When a Claude session exits with an error (e.g. expired OAuth token),
the error text was being auto-posted to the channel as if it were
normal assistant output. This caused raw JSON API errors to appear
in user-facing channels.

Now, when flush_auto_output detects a Result event with is_error: true,
it clears the pending events instead of posting them. Errors are still
logged to daemon.log for debugging.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Channel leads had no max retry limit — when a lead's auth expired, it
would crash, wait 120s, crash again, and repeat forever. Workers already
had MAX_WORKER_RESTARTS=3 with ops escalation, but leads were missing
this protection.

Now ensure_lead_for_channel checks failure_count and stops retrying
after MAX_LEAD_RESTARTS=3 consecutive failures, posting to ops instead.
The daemon also uses the correct per-kind max and escalation key format.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Workers are spawned with channel=dm-{name}, not the task's channel.
This meant @ALL in a topic channel only found agents indexed under
that channel (the lead), missing workers whose tasks belong there.

The fix adds a second scan after the by_channel lookup that finds
workers by checking task.channel instead of agent.channel. The nudge
dedup set prevents double-nudging workers that happen to be indexed
in the correct channel.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

resolve_nudge_action returned RespawnAndDeliver for any stopped agent
with no session_id, regardless of whether a SpawnFailure cooldown was
active. This meant every user message to a dead lead triggered a new
spawn attempt, bypassing both the 120s cooldown and the circuit
breaker (MAX_LEAD_RESTARTS) from ensure_channel_leads_alive.

Now resolve_nudge_action checks is_active(SpawnFailure, key) before
returning RespawnAndDeliver. Leads use channel as key, workers use
task_id.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The Cycle 4 fix only added cooldown checks to RespawnAndDeliver (no
session_id). ResumeAndDeliver (has session_id) was unchecked, meaning
agents with preserved session_ids (e.g. auth errors that don't trigger
"No conversation found") could be resumed on every user message.

Moved the cooldown check before the session_id branch so it applies
to both resume and respawn paths.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Addresses Codex review: flush_auto_output's error check only worked
when the Result event was in the same batch as the error text. If the
2-second timer fired between the error text and the Result, the text
leaked through.

Moved error suppression from flush_auto_output to the drain loop:
- Set session_errored flag when Result { is_error: true } is received
- Skip timer flushes, stream-end flushes, and turn-end flushes when
  the flag is set
- flush_auto_output is now a pure extract-and-post function

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Pre-existing biome error exposed by touching Channel.svelte.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>