolLabel(account)} reason=already exhausted in this session`);
+                    }
+                const remaining = prepared.pool.kind === 'ready' ? prepared.pool.accounts.filter(a => !attemptedAccounts.has(a.accountId)) : [];
+                const selected = await selectPoolForResolvedModel(resolved, { workspaceId: msg.teamvibe.workspaceId, pool: remaining.length && prepared.pool.kind === 'ready' ? { ...prepared.pool, accounts: remaining } : prepared.pool, store: prepared.store, now: Date.now(), log: sessionLog, logAllExhausted: remaining.length === 0 });
+                if (selected.kind !== 'selected' || attemptedAccounts.has(selected.account.accountId))
+                    throw await poolDeferredError(prepared.pool, resolved, prepared.store, undefined, remaining.length ? sessionLog : undefined);
+                effectiveSessionId = result.attemptedSessionId ?? effectiveSessionId;
+                if (!effectiveSessionId)
+                    throw new PoolDeferredError();
+                const fromAccount = prepared.account;
+                poolInfo(sessionLog, `switch from=${poolLabel(fromAccount)} to=${poolLabel(selected.account)} session=${JSON.stringify(effectiveSessionId)}`);
+                prepared.account = selected.account;
+                runtime.account = selected.account;
+                runtime.resumePending = true;
+                switched = true;
+                const selectedUsage = await prepared.store.read(selected.account).catch(() => ({ reactive: [], passive: undefined }));
+                emitEvent('pool.account_switched', msg.teamvibe.channelId, { workspaceId: msg.teamvibe.workspaceId, threadId: msg.thread_id, ...poolRunTelemetry(poolAttempts, poolRuntime.quotaDeferEpisodes), ...accountUsageTelemetry(selected.account, selectedUsage), lastRateLimitInfo: selectedUsage.passive?.rateLimitInfo, observedAt: selectedUsage.passive?.observedAt, fromAccountId: fromAccount.accountId, fromAccountLabel: fromAccount.label ?? fromAccount.accountId, model: resolved.model, chainLength: poolAttempts.length + 1, switchedAccounts: true });
+                result = await attempt(effectiveSessionId, false);
+                sawSendMessageCall ||= result.sawSendMessageCall === true;
+            }
+            return { ...result, sawSendMessageCall, ...(prepared?.account ? { poolAttempts } : {}) };
+        };
+        const result = await finishQuota(await attempt(effectiveSessionId, isFirstMessage));
+        let replacedSessionId = false;
+        // If --resume failed, retry as a fresh session (session files may have been lost on container restart)
+        let retryResult = result;
+        if (!runtime?.resumePending && !switched && !result.success && !result.quota && effectiveSessionId && !isFirstMessage) {
+            sessionLog.info('Resume failed, retrying as fresh session (session files may have been lost)');
+            retryResult = await finishQuota(await attempt(effectiveSessionId, true));
+        }
+        // If session ID is "already in use" (stale lock file), retry immediately with a
+        // fresh ID — no zombie kill first. Zombie cleanup is #73's concern, not spawn
+        // retry's (teamvibe.ai#77 acceptance criteria: "no zombie kill needed first").
+        if (!runtime?.resumePending && !switched && !retryResult.success && !retryResult.quota && effectiveSessionId && retryResult.error?.includes('already in use')) {
+            sessionLog.info('Session ID already in use (stale lock), retrying with fresh session ID');
+            const { randomUUID } = await import('crypto');
+            const freshId = randomUUID();
+            effectiveSessionId = freshId;
+            replacedSessionId = true;
+            retryResult = await finishQuota(await attempt(freshId, true));
+        }
+        return finalizeSpawnResult(retryResult, isFirstMessage || replacedSessionId, effectiveSessionId);
+    }
+    catch (error) {
+        if (error instanceof PoolDeferredError) {
+            if (loggingPool)
+                poolInfo(sessionLog, `work deferred eligibleAt=${new Date(error.eligibleAt).toISOString()} providerResetAt=${error.resetAt ?? 'unknown'}`);
+            retainWorktree = true;
+            error.attempts = poolAttempts;
+        }
+        throw error;
+    }
+    finally {
+        if (worktreeOwner && !retainWorktree) {
+            removeWorktree(worktreeOwner.brainPath, worktreeOwner.id).catch((err) => {
+                sessionLog.warn(`[Worktree] Cleanup failed (will be retried by orphan janitor): ${err instanceof Error ? err.message : err}`);
+            });
+        }
+    }
+}
 const activeProcesses = new Map();
 const activeProcessesByThread = new Map();
 // tv#317: when the last `claude` process ended, so the idle-restart gate can require

package/dist/config-client.d.ts

@@ -25,6 +25,8 @@
  */
 export type ModelConfigScope = 'poller' | 'workspace' | 'channel';
 export interface ResolvedModelConfig {
+    /** Original stored id supplied by the service after read normalization. */
+    modelNormalizedFrom?: string;
     model?: string;
     reasoningEffort?: string;
     modelSource?: ModelConfigScope;

package/dist/config-client.js

@@ -104,6 +104,9 @@ export async function fetchConfigForSpawn(input) {
     if (typeof env.REASONING_EFFORT === 'string' && env.REASONING_EFFORT) {
         result.reasoningEffort = env.REASONING_EFFORT;
     }
+    if (result.model && typeof parsed.modelNormalizedFrom === 'string' && parsed.modelNormalizedFrom) {
+        result.modelNormalizedFrom = parsed.modelNormalizedFrom;
+    }
     if (isModelConfigScope(sources.MODEL))
         result.modelSource = sources.MODEL;
     if (isModelConfigScope(sources.REASONING_EFFORT))

package/dist/event-queue.js

@@ -69,7 +69,7 @@ export async function flush() {
         return;
     isFlushing = true;
     try {
-        const batch = [...queue];
+        const batch = queue.splice(0);
         const failed = [];
         for (const event of batch) {
             const ok = await flushOne(event);
@@ -77,7 +77,7 @@ export async function flush() {
                 failed.push(event);
             }
         }
-        queue = failed;
+        queue = [...failed, ...queue].slice(-MAX_QUEUE_SIZE);
         if (failed.length > 0) {
             logger.debug(`[EventQueue] ${failed.length} event(s) failed to flush, will retry`);
         }

package/dist/inbox-manager.d.ts

@@ -1,3 +1,6 @@
+import type { ClaudeRateLimitInfo } from './claude-rate-limit.js';
+import type { PoolAttempt } from './subscription-runtime.js';
+import type { TeamVibeQueueMessage, SubscriptionPin } from './types.js';
 /**
  * Write a new message to the inbox.
  * Returns the filename of the created message file.
@@ -23,7 +26,7 @@ export declare function markProcessed(brainPath: string, threadId: string, filen
 /**
  * Move a message from processing/ back to new/.
  *
- * Used specifically for a poller-initiated *shutdown* kill (teamvibe.ai#73,
+ * Used for quota-paused spawn preparation and a poller-initiated *shutdown* kill (teamvibe.ai#73,
  * PR#308 round-5): pickNextMessage() above moves a file to processing/ as
  * soon as it's picked up, not once it completes, so a message killed
  * mid-flight by shutdown() is left sitting in processing/. The inbox
@@ -49,3 +52,21 @@ export declare function requeueMessage(brainPath: string, threadId: string, file
  * Check if there are unprocessed messages in new/ or processing/.
  */
 export declare function hasUnprocessed(brainPath: string, threadId: string): boolean;
+export declare function saveInboxContext(brainPath: string, msg: TeamVibeQueueMessage): void;
+export declare function readInboxContext(brainPath: string, threadId: string): TeamVibeQueueMessage | undefined;
+export interface InboxRuntime {
+    sessionId: string;
+    pin: SubscriptionPin;
+    filename: string;
+    quotaDeferEpisodes?: number;
+    attempts?: readonly PoolAttempt[];
+    /** Inference finished; only bookkeeping may be retried, never the prompt. */
+    completed?: {
+        observedAt: number;
+        retryAt: number;
+        rateLimitInfo?: ClaudeRateLimitInfo;
+    };
+}
+export declare function saveInboxRuntime(brainPath: string, threadId: string, state: InboxRuntime): void;
+export declare function readInboxRuntime(brainPath: string, threadId: string): InboxRuntime | undefined;
+export declare function clearInboxRuntime(brainPath: string, threadId: string): void;