commonswarm 0.1.52 → 0.1.54

package/cswarm.cjs

@@ -13519,7 +13519,8 @@ __export(cli_exports, {
   replyRefusalHint: () => replyRefusalHint,
   resolveDetachedClaudeExecutable: () => resolveDetachedClaudeExecutable,
   resolveDetachedCodexExecutable: () => resolveDetachedCodexExecutable,
-  resolveTurnBudgetOrDefer: () => resolveTurnBudgetOrDefer
+  resolveTurnBudgetOrDefer: () => resolveTurnBudgetOrDefer,
+  usage: () => usage
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_crypto22 = require("node:crypto");
@@ -13530,6 +13531,188 @@ var import_node_os10 = require("node:os");
 var import_node_path21 = require("node:path");
 var import_promises13 = require("node:readline/promises");
 
+// src/protocol/events.ts
+var SCHEMA_VERSION = 1;
+var EVENT_TYPES = [
+  "TaskCreated",
+  "LeaseAcquired",
+  "LeaseRenewed",
+  "LeaseHandedOff",
+  "LeaseTakenOver",
+  "TaskSubmitted",
+  "TaskClosed",
+  "TaskReopened",
+  "CommandRejected"
+];
+
+// src/protocol/reducer.ts
+function req(payload, keys, type, seq) {
+  if (!payload || typeof payload !== "object") throw new StreamIntegrityError(`event "${type}" at seq ${seq} has a non-object payload`);
+  for (const k of keys) {
+    if (payload[k] === void 0) {
+      throw new StreamIntegrityError(`event "${type}" at seq ${seq} is missing payload field "${String(k)}"`);
+    }
+  }
+  return payload;
+}
+var UnknownEventTypeError = class extends Error {
+  constructor(type, seq) {
+    super(`unknown authoritative event type "${type}" at seq ${seq}; halting`);
+    this.type = type;
+    this.seq = seq;
+    this.name = "UnknownEventTypeError";
+  }
+  type;
+  seq;
+};
+var StreamIntegrityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "StreamIntegrityError";
+  }
+};
+function reduceTask(prev, env) {
+  if (!EVENT_TYPES.includes(env.type)) {
+    throw new UnknownEventTypeError(env.type, env.seq);
+  }
+  if (env.schema_version !== SCHEMA_VERSION) {
+    throw new StreamIntegrityError(`event "${env.type}" at seq ${env.seq} is schema v${env.schema_version}, expected v${SCHEMA_VERSION} (upcast before reduce)`);
+  }
+  if (env.type === "CommandRejected") {
+    if (!prev) throw new StreamIntegrityError(`CommandRejected before task exists (seq ${env.seq})`);
+    req(env.payload, ["task_id", "command", "reason", "detail"], env.type, env.seq);
+    return prev;
+  }
+  if (env.type === "TaskCreated") {
+    if (prev) throw new StreamIntegrityError(`TaskCreated for an already-existing task (seq ${env.seq})`);
+    const p = req(env.payload, ["task_id", "slug"], env.type, env.seq);
+    return {
+      task_id: p.task_id,
+      slug: p.slug,
+      lifecycle: "open",
+      version: 1,
+      epoch: 0,
+      owner: null,
+      lease_expiry: null,
+      submission: null,
+      closed_disposition: null
+    };
+  }
+  if (!prev) throw new StreamIntegrityError(`event "${env.type}" before TaskCreated (seq ${env.seq})`);
+  const s = prev;
+  function assertEpochIncrease(ep) {
+    if (typeof ep !== "number" || ep <= s.epoch) {
+      throw new StreamIntegrityError(`${env.type} at seq ${env.seq} has non-increasing epoch ${ep} (current ${s.epoch})`);
+    }
+  }
+  const leaseLifecycle = s.submission ? "awaiting_review" : "active";
+  switch (env.type) {
+    case "LeaseAcquired": {
+      const p = req(env.payload, ["task_id", "epoch", "owner", "lease_expiry"], env.type, env.seq);
+      assertEpochIncrease(p.epoch);
+      return { ...s, lifecycle: leaseLifecycle, epoch: p.epoch, owner: p.owner, lease_expiry: p.lease_expiry };
+    }
+    case "LeaseRenewed": {
+      const p = req(env.payload, ["task_id", "epoch", "lease_expiry"], env.type, env.seq);
+      if (p.epoch !== s.epoch) throw new StreamIntegrityError(`LeaseRenewed at seq ${env.seq} epoch ${p.epoch} != current ${s.epoch}`);
+      return { ...s, lease_expiry: p.lease_expiry };
+    }
+    case "LeaseHandedOff": {
+      const p = req(env.payload, ["task_id", "epoch", "from_owner", "to_owner", "lease_expiry"], env.type, env.seq);
+      assertEpochIncrease(p.epoch);
+      return { ...s, lifecycle: leaseLifecycle, epoch: p.epoch, owner: p.to_owner, lease_expiry: p.lease_expiry };
+    }
+    case "LeaseTakenOver": {
+      const p = req(env.payload, ["task_id", "epoch", "owner", "lease_expiry", "grant_id"], env.type, env.seq);
+      assertEpochIncrease(p.epoch);
+      return { ...s, lifecycle: leaseLifecycle, epoch: p.epoch, owner: p.owner, lease_expiry: p.lease_expiry };
+    }
+    case "TaskSubmitted": {
+      const p = req(env.payload, ["task_id", "epoch", "branch", "head_sha", "evidence_set"], env.type, env.seq);
+      return {
+        ...s,
+        lifecycle: "awaiting_review",
+        submission: { epoch: p.epoch, branch: p.branch, head_sha: p.head_sha, evidence_set: [...p.evidence_set] }
+      };
+    }
+    case "TaskClosed": {
+      const p = req(env.payload, ["task_id", "epoch", "disposition", "grant_id"], env.type, env.seq);
+      return { ...s, lifecycle: "done", closed_disposition: p.disposition };
+    }
+    case "TaskReopened": {
+      const p = req(env.payload, ["task_id", "version"], env.type, env.seq);
+      if (p.version <= s.version) throw new StreamIntegrityError(`TaskReopened at seq ${env.seq} version ${p.version} not > current ${s.version}`);
+      return { ...s, lifecycle: "reopened", version: p.version, submission: null, owner: null, lease_expiry: null };
+    }
+    default: {
+      throw new UnknownEventTypeError(env.type, env.seq);
+    }
+  }
+}
+
+// src/protocol/idempotency.ts
+function canonicalJson(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(v) {
+  if (Array.isArray(v)) return v.map(sortValue);
+  if (v && typeof v === "object") {
+    const out = {};
+    for (const k of Object.keys(v).sort()) {
+      out[k] = sortValue(v[k]);
+    }
+    return out;
+  }
+  return v;
+}
+
+// src/protocol/upcasters.ts
+var registry = /* @__PURE__ */ new Map();
+function key(type, fromVersion) {
+  return `${type}:${fromVersion}`;
+}
+function registerUpcaster(type, fromVersion, fn) {
+  registry.set(key(type, fromVersion), fn);
+}
+var UpcastError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UpcastError";
+  }
+};
+function upcastPayload(type, fromVersion, payload) {
+  let v = fromVersion;
+  let p = payload;
+  if (v > SCHEMA_VERSION) {
+    throw new UpcastError(`event "${type}" is schema v${v}, newer than supported v${SCHEMA_VERSION}; halting`);
+  }
+  while (v < SCHEMA_VERSION) {
+    const fn = registry.get(key(type, v));
+    if (!fn) throw new UpcastError(`no upcaster for "${type}" v${v}\u2192v${v + 1}`);
+    p = fn(p);
+    v += 1;
+  }
+  return { payload: p, schema_version: SCHEMA_VERSION };
+}
+function upcastEnvelope(raw) {
+  const { payload, schema_version } = upcastPayload(raw.type, raw.schema_version, raw.payload);
+  return { ...raw, payload, schema_version };
+}
+registerUpcaster("TaskCreated", 0, (p) => ({ task_id: p.id, slug: p.name }));
+
+// src/protocol/workspace-commands.ts
+var INVITATION_MAX_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var AGENT_TOKEN_DEFAULT_TTL_MS = 60 * 60 * 1e3;
+var AGENT_TOKEN_MAX_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var RENEWAL_HORIZON_DEFAULT_MS = 30 * 24 * 60 * 60 * 1e3;
+var RENEWAL_HORIZON_MAX_MS = 90 * 24 * 60 * 60 * 1e3;
+
+// src/protocol/brain-version-window.ts
+var BRAIN_FILE_PREFIX = "brain--";
+var BRAIN_FILE_SUFFIX = ".md";
+var BRAIN_TOPIC_MAX_LENGTH = 255 - BRAIN_FILE_PREFIX.length - BRAIN_FILE_SUFFIX.length;
+var FILE_VERSION_PRECONDITION_FAILED = "file_version_precondition_failed";
+
 // src/cloud/auth.ts
 var import_node_crypto2 = require("node:crypto");
 var import_node_http = require("node:http");
@@ -21959,189 +22142,6 @@ async function logout(target2, store2, scope = "local", options = {}) {
 
 // src/cloud/command-client.ts
 var import_node_crypto3 = require("node:crypto");
-
-// src/protocol/events.ts
-var SCHEMA_VERSION = 1;
-var EVENT_TYPES = [
-  "TaskCreated",
-  "LeaseAcquired",
-  "LeaseRenewed",
-  "LeaseHandedOff",
-  "LeaseTakenOver",
-  "TaskSubmitted",
-  "TaskClosed",
-  "TaskReopened",
-  "CommandRejected"
-];
-
-// src/protocol/reducer.ts
-function req(payload, keys, type, seq) {
-  if (!payload || typeof payload !== "object") throw new StreamIntegrityError(`event "${type}" at seq ${seq} has a non-object payload`);
-  for (const k of keys) {
-    if (payload[k] === void 0) {
-      throw new StreamIntegrityError(`event "${type}" at seq ${seq} is missing payload field "${String(k)}"`);
-    }
-  }
-  return payload;
-}
-var UnknownEventTypeError = class extends Error {
-  constructor(type, seq) {
-    super(`unknown authoritative event type "${type}" at seq ${seq}; halting`);
-    this.type = type;
-    this.seq = seq;
-    this.name = "UnknownEventTypeError";
-  }
-  type;
-  seq;
-};
-var StreamIntegrityError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "StreamIntegrityError";
-  }
-};
-function reduceTask(prev, env) {
-  if (!EVENT_TYPES.includes(env.type)) {
-    throw new UnknownEventTypeError(env.type, env.seq);
-  }
-  if (env.schema_version !== SCHEMA_VERSION) {
-    throw new StreamIntegrityError(`event "${env.type}" at seq ${env.seq} is schema v${env.schema_version}, expected v${SCHEMA_VERSION} (upcast before reduce)`);
-  }
-  if (env.type === "CommandRejected") {
-    if (!prev) throw new StreamIntegrityError(`CommandRejected before task exists (seq ${env.seq})`);
-    req(env.payload, ["task_id", "command", "reason", "detail"], env.type, env.seq);
-    return prev;
-  }
-  if (env.type === "TaskCreated") {
-    if (prev) throw new StreamIntegrityError(`TaskCreated for an already-existing task (seq ${env.seq})`);
-    const p = req(env.payload, ["task_id", "slug"], env.type, env.seq);
-    return {
-      task_id: p.task_id,
-      slug: p.slug,
-      lifecycle: "open",
-      version: 1,
-      epoch: 0,
-      owner: null,
-      lease_expiry: null,
-      submission: null,
-      closed_disposition: null
-    };
-  }
-  if (!prev) throw new StreamIntegrityError(`event "${env.type}" before TaskCreated (seq ${env.seq})`);
-  const s = prev;
-  function assertEpochIncrease(ep) {
-    if (typeof ep !== "number" || ep <= s.epoch) {
-      throw new StreamIntegrityError(`${env.type} at seq ${env.seq} has non-increasing epoch ${ep} (current ${s.epoch})`);
-    }
-  }
-  const leaseLifecycle = s.submission ? "awaiting_review" : "active";
-  switch (env.type) {
-    case "LeaseAcquired": {
-      const p = req(env.payload, ["task_id", "epoch", "owner", "lease_expiry"], env.type, env.seq);
-      assertEpochIncrease(p.epoch);
-      return { ...s, lifecycle: leaseLifecycle, epoch: p.epoch, owner: p.owner, lease_expiry: p.lease_expiry };
-    }
-    case "LeaseRenewed": {
-      const p = req(env.payload, ["task_id", "epoch", "lease_expiry"], env.type, env.seq);
-      if (p.epoch !== s.epoch) throw new StreamIntegrityError(`LeaseRenewed at seq ${env.seq} epoch ${p.epoch} != current ${s.epoch}`);
-      return { ...s, lease_expiry: p.lease_expiry };
-    }
-    case "LeaseHandedOff": {
-      const p = req(env.payload, ["task_id", "epoch", "from_owner", "to_owner", "lease_expiry"], env.type, env.seq);
-      assertEpochIncrease(p.epoch);
-      return { ...s, lifecycle: leaseLifecycle, epoch: p.epoch, owner: p.to_owner, lease_expiry: p.lease_expiry };
-    }
-    case "LeaseTakenOver": {
-      const p = req(env.payload, ["task_id", "epoch", "owner", "lease_expiry", "grant_id"], env.type, env.seq);
-      assertEpochIncrease(p.epoch);
-      return { ...s, lifecycle: leaseLifecycle, epoch: p.epoch, owner: p.owner, lease_expiry: p.lease_expiry };
-    }
-    case "TaskSubmitted": {
-      const p = req(env.payload, ["task_id", "epoch", "branch", "head_sha", "evidence_set"], env.type, env.seq);
-      return {
-        ...s,
-        lifecycle: "awaiting_review",
-        submission: { epoch: p.epoch, branch: p.branch, head_sha: p.head_sha, evidence_set: [...p.evidence_set] }
-      };
-    }
-    case "TaskClosed": {
-      const p = req(env.payload, ["task_id", "epoch", "disposition", "grant_id"], env.type, env.seq);
-      return { ...s, lifecycle: "done", closed_disposition: p.disposition };
-    }
-    case "TaskReopened": {
-      const p = req(env.payload, ["task_id", "version"], env.type, env.seq);
-      if (p.version <= s.version) throw new StreamIntegrityError(`TaskReopened at seq ${env.seq} version ${p.version} not > current ${s.version}`);
-      return { ...s, lifecycle: "reopened", version: p.version, submission: null, owner: null, lease_expiry: null };
-    }
-    default: {
-      throw new UnknownEventTypeError(env.type, env.seq);
-    }
-  }
-}
-
-// src/protocol/idempotency.ts
-function canonicalJson(value) {
-  return JSON.stringify(sortValue(value));
-}
-function sortValue(v) {
-  if (Array.isArray(v)) return v.map(sortValue);
-  if (v && typeof v === "object") {
-    const out = {};
-    for (const k of Object.keys(v).sort()) {
-      out[k] = sortValue(v[k]);
-    }
-    return out;
-  }
-  return v;
-}
-
-// src/protocol/upcasters.ts
-var registry = /* @__PURE__ */ new Map();
-function key(type, fromVersion) {
-  return `${type}:${fromVersion}`;
-}
-function registerUpcaster(type, fromVersion, fn) {
-  registry.set(key(type, fromVersion), fn);
-}
-var UpcastError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "UpcastError";
-  }
-};
-function upcastPayload(type, fromVersion, payload) {
-  let v = fromVersion;
-  let p = payload;
-  if (v > SCHEMA_VERSION) {
-    throw new UpcastError(`event "${type}" is schema v${v}, newer than supported v${SCHEMA_VERSION}; halting`);
-  }
-  while (v < SCHEMA_VERSION) {
-    const fn = registry.get(key(type, v));
-    if (!fn) throw new UpcastError(`no upcaster for "${type}" v${v}\u2192v${v + 1}`);
-    p = fn(p);
-    v += 1;
-  }
-  return { payload: p, schema_version: SCHEMA_VERSION };
-}
-function upcastEnvelope(raw) {
-  const { payload, schema_version } = upcastPayload(raw.type, raw.schema_version, raw.payload);
-  return { ...raw, payload, schema_version };
-}
-registerUpcaster("TaskCreated", 0, (p) => ({ task_id: p.id, slug: p.name }));
-
-// src/protocol/workspace-commands.ts
-var INVITATION_MAX_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
-var AGENT_TOKEN_DEFAULT_TTL_MS = 60 * 60 * 1e3;
-var AGENT_TOKEN_MAX_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
-var RENEWAL_HORIZON_DEFAULT_MS = 30 * 24 * 60 * 60 * 1e3;
-var RENEWAL_HORIZON_MAX_MS = 90 * 24 * 60 * 60 * 1e3;
-
-// src/protocol/brain-version-window.ts
-var BRAIN_FILE_PREFIX = "brain--";
-var BRAIN_FILE_SUFFIX = ".md";
-var BRAIN_TOPIC_MAX_LENGTH = 255 - BRAIN_FILE_PREFIX.length - BRAIN_FILE_SUFFIX.length;
-
-// src/cloud/command-client.ts
 var AGENT_TOKEN_RE = /^swm_agt_[A-Za-z0-9_-]{43}$/;
 var INVITATION_TOKEN_RE = /^swm_inv_[A-Za-z0-9_-]{43}$/;
 var CAPABILITY_TOKEN_RE = /^swm_cap_[A-Za-z0-9_-]{43}$/;
@@ -22978,13 +22978,18 @@ async function sendFileCommand(options, command2) {
   return body;
 }
 function fileVersionCreate(options, input) {
+  const ifVersion = input.ifVersion ?? null;
   return sendFileCommand(options, {
     kind: "file_version_create",
     file_id: input.fileId,
     version_id: input.versionId,
     name: input.name,
     declared_size_bytes: input.declaredSizeBytes,
-    content_type: input.contentType
+    content_type: input.contentType,
+    /* The server validates an exact key set, so the key is sent only when a
+     * precondition was asked for. An unconditional write is byte-identical to
+     * what every earlier client sent. */
+    ...ifVersion === null ? {} : { if_version: ifVersion }
   });
 }
 function fileVersionCommit(options, input) {
@@ -34514,6 +34519,25 @@ async function resolveBudgetAndPrompt(session, prompt, budget) {
   const timeoutMs = typeof budget === "number" ? budget : await budget();
   return await session.prompt(prompt, { timeoutMs });
 }
+var LISTENER_DELIVERY_MAX_LEASE_MS = 9e5;
+var LISTENER_DELIVERY_HOLD_RELEASE_REASONS = [
+  "hold_budget",
+  "lease_budget"
+];
+var LISTENER_DELIVERY_HOLD_RELEASE_CLAUSES = {
+  hold_budget: "it used the turn budget for one delivery",
+  lease_budget: "what was left of its lease could not cover the next step"
+};
+var LISTENER_DELIVERY_HOLD_RELEASE_REMEDIES = {
+  hold_budget: `a larger --turn-budget gives one delivery more of the seat. Past the ${LISTENER_DELIVERY_MAX_LEASE_MS / 6e4} minutes the service leases a delivery for it stops helping, because the turn then outlives its lease and the reply can no longer be acknowledged. The bound is read when the listener starts, so stop this listener and start it again to change it`,
+  /* NOT a cap: nothing clamps the turn budget to the lease, and leaseSpent
+     refuses to START a phase rather than interrupting one, so a 60m budget
+     really does hold the worker for 60m. The sentence says raising past the
+     lease stops helping, and why, which is what the code supports. An earlier
+     version read "up to the 15 minutes the service leases it for", which a
+     review arm read as a cap the code does not enforce. */
+  lease_budget: "nothing needs raising: the row comes back under a new lease of full length, so the next attempt starts with the room this one ran out of. If it keeps being handed back, the service stops retrying it in the end, so look at the delivery rather than at the bound"
+};
 
 // src/listener/engine.ts
 var UUID_RE14 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -36735,11 +36759,11 @@ function pendingMainEntry(signal, principalId, provenance, now, options = {}) {
 // src/listener/runtime.ts
 var LISTENER_PAGE_LIMIT = 100;
 var LISTENER_IDLE_POLL_MS = 2e3;
-var LISTENER_DELIVERY_MAX_LEASE_MS = 9e5;
 var LISTENER_DELIVERY_SAFETY_MARGIN_MS = 3e4;
 var LISTENER_ACK_ONLY_MINIMUM_MS = DELIVERY_REQUEST_TIMEOUT_MS + LISTENER_DELIVERY_SAFETY_MARGIN_MS;
 var LISTENER_REPLY_ONLY_MINIMUM_MS = SIGNAL_REQUEST_TIMEOUT_MS + LISTENER_ACK_ONLY_MINIMUM_MS;
 var LISTENER_PROMPT_START_MINIMUM_MS = SIGNAL_READ_TIMEOUT_MS + ACP_DEFAULT_REQUEST_TIMEOUT_MS + LISTENER_REPLY_ONLY_MINIMUM_MS;
+var LISTENER_DELIVERY_HOLD_BUDGET_MS = LISTENER_PROMPT_TIMEOUT_MS;
 var LISTENER_DELIVERY_RETRY_INITIAL_MS = 500;
 var LISTENER_DELIVERY_RETRY_MAX_MS = 3e4;
 var LISTENER_HOST_PORTS_PROBE_MS = 6e4;
@@ -37012,6 +37036,7 @@ async function runListenerRuntime(options) {
   const pollMs = options.pollMs ?? LISTENER_IDLE_POLL_MS;
   const routeMode = options.routeMode ?? "worker";
   const deferOverChars = options.deferOverChars ?? null;
+  const deliveryHoldBudgetMs = options.deliveryHoldBudgetMs ?? LISTENER_DELIVERY_HOLD_BUDGET_MS;
   const abort = options.signal;
   const hasInstanceId = options.listenerInstanceId !== void 0;
   const hasJournal = options.deliveryJournal !== void 0;
@@ -37033,6 +37058,12 @@ async function runListenerRuntime(options) {
       new Error("an injected delivery client requires durable delivery configuration")
     );
   }
+  if (!Number.isSafeInteger(deliveryHoldBudgetMs) || deliveryHoldBudgetMs <= 0) {
+    return await closeBeforeStart(
+      options.model,
+      new Error("listener delivery hold budget must be a positive number of milliseconds")
+    );
+  }
   try {
     decideListenerRoute(routeMode, deferOverChars, 0);
     if (routeMode !== "worker" && options.pendingMainQueue === void 0) {
@@ -37626,6 +37657,8 @@ async function runListenerRuntime(options) {
           stop = { reason: "cancelled" };
           break;
         }
+        const claimedAtMs = Date.parse(active.claimCreatedAt);
+        const holdStartedAtMs = Number.isFinite(claimedAtMs) ? Math.min(claimedAtMs, now()) : now();
         const signal = authoritativeSignal(claimed);
         let terminal = null;
         try {
@@ -37692,22 +37725,18 @@ async function runListenerRuntime(options) {
                 throw new Error("stored listener effect does not match the authoritative delivery");
               }
               const requiredBudget = effectPhaseBudget(before);
-              if (leasedUntilMs <= now() + requiredBudget) {
-                await sleep2(
-                  Math.max(
-                    0,
-                    leasedUntilMs + LISTENER_DELIVERY_SAFETY_MARGIN_MS - now()
-                  ),
-                  abort
-                );
-                if (abort?.aborted) {
-                  stop = { reason: "cancelled" };
-                  break;
-                }
-                if (now() >= leasedUntilMs + LISTENER_DELIVERY_SAFETY_MARGIN_MS) {
-                  await journal.clearActive(eventTime(now));
-                  after = null;
-                }
+              const holdSpent = processAttempt > 0 && now() - holdStartedAtMs >= deliveryHoldBudgetMs;
+              const leaseSpent = leasedUntilMs <= now() + requiredBudget;
+              if (holdSpent || leaseSpent) {
+                await journal.clearActive(eventTime(now));
+                after = null;
+                options.onEvent?.({
+                  type: "delivery_hold_released",
+                  signalId: signal.id,
+                  reason: holdSpent ? "hold_budget" : "lease_budget",
+                  heldMs: Math.max(0, now() - holdStartedAtMs),
+                  ts: eventTime(now)
+                });
                 break;
               }
               const processed = await engine.process(signal);
@@ -38206,6 +38235,10 @@ var STATUS_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "lastAckOutcome",
   "consecutiveAckFailureCount",
   "lastAckSignalId",
+  "currentDeliverySignalId",
+  "currentDeliverySince",
+  "heldBackDeliveries",
+  "pendingDeliveryCountAt",
   "routeMode",
   "deferOverChars",
   "pendingForMainCount",
@@ -38250,6 +38283,30 @@ var STATUS_DELIVERY_KEYS = [
   "consecutiveAckFailureCount"
 ];
 var deliveryOutcomes = DELIVERY_ACK_OUTCOMES;
+var LISTENER_HELD_BACK_MAX = 16;
+function parseHeldBackDeliveries(value) {
+  if (!Array.isArray(value) || value.length > LISTENER_HELD_BACK_MAX) return null;
+  const parsed = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+    const entry = item;
+    for (const key2 of Object.keys(entry)) {
+      if (key2 !== "signalId" && key2 !== "at" && key2 !== "reason") return null;
+    }
+    if (typeof entry.signalId !== "string" || !UUID_RE18.test(entry.signalId) || typeof entry.at !== "string" || !Number.isFinite(Date.parse(entry.at)) || typeof entry.reason !== "string" || !LISTENER_DELIVERY_HOLD_RELEASE_REASONS.includes(
+      entry.reason
+    )) {
+      return null;
+    }
+    if (parsed.some((seen) => seen.signalId === entry.signalId)) return null;
+    parsed.push({
+      signalId: entry.signalId,
+      at: entry.at,
+      reason: entry.reason
+    });
+  }
+  return parsed;
+}
 function parseStatus(raw, rejectUnknownKeys = false) {
   let value;
   try {
@@ -38273,7 +38330,8 @@ function parseStatus(raw, rejectUnknownKeys = false) {
   const nullableCount = (candidate) => candidate === null || typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0;
   const nullableTimestamp3 = (candidate) => candidate === null || typeof candidate === "string" && Number.isFinite(Date.parse(candidate));
   const readHealth = row.readHealth === void 0 ? void 0 : parseListenerReadHealth(row.readHealth, rejectUnknownKeys);
-  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE18.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE18.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE18.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !["starting", "ready", "stopping", "stopped", "failed"].includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid3(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || !(row.lastErrorDetail === void 0 || row.lastErrorDetail === null || typeof row.lastErrorDetail === "string" && row.lastErrorDetail.length > 0 && row.lastErrorDetail.length <= 2048 && !/swm_(?:agt|inv|cap)_/i.test(row.lastErrorDetail)) || !(row.lastErrorReasonCode === void 0 || row.lastErrorReasonCode === null || typeof row.lastErrorReasonCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorReasonCode)) || !(row.providerExecutable === void 0 || row.providerExecutable === null || typeof row.providerExecutable === "string" && (0, import_node_path16.isAbsolute)(row.providerExecutable)) || !(row.providerVersion === void 0 || row.providerVersion === null || typeof row.providerVersion === "string" && SEMVER_RE2.test(row.providerVersion)) || !(row.providerLastMeasuredVersion === void 0 || row.providerLastMeasuredVersion === null || typeof row.providerLastMeasuredVersion === "string" && SEMVER_RE2.test(row.providerLastMeasuredVersion)) || !(row.providerBundledAgentSdkVersion === void 0 || row.providerBundledAgentSdkVersion === null || typeof row.providerBundledAgentSdkVersion === "string" && SEMVER_RE2.test(row.providerBundledAgentSdkVersion)) || !(row.providerBundledClaudeCodeVersion === void 0 || row.providerBundledClaudeCodeVersion === null || typeof row.providerBundledClaudeCodeVersion === "string" && SEMVER_RE2.test(row.providerBundledClaudeCodeVersion)) || !(row.providerMinimumRequiredVersion === void 0 || row.providerMinimumRequiredVersion === null || typeof row.providerMinimumRequiredVersion === "string" && SEMVER_RE2.test(row.providerMinimumRequiredVersion)) || !(row.cswarmVersion === void 0 || row.cswarmVersion === null || typeof row.cswarmVersion === "string" && SEMVER_RE2.test(row.cswarmVersion)) || (row.providerVersion === null || row.providerVersion === void 0) !== (row.providerLastMeasuredVersion === null || row.providerLastMeasuredVersion === void 0) || !(row.lastWorkerStderrTail === void 0 || row.lastWorkerStderrTail === null || typeof row.lastWorkerStderrTail === "string" && row.lastWorkerStderrTail.length > 0 && row.lastWorkerStderrTail.length <= 2048 && !/swm_(?:agt|inv|cap)_/i.test(row.lastWorkerStderrTail)) || typeof row.logPath !== "string" || !(0, import_node_path16.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp3(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp3(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp3(row.lastAckAt)) || !(row.lastAckOutcome === void 0 || row.lastAckOutcome === null || typeof row.lastAckOutcome === "string" && deliveryOutcomes.has(row.lastAckOutcome)) || !(row.consecutiveAckFailureCount === void 0 || nullableCount(row.consecutiveAckFailureCount)) || !(row.lastAckSignalId === void 0 || row.lastAckSignalId === null || typeof row.lastAckSignalId === "string" && UUID_RE18.test(row.lastAckSignalId)) || !(row.routeMode === void 0 || row.routeMode === "worker" || row.routeMode === "main" || row.routeMode === "split") || !(row.deferOverChars === void 0 || row.deferOverChars === null || typeof row.deferOverChars === "number" && Number.isSafeInteger(row.deferOverChars) && row.deferOverChars >= 1 && row.deferOverChars <= 1e4) || !(row.pendingForMainCount === void 0 || typeof row.pendingForMainCount === "number" && Number.isSafeInteger(row.pendingForMainCount) && row.pendingForMainCount >= 0) || !(row.droppedForMainCount === void 0 || typeof row.droppedForMainCount === "number" && Number.isSafeInteger(row.droppedForMainCount) && row.droppedForMainCount >= 0) || readHealth === null || !(row.connectionsOpened === void 0 || typeof row.connectionsOpened === "number" && Number.isSafeInteger(row.connectionsOpened) && row.connectionsOpened >= 0) || !(row.connectionReuseRatio === void 0 || typeof row.connectionReuseRatio === "number" && Number.isFinite(row.connectionReuseRatio) && row.connectionReuseRatio >= 0) || !(row.activityPublishFailures === void 0 || typeof row.activityPublishFailures === "number" && Number.isSafeInteger(row.activityPublishFailures) && row.activityPublishFailures >= 0) || !(row.activityLastErrorCode === void 0 || row.activityLastErrorCode === null || typeof row.activityLastErrorCode === "string" && STATUS_ACTIVITY_ERROR_CODES.has(
+  const heldBackDeliveries = row.heldBackDeliveries === void 0 ? void 0 : parseHeldBackDeliveries(row.heldBackDeliveries);
+  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE18.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE18.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE18.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !["starting", "ready", "stopping", "stopped", "failed"].includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid3(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || !(row.lastErrorDetail === void 0 || row.lastErrorDetail === null || typeof row.lastErrorDetail === "string" && row.lastErrorDetail.length > 0 && row.lastErrorDetail.length <= 2048 && !/swm_(?:agt|inv|cap)_/i.test(row.lastErrorDetail)) || !(row.lastErrorReasonCode === void 0 || row.lastErrorReasonCode === null || typeof row.lastErrorReasonCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorReasonCode)) || !(row.providerExecutable === void 0 || row.providerExecutable === null || typeof row.providerExecutable === "string" && (0, import_node_path16.isAbsolute)(row.providerExecutable)) || !(row.providerVersion === void 0 || row.providerVersion === null || typeof row.providerVersion === "string" && SEMVER_RE2.test(row.providerVersion)) || !(row.providerLastMeasuredVersion === void 0 || row.providerLastMeasuredVersion === null || typeof row.providerLastMeasuredVersion === "string" && SEMVER_RE2.test(row.providerLastMeasuredVersion)) || !(row.providerBundledAgentSdkVersion === void 0 || row.providerBundledAgentSdkVersion === null || typeof row.providerBundledAgentSdkVersion === "string" && SEMVER_RE2.test(row.providerBundledAgentSdkVersion)) || !(row.providerBundledClaudeCodeVersion === void 0 || row.providerBundledClaudeCodeVersion === null || typeof row.providerBundledClaudeCodeVersion === "string" && SEMVER_RE2.test(row.providerBundledClaudeCodeVersion)) || !(row.providerMinimumRequiredVersion === void 0 || row.providerMinimumRequiredVersion === null || typeof row.providerMinimumRequiredVersion === "string" && SEMVER_RE2.test(row.providerMinimumRequiredVersion)) || !(row.cswarmVersion === void 0 || row.cswarmVersion === null || typeof row.cswarmVersion === "string" && SEMVER_RE2.test(row.cswarmVersion)) || (row.providerVersion === null || row.providerVersion === void 0) !== (row.providerLastMeasuredVersion === null || row.providerLastMeasuredVersion === void 0) || !(row.lastWorkerStderrTail === void 0 || row.lastWorkerStderrTail === null || typeof row.lastWorkerStderrTail === "string" && row.lastWorkerStderrTail.length > 0 && row.lastWorkerStderrTail.length <= 2048 && !/swm_(?:agt|inv|cap)_/i.test(row.lastWorkerStderrTail)) || typeof row.logPath !== "string" || !(0, import_node_path16.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp3(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp3(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp3(row.lastAckAt)) || !(row.lastAckOutcome === void 0 || row.lastAckOutcome === null || typeof row.lastAckOutcome === "string" && deliveryOutcomes.has(row.lastAckOutcome)) || !(row.consecutiveAckFailureCount === void 0 || nullableCount(row.consecutiveAckFailureCount)) || !(row.lastAckSignalId === void 0 || row.lastAckSignalId === null || typeof row.lastAckSignalId === "string" && UUID_RE18.test(row.lastAckSignalId)) || !(row.currentDeliverySignalId === void 0 || row.currentDeliverySignalId === null || typeof row.currentDeliverySignalId === "string" && UUID_RE18.test(row.currentDeliverySignalId)) || !(row.currentDeliverySince === void 0 || nullableTimestamp3(row.currentDeliverySince)) || heldBackDeliveries === null || !(row.pendingDeliveryCountAt === void 0 || nullableTimestamp3(row.pendingDeliveryCountAt)) || !(row.routeMode === void 0 || row.routeMode === "worker" || row.routeMode === "main" || row.routeMode === "split") || !(row.deferOverChars === void 0 || row.deferOverChars === null || typeof row.deferOverChars === "number" && Number.isSafeInteger(row.deferOverChars) && row.deferOverChars >= 1 && row.deferOverChars <= 1e4) || !(row.pendingForMainCount === void 0 || typeof row.pendingForMainCount === "number" && Number.isSafeInteger(row.pendingForMainCount) && row.pendingForMainCount >= 0) || !(row.droppedForMainCount === void 0 || typeof row.droppedForMainCount === "number" && Number.isSafeInteger(row.droppedForMainCount) && row.droppedForMainCount >= 0) || readHealth === null || !(row.connectionsOpened === void 0 || typeof row.connectionsOpened === "number" && Number.isSafeInteger(row.connectionsOpened) && row.connectionsOpened >= 0) || !(row.connectionReuseRatio === void 0 || typeof row.connectionReuseRatio === "number" && Number.isFinite(row.connectionReuseRatio) && row.connectionReuseRatio >= 0) || !(row.activityPublishFailures === void 0 || typeof row.activityPublishFailures === "number" && Number.isSafeInteger(row.activityPublishFailures) && row.activityPublishFailures >= 0) || !(row.activityLastErrorCode === void 0 || row.activityLastErrorCode === null || typeof row.activityLastErrorCode === "string" && STATUS_ACTIVITY_ERROR_CODES.has(
     row.activityLastErrorCode
   ))) {
     throw new Error("stored listener status is malformed");
@@ -38299,6 +38357,16 @@ function parseStatus(raw, rejectUnknownKeys = false) {
     // Optional key: present only when the file carried it, so a status written
     // without it round-trips byte-for-byte (the routeMode pattern).
     ...row.lastAckSignalId === void 0 ? {} : { lastAckSignalId: row.lastAckSignalId ?? null },
+    ...row.currentDeliverySignalId === void 0 ? {} : {
+      currentDeliverySignalId: row.currentDeliverySignalId ?? null
+    },
+    ...row.currentDeliverySince === void 0 ? {} : {
+      currentDeliverySince: row.currentDeliverySince ?? null
+    },
+    ...heldBackDeliveries === void 0 ? {} : { heldBackDeliveries },
+    ...row.pendingDeliveryCountAt === void 0 ? {} : {
+      pendingDeliveryCountAt: row.pendingDeliveryCountAt ?? null
+    },
     lastErrorDetail: row.lastErrorDetail ?? null,
     lastWorkerStderrTail: row.lastWorkerStderrTail ?? null,
     providerVersion: row.providerVersion ?? null,
@@ -38375,7 +38443,10 @@ async function appendListenerEvent(paths, event) {
     "defer_over_chars",
     "body_length",
     "pending_main_count",
-    "dropped_count"
+    "dropped_count",
+    // How long one delivery held the worker seat, and why it gave it back.
+    "held_ms",
+    "release_reason"
   ]);
   const deliveryModes = /* @__PURE__ */ new Set(["durable_claim", "cursor_fallback"]);
   const routeModes = /* @__PURE__ */ new Set(["worker", "main", "split"]);
@@ -38437,6 +38508,14 @@ async function appendListenerEvent(paths, event) {
     if ((key2 === "body_length" || key2 === "pending_main_count" || key2 === "dropped_count") && !(typeof value === "number" && Number.isSafeInteger(value) && value >= 0)) {
       throw new Error("listener event main-route count is not allowed");
     }
+    if (key2 === "held_ms" && !(typeof value === "number" && Number.isSafeInteger(value) && value >= 0)) {
+      throw new Error("listener event hold duration is not allowed");
+    }
+    if (key2 === "release_reason" && !(typeof value === "string" && LISTENER_DELIVERY_HOLD_RELEASE_REASONS.includes(
+      value
+    ))) {
+      throw new Error("listener event hold release reason is not allowed");
+    }
     if (key2 === "worker_stderr_tail" && !(typeof value === "string" && value.length > 0 && value.length <= 2048)) {
       throw new Error("listener event stderr tail is not allowed");
     }
@@ -38816,6 +38895,7 @@ async function runListenerSupervisor(options) {
     lastWorkerStderrTail: null,
     deliveryMode: null,
     pendingDeliveryCount: null,
+    pendingDeliveryCountAt: null,
     lastTerminalDeliveryFailureCount: null,
     lastTerminalDeliveryFailureAt: null,
     lastClaimAt: null,
@@ -38827,6 +38907,11 @@ async function runListenerSupervisor(options) {
     lastAckOutcome: carried?.lastAckOutcome ?? null,
     consecutiveAckFailureCount: carried?.consecutiveAckFailureCount ?? null,
     lastAckSignalId: carried?.lastAckSignalId ?? null,
+    /* Never carried across a restart: a seat this process does not hold cannot
+       be reported as held, and the queue age restarts with the observations. */
+    currentDeliverySignalId: null,
+    currentDeliverySince: null,
+    heldBackDeliveries: [],
     routeMode: options.routeMode ?? "worker",
     deferOverChars: options.deferOverChars ?? null,
     pendingForMainCount: 0,
@@ -38860,9 +38945,15 @@ async function runListenerSupervisor(options) {
     chain(() => appendListenerEvent(options.paths, event));
   };
   const transition = (state, changes = {}) => {
+    const notWatching = state === "starting" || state === "stopped" || state === "failed";
     status = {
       ...status,
       ...changes,
+      ...notWatching ? {
+        currentDeliverySignalId: null,
+        currentDeliverySince: null,
+        heldBackDeliveries: []
+      } : {},
       state,
       updatedAt: iso2(now)
     };
@@ -39051,6 +39142,7 @@ async function runListenerSupervisor(options) {
         ...status,
         deliveryMode: event.mode,
         pendingDeliveryCount: event.pendingDeliveryCount,
+        pendingDeliveryCountAt: event.pendingDeliveryCount === null ? null : event.ts,
         updatedAt: event.ts
       };
       persist();
@@ -39063,6 +39155,7 @@ async function runListenerSupervisor(options) {
       return;
     }
     if (event.type === "delivery_claim") {
+      const heldBack = (status.heldBackDeliveries ?? []).filter((entry) => entry.signalId !== event.signalId);
       status = {
         ...status,
         readHealth: recordListenerClaim(
@@ -39070,6 +39163,10 @@ async function runListenerSupervisor(options) {
           event.ts
         ),
         pendingDeliveryCount: event.pendingDeliveryCount,
+        pendingDeliveryCountAt: event.ts,
+        currentDeliverySignalId: event.signalId,
+        currentDeliverySince: event.signalId === null ? null : event.ts,
+        heldBackDeliveries: heldBack,
         lastClaimAt: event.ts,
         updatedAt: event.ts
       };
@@ -39101,6 +39198,36 @@ async function runListenerSupervisor(options) {
       });
       return;
     }
+    if (event.type === "delivery_hold_released") {
+      status = {
+        ...status,
+        currentDeliverySignalId: null,
+        currentDeliverySince: null,
+        /* Held back, NOT waiting to be claimed: the row keeps its live lease,
+           so the service cannot hand it to anyone until that lease expires.
+           Both review arms on 33cd24b measured the earlier wording counting it
+           among deliveries "waiting to be claimed". Newest first, deduplicated
+           on the id (a row can be released, redelivered and released again),
+           and bounded. */
+        heldBackDeliveries: [
+          { signalId: event.signalId, at: event.ts, reason: event.reason },
+          ...(status.heldBackDeliveries ?? []).filter(
+            (entry) => entry.signalId !== event.signalId
+          )
+        ].slice(0, LISTENER_HELD_BACK_MAX),
+        lastSignalId: event.signalId,
+        updatedAt: event.ts
+      };
+      persist();
+      log({
+        ts: event.ts,
+        event: "listener_delivery_hold_released",
+        signal_id: event.signalId,
+        release_reason: event.reason,
+        held_ms: Math.max(0, Math.trunc(event.heldMs))
+      });
+      return;
+    }
     if (event.type === "delivery_ack") {
       const failed = event.outcome === "failed_terminal";
       const providerProven = DELIVERY_PROVIDER_PROVEN_OUTCOMES.has(event.outcome);
@@ -39111,6 +39238,13 @@ async function runListenerSupervisor(options) {
         lastAckSignalId: event.signalId,
         consecutiveAckFailureCount: failed ? (status.consecutiveAckFailureCount ?? 0) + 1 : providerProven ? 0 : status.consecutiveAckFailureCount,
         pendingDeliveryCount: null,
+        pendingDeliveryCountAt: null,
+        currentDeliverySignalId: null,
+        currentDeliverySince: null,
+        // An acknowledged row is answered and gone; drop just that one.
+        heldBackDeliveries: (status.heldBackDeliveries ?? []).filter(
+          (entry) => entry.signalId !== event.signalId
+        ),
         lastSignalId: event.signalId,
         updatedAt: event.ts
       };
@@ -39281,7 +39415,14 @@ async function effectiveListenerStatus(paths) {
         state: "failed",
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         stoppedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        lastErrorCode: "unclean_exit"
+        lastErrorCode: "unclean_exit",
+        /* The process is gone: it holds nothing and observes nothing, so every
+           field whose sentence is rendered in the present tense against read
+           time is cleared. pendingDeliveryCount stays, because its line already
+           says it is what the service reported. */
+        currentDeliverySignalId: null,
+        currentDeliverySince: null,
+        heldBackDeliveries: []
       };
       await writeListenerStatus(paths, failed);
       return failed;
@@ -41648,6 +41789,23 @@ var ListenerHttpClient = class {
 
 // src/resume.ts
 var import_node_child_process8 = require("node:child_process");
+var DEFAULT_PROCESS_TABLE_COMMAND = {
+  file: "ps",
+  args: ["-axo", "pid=,command="]
+};
+var ProcessTableError = class extends Error {
+  constructor(command2, detail) {
+    super(
+      `could not read the host process table with ${command2.file}: ${detail}`
+    );
+    this.command = command2;
+    this.detail = detail;
+    this.name = "ProcessTableError";
+  }
+  command;
+  detail;
+  code = "process_table_unavailable";
+};
 function execFileText(file, args) {
   return new Promise((resolve3, reject) => {
     (0, import_node_child_process8.execFile)(file, [...args], {
@@ -41659,15 +41817,76 @@ function execFileText(file, args) {
     });
   });
 }
-function systemProcessTable() {
+function parseProcessRow(line) {
+  const match = /^\s*(\d+)\s+(.*)$/.exec(line);
+  if (!match) return null;
+  const pid = Number(match[1]);
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  return { pid, command: match[2] };
+}
+var PROCESS_TABLE_STDERR_MAX_CHARS = 2e3;
+function systemProcessTable(options = {}) {
+  const command2 = options.command ?? DEFAULT_PROCESS_TABLE_COMMAND;
+  const retain = options.retain ?? (() => true);
   return {
-    async list() {
-      const output = await execFileText("ps", ["-axo", "pid=,command="]);
-      return output.split("\n").flatMap((line) => {
-        const match = /^\s*(\d+)\s+(.*)$/.exec(line);
-        if (!match) return [];
-        const pid = Number(match[1]);
-        return Number.isSafeInteger(pid) && pid > 0 ? [{ pid, command: match[2] }] : [];
+    list() {
+      return new Promise((resolve3, reject) => {
+        const child = (0, import_node_child_process8.spawn)(command2.file, [...command2.args], {
+          stdio: ["ignore", "pipe", "pipe"]
+        });
+        const rows3 = [];
+        let pending = "";
+        let stderr = "";
+        let settled = false;
+        const fail = (detail) => {
+          if (settled) return;
+          settled = true;
+          child.stdout.destroy();
+          reject(new ProcessTableError(command2, detail));
+        };
+        const take = (line) => {
+          const row = parseProcessRow(line);
+          if (row === null) return true;
+          try {
+            if (retain(row.command)) rows3.push(row);
+          } catch {
+            fail("its row filter threw");
+            return false;
+          }
+          return true;
+        };
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+          if (settled) return;
+          const lines = (pending + chunk).split("\n");
+          pending = lines.pop() ?? "";
+          for (const line of lines) {
+            if (!take(line)) return;
+          }
+        });
+        child.stderr.setEncoding("utf8");
+        child.stderr.on("data", (chunk) => {
+          const room = PROCESS_TABLE_STDERR_MAX_CHARS - stderr.length;
+          if (room > 0) stderr += chunk.slice(0, room);
+        });
+        child.stdout.on("error", () => fail("its output stream failed"));
+        child.stderr.on("error", () => fail("its error stream failed"));
+        child.on("error", (error) => fail(error.name));
+        child.on("close", (code, signal) => {
+          if (settled) return;
+          if (pending.length > 0 && !take(pending)) return;
+          if (signal !== null) {
+            fail(`it was stopped by ${signal}`);
+            return;
+          }
+          if (code !== 0) {
+            const trailer = stderr.trim().length > 0 ? `: ${stderr.trim().slice(0, PROCESS_TABLE_STDERR_MAX_CHARS)}` : "";
+            fail(`it exited ${code}${trailer}`);
+            return;
+          }
+          settled = true;
+          resolve3(rows3);
+        });
       });
     }
   };
@@ -41717,7 +41936,10 @@ function isNotifyCommand(command2) {
   return /(?:^|\s)inbox(?:\s|$)/.test(command2) && /(?:^|\s)--notify(?:\s|$)/.test(command2);
 }
 async function findNotifyWatchers(options) {
-  const processTable = options.processTable ?? systemProcessTable();
+  const processTable = options.processTable ?? systemProcessTable({
+    retain: isNotifyCommand,
+    ...options.processTableCommand ? { command: options.processTableCommand } : {}
+  });
   const stdoutConsumer = options.stdoutConsumer ?? lsofStdoutConsumer();
   const rows3 = await processTable.list();
   const matches = rows3.flatMap((row) => {
@@ -41985,6 +42207,7 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "grok-executable",
   "head-sha",
   "help",
+  "if-version",
   "include-stale",
   "include-tombstoned",
   "invitation-id",
@@ -42056,8 +42279,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 ]);
 var UUID_RE23 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function packageVersion() {
-  if ("0.1.52".length > 0) {
-    return "0.1.52";
+  if ("0.1.54".length > 0) {
+    return "0.1.54";
   }
   try {
     const value = JSON.parse(
@@ -42192,7 +42415,7 @@ Usage:
   cswarm file restore <name|file-id> [--url <url> --anon-key <key>] [--workspace-id <uuid>] ${agentCredential2} [--json]
   cswarm brain ls [--url <url> --anon-key <key>] [--workspace-id <uuid>] ${agentCredential2} [--json]
   cswarm brain get <topic>[@<version>] [--version <n>] [--url <url> --anon-key <key>] [--workspace-id <uuid>] ${agentCredential2} [--json]
-  cswarm brain put <topic> [<markdown-path>] [--url <url> --anon-key <key>] [--workspace-id <uuid>] ${agentCredential2} [--json]  # without a path, reads Markdown from stdin
+  cswarm brain put <topic> [<markdown-path>] [--url <url> --anon-key <key>] [--workspace-id <uuid>] ${agentCredential2} [--if-version <n>] [--json]  # without a path, reads Markdown from stdin; --if-version refuses the write unless the live version is still <n>
   cswarm feedback "<text>" --kind bug|idea|friction [--about <ref>] [--url <url> --anon-key <key>] [--workspace-id <uuid>] ${agentCredential2} [--json]
   cswarm listen start ${requiredAgentCredential} [--url <url> --anon-key <key>] --workspace-id <uuid> --provider grok|opencode|claude|codex [--cwd <absolute-path>] [--model <model>] [--effort <level>] [--permissions deny|allow] [--grok-executable <path>] [--opencode-executable <path>] [--claude-executable <path>] [--codex-executable <path>] [--turn-budget <duration>] [--route worker|main|split] [--defer-over <chars>] [--allow-unattended] [--foreground] [--json]
   cswarm listen canary ${requiredAgentCredential} [--url <url> --anon-key <key>] --workspace-id <uuid> [--state-dir <path>] [--wait <seconds>] [--json]
@@ -42282,7 +42505,10 @@ due \u2014 a turn never outlives its credential. Right after a rotation the full
 budget is available up to the token TTL minus 60s (about 59m on the default 1h
 TTL); a turn that lands just before a rotation can be clamped to the ~5m
 renewal lead, and if it times out there, durable delivery retries it on the
-fresh credential.
+fresh credential. The same budget also bounds how long ONE delivery may hold the
+worker seat across its retries: when it is spent the listener hands the seat
+back and claims the next delivery. After the lease ends the service either
+delivers the released one again or terminates it.
 
 listen start --route worker|main|split chooses where directed messages go. worker
 is the unchanged default. main queues every ask or note for the interactive session.
@@ -45305,6 +45531,12 @@ function listenerStatusJson(status, permissionMode, evidence = {
     lastAckOutcome: status.lastAckOutcome ?? null,
     consecutiveAckFailureCount: status.consecutiveAckFailureCount ?? null,
     lastAckSignalId: status.lastAckSignalId ?? null,
+    currentDeliverySignalId: status.currentDeliverySignalId ?? null,
+    currentDeliverySince: status.currentDeliverySince ?? null,
+    currentDeliveryElapsedMs: status.currentDeliverySince ? Math.max(0, nowMs - Date.parse(status.currentDeliverySince)) : null,
+    pendingDeliveryCountAt: status.pendingDeliveryCountAt ?? null,
+    heldBackDeliveries: status.heldBackDeliveries ?? [],
+    heldBackDeliveryCount: (status.heldBackDeliveries ?? []).length,
     routeMode: status.routeMode ?? "worker",
     deferOverChars: status.deferOverChars ?? null,
     pendingForMainCount: status.pendingForMainCount ?? 0,
@@ -45427,8 +45659,26 @@ function renderListenerStatus(status, evidence = {
     lines.push("Delivery mode has not been reported yet.");
   }
   if (status.pendingDeliveryCount !== null) {
+    const observedAt = status.pendingDeliveryCountAt ?? null;
+    lines.push(
+      `Pending deliveries reported by the service: ${status.pendingDeliveryCount}.` + (observedAt === null ? " When the service reported it was not recorded." : ` The service reported that ${relativeAge(observedAt, nowMs)}.`)
+    );
+  }
+  const currentDeliveryId = status.currentDeliverySignalId ?? null;
+  const currentDeliverySince = status.currentDeliverySince ?? null;
+  if (currentDeliveryId !== null && currentDeliverySince !== null) {
+    lines.push(
+      `Working on delivery ${currentDeliveryId}, claimed ${relativeAge(currentDeliverySince, nowMs)}.`
+    );
+  } else {
+    lines.push("No delivery is being worked on right now.");
+  }
+  const heldBack = status.heldBackDeliveries ?? [];
+  const newestHeldBack = heldBack[0];
+  if (newestHeldBack !== void 0) {
+    const others = heldBack.length - 1;
     lines.push(
-      `Pending deliveries reported by the service: ${status.pendingDeliveryCount}.`
+      `Delivery ${newestHeldBack.signalId} was handed back ${relativeAge(newestHeldBack.at, nowMs)} because ${LISTENER_DELIVERY_HOLD_RELEASE_CLAUSES[newestHeldBack.reason]}.` + (others > 0 ? ` This listener is still tracking ${others} other handed-back ${others === 1 ? "delivery" : "deliveries"}.` : "") + ` This listener has not answered it. After the lease ends the service either delivers it again or terminates it. If this repeats, ${LISTENER_DELIVERY_HOLD_RELEASE_REMEDIES[newestHeldBack.reason]}.`
     );
   }
   lines.push(
@@ -45969,6 +46219,9 @@ async function runConfiguredListener(options) {
             },
             routeMode,
             deferOverChars,
+            /* One delivery may hold the seat for one turn budget, not for the
+               whole 15-minute lease. Same lever, so the two cannot drift. */
+            deliveryHoldBudgetMs: turnBudgetMs,
             pendingMainQueue,
             fetcher: httpClient.fetch
           });
@@ -46796,7 +47049,7 @@ async function resolveFileSelector(context, selector) {
   }
   return match.file_id;
 }
-async function uploadNamedFile(context, name, bytes) {
+async function uploadNamedFile(context, name, bytes, options = {}) {
   if (bytes.byteLength > FILE_MAX_VERSION_BYTES) {
     throw new Error(
       `this file is ${formatFileSize(bytes.byteLength)}; the per-file limit is ${formatFileSize(FILE_MAX_VERSION_BYTES)}, so the upload was not started`
@@ -46823,7 +47076,8 @@ async function uploadNamedFile(context, name, bytes) {
       versionId,
       name,
       declaredSizeBytes: bytes.byteLength,
-      contentType
+      contentType,
+      ...options.ifVersion === void 0 ? {} : { ifVersion: options.ifVersion }
     })
   );
   await onceRetried(
@@ -47117,7 +47371,8 @@ async function runBrainPut(args) {
       "cswarm brain put cannot read both the credential and Markdown from stdin; use --agent-token-file or pass a Markdown path"
     );
   }
-  const context = await fileContext(args, [], args.positionals.length);
+  const context = await fileContext(args, ["if-version"], args.positionals.length);
+  const ifVersion = args.optional("if-version") === void 0 ? void 0 : integer2(args, "if-version", { minimum: 0 });
   let bytes;
   if (localPath) {
     try {
@@ -47132,7 +47387,19 @@ async function runBrainPut(args) {
     bytes = await readBrainMarkdownFromStdin();
   }
   decodeBrainMarkdown(bytes);
-  const committed = await uploadNamedFile(context, brainFileName(topic), bytes);
+  const committed = await uploadNamedFile(
+    context,
+    brainFileName(topic),
+    bytes,
+    ifVersion === void 0 ? {} : { ifVersion }
+  ).catch((error) => {
+    if (error instanceof FileCommandRefused && error.code === FILE_VERSION_PRECONDITION_FAILED) {
+      throw new Error(
+        `${error.message}. Someone saved a new version after you read this topic. Re-read it, apply your change to that copy, then put it again: cswarm brain get ${topic}`
+      );
+    }
+    throw error;
+  });
   if (args.has("json")) {
     process.stdout.write(`${JSON.stringify({ topic, ...committed }, null, 2)}
 `);
@@ -47634,5 +47901,6 @@ ${usage()}
   replyRefusalHint,
   resolveDetachedClaudeExecutable,
   resolveDetachedCodexExecutable,
-  resolveTurnBudgetOrDefer
+  resolveTurnBudgetOrDefer,
+  usage
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commonswarm",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "description": "CommonSwarm CLI — coordination for teams where people and AI agents work side by side.",
   "bin": {
     "cswarm": "cswarm.cjs"