openvisio-agent 0.17.6 → 0.18.1

package/src/watch.mjs

@@ -5,12 +5,14 @@
 // than written to disk from a pasted heredoc.
 
 import { spawn, spawnSync } from 'node:child_process'
-import { writeFileSync, mkdirSync, existsSync, readFileSync, unlinkSync } from 'node:fs'
+import { closeSync, writeFileSync, mkdirSync, existsSync, openSync, readFileSync, unlinkSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, dirname } from 'node:path'
 import { OV_DIR, DEFAULT_WORKSPACE, readConfig, writeJson, configPath, onPath, fail, ok, info, slugify, stripSlash, chmodSafe } from './lib.mjs'
 import { connectAgentWs, assertWebSocket } from './ws.mjs'
-import { agentStateRequest, buildTaskCompletionReport, codexPolicyBlock, requestTargetsLaterAgent, taskAgentId, taskFromEvent, taskIsAwaitingReview, taskIsCompleted } from './events.mjs'
+import { agentStateRequest, buildTaskCompletionReport, codexPolicyBlock, mentionDedupeKeys, normalizeRenderedMessageText, opencodeEventEvidence, renderedAgentMessages, requestTargetsLaterAgent, shouldSuppressCodexDiagnostic, taskAgentId, taskFromEvent, taskIsAwaitingReview, taskIsCompleted } from './events.mjs'
+import { createByoMemoryGraph } from './memory.mjs'
+import { repositoryHasPrPushAuthorization } from './pr-push.mjs'
 
 // Behaviour prompts. The openvisio-team MCP bridge requires the agent's
 // credentials as ARGUMENTS on every tool call — those are injected at runtime by
@@ -38,7 +40,7 @@ const REPLY_DISCIPLINE = [
 
 // ── CHAT-ONLY agents (no --workdir): chat/ticket tools, no code surface. ──────
 const CHAT_CHARTER = [
-  'YOU ARE a connected agent in an OpenVisio team, running in CHAT-ONLY mode. Use only tools that actually appear in your openvisio-team tool list. Backend MCP commonly provides post_message, react_message, list_agents, list_projects, list_tasks, get_ticket, update_ticket, and list_activity. Some relay runtimes also provide poll_inbox or get_marching_orders. Never call a tool that is absent. You have NO file/Bash/git tools in this mode, so you cannot write code yourself.',
+  'YOU ARE a connected agent in an OpenVisio team, running in CHAT-ONLY mode. Use only tools that actually appear in your openvisio-team tool list. Backend MCP provides post_message, react_message, list_agents, list_projects, list_tasks, get_ticket, update_ticket, comment_ticket, and list_activity. Some relay runtimes also provide poll_inbox or get_marching_orders. Never call a tool that is absent. You have NO file/Bash/git tools in this mode, so you cannot write code yourself.',
   'WORK ETHIC — behave like a dependable teammate: never leave a promise dangling. Either ACT now (reply, or file a ticket) or say plainly you can\'t and offer to file a ticket / tag a coding agent who can. Never invent progress. Close the loop every cycle — the human should never have to remind you to circle back.',
   '',
   REPLY_DISCIPLINE,
@@ -66,7 +68,7 @@ const COORDINATE = [
 // A stable "who you are / how you work" charter prepended to every code cycle.
 const CODE_CHARTER = [
   'YOU ARE a connected CODING agent in an OpenVisio team, running ON THE USER\'S LAPTOP. You have REAL tools — use them; do NOT claim you lack a capability without checking what you actually hold. Your toolbox:',
-  '  • openvisio-team tools — use the names actually present. Backend MCP provides project/task discovery through list_agents, list_projects, list_tasks, get_ticket, update_ticket, plus post_message/react_message/list_activity. Relay runtimes may additionally expose poll_inbox, get_marching_orders, or comment_ticket.',
+  '  • openvisio-team tools — use the names actually present. Backend MCP provides project/task discovery through list_agents, list_projects, list_tasks, get_ticket, update_ticket, and comment_ticket, plus post_message/react_message/list_activity. Relay runtimes may additionally expose poll_inbox or get_marching_orders.',
   '  • Read / Grep / Glob / Edit / Write / MultiEdit — inspect AND change code.',
   '  • Bash — git (branch, commit, push a branch), gh (clone repos, open PRs), run tests/builds.',
   'YOUR WORKSPACE: your working directory is a WORKSPACE ROOT that holds the org\'s repos as subfolders. Reuse existing clones and the context you already verified. Read repository AGENTS.md instructions before changing code. For any task: locate the relevant repo under the workspace; clone it only when it is genuinely absent, then work inside that subfolder. Never ask the user for a path you can discover yourself.',
@@ -77,6 +79,7 @@ const CODE_CHARTER = [
   '  2. FINISH, then REPORT. Always update/move the ticket with update_ticket. Reply in a supplied human source thread when one exists. For backlog-assigned work, do not call post_message yourself: the watcher publishes one evidence-verified result in the project channel after the PR and ticket handoff are confirmed.',
   '  3. Be honest and specific. Never invent progress. If you are genuinely blocked (missing repo, unclear spec, a failing tool), say exactly what you need in one message — that IS closing the loop.',
   '  4. One reply per channel per cycle; answer several nudges together.',
+  '  5. RECOVER DEAD COMMAND SESSIONS. If write_stdin reports “Unknown process id”, that command session has already exited. Never poll the same process id again. Start a fresh exec_command when more work is required, then continue the task and verify the final state.',
   '',
   REPLY_DISCIPLINE,
 ].join('\n')
@@ -90,7 +93,7 @@ const CODE_FULL = [
   '  3. CHANGE + VERIFY: Read/Edit/Write the files; run the tests or build if the repo has them.',
   '  4. COMMIT + PUSH YOUR BRANCH: git add -A && git commit -m "…"; then git push -u origin agent/<slug>. Only ever push your own agent/* branch. Never --force, never push to main/master, never merge.',
   '  5. RAISE A PR: gh pr create --fill --base <default-branch> --head agent/<slug> (a clear title + a body summarizing the change and how you verified it). Never gh pr merge.',
-  '  6. CLOSE THE LOOP: move/update the ticket with update_ticket. Reply with the summary + PR link in a source thread explicitly supplied by the event. For backlog-only tickets, do not call post_message yourself; the watcher sends one verified project-channel completion message and deduplicates it across reconnects.',
+  '  6. CLOSE THE LOOP: use comment_ticket for a concrete ticket-scoped blocker or clarification, then move/update the ticket with update_ticket. The watcher adds one evidence-verified final ticket comment after handoff. Reply with the summary + PR link in a source thread explicitly supplied by the event. For backlog-only tickets, do not call post_message yourself; the watcher sends one verified project-channel completion message and deduplicates it across reconnects.',
   'Bash is for git / gh / tests / clone ONLY — never to hunt for credentials (they are given to you above).',
 ].join('\n')
 
@@ -178,18 +181,31 @@ function claimStartupSweep(key) {
 // are taken over. Returns { release } or { conflict: <pid> }.
 function acquireSingleInstance(key) {
   const lockPath = join(OV_DIR, 'watch-' + key + '.lock')
-  try {
-    mkdirSync(OV_DIR, { recursive: true })
-    if (existsSync(lockPath)) {
-      const pid = parseInt(String(readFileSync(lockPath, 'utf8')).trim(), 10)
-      if (pid && pid !== process.pid) {
-        let alive = false
-        try { process.kill(pid, 0); alive = true } catch (e) { alive = !!(e && e.code === 'EPERM') }
-        if (alive) return { conflict: pid }
-      }
+  try { mkdirSync(OV_DIR, { recursive: true }) } catch (error) { return { error } }
+  // `existsSync` followed by `writeFileSync` is a race: two KeepAlive starts can
+  // both observe no file and both become watchers. `wx` makes creation atomic.
+  for (let attempt = 0; attempt < 2; attempt++) {
+    let fd = null
+    try {
+      fd = openSync(lockPath, 'wx')
+      writeFileSync(fd, String(process.pid))
+      closeSync(fd); fd = null
+      break
+    } catch (error) {
+      if (fd != null) { try { closeSync(fd) } catch { /* already closed */ } }
+      if (error?.code !== 'EEXIST') return { error }
+      let pid = 0
+      try { pid = parseInt(String(readFileSync(lockPath, 'utf8')).trim(), 10) } catch { /* an in-flight creator owns it */ }
+      if (!pid) return { conflict: 'unknown' }
+      let alive = false
+      try { process.kill(pid, 0); alive = true } catch (e) { alive = !!(e && e.code === 'EPERM') }
+      if (alive) return { conflict: pid }
+      // Exact stale lock only. If another process wins the retry, its atomic file
+      // remains and this process will return conflict on the next iteration.
+      try { unlinkSync(lockPath) } catch (e) { if (e?.code !== 'ENOENT') return { error: e } }
+      if (attempt === 1) return { conflict: 'unknown' }
     }
-    writeFileSync(lockPath, String(process.pid))
-  } catch { /* if the lock can't be written, don't block the agent from running */ }
+  }
   const release = () => { try { if (parseInt(String(readFileSync(lockPath, 'utf8')).trim(), 10) === process.pid) unlinkSync(lockPath) } catch { /* already gone */ } }
   return { release }
 }
@@ -229,6 +245,7 @@ export async function runWatch({ flags }) {
   // both connect as the same agent and both answer every mention. Refuse to start.
   if (!flags.install) {
     const lock = acquireSingleInstance(slug || 'openvisio')
+    if (lock.error) fail(`Could not acquire the single-watcher lock for "${slug || 'openvisio'}": ${lock.error.message || lock.error}`)
     if (lock.conflict) {
       const watcherName = slug || 'openvisio'
       const logs = process.platform === 'darwin'
@@ -274,7 +291,7 @@ export async function runWatch({ flags }) {
 // The openvisio-team MCP is declared in an `opencode.json` written into the run cwd
 // (opencode reads it from there). `--auto` approves tool use non-interactively.
 // Same { runCycle, canCode } contract as the Claude runner.
-function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, maxCycleMs, log, debug, model, systemPrompt }) {
+function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, maxCycleMs, log, debug, model, onTool, systemPrompt }) {
   // opencode reads opencode.json from its CWD: the code workspace, or a dedicated
   // per-agent dir for chat-only agents.
   const cwd = workdir || join(OV_DIR, 'opencode-' + (cfgKey || 'agent'))
@@ -303,18 +320,71 @@ function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, ma
       // opencode has no system-prompt flag; each run is a fresh process, so fold the
       // charter/creds into the message (still not re-accumulated across cycles).
       const full = systemPrompt ? systemPrompt + '\n\n' + prompt : prompt
-      const args = ['run', full, '--auto', ...(m ? ['--model', m] : [])]
-      let child = null, done = false
-      const finish = (o) => { if (done) return; done = true; clearTimeout(timer); resolve(o) }
+      // JSON mode is the evidence boundary. Formatted stdout only tells us that
+      // OpenCode exited; raw events tell us which tools actually completed.
+      const args = ['run', full, '--auto', '--format', 'json', ...(m ? ['--model', m] : [])]
+      let child = null, done = false, didCode = false, didRepoMutation = false, didMessage = false, didChannelMessage = false, didMcpTaskRead = false, didMcpTaskUpdate = false
+      let outputText = '', jsonlBuffer = ''
+      const mcpCalls = new Set(), mcpErrors = new Set(), runtimeErrors = new Set()
+      const finish = (o) => {
+        if (done) return
+        done = true
+        clearTimeout(timer)
+        const calls = [...mcpCalls]
+        log('opencode MCP calls: ' + (calls.length ? calls.join(', ') : 'none') + (mcpErrors.size ? ' (failed: ' + [...mcpErrors].join(', ') + ')' : ''))
+        resolve({ ...o, didCode, didRepoMutation, didMessage, didChannelMessage, didMcpTaskRead, didMcpTaskUpdate, mcpCalls: calls, mcpErrors: [...mcpErrors], outputText })
+      }
+      const inspectLine = (line) => {
+        const value = String(line || '').trim()
+        if (!value) return
+        let event
+        try { event = JSON.parse(value) } catch {
+          if (debug) log('  · unparsed opencode output: ' + value.slice(0, 180))
+          return
+        }
+        const evidence = opencodeEventEvidence(event)
+        if (evidence.outputText) {
+          outputText += ' ' + evidence.outputText
+          if (debug) log('  · ' + evidence.outputText.replace(/\s+/g, ' ').slice(0, 180))
+        }
+        if (evidence.runtimeError) runtimeErrors.add(evidence.runtimeError)
+        if (!evidence.tool) return
+        if (debug) log('  → tool ' + evidence.tool + (evidence.failed ? ' (failed)' : evidence.completed ? ' (completed)' : ''))
+        try { onTool && onTool(evidence.tool) } catch { /* activity is best-effort */ }
+        if (evidence.mcpTool) {
+          mcpCalls.add(evidence.mcpTool)
+          if (evidence.failed) mcpErrors.add(evidence.mcpTool)
+          else if (evidence.completed) mcpErrors.delete(evidence.mcpTool)
+        }
+        didCode ||= !!evidence.didCode
+        didRepoMutation ||= !!evidence.didRepoMutation
+        didMessage ||= !!evidence.didMessage
+        didChannelMessage ||= !!evidence.didChannelMessage
+        didMcpTaskRead ||= !!evidence.didMcpTaskRead
+        didMcpTaskUpdate ||= !!evidence.didMcpTaskUpdate
+      }
       const timer = setTimeout(() => {
         log('opencode cycle TIMED OUT after ' + Math.round(maxCycleMs / 1000) + 's — killing')
         try { child && child.kill() } catch { /* gone */ }
         finish({ type: 'result', subtype: 'timeout' })
       }, maxCycleMs)
       log('running opencode cycle…' + (m ? ' [' + m + ']' : ''))
-      try { child = spawn(bin, args, { cwd, stdio: ['ignore', debug ? 'inherit' : 'ignore', 'inherit'] }) }
+      try {
+        child = spawn(bin, args, { cwd, stdio: ['ignore', 'pipe', 'inherit'] })
+        child.stdout?.on('data', (data) => {
+          jsonlBuffer += String(data)
+          const lines = jsonlBuffer.split('\n')
+          jsonlBuffer = lines.pop() ?? ''
+          for (const line of lines) inspectLine(line)
+        })
+      }
       catch (e) { log('opencode spawn failed: ' + (e && e.message ? e.message : e) + ' — is opencode installed? (npm i -g opencode-ai, then `opencode auth login`)'); return finish({ type: 'result', subtype: 'spawn-failed' }) }
-      child.on('exit', (code) => { log('opencode cycle done (' + (code === 0 ? 'ok' : 'exit ' + code) + ')'); finish({ type: 'result', subtype: code === 0 ? 'ok' : 'error' }) })
+      child.on('close', (code) => {
+        inspectLine(jsonlBuffer); jsonlBuffer = ''
+        const subtype = code === 0 && runtimeErrors.size === 0 ? 'ok' : 'error'
+        log('opencode cycle done (' + (subtype === 'ok' ? 'ok' : 'exit ' + code) + ')')
+        finish({ type: 'result', subtype })
+      })
       child.on('error', (e) => { log('opencode error: ' + (e && e.message ? e.message : e)); finish({ type: 'result', subtype: 'error' }) })
     })
   }
@@ -334,19 +404,21 @@ function createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, l
   const tomlString = (v) => JSON.stringify(String(v))
   const headerEntries = Object.entries(mcpHeaders || {}).map(([k, v]) => `${JSON.stringify(k)} = ${tomlString(v)}`).join(', ')
 
-  function runCycle(prompt, cycleModel) {
+  function runCycle(prompt, cycleModel, cycleOptions = {}) {
     return new Promise((resolve) => {
       const m = cycleModel || model
       const full = systemPrompt ? systemPrompt + '\n\n' + prompt : prompt
+      const disabledMcpTools = Array.isArray(cycleOptions.disabledMcpTools) ? cycleOptions.disabledMcpTools.filter(Boolean) : []
+      const disabledToolConfig = disabledMcpTools.length ? `, disabled_tools = [${disabledMcpTools.map(tomlString).join(', ')}]` : ''
       const mcpOverride = mcpUrl
-        ? `mcp_servers={ openvisio-team = { url = ${tomlString(mcpUrl)}${headerEntries ? `, http_headers = { ${headerEntries} }` : ''} } }`
+        ? `mcp_servers={ openvisio-team = { url = ${tomlString(mcpUrl)}${headerEntries ? `, http_headers = { ${headerEntries} }` : ''}${disabledToolConfig} } }`
         : ''
       const args = ['exec', '--ignore-user-config', '--skip-git-repo-check', '--ephemeral', '--json', '--color', 'never',
         ...(canCode ? ['--approve-for-me'] : ['--sandbox', 'read-only']),
         ...(m ? ['--model', m] : []),
         ...(mcpOverride ? ['-c', mcpOverride] : []),
         full]
-      let child = null, done = false, didCode = false, didRepoMutation = false, didMessage = false, didChannelMessage = false, outputText = '', jsonlBuffer = '', stderrBuffer = ''
+      let child = null, done = false, didCode = false, didRepoMutation = false, didMessage = false, didChannelMessage = false, outputText = '', jsonlBuffer = '', stderrBuffer = '', stderrLineBuffer = ''
       let policyBlock = null
       const mcpCalls = new Set(), mcpErrors = new Set()
       let didMcpTaskRead = false, didMcpTaskUpdate = false
@@ -363,11 +435,26 @@ function createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, l
         stderrBuffer = (stderrBuffer + s).slice(-24_000)
         policyBlock = codexPolicyBlock(stderrBuffer) || policyBlock
       }
+      const forwardDiagnostic = (value, flush = false) => {
+        const incoming = String(value || '')
+        inspectDiagnostic(incoming)
+        stderrLineBuffer += incoming
+        const lines = stderrLineBuffer.split('\n')
+        stderrLineBuffer = lines.pop() ?? ''
+        for (const line of lines) {
+          if (!shouldSuppressCodexDiagnostic(line)) process.stderr.write(line + '\n')
+        }
+        if (flush && stderrLineBuffer) {
+          if (!shouldSuppressCodexDiagnostic(stderrLineBuffer)) process.stderr.write(stderrLineBuffer)
+          stderrLineBuffer = ''
+        }
+      }
       const inspectLine = (line) => {
         const s = line.trim()
         if (!s) return
+        policyBlock = codexPolicyBlock(s) || policyBlock
         if (/command_execution|file_change|apply_patch|shell_command|exec_command/i.test(s)) didCode = true
-        if (/file_change|apply_patch/i.test(s) || /\b(?:git\s+(?:commit|push)|gh\s+pr\s+create)\b/i.test(s)) didRepoMutation = true
+        if (/file_change|apply_patch/i.test(s) || /\b(?:git\s+(?:commit|push)|gh\s+pr\s+create|openvisio-agent\s+push-pr-branch)\b/i.test(s)) didRepoMutation = true
         if (/post_message|comment_ticket/i.test(s)) didMessage = true
         try {
           const event = JSON.parse(s)
@@ -379,6 +466,7 @@ function createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, l
             try { onTool && onTool(tool) } catch { /* activity is best-effort */ }
             if (/^(?:get_ticket|list_tasks|list_task_types)$/.test(tool)) didMcpTaskRead = true
             if (tool === 'update_ticket') didMcpTaskUpdate = true
+            if (/^(?:create_codebase_branch|create_codebase_commit|write_codebase_file|create_pull_request)$/.test(tool)) { didCode = true; didRepoMutation = true }
             if (/post_message|comment_ticket/.test(tool)) didMessage = true
             if (/post_message/.test(tool)) didChannelMessage = true
             if (/fail|error/i.test(String(item.status || '')) || item.error) mcpErrors.add(tool)
@@ -403,15 +491,14 @@ function createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, l
           for (const line of lines) inspectLine(line)
         })
         if (child.stderr) child.stderr.on('data', (d) => {
-          inspectDiagnostic(d)
-          process.stderr.write(d)
+          forwardDiagnostic(d)
         })
       } catch (e) {
         log('codex spawn failed: ' + (e && e.message ? e.message : e) + ' — is Codex installed and signed in? (`npm i -g @openai/codex`, then `codex login`)')
         return finish({ type: 'result', subtype: 'spawn-failed' })
       }
       child.on('close', (code) => {
-        inspectLine(jsonlBuffer); jsonlBuffer = ''; inspectDiagnostic('')
+        inspectLine(jsonlBuffer); jsonlBuffer = ''; forwardDiagnostic('', true)
         const subtype = policyBlock ? 'blocked' : code === 0 ? 'ok' : 'error'
         log('codex cycle done (' + (subtype === 'blocked' ? 'BLOCKED: user authorization required' : subtype === 'ok' ? 'ok' : 'exit ' + code) + ')')
         finish({ type: 'result', subtype })
@@ -433,7 +520,7 @@ function createCycleRunner({ claude, agent, mcpUrl, mcpHeaders, cfgKey, mcpConfi
   const maxCycleMs = canCode ? MAX_CODE_CYCLE_MS : MAX_CYCLE_MS
   // opencode drives cycles differently — a headless `opencode run` per cycle rather
   // than a persistent stream-json session. Same { runCycle, canCode } contract.
-  if (agent === 'opencode') return createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, maxCycleMs, log, debug, model, systemPrompt })
+  if (agent === 'opencode') return createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, maxCycleMs, log, debug, model, onTool, systemPrompt })
   if (agent === 'codex') return createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, log, debug, model, onTool, systemPrompt })
   let child = null
   // The model the CURRENT session was spawned with. runCycle can pass a different
@@ -583,7 +670,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   const canCode = !!workdir
   // The Mastra bridge authenticates per-CALL: every openvisio-team tool needs
   // agent_identifier + agent_api_key as arguments. Hand them over up front.
-  const credNote = `AUTH: the openvisio-team tools REQUIRE two arguments on EVERY call — agent_identifier: "${identifier}" and agent_api_key: "${apiKey}". Include BOTH on every openvisio-team tool call. Use ONLY names shown in the current tool list. On backend MCP, discover work with list_agents, list_projects, list_tasks, get_ticket, update_ticket, and list_activity; get_marching_orders, poll_inbox, and comment_ticket may be absent. Tools may be namespaced — call whichever names actually appear. The credentials are given here; do NOT hunt for them. Bash/git/gh ARE for code work; this rule only forbids searching for keys.`
+  const credNote = `AUTH: the openvisio-team tools REQUIRE two arguments on EVERY call — agent_identifier: "${identifier}" and agent_api_key: "${apiKey}". Include BOTH on every openvisio-team tool call. Use ONLY names shown in the current tool list. On backend MCP, discover and update work with list_agents, list_projects, list_tasks, get_ticket, update_ticket, comment_ticket, and list_activity; get_marching_orders and poll_inbox may be absent. Tools may be namespaced — call whichever names actually appear. The credentials are given here; do NOT hunt for them. Bash/git/gh ARE for code work; this rule only forbids searching for keys.`
   // The STATIC charter + creds are the session system prompt (cached, billed once),
   // NOT re-sent in every cycle's user message — the big token saving.
   const systemPrompt = (canCode ? CODE_CHARTER : CHAT_CHARTER) + '\n\n' + credNote
@@ -597,7 +684,10 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     work: createCycleRunner({ ...runnerOptions, onTool: (name) => { if (/post_message/.test(name)) emitLaneStatus('work', 'typing') } }),
     reply: createCycleRunner({ ...runnerOptions, cfgKey: identifier + '-reply', onTool: (name) => { if (/post_message/.test(name)) emitLaneStatus('reply', 'typing') } }),
   }
-  const fullPrompt = canCode ? CODE_FULL : CYCLE
+  const codexPushGuide = agent === 'codex' && canCode
+    ? '\n\nCODEX PR DELIVERY: first inspect the OpenVisio MCP tools. When list_codebases, create_codebase_branch, create_codebase_commit (or write_codebase_file), and create_pull_request are available, use that authenticated linked-codebase flow to create the agent/* branch, publish the verified changed files, and open the PR. This is the preferred path and requires no local git push. If those tools are unavailable for the repository, do not run git push directly. From the repository run `openvisio-agent push-pr-branch`. It is a user-authorized constrained fallback that can only push HEAD to the matching agent/* branch on the exact authorized origin. If it reports OPENVISIO_PR_PUSH_AUTH_REQUIRED, do not retry or route around it. Report the one-time command `openvisio-agent authorize-pr-push` as the blocker.'
+    : ''
+  const fullPrompt = canCode ? CODE_FULL + codexPushGuide : CYCLE
   const fastPrompt = canCode ? CODE_FAST : CYCLE_FAST
   // Live model state — changeable at runtime by the in-chat `/model` command.
   // codeModel drives full/sweep cycles; chatModel (if set) the lighter fast/intro
@@ -606,8 +696,8 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   let liteModel = chatModel || model
 
   const lanes = {
-    work: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [] },
-    reply: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [] },
+    work: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [], deferred: [] },
+    reply: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [], deferred: [] },
   }
   // Tasks we've already reacted to (keyed task-id:agent — so a REASSIGNMENT to a
   // different agent re-triggers), so a noisy stream of task:updated events doesn't
@@ -620,29 +710,55 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   let replayState = {}
   try { replayState = JSON.parse(readFileSync(replayPath, 'utf8')) } catch { /* first run */ }
   const seenMentions = new Set(Array.isArray(replayState.seenMentions) ? replayState.seenMentions : [])
+  const recentMentionSignatures = new Map(Array.isArray(replayState.recentMentionSignatures) ? replayState.recentMentionSignatures : [])
   const seenActivities = new Set(Array.isArray(replayState.seenActivities) ? replayState.seenActivities : [])
+  const deliveredReplies = new Set(Array.isArray(replayState.deliveredReplies) ? replayState.deliveredReplies : [])
+  const memory = createByoMemoryGraph({ path: join(OV_DIR, 'watch-' + slug + '-memory.json') })
   // Completion delivery is runtime-owned for assigned coding work. Persist both
   // pending and delivered keys so a reconnect can finish a missed notification
   // without re-running the model or posting the same result twice.
   const pendingCompletionReports = new Set(Array.isArray(replayState.pendingCompletionReports) ? replayState.pendingCompletionReports : [])
   const reportedCompletions = new Set(Array.isArray(replayState.reportedCompletions) ? replayState.reportedCompletions : [])
+  const reportedTaskComments = new Set(Array.isArray(replayState.reportedTaskComments) ? replayState.reportedTaskComments : [])
   // A policy-blocked task stays paused across reconnects. It is released only
   // after the ticket itself carries explicit authorization or is completed/
   // unassigned. This prevents a 30-minute reconciliation retry from repeatedly
   // attempting the same rejected egress action.
   const blockedTasks = new Set(Array.isArray(replayState.blockedTasks) ? replayState.blockedTasks : [])
+  const blockedTaskRepos = new Map(Array.isArray(replayState.blockedTaskRepos) ? replayState.blockedTaskRepos : [])
   const trimSeen = (set) => { while (set.size > 500) set.delete(set.values().next().value) }
+  const MENTION_SIGNATURE_TTL_MS = 10 * 60 * 1000
+  const pruneMentionSignatures = () => {
+    const cutoff = Date.now() - MENTION_SIGNATURE_TTL_MS
+    for (const [key, at] of recentMentionSignatures) if (Number(at) < cutoff) recentMentionSignatures.delete(key)
+    while (recentMentionSignatures.size > 500) recentMentionSignatures.delete(recentMentionSignatures.keys().next().value)
+  }
   const persistReplay = () => {
     try {
+      pruneMentionSignatures()
       writeJson(replayPath, {
         seenMentions: [...seenMentions],
+        recentMentionSignatures: [...recentMentionSignatures],
         seenActivities: [...seenActivities],
+        deliveredReplies: [...deliveredReplies],
         blockedTasks: [...blockedTasks],
+        blockedTaskRepos: [...blockedTaskRepos],
         pendingCompletionReports: [...pendingCompletionReports],
         reportedCompletions: [...reportedCompletions],
+        reportedTaskComments: [...reportedTaskComments],
       }, true)
     } catch { /* best-effort */ }
   }
+  const markMentionHandled = (message, channelId) => {
+    pruneMentionSignatures()
+    const { idKey, signatureKey } = mentionDedupeKeys(message, channelId)
+    const duplicate = (idKey && seenMentions.has(idKey)) || (signatureKey && recentMentionSignatures.has(signatureKey))
+    if (duplicate) return true
+    if (idKey) { seenMentions.add(idKey); trimSeen(seenMentions) }
+    if (signatureKey) recentMentionSignatures.set(signatureKey, Date.now())
+    persistReplay()
+    return false
+  }
   // Context lines from the events themselves (the WS payload already carries the
   // channel + message / task), so the agent acts on THEM directly instead of
   // hoping poll_inbox re-surfaces the same item. Accumulated across coalesced
@@ -676,7 +792,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   }
   const ensureMcpSession = async () => {
     if (mcpSessionId) return
-    const res = await mcpPost({ jsonrpc: '2.0', id: ++mcpRpcId, method: 'initialize', params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'openvisio-agent', version: '0.17.6' } } }, false)
+    const res = await mcpPost({ jsonrpc: '2.0', id: ++mcpRpcId, method: 'initialize', params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'openvisio-agent', version: '0.18.1' } } }, false)
     if (!res.ok) throw new Error('MCP initialize HTTP ' + res.status)
     await mcpPayload(res)
     mcpSessionId = res.headers.get('mcp-session-id') || ''
@@ -695,7 +811,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     if (payload.error) throw new Error(`MCP ${name}: ${payload.error.message || 'tool error'}`)
     const result = payload.result ?? payload
     if (result?.isError) {
-      const detail = result.content?.find?.((c) => c?.type === 'text')?.text || 'tool error'
+      const detail = String(result.content?.find?.((c) => c?.type === 'text')?.text || 'tool error').split(apiKey).join('[redacted]')
       throw new Error(`MCP ${name}: ${detail}`)
     }
     return result
@@ -706,6 +822,48 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     try { return JSON.parse(text) } catch { return { text } }
   }
 
+  // All watcher-owned message delivery goes through this gate. For threaded
+  // replies it first reads the live backend thread and inspects rows already
+  // rendered as this agent. A persisted delivery key closes the crash/reconnect
+  // gap; an in-flight promise closes the two-lane race inside one watcher.
+  const messageDeliveries = new Map()
+  const postMessageOnce = async ({ key, channelId, parentId, projectId, content, skipIfAnyAgentReply = false, sourceKey = '' }) => {
+    const deliveryKey = String(key || '')
+    const message = String(content || '').trim()
+    if (!deliveryKey || !Number.isFinite(Number(channelId)) || !message) return { posted: false, reason: 'invalid-delivery' }
+    if (deliveredReplies.has(deliveryKey) || memory.has(deliveryKey, 'rendered')) return { posted: false, reason: 'remembered' }
+    if (messageDeliveries.has(deliveryKey)) return messageDeliveries.get(deliveryKey)
+
+    const run = (async () => {
+      if (parentId != null) {
+        const live = toolData(await callMcpTool('list_message_thread', { channel_id: Number(channelId), message_id: Number(parentId) }))
+        const rendered = renderedAgentMessages(live, { id: selfAgentId, identifier, slug, name: slug })
+        const duplicate = rendered.some((row) => normalizeRenderedMessageText(row.content) === normalizeRenderedMessageText(message))
+        if (duplicate || (skipIfAnyAgentReply && rendered.length)) {
+          deliveredReplies.add(deliveryKey); trimSeen(deliveredReplies); persistReplay()
+          memory.remember({ key: deliveryKey, kind: 'delivery', state: 'rendered', summary: duplicate ? message : rendered.at(-1)?.content, refs: { channelId: Number(channelId), threadId: Number(parentId) }, meta: { discoveredFromBackend: true } })
+          if (sourceKey) memory.connect(deliveryKey, sourceKey, 'responds_to')
+          log('message delivery ' + deliveryKey + ' already rendered — skipped')
+          return { posted: false, reason: duplicate ? 'same-content-rendered' : 'agent-reply-rendered' }
+        }
+      }
+
+      sendStatus(Number(channelId), 'typing')
+      const result = toolData(await callMcpTool('post_message', {
+        ...(Number.isFinite(Number(projectId)) ? { project_id: Number(projectId) } : {}),
+        channel_id: Number(channelId),
+        ...(parentId != null ? { parent_id: Number(parentId) } : {}),
+        content: message,
+      }))
+      deliveredReplies.add(deliveryKey); trimSeen(deliveredReplies); persistReplay()
+      memory.remember({ key: deliveryKey, kind: 'delivery', state: 'rendered', summary: message, refs: { channelId: Number(channelId), ...(parentId != null ? { threadId: Number(parentId) } : {}), ...(Number.isFinite(Number(projectId)) ? { projectId: Number(projectId) } : {}) }, meta: { messageId: result.id ?? result.message?.id ?? null } })
+      if (sourceKey) memory.connect(deliveryKey, sourceKey, 'responds_to')
+      return { posted: true, result }
+    })().finally(() => messageDeliveries.delete(deliveryKey))
+    messageDeliveries.set(deliveryKey, run)
+    return run
+  }
+
   const statusChannelCache = new Map()
   const projectStatusChannel = async (projectId) => {
     const key = Number(projectId)
@@ -727,6 +885,22 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     }
   }
 
+  const announceIntroduction = async () => {
+    const projectsData = toolData(await callMcpTool('list_projects'))
+    const projects = Array.isArray(projectsData.projects) ? projectsData.projects : []
+    const project = projects.find((item) => Number.isFinite(Number(item.id)))
+    if (!project) { log('no project available for first-connection introduction'); return false }
+    const channelId = await projectStatusChannel(project.id)
+    if (!Number.isFinite(Number(channelId))) return false
+    await postMessageOnce({
+      key: `intro:${identifier}:${project.id}`,
+      projectId: Number(project.id),
+      channelId: Number(channelId),
+      content: "I'm here, I pick up tasks assigned to me, and I respond to @mentions. Send work my way whenever you need me.",
+    })
+    return true
+  }
+
   const announceTaskCompletion = async (taskRef, result = {}) => {
     const projectId = Number(taskRef?.projectId)
     const ticketId = Number(taskRef?.ticketId)
@@ -736,6 +910,23 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     const ticket = current.ticket ?? current.task ?? current
     const report = buildTaskCompletionReport(ticket, { projectId, fallbackText: result.outputText })
     if (!report) return false
+    const memoryKey = `ticket:${projectId}:${ticketId}`
+    memory.remember({
+      key: memoryKey,
+      kind: 'ticket',
+      state: 'handoff',
+      summary: report.content,
+      refs: { projectId, ticketId },
+      meta: { reportKey: report.key, prUrl: report.prUrl },
+    })
+    // Ticket comments are now a backend first-class surface. The watcher owns the
+    // final comment so every runtime (Claude, Codex, OpenCode) closes the ticket
+    // loop consistently, and the persisted report key prevents reconnect repeats.
+    if (!reportedTaskComments.has(report.key)) {
+      await callMcpTool('comment_ticket', { project_id: projectId, ticket_id: ticketId, text: report.content })
+      reportedTaskComments.add(report.key); trimSeen(reportedTaskComments); persistReplay()
+      log('posted verified ticket comment for #' + ticketId)
+    }
     if (reportedCompletions.has(report.key)) {
       pendingCompletionReports.delete(taskKey)
       persistReplay()
@@ -752,10 +943,10 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     }
     const channelId = Number.isFinite(Number(taskRef.channelId)) ? Number(taskRef.channelId) : await projectStatusChannel(projectId)
     if (!Number.isFinite(channelId)) return false
-    sendStatus(channelId, 'typing')
-    await callMcpTool('post_message', { project_id: projectId, channel_id: channelId, content: report.content })
+    await postMessageOnce({ key: `completion:${report.key}`, projectId, channelId, content: report.content, sourceKey: memoryKey })
     reportedCompletions.add(report.key); trimSeen(reportedCompletions)
     pendingCompletionReports.delete(taskKey); persistReplay()
+    memory.remember({ key: memoryKey, kind: 'ticket', state: 'reported', summary: report.content, refs: { projectId, ticketId, channelId }, meta: { reportKey: report.key, prUrl: report.prUrl } })
     log('posted verified completion for ticket #' + ticketId + ' in channel ' + channelId)
     return true
   }
@@ -772,11 +963,9 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     let delivered = false
     if (Number.isFinite(channelId)) {
       try {
-        await callMcpTool('post_message', {
-          channel_id: channelId,
-          ...(parentMatch ? { parent_id: Number(parentMatch[1]) } : {}),
-          content: notice,
-        })
+        const parentId = parentMatch ? Number(parentMatch[1]) : null
+        const blockerKey = `blocker:${channelId}:${parentId ?? 'top'}:${normalizeRenderedMessageText(notice).slice(0, 180)}`
+        await postMessageOnce({ key: blockerKey, channelId, parentId, projectId, content: notice, sourceKey: Number.isFinite(ticketId) && Number.isFinite(projectId) ? `ticket:${projectId}:${ticketId}` : '' })
         delivered = true
       } catch (e) {
         log('failed to post blocker in channel ' + channelId + ': ' + (e?.message || e))
@@ -789,12 +978,19 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
 
     const key = `${projectId}:${ticketId}`
     if (pause) { blockedTasks.add(key); persistReplay() }
+    memory.remember({
+      key: `ticket:${projectId}:${ticketId}`,
+      kind: 'ticket',
+      state: pause ? 'authorization-blocked' : 'blocked',
+      summary: ticketNotice,
+      refs: { projectId, ticketId, ...(Number.isFinite(channelId) ? { channelId } : {}) },
+    })
     try {
       await callMcpTool('comment_ticket', { project_id: projectId, ticket_id: ticketId, text: ticketNotice })
       delivered = true
       return
     } catch (e) {
-      log('comment_ticket unavailable for blocker; recording it on ticket #' + ticketId)
+      log('comment_ticket failed for blocker; falling back to the ticket description for #' + ticketId)
     }
     const current = toolData(await callMcpTool('get_ticket', { project_id: projectId, ticket_id: ticketId }))
     const ticket = current.ticket ?? current.task ?? current
@@ -811,6 +1007,18 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   }
 
   const reportPolicyBlock = async (prompt, taskRef, block) => {
+    if (block?.kind === 'pr-push-authorization-required') {
+      const location = block.root ? ` from \`${block.root}\`` : ' from the repository'
+      const notice = `Action required: run \`openvisio-agent authorize-pr-push\`${location}. This is a one-time, repository-scoped opt-in. It permits only the constrained \`openvisio-agent push-pr-branch\` helper for the current \`agent/*\` branch, never main/master, force pushes, another remote, or merges. I've paused the ticket until it is enabled.`
+      const ticketNotice = `I'm paused before the PR push. Run \`openvisio-agent authorize-pr-push\`${location}; the watcher will resume this ticket after the repository-scoped helper is authorized.`
+      const projectId = Number(taskRef?.projectId)
+      const ticketId = Number(taskRef?.ticketId)
+      if (block.root && Number.isFinite(projectId) && Number.isFinite(ticketId)) {
+        blockedTaskRepos.set(`${projectId}:${ticketId}`, block.root)
+        persistReplay()
+      }
+      return publishBlocker({ prompt, taskRef, notice, ticketNotice, pause: true })
+    }
     const command = block?.command || 'the requested external repository action'
     const payload = [block?.commit && `commit ${block.commit}`, block?.branch && `branch ${block.branch}`, block?.remote && `remote ${block.remote}`].filter(Boolean).join(', ')
     const approval = block?.commit && block?.branch
@@ -836,6 +1044,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       const projects = Array.isArray(projectsData.projects) ? projectsData.projects : []
       const assigned = []
       const mentionActivity = []
+      let activityReplayTouched = false
       for (const project of projects) {
         const [tasksData, typesData, activityData] = await Promise.all([
           callMcpTool('list_tasks', { project_id: project.id }).then(toolData),
@@ -851,12 +1060,13 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           if (taskAgentId !== Number(self.id) && taskIdent !== identifier) continue
           const taskKey = `${project.id}:${task.id}`
           if (taskIsCompleted(task, doneIds) || taskIsAwaitingReview(task, reviewIds)) {
+            memory.remember({ key: `ticket:${project.id}:${task.id}`, kind: 'ticket', state: 'handoff', summary: task.title, refs: { projectId: project.id, ticketId: task.id } })
             if (pendingCompletionReports.has(taskKey)) {
               const activityChannel = await projectStatusChannel(project.id)
               try { await announceTaskCompletion({ projectId: project.id, ticketId: task.id, channelId: activityChannel }) }
               catch (e) { log('completion report retry failed for ticket #' + task.id + ': ' + (e?.message || e)) }
             }
-            if (blockedTasks.delete(taskKey)) persistReplay()
+            if (blockedTasks.delete(taskKey)) { blockedTaskRepos.delete(taskKey); persistReplay() }
             // Release the in-flight de-dupe key at handoff. If a reviewer moves
             // the ticket back to an actionable column, that update must start a
             // fresh work cycle.
@@ -865,11 +1075,14 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           }
           if (blockedTasks.has(taskKey)) {
             const approvalText = [task.title, task.description].filter(Boolean).join(' ')
-            if (/\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
-              blockedTasks.delete(taskKey); seenTasks.delete(taskKey); persistReplay()
-              log('backlog ticket #' + task.id + ' now contains explicit push authorization — resuming')
+            const blockedRepo = blockedTaskRepos.get(taskKey)
+            const helperAuthorized = blockedRepo && repositoryHasPrPushAuthorization({ cwd: blockedRepo })
+            if (helperAuthorized || /\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
+              blockedTasks.delete(taskKey); blockedTaskRepos.delete(taskKey); seenTasks.delete(taskKey); persistReplay()
+              log('backlog ticket #' + task.id + (helperAuthorized ? ' has repository-scoped PR push authorization' : ' now contains explicit push authorization') + ' — resuming')
             } else continue
           }
+          memory.remember({ key: `ticket:${project.id}:${task.id}`, kind: 'ticket', state: 'assigned', summary: task.title, refs: { projectId: project.id, ticketId: task.id }, meta: { updatedAt: task.updated_at ?? task.updatedAt } })
           assigned.push({ id: task.id, projectId: project.id, project: project.name, title: task.title, priority: task.priority, typeId: task.type_id ?? task.typeId, updatedAt: task.updated_at ?? task.updatedAt })
         }
         const activities = Array.isArray(activityData.activities) ? activityData.activities : Array.isArray(activityData.activity) ? activityData.activity : []
@@ -879,12 +1092,26 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           const lower = text.toLowerCase()
           const activityKey = String(project.id) + ':' + String(item.id ?? item.message_id ?? item.messageId ?? text.slice(0, 500))
           if (!seenActivities.has(activityKey) && mentionNeedles.some((needle) => lower.includes(needle)) && /message|mention|channel/i.test(text)) {
-            seenActivities.add(activityKey); trimSeen(seenActivities)
-            mentionActivity.push({ projectId: project.id, project: project.name, activity: item })
+            const data = item?.data && typeof item.data === 'object' ? item.data : null
+            const activityMessage = item?.message && typeof item.message === 'object'
+              ? item.message
+              : data?.message && typeof data.message === 'object' ? data.message : item
+            const activityChannelId = item?.channel_id ?? item?.channelId ?? data?.channel_id ?? data?.channelId
+            seenActivities.add(activityKey); trimSeen(seenActivities); activityReplayTouched = true
+            // The same logical mention may already have arrived over WebSocket.
+            // Share the id/signature guard instead of starting a second model turn.
+            if (markMentionHandled(activityMessage, activityChannelId)) continue
+            mentionActivity.push({
+              projectId: project.id,
+              project: project.name,
+              channelId: activityChannelId,
+              message: activityMessage,
+              activity: item,
+            })
           }
         }
       }
-      if (mentionActivity.length) persistReplay()
+      if (activityReplayTouched) persistReplay()
       if (!assigned.length) lastTaskSignature = ''
       else {
         const signature = JSON.stringify(assigned)
@@ -903,8 +1130,18 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       const inboxSignature = JSON.stringify(mentionActivity.slice(-20)).slice(0, 4000)
       if (mentionActivity.length && inboxSignature !== lastInboxSignature) {
         lastInboxSignature = inboxSignature
-        log('backlog reconciliation found mention activity -> reply cycle')
-        void drain('fast', `Recent project activity contains these messages mentioning YOU: ${inboxSignature}. Handle each still-unanswered mention once using the channel/message ids in the activity. Do not call nonexistent poll_inbox or get_marching_orders tools. Skip anything already answered by you.`)
+        log('backlog reconciliation found ' + mentionActivity.length + ' mention(s) -> guarded reply cycle(s)')
+        // Replay each real message through the exact same delivery path as a live
+        // WebSocket mention. This preserves thread ids and lets postMessageOnce
+        // consult the rendered thread before any reply is emitted.
+        for (const mention of mentionActivity) {
+          onEvent('agent:mention', {
+            project_id: mention.projectId,
+            channel_id: mention.channelId,
+            message: mention.message,
+            _mentionAlreadyMarked: true,
+          })
+        }
       } else if (!mentionActivity.length) lastInboxSignature = ''
     } catch (e) {
       mcpSessionId = ''
@@ -915,10 +1152,56 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   // Higher rank wins when coalescing cycles requested while one is running.
   const RANK = { fast: 0, intro: 1, coord: 2, sweep: 2, full: 3 }
   const baseFor = (kind) => kind === 'intro' ? INTRO : kind === 'full' ? fullPrompt : (kind === 'coord' || kind === 'sweep') ? COORDINATE : fastPrompt
+  // Codex and OpenCode expose structured action streams. Require runtime facts
+  // from those streams before accepting a full coding cycle. Claude's evidence
+  // shape is different and remains on its existing completion path.
+  const evidenceGatedRuntime = agent === 'codex' || agent === 'opencode'
+  const missingWorkEvidence = (result, ticketCycle) => {
+    const missing = [
+      ticketCycle && !result?.didMcpTaskRead && 'read the ticket through get_ticket/list_tasks',
+      !result?.didRepoMutation && 'perform and verify the repository change',
+      ticketCycle && !result?.didMcpTaskUpdate && 'update the ticket through update_ticket',
+    ].filter(Boolean)
+    if (result?.mcpErrors?.length) missing.push('resolve failed MCP calls: ' + result.mcpErrors.join(', '))
+    return missing
+  }
+  const combineWorkEvidence = (first, second) => ({
+    ...second,
+    didCode: !!first?.didCode || !!second?.didCode,
+    didRepoMutation: !!first?.didRepoMutation || !!second?.didRepoMutation,
+    didMessage: !!first?.didMessage || !!second?.didMessage,
+    didChannelMessage: !!first?.didChannelMessage || !!second?.didChannelMessage,
+    didMcpTaskRead: !!first?.didMcpTaskRead || !!second?.didMcpTaskRead,
+    didMcpTaskUpdate: !!first?.didMcpTaskUpdate || !!second?.didMcpTaskUpdate,
+    mcpCalls: [...new Set([...(first?.mcpCalls || []), ...(second?.mcpCalls || [])])],
+    // A focused recovery is allowed to clear an earlier MCP failure. Only calls
+    // still failing in the recovery remain blockers.
+    mcpErrors: second?.mcpErrors || [],
+    outputText: [first?.outputText, second?.outputText].filter(Boolean).join(' '),
+  })
+  const releaseTaskForRetry = (taskRef, prompt) => {
+    const directProject = Number(taskRef?.projectId)
+    const directTicket = Number(taskRef?.ticketId)
+    if (Number.isFinite(directProject) && Number.isFinite(directTicket)) seenTasks.delete(`${directProject}:${directTicket}`)
+    else {
+      const match = /ticket\s+#?(\d+).*?project\s+(\d+)/i.exec(prompt)
+      if (match) seenTasks.delete(`${match[2]}:${match[1]}`)
+    }
+    // The next task update or periodic reconciliation must be allowed to queue
+    // this work again. An acknowledgement is not a terminal task signature.
+    lastTaskSignature = ''
+  }
 
-  async function drain(kind, context, targetChannels = [], taskRef = null) {
+  async function drain(kind, context, targetChannels = [], taskRef = null, delivery = null) {
     const laneName = kind === 'full' ? 'work' : 'reply'
     const lane = lanes[laneName]
+    // A guarded reply is never coalesced with another event. It carries one
+    // source message and one delivery key, so queue it as an independent cycle.
+    if (lane.busy && delivery) {
+      lane.deferred.push({ kind, context, targetChannels, taskRef, delivery })
+      log(laneName + ' lane busy — queued one guarded ' + kind + ' cycle')
+      return
+    }
     if (context) lane.pending.push(context)
     if (taskRef) lane.taskRefs.push(taskRef)
     for (const channelId of targetChannels) if (Number.isFinite(Number(channelId))) lane.targets.add(Number(channelId))
@@ -931,7 +1214,11 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     laneStatusTargets[laneName] = new Set(targets)
     // credNote + charter live in the cached system prompt now — the per-cycle
     // message is just the event context + the small base instruction.
-    const prompt = (ctx.length ? ctx.join('\n') + '\n\n' : '') + baseFor(kind)
+    const memoryRefs = delivery
+      ? { channelId: delivery.channelId, threadId: delivery.parentId }
+      : activeTaskRef ? { projectId: activeTaskRef.projectId, ticketId: activeTaskRef.ticketId } : {}
+    const recalled = memory.context(memoryRefs)
+    const prompt = (ctx.length ? ctx.join('\n') + '\n\n' : '') + (recalled ? recalled + '\n\n' : '') + baseFor(kind)
     // Chat-shaped cycles (mentions/intro) may run on the cheaper chat model; code
     // work (full/sweep) uses the main model.
     const useModel = agent === 'codex' ? codeModel : kind === 'full' ? codeModel : liteModel
@@ -943,7 +1230,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     // 20 seconds so long coding runs do not create needless network/battery load.
     const heartbeat = targets.length ? setInterval(() => emitLaneStatus(laneName, 'working'), 20_000) : null
     try {
-      const result = await runners[laneName].runCycle(prompt, useModel)
+      const result = await runners[laneName].runCycle(prompt, useModel, agent === 'codex' && delivery ? { disabledMcpTools: ['post_message'] } : {})
       let completionResult = result
       if (agent === 'codex' && result?.subtype === 'blocked' && result?.policyBlock) {
         log('WORK_CYCLE_BLOCKED authorization required; pausing this ticket and publishing an action-required notice')
@@ -956,6 +1243,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
         log('WORK_CYCLE_BLOCKED ' + result.subtype + '; publishing blocker')
         try { await publishBlocker({ prompt, taskRef: activeTaskRef, notice }) }
         catch (e) { log('failed to publish cycle blocker: ' + (e?.message || e)) }
+        releaseTaskForRetry(activeTaskRef, prompt)
         return
       }
       if (kind !== 'full' && result?.mcpErrors?.length) {
@@ -968,46 +1256,56 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       // Model prose never proves success or a blocker. Full cycles must produce
       // runtime-observed ticket reads, repository evidence, and ticket updates.
       const ticketCycle = !!activeTaskRef || /ticket\s+#?\d+.*?project\s+\d+/i.test(prompt)
-      const incomplete = !result?.didRepoMutation || (ticketCycle && (!result?.didMcpTaskRead || !result?.didMcpTaskUpdate)) || result?.mcpErrors?.length
-      if (agent === 'codex' && kind === 'full' && result?.subtype === 'ok' && incomplete) {
-        const missing = [ticketCycle && !result.didMcpTaskRead && 'read the ticket through get_ticket/list_tasks', !result.didRepoMutation && 'perform and verify the repository change', ticketCycle && !result.didMcpTaskUpdate && 'update the ticket through update_ticket'].filter(Boolean)
-        if (result.mcpErrors?.length) missing.push('resolve failed MCP calls: ' + result.mcpErrors.join(', '))
-        log('coding cycle incomplete; recovery requires: ' + missing.join(', '))
-        const recovery = await runners.work.runCycle(`The assigned task is NOT complete. Missing runtime evidence: ${missing.join('; ')}. Do not post an acknowledgement or claim success. Resume now. Use get_ticket/list_tasks and list_task_types, perform and verify the repository work, commit and push an agent/* branch, open the PR, and call update_ticket with the correct board column. Post only when the original context supplies a source thread.`, codeModel)
-        const recoveryIncomplete = recovery?.subtype !== 'ok' || !recovery?.didRepoMutation || (ticketCycle && (!recovery?.didMcpTaskRead || !recovery?.didMcpTaskUpdate)) || recovery?.mcpErrors?.length
-        if (recoveryIncomplete) {
+      const missing = missingWorkEvidence(result, ticketCycle)
+      if (evidenceGatedRuntime && kind === 'full' && result?.subtype === 'ok' && missing.length) {
+        log(agent + ' coding cycle incomplete; recovery requires: ' + missing.join(', '))
+        const recovery = await runners.work.runCycle(`The assigned task is NOT complete. Missing runtime evidence: ${missing.join('; ')}. Do not post an acknowledgement or claim success. Resume now. Use get_ticket/list_tasks and list_task_types, perform and verify the repository work, publish an agent/* branch, open the PR, and call update_ticket with the correct board column. ${agent === 'codex' ? 'Prefer the available OpenVisio create_codebase_branch/create_codebase_commit/create_pull_request tools. Only when that linked-codebase flow is unavailable, run openvisio-agent push-pr-branch; never retry a rejected direct git push.' : ''} Post only when the original context supplies a source thread.`, codeModel, agent === 'codex' && delivery ? { disabledMcpTools: ['post_message'] } : {})
+        const recoveredResult = combineWorkEvidence(result, recovery)
+        const recoveryMissing = missingWorkEvidence(recoveredResult, ticketCycle)
+        if (recovery?.subtype !== 'ok' || recoveryMissing.length) {
           if (recovery?.subtype === 'blocked' && recovery?.policyBlock) {
             try { await reportPolicyBlock(prompt, activeTaskRef, recovery.policyBlock) }
             catch (e) { log('failed to publish recovery policy blocker: ' + (e?.message || e)) }
           } else {
-            const notice = `I'm blocked after one recovery attempt. Missing required evidence: ${missing.join('; ')}. I've left the ticket open and I'm not claiming completion.`
+            const unresolved = recoveryMissing.length ? recoveryMissing : [`the recovery cycle ended with ${recovery?.subtype || 'an unknown error'}`]
+            const notice = `I'm blocked after one recovery attempt. Missing required evidence: ${unresolved.join('; ')}. I've left the ticket open and I'm not claiming completion.`
             try { await publishBlocker({ prompt, taskRef: activeTaskRef, notice }) }
             catch (e) { log('failed to publish recovery blocker: ' + (e?.message || e)) }
           }
-          if (activeTaskRef) seenTasks.delete(`${activeTaskRef.projectId}:${activeTaskRef.ticketId}`)
-          else {
-            const taskMatch = /ticket\s+#?(\d+).*?project\s+(\d+)/i.exec(prompt)
-            if (taskMatch) seenTasks.delete(`${taskMatch[2]}:${taskMatch[1]}`)
-          }
-          lastTaskSignature = ''
+          releaseTaskForRetry(activeTaskRef, prompt)
           log('WORK_CYCLE_FAILED evidence gate still incomplete after one recovery; ticket retained for retry')
           return
         }
-        completionResult = recovery
+        completionResult = recoveredResult
       }
       if (kind === 'full' && activeTaskRef) {
         try {
           const delivered = await announceTaskCompletion(activeTaskRef, completionResult)
-          if (!delivered) log('completion report deferred for ticket #' + activeTaskRef.ticketId + '; waiting for verified review/done state and PR evidence')
+          if (!delivered) {
+            releaseTaskForRetry(activeTaskRef, prompt)
+            log('completion report deferred for ticket #' + activeTaskRef.ticketId + '; waiting for verified review/done state and PR evidence; ticket remains retryable')
+          }
         } catch (e) {
+          releaseTaskForRetry(activeTaskRef, prompt)
           log('completion report failed for ticket #' + activeTaskRef.ticketId + ': ' + (e?.message || e) + '; retained for reconnect retry')
         }
       }
+      if (agent === 'codex' && delivery) {
+        const reply = String(completionResult?.outputText || '').trim()
+        if (!reply) {
+          log('guarded reply produced no final text; leaving delivery unrecorded for retry')
+        } else {
+          try { await postMessageOnce({ ...delivery, content: reply }) }
+          catch (e) { log('guarded reply delivery failed closed: ' + (e?.message || e)) }
+        }
+      }
     } finally {
       if (heartbeat) clearInterval(heartbeat)
       laneStatusTargets[laneName].clear()
       lane.busy = false
-      if (lane.queued || lane.pending.length) { const next = lane.queued || (laneName === 'work' ? 'full' : 'fast'); lane.queued = null; void drain(next) }
+      const deferred = lane.deferred.shift()
+      if (deferred) void drain(deferred.kind, deferred.context, deferred.targetChannels, deferred.taskRef, deferred.delivery)
+      else if (lane.queued || lane.pending.length) { const next = lane.queued || (laneName === 'work' ? 'full' : 'fast'); lane.queued = null; void drain(next) }
     }
   }
 
@@ -1071,22 +1369,28 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       const assignedIdentifier = String(ticket.agent?.identifier ?? ticket.assigned_agent?.identifier ?? '')
       const belongsToSelf = (selfAgentId != null && assignedId === selfAgentId) || assignedIdentifier === identifier
       const key = `${projectId}:${ticketId}`
-      if (!belongsToSelf) { blockedTasks.delete(key); pendingCompletionReports.delete(key); persistReplay(); seenTasks.delete(key); log(kind + ' ticket #' + ticketId + ' is not assigned to this agent — ignored'); return }
+      if (!belongsToSelf) {
+        memory.remember({ key: `ticket:${projectId}:${ticketId}`, kind: 'ticket', state: 'unassigned', summary: ticket.title, refs: { projectId, ticketId } })
+        blockedTasks.delete(key); blockedTaskRepos.delete(key); pendingCompletionReports.delete(key); persistReplay(); seenTasks.delete(key); log(kind + ' ticket #' + ticketId + ' is not assigned to this agent — ignored'); return
+      }
       if (taskIsCompleted(ticket) || taskIsAwaitingReview(ticket)) {
+        memory.remember({ key: `ticket:${projectId}:${ticketId}`, kind: 'ticket', state: 'handoff', summary: ticket.title, refs: { projectId, ticketId } })
         if (pendingCompletionReports.has(key)) {
           const activityChannel = await projectStatusChannel(projectId)
           try { await announceTaskCompletion({ projectId, ticketId, channelId: activityChannel }) }
           catch (e) { log('completion report failed for ticket #' + ticketId + ': ' + (e?.message || e) + '; retained for reconnect retry') }
         }
-        blockedTasks.delete(key); persistReplay(); seenTasks.delete(key)
+        blockedTasks.delete(key); blockedTaskRepos.delete(key); persistReplay(); seenTasks.delete(key)
         log(kind + ' ticket #' + ticketId + ' is already complete or awaiting review — ignored')
         return
       }
       if (blockedTasks.has(key)) {
         const approvalText = [ticket.title, ticket.description].filter(Boolean).join(' ')
-        if (/\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
-          blockedTasks.delete(key); seenTasks.delete(key); persistReplay()
-          log(kind + ' ticket #' + ticketId + ' contains explicit push authorization — resuming')
+        const blockedRepo = blockedTaskRepos.get(key)
+        const helperAuthorized = blockedRepo && repositoryHasPrPushAuthorization({ cwd: blockedRepo })
+        if (helperAuthorized || /\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
+          blockedTasks.delete(key); blockedTaskRepos.delete(key); seenTasks.delete(key); persistReplay()
+          log(kind + ' ticket #' + ticketId + (helperAuthorized ? ' has repository-scoped PR push authorization' : ' contains explicit push authorization') + ' — resuming')
         } else {
           log(kind + ' ticket #' + ticketId + ' is paused for explicit repository push authorization — ignored')
           return
@@ -1095,6 +1399,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       if (seenTasks.has(key)) { log(kind + ' ticket #' + ticketId + ' already queued/active — ignored'); return }
       seenTasks.add(key); trimSeen(seenTasks)
       const title = String(ticket.title || hinted.title || '')
+      memory.remember({ key: `ticket:${projectId}:${ticketId}`, kind: 'ticket', state: 'queued', summary: title, refs: { projectId, ticketId }, meta: { sourceEvent: kind } })
       const taskText = [title, ticket.description, ticket.type, ticket.kind].filter(Boolean).join(' ')
       const cycleKind = canCode && !coordinationOnly(taskText) ? 'full' : 'coord'
       log(kind + ' verified ticket #' + ticketId + ' “' + title + '” -> ' + cycleKind + ' lane')
@@ -1124,22 +1429,28 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       // De-dupe: the same mention re-delivered (reconnect replay / dup fan-out) must
       // NOT trigger a second reply. Key by message id, or a channel+text signature
       // when the payload carries no id.
-      const dedupeKey = mid != null ? 'id:' + mid : 'sig:' + (cid != null ? cid : '?') + '|' + text.slice(0, 100)
-      if (seenMentions.has(dedupeKey)) { log('agent:mention (dup) — skipped'); return }
-      seenMentions.add(dedupeKey); trimSeen(seenMentions); persistReplay()
+      if (!raw._mentionAlreadyMarked && markMentionHandled(msg, cid)) { log('agent:mention (dup) — skipped'); return }
       if (requestTargetsLaterAgent(text, [slug, identifier])) {
         log('agent:mention addressed to a later-mentioned agent — skipped')
         return
       }
+      const mentionKeys = mentionDedupeKeys(msg, cid)
+      const sourceKey = `mention:${cid ?? '?'}:${mentionKeys.idKey || mentionKeys.signatureKey || threadRoot || Date.now()}`
+      memory.remember({ key: sourceKey, kind: 'mention', state: 'received', summary: text, refs: { channelId: cid, threadId: threadRoot, messageId: mid } })
+      const guardedDelivery = (stage = 'reply', skipIfAnyAgentReply = stage !== 'result') => agent === 'codex' && cid != null
+        ? { key: `reply:${sourceKey}:${stage}`, channelId: Number(cid), parentId: threadRoot, skipIfAnyAgentReply, sourceKey }
+        : null
       // Under-the-hood model control from chat (view / switch the model the agent runs).
       const mcmd = cid != null ? parseModelCmd(text) : null
       if (mcmd) {
         const thread = threadRoot != null ? `, parent_id ${threadRoot}` : ''
         if (mcmd.report) {
           log('model query → code ' + codeModel + ' / chat ' + liteModel)
-          void drain('fast', `An engineer asked which model you're running. Reply once in channel ${cid}${thread} (with your agent creds): "I'm on ${codeModel} for code work${liteModel !== codeModel ? ` and ${liteModel} for chat replies` : ' (and chat)'}." One line. Then stop.`)
+          const delivery = guardedDelivery('model')
+          void drain('fast', `An engineer asked which model you're running. ${delivery ? `Return exactly this one-line final answer without calling post_message: "I'm on ${codeModel} for code work${liteModel !== codeModel ? ` and ${liteModel} for chat replies` : ' (and chat)'}.” The watcher will verify and deliver it once.` : `Reply once in channel ${cid}${thread} (with your agent creds): "I'm on ${codeModel} for code work${liteModel !== codeModel ? ` and ${liteModel} for chat replies` : ' (and chat)'}.” One line. Then stop.`}`, [cid], null, delivery)
         } else if (mcmd.invalid) {
-          void drain('fast', `An engineer tried to switch your model to "${mcmd.invalid}", which isn't one you recognize. Reply once in channel ${cid}${thread} (with your agent creds): say you support "opus", "sonnet", "haiku", or a full "claude-…" id, and ask which they meant. One line. Then stop.`)
+          const delivery = guardedDelivery('model')
+          void drain('fast', `An engineer tried to switch your model to "${mcmd.invalid}", which isn't one you recognize. ${delivery ? 'Return one short final answer saying you support "opus", "sonnet", "haiku", or a full model id and asking which they meant. Do not call post_message; the watcher will verify and deliver it once.' : `Reply once in channel ${cid}${thread} (with your agent creds): say you support "opus", "sonnet", "haiku", or a full "claude-…" id, and ask which they meant. One line. Then stop.`}`, [cid], null, delivery)
         } else {
           const tgt = mcmd.target // 'chat' | 'code' | 'both'
           const prev = `code ${codeModel}/chat ${liteModel}`
@@ -1149,7 +1460,8 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           persistModel()
           const label = tgt === 'chat' ? 'chat model' : tgt === 'code' ? 'code model' : 'model'
           log('model switched (' + tgt + ') ' + prev + ' → code ' + codeModel + '/chat ' + liteModel + (who ? ' (by ' + who + ')' : ''))
-          void drain('fast', `An engineer switched your ${label} to "${mcmd.set}" — active for your next ${tgt === 'chat' ? 'chat replies' : tgt === 'code' ? 'code cycles' : 'actions'}. Post ONE short confirmation in channel ${cid}${thread} (with your agent creds): e.g. "Switched my ${label} to ${mcmd.set} — I'll use it from here." Then stop.`)
+          const delivery = guardedDelivery('model')
+          void drain('fast', `An engineer switched your ${label} to "${mcmd.set}" — active for your next ${tgt === 'chat' ? 'chat replies' : tgt === 'code' ? 'code cycles' : 'actions'}. ${delivery ? `Return one short final confirmation such as "Switched my ${label} to ${mcmd.set}. I'll use it from here." Do not call post_message; the watcher will verify and deliver it once.` : `Post ONE short confirmation in channel ${cid}${thread} (with your agent creds): e.g. "Switched my ${label} to ${mcmd.set} — I'll use it from here." Then stop.`}`, [cid], null, delivery)
         }
         return
       }
@@ -1158,16 +1470,24 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       // subsequent working/typing heartbeat for its lane.
       if (cid != null) sendStatus(cid, 'thinking')
       const codingMention = canCode && needsCode(text)
+      const replyDelivery = guardedDelivery(codingMention ? 'result' : 'reply', !codingMention)
       const ctx = cid != null
-        ? `You were @mentioned in OpenVisio channel ${cid}${who ? ` by "${who}"` : ''}: "${text}". This mention is FOR YOU. ${codingMention ? 'This is repository work: complete the coding flow first, then send' : 'Send'} EXACTLY ONE reply with post_message: arguments: channel_id ${cid}${threadRoot != null ? `, parent_id ${threadRoot} (reply IN THAT THREAD, do not start a new top-level message)` : ''}, plus agent_identifier + agent_api_key from the AUTH line above, and a 1-3 sentence reply. Compose the whole answer, then post it ONCE. Do not post a first reply and then a revised version. FIRST read the recent messages in this thread: if you already answered this, or another agent was the one addressed, do NOT post at all. Be sure of your answer before sending.${who ? ` To @mention them back, write their EXACT full name "@${who}". A mention only links when the name matches exactly.` : ''} You ALREADY have the message here. Do not poll_inbox, and after your single reply, STOP.`
+        ? replyDelivery
+          ? `You were @mentioned in OpenVisio channel ${cid}${who ? ` by "${who}"` : ''}: "${text}". This mention is FOR YOU. ${codingMention ? 'Complete the repository work and verification first.' : 'Answer the request.'} Do NOT call post_message; it is intentionally unavailable. Return only the final 1-3 sentence reply as your final answer. The watcher will read the real thread, check its persistent memory graph, and render that answer at most once.${who ? ` To mention the requester, use their exact full name "@${who}".` : ''} Do not poll_inbox.`
+          : `You were @mentioned in OpenVisio channel ${cid}${who ? ` by "${who}"` : ''}: "${text}". This mention is FOR YOU. ${codingMention ? 'This is repository work: complete the coding flow first, then send' : 'Send'} EXACTLY ONE reply with post_message: arguments: channel_id ${cid}${threadRoot != null ? `, parent_id ${threadRoot} (reply IN THAT THREAD, do not start a new top-level message)` : ''}, plus agent_identifier + agent_api_key from the AUTH line above, and a 1-3 sentence reply. Compose the whole answer, then post it ONCE. Do not post a first reply and then a revised version. FIRST read the recent messages in this thread: if you already answered this, or another agent was the one addressed, do NOT post at all. Be sure of your answer before sending.${who ? ` To @mention them back, write their EXACT full name "@${who}". A mention only links when the name matches exactly.` : ''} You ALREADY have the message here. Do not poll_inbox, and after your single reply, STOP.`
         : undefined
       if (codingMention) {
-        const ack = cid != null
-          ? `You were asked for repository work in channel ${cid}${threadRoot != null ? `, thread ${threadRoot}` : ''}. The dedicated work lane has accepted it. Post exactly one short reply with post_message in that same thread saying you have picked it up and will return there with the verified result. Include agent_identifier + agent_api_key. Do not inspect or edit code in this reply lane.`
-          : undefined
-        void drain('coord', ack, cid == null ? [] : [cid])
-        void drain('full', ctx, cid == null ? [] : [cid])
-      } else void drain('fast', ctx, cid == null ? [] : [cid])
+        if (agent === 'codex' && cid != null) {
+          const ack = `${who ? `@${who} ` : ''}I've picked this up and will return here with the verified result.`
+          void postMessageOnce({ ...guardedDelivery('ack'), content: ack }).catch((e) => log('guarded acknowledgement failed closed: ' + (e?.message || e)))
+        } else {
+          const ack = cid != null
+            ? `You were asked for repository work in channel ${cid}${threadRoot != null ? `, thread ${threadRoot}` : ''}. The dedicated work lane has accepted it. Post exactly one short reply with post_message in that same thread saying you have picked it up and will return there with the verified result. Include agent_identifier + agent_api_key. Do not inspect or edit code in this reply lane.`
+            : undefined
+          void drain('coord', ack, cid == null ? [] : [cid])
+        }
+        void drain('full', ctx, cid == null ? [] : [cid], null, replyDelivery)
+      } else void drain('fast', ctx, cid == null ? [] : [cid], null, replyDelivery)
     } else if (k === 'error') {
       const detail = raw && (raw.message || raw.error || raw.reason || raw.code || raw.d?.message || raw.d?.error)
       log('error event: ' + (detail ? String(detail) : JSON.stringify(raw)).slice(0, 220))
@@ -1189,9 +1509,17 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     // Workspace ethics: a one-time hello the FIRST time this agent ever connects.
     const introMarker = join(OV_DIR, 'intro-' + slugify(identifier) + '.done')
     if (!existsSync(introMarker)) {
-      try { mkdirSync(OV_DIR, { recursive: true }); writeFileSync(introMarker, new Date().toISOString() + '\n') } catch { /* best-effort */ }
+      if (agent !== 'codex') {
+        try { mkdirSync(OV_DIR, { recursive: true }); writeFileSync(introMarker, new Date().toISOString() + '\n') } catch { /* best-effort */ }
+      }
       log('first connection — introducing self to the workspace')
-      introTimer = setTimeout(() => void drain('intro'), 5000) // let the socket subscribe first
+      introTimer = setTimeout(() => {
+        if (agent !== 'codex') { void drain('intro'); return }
+        void announceIntroduction().then((delivered) => {
+          if (!delivered) return
+          try { mkdirSync(OV_DIR, { recursive: true }); writeFileSync(introMarker, new Date().toISOString() + '\n') } catch { /* best-effort */ }
+        }).catch((e) => log('guarded introduction failed: ' + (e?.message || e)))
+      }, 5000) // let the socket subscribe first
     }
     // Reconciliation replaces the old model-driven startup/daily sweep. It uses
     // supported MCP tools directly, stays silent when empty, and hands verified