comfyui-mcp 0.52.29 → 0.52.30

package/dist/orchestrator/node-id.js

@@ -76,4 +76,82 @@ export function normalizeNodeId(v) {
 /** The message a rejected id gets. Names the qualified shape explicitly, because a
  *  caller holding `263:78` needs to know whether it is unsupported or malformed. */
 export const NODE_ID_MESSAGE = "a node id must be an integer (e.g. 42) or a subgraph-qualified id (e.g. 120:104)";
+/**
+ * #1889 — a bare `z.union` renders as the word `Invalid input` and nothing else.
+ *
+ * Zod 4 reports a failed union as ONE `invalid_union` issue whose own `message`
+ * is the constant `"Invalid input"`; the per-member messages (NODE_ID_MESSAGE
+ * among them) live in a nested `errors` array. Every renderer that reaches an
+ * agent flattens `issue.message` and drops that nest — the MCP SDK's
+ * `getParseErrorMessage` (1.30) joins `` `${i.message} at ${path}` ``, zod's own
+ * `prettifyError` prints `✖ ${i.message}`, and 1.29 JSON-stringifies the issues.
+ * So a node-id rejection read:
+ *
+ *     Invalid input at node_id
+ *     Invalid input: expected string, received undefined at title
+ *
+ * NODE_ID_MESSAGE was never dead prose — a BAD STRING (`"42px"`) fails only the
+ * string member, zod collapses that to a plain `invalid_format` issue, and the
+ * message prints. It is unreachable only for inputs that fail EVERY member
+ * (undefined, null, 4.5, an object), which is the common case and the reported
+ * one. This is what makes the union say the same thing there.
+ *
+ * `received` is carried too, because the complaint was the asymmetry with the
+ * sibling `title`, and half of what `title` said was what it actually got.
+ */
+export function unionErrorFor(expected) {
+    return (iss) => `${expected}; received ${describeReceived(iss.input)}`;
+}
+/** How long a rendered value may get before it is cut. A node id is a handful of
+ *  characters; anything near this is a caller error worth showing, not quoting. */
+const RECEIVED_MAX = 60;
+/**
+ * Render an arbitrary rejected input for a message, TOTALLY.
+ *
+ * This runs inside zod's error path, so it must never throw: a formatter that
+ * throws converts a clean validation refusal into a 500. `JSON.stringify` alone
+ * is not safe here — it throws on a BigInt and on a circular object, returns the
+ * bare `undefined` value for a symbol or a function, and renders NaN/Infinity as
+ * `null`, which would tell a caller who passed NaN that they passed null. Each
+ * of those is handled before the stringify, and the stringify itself is caught.
+ */
+export function describeReceived(input) {
+    if (input === null)
+        return "null";
+    switch (typeof input) {
+        case "undefined":
+            return "undefined";
+        case "bigint":
+            return `${input}n`;
+        case "symbol":
+            return input.toString();
+        case "function":
+            return "a function";
+        case "number":
+        case "boolean":
+            // `String` and not `JSON.stringify`: the latter renders NaN and ±Infinity
+            // as `null`, which would tell a caller who passed NaN that they passed null.
+            return String(input);
+        default:
+            break;
+    }
+    let rendered;
+    try {
+        rendered = JSON.stringify(input) ?? String(input);
+    }
+    catch {
+        // The fallback needs its own guard: `Array.isArray` THROWS on a revoked
+        // proxy ("Cannot perform 'IsArray' on a proxy that has been revoked"), so
+        // the naive recovery path was itself a way for this function to throw.
+        // Measured, not assumed — it is the one hostile input of ten that got past
+        // the outer catch.
+        try {
+            return Array.isArray(input) ? "an array" : "an object";
+        }
+        catch {
+            return "an object";
+        }
+    }
+    return rendered.length > RECEIVED_MAX ? `${rendered.slice(0, RECEIVED_MAX)}…` : rendered;
+}
 //# sourceMappingURL=node-id.js.map

package/dist/orchestrator/node-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-id.js","sourceRoot":"","sources":["../../src/orchestrator/node-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,CAAkB;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAC1B,kFAAkF,CAAC"}
+{"version":3,"file":"node-id.js","sourceRoot":"","sources":["../../src/orchestrator/node-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,CAAkB;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAC1B,kFAAkF,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,QAAQ,cAAc,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;mFACmF;AACnF,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,GAAG,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1B,KAAK,UAAU;YACb,OAAO,YAAY,CAAC;QACtB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,0EAA0E;YAC1E,6EAA6E;YAC7E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB;YACE,MAAM;IACV,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,mBAAmB;QACnB,IAAI,CAAC;YACH,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3F,CAAC"}

package/dist/orchestrator/panel-tools.js

@@ -46,7 +46,7 @@ import { compareSemver } from "../services/self-update.js";
 import { describeInstallPanelAction } from "../services/panel-recovery.js";
 import { peekResolvedPanelBase, primePanelBase, verifiedPanelDiskVersion, } from "../services/panel-workspace.js";
 import { conversationOfScopeAddress, isScopeAddress, shortTabId } from "../services/session-scope.js";
-import { NODE_ID_MESSAGE, NODE_ID_PATTERN, normalizeNodeId, PLAIN_NODE_ID_PATTERN, } from "./node-id.js";
+import { NODE_ID_MESSAGE, NODE_ID_PATTERN, normalizeNodeId, PLAIN_NODE_ID_PATTERN, unionErrorFor, } from "./node-id.js";
 import { parseContradictoryPromotedWidgetRefusal, resolveInnerPromotedTarget, } from "./promoted-widget.js";
 import { includeRequestedCreateGroupMembers } from "./create-group-membership.js";
 import { fastGroupsFilterPropertyNote, isFastGroupsFilterProperty, } from "./rgthree-fast-groups-property.js";
@@ -78,7 +78,7 @@ function journalTabFor(ctx) {
 function journalConversationFor(ctx) {
     return conversationOfScopeAddress(ctx.tabId);
 }
-import { BRIDGE_DEFAULT_TIMEOUT_MS, BRIDGE_READ_DEFAULT_TIMEOUT_MS, dispatchOutcomeOf, GRAPH_CMD_EFFECT, isCapabilityRefusal, isPanelCmdUnsupportedError, isReplyTimeoutTagged, isRoutingAmbiguity, requiresWorkflowStampEnforcement, } from "../services/ui-bridge.js";
+import { BRIDGE_DEFAULT_TIMEOUT_MS, BRIDGE_READ_DEFAULT_TIMEOUT_MS, dispatchOutcomeOf, GRAPH_CMD_EFFECT, isCapabilityRefusal, isPanelCmdUnsupportedError, isMidCommandDisconnectTagged, isReplyTimeoutTagged, isRoutingAmbiguity, requiresWorkflowStampEnforcement, } from "../services/ui-bridge.js";
 import { withWorkflowTarget, } from "../services/workflow-target-store.js";
 import { addUserMcpServer, readUserMcpServers, removeUserMcpServer, setUserMcpServerSecret, } from "../services/user-mcp-config.js";
 import { setComfyuiSecret, setAgentSecret, isAllowedAgentSecretKey, receiptDisclosures, shadowedNote, storeDamageNote, } from "../services/panel-secrets.js";
@@ -580,6 +580,10 @@ export const __panelToolsTestHooks = {
     setReadVramDevices(fn) {
         readVramDevicesOverride = fn;
     },
+    /** #1895 tests drive these, not a copy. A mutation of either that the
+     *  tool-handler suite never reaches must still fail. */
+    annotateFreeVramAck,
+    deviceStillPinned,
     /** Direct access to the #742 decline recheck loop so its hard-deadline
      *  guarantee (codex gate r2) can be unit-tested with a custom deadline. */
     probeDeclineRecovery,
@@ -2075,6 +2079,27 @@ function carryReplyTimeoutMark(err, res) {
 function isReplyTimeoutResult(res) {
     return res?.isError === true && res[REPLY_TIMEOUT_RESULT] === true;
 }
+/** panel#1524 — carry the bridge's typed mid-command-disconnect marker onto the
+ *  ToolResult the same way reply-timeout is carried: an acked panel error can
+ *  quote "OUTCOME UNKNOWN", so the reconcile must not key on message text. */
+const MID_COMMAND_DISCONNECT_RESULT = Symbol("panel.midCommandDisconnectResult");
+function carryMidCommandDisconnectMark(err, res) {
+    if (!isMidCommandDisconnectTagged(err))
+        return res;
+    Object.defineProperty(res, MID_COMMAND_DISCONNECT_RESULT, {
+        value: true,
+        enumerable: false,
+        configurable: true,
+    });
+    return res;
+}
+function isMidCommandDisconnectResult(res) {
+    return (res?.isError === true && res[MID_COMMAND_DISCONNECT_RESULT] === true);
+}
+/** A `graph_run` we wrote and then lost the reply for — timeout or disconnect. */
+function isUnackedGraphRunResult(res) {
+    return isReplyTimeoutResult(res) || isMidCommandDisconnectResult(res);
+}
 /**
  * #1560 — the same translation problem, for the OTHER fact: did anything answer?
  *
@@ -2291,6 +2316,11 @@ function sampleVramDevice(d) {
  *  H3 case was device 2 with the torch pool at ~0.24% free — that occupancy
  *  is what this threshold names.
  *
+ *  The ratio is pool FULLNESS, not the reserved share of the card
+ *  (`torch_vram_total / vram_total`). A 5 GiB reservation with 4 GiB unused
+ *  inside the pool is not pinned here — that shape was not observed live
+ *  after /free (#1895 item 3).
+ *
  *  Unknown/unreadable torch counters are NOT pinned: an unknown answer
  *  claims nothing in either direction (#1473). Device-global counters
  *  alone also claim nothing — they cannot tell ComfyUI from another process. */
@@ -2312,11 +2342,28 @@ function deviceStillPinned(d) {
 function pinnedVramDevices(devices) {
     return devices.filter(deviceStillPinned);
 }
-/** /free only unloads ComfyUI's model manager. Ray workers, parallel CLIP
- *  loaders, and other custom-node allocations survive it and keep the GPU
- *  occupied — which is why a 2xx from /free is not evidence VRAM is free. */
-function pinnedVramAfterFreeNote(pinned) {
-    const named = pinned
+/** Device-global occupancy (`vram_free` / `vram_total`). Same 1 GiB / 20%
+ *  thresholds as the torch pin, applied to the WHOLE card. Used to disclose
+ *  an occupied card that is not this ComfyUI's torch pin (#1895) — never to
+ *  flip freed:true to a /free failure. */
+function deviceOccupiedGlobally(d) {
+    const total = d.vram_total;
+    const free = d.vram_free;
+    if (typeof total !== "number" || typeof free !== "number")
+        return false;
+    if (!Number.isFinite(total) || !Number.isFinite(free))
+        return false;
+    if (total < PINNED_VRAM_MIN_TOTAL_BYTES)
+        return false;
+    if (free < 0)
+        return true;
+    return free / total <= PINNED_VRAM_FREE_RATIO;
+}
+function occupiedVramDevices(devices) {
+    return devices.filter(deviceOccupiedGlobally);
+}
+function nameVramDevices(devices) {
+    return devices
         .map((d) => {
         if (typeof d.index === "number")
             return `device ${d.index}`;
@@ -2325,12 +2372,45 @@ function pinnedVramAfterFreeNote(pinned) {
         return "an unnamed device";
     })
         .join(", ");
+}
+/** /free only unloads ComfyUI's model manager. Ray workers, parallel CLIP
+ *  loaders, and other custom-node allocations survive it and keep the GPU
+ *  occupied — which is why a 2xx from /free is not evidence VRAM is free. */
+function pinnedVramAfterFreeNote(pinned) {
     return (`ComfyUI /free accepted (unload_models + free_memory) but VRAM is STILL PINNED on ` +
-        `${named}. /free only unloads ComfyUI's model manager — it does not terminate Ray ` +
+        `${nameVramDevices(pinned)}. /free only unloads ComfyUI's model manager — it does not terminate Ray ` +
         `workers or custom-node allocations (Raylight sequence-parallel, parallel CLIP loaders). ` +
         `This is not a successful VRAM recovery. Next: panel_restart_comfyui (last resort; ` +
         `refuses mid-render) after confirming with get_system_stats (action:"stats").`);
 }
+/** #1895 — the free DID succeed (torch pool not pinned) but the card is still
+ *  occupied. /system_stats is device-global and cannot name the holder, so
+ *  the wording asserts neither (a) this ComfyUI outside torch nor (b) another
+ *  process. */
+function occupiedCardAfterFreeNote(occupied) {
+    const named = nameVramDevices(occupied);
+    const verb = occupied.length === 1 ? "is" : "are";
+    return (`ComfyUI /free accepted and THIS instance's torch pool is not pinned, so the free DID succeed. ` +
+        `${named} ${verb} still occupied. /system_stats reports the device globally and cannot name ` +
+        `which process holds it. Two shapes this reading cannot distinguish: (a) allocations this ` +
+        `ComfyUI made outside torch's allocator (Ray workers, sequence-parallel / parallel CLIP ` +
+        `loaders) — panel_restart_comfyui of THIS instance can clear those; (b) a different process ` +
+        `on the host (a second ComfyUI, a trainer, the browser) — restarting THIS instance will not ` +
+        `free that VRAM.`);
+}
+function occupiedCardAfterFreeResult(occupied, extra) {
+    return ok({
+        freed: true,
+        unload_models: true,
+        free_memory: true,
+        model_manager_freed: true,
+        occupied_devices: occupied,
+        ...extra,
+        note: occupiedCardAfterFreeNote(occupied),
+    });
+}
+const UNOBSERVED_OCCUPANCY_NOTE = `freed:true is the panel's /free receipt, not a measured device — this tab's server could ` +
+    `not be proven as the local boot instance, so /system_stats was never re-read.`;
 function pinnedVramAfterFreeResult(pinned, extra) {
     return {
         content: [
@@ -2437,11 +2517,17 @@ async function settleFreeVramAfterAckTimeout(ctx, timedOut) {
     };
     // #1866 — a 2xx from /free is not a free GPU. Ray/CLIP workers can keep a
     // device pinned. When we have occupancy numbers, they are the verdict.
+    // #1895 — a card that is occupied while THIS instance's torch pool is empty
+    // is not a /free failure; disclose the device instead of a bare freed:true.
     if (direct.after != null) {
         const pinned = pinnedVramDevices(direct.after);
         if (pinned.length > 0) {
             return pinnedVramAfterFreeResult(pinned, extra);
         }
+        const occupied = occupiedVramDevices(direct.after);
+        if (occupied.length > 0) {
+            return occupiedCardAfterFreeResult(occupied, extra);
+        }
     }
     const statsNote = direct.before != null && direct.after != null
         ? "vram_before/vram_after are the server's own /system_stats counters around the free."
@@ -2468,7 +2554,12 @@ async function settleFreeVramAfterAckTimeout(ctx, timedOut) {
  * settle uses (`captureRebootHealthBase(ctx)`), never `getComfyUIBaseUrl()`.
  * A hello from another tab can retarget the global base asynchronously;
  * reporting that GPU as this command's failure is the wrong-target failure
- * the gate exists to prevent. No proven local server → leave the ack.
+ * the gate exists to prevent.
+ *
+ * #1895 — no proven local server must not look like a measured GPU: disclose
+ * that occupancy was never re-read. An occupied card whose torch pool is
+ * empty is not a /free failure (isError stays false, freed stays true) but
+ * MUST name the device and that /system_stats is device-global.
  */
 async function annotateFreeVramAck(ctx, res) {
     if (res.isError)
@@ -2477,18 +2568,31 @@ async function annotateFreeVramAck(ctx, res) {
     if (!parsed || parsed.freed !== true)
         return res;
     const base = captureRebootHealthBase(ctx);
-    if (!base)
-        return res;
+    if (!base) {
+        return ok({
+            ...parsed,
+            occupancy_reread: false,
+            note: UNOBSERVED_OCCUPANCY_NOTE,
+        });
+    }
     const devices = await readVramDevicesMaybe(base, FREE_VRAM_DIRECT_TIMEOUT_MS);
     if (devices == null)
         return res;
     const pinned = pinnedVramDevices(devices);
-    if (pinned.length === 0)
-        return res;
-    return pinnedVramAfterFreeResult(pinned, {
-        acknowledged: true,
-        devices,
-    });
+    if (pinned.length > 0) {
+        return pinnedVramAfterFreeResult(pinned, {
+            acknowledged: true,
+            devices,
+        });
+    }
+    const occupied = occupiedVramDevices(devices);
+    if (occupied.length > 0) {
+        return occupiedCardAfterFreeResult(occupied, {
+            acknowledged: true,
+            devices,
+        });
+    }
+    return res;
 }
 // ---- panel_install_node: accepted-but-never-enqueued (#1129) ---------------
 // #1143 fixed the pre-queue REFUSAL (403/404 → direct clone). This is the other
@@ -8094,7 +8198,7 @@ export function makePanelToolCtx(bridge, tabId, workflowTargets) {
         const res = await callOnce(cmd, timeoutMs, onDispatchedRid, (err) => {
             failure = err;
         });
-        return carryPanelAnsweredMark(failure, res);
+        return carryMidCommandDisconnectMark(failure, carryPanelAnsweredMark(failure, res));
     };
     // Human-in-the-loop confirmation for a DESTRUCTIVE op: render a yes/no card in
     // the panel and block on the user's pick. Returns false on decline, timeout, or
@@ -8804,45 +8908,85 @@ function runLateAckGraceMs() {
     return runLateAckGraceMsOverride ?? RUN_LATE_ACK_GRACE_MS;
 }
 /**
- * Wait, bounded, for the panel to acknowledge a `graph_run` we stopped waiting
- * for — and hand back the reply it would have produced on time (#1175).
- *
- * Returns null when there is nothing to reconcile, which is every case except a
- * retained `graph_run` success WITH its body. The negatives are deliberate:
- *
- *  - NOT a reply timeout ⇒ nothing to wait for. Gated on the bridge's own typed
- *    mark, never on message text: an acked panel error can quote our timeout
- *    sentence verbatim (#1468 round 2), and the difference between the two is
- *    whether the tab answered, which only the bridge knows.
- *  - NO retained body ⇒ leave the entry ALONE. The retry-token layer drains this
- *    same rid to tell the caller their earlier attempt landed; consuming it here
- *    to answer a question we then could not act on would delete the recovery the
- *    caller still had. Hence peek-then-take.
- *  - A DIFFERENT command's entry ⇒ leave it alone for the same reason. The rid is
- *    ours, so this should not happen; if it ever does, the safe reading of a
- *    surprise is not to spend someone else's notice on it.
+ * Wait, bounded, for evidence that a `graph_run` we stopped waiting for still
+ * queued — and hand back the reply it would have produced on time (#1175,
+ * panel#1524).
+ *
+ * Two receipts, in this order:
+ *
+ *  1. The panel's own late `graph_run` body, retained by the bridge after a
+ *     reply-timeout (#1175) or a mid-command disconnect (panel#1524). Stronger:
+ *     it is the executor's answer, rid-correlated.
+ *  2. A prompt id that appeared in ComfyUI's queue AFTER this dispatch, which
+ *     was not the in-flight prompt when we sent `graph_run`. Weaker: inferred
+ *     from the watchdog, not the panel. Used when the tab dropped before
+ *     acknowledging a paid render that is observably running.
+ *
+ * Returns null when there is nothing to reconcile. The negatives are deliberate:
+ *
+ *  - NOT an unacked post-write (timeout or disconnect) ⇒ nothing to wait for.
+ *    Gated on the bridge's own typed marks, never on message text: an acked
+ *    panel error can quote our timeout/OUTCOME UNKNOWN sentence verbatim
+ *    (#1468 round 2), and the difference is whether the tab answered, which
+ *    only the bridge knows.
+ *  - NO retained body AND no new queue prompt ⇒ leave any unusable late-mutation
+ *    entry ALONE. The retry-token layer drains this same rid to tell the caller
+ *    their earlier attempt landed; consuming it here to answer a question we
+ *    then could not act on would delete the recovery the caller still had.
+ *    Hence peek-then-take.
+ *  - A DIFFERENT command's entry ⇒ leave it alone for the same reason.
+ *  - The SAME prompt that was already running at dispatch ⇒ not this command's
+ *    receipt. Claiming it would launder a prior render as this run.
  */
-async function reconcileLateRunAck(ctx, res, rid) {
-    if (!rid || !isReplyTimeoutResult(res))
+function promptAppearedAfterDispatch(preRunningPromptId) {
+    const id = QueueMonitor.snapshot().runningPromptId;
+    if (typeof id !== "string")
         return null;
-    const bridge = ctx.bridge;
-    if (typeof bridge?.peekLateMutation !== "function")
+    const now = id.trim();
+    if (now === "")
         return null;
-    if (typeof bridge?.takeLateMutation !== "function")
+    const pre = typeof preRunningPromptId === "string" && preRunningPromptId.trim() !== ""
+        ? preRunningPromptId.trim()
+        : null;
+    if (pre !== null && now === pre)
+        return null;
+    return now;
+}
+async function reconcileLateRunAck(ctx, res, rid, preRunningPromptId) {
+    if (!isUnackedGraphRunResult(res))
         return null;
-    const deadline = Date.now() + runLateAckGraceMs();
+    const fromQueue = () => {
+        const promptId = promptAppearedAfterDispatch(preRunningPromptId);
+        if (!promptId)
+            return null;
+        return { result: { queued: true, prompt_id: promptId }, lateByMs: 0, via: "queue" };
+    };
+    const bridge = ctx.bridge;
+    const canPeek = Boolean(rid) &&
+        typeof bridge?.peekLateMutation === "function" &&
+        typeof bridge?.takeLateMutation === "function";
+    // Stubbed bridges in unit tests have no late-mutation map. One-shot the queue
+    // (no grace wait) so a timeout whose prompt did not change still returns in
+    // the same tick it always has.
+    if (!canPeek)
+        return fromQueue();
+    const startedAt = Date.now();
+    const deadline = startedAt + runLateAckGraceMs();
     for (;;) {
         const seen = bridge.peekLateMutation(rid);
         if (seen) {
             if (seen.cmd !== "graph_run" || !("result" in seen))
-                return null;
+                return fromQueue();
             // Only now is it certain this entry will be USED, so draining it costs the
             // caller nothing: they are about to be handed its contents.
             const taken = bridge.takeLateMutation(rid);
             if (!taken || !("result" in taken))
-                return null;
-            return { result: taken.result, lateByMs: taken.lateByMs };
+                return fromQueue();
+            return { result: taken.result, lateByMs: taken.lateByMs, via: "ack" };
         }
+        const queued = fromQueue();
+        if (queued)
+            return { ...queued, lateByMs: Date.now() - startedAt };
         const left = deadline - Date.now();
         if (left <= 0)
             return null;
@@ -8861,6 +9005,15 @@ function lateRunAckNote(lateByMs) {
         `this is its outcome. (A queue listing taken in the moments after a run is accepted can still ` +
         `be empty, so an empty queue would not have settled this either way.)`);
 }
+/** panel#1524 — the panel never acknowledged, but the queue holds a prompt this
+ *  dispatch created. Names the id and says we did not re-issue. */
+function queueRunReceiptNote(promptId) {
+    return (`\n\n[RECOVERED] The panel tab disconnected (or missed its ack) before acknowledging this ` +
+        `graph_run, but ComfyUI's queue now contains prompt ${promptId} — which was not the in-flight ` +
+        `prompt when this command was dispatched. Treating that as this run's receipt (queued:true). ` +
+        `Nothing was dispatched a second time. Do NOT re-run: a second panel_run would bill/queue ` +
+        `another render behind the one already running.`);
+}
 async function pollLateAskReply(bridge, askId, timing, hardDeadline) {
     const take = bridge
         .takeLateAskReply;
@@ -9252,10 +9405,12 @@ function validatePanelEditNodeArgs(args) {
  * node-id.ts, where truncating `"263:78"` to `263` would edit the wrong node.
  */
 const nodeId = () => z
-    .union([
-    z.number().int(),
-    z.string().regex(NODE_ID_PATTERN, NODE_ID_MESSAGE),
-])
+    // #1889 — the union-level `error` is what a caller actually reads. Without it
+    // zod names the failed union `"Invalid input"` and buries NODE_ID_MESSAGE in a
+    // nested `errors` array that no renderer prints. See unionErrorFor.
+    .union([z.number().int(), z.string().regex(NODE_ID_PATTERN, NODE_ID_MESSAGE)], {
+    error: unionErrorFor(NODE_ID_MESSAGE),
+})
     .transform(normalizeNodeId);
 /**
  * #1497 — the ONE node-id argument #845 never reached: panel_run's `to_node_id`.
@@ -9284,10 +9439,10 @@ const nodeId = () => z
  */
 const RUN_TO_NODE_ID_MESSAGE = 'a run-to-node target must be a plain integer node id — 42 or "42" both work. A subgraph-qualified id (e.g. "120:104") is not an execution root: pass the output node\'s own plain id, which is what panel_query_graph prints for it even when it is nested inside a subgraph';
 const runToNodeId = () => z
-    .union([
-    z.number().int(),
-    z.string().regex(PLAIN_NODE_ID_PATTERN, RUN_TO_NODE_ID_MESSAGE),
-])
+    // #1889, same as nodeId(): #1497 wrote RUN_TO_NODE_ID_MESSAGE so a qualified id
+    // would be "refused now by name, with a reason" — and for the shapes that fail
+    // BOTH members the name and the reason were dropped on the floor.
+    .union([z.number().int(), z.string().regex(PLAIN_NODE_ID_PATTERN, RUN_TO_NODE_ID_MESSAGE)], { error: unionErrorFor(RUN_TO_NODE_ID_MESSAGE) })
     .transform((v) => (typeof v === "number" ? v : Number.parseInt(v, 10)));
 /**
  * #845 — which `panel_canvas` arguments the chosen action actually consumes.
@@ -10674,11 +10829,16 @@ export function buildPanelToolDefs() {
             // guidance. Rebuilding the reply here (rather than describing it) is what
             // makes that possible — `ok()` is exactly what ctx.call would have produced.
             const reconcileRun = async () => {
-                const recovered = await reconcileLateRunAck(ctx, res, runRid);
+                const recovered = await reconcileLateRunAck(ctx, res, runRid, pre.runningPromptId);
                 if (!recovered)
                     return;
                 res = ok(recovered.result);
-                lateAckNote = lateRunAckNote(recovered.lateByMs);
+                lateAckNote =
+                    recovered.via === "queue"
+                        ? queueRunReceiptNote(typeof recovered.result.prompt_id === "string"
+                            ? recovered.result.prompt_id
+                            : "?")
+                        : lateRunAckNote(recovered.lateByMs);
             };
             await reconcileRun();
             // Derive the verdict from the AUTHORITATIVE reply, not a bare `queued`
@@ -13999,7 +14159,7 @@ CHECKED FOR YOU: the graph read this message prescribes was just run, and it ` +
                         ".") + argvNote + (preflightNote ? ` ${preflightNote}` : ""),
             });
         }),
-        def("panel_free_vram", "Unload all loaded models and free VRAM (ComfyUI /free). Use to unwedge a stuck/OOM ComfyUI when a cancel didn't free memory — before retrying or, last resort, restarting (panel_restart_comfyui). Does NOT restart ComfyUI; it just drops resident models and frees cached memory. After /free, THIS instance's torch-pool occupancy is re-read from /system_stats on the server this tab provably fronts: if a device remains pinned (Ray workers, parallel CLIP, custom-node allocations /free cannot terminate), the reply names those devices and does NOT claim VRAM was freed — next step is panel_restart_comfyui. Device-global occupancy held by another process is not this free failing. If the panel tab is frozen and cannot acknowledge, the free is instead issued DIRECTLY to the ComfyUI server and verified there (same /free, idempotent) whenever the tab provably fronts the local server — otherwise the outcome is reported unknown rather than claimed.", {}, async (_args, ctx) => {
+        def("panel_free_vram", "Unload all loaded models and free VRAM (ComfyUI /free). Use to unwedge a stuck/OOM ComfyUI when a cancel didn't free memory — before retrying or, last resort, restarting (panel_restart_comfyui). Does NOT restart ComfyUI; it just drops resident models and frees cached memory. After /free, THIS instance's torch-pool occupancy is re-read from /system_stats on the server this tab provably fronts: if a device remains pinned (Ray workers, parallel CLIP, custom-node allocations /free cannot terminate), the reply names those devices and does NOT claim VRAM was freed — next step is panel_restart_comfyui. Device-global occupancy with an empty torch pool is not this free failing (freed:true) but the reply still names the device and that /system_stats cannot say which process holds the card. If this tab's server cannot be proven, freed:true is the panel's /free receipt — occupancy was not re-read. If the panel tab is frozen and cannot acknowledge, the free is instead issued DIRECTLY to the ComfyUI server and verified there (same /free, idempotent) whenever the tab provably fronts the local server — otherwise the outcome is reported unknown rather than claimed.", {}, async (_args, ctx) => {
             const res = await ctx.call({ cmd: "free_vram" }, 15000);
             // #1249 — ONLY a no-reply is settled server-side. An acked executor error
             // (the panel's own "Failed to free VRAM: …") is a reply the bridge