merge: integrate origin/main (406 commits) into live branch

Merge upstream's paired-room stabilization, dedicated message-runtime-loop,
outbound delivery refactor (ipc-outbound-delivery / deliverFormattedCanonicalMessage),
discord module split, dashboard rework, and migrations 015-018 into our branch.

Conflict policy: prefer upstream for the heavily-refactored paired-room /
message-runtime / db cluster (it supersedes our earlier loop band-aids), keep
only orthogonal unique fixes:
- codex bundled-JS launcher fix (codex-warmup.ts)
- slot-aligned Claude+Codex usage primer (usage-primer.ts) re-wired into index.ts
- MemoryHigh=3G cgroup bound, discord perms diagnostic, prompt docs
- progress null-race + silent-failure publish guards (message-turn-controller.ts)

Dropped (superseded by upstream or unwired): reviewer STEP_DONE/TASK_DONE loop
band-aids, router markdown-escape override, register tribunal-default+git-init,
restart-context rewindToSeq (unwired).

Verified: typecheck clean, build clean, vitest shows zero new regressions vs the
origin/main baseline (only pre-existing env-config failures remain).

src/agent-error-detection.ts

@@ -231,6 +231,35 @@ const NONE: AgentErrorClassification = {
   reason: '',
 };
 
+export function isCodexPoolUnavailableError(
+  error: string | null | undefined,
+): boolean {
+  if (!error) return false;
+  return (
+    /all\s+codex(?:\s+rotation)?\s+accounts(?:\s+are)?\s+unavailable/i.test(
+      error,
+    ) || /codex\s+rotation\s+pool\s+unavailable/i.test(error)
+  );
+}
+
+export function isTerminalCodexAccountFailure(
+  error: string | null | undefined,
+): boolean {
+  if (!error) return false;
+  if (isCodexPoolUnavailableError(error)) return true;
+  if (classifyCodexAuthError(error).category !== 'none') return true;
+  const lower = error.toLowerCase();
+  if (
+    classifyAgentError(error).category === 'rate-limit' &&
+    (lower.includes('workspace out of credits') ||
+      lower.includes('out of credits') ||
+      lower.includes('codex'))
+  ) {
+    return true;
+  }
+  return false;
+}
+
 /**
  * Classify an agent error string into a category.
  * Handles patterns common to both Claude and Codex: 429, 503, network.
@@ -249,6 +278,8 @@ export function classifyAgentError(
     lower.includes('429') ||
     lower.includes('rate limit') ||
     lower.includes('usage limit') ||
+    lower.includes('out of credits') ||
+    lower.includes('workspace out of credits') ||
     lower.includes('hit your limit') ||
     lower.includes('too many requests') ||
     lower.includes('rate_limit')
@@ -267,6 +298,8 @@ export function classifyAgentError(
     hasApi5xx ||
     lower.includes('503') ||
     lower.includes('overloaded') ||
+    lower.includes('selected model is at capacity') ||
+    lower.includes('model is at capacity') ||
     ((lower.includes('502') || lower.includes('bad gateway')) &&
       (lower.includes('cloudflare') ||
         lower.includes('<html') ||
@@ -333,14 +366,21 @@ export function classifyCodexAuthError(
   error: string | null | undefined,
 ): AgentErrorClassification {
   if (!error) return NONE;
+  if (isCodexPoolUnavailableError(error)) return NONE;
   const lower = error.toLowerCase();
 
   if (
+    lower.includes('auth-expired') ||
+    lower.includes('auth expired') ||
     lower.includes('401') ||
     lower.includes('authentication_error') ||
     lower.includes('failed to authenticate') ||
+    lower.includes('access token could not be refreshed') ||
     lower.includes('oauth token has expired') ||
+    lower.includes('refresh token was already used') ||
     lower.includes('refresh your existing token') ||
+    lower.includes('log out and sign in again') ||
+    lower.includes('app_session_terminated') ||
     lower.includes('unauthorized')
   ) {
     return { category: 'auth-expired', reason: 'auth-expired' };