Unstick the pr-reviewer Stage 3 agent: lean prompt, real local-daemon timeouts, and TUI recovery for retry ladders and permission dialogs

[atomantic]

Summary

The pr-reviewer Stage 3 agent (claude-ollama-tui + qwen3-coder:30b) hung twice on 2026-09-04: first at API error · Retrying in 0s · attempt 1/10 for the whole run, then — once the request finally got through — on a tool-permission dialog nobody was present to answer. Both were diagnosed and fixed at the root, and both hang shapes now recover automatically.

Why it hung

• The stage prompt was ~400KB (~100K tokens): {reviewChecklist} inlined the entire /do:review command with every lib (~260KB the sandboxed stage cannot use), and a string-form String.replace let a $+backtick inside that body splice the stage prompt back into itself seven times.
• Ollama sends no bytes at all until prefill completes. Claude Code v2.1.260 has four independent ceilings on that silence, and the binding one is the Bun runtime's own fetch timeout (~360s), which only API_FORCE_IDLE_TIMEOUT=0 disables — so PR Public-review Stage 3 dispatches a ~100K-token prompt to a local model without checking it fits the run's time budget #6117's API_TIMEOUT_MS raise changed nothing. Verified with a fake stalled /v1/messages on loopback: with the flag unset or 1 the client re-sends every 361s regardless of every other knob; with 0 it waits out the prefill. (Ollama's context checkpoints are why the run eventually got through after ~5 retries.)
• The local model then hallucinated an absolute path outside the worktree, and --permission-mode acceptEdits painted Do you want to proceed?.

What changed

• Stage 3 gets a new {reviewLenses} placeholder (the five review lenses, ~39KB) instead of the whole /do:review; every placeholder uses a function replacer. Resolved prompt drops from ~400KB to ~50KB before the PR envelope.
• Local-backed Claude harnesses get API_FORCE_IDLE_TIMEOUT=0 plus the two 30-minute stream-idle knobs, allowlisted through both public-review env boundaries.
• createRetryStallGate: a retry banner that advances twice across ten minutes fails the run over to a fallback provider (decided at a sighting, never by the clock, so a fast cloud ladder that then succeeded is left alone).
• createToolPermissionGate: any tool-permission dialog is declined (arrow-down to the last "No", whose number varies by tool) and the quiet session is nudged back to work; eight nudges fail the run. The OOM nudge and this one share one createSilenceNudgeGate. The dialog pattern is shared with the post-mortem analyzer.
• The pipeline hand-off no longer points a stage at data/cos/agents/<prev>/output.txt (outside every worktree) once the output is inlined.

Test plan

• server: aiToolkit, tuiHandshake, cliChildEnv, agentTuiSpawning, taskPromptService, agentPromptBuilder, taskPromptDefaults, agentErrorAnalysis, agentCompletionCleanup suites — 1432 passing
• Mutation checks: reverting the function replacer fails the splice test; removing the stall-gate wiring fails the spawner test
• Offline Claude Code timeout matrix (12 variants × ~7 min against a fake stalled /v1/messages) pins API_FORCE_IDLE_TIMEOUT=0 as the knob that survives a silent prefill
• After merge: pm2 restart portos-server so the new child env reaches the next Stage 3 spawn, then re-run the pr-reviewer on a contributor PR and confirm the agent dir shows a ~50KB prompt.txt and no Retrying banner