in2-agent-server 0.20261025.25549 → 0.20261025.32045

package/README.md

@@ -260,9 +260,19 @@ load-bearing and skipping one is refused by name. Ending a run early is legal fr
 
 `resume_session {sessionId}` picks up a run a previous session left unfinished: it reconstructs the
 position from the ledger plus the artifacts, reports where the two disagree rather than reconciling
-them, and **checks the org auth instead of assuming it** — an activation-minted token lasts about a
-day, so the commonest resume has intact artifacts and a dead org, which is a card for the operator
-and never a re-authentication.
+them, and **checks the org's sign-in instead of assuming it** — an activation sign-in can die while
+nobody is watching (its lifetime has never been measured; see `docs/orgs-and-credentials.md` trap 1),
+and `sf org display` still names the org for a dead one, so the resume probes liveness and tells a dead
+sign-in (a card: sign in again with `org_login {sessionId}`) from one it could not check (try again).
+It never re-authenticates anything itself.
+
+**A sign-in that dies mid-run is recovered in the same run** (BUG-011). The write gate refuses
+`ORG_AUTH_EXPIRED` only on a definite negative — a network blip or maintenance page is re-checked
+once and passed — and `advance_phase` checks it once more on entering delivery. The operator is
+carded, signs in again through `org_login {sessionId}` (a browser flow under a staging alias, rebound
+only after the new sign-in proves to be the session's own org), and the refused step re-runs. A wave
+that loses its sign-in after Salesforce has the job is `AMBIGUOUS_DELIVERY` naming the job id, and
+re-running that step polls the job instead of submitting it again.
 
 ## Tools
 

package/dist/core/chapterInstructions.js

@@ -53,9 +53,10 @@ const BRIEFS = {
             "This batch is provider-bound: every step from here to close_batch uses the mcp__in2__ tools only,",
             "whatever other Salesforce MCPs this client has connected.",
             "",
-            "NEVER ask for a username, password or token, and never re-authenticate an org yourself when a",
-            "session dies. Salesforce auto-freezes an integration user on rapid retries, so a second attempt is",
-            "not free — stop, and tell the operator exactly what to run.",
+            "NEVER ask for a username, password or token, and never re-authenticate an org on your own",
+            "initiative. Salesforce auto-freezes an integration user on rapid retries, so every attempt is one the",
+            "operator asked for: a sign-in that dies mid-run is carded first, and `org_login {sessionId}` runs only",
+            "on their yes.",
             "",
             "CARRY THE sessionId, NOT AN ORG. Every org-touching tool derives its org from the session, bound and",
             "verified when the session was created. `ALIAS_REPOINTED` means the alias moved to another org since",
@@ -421,11 +422,18 @@ const BRIEFS = {
             "  shipping a VALIDATED member beside a refused one. `objectFacetUpdates` have no practice mode at all.",
             "- A ListView delete is a MANUAL SETUP TASK by default. \"Nothing references it\" is not evidence.",
             "",
-            "NEVER RE-AUTH THE ORG YOURSELF. On `ORG_READ_FAILED` / `Session expired`: card the operator with the",
-            "fix (one line, re-auth from Campfire), then `close_batch {sessionId}`, then stop — IN THAT ORDER.",
+            "SIGN-IN LOST MID-RUN (`ORG_AUTH_EXPIRED`, `ORG_READ_FAILED` / `Session expired`). NEVER RE-AUTH THE ORG",
+            "YOURSELF: card the operator — sign in again (recommended) or stop. On yes, `org_login {sessionId}`, a",
+            "browser flow THEY complete; call it again until it says signed back in. It refuses a sign-in to any",
+            "other org. Then re-run the refused step as it was: the refusal deployed nothing and the approval",
+            "stands. An `AMBIGUOUS_DELIVERY` whose notes say the sign-in was lost: sign in, then re-run the same",
+            "step — it polls the job the interrupted attempt submitted and never resubmits it.",
+            "If they cannot sign in now: card, then `close_batch {sessionId}`, then stop — IN THAT ORDER.",
             "`close_batch` makes no org round-trip, so it works with every token dead; a run that stops at the",
             "card reads as in-progress-forever and the waves that DID land are never reported. Rapid retries trip",
-            "Salesforce's integration-user auto-freeze, so never touch the token endpoint yourself.",
+            "Salesforce's integration-user auto-freeze: one attempt per yes, and never touch a token endpoint.",
+            "`ORG_UNREACHABLE`: nothing was deployed and the sign-in's state is unknown — re-run once the connection",
+            "is back; only if Salesforce is reachable and it still fails, card the sign-in.",
             "",
             "A FAILED APPLY IS NEVER ANOTHER PROVIDER'S TO RETRY. This is the chapter where the temptation is",
             "real: `REJECTED_BY_ORG`, a refusal, a wave that will not lint — and another Salesforce MCP connected",

package/dist/core/gate.js

@@ -1,3 +1,4 @@
+import { AUTH_PROBE_TIMEOUT_MS, checkOrgLiveness } from "./orgAuth.js";
 import { runProcess, sfCliEnv } from "./spawn.js";
 import { isOrgGranted } from "./writeGrants.js";
 // Execution-gate semantics copied from apps/in2-interactive/lib/flue/execution-gate.ts:
@@ -12,6 +13,14 @@ export class GateError extends Error {
     }
 }
 const orgIdCache = new Map();
+/**
+ * Drop the memoized org id for an alias (BUG-011). The cache is safe only while an alias keeps
+ * pointing at the same credential; a mid-run re-sign-in (`org_login {sessionId}`) repoints the alias
+ * at a fresh auth file, and the next resolution must come from the CLI rather than from before it.
+ */
+export function forgetOrgId(alias) {
+    orgIdCache.delete(alias);
+}
 export async function defaultOrgIdResolver(alias) {
     const cached = orgIdCache.get(alias);
     if (cached)
@@ -52,9 +61,11 @@ export async function defaultOrgIdResolver(alias) {
  * itself, as a less legible error, once the gate has passed from cache once.
  */
 export async function defaultOrgLivenessProbe(alias) {
+    // Killed just after checkOrgLiveness's own cap (BUG-011): offline, this call takes ~32 s, and a
+    // probe the caller has already given up on must not linger as a child process.
     const run = await runProcess("sf", ["org", "display", "--target-org", alias, "--json"], {
         env: sfCliEnv(),
-        timeoutMs: 60_000
+        timeoutMs: AUTH_PROBE_TIMEOUT_MS + 2_000
     });
     if (run.timedOut)
         return null;
@@ -62,8 +73,15 @@ export async function defaultOrgLivenessProbe(alias) {
         const parsed = JSON.parse(run.stdout);
         if (parsed.result)
             return { ...(parsed.result.connectedStatus ? { connectedStatus: parsed.result.connectedStatus } : {}) };
-        // A parseable answer with no result is the CLI saying it has no auth for this alias — a real
-        // answer, and a negative one. Distinct from the unparseable case below, which is no answer.
+        // The envelope's NAME travels with its message (BUG-011 simulation runbook §1.3 #2): offline with
+        // a day-old API-version cache, the CLI answers `{name: "DomainNotFoundError", message: "Parsing
+        // --target-org ... The org cannot be found"}`, and only the name says it is a resolution failure.
+        if (parsed.message && parsed.name)
+            return { connectedStatus: `${parsed.name}: ${parsed.message}` };
+        // A parseable answer with no result is the CLI's error envelope. Its message is passed on as the
+        // status and CLASSIFIED like any other (core/orgAuth.ts): "No authorization information found"
+        // is a definite negative, but the same envelope also carries lock-file and decipher errors from
+        // an auth file another sf child is rewriting, which are not. Until BUG-011 every envelope refused.
         return parsed.message ? { connectedStatus: parsed.message } : null;
     }
     catch {
@@ -127,7 +145,7 @@ export function campfireAllowlistedOrgIds() {
     const ids = raw ? raw.split(",").map((entry) => entry.trim()).filter(Boolean) : [...CONSULTANT_ORG_IDS];
     return ids.map(normalizeOrgId);
 }
-export async function assertCampfireWriteAllowed(consultantOrg, resolveOrgId = defaultOrgIdResolver) {
+export async function assertCampfireWriteAllowed(consultantOrg, resolveOrgId = defaultOrgIdResolver, probeLiveness = defaultOrgLivenessProbe, sleep) {
     assertTargetOrg(consultantOrg);
     if (!campfireWriteEnabled()) {
         throw new GateError("CAMPFIRE_WRITE_NOT_AUTHORIZED", "Campfire writes are default-closed (the consultant org is real and shared). Start the server with CC_MCP_CAMPFIRE_WRITE=1 to enable them — this gate is deliberately separate from CC_MCP_EXECUTION.");
@@ -140,6 +158,18 @@ export async function assertCampfireWriteAllowed(consultantOrg, resolveOrgId = d
     if (!allowlist.includes(normalizeOrgId(orgId))) {
         throw new GateError("CONSULTANT_ORG_NOT_ALLOWLISTED", `Org ${orgId} (alias ${consultantOrg}) is not on the Campfire write allowlist [${allowlist.join(", ")}].`);
     }
+    // BUG-011 slice 4, the writeback half of .audit/oauth-expiry.md item 5. This gate resolved the org
+    // id from a per-process cache and never asked whether the credential still worked, so a dead
+    // consultant sign-in surfaced as a jsforce error at the FIRST upsert, after the delivery had
+    // landed. Same probe and classifier as the direct tier, after the allowlist for the same reason:
+    // authority first, then reachability.
+    const liveness = await checkOrgLiveness(consultantOrg, { probe: probeLiveness, ...(sleep ? { sleep } : {}) });
+    if (liveness.state === "dead") {
+        throw new GateError("ORG_AUTH_EXPIRED", `The Campfire org ${orgId} (alias ${consultantOrg}) is the right org, but its stored sign-in no longer works (${liveness.status ?? "no status"}). ` +
+            `Nothing was written to Campfire, and the delivery itself is unaffected: only the record of it is waiting.\n` +
+            `Fix in this run: ask the operator in one card whether to sign in to Campfire again now. On yes, call org_login {sessionId, role: "campfire"} (a browser sign-in THEY complete, checked against the Campfire org id before anything is rebound), then re-run this writeback. One attempt per "yes".\n` +
+            `If they cannot sign in now: card what is unwritten, then close_batch {sessionId}, then stop.`);
+    }
 }
 // Direct working tier (Amendment A, plan 2026-07-22-001): raw metadata writes with
 // mandatory lint -> checkOnly -> deploy -> re-project -> three-way diff. Own gate,
@@ -153,7 +183,7 @@ export function directAllowlistedOrgIds() {
     const ids = raw ? raw.split(",").map((entry) => entry.trim()).filter(Boolean) : [T_PINTO_ORG_ID];
     return ids.map(normalizeOrgId);
 }
-export async function assertDirectWriteAllowed(targetOrg, resolveOrgId = defaultOrgIdResolver, orgIsGranted = isOrgGranted, probeLiveness = defaultOrgLivenessProbe) {
+export async function assertDirectWriteAllowed(targetOrg, resolveOrgId = defaultOrgIdResolver, orgIsGranted = isOrgGranted, probeLiveness = defaultOrgLivenessProbe, sleep) {
     assertTargetOrg(targetOrg);
     if (!directWriteEnabled()) {
         throw new GateError("DIRECT_WRITE_NOT_AUTHORIZED", "The direct working tier is default-closed. Start the server with CC_MCP_DIRECT_WRITE=1 to enable it (org authority then comes from activate_session, or from CC_MCP_DIRECT_ALLOWLIST for internal testing).");
@@ -191,27 +221,32 @@ export async function assertDirectWriteAllowed(targetOrg, resolveOrgId = default
     }
     // THE GRANT AND THE TOKEN IT AUTHORIZES ARE ON DIFFERENT CLOCKS, and until this check existed the
     // gate read only the slower one. A grant lasts 30 days (`writeGrants.ts`); the activation refresh
-    // token it authorizes lasts about ONE (`docs/orgs-and-credentials.md`). So for 29 of 30 days an
-    // install believed it could write to an org it could no longer reach, and the truth arrived from
-    // Salesforce as `Session expired` mid-deploy — discovered on the first request rather than at
-    // connect (`direct/rollbackRun.ts` header), which is the worst possible moment for it.
+    // token it authorizes has NO measured lifetime. The IN2 Launch app's metadata says
+    // `refreshTokenPolicy=infinite`, yet activation tokens demonstrably die: revoked, the per-user
+    // approval limit, a target org that manages the app with its own policy (`docs/orgs-and-
+    // credentials.md` trap 1). An earlier version of this comment said "about one day"; nobody ever
+    // measured that. Either way the install could believe it was authorized to write to an org it
+    // could no longer reach, and the truth arrived from Salesforce as `Session expired` mid-deploy,
+    // discovered on the first request rather than at connect (`direct/rollbackRun.ts` header), which
+    // is the worst possible moment for it.
     //
-    // A liveness probe rather than a shorter calendar TTL, deliberately. The doctrine's own
-    // first-choice recovery is `sf org login web --alias <the session alias>`, which re-mints a
-    // durable CLI token under the SAME alias without touching the grant. Shortening the TTL would
-    // revoke authority the operator had just legitimately restored. Calendar time bounds the
-    // ENGAGEMENT; the probe answers whether the org is reachable right now.
+    // A liveness probe rather than a shorter calendar TTL, deliberately. The in-run recovery,
+    // `org_login {sessionId}`, re-mints the credential for the SAME org under the session's alias
+    // without touching the grant. Shortening the TTL would revoke authority the operator had just
+    // legitimately restored. Calendar time bounds the ENGAGEMENT; the probe answers whether the org is
+    // reachable right now.
     //
-    // ONLY A DEFINITE NEGATIVE REFUSES. A probe that returns nothing, or an answer that names no
-    // status at all, is the CLI declining to say — which is the same evidence state as not having
-    // looked, and this file's own doctrine is that "I could not verify that" is only true after you
-    // looked. Refusing on silence would turn a flaky child process, or an org whose auth shape does
-    // not report a status, into a blocked delivery.
-    const liveness = await probeLiveness(targetOrg);
-    if (liveness?.connectedStatus && liveness.connectedStatus !== "Connected") {
-        throw new GateError("ORG_AUTH_EXPIRED", `Org ${orgId} (alias ${targetOrg}) is authorized by this install, but its stored sign-in is no longer valid (${liveness.connectedStatus}). ` +
-            `Activation-minted tokens last about a day, so a session resumed the next morning reads this way — the write authority outlives the credential it authorizes.\n` +
-            `Fix, either way: sign in directly with \`sf org login web --alias ${targetOrg} --instance-url <their org url>\` (one clean attempt — rapid retries trip Salesforce's integration-user auto-freeze), or re-send the requirements from Campfire and redeem a fresh code with activate_session.\n` +
-            `Refusing fail-closed: nothing was deployed, so there is nothing to undo.`);
+    // ONLY A DEFINITE NEGATIVE REFUSES, and BUG-011 gave that sentence a definition (core/orgAuth.ts).
+    // The CLI writes whatever its refresh threw into `connectedStatus`, so a DNS blip or a maintenance
+    // page used to refuse here as an expired sign-in and end the run. An unclear answer is now
+    // re-checked once and then passed through (unverified is not expired), and anything that then
+    // fails inside the wave is labelled by the apply loop as what it is, never as the org rejecting
+    // the change.
+    const liveness = await checkOrgLiveness(targetOrg, { probe: probeLiveness, ...(sleep ? { sleep } : {}) });
+    if (liveness.state === "dead") {
+        throw new GateError("ORG_AUTH_EXPIRED", `Org ${orgId} (alias ${targetOrg}) is authorized by this install, but its stored sign-in no longer works (${liveness.status ?? "no status"}). ` +
+            `Nothing was deployed, so there is nothing to undo.\n` +
+            `Fix in this run (recommended): ask the operator in one card whether to sign in again now. On yes, call org_login {sessionId} (a browser sign-in THEY complete, checked against this session's org id before anything is rebound), then re-run this same step. One attempt per "yes": rapid retries trip Salesforce's auto-freeze.\n` +
+            `If they cannot sign in now: card, then close_batch {sessionId}, then stop. Re-sending from Campfire and redeeming a fresh code with activate_session also restores access, as a new batch.`);
     }
 }

package/dist/core/orgAuth.js

@@ -0,0 +1,184 @@
+// IS THIS ORG'S SIGN-IN DEAD, OR COULD WE JUST NOT TELL? (BUG-011)
+//
+// The write gate used to refuse ORG_AUTH_EXPIRED on any `connectedStatus` other than "Connected",
+// and that field is not a status enum. The sf CLI fills it with whatever its refresh attempt threw:
+// `authErrorHandler` in plugin-org/lib/shared/orgListUtil.js (CLI 2.137.7) returns
+// `'Down (Maintenance)'` for a maintenance page, `'Bad Response'` for any other HTML, and otherwise
+// `error.code ?? error.message` — so `ENOTFOUND`, `ETIMEDOUT` and a revoked token all arrive in the
+// same field. A DNS blip during a long build therefore read as "your sign-in expired", and the
+// doctrine then ended the run. One hiccup was enough.
+//
+// So the status is classified, and ONLY A DEFINITE NEGATIVE refuses:
+//   dead       — the org (or the CLI's own store) answered that this credential no longer works
+//   live       — "Connected"
+//   unknown    — no answer we can trust either way (network, maintenance, a half-written auth file)
+//   unreported — the CLI answered with an org and no status at all (some auth shapes do this)
+//
+// ORDER MATTERS. jsforce wraps a refresh failure verbatim — `Unable to refresh session due to:
+// Error authenticating with the refresh token due to: <cause>` (jsforce session-refresh-delegate.js,
+// @salesforce/core authInfo.js `refreshTokenAuthError`) — so a network failure DURING a refresh
+// produces the same prefix as a revoked token. Only the cause decides. The OAuth server's own
+// answers (`expired access/refresh token`, `invalid_grant`, `inactive user`) can only come back from
+// a server that was reached, so they are checked first; network markers next; and the bare error
+// NAMES last, because a name like `RefreshTokenAuthError` hides its cause and is only trusted when
+// nothing else in the string contradicts it. The names are a SECONDARY match: measured on a dead
+// T-Pinto copy (BUG-011 simulation runbook §1.1), the CLI's error envelopes for a dead refresh token
+// are named plain `Error`, and only the message ("expired access/refresh token") identifies them.
+/** Answers only the token endpoint gives — the server was reached and said no. */
+const SERVER_SAID_NO = [
+    /expired access\/refresh token/i,
+    /\binvalid_grant\b/i,
+    /\binactive (user|organization)\b/i,
+    /\b(user|account) (is|has been) (frozen|inactive|deactivated)\b/i
+];
+/**
+ * Could not reach Salesforce, or reached something that was not an answer.
+ *
+ * `DomainNotFoundError` is here and NOT in the dead list, deliberately and against the first draft
+ * of the BUG-011 plan: @salesforce/core throws it from `Connection.isResolvable` when the instance
+ * host does not resolve, which is exactly what a laptop with its Wi-Fi off produces. A deleted org
+ * produces it too, but a deleted org will fail every later call loudly; an offline laptop told its
+ * sign-in expired is sent to sign in again for nothing.
+ */
+const UNREACHABLE = [
+    /\bE(NOTFOUND|TIMEDOUT|CONNRESET|CONNREFUSED|CONNABORTED|AI_AGAIN|NETUNREACH|HOSTUNREACH|PIPE)\b/,
+    /\bDomainNotFoundError\b/,
+    /socket hang up/i,
+    /fetch failed/i,
+    /network (error|is unreachable)/i,
+    // Not a bare /maintenance/: this list also reads projection read errors, which can quote a
+    // component's label ("Maintenance Plan") — the CLI's own string, and Salesforce's page wording only.
+    /Down \(Maintenance\)|\bunder maintenance\b|\b(scheduled )?maintenance (window|mode)\b/i,
+    /^Bad Response$/,
+    /<html|<!DOCTYPE HTML/i,
+    /\b(502|503|504)\b.*(gateway|unavailable)/i
+];
+/** The CLI's names for "this credential is gone", trusted only when nothing above contradicts them. */
+const DEAD_BY_NAME = [
+    /\bRefreshTokenAuthError\b/,
+    /\bNamedOrgNotFound(Error)?\b/,
+    /No authori[sz]ation information found/i,
+    /\bINVALID_SESSION_ID\b/,
+    /\bexpired\b/i
+];
+export function classifyOrgStatus(status) {
+    if (status === undefined)
+        return "unreported";
+    const s = status.trim();
+    if (s === "Connected")
+        return "live";
+    if (SERVER_SAID_NO.some((re) => re.test(s)))
+        return "dead";
+    if (UNREACHABLE.some((re) => re.test(s)))
+        return "unknown";
+    if (DEAD_BY_NAME.some((re) => re.test(s)))
+        return "dead";
+    // Everything else — a decipher error from an auth file mid-rewrite, a lock-file error, an empty
+    // string — is the CLI failing to say, which is not the org saying no.
+    return "unknown";
+}
+/** A deploy/read failure whose text says the sign-in is gone — never a component the org refused. */
+export function isAuthDeadFailure(text) {
+    return classifyFailureText(text) === "dead";
+}
+/** A deploy/read failure whose text says Salesforce could not be reached at all. */
+export function isOrgUnreachableFailure(text) {
+    return classifyFailureText(text) === "unreachable";
+}
+function classifyFailureText(text) {
+    if (!text)
+        return null;
+    if (SERVER_SAID_NO.some((re) => re.test(text)))
+        return "dead";
+    if (UNREACHABLE.some((re) => re.test(text)))
+        return "unreachable";
+    // The bare-name list carries a loose `expired`, which is fine for a status field and far too loose
+    // for free text — a component failure can say "expired" about a date. Only the names here.
+    if (DEAD_BY_NAME.slice(0, 4).some((re) => re.test(text)))
+        return "dead";
+    return null;
+}
+/**
+ * The wave lost its org connection BEFORE anything could have changed in the org (BUG-011 slice 2).
+ *
+ * Thrown by the apply loop only where it can prove nothing was submitted: the pre-projection, the
+ * checkOnly, a real deploy that left no job in the sf deploy cache, or a first write refused for
+ * auth. `deployed` is a literal `false` so no caller can mistake this for a half-applied wave —
+ * those come back as AMBIGUOUS_DELIVERY instead, because the job may still land.
+ *
+ * `kind` keeps "the sign-in is gone" (sign in again) apart from "Salesforce could not be reached"
+ * (try again), which send the operator to different places.
+ */
+export class OrgAuthLostError extends Error {
+    stage;
+    kind;
+    detail;
+    deployed = false;
+    constructor(stage, kind, detail) {
+        super(kind === "dead"
+            ? `the org sign-in was lost during ${stage} (${detail}); nothing was deployed`
+            : `Salesforce could not be reached during ${stage} (${detail}); nothing was deployed`);
+        this.stage = stage;
+        this.kind = kind;
+        this.detail = detail;
+        this.name = "OrgAuthLostError";
+    }
+}
+/** Dead, unreachable, or neither, for one piece of failure text. */
+export function failureAuthClass(text) {
+    return classifyFailureText(text);
+}
+/** How long to wait before the one re-check. A blip long enough to outlast it is not a blip. */
+export const AUTH_REPROBE_DELAY_MS = 5_000;
+/**
+ * The most one liveness probe may take. Measured in the BUG-011 simulation: offline, `sf org display`
+ * takes ~32 s (the CLI retries the refresh), so the gate's re-check held a wave ~70 s before passing
+ * through. A probe that has not answered in ten seconds has answered "unknown", which is all the
+ * longer wait would have said too.
+ */
+export const AUTH_PROBE_TIMEOUT_MS = 10_000;
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const TIMED_OUT = Symbol("timed-out");
+/**
+ * Probe, and on an unclear answer probe ONCE more (BUG-011, decision Q2: re-check once, then pass
+ * through). A null probe (the CLI would not answer) is unclear too and earns the re-check; an org
+ * that answers with NO status is not, because asking again gets the same silence and costs five
+ * seconds on every write to such an org.
+ *
+ * Each probe is capped at `AUTH_PROBE_TIMEOUT_MS` and a timeout counts as "unknown". When the first
+ * probe timed out, the five-second pause is skipped: ten seconds of waiting for an answer already
+ * was the pause, and adding five more is how an outage became a seventy-second stall.
+ *
+ * Never more than one re-check: a gate that polled until Salesforce answered would hang a wave on
+ * an outage, and the downstream failure is now labelled honestly anyway (direct/applyLoop.ts).
+ */
+export async function checkOrgLiveness(alias, deps) {
+    const cap = deps.probeTimeoutMs ?? AUTH_PROBE_TIMEOUT_MS;
+    const read = async () => {
+        let timer;
+        const answer = await Promise.race([
+            deps.probe(alias),
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(TIMED_OUT), cap);
+            })
+        ]).finally(() => clearTimeout(timer));
+        if (answer === TIMED_OUT)
+            return { state: "unknown", timedOut: true };
+        if (!answer)
+            return { state: "unknown", timedOut: false };
+        return {
+            state: classifyOrgStatus(answer.connectedStatus),
+            ...(answer.connectedStatus !== undefined ? { status: answer.connectedStatus } : {}),
+            timedOut: false
+        };
+    };
+    const first = await read();
+    if (first.state !== "unknown")
+        return { state: first.state, ...(first.status !== undefined ? { status: first.status } : {}), probes: 1 };
+    if (!first.timedOut)
+        await (deps.sleep ?? defaultSleep)(AUTH_REPROBE_DELAY_MS);
+    const second = await read();
+    // Keep whichever answer actually said something, so a refusal or a note can quote it.
+    const status = second.status ?? first.status ?? (second.timedOut ? `no answer within ${Math.round(cap / 1000)} s` : undefined);
+    return { state: second.state, ...(status !== undefined ? { status } : {}), probes: 2 };
+}

package/dist/core/resume.js

@@ -234,8 +234,15 @@ export function renderReconstruction(r, auth) {
         ""
     ];
     lines.push("ORG ACCESS:", `  ${auth.summary}`);
-    if (!auth.usable) {
-        lines.push("  You cannot deploy, project or read the org until this is fixed, and you must NOT fix it yourself.", "  Card the operator with exactly one ask, then stop. Do not plan around a dead org — a plan built", "  on a projection you could not take is a plan built on the requirement text alone.");
+    if (!auth.usable && auth.unreachable) {
+        // Connection first, not a sign-in card (BUG-011 simulation C4b): an offline operator sent through
+        // a browser sign-in is asked to fix what may not be broken. But nothing here is a claim about the
+        // sign-in either — offline, its state is UNKNOWN, and on a token that had already died "this is
+        // not an expired sign-in" would be false (simulation tester, 4ed783e).
+        lines.push("  You cannot deploy, project or read the org until Salesforce answers, and whether the sign-in still", "  works is unknown. Tell the operator the org could not be reached and nothing has changed; ask them", "  to check the connection, and call resume_session again. Only if Salesforce is reachable and it", "  still fails, card them to sign in again. Do not plan around an org you could not read.");
+    }
+    else if (!auth.usable) {
+        lines.push("  You cannot deploy, project or read the org until this is fixed, and you must NOT fix it yourself.", "  Card the operator with exactly one ask: sign in again now (the browser flow is theirs; it is", "  `org_login {sessionId}`, and the result says whether it landed on this session's org), or stop.", "  Wait for their answer. Do not plan around a dead org — a plan built on a projection you could not", "  take is a plan built on the requirement text alone.");
     }
     lines.push("");
     if (r.batchId) {

package/dist/core/sessionOrg.js

@@ -49,7 +49,7 @@ export async function resolveSessionOrg(session, role, opts = {}) {
     if (!live) {
         // Deliberately a GateError: the caller's fail-closed handling for "we cannot tell which org
         // this is" already exists and is the correct response here too.
-        throw new GateError("ORG_ID_UNRESOLVED", `Session ${session.sessionId} is bound to alias ${JSON.stringify(binding.alias)} (org ${binding.orgId}), but that alias does not resolve — it may have been logged out. Re-authenticate it, then retry. Refusing fail-closed.`);
+        throw new GateError("ORG_ID_UNRESOLVED", `Session ${session.sessionId} is bound to alias ${JSON.stringify(binding.alias)} (org ${binding.orgId}), but that alias does not resolve — it may have been logged out, or this machine cannot reach Salesforce (offline, the CLI cannot resolve an org's host). Check the connection first; if it is fine, the operator signs in again. Refusing fail-closed.`);
     }
     if (live.slice(0, 15) !== binding.orgId.slice(0, 15)) {
         throw new SessionOrgError("ALIAS_REPOINTED", `Alias ${JSON.stringify(binding.alias)} now points at org ${live}, but session ${session.sessionId} was bound to ${binding.orgId}. Refusing — an alias is operator-controlled and can be repointed, and acting on the new one would apply this session's work to a different org than it was approved against.`);

package/dist/core/supervisorContract.js

@@ -59,10 +59,11 @@ URL is your FIRST line to the operator, verbatim and on its own line — and fol
 \`OPEN IT IN THE IN-APP BROWSER\` steps exactly when its tools exist here. Then read the requirements, \`project_org\`, and STOP: "N requirements imported,
 watch at <url> — start analysis?" The fan-out starts on their go, never before it. Any other start ->
 \`create_session\` then \`import_requirements\`. An unauthenticated org -> \`org_login\`, a browser
-flow THEY complete. Never ask for a password or token, and never re-authenticate an org yourself
-when a session dies: CARD them with the fix, then \`close_batch\`, then stop — in that order.
-\`close_batch\` makes no org round-trip, so it still works with every token on the machine dead, and
-a run you walk away from instead reads as ABANDONED with no record that it ever ended.
+flow THEY complete. Never ask for a password or token, and never re-authenticate an org on your
+own initiative. Sign-in lost mid-run (\`ORG_AUTH_EXPIRED\`): CARD them; on yes, \`org_login
+{sessionId}\` (THEY complete it; never accept a sign-in to a different org), then re-run the step.
+If they cannot: card, then \`close_batch\`, then stop — in that order. \`close_batch\` makes no
+org round-trip, so it works with every token dead; a run you walk away from reads as ABANDONED.
 
 PROVIDER BOUNDARY: an IN2 delivery runs on IN2's tools alone, activation through close_batch.
 Never substitute another Salesforce MCP's tools for any part of it — reads, deploys, verification,