feat(*): pick up a turn left on a registered machine when this computer stops

[Handsome-wzw]

Summary

Registered machines are now available without a debug environment switch.
RAVEN_DEBUG_MACHINES previously defaulted to off: it kept machine-backed
agents out of the dispatch table, refused node/installer access, hid remote
preset destinations, and treated file paths locally while off. It was a
trial feature gate, not a verbose-logging option. At the owner's request,
this PR removes the variable and all of those checks. Normal startup and
restart recovery use the configured machine entries; even a leftover value
of 0 is ignored. Machine registration, SSH authentication, file permission
prompts, and concurrency limits still apply.

Fourth change in the series that lets a Raven dispatch work to the
machines in its machine registry. #920, #921 (merged through #922) and
#922 are on main; this change stands on main alone now, and the diff is
its own.

What this does: a turn running on a registered machine survives this
computer stopping, and the next start picks it up and reports it.

• While a turn runs on a machine, this computer remembers what the
  machine does not know (raven/acp_client/remote_runs.py): one
  owner-only file per run under <raven home>/machines/runs/, with the
  machine's registry id, the task id its daemon runs the agent under, the
  agent, the session key, the instance handle, the dispatch id, the ACP
  session, the id of the prompt whose answer is awaited, the ids this
  side has used, how many of the agent's frames were read here, the
  agent's answer to initialize and the connection's launch key. Kept
  current after every frame the connection has dealt with, removed when
  the turn ends here. No address is in it.
• When this process stops -- the gateway, serve, the TUI, the page
  stack -- the
  agents on machines stay with their daemons
  (remote.leave_agents_running() before the drain): a cancelled turn
  on a machine sends no session/cancel, closing its connection ends the
  endpoint only, and the manager leaves the dispatch's record open rather
  than finishing it as cancelled. A hard kill or /restart leaves the
  same record, written as the turn ran.
• At the next start -- the gateway once its generation is bound; the
  serve, TUI and page stacks once -- raven/agent/subagent/resume_remote.py
  picks every run up: task/list on the machine, agent/attach from the
  frame last read (NodePool.attach), the connection adopted into the
  pool with request ids carried on past the other process's
  (AcpConnectionPool.adopt, AcpClient.continue_ids_from), the
  prompt's answer awaited (AcpClient.await_response), the reply built
  as a turn ended here is -- the partial notice when the agent stopped
  early, the machine note saying it was picked up after this computer
  restarted -- then the dispatch's record finished, the registry row and
  the node claim closed, and the result announced into the conversation
  that asked, as the manager announces a turn that ended here
  (raven/acp_client/remote_resume.py). A machine that cannot be asked
  keeps its record for a later start; a run the machine no longer has,
  one whose agent ended while this computer was away, one whose agent
  left the agent table, and one whose turn says nothing are announced as
  errors that say so. The adopted agent process serves later dispatches
  of its entry, as one started here would.
• Seams: AcpClient.request(sent=) hears the id of what goes out;
  ChannelEndpoint.watchers hear the frames the connection has dealt
  with (consumed, called by the read loop); ChannelEndpoint.stays
  reads the leaving flag.
• A cli entry's run on a machine is recorded while it runs (kind cli,
  no ACP part) and left the same way, the manager reading the dispatch
  as left; the entry picks it up (CliAgentBackend.pick_up): the daemon
  replays the command's whole output from its first line, the exit code
  ends it, and the reply closes with the machine note.
• The record carries the task as the model wrote it, and -- once the
  manager has read the run as left -- the dispatch's origin and summary
  (remote_runs.annotate): the announce after a restart names the
  instance, node and tool call as the announce here does and quotes the
  task as authored, never the rendered prompt on disk; a host killed
  outright gets an origin made up from the spawn record and the run.
• The record goes last, once the outcome has reached its conversation:
  a conclusion that fails, a stop under it, or an announce the scheduler
  refuses (_announce_result says so now) leaves the record, its claim
  released, for the next start to try again.
• A run that returned here keeps its record the same way, until the
  manager's announce of the reply was taken: the manager dispatches with
  reported_by_caller=True, the backend then leaves the record behind
  with the reply instead of removing it as it returns, and the manager
  removes it after the announce (remote_runs.forget_dispatch) -- or,
  when the draining scheduler refused the announce, annotates it with
  the dispatch's origin and summary for the next start to report. A host
  killed between the agent's answer and the announce therefore still has
  the way back to the run. A caller that takes the reply as its own
  result (a graph node, a probe, a direct chat) dispatches without the
  keyword, and the record goes as it did. The record's frame count stops
  at the prompt: the turn's own frames, the chunks before the answer as
  much as the answer, are never checkpointed, so a pick-up replays the
  turn whole and the reply it reports is complete; a record that had
  moved past the answer would have resumed after it and waited forever.

Not in this change: a run from the DAG lane has no spawn record to
finish; it is announced from the origin the manager added to its record
when it was left, or, for a host killed outright, from the run's record
alone. The Tasks page reads the finished record on its next load rather
than live.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

Machine availability and restart checks after removing the trial switch:

• New default-behavior regressions were run before the removal: 8 failed,
  with the enabled-value control passing. After removal, all 9 passed,
  including ACP/CLI recovery through the real AgentRegistry with the
  variable absent or set to 0.

• uv run --no-sync pytest tests/test_acp_remote.py tests/test_node_client.py tests/test_node_server.py tests/test_node_install.py tests/test_ops_remote_path.py tests/test_permissions_remote_read.py tests/test_remote_file_tools.py tests/test_deliver_files_tool.py tests/test_raven_config_tool.py tests/test_rpc_subagents.py tests/test_shell_machine_channel.py tests/test_subagent_acp_remote.py tests/test_subagent_cli_remote.py tests/test_resume_remote.py tests/test_remote_resume.py tests/test_remote_runs.py tests/test_subagent_manager.py tests/test_cli_tui_commands.py tests/test_rpc_schema_match.py tests/test_config_schema.py -n 4 --idle-ceiling-strict --cov=raven --cov-branch --cov-report=json:<coverage-json> --cov-report= --tb=short
  -- 1799 passed on the combined tree, including the latest published
  result-retention fix. An earlier run had a missing stdio response in the
  minimal-node dependency test and an idle-gate hit; both passed a focused
  recheck, and this final complete selection passed with the strict gate.

• uv run --no-sync python scripts/coverage_gate.py --coverage-json <coverage-json> diff --base-ref origin/main --threshold 90
  -- 92.92% (656/706 changed executable lines) for this PR; the gate-removal
  commit alone covers 2/2 new executable lines (the remainder deletes gates
  and updates descriptions).

• UV_NO_SYNC=1 make lint-python lint-imports lint-deps lint-types, the
  commit/source-language/large-file scope gates and git diff --check pass.
  Both RPC generators' --check runs pass; npm test -- scripts/gates/fixture-shape.test.mjs
  from ui-web passes all five tests.

• Real Linux machine, isolated node installations, separate dispatch and
  restart processes: before removal, a task started with the trial switch
  on was reported as an absent agent and its recovery record deleted when
  restarted without it. After removal, both absent and old 0 settings
  recover the full CLI result and read its output file by address. The
  absent-variable case kills the relay before host shutdown. The combined
  final tree was reinstalled and both scenarios repeated successfully.

• With the variable absent, 12 further timing/boundary probes pass: early
  CLI exit and blank lines, relay loss before heartbeat with normal-call
  recovery, tunnel loss, ACP/CLI/OpenAI cancellation during disconnection,
  11 launches admitting 8 and refusing 3, occupied tunnel port, and an
  unwritable prompt file. Three attachment, POSIX-command and IPv6 checks
  also pass; Windows command parsing is simulated, not native Windows.
  No test task or tunnel remains; the dedicated node directories are removed.

• CONTEXT.md, configuration and RPC descriptions, transport/path docstrings,
  both collaboration guides and the owner's design notes were checked
  against the code. The guides explain the former trial switch and normal
  startup without it. The existing SSH, permission and limit tests continue
  to exercise their checks with no test-only switch setup.

• env -u RAVEN_DEBUG_MACHINES uv run --no-sync pytest -n 4 --tb=short --cov=raven --cov-branch --cov-report=json:<full-coverage-json> --cov-report=
  -- 31345 passed, 230 skipped, 2 xfailed, 5 failed. A separate current-main
  checkout reproduces four failures: CLI color rendering on this host,
  LibreOffice detection, and the two simulation cases. The remaining failure
  was the direct-chat test stub rejecting reported_by_caller from the
  latest result-retention change; the published wrapper fix now forwards only keywords declared by its fake backend. The full
  suite was not rerun for that test-only correction. Final direct-chat and
  manager recheck: 277 passed with strict idle accounting. Full-PR changed-line coverage from this
  run is 96.18% (679/706).

Earlier verification:

• uv run pytest tests/test_remote_runs.py tests/test_remote_resume.py tests/test_resume_remote.py tests/test_acp_client_resume.py tests/test_node_client.py tests/test_subagent_acp_remote.py tests/test_subagent_cli_remote.py tests/test_cli_tui_commands.py tests/test_subagent_manager.py tests/test_rpc_bootstrap.py tests/test_cli_gateway_commands.py tests/test_acp_client_launch.py tests/test_subagent_acp.py tests/test_scope_canon.py tests/test_l4_entrances.py
  -- all passed (605 passed). Covered: the record written owner-only, kept current
  per frame and per prompt, removed when the turn ends here and kept when
  this process leaves; a dispatch left at shutdown neither finished nor
  announced by the manager; an endpoint ended while leaving leaves the
  agent with the daemon (real daemon); a task picked up from the frame
  last read, with the watchers hearing each frame; a pick-up the machine
  refuses or cannot carry; an answer awaited for a request another
  process sent, ids carried on, no session/cancel while leaving; the
  reply read off replayed frames with the other sessions' frames
  ignored, a turn cut short marked partial, an unreachable machine
  keeping the record, a run the machine no longer has, a prompt never
  sent, an agent that ended while this computer was away, an answer
  waited out, a turn that said nothing, a pick-up beside a live
  connection closing its own; the manager-side conclusion: record
  finished and announced, an error announced and the record failed, an
  unreachable machine keeping the record, an agent off the table, a
  failure inside one pick-up not stopping the next, a run with no
  conversation, the once-per-process scheduling; a cli run recorded
  while it runs and left at shutdown, picked up whole on the real daemon
  behind the stand-in ssh, its pick-up's errors said (a non-zero exit, a
  machine that no longer has it, a link down, this computer leaving), a
  cancel that is not a leave ending the command with no record left; the
  TUI's stop saying the agents stay before the cancel and its start
  scheduling the pick-up; the record annotated with the dispatch's
  origin and summary when the manager reads it as left, the announce
  quoting the task as authored and naming instance, node and tool call,
  with and without the manager's fields; the record outliving a refused
  announce and a failed conclusion, claim released; a cli record read
  without an ACP session, an older record read with defaults; the record
  moving with the frames before the prompt and not past it, a dispatch's
  record forgotten by the manager's id with its claim, the manager
  dispatching with reported_by_caller and forgetting the record after
  an announce that was taken and annotating it after one that was
  refused; on the real daemon behind the stand-in ssh, an acp reply and
  a cli output returned with the record kept and the host "stopped"
  before the announce, the next start reading the same reply again
  whole, and a dispatch without the keyword leaving no record. End to end on the real
  daemon behind the stand-in ssh: a turn dispatched, this process
  "stopped" the way the gateway stops, the agent still running on the
  daemon, then a fresh pick-up reading its answer, finishing the record
  and announcing it, with the agent's process the pool's connection
  again.

• uv run pytest on this tree, at an earlier revision of this change -- 29270 passed, 121 skipped, 3 failed:
  test_rpc_files.py::test_a_host_without_libreoffice_says_so,
  test_simulation_scenario.py::test_a_fresh_trial_refreshes_the_subagent_homes_before_it_runs
  and test_simulation_suite.py::test_a_stopped_run_is_marked_in_its_record_and_finished_with_its_evidence,
  which fail the same way on main on this machine; diff coverage of this
  change against its base: 97.45% (153 of 157 executable changed lines),
  and 94.67% for the four changes against main; lint-imports 10 kept,
  0 broken; ty clean.

• Real machine (a registered Linux machine with Claude Code signed in,
  node reinstalled with this tree): process A dispatched a 25 s task,
  saw the prompt out after 2.4 s and the record keep up with the frames
  (6, then 10), then stopped the way the gateway stops 5.4 s after the
  dispatch, leaving the record and the agent running there; process B,
  started fresh, found the record and the running task, picked it up
  in 2.4 s, announced the agent's reply to the conversation with the
  machine note, finished the record, removed the run's record, held the
  agent's process as the pool's connection, and closing the pool ended
  the agent on the machine. This revision, the cli lane with the code
  before and after, the node reinstalled for each: a cli entry
  sh -c 'echo $$ > pid.txt; sleep 20; echo done; cat' was dispatched
  and the host stopped the gateway's way 2.7 s later. Before: no
  record, the command left running on the machine, and the next start
  found nothing to pick up. After: the record kept with the task as
  authored and the manager's origin, the command running on, and the
  next start picked it up in 16.8 s (the sleep), announcing done and
  hi with the instance, node and tool call and the machine note. The
  same with the link killed before the stop: recorded, left, picked up.
  With the machine's daemon ended between the stop and the pick-up, it
  ended its groups on its way out, the task's record there said exit
  -9, and the pick-up announced that as the run's error in 0.1 s,
  leaving nothing on the machine.

• scripts/check_source_language.py, scripts/check_commit_messages.py
  and scripts/check_large_files.py on the branch range, commitlint,
  ruff -- all clean.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

The English and Chinese agent-collaboration guides explain normal startup,
registered-machine setup and recovery, and the removed trial switch.

Risk

Configured machine entries are available by default; entries without a
machine remain local. A remote-looking file path is resolved against the
registry even without an environment variable; use an explicit local path
such as ./a:b for a local filename containing a colon. A formerly hidden
machine entry is now available for dispatch, and an old variable set to 0
no longer disables it. Stopping Raven no longer cancels a turn
running on a machine; it goes on there until the agent finishes or is
cancelled, and its answer arrives in the conversation after the next
start, as a sub-agent result that triggers a turn. One record per run in
the raven home, owner-only, removed when the run is concluded; a machine
that cannot be reached keeps it, so a run is reported at most once and
never lost quietly. The adopted connection answers requests with ids
past the ones the stopped process used, so a replayed frame resolves
nothing sent after the restart. Rollback is a plain revert; a record left
behind is then an inert file.

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Related Issues

#920 and #922 (merged); #921 was carried by #922.

[gloryfromca]

Blocking: cover the TUI host, preserve spawn context, and keep resumptions retryable until delivery completes.

I found three merge blockers in the restart/resume handoff.

Coverage: I read git diff github/main...HEAD, separated the head commit from its stacked machine-support prerequisites, followed the startup/shutdown hosts, node attach/replay, ACP request IDs and frame accounting, manager finalization and announcement callers, and relevant commit history. I also checked AGENTS.md, CONTEXT-MAP.md/CONTEXT.md terminology and architecture constraints, backward compatibility, dependency/schema changes, and the test diff for weakened coverage. git diff --check github/main...HEAD is clean.

Verification: after uv sync --extra dev, the change's stated 683-test set passed. uv run pytest -q completed with 29,002 passed, 144 skipped, and 2 failed: test_cli_theme.py::test_bold_accent_renders_styled_not_bare is on an untouched area, while test_subagent_acp_remote.py::test_the_free_probe_shows_the_link_s_state_once_a_dispatch_has_opened_it passed when rerun alone (the isolated rerun was 1 passed plus the same theme failure). None of these results weakens the blockers below.

[gloryfromca]

Blocking: the three open restart/resume findings still require implementation changes.

The new commit only makes the remote probe test wait for the link's asynchronous agent-exit update. That wait preserves the final idle assertion and is sound, but it does not change or answer any of the three open implementation findings, so they remain blocking on this revision.

Coverage for this revision: I compared 482c704fc035..HEAD, rechecked the affected probe/link caller and the open review record, checked AGENTS.md and the existing CONTEXT architecture constraints, backward compatibility, and that the test was not weakened. git diff --check github/main...HEAD is clean. uv run pytest tests/test_subagent_acp_remote.py tests/test_remote_runs.py tests/test_remote_resume.py tests/test_resume_remote.py tests/test_acp_client_resume.py tests/test_node_client.py tests/test_subagent_manager.py tests/test_rpc_bootstrap.py -q passed: 364 tests.

[LivXue]

Windows compatibility review: one new test portability finding was reproduced.

Scope: complete 79-file PR at 00c671d9e16c0e796459f557df9331671cd53776, API base 182dacac001e6697b3260da4400d2f9e36ba536c, merge base 829eb28e1db877dffdd3df4f835d707e1f049d3a. The isolated snapshot matched all 4,386 head-tree blobs. Rechecked the full scope, the 19-file delta from the previously reviewed #922 prerequisite, persistence/attach/replay and host lifecycle callers, and all discussions. The other 60 changed files retain the reviewed prerequisite blobs.

P2 - Separate POSIX permission bits from the portable record round-trip test. Reproduced on native Windows. tests/test_remote_runs.py:58 unconditionally requires file mode 0600 and directory mode 0700. The actual file reports st_mode=33206, whose permission bits are 0666, so the first test fails before its read-back assertions. Windows stat/chmod mode bits do not express POSIX owner/group permissions. Keep the persistence assertions on Windows and gate the POSIX-mode assertions appropriately; verify Windows ACLs separately if the owner-only requirement is intended there. Both this test and the record module are absent from the exact API base.

The remaining record tests passed. A separate native probe used the real Tracker/record/pending/forget path under a home containing spaces and non-ASCII characters, then started a fresh uv Python process: it recovered the same complete record, including prompt ID 17, next ID 18 and consumed-frame count 7, and removal left no pending record.

Existing functional findings remain tracked in gloryfromca's TUI lifecycle, spawn metadata, and retry-safe conclusion discussions. Those are not duplicated as new findings here.

Native Windows / Python 3.13.12, fresh run-owned environment from uv sync --frozen --extra dev --dev; UV_NO_SYNC=1, PYTHONUTF8=1, isolated user/Raven/temp directories, and imports checked against this snapshot. Exact commands from its root:

$R = 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\a0f78a02ffe84d9c83968056559a226b'
uv run pytest tests/test_remote_runs.py -n 0 -x --tb=short --basetemp "$R\checks\934-records\pytest" --junitxml "$R\checks\934-records\junit.xml"
# 1 failed: the permission-bit assertion.
uv run pytest tests/test_remote_runs.py -k 'not written_owner_only' -n 0 -x --tb=short --basetemp "$R\checks\934-record-behavior\pytest" --junitxml "$R\checks\934-record-behavior\junit.xml"
# 7 passed, 1 deselected.
uv run pytest tests/test_remote_resume.py tests/test_resume_remote.py tests/test_acp_client_resume.py -n 0 -x --tb=short --basetemp "$R\checks\934-resume\pytest" --junitxml "$R\checks\934-resume\junit.xml"
# 25 passed.
uv run pytest tests/test_node_client.py tests/test_acp_client_launch.py tests/test_acp_client_teardown.py -n 0 -x --tb=short --basetemp "$R\checks\934-node\pytest" --junitxml "$R\checks\934-node\junit.xml"
# 33 passed, 33 skipped.
uv run pytest tests/test_subagent_manager.py::test_a_dispatch_left_running_on_its_machine_when_the_host_stops_is_neither_finished_nor_announced -n 0 -x --tb=short --basetemp "$R\checks\934-manager\pytest" --junitxml "$R\checks\934-manager\junit.xml"
# 1 passed.
uv run pytest tests/test_ops_remote_path.py tests/test_deliver_files_tool.py tests/test_remote_file_tools.py tests/test_permissions_remote_read.py -n 0 -x --tb=short --basetemp "$R\checks\934-prerequisites\pytest" --junitxml "$R\checks\934-prerequisites\junit.xml"
# 165 passed, 3 skipped.
uv run pytest "$R\test_native_record_restart.py" -s -n 0 -x --tb=short --basetemp "$R\checks\934-native-record\pytest" --junitxml "$R\checks\934-native-record\junit.xml"
# 1 passed.

Total: 232 passed, 36 skipped, 1 failed. The skips require POSIX-shell fixtures. Recovery protocol tests use in-process endpoint/node substitutes; the cross-process probe verifies local persistence only. No live SSH/remote daemon, real host shutdown/restart, Windows ACL audit, or full repository suite was exercised.

[gloryfromca]

Blocking: the three existing lifecycle defects remain, and remote CLI shutdown leaves an untracked orphan.

The earlier three open threads are unchanged in this revision and still stand. The merge also enables CLI and OpenAI rows on registered machines; the remote CLI path adds the shutdown blocker marked inline.

This new blocker meets the post-fourth-round bar: this revision introduces it by enabling CLI machine rows, ordinary gateway/RPC shutdown reaches it whenever such a turn is active, and Raven offers no recovery because it records the turn as cancelled while leaving an untracked process on the machine.

Coverage: I read AGENTS.md/CLAUDE.md and the runtime context map, compared github/main...HEAD plus the delta from the previously reviewed head, traced shutdown/cancellation through the manager, CLI backend, node endpoint, run tracker, and resume scheduler, and checked callers, history, schemas/generated clients, backward compatibility, and whether tests were weakened. git diff --check github/main...HEAD is clean. uv run pytest tests/test_subagent_cli_remote.py tests/test_subagent_acp_remote.py tests/test_remote_runs.py tests/test_resume_remote.py tests/test_acp_client_resume.py tests/test_node_client.py tests/test_node_server.py tests/test_subagent_manager.py tests/test_rpc_bootstrap.py tests/test_rpc_subagents.py tests/test_cli_gateway_commands.py tests/test_cli_tui_commands.py -q passed: 787 tests. At review time GitHub CI had one Ubuntu unit shard failed and another pending; the failed job's log was not yet available while the workflow remained in progress. I also checked the existing Windows portability report without duplicating or re-grading it.

[gloryfromca]

Blocking: the four open lifecycle defects still have to be fixed.

The new node/filesystem hardening commit does not touch or invalidate any of those four threads, so they remain open and this revision cannot merge yet. I found no additional blocker in the six-file delta.

Coverage this round: the repository rules and runtime context; git diff github/main...HEAD and the complete delta from the previously reviewed head; the changed filesystem, node server, installer, and tests; chunk-boundary behavior, concurrent read/write ordering, installer shell quoting and package-index precedence; callers and history; backward compatibility; the current discussions; and whether tests were weakened. git diff --check github/main...HEAD is clean. uv run pytest tests/test_filesystem_tools.py tests/test_node_install.py tests/test_node_server.py tests/test_subagent_cli_remote.py tests/test_subagent_acp_remote.py tests/test_remote_runs.py tests/test_resume_remote.py tests/test_acp_client_resume.py tests/test_subagent_manager.py tests/test_rpc_bootstrap.py tests/test_rpc_subagents.py tests/test_cli_gateway_commands.py tests/test_cli_tui_commands.py -q passed: 809 tests. GitHub checks were still in progress; all completed checks were passing.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Reviewed the exact delta from the prior clean head and reconciled it with the complete github/main...HEAD patch. The only production change moves PickedUp, UnreachableError, and PICKED_UP_NOTE into a Raven-independent leaf; remote_resume re-exports the identical objects for backward compatibility, while the CLI backend imports the leaf and no longer closes the reported module cycle. The previously reviewed lifecycle behavior is unchanged.

Covered the repository rules and canonical context, the four-file diff, callers and import history, public import compatibility, the cycle-budget architecture constraint, and whether tests were weakened. git diff --check passes; the import-cycle guard plus ACP/CLI pickup and resume suites pass 75/75. The direct compatibility check also confirms all three old exports are object-identical to the new leaf exports. No finding remains.

[Handsome-wzw]

Merged main (b43d78b, #922 squashed in) into this branch as a plain merge commit; no rebase, no force. The five files that conflicted (the acp and cli backends, the node client, the two stand-in-machine test files) carry main's side byte for byte already, since #922's commits were brought in before: the conflicts were this branch's own changes beside them, kept whole, and what these files lose against main are only lines this branch rewrote on purpose (the transcript parse moved into a helper the pick-up shares). The diff is now this change's own. #921 is closed: its content is on main through #922.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Reviewed the exact merge from the prior clean head after refreshing github/main to b43d78bf0, then re-read the resulting 26-file github/main...HEAD feature diff. The merge tree is byte-identical to the prior clean tree. Its five conflict resolutions correctly retain the feature-side ACP/CLI run tracking, frame handoff count, shared transcript parsing, and pickup tests beside the mainline files-by-address behavior; no mainline behavior is silently dropped.

Covered the repository rules and canonical context, the diff and both-parent history, conflict callers and callees, serialized/backward compatibility, import-cycle and node-transport architecture constraints, and whether tests were weakened. Both git diff --check scopes pass. The import-cycle, ACP/CLI resume, durable-record, node-client, and stand-in-machine suites pass 218/218 at this head. GitHub also reports the exact-head Windows ACP, TUI, lint, repository, and packaging checks green; remaining unit shards were still running when reviewed. No finding remains, and every thread I opened is resolved.

[gloryfromca]

Blocking: preserve the optional backend contract through forwarding wrappers.

Reviewed the new reply-to-announce durability delta and the complete main-to-head change. I covered AGENTS.md/CLAUDE.md and the Runtime vocabulary, the diff and its callers/history, backward compatibility, test weakening, and the backend/manager architecture contract. The record lifetime and whole-turn replay paths are supported by the focused process tests, but the new keyword breaks an existing forwarding-wrapper path, so this revision cannot merge yet.

Verification: the focused remote-run/manager/resume/ACP/CLI/routing suite passed 390/390. The unchanged direct-chat compatibility test fails deterministically at this head, and exact-head CI unit shard 4/4 reports the same failure; shard 3/4 also hit its existing process-timeout/leak case, while that isolated test passed locally. git diff --check passed.

Patch-risk assessment for the immutable github/main...HEAD diff (218b366129bf7161145c849e84989a1af4abff336056565a8bfcfe6cf2dfbf0f) validates as revise: impact high (persistent restart state), regression likelihood high (reproduced contract break), protection partial, recovery managed, confidence high.

[Handsome-wzw]

Two commits since the last look, both from the review of #947 (which carries this branch):

• 62c5c64: a run's record outlives its reply until the announce was taken, and a pick-up replays the turn whole. The backends removed the record the moment the prompt or the command returned, before the manager announced, so a host killed in between lost the reply; and the record's frame count had moved past the answer, so a record left behind would have resumed after it. Now the manager dispatches with reported_by_caller=True and removes the record after an announce that was taken (remote_runs.forget_dispatch), or annotates and keeps it after one the draining scheduler refused; Tracker.received stops at the prompt. Tested on the real daemon behind the stand-in ssh and on a registered machine with the code before and after (the before: "nothing was announced: the reply is lost"; with the old record forced to stay, a pick-up that waited out its deadline). Details in the thread on feat(*): lend the host's MCP servers to an acp agent on a machine through its node #947.
• b184d82: a test stand-in that forwarded every keyword to a fake that declares fewer (the direct chat's gating double), which the new keyword made visible.

The body above carries both.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

The new commit correctly confines the previously failing keyword forwarding to the test-only gating wrapper; it does not weaken the reply-record, whole-turn replay, or manager-announcement assertions. I rechecked the repository rules and Runtime terminology, the full main-to-head diff plus this one-file delta, callers and history, backward compatibility, test weakening, and the manager/backend architecture. The broader custom-route edge is not reachable through the repository's shipped routed implementations and does not meet the late-round blocking bar.

Verification: git diff --check passed; the formerly failing direct-chat test plus the focused routing, manager, record, resume, ACP, and CLI suite passed 391/391. Exact-head GitHub jobs were pending at review time. My prior thread is withdrawn and resolved, and no thread I opened remains outstanding.

[Handsome-wzw]

Removed the machine trial switch at the owner's request in a0babda. The final branch also retains the independently published result-retention fix from 62c5c64 and current main.

What the parameter used to do: RAVEN_DEBUG_MACHINES was a default-off feature gate for trying registered-machine support. It was not a verbose-logging option. Unless enabled, machine-backed agents were excluded from the dispatch table, node and installer access was refused, remote preset destinations were hidden, and the file tools treated remote-looking paths locally. The startup restore path still ran, so an omitted variable could make a pending run look like an agent that had been removed.

Now the variable and every production check are gone. Start Raven normally; a configured machine selects the destination, and an entry without it stays local. A stale RAVEN_DEBUG_MACHINES=0 is ignored. Registration validation, SSH authentication, file permission prompts and concurrency limits continue to apply. Listing entries and capability backfills still do not log into every machine.

Verification:

• The default-behavior regression selection produced 8 failures before removal, with the enabled-value control passing; all 9 pass afterwards. The recovery tests construct a real AgentRegistry for both ACP and CLI, with the variable absent and with the old value 0.
• The final combined tree passes 1799 related tests with strict idle accounting. Changed-line coverage for the whole PR is 92.92% (656/706); the removal commit's new executable lines are 2/2 covered. Python lint, types, imports, dependencies, scope gates and both RPC generators pass; five frontend fixture-contract tests pass.
• On a registered Linux machine, separate dispatch and restart processes reproduce the original loss: start with the switch on, restart without it, and the outcome is an absent-agent error with the record removed. With the change, both an absent variable and old 0 recover the full result and read the output file by address. The absent-variable case also kills the relay before shutdown. Both were repeated after integrating the latest recovery fix.
• With no variable set, 12 timing/boundary probes and three attachment/command/IPv6 checks pass. They include cancellation during a dead link and 11 concurrent launches allowing 8 and refusing 3. Windows command parsing is simulated, not a native Windows run. The dedicated test tasks, tunnels and remote node directories have been cleaned up.

Checked documentation against the code: CONTEXT.md, config and RPC descriptions, transport/path docstrings, both collaboration guides, the external design notes and this PR description. They now explain normal startup and what the removed parameter previously controlled. The existing CI environment-contamination investigation and the separate CLI-derived-session observation were not changed by this work.

Full-suite follow-up: 31345 passed, 230 skipped, 2 xfailed and 5 failed. Four failures reproduce in a separate current-main checkout (host color rendering, LibreOffice detection and two simulation cases). The fifth exposed a direct-chat test stub that did not accept the newly published reported_by_caller keyword; the published fix in b184d82 is retained unchanged: the wrapper forwards only keywords its fake backend declares. The full suite was not rerun for that test-only adjustment; the complete direct-chat/manager recheck reports 277 passed with strict idle accounting. Full-PR changed-line coverage is 96.18% (679/706).

The final integration also carries the published replay-docstring correction. The two Python files differ only in docstrings from the tested implementation; their executable syntax trees were compared and are identical.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

The branch advanced during this review, so this stance covers the current aeaa24432942 tree rather than stopping at the assigned 2052eb3888e1 parent. I rechecked the new default-on registered-machine commit and the merge integrations against current main, along with the replay-docstring delta: removing the former trial switch leaves registry usability, SSH, permission, and local-path safeguards intact, and the updated replay wording matches the prompt-time frame cursor used by pickup.

Covered the repository rules and canonical runtime terms, the new diff and its callers/history, backward compatibility (including an old RAVEN_DEBUG_MACHINES=0), test changes for weakening, and the machine/recovery architecture. git diff --check github/main...HEAD passes. The focused exact-head run passed 1,182 tests with 4 expected skips for unavailable csh/tcsh; GitHub checks are green except the four unit shards still running at review time.

[0xKT]

Not a blocker. Grading this PR A (mergeable). Two items for awareness before merge; neither blocks.

Severity of this one finding, not a verdict on the pull request. Any blocking findings from this pass are review threads on the changed files; GitHub renders those collapsed, as a file name with no text.

1. Defense-in-depth reduction: the kernel machine-lane gate is removed (by design)

This PR deletes MACHINE_LANE_ENV / machine_lane_enabled() from the kernel (home.py) and all 6 call sites. In the prior design (accepted in #920/#921) that env var was deliberately in the kernel so, in its own words, the model "must not be able to turn the lane on itself". After this PR the heavier machine integrations (persistent acp/cli sub-agents, remote file tools, remote resume) ride only the normal config/exec approval tiers.

I graded this A, not blocking, after checking three things against the merged tree:

• Not default-on: a fresh install has an empty connection registry, so remote.machine() refuses any id and subagents.add refuses through the same seam; an entry with no machine runs locally. The model cannot add a host (the ops connection-add tool is off by default); an operator must register one first.
• No new remote-exec path: exec(machine=<id>) already ran a 60s-capped command on an operator-registered machine in base, ungated by the env var (base shell.py:293-296 calls run_on_machine with no machine_lane_enabled() check; the gate at base:311-317 only changes the wording of a refusal message for a typed raw-ssh command). So prompt-injection -> remote-exec on a registered machine pre-dates this PR; this PR graduates the heavier integrations into that same already-reachable trust domain.
• Highest-risk sub-capability stays with the user: lending credentials/MCP to a machine sub-agent (lend_key) is still touches_sensitive() == True, so in SMART mode it is kept with the user, not routed to the judge.

Flagging it because it is a conscious security-posture change (a kernel gate my own #920/#921 acceptances relied on) and it intersects the open #947 finding (host MCP lent to a machine acp agent). Your call at merge whether a maturing feature should keep a non-model gate.

2. Non-blocking: a failed remote run's error is lost on a draining-refused announce (manager.py:1956)

The CRUX-1 fix (62c5c64) makes the SUCCESS branch keep the run's machine record when _announce_result returns False during scheduler draining (announced = taken is not False, then the finally annotates instead of forgetting). The two ERROR branches (except SubagentActionAbortedError, except Exception) call _announce_result(..., 'error') but do not capture its return, so announced stays True (its init value at 1807) and the finally runs forget_dispatch(task_id) -- removing the record the backend deliberately kept, even when the error-announce was refused by draining.

Result: a remote sub-agent run that fails in the host-shutdown/draining window has its failure neither announced (draining refused it) nor recoverable by resume (record gone); only a status=failed spawn record persists on disk, never re-announced. Narrow (shutdown race) and the failure is still on disk, hence non-blocking. Mirroring the success branch's announced = taken is not False onto the error path would close it.

[gloryfromca]

No blockers; suggestions only, and they are marked inline.

The new draining-error observation changes my prior clean stance to nonblocking. I confirmed that both exception branches discard a false return from _announce_result(), so announced remains true and the finally block forgets the remote run record even though the draining scheduler refused its error announcement. The focused success/refusal and resumed-announcement tests pass 2/2, but they do not exercise this error/refusal branch.

This remains a narrow shutdown race, and the failed spawn record is still durable locally, so it does not hold the merge. The deliberate removal of the machine trial gate does not otherwise change my stance.