comfyui-mcp 0.50.0 → 0.50.2

package/dist/comfyui/fetch.js

@@ -1,4 +1,42 @@
 import { getComfyUIAuthHeaders } from "../config.js";
+import { describeFetchFailure, isBareFetchFailure } from "../utils/errors.js";
+/** The request target, for the diagnostic. Never throws on an odd input. */
+function targetOf(input) {
+    try {
+        if (typeof input === "string")
+            return input;
+        if (input instanceof URL)
+            return input.href;
+        return input.url ?? String(input);
+    }
+    catch {
+        return String(input);
+    }
+}
+/**
+ * Turn a network-layer throw into a diagnostic that says WHAT was attempted.
+ *
+ * `TypeError: fetch failed` was reaching tool results verbatim: #954 saw it from
+ * the workflow-templates listing (now `list_packs` action:"list_templates") and
+ * could not tell which host was tried, and #952 saw it from the readonly tools
+ * while the panel bridge was working fine — reading it, reasonably, as "the tool
+ * is broken" when the headless target was simply a different (unreachable)
+ * address than the one the panel is bound to.
+ *
+ * The two ARE separate targets by design: the panel talks to whichever ComfyUI
+ * the browser is on, while these calls go to the configured COMFYUI_URL. That is
+ * not a bug, but it is invisible unless the failure names the address.
+ */
+function describeComfyFetchFailure(err, target) {
+    const { message, code } = describeFetchFailure(err);
+    const wrapped = new Error(`${message} — while requesting ${target}. ` +
+        `That is the headless ComfyUI target (COMFYUI_URL); a CONNECTED sidebar panel does not imply this address is reachable, ` +
+        `because the panel talks to whichever ComfyUI its browser tab is on. ` +
+        `Check the target with install_comfyui (action:"environment"), and confirm the server is up with get_system_stats (action:"health").`, { cause: err });
+    if (code)
+        wrapped.code = code;
+    return wrapped;
+}
 /**
  * `fetch` wrapper for ComfyUI HTTP requests that injects the configured generic
  * auth header(s) (COMFYUI_AUTH_* — for self-hosted ComfyUI behind a reverse
@@ -9,15 +47,30 @@ import { getComfyUIAuthHeaders } from "../config.js";
  * server. Non-ComfyUI requests (HuggingFace, Civitai, Comfy Cloud) keep using
  * plain `fetch` — Comfy Cloud has its own X-API-Key path in cloud-client.ts.
  */
-export function comfyuiFetch(input, init = {}) {
+export async function comfyuiFetch(input, init = {}) {
     const auth = getComfyUIAuthHeaders();
-    if (Object.keys(auth).length === 0)
-        return fetch(input, init);
-    const headers = new Headers(init.headers);
-    for (const [name, value] of Object.entries(auth)) {
-        if (!headers.has(name))
-            headers.set(name, value);
+    let request;
+    if (Object.keys(auth).length === 0) {
+        request = fetch(input, init);
+    }
+    else {
+        const headers = new Headers(init.headers);
+        for (const [name, value] of Object.entries(auth)) {
+            if (!headers.has(name))
+                headers.set(name, value);
+        }
+        request = fetch(input, { ...init, headers });
+    }
+    try {
+        return await request;
+    }
+    catch (err) {
+        // ONLY the opaque undici failure is rewritten. An AbortError, a timeout with
+        // its own message, or anything else already says what happened, and
+        // replacing that text would be a downgrade.
+        if (!isBareFetchFailure(err))
+            throw err;
+        throw describeComfyFetchFailure(err, targetOf(input));
     }
-    return fetch(input, { ...init, headers });
 }
 //# sourceMappingURL=fetch.js.map

package/dist/comfyui/fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/comfyui/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,KAA6B,EAC7B,OAAoB,EAAE;IAEtB,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/comfyui/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,KAA6B;IAC7C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,KAAK,YAAY,GAAG;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QAC5C,OAAQ,KAAiB,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,yBAAyB,CAAC,GAAY,EAAE,MAAc;IAC7D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,GAAG,OAAO,uBAAuB,MAAM,IAAI;QACzC,yHAAyH;QACzH,sEAAsE;QACtE,qIAAqI,EACvI,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACF,IAAI,IAAI;QAAG,OAA6B,CAAC,IAAI,GAAG,IAAI,CAAC;IACrD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAA6B,EAC7B,OAAoB,EAAE;IAEtB,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,OAA0B,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,oEAAoE;QACpE,4CAA4C;QAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QACxC,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/orchestrator/agent-backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-backend.js","sourceRoot":"","sources":["../../src/orchestrator/agent-backend.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,mFAAmF;AACnF,oEAAoE;AACpE,EAAE;AACF,mFAAmF;AACnF,+EAA+E;AAC/E,+EAA+E;AAC/E,mFAAmF;AAoJnF;;;8EAG8E;AAC9E,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAC9B,MAAiC,EACjC,IAAY;IAEZ,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAsGD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB,EAAE,IAAI;IACvB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;IACnB,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI,EAAE,0DAA0D;IACxE,KAAK,EAAE,KAAK,EAAE,6DAA6D;IAC3E,WAAW,EAAE,IAAI,EAAE,sEAAsE;CAC1F,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,iBAAiB,EAAE,IAAI,EAAE,2CAA2C;IACpE,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;IACzC,YAAY,EAAE,KAAK,EAAE,+CAA+C;IACpE,YAAY,EAAE,KAAK,EAAE,mCAAmC;IACxD,gBAAgB,EAAE,IAAI,EAAE,cAAc;IACtC,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,kEAAkE;IAChF,KAAK,EAAE,KAAK,EAAE,oEAAoE;IAClF,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;gFAIgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB,EAAE,IAAI,EAAE,wCAAwC;IACjE,eAAe,EAAE,IAAI,EAAE,2DAA2D;IAClF,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;IACzC,YAAY,EAAE,KAAK,EAAE,sDAAsD;IAC3E,YAAY,EAAE,KAAK,EAAE,mDAAmD;IACxE,gBAAgB,EAAE,IAAI,EAAE,oEAAoE;IAC5F,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,yEAAyE;IACvF,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,qEAAqE;IACrE,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;;;;sEAOsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,iBAAiB,EAAE,IAAI,EAAE,kDAAkD;IAC3E,eAAe,EAAE,IAAI,EAAE,yCAAyC;IAChE,gBAAgB,EAAE,IAAI,EAAE,qDAAqD;IAC7E,YAAY,EAAE,KAAK,EAAE,oDAAoD;IACzE,YAAY,EAAE,KAAK,EAAE,yCAAyC;IAC9D,gBAAgB,EAAE,IAAI,EAAE,sCAAsC;IAC9D,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK,EAAE,uCAAuC;IACtD,KAAK,EAAE,KAAK,EAAE,uDAAuD;IACrE,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;;;;;iFAQiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,iBAAiB,EAAE,IAAI,EAAE,qDAAqD;IAC9E,eAAe,EAAE,IAAI,EAAE,kCAAkC;IACzD,gBAAgB,EAAE,IAAI,EAAE,qDAAqD;IAC7E,YAAY,EAAE,KAAK,EAAE,uDAAuD;IAC5E,YAAY,EAAE,KAAK,EAAE,4DAA4D;IACjF,gBAAgB,EAAE,IAAI,EAAE,qBAAqB;IAC7C,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK,EAAE,qCAAqC;IACpD,KAAK,EAAE,KAAK,EAAE,sDAAsD;IACpE,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;kEAEkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,iBAAiB,EAAE,IAAI;IACvB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,gBAAgB,EAAE,IAAI,EAAE,+DAA+D;IACvF,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI;IACZ,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,qEAAqE;IACrE,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;;;;;;2CAS2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB,EAAE,IAAI,EAAE,yCAAyC;IAClE,eAAe,EAAE,IAAI,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IACjE,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK,EAAE,2DAA2D;IAChF,gBAAgB,EAAE,IAAI,EAAE,wCAAwC;IAChE,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,mEAAmE;IACjF,KAAK,EAAE,IAAI,EAAE,4GAA4G;IACzH,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;iFACiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,iBAAiB,EAAE,IAAI;IACvB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAC1E,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,uEAAuE;IACrF,KAAK,EAAE,KAAK,EAAE,qEAAqE;IACnF,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,GAAG,mBAAmB;CACvB,CAAC;AAEF,kFAAkF;AAClF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,sEAAsE;AAEtE;;;gEAGgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,GAAG,mBAAmB;CACvB,CAAC"}
+{"version":3,"file":"agent-backend.js","sourceRoot":"","sources":["../../src/orchestrator/agent-backend.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,mFAAmF;AACnF,oEAAoE;AACpE,EAAE;AACF,mFAAmF;AACnF,+EAA+E;AAC/E,+EAA+E;AAC/E,mFAAmF;AA6JnF;;;8EAG8E;AAC9E,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAC9B,MAAiC,EACjC,IAAY;IAEZ,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAsGD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB,EAAE,IAAI;IACvB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;IACnB,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI,EAAE,0DAA0D;IACxE,KAAK,EAAE,KAAK,EAAE,6DAA6D;IAC3E,WAAW,EAAE,IAAI,EAAE,sEAAsE;CAC1F,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,iBAAiB,EAAE,IAAI,EAAE,2CAA2C;IACpE,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;IACzC,YAAY,EAAE,KAAK,EAAE,+CAA+C;IACpE,YAAY,EAAE,KAAK,EAAE,mCAAmC;IACxD,gBAAgB,EAAE,IAAI,EAAE,cAAc;IACtC,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,kEAAkE;IAChF,KAAK,EAAE,KAAK,EAAE,oEAAoE;IAClF,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;gFAIgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB,EAAE,IAAI,EAAE,wCAAwC;IACjE,eAAe,EAAE,IAAI,EAAE,2DAA2D;IAClF,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;IACzC,YAAY,EAAE,KAAK,EAAE,sDAAsD;IAC3E,YAAY,EAAE,KAAK,EAAE,mDAAmD;IACxE,gBAAgB,EAAE,IAAI,EAAE,oEAAoE;IAC5F,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,yEAAyE;IACvF,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,qEAAqE;IACrE,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;;;;sEAOsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,iBAAiB,EAAE,IAAI,EAAE,kDAAkD;IAC3E,eAAe,EAAE,IAAI,EAAE,yCAAyC;IAChE,gBAAgB,EAAE,IAAI,EAAE,qDAAqD;IAC7E,YAAY,EAAE,KAAK,EAAE,oDAAoD;IACzE,YAAY,EAAE,KAAK,EAAE,yCAAyC;IAC9D,gBAAgB,EAAE,IAAI,EAAE,sCAAsC;IAC9D,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK,EAAE,uCAAuC;IACtD,KAAK,EAAE,KAAK,EAAE,uDAAuD;IACrE,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;;;;;iFAQiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,iBAAiB,EAAE,IAAI,EAAE,qDAAqD;IAC9E,eAAe,EAAE,IAAI,EAAE,kCAAkC;IACzD,gBAAgB,EAAE,IAAI,EAAE,qDAAqD;IAC7E,YAAY,EAAE,KAAK,EAAE,uDAAuD;IAC5E,YAAY,EAAE,KAAK,EAAE,4DAA4D;IACjF,gBAAgB,EAAE,IAAI,EAAE,qBAAqB;IAC7C,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK,EAAE,qCAAqC;IACpD,KAAK,EAAE,KAAK,EAAE,sDAAsD;IACpE,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;kEAEkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,iBAAiB,EAAE,IAAI;IACvB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,gBAAgB,EAAE,IAAI,EAAE,+DAA+D;IACvF,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI;IACZ,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,qEAAqE;IACrE,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;;;;;;;;;2CAS2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB,EAAE,IAAI,EAAE,yCAAyC;IAClE,eAAe,EAAE,IAAI,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,yCAAyC;IACjE,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK,EAAE,2DAA2D;IAChF,gBAAgB,EAAE,IAAI,EAAE,wCAAwC;IAChE,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,mEAAmE;IACjF,KAAK,EAAE,IAAI,EAAE,4GAA4G;IACzH,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF;iFACiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,iBAAiB,EAAE,IAAI;IACvB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAC1E,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,IAAI,EAAE,uEAAuE;IACrF,KAAK,EAAE,KAAK,EAAE,qEAAqE;IACnF,WAAW,EAAE,IAAI,EAAE,yCAAyC;CAC7D,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,GAAG,mBAAmB;CACvB,CAAC;AAEF,kFAAkF;AAClF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,sEAAsE;AAEtE;;;gEAGgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,GAAG,mBAAmB;CACvB,CAAC"}

package/dist/orchestrator/call-tool-admission.js

@@ -4,7 +4,7 @@
  * decision is a pure, unit-testable function — the dispatcher is a one-line
  * call site.
  */
-import { retiredToolMessage } from "../tools/vocabulary.js";
+import { retiredToolMessage, TOOL_NAMES } from "../tools/vocabulary.js";
 /** The direct tool channel: a mobile client can invoke these READ/DOWNLOAD backend
  *  tools without an agent turn (structured nav data + rig downloads). The
  *  bridge is already token-gated; this whitelist keeps call_tool to non-destructive
@@ -434,8 +434,23 @@ export function callToolAdmission(tool, args) {
     const retired = retiredToolMessage(tool);
     if (retired !== undefined)
         return retired;
-    if (!CALL_TOOL_WHITELIST.has(tool))
-        return `tool "${tool}" is not permitted`;
+    if (!CALL_TOOL_WHITELIST.has(tool)) {
+        // Distinguish "does not exist" from "exists, but not on THIS channel" (#908).
+        // The bare "is not permitted" was a dead end: the panel's RunPod Deploy/Start
+        // buttons returned it verbatim for ~2 weeks after #278 correctly removed those
+        // two tools from this whitelist (both start BILLING, and a confirmation-less
+        // mirrored tab must not spend money). The exclusion was right; the message
+        // told nobody what had happened or what to do instead, so it read as "the
+        // panel is broken" rather than "this channel deliberately does not carry it".
+        const exists = TOOL_NAMES.includes(tool);
+        return exists
+            ? `tool "${tool}" exists but is not available on the direct call_tool channel ` +
+                `(the canvas-less path used by mobile, mirrored tabs and panel buttons). This is a ` +
+                `deliberate exclusion, not a missing tool — some tools are withheld here because they ` +
+                `spend money or mutate state that this channel cannot confirm with the user. Ask the ` +
+                `agent to run it instead: the agent session carries the full tool surface and can confirm.`
+            : `tool "${tool}" is not permitted`;
+    }
     const actions = CALL_TOOL_ACTION_WHITELIST.get(tool);
     if (actions !== undefined) {
         const action = typeof args.action === "string" ? args.action : undefined;

package/dist/orchestrator/call-tool-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"call-tool-admission.js","sourceRoot":"","sources":["../../src/orchestrator/call-tool-admission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;;;;;;;;oCAUoC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IACjD,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,iFAAiF;IACjF,cAAc;IACd,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,gEAAgE;IAChE,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,qEAAqE;IACrE,8EAA8E;IAC9E,gDAAgD;IAChD,WAAW;IACX,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,mBAAmB;IACnB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,8BAA8B;IAC9B,gBAAgB;IAChB,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,wBAAwB;IACxB,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,kDAAkD;IAClD,8BAA8B;IAC9B,kBAAkB;IAClB,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,mEAAmE;IACnE,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,mDAAmD;IACnD,eAAe;IACf,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,oEAAoE;IACpE,8DAA8D;IAC9D,OAAO;IACP,iFAAiF;IACjF,2EAA2E;IAC3E,8EAA8E;IAC9E,aAAa;IACb,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,6BAA6B;IAC7B,aAAa;IACb,qEAAqE;IACrE,uEAAuE;IACvE,8EAA8E;IAC9E,sEAAsE;IACtE,8EAA8E;IAC9E,gBAAgB;IAChB,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,uBAAuB;IACvB,aAAa;IACb,cAAc;IACd,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,qDAAqD;IACrD,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,4BAA4B;IAC5B,EAAE;IACF,+EAA+E;IAC/E,yEAAyE;IACzE,8EAA8E;IAC9E,wEAAwE;IACxE,8BAA8B;IAC9B,QAAQ;IACR,wEAAwE;IACxE,yEAAyE;IACzE,8EAA8E;IAC9E,0EAA0E;IAC1E,kEAAkE;IAClE,cAAc;IACd,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM;IACN,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,mFAAmF;IACnF,+DAA+D;IAC/D,4BAA4B;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,+CAA+C;IAC/C,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,YAAY;IACZ,EAAE;IACF,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,8EAA8E;IAC9E,6DAA6D;IAC7D,qBAAqB;IACrB,6EAA6E;IAC7E,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,yEAAyE;IACzE,sDAAsD;IACtD,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,yDAAyD;CAC1D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA6C,IAAI,GAAG,CAAC;IAC1F,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,mEAAmE;IACnE,uEAAuE;IACvE,2DAA2D;IAC3D,yCAAyC;IACzC,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9B,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,4CAA4C;IAC5C,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IACtF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,+DAA+D;IAC/D,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,iEAAiE;IACjE,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,iCAAiC;IACjC,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACzC,wEAAwE;IACxE,+EAA+E;IAC/E,0EAA0E;IAC1E,+EAA+E;IAC/E,wEAAwE;IACxE,uFAAuF;IACvF,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,qBAAqB;IACrB,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,uCAAuC;IACvC,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,qEAAqE;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,yCAAyC;IACzC;QACE,gBAAgB;QAChB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;KAClG;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,8EAA8E;IAC9E,8BAA8B;IAC9B,EAAE;IACF,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,4EAA4E;IAC5E,sDAAsD;IACtD,6EAA6E;IAC7E,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,iFAAiF;IACjF,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,iDAAiD;IACjD,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,qBAAqB;IACrB,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,oEAAoE;IACpE,4EAA4E;IAC5E,8EAA8E;IAC9E,mDAAmD;IACnD,EAAE;IACF,6EAA6E;IAC7E,CAAC,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,uEAAuE;IACvE,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,EAAE;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,sBAAsB;IACtB,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,mEAAmE;IACnE,EAAE;IACF,+EAA+E;IAC/E,yEAAyE;IACzE,iDAAiD;IACjD,CAAC,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,WAAW;IACX,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,yEAAyE;IACzE,sEAAsE;IACtE,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,kEAAkE;IAClE,2DAA2D;IAC3D,EAAE;IACF,uEAAuE;IACvE,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,mEAAmE;IACnE,gFAAgF;IAChF,gBAAgB;IAChB,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/C,wEAAwE;IACxE,0EAA0E;IAC1E,8EAA8E;IAC9E,kCAAkC;IAClC,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,oDAAoD;IACpD,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,CAAC,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,IAA6B;IAE7B,gFAAgF;IAChF,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe;IACf,EAAE;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,sDAAsD;IACtD,EAAE;IACF,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,6EAA6E;IAC7E,4EAA4E;IAC5E,kFAAkF;IAClF,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAE1C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,IAAI,oBAAoB,CAAC;IAC7E,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,IAAI,kCAAkC,MAAM,IAAI,WAAW,GAAG,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"call-tool-admission.js","sourceRoot":"","sources":["../../src/orchestrator/call-tool-admission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAExE;;;;;;;;;;oCAUoC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IACjD,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,iFAAiF;IACjF,cAAc;IACd,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,gEAAgE;IAChE,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,qEAAqE;IACrE,8EAA8E;IAC9E,gDAAgD;IAChD,WAAW;IACX,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,mBAAmB;IACnB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,8BAA8B;IAC9B,gBAAgB;IAChB,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,wBAAwB;IACxB,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,kDAAkD;IAClD,8BAA8B;IAC9B,kBAAkB;IAClB,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,mEAAmE;IACnE,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,mDAAmD;IACnD,eAAe;IACf,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,oEAAoE;IACpE,8DAA8D;IAC9D,OAAO;IACP,iFAAiF;IACjF,2EAA2E;IAC3E,8EAA8E;IAC9E,aAAa;IACb,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,6BAA6B;IAC7B,aAAa;IACb,qEAAqE;IACrE,uEAAuE;IACvE,8EAA8E;IAC9E,sEAAsE;IACtE,8EAA8E;IAC9E,gBAAgB;IAChB,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,uBAAuB;IACvB,aAAa;IACb,cAAc;IACd,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,qDAAqD;IACrD,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,4BAA4B;IAC5B,EAAE;IACF,+EAA+E;IAC/E,yEAAyE;IACzE,8EAA8E;IAC9E,wEAAwE;IACxE,8BAA8B;IAC9B,QAAQ;IACR,wEAAwE;IACxE,yEAAyE;IACzE,8EAA8E;IAC9E,0EAA0E;IAC1E,kEAAkE;IAClE,cAAc;IACd,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM;IACN,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,mFAAmF;IACnF,+DAA+D;IAC/D,4BAA4B;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,+CAA+C;IAC/C,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,YAAY;IACZ,EAAE;IACF,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,8EAA8E;IAC9E,6DAA6D;IAC7D,qBAAqB;IACrB,6EAA6E;IAC7E,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,yEAAyE;IACzE,sDAAsD;IACtD,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,yDAAyD;CAC1D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA6C,IAAI,GAAG,CAAC;IAC1F,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,mEAAmE;IACnE,uEAAuE;IACvE,2DAA2D;IAC3D,yCAAyC;IACzC,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9B,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,4CAA4C;IAC5C,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IACtF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,+DAA+D;IAC/D,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,iEAAiE;IACjE,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,iCAAiC;IACjC,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACzC,wEAAwE;IACxE,+EAA+E;IAC/E,0EAA0E;IAC1E,+EAA+E;IAC/E,wEAAwE;IACxE,uFAAuF;IACvF,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,qBAAqB;IACrB,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,uCAAuC;IACvC,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,qEAAqE;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,yCAAyC;IACzC;QACE,gBAAgB;QAChB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;KAClG;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,8EAA8E;IAC9E,8BAA8B;IAC9B,EAAE;IACF,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,4EAA4E;IAC5E,sDAAsD;IACtD,6EAA6E;IAC7E,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,iFAAiF;IACjF,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,iDAAiD;IACjD,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,qBAAqB;IACrB,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,oEAAoE;IACpE,4EAA4E;IAC5E,8EAA8E;IAC9E,mDAAmD;IACnD,EAAE;IACF,6EAA6E;IAC7E,CAAC,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,uEAAuE;IACvE,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,EAAE;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,sBAAsB;IACtB,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,mEAAmE;IACnE,EAAE;IACF,+EAA+E;IAC/E,yEAAyE;IACzE,iDAAiD;IACjD,CAAC,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,WAAW;IACX,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,yEAAyE;IACzE,sEAAsE;IACtE,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,kEAAkE;IAClE,2DAA2D;IAC3D,EAAE;IACF,uEAAuE;IACvE,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,mEAAmE;IACnE,gFAAgF;IAChF,gBAAgB;IAChB,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/C,wEAAwE;IACxE,0EAA0E;IAC1E,8EAA8E;IAC9E,kCAAkC;IAClC,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,oDAAoD;IACpD,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,CAAC,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,IAA6B;IAE7B,gFAAgF;IAChF,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe;IACf,EAAE;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,sDAAsD;IACtD,EAAE;IACF,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,6EAA6E;IAC7E,4EAA4E;IAC5E,kFAAkF;IAClF,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAE1C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,MAAM,GAAI,UAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,MAAM;YACX,CAAC,CAAC,SAAS,IAAI,gEAAgE;gBAC7E,oFAAoF;gBACpF,uFAAuF;gBACvF,sFAAsF;gBACtF,2FAA2F;YAC7F,CAAC,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,IAAI,kCAAkC,MAAM,IAAI,WAAW,GAAG,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/orchestrator/claude-backend.js

@@ -12,6 +12,8 @@
 import { logger } from "../utils/logger.js";
 import { errorText } from "./error-text.js";
 import { buildAgentSpawnEnv } from "../services/panel-secrets.js";
+import { loadTurnRegistry, saveTurnRegistry, tombstoneTurn } from "./turn-registry.js";
+import { randomUUID } from "node:crypto";
 import { CLAUDE_CAPABILITIES, } from "./agent-backend.js";
 // ---- reasoning effort mapping ----
 // Effort is now a provider-neutral union (it must survive a provider switch — see
@@ -204,6 +206,11 @@ export async function fetchSupportedCommands(model) {
  *  silently realigning it: the pop that crosses the evicted gap (and any
  *  traceless result) fails closed as unverifiable, never ok:true (#745 r3). */
 const MAX_UNRESOLVED_TURNS = 16;
+/** Bound on REMEMBERED dead-session turn ids (#886). The set exists to
+ *  recognize a late result from a restarted session — it is not a
+ *  classification input, so a cap here only bounds how far back recognition
+ *  reaches; beyond it a stray falls back to the plain traceless report. */
+const MAX_REMEMBERED_DEAD_TURNS = 64;
 /**
  * The Claude Agent SDK adapter. One instance per PanelAgent; it holds the live
  * `Query` for the current session and re-creates it on each `run()`.
@@ -260,6 +267,51 @@ export class ClaudeBackend {
      *  unconsumed candidate it fails closed as traceless (#728 r6). */
     consumedInterrupted = new Set();
     turns = [];
+    // #886 — "submitted" must survive the session: when a run() restart drops the
+    // live traces above, their ids move here (and a RESUMED session rehydrates
+    // them from the durable registry written by the previous process). A
+    // traceless result while this set is non-empty is then RECOGNIZED for what
+    // it most likely is — a turn that was in flight when its session died,
+    // completing late — and reported as "completed but unverified": never a
+    // fabricated success (fail-closed #745 stands), but also no longer the false
+    // "could not be matched to any submitted turn", which claimed the turn never
+    // existed when only its record was lost. Insertion-ordered; recognition
+    // consumes the oldest entry (results land in submission order).
+    //
+    // Entries are owner-TAGGED (`<instanceId>:<turnId>`): turnSeq restarts per
+    // process, so two instances can each leave their own turn "1" outstanding —
+    // untagged ids would collapse those into one record and the second late
+    // result would be falsely reported as matching no submission (codex gate).
+    instanceId = randomUUID();
+    rememberedDeadTurns = new Set();
+    /** The remembered set's bound dropped a record at some point — persisted
+     *  into the registry file (`incomplete`) so a RESPAWN also knows the record
+     *  is not provably complete, not just this process (codex gate r2). */
+    rememberedIncomplete = false;
+    /** Session id the durable registry file belongs to (learned at init). Null
+     *  until then — a submission pulled before init is processed can't be filed
+     *  under a session nobody can resume yet. */
+    registrySessionId = null;
+    /** A registry read/write failed — the record of outstanding turns is not
+     *  provably complete, so log it and never lean on the registry's ABSENCE as
+     *  evidence in that state. */
+    registryDegraded = false;
+    // #885 — a stall is not a user rejection. The Agent SDK has no mid-turn steer
+    // (Codex's turn/steer equivalent): a user message pushed into the stream is
+    // queued by the CLI until the current turn ENDS — exactly what a frozen turn
+    // cannot do — so the notice cannot ride the stalled turn itself. What must
+    // not happen is the transcript keeping ONLY the interrupt's generic
+    // user-rejection payload: on the next turn the model reads it and tells the
+    // user "you cancelled" — a lie about the user's own actions. So the notice
+    // is held here and prepended (clearly delimited as harness text, not the
+    // user's words) to the NEXT user turn, where it lands in the transcript
+    // right beside that payload. recoverStalledTurn therefore returns false:
+    // PanelAgent keeps its proven bounded interrupt/restart recovery for the
+    // frozen turn, and the correction rides the turn after.
+    pendingStallNotice = null;
+    /** turnSeq when the notice was stored — a genuine `success` landing for that
+     *  turn means the "stall" recovered by itself and the notice is stale. */
+    pendingStallNoticeTurn = 0;
     constructor(deps) {
         this.deps = deps;
     }
@@ -300,7 +352,20 @@ export class ClaudeBackend {
      *  image refs to inline base64 blocks so the agent SEES them in this turn (no
      *  get_image view/fetch round-trip). */
     async shapeTurn(turn) {
-        const text = turn.text;
+        let text = turn.text;
+        // #885 — deliver the held stall correction AHEAD of the user's words, so
+        // the model reads the true origin of the interrupt right next to the
+        // generic rejection payload it would otherwise take at face value. The
+        // notice names the PREVIOUS turn explicitly: on this new turn, a bare
+        // "this turn stalled" would mispoint.
+        if (this.pendingStallNotice) {
+            text =
+                `${this.pendingStallNotice}\n\n` +
+                    `[harness note: the notice above is about the PREVIOUS turn — the one the harness cleared. ` +
+                    `It is not part of the user's message and the user did not write it. The user's message follows.]\n\n` +
+                    text;
+            this.pendingStallNotice = null;
+        }
         const images = turn.images ?? [];
         let content = text;
         if (images.length) {
@@ -382,23 +447,51 @@ export class ClaudeBackend {
         const query = await loadQuery();
         const self = this;
         // A (re)started session can never produce results for turns submitted to a
-        // PREVIOUS session — drop any dead traces and advance the result sequence
-        // past EVERY turn stamped so far (turnSeq), whether or not traces remain:
-        // in a FULLY DRAINED (e.g. poisoned) session the FIFO is already empty, but
-        // the sequence must still move past the old ids or the new session's first
-        // result re-crosses the old gap and falsely re-poisons (#745 r5). Stray
-        // late results from the dead session then arrive TRACELESS and fail closed
-        // instead. This genuine restart boundary is also the ONLY reset of the
+        // PREVIOUS session through the live FIFO — clear it and advance the result
+        // sequence past EVERY turn stamped so far (turnSeq), whether or not traces
+        // remain: in a FULLY DRAINED (e.g. poisoned) session the FIFO is already
+        // empty, but the sequence must still move past the old ids or the new
+        // session's first result re-crosses the old gap and falsely re-poisons
+        // (#745 r5). This genuine restart boundary is also the ONLY reset of the
         // sticky classification poison (#745 r4). Done here, at run() entry (BEFORE
         // the new query exists), rather than on system/init: the SDK's prompt drain
         // legitimately pulls the first batch before init is processed, and an
         // init-time clear would unmark that genuinely in-flight turn (#745).
+        //
+        // But "the trace is gone" must not become "no turn was ever submitted"
+        // (#886): the dead session's unresolved ids are REMEMBERED (and, when this
+        // run RESUMES a session, rehydrated from the durable registry a previous
+        // process wrote), so a stray late result is recognized as a submitted
+        // turn's late landing and reported "completed but unverified" instead of
+        // "matched to no submitted turn". Recognition never upgrades a result to
+        // ok:true — fail-closed stands.
+        for (const dead of this.turns)
+            this.rememberDeadTurn(`${this.instanceId}:${dead.id}`);
         this.turns.length = 0;
         this.lastResultTurnId = this.turnSeq;
         this.classificationPoisoned = false;
         this.parkedInterrupted.clear(); // dead session's parks die with it
         this.consumedInterrupted.clear(); // …and its landing history
         this.markerBase = this.lastResultTurnId; // turn markers are run-relative (#728)
+        const resumeTarget = opts.resume ?? opts.sessionId ?? null;
+        // Registry writes before init (the prompt drain can submit ahead of it)
+        // file under the resume target — the session they will actually run in.
+        // A fresh start files nothing until init names the new session.
+        this.registrySessionId = resumeTarget;
+        if (resumeTarget) {
+            const loaded = loadTurnRegistry(resumeTarget);
+            // Hydrate whatever the session's files prove is outstanding — including
+            // this instance's OWN file (tags dedupe against the in-memory carry, and
+            // tombstones keep already-reported strays from resurrecting). A degraded
+            // or self-declared-incomplete record must not later ground the confident
+            // "matched to no submitted turn".
+            for (const tag of loaded.tags)
+                this.rememberDeadTurn(tag);
+            if (loaded.kind === "degraded" || loaded.incomplete) {
+                this.registryDegraded = true;
+                logger.warn(`[claude-backend] turn registry for the resumed session is ${loaded.kind === "degraded" ? `unreadable (${loaded.reason})` : "incomplete"} — outstanding-turn recognition is degraded (#886)`);
+            }
+        }
         // Wrap the neutral channel: shape each turn into the SDK's native form right
         // before it's read, so PanelAgent never deals in SDKUserMessage.
         async function* prompt() {
@@ -416,6 +509,7 @@ export class ClaudeBackend {
                     const evicted = self.turns.shift();
                     logger.warn(`[claude-backend] over ${MAX_UNRESOLVED_TURNS} unresolved turns — evicted turn ${evicted?.id}'s trace; its result will fail closed as unverifiable (#740)`);
                 }
+                self.saveRegistry(); // the submission record must survive a restart (#886)
                 yield msg;
             }
         }
@@ -470,6 +564,22 @@ export class ClaudeBackend {
             active.interrupted = true;
         await this.q?.interrupt();
     }
+    /**
+     * #885 — record the harness-stall notice so the NEXT user turn carries it
+     * into the transcript beside the interrupt's generic user-rejection payload
+     * (see the pendingStallNotice field comment for why the notice cannot ride
+     * the stalled turn itself on this provider). Returns false: no mid-turn
+     * steer exists here, so PanelAgent keeps its bounded interrupt/restart
+     * recovery for the frozen turn — the notice's job is only to stop the agent
+     * from telling the user THEY cancelled, and to tell it a retry is safe.
+     */
+    async recoverStalledTurn(notice) {
+        if (notice.trim()) {
+            this.pendingStallNotice = notice;
+            this.pendingStallNoticeTurn = this.turnSeq;
+        }
+        return false;
+    }
     /** Permanently dispose of the live SDK query. The Agent SDK has no explicit
      *  "dispose" beyond interrupt(), which both stops the in-flight turn and lets
      *  the underlying transport wind down once the prompt generator is no longer
@@ -492,6 +602,71 @@ export class ClaudeBackend {
     async listModels() {
         return [];
     }
+    /** Remember a submitted turn whose result can no longer arrive through the
+     *  live FIFO (its session restarted). Recognition-only (#886): membership
+     *  changes what an unmatched result can honestly be CALLED, never how it is
+     *  classified. Bounded — oldest drops first, but a drop means the record is
+     *  no longer provably complete, so it degrades recognition (the hedged
+     *  wording) rather than silently reverting to the confident negative. */
+    rememberDeadTurn(tag) {
+        if (this.rememberedDeadTurns.has(tag))
+            return;
+        this.rememberedDeadTurns.add(tag);
+        if (this.rememberedDeadTurns.size > MAX_REMEMBERED_DEAD_TURNS) {
+            const oldest = this.rememberedDeadTurns.keys().next().value;
+            if (oldest !== undefined)
+                this.rememberedDeadTurns.delete(oldest);
+            this.registryDegraded = true;
+            this.rememberedIncomplete = true; // persisted — a respawn must hedge too
+            logger.warn(`[claude-backend] over ${MAX_REMEMBERED_DEAD_TURNS} remembered dead turns — dropped the oldest record; outstanding-turn recognition is degraded (#886)`);
+        }
+    }
+    /** Consume the oldest remembered dead-turn tag, if any — a recognized late
+     *  landing spends the record (in memory, in this instance's file, and in the
+     *  session's tombstones) so a second stray can never re-claim it. */
+    takeOldestRememberedDeadTurn() {
+        const oldest = this.rememberedDeadTurns.keys().next().value;
+        if (oldest === undefined)
+            return null;
+        this.rememberedDeadTurns.delete(oldest);
+        const sid = this.registrySessionId;
+        if (sid) {
+            try {
+                tombstoneTurn(sid, oldest);
+            }
+            catch (err) {
+                // A lost tombstone can only REVIVE an already-reported record (a
+                // repeated hedged disclosure) — never a fabricated success. Log, move on.
+                logger.warn(`[claude-backend] turn tombstone write failed: ${msgOf(err)} (#886)`);
+            }
+        }
+        this.saveRegistry();
+        return oldest;
+    }
+    /** Persist which submitted turns are still outstanding (#886). A failure
+     *  degrades recognition (flagged + logged) but must never break the turn
+     *  itself — the registry is a recognition aid, not load-bearing for the
+     *  turn in flight.
+     *
+     *  Ordering: saves happen AFTER the trace push/pop they record. A crash in
+     *  the pop→save window leaves a STALE record (a turn whose result was seen
+     *  still listed outstanding) — over-recognition, which produces the hedged
+     *  "completed but unverified" disclosure. The reverse order could LOSE a
+     *  record, and a lost record produces the confident "matched to no
+     *  submitted turn" — a false assertion — so over-recognition is the
+     *  deliberate failure side. */
+    saveRegistry() {
+        const sid = this.registrySessionId;
+        if (!sid)
+            return;
+        try {
+            saveTurnRegistry(sid, this.instanceId, this.turns.map((t) => t.id), [...this.rememberedDeadTurns], this.rememberedIncomplete);
+        }
+        catch (err) {
+            this.registryDegraded = true;
+            logger.warn(`[claude-backend] turn registry write failed: ${msgOf(err)} — outstanding-turn recognition is degraded (#886)`);
+        }
+    }
     /** Normalize one SDK message into zero or more canonical AgentEvents. */
     *route(message) {
         switch (message.type) {
@@ -499,9 +674,15 @@ export class ClaudeBackend {
                 if (message.subtype === "init") {
                     // New session (or a restarted one). No turn state is reset here: all
                     // of it is per-turn (the `turns` FIFO), and dead traces from a
-                    // previous session are dropped at run() entry — an init-time clear
-                    // could unmark a turn the prompt drain already handed to the SDK
-                    // before this init was processed (#745 review).
+                    // previous session were already carried into `rememberedDeadTurns`
+                    // at run() entry — an init-time clear could unmark a turn the prompt
+                    // drain already handed to the SDK before this init was processed
+                    // (#745 review).
+                    // The durable turn registry is keyed by THIS session id from now on
+                    // (#886) — including a pre-init submission the prompt drain already
+                    // pulled, which couldn't be filed before the session id was known.
+                    this.registrySessionId = message.session_id;
+                    this.saveRegistry();
                     yield {
                         type: "session",
                         sessionId: message.session_id,
@@ -696,13 +877,63 @@ export class ClaudeBackend {
                     idx = this.turns.findIndex((t) => t.interrupted && this.parkedInterrupted.has(t.id) && !this.consumedInterrupted.has(t.id));
                 }
                 const trace = idx >= 0 ? (this.turns.splice(idx, 1)[0] ?? null) : null;
+                if (trace) {
+                    // The pop retires the turn's outstanding record (#886) — in this
+                    // instance's own file AND in the session's tombstones: a concurrent
+                    // resumer may have copied this turn's id into its own file as a dead
+                    // record while it was still live, and only a tombstone invalidates
+                    // that replica (rewriting this instance's file does not). A lost
+                    // tombstone can only revive the copy as a hedged over-recognition —
+                    // never a fabricated success — so a failure logs and moves on.
+                    const sid = this.registrySessionId;
+                    if (sid) {
+                        try {
+                            tombstoneTurn(sid, `${this.instanceId}:${trace.id}`);
+                        }
+                        catch (err) {
+                            logger.warn(`[claude-backend] turn tombstone write failed: ${msgOf(err)} (#886)`);
+                        }
+                    }
+                    this.saveRegistry();
+                }
                 let unverifiable = null;
+                // #886: an unmatched result with a REMEMBERED outstanding submission is
+                // a different report than one with none. Both fail closed — only the
+                // honesty of the message differs.
+                let unverifiedCompletion = false;
                 if (this.classificationPoisoned) {
                     unverifiable = "Turn bookkeeping was poisoned by an earlier overflow — no result in this session can be verified";
                 }
                 else if (!trace) {
-                    unverifiable = "The result could not be matched to any submitted turn";
-                    logger.warn(`[claude-backend] ${unverifiable} — unverifiable, failing closed (#740)`);
+                    const deadId = this.takeOldestRememberedDeadTurn();
+                    if (deadId !== null) {
+                        // A turn WAS submitted (before a session restart dropped its trace)
+                        // and never reported an outcome — this result is most plausibly its
+                        // late landing. Say exactly that: not a success (unverifiable — the
+                        // match is inference, not proof), and not a failure either — the
+                        // turn may have finished real work, and "turn failed, try again"
+                        // would invite a destructive duplicate retry.
+                        unverifiedCompletion = true;
+                        unverifiable =
+                            `A result (reported as "${resultSubtype}") arrived that matches no live turn, but a turn ` +
+                                `submitted before the session restarted never reported an outcome — this is most likely that ` +
+                                `turn completing late. It may have finished real work (files written, changes made), yet I ` +
+                                `cannot verify which turn it was, so I am NOT counting it as a success. Check what that turn ` +
+                                `was doing before asking for it again, so the work is not done twice.`;
+                        logger.warn(`[claude-backend] traceless result (${resultSubtype}) recognized as a likely late landing for a pre-restart submitted turn — completed but unverified, failing closed (#886)`);
+                    }
+                    else if (this.registryDegraded) {
+                        // The recognition record itself is not provably complete — do not
+                        // assert the negative as confidently as a healthy registry allows.
+                        unverifiable =
+                            "The result could not be matched to any submitted turn, and the durable turn record " +
+                                "could not be fully read or written, so an outstanding earlier submission can't be ruled out";
+                        logger.warn(`[claude-backend] ${unverifiable} — unverifiable, failing closed (#740/#886)`);
+                    }
+                    else {
+                        unverifiable = "The result could not be matched to any submitted turn";
+                        logger.warn(`[claude-backend] ${unverifiable} — unverifiable, failing closed (#740)`);
+                    }
                 }
                 else {
                     let crossesGap = false;
@@ -755,7 +986,13 @@ export class ClaudeBackend {
                     ok = false;
                     yield {
                         type: "error",
-                        message: `${unverifiable} — reporting the turn as unverifiable rather than a success.`,
+                        // The recognized late landing's message is self-contained (it says
+                        // "not counted as a success" itself) and flagged so the panel
+                        // doesn't frame it as a failure (#886).
+                        message: unverifiedCompletion
+                            ? unverifiable
+                            : `${unverifiable} — reporting the turn as unverifiable rather than a success.`,
+                        ...(unverifiedCompletion ? { unverifiedCompletion: true } : {}),
                         ...stamp,
                     };
                 }
@@ -772,6 +1009,17 @@ export class ClaudeBackend {
                         ...stamp,
                     };
                 }
+                // #885: a SELF landing for the stalled turn (success OR a genuine
+                // error — i.e. not the interrupt's doing) means the turn ended on its
+                // own and no rejection payload ever landed in the transcript, so the
+                // held correction would be stale; drop it. An INTERRUPT landing
+                // (trace.interrupted) is exactly the case the notice exists for.
+                if (this.pendingStallNotice !== null &&
+                    trace !== null &&
+                    !trace.interrupted &&
+                    trace.id >= this.pendingStallNoticeTurn) {
+                    this.pendingStallNotice = null;
+                }
                 yield {
                     type: "result",
                     ok,