@aeondave/pi-persona 1.17.4 → 1.17.5

package/AGENTS.md

@@ -268,6 +268,19 @@ the shared behavioral prompt layer: [`docs/SPINE.md`](docs/SPINE.md).
   option (a terminal event is observed before the permission gate). A countdown replaces the stall clock; `x`
   cancels one via the stop registry; `X`, the `N agents` count and telemetry exclude them.
 
+- Loaded companions: `core/companion.ts` defines the public local presence, live memory-owner and
+  activity contracts; `extension/{companion,memory-owner}.ts` bind them to the current native owner.
+  Mind requires a compatible loaded partner, never a settings-file inference. Actual selection is
+  authoritative with persistence off; both engines freeze it for delegated legs (private per-child
+  factory in-process, spawn-local environment for child processes). `ui/activity-rows.ts` projects
+  bounded local Mind work without agent counts, controls, wakes, model usage or agent telemetry.
+  Automatic semantic review instead uses `pi-persona:mind-worker:v1`: one real tracked Mind worker,
+  with the current session model/effort, no tools/fallback/bus, normal shared concurrency and F9
+  controls, a 180s deadline, and a terminal archive. Memory/delegate/target permissions still apply.
+  Its completion belongs to Mind; it never wakes the supervisor. See the companion architecture contract.
+  These cooperative contracts are not authentication; see the loaded-companion section
+  in `docs/ARCHITECTURE.md`.
+
 - `src/core/` — pure kernel: frontmatter, permissions, contract (+`parseContract`), config, discovery, fence (`fenceUntrusted`), brief (`buildDelegationBrief` — the per-turn roster + standing hand-off default; `buildExocomBrief` — the per-turn exocom peer roster, the peer-vs-sub-agent split, and the relevance bound on a peer exchange), timer (`TimerScheduler` — the alarm engine behind the `timer` tool), session-runs (pure restore-notice helper: what a reload/resume lost + the run-id counter), types.
 - `src/engine/` — `child.ts`, `inproc.ts` (default), `adapter.ts`, `async.ts` (async tracker/peek), `worktree.ts` (git-worktree isolation), `stream.ts` (event→state).
 - `src/orchestration/` — `sdk.ts` (`agent`/`parallel`/`reduce`), `strategy.ts` (registry), `strategies/*.ts`, `voting.ts`, `flow*.ts` (DAG + JSONL journal + checkpoint gates), `roster.ts` (teams + `rosterSpec`: a roster member is a bare name OR an inline `{ agent, role, model, skills }` that specialises one agent — every strategy runs members through `rosterSpec`).

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows the version scheme
 used in its [GitHub releases](https://github.com/AeonDave/pi-persona/releases).
 
+## [1.17.5](https://github.com/AeonDave/pi-persona/releases/tag/v1.17.5) - 2026-10-25
+
+### Added
+
+- A visible asynchronous Mind maintenance worker, pinned to the current session model and effort.
+  It shares normal concurrency, F9 controls and result archival, has no tools or model fallback,
+  and returns its completion to Mind without starting another supervisor turn.
+- Loaded-companion presence, live memory ownership and bounded `Mind` activity rows. Mind can
+  require the actual loaded Persona partner and follow persona changes even with persistence off;
+  both engines freeze that owner for delegated legs. Activity stays separate from agents, controls,
+  wakes and model usage. These paired contracts require the updated Mind and Persona together.
+
+### Fixed
+
+- Council, MAGI, auxiliary actors and flow legs keep their own model and effort in the live
+  tree and F9 when abbreviated roles collide or identical roles use different inline pins.
+  Runtime callbacks carry exact attempt identity; retries clear stale observations and terminal
+  rows use the engine's observed model. Saved model assignments remain keyed by the full role.
+- Terminal-result capture survives reactivation of the same extension and tracker. Shutdown
+  revokes the old archive owner without removing the capture observers or changing their order
+  before completion notifications; late results cannot enter another session's archive.
+- Child broker contacts confirm one-way delivery only after admission to the host bus.
+  Full inboxes, disconnects, cancellation and missing receipts no longer report `delivered: true`.
+  Receipts are bounded and never count as a supervisor answer or authorization.
+  Unconfirmed sends and errors after admission no longer claim that the message was dropped;
+  the supervisor may already have received it.
+- Reference-flow diagnostics fence worker excerpts even on the defensive missing-reference path.
+- A worker-provided patch remains usable after worktree capture fails, with an explicit warning
+  that the patch was not verified against the final worktree state.
+
 ## [1.17.4](https://github.com/AeonDave/pi-persona/releases/tag/v1.17.4) - 2026-10-25
 
 ### Added

package/README.md

@@ -1,7 +1,7 @@
 # pi-persona
 
 <p align="center">
-  <img src="assets/banner.png" alt="pi-persona — supervised multi-agent orchestration for Pi">
+  <img src="https://raw.githubusercontent.com/AeonDave/pi-persona/v1.17.5/assets/banner.png" alt="pi-persona — supervised multi-agent orchestration for Pi">
 </p>
 
 [![CI](https://github.com/AeonDave/pi-persona/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/AeonDave/pi-persona/actions/workflows/test.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AeonDave/pi-persona/badge)](https://scorecard.dev/viewer/?uri=github.com/AeonDave/pi-persona) [![npm version](https://img.shields.io/npm/v/@aeondave/pi-persona?logo=npm)](https://www.npmjs.com/package/@aeondave/pi-persona) [![License](https://img.shields.io/github/license/AeonDave/pi-persona)](LICENSE)
@@ -40,9 +40,9 @@ your customizations.
 | Install option | Command |
 |---|---|
 | This project only | `pi install -l npm:@aeondave/pi-persona` |
-| Pin this release | `pi install npm:@aeondave/pi-persona@1.17.4` |
+| Pin this release | `pi install npm:@aeondave/pi-persona@1.17.5` |
 | Update an unpinned install | `pi update npm:@aeondave/pi-persona` |
-| Git tag 1.17.4 | `pi install git:github.com/AeonDave/pi-persona@v1.17.4` |
+| Git tag 1.17.5 | `pi install git:github.com/AeonDave/pi-persona@v1.17.5` |
 
 Restart Pi after updating. For a pinned install, install the new version or tag explicitly.
 If switching from a Git install, remove that source first with
@@ -180,14 +180,20 @@ to those files. It does not delete additional custom files: a persona `pippo.md`
 `pluto.md` remains untouched. A custom file using the same destination as a bundled default is
 replaced. Settings, credentials, sessions and project-local overrides are not reset.
 
-For optional long-term memory, add [pi-persona-mind](https://github.com/AeonDave/pi-persona-mind).
-
 `/persona-settings` is separate from Pi's `/settings`: it edits pi-persona preferences and saved
 persona model assignments, not native Pi or compaction settings. In the TUI, `/` filters settings,
 `r` resets the selected saved override, and `m` opens model assignment editing. Scalar preference
 changes apply after restarting Pi or Pi's native `/reload`, not `/new`; `/persona reload` only
 refreshes persona definitions. Model changes apply to future runs. See [configuration and settings](docs/REFERENCE.md#configuration-and-data).
 
+## Optional memory companion
+
+[pi-persona-mind 0.8.4](https://github.com/AeonDave/pi-persona-mind/releases/tag/v0.8.4) adds durable
+project/persona memory, session notes and a visible automatic consolidation worker. It requires
+pi-persona 1.17.5 or later. Install it with `pi install npm:@aeondave/pi-persona-mind`, then restart
+Pi or run `/reload`. See its [README](https://github.com/AeonDave/pi-persona-mind#readme) for scope,
+automatic-review limits and undo.
+
 ## Documentation
 
 | Guide | What's inside |

package/docs/ARCHITECTURE.md

@@ -288,13 +288,18 @@ up to 16 names. Same idea, two layers, two caps — see docs/REFERENCE.md's exam
 
 `isolation: worktree` is fail-closed. It requires a clean Git checkout so the detached `HEAD` view
 cannot silently omit staged/unstaged/untracked supervisor work; a non-repository, dirty checkout,
-worktree creation failure, missing diff artifact, or an artifact over the return limit fails the leg —
-the base engine is never invoked against the real tree as a fallback. The created worktree's initial
-commit is pinned before the worker starts. Export compares the final file state against that immutable
-commit, so worker commits, later unstaged changes and new files are included together. The diff is
-captured before the temporary tree is removed and then returned to the supervisor; commit history is
-not applied to the main checkout. Every git call is asynchronous so the extension host keeps rendering,
-ticking timers, and serving broker sockets while a large checkout runs.
+worktree creation failure, or a successful leg with neither a captured diff nor a returned unified
+patch fails the leg — the base engine is never invoked against the real tree as a fallback. The
+created worktree starts from the committed `HEAD` only: local ignored files are not copied into it,
+and untracked ignored outputs are not exported. The original checkout's ignored files remain
+untouched; tasks that need local-only inputs must recreate or provide them explicitly. The
+worktree's initial commit is pinned before the worker starts. Export compares the final file state
+against that immutable commit, so worker commits, later unstaged changes and new files are included
+together. The diff is captured before the temporary tree is removed, then returned to the supervisor;
+commit history is not applied to the main checkout. If Git cannot capture the diff but the worker
+returned a unified patch, that patch is retained with a warning that it was worker-provided and not
+verified against the worktree state. Every git call is asynchronous so the extension host keeps
+rendering, ticking timers, and serving broker sockets while a large checkout runs.
 
 Transient retries inside one agent session belong to the host **Pi runtime**'s `retry.*` settings, not
 a persona contract — pi-persona neither parses retry notation nor schedules its own backoff. Both
@@ -317,10 +322,19 @@ models, repeated same-model attempts, stop/timeout/contract/agent/infrastructure
 child/token budgets do not recover. Both attempts are accounted, and a warning plus result metadata
 identify the switch. A per-role model assignment can supplement the legacy per-agent assignment;
 preflight model selection includes external arbiters and other declared agent-valued parameters.
-Live tree and telemetry labels use those participant identities for auxiliary actors too, with
-inline model pins taking precedence. If distinct full roles share a short display hint, the display
-keeps the hint (with `#N` suffixes for repeated node keys) but omits the uncertain model label rather
-than borrowing another role's choice. Routing still resolves the full role key, not the display hint.
+Live tree and telemetry labels resolve auxiliary actors and every repeated roster occurrence from
+the SDK's exact, immutable attempt identity (`agent`, full `role`, explicit `model` and `thinking`),
+alongside its unique node key. Short role hints and `#N` suffixes are presentation only: colliding
+hints never discard a known model or borrow another occurrence's inline pins. Model assignments
+and agent defaults are copied after setup when the engine is constructed, so a queued leg's display
+cannot change with later persona/settings edits. Seeds use each actual roster member; lifecycle
+updates use the actual attempt, including custom strategy calls and auxiliary actors in any order.
+A recovery keeps the node key, changes its requested model, and clears the preceding attempt's Pi
+effort observation. Terminal `modelUsed` and validated effort observations override intent only when
+reported; an absent observation retains the current attempt's intent. Initial effort remains the
+explicit spec request, never inferred provider cognition. Clearing an unknown model emits an empty
+`model` string in a telemetry update, preserving the existing string patch contract without leaving
+a stale previous model in consumers.
 
 **Model assignment repair is configuration, not execution recovery.** `/persona models [profile]`
 is an explicit user edit in the Pi adapter: it reuses `resolveCouncilInvocation`,
@@ -497,8 +511,9 @@ never simultaneously a telemetry event, a routed message, and a UI source of tru
   usage`). Feeds derived UI; never routed as an agent message.
 - **Bus Msg** — semantic agent↔agent communication (`progress · decision · interview`, and sibling
   peer sends). `src/bus`. `progress_update` is a Bus message only, not an EngineEvent.
-- **ProgressView** — a derived, read-only UI view computed *from* EngineEvents. Never authored, never
-  a source of truth. The `f9` agent tree and `peek` digest are ProgressViews.
+- **ProgressView** — a derived, read-only UI view computed from observed runtime lifecycles:
+  EngineEvents, wake-source lifecycles, or the bounded local companion lifecycle below. Never a
+  source of truth. The `f9` agent tree and `peek` digest are ProgressViews.
 
 Steering is a supervisor-to-child control action, distinct from semantic Bus messages; requesting
 steering does not establish that a blocking headless delegate call has been interrupted. The peek digest is
@@ -508,6 +523,69 @@ External telemetry is not a fourth communication plane: it is a generic observer
 future plugins may consume or produce, not an exclusive pi-persona protocol. It observes projected
 events and cannot route, reply, steer, or otherwise control agents.
 
+### Loaded companions and local activity
+
+The local EventBus request `pi-persona:companion:v1` accepts `{ version: 1, respond }` and calls
+`respond` synchronously with `{ version: 1, provider: "pi-persona", role, capabilities }`.
+`role` is `supervisor`, `leg`, or `disabled`; `capabilities.memory` is `1` for a loaded supervisor or
+delegated leg and `false` for a disabled supervisor. `capabilities.activity` is `1` only for an enabled
+supervisor. Persona registers this responder before its bridge and disable guards. Pi owns the
+subscription lifetime and revokes it on disposal/reload. Companions query the loaded extension;
+settings files, package installation, and environment flags cannot establish its presence. This is
+a cooperative local extension contract, not authentication or an OS permission boundary. The
+contract is available from Persona 1.17.5, paired with Mind 0.8.4 or later; qualify both together.
+
+Memory ownership is queried through `pi-persona:memory-owner:v1` with
+`{ version: 1, sessionId, respond }`. Its synchronous response is
+`{ version: 1, provider: "pi-persona", sessionId, ready, persona }`, where `persona` is the actual
+live selection or `null` for Persona off. The native manager/id/file must still match, and `ready`
+remains false until Persona's session startup finishes. `pi-persona:memory-owner-changed:v1`
+broadcasts that same descriptor on readiness, selection and shutdown. A companion loaded first
+must not wait inside its startup hook for a later extension's hook; it can activate on the readiness
+broadcast or its next fresh query. Canonical settings retain startup preferences, not live ownership:
+`persist: false` selections still change this descriptor. Unavailable ownership never authorizes a
+fallback to another persona's saved selection.
+
+Each engine freezes the parent's memory persona when it is built. In-process children receive a
+private ResourceLoader factory and their own native manager/EventBus responder; child processes
+receive the versioned `PI_PERSONA_MEMORY_PERSONA` record only in that spawn's environment. Inherited
+values are scrubbed before spawning. Neither route mutates a shared process-wide persona value.
+Delegated legs expose this frozen owner while retaining their lean memory-only role, including an
+explicit `null` owner when the parent had Persona off.
+
+`pi-persona:activity:v1` contributes operator-only local-work rows through a closed record:
+`{ version: 1, producerId: "pi-persona-mind", activityId, sessionId, phase, state, target }`.
+`phase` is `inspect|stage|apply`, `state` is `running|staged|done|failed`, and `target` is
+`project|persona|shared`; `staged` is valid only for `stage`. No memory text, paths, models, token
+counts, or free-form output are accepted. Ingress matches the active native session and checks its
+manager's current id/file. The producer also captures its native owner and scope across awaits.
+The resulting `Mind` row uses `kind: "activity"`: it has no agent count, steer/stop handle, wake,
+stall badge, or `agent.*` telemetry. The F9 drill-in explains the local phase. Up to eight rows are
+retained, with completed/staged rows evicted before live work; teardown and explicit persona
+selection revoke old rows without cancelling workers. A staged row states that a proposal was
+prepared and requires explicit apply; it does not claim that the plan remains valid indefinitely or
+that model review is running.
+Receipts remain in Mind's session-native cards; local activity events are not replayed on restart.
+
+Mind may request one real async maintenance worker through `pi-persona:mind-worker:v1` with
+the closed record `{ version: 1, sessionId, persona, task, respond }` (task at most 48,000 characters).
+Persona checks the current native session and ready memory owner, actual persona, delegation and
+memory permissions, the persona's raw delegate target rules for `mind`, and idle/no-pending-message
+state. A strict target allowlist must include `mind`; explicit memory/delegate/target denies win.
+No installed agent is required. Accepted
+responses are synchronous `{ ok: true, runId, model, thinking, completion, cancel }`; rejection is
+`{ ok: false, reason }`. `completion` resolves with `{ ok, output, error?, resultRef?, model?, thinking? }`.
+Output remains untrusted data for Mind's bounded proposal parser, never executable code.
+
+This is an ordinary tracked `Mind` sub-agent in the tree and F9, sharing the launch pool, usage,
+progress, stop/steer controls and terminal-result archive. Its private definition has an explicit empty
+tool allowlist and no worker spine. Provider/model and thinking are pinned to the accepting session;
+provider fallback is disabled. The worker has a 180-second cancellation ceiling; owner readiness or
+selection changes cancel it. Mind can also cancel through its accepted handle. Settlement returns
+to the requesting companion and retains operator failure reporting, but never wakes a supervisor
+model turn. Native session teardown cancels it through the ordinary stop registry. Local inspect,
+stage and apply operations continue to use activity rows; model work uses the real agent view.
+
 ## The comm plane in practice
 
 - **In-process bus** (`bus/inproc.ts`) — a handle-based mailbox: `send` (one-way), `ask` (blocks for a
@@ -539,10 +617,14 @@ events and cannot route, reply, steer, or otherwise control agents.
   notifier, f9, peek) is unchanged by construction. Off ⇒ the host never starts and the child spawns
   byte-identical to pre-broker pi-persona. Ask failures echo the originating `msgId` so the client
   rejects the right request immediately, and a client cancellation propagates only to that connection's
-  own host ask. `extension/broker-host.ts`'s `SupervisorBroker` owns the lifecycle: it starts the host
-  lazily on the first child-engine build, warns once on a failed bind (children built while it's down
-  spawn without a bus endpoint, so they never burn connect backoff against a dead socket), and the next
-  build retries; `/doctor` surfaces its state on one line. A dropped client connection flips the
+  own host ask. A one-way send gets a UUID-correlated host receipt; `delivered: true` means admitted
+  to the bus, not read or acted on by the peer. Each child is limited to 64 pending receipts with a
+  maximum 10-second wait. Abort, disconnect, a full or missing inbox, or a lost receipt reports
+  `delivered: false`. It never waits for a recipient answer or approval and does not replay.
+  `extension/broker-host.ts`'s `SupervisorBroker` owns the lifecycle: it starts
+  the host lazily on the first child-engine build and warns once on a failed bind. Children built while
+  it's down spawn without a bus endpoint, so they never burn connect backoff against a dead socket;
+  the next build retries; `/doctor` surfaces its state on one line. A dropped client connection flips the
   child-side bridge to `⇄ offline` and fails a fresh ask fast rather than hanging.
   A connected child exposes `contact_supervisor` when `canUseBus` is allowed; `contact_peer` also
   requires the run's peer opt-in. Granted custom tool names join a nonempty plain allowlist so Pi's
@@ -659,7 +741,16 @@ retention is labelled as such. Retrieval is read-only: `intercom results` lists,
 { ref, offset, limit }` pages (8,000 default / 16,000 max units, surrogate-safe), with no respawn,
 rebilling, collection or extra wake; reading a page never returns the whole run hidden in metadata.
 A saved result is not a live worker: the restore notice says runtime handles are gone while retained
-reports remain readable.
+reports remain readable. Archive listeners belong to the extension factory/tracker lifetime and are
+installed exactly once. `session_shutdown` revokes that session's archive owner and clears its
+captures. A later activation creates a fresh owner and capture context before the ordinary completion
+listener observes terminal results for that activation; a late callback bound to the old owner cannot
+append into the new session.
+
+Flow reference handoff needs durable session-entry storage when a phase's result feeds a dependent
+phase. In a no-session run, a source phase can finish with a memory-only receipt, but the dependent's
+reader preflight rejects it before that dependent is spawned. Use a persisted session for reference
+handoff across phases, or use inline handoff when no durable reader is available.
 
 This is a UI invariant only: truncating a collapsed card must never be confused with truncating the
 underlying result or changing a strategy's contract.

package/docs/STRATEGIES.md

@@ -80,6 +80,12 @@ Same-agent members are disambiguated in the live `f9` tree by a role hint (`revi
 `rosterNodeKeys`/`roleHint` (`roster.ts`) + the SDK's per-run key (`sdk.ts`). If you touch either, keep
 the seeding loop and the SDK key derivation in lockstep, and inject any per-run protocol via the TASK
 text, never `role` (or the derived tree key drifts from the seeded one).
+The short hint is never used to recover a participant's model or effort. SDK lifecycle callbacks
+carry a frozen `AgentAttemptIdentity` beside that key, containing only the actual agent, full role,
+explicit model and requested thinking. This preserves distinct inline selections for repeated roles,
+auxiliary actors and custom strategies that invoke members in a different order. Recovery updates the
+same logical key with the new attempt's model; observed terminal metadata remains separate from the
+request. Tasks and result grants are excluded from this display identity.
 
 ## The built-in strategies
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeondave/pi-persona",
-  "version": "1.17.4",
+  "version": "1.17.5",
   "private": false,
   "type": "module",
   "description": "Supervised multi-agent orchestration for Pi — async workers, live steering, cross-session collaboration, and switchable personas.",
@@ -111,7 +111,7 @@
     }
   },
   "pi": {
-    "image": "https://raw.githubusercontent.com/AeonDave/pi-persona/v1.17.4/assets/banner.png",
+    "image": "https://raw.githubusercontent.com/AeonDave/pi-persona/v1.17.5/assets/banner.png",
     "video": "https://cdn.jsdelivr.net/gh/AeonDave/pi-persona@6655d281ce7965a75303dd704bd29db73db04070/assets/demo1.mp4",
     "extensions": [
       "./src/extension.ts"

package/src/bridge.ts

@@ -20,7 +20,8 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 
 import { type BrokerClient, type DeliverEvent, makeBrokerClient, type MakeBrokerClientDeps } from "./bus/broker/client.ts";
 import { makeContactSupervisorTool } from "./bus/contact.ts";
-import { InProcessBus, type MsgKind } from "./bus/inproc.ts";
+import type { MsgKind } from "./bus/inproc.ts";
+import type { ContactTransport } from "./bus/contact-transport.ts";
 import { makeContactPeerTool, type PeerInfo } from "./bus/peers.ts";
 import { attributeInbound } from "./core/fence.ts";
 import { isReaderToken } from "./bus/broker/messages.ts";
@@ -49,30 +50,22 @@ export function isBridgeMode(env: Env = process.env): boolean {
 	return !!env.PI_PERSONA_BUS;
 }
 
-/** Routes `InProcessBus.send`/`ask` over a `BrokerClient` instead of a local mailbox — the
- *  thin adapter the bus-bound `contact_supervisor`/`contact_peer` factories need to run
- *  unmodified against a remote target. A real `InProcessBus` subclass (not a duck-typed
- *  object) so it satisfies the factories' concrete parameter type without touching them.
- *  `connected` gates both overrides so the tools' existing "no supervisor reachable" /
- *  "dropped" wording stays honest before the handshake completes — the client's own
- *  `send`/`ask` can't report that (a write to a not-yet-open socket silently no-ops, per
- *  spec's "sends report undelivered"). */
-class BrokerBus extends InProcessBus {
+/** Contact transport over the broker. A connected socket is not delivery evidence:
+ * send resolves only after the host acknowledges admission to its local bus. */
+class BrokerBus implements ContactTransport {
 	private readonly client: BrokerClient;
 	connected = false;
 
 	constructor(client: BrokerClient) {
-		super();
 		this.client = client;
 	}
 
-	override send(_from: string, to: string, text: string, kind: MsgKind = "progress"): boolean {
+	send(_from: string, to: string, text: string, kind: MsgKind = "progress", signal?: AbortSignal): boolean | Promise<boolean> {
 		if (!this.connected) return false;
-		this.client.send(to, kind, text);
-		return true;
+		return this.client.send(to, kind, text, signal);
 	}
 
-	override ask(
+	ask(
 		_from: string,
 		to: string,
 		text: string,

package/src/bus/broker/client.ts

@@ -2,7 +2,7 @@
  * Broker client — the child-side half of the relay (spec B3/B6): connects to the
  * session-scoped endpoint (`paths.ts`), performs the `register`/`registered` handshake,
  * and exposes the same shape a local `contact_supervisor`/`contact_peer` binding needs —
- * `send` (fire-and-forget), `ask` (a blocking `send{expectsReply}` correlated to a
+ * `send` (one-way with a bounded host-admission receipt), `ask` (a blocking `send{expectsReply}` correlated to a
  * `replied{askId}`, 10-minute cap, mirrors `bus.ask`, and sends `cancel{msgId}` when
  * aborted), `reply` (answers a host-issued
  * blocking `deliver`), `list` (the engine-scoped peer roster, B7), and `onDeliver`/`onSteer`
@@ -14,7 +14,7 @@
  * exponential backoff (250ms–5s) on the INITIAL connect only (comtac's presence tracking,
  * roster cache, and endless reconnect-after-disconnect "storm" are dropped — YAGNI here,
  * see spec B6/Task 4 brief). An unexpected disconnect (host died
- * mid-run) is NOT auto-reconnected: sends silently go nowhere, while in-flight asks/lists
+ * mid-run) is NOT auto-reconnected: sends resolve false, while in-flight asks/lists
  * reject promptly and clean up their timers. Authenticated result readers are stricter:
  * one connect attempt, bounded handshake/reads, closed failure replies, never mute success.
  *
@@ -46,8 +46,9 @@ export interface BrokerClient {
 	register(): Promise<void>;
 	/** Authenticated bounded read. Failures are fixed closed replies; never a mute success. */
 	read(request: ResultReadRequest, signal?: AbortSignal): Promise<ReadReply>;
-	/** Fire-and-forget; a dead connection silently drops it (spec: "sends report undelivered"). */
-	send(to: string, kind: MsgKind, text: string): void;
+	/** One-way message; true only after host bus admission, never a recipient answer.
+	 * Missing receipt, cancellation, saturation or disconnect resolve false without replay. */
+	send(to: string, kind: MsgKind, text: string, signal?: AbortSignal): Promise<boolean>;
 	/** Blocking request; resolves on a matching `replied`, rejects on `signal` abort or the
 	 *  10-minute cap (mirrors `bus.ask`'s default). */
 	ask(to: string, kind: MsgKind, text: string, signal?: AbortSignal): Promise<string>;
@@ -81,6 +82,8 @@ const ASK_TIMEOUT_MS = 600_000;
 // A roster lookup is one local socket/pipe round-trip, unlike a blocking supervisor ask. Do not
 // let a half-open broker pin `contact_peer list/send` until the child idle watchdog fires.
 const LIST_TIMEOUT_MS = 10_000;
+export const SEND_TIMEOUT_MS = 10_000;
+export const MAX_PENDING_SENDS = 64;
 
 export function makeBrokerClient(deps: MakeBrokerClientDeps): BrokerClient {
 	const netImpl = deps.net ?? nodeNet;
@@ -93,6 +96,7 @@ export function makeBrokerClient(deps: MakeBrokerClientDeps): BrokerClient {
 	let cancelConnect: (() => void) | undefined;
 	let cancelBackoff: (() => void) | undefined;
 	const pendingReads = new Map<string, { request: ResultReadRequest; resolve: (result: ReadReply) => void }>();
+	const pendingSends = new Map<string, (delivered: boolean) => void>();
 	let registerSettle: { resolve: () => void; reject: (err: Error) => void } | undefined;
 
 	const deliverListeners = new Set<(evt: DeliverEvent) => void>();
@@ -101,9 +105,7 @@ export function makeBrokerClient(deps: MakeBrokerClientDeps): BrokerClient {
 	const pendingAsks = new Map<string, { resolve: (text: string) => void; reject: (err: Error) => void }>();
 	const pendingLists = new Map<string, { resolve: (peers: Array<{ handle: string; label: string }>) => void; reject: (err: Error) => void }>();
 
-	/** Best-effort write: a frame sent while disconnected is silently dropped — matches
-	 *  the design's "sends report undelivered" (no throw the caller could even act on,
-	 *  `send`/`reply` are `void`). */
+	/** Best-effort control frame write. Confirmed sends use their own guarded write and receipt. */
 	function write(frame: Frame): void {
 		if (!socket) return;
 		try {
@@ -126,6 +128,9 @@ export function makeBrokerClient(deps: MakeBrokerClientDeps): BrokerClient {
 
 	function handleFrame(frame: Frame): void {
 		switch (frame.t) {
+			case "sent":
+				pendingSends.get(frame.msgId)?.(frame.delivered);
+				return;
 			case "registered":
 				if (!registerSettle) return;
 				if (frame.handle !== deps.handle || (deps.readerToken !== undefined && (!frame.readerToken
@@ -146,6 +151,7 @@ export function makeBrokerClient(deps: MakeBrokerClientDeps): BrokerClient {
 				// A correlated error belongs to one request on this connection. Do not let an
 				// unknown/stale correlation id affect the register handshake or another ask.
 				if (frame.msgId !== undefined) {
+					pendingSends.get(frame.msgId)?.(false);
 					pendingAsks.get(frame.msgId)?.reject(new Error(frame.reason));
 					return;
 				}
@@ -254,6 +260,7 @@ export function makeBrokerClient(deps: MakeBrokerClientDeps): BrokerClient {
 	}
 
 	function rejectAllPending(reason: string): void {
+		for (const settle of pendingSends.values()) settle(false);
 		for (const p of pendingReads.values()) p.resolve(readFailure("unavailable"));
 		for (const p of pendingAsks.values()) p.reject(new Error(reason));
 		pendingAsks.clear();
@@ -354,8 +361,24 @@ export function makeBrokerClient(deps: MakeBrokerClientDeps): BrokerClient {
 		});
 	}
 
-	function send(to: string, kind: MsgKind, text: string): void {
-		write({ t: "send", to, kind, text, msgId: randomUUID(), expectsReply: false });
+	function send(to: string, kind: MsgKind, text: string, signal?: AbortSignal): Promise<boolean> {
+		if (signal?.aborted || closed || disconnected || !registered || !socket || pendingSends.size >= MAX_PENDING_SENDS) return Promise.resolve(false);
+		const msgId = randomUUID();
+		return new Promise((resolve) => {
+			const finish = (delivered: boolean): void => {
+				if (!pendingSends.delete(msgId)) return;
+				clearTimeout(timer);
+				signal?.removeEventListener("abort", onAbort);
+				resolve(delivered);
+			};
+			const onAbort = (): void => finish(false);
+			const timer = setTimeout(() => finish(false), SEND_TIMEOUT_MS);
+			timer.unref?.();
+			pendingSends.set(msgId, finish);
+			signal?.addEventListener("abort", onAbort, { once: true });
+			try { socket!.write(encodeFrame({ t: "send", to, kind, text, msgId, expectsReply: false })); }
+			catch { finish(false); }
+		});
 	}
 
 	/** Why `ask`/`list` refuse to send right now — distinguishes a disposed client from one that

package/src/bus/broker/host.ts

@@ -373,7 +373,7 @@ export async function startBrokerHost(deps: StartBrokerHostDeps): Promise<Broker
 				}
 				case "send": {
 					if (!handle) {
-						write({ t: "error", reason: "send before register" });
+						write({ t: "error", reason: "send before register", msgId: frame.msgId });
 						return;
 					}
 					const from = handle;
@@ -395,8 +395,12 @@ export async function startBrokerHost(deps: StartBrokerHostDeps): Promise<Broker
 							forgetAsk(frame.msgId, ac);
 							write({ t: "error", reason: errorReason(error), msgId: frame.msgId });
 						}
-					} else if (!bus.send(from, frame.to, frame.text, frame.kind)) {
-						write({ t: "error", reason: `unknown peer: ${frame.to}` });
+					} else {
+						// Admission is not an answer. Unknown/full inboxes both return false;
+						// never label a full inbox "unknown peer" or a socket write "delivered".
+						let delivered = false;
+						try { delivered = bus.send(from, frame.to, frame.text, frame.kind); } catch { /* no confirmation */ }
+						write({ t: "sent", msgId: frame.msgId, delivered });
 					}
 					return;
 				}

package/src/bus/broker/messages.ts

@@ -1,7 +1,7 @@
 /**
  * Slimmed wire-frame catalog + validators (spec B6) — comtac's protocol trimmed to the
  * frames pi-persona actually needs: register/send/cancel/reply/list/bye (client→host) and
- * registered/deliver/steer/peers/replied/error (host→client). Mirrors comtac's
+ * registered/sent/deliver/steer/peers/replied/error (host→client). Mirrors comtac's
  * `messages.ts` validation STYLE (structural per-field checks, one explicit assert per
  * case) but drops presence/sessions/attachments/broadcasts entirely (YAGNI here).
  *
@@ -28,6 +28,7 @@ export type Frame =
 	| { t: "result_read_reply"; reqId: string; result: ReadReply }
 	| { t: "result_read_cancel"; reqId: string }
 	| { t: "send"; to: string; kind: MsgKind; text: string; msgId: string; expectsReply: boolean }
+	| { t: "sent"; msgId: string; delivered: boolean }
 	| { t: "cancel"; msgId: string }
 	| { t: "deliver"; from: string; fromLabel?: string; kind: MsgKind; text: string; msgId: string; expectsReply: boolean }
 	| { t: "reply"; askId: string; text: string }
@@ -84,6 +85,8 @@ export function isFrame(value: unknown): value is Frame {
 			);
 		case "cancel":
 			return typeof value.msgId === "string";
+		case "sent":
+			return closedRecord(value, ["t", "msgId", "delivered"]) && typeof value.msgId === "string" && typeof value.delivered === "boolean";
 		case "deliver": {
 			if (typeof value.from !== "string") return false;
 			if (value.fromLabel !== undefined && typeof value.fromLabel !== "string") return false;

package/src/bus/contact-transport.ts

@@ -0,0 +1,8 @@
+import type { InProcessBus, MsgKind } from "./inproc.ts";
+
+/** Child contact tools need delivery admission, not a concrete mailbox implementation.
+ * A remote send awaits only the host's bounded receipt, never the recipient's answer. */
+export interface ContactTransport {
+	send(from: string, to: string, text: string, kind?: MsgKind, signal?: AbortSignal): boolean | Promise<boolean>;
+	ask: InProcessBus["ask"];
+}

package/src/bus/contact.ts

@@ -21,7 +21,8 @@ import { Text } from "@earendil-works/pi-tui";
 
 import { compactInlineText } from "../ui/presentation.ts";
 import { renderLiteralToolResult } from "../ui/literal-tool-result.ts";
-import type { InProcessBus, MsgKind } from "./inproc.ts";
+import type { MsgKind } from "./inproc.ts";
+import type { ContactTransport } from "./contact-transport.ts";
 
 const ContactParams = Type.Object({
 	kind: Type.Union([Type.Literal("progress"), Type.Literal("decision"), Type.Literal("interview")], {
@@ -94,7 +95,7 @@ function result(t: string, details: ContactDetails): { content: [{ type: "text";
  *  the supervisor is busy (a sync run holds the turn), so the question is posted one-way and
  *  returns unresolved. This prevents a sync delegate/council from deadlocking on a child ask. */
 export function makeContactSupervisorTool(
-	bus: InProcessBus,
+	bus: ContactTransport,
 	fromHandle: string,
 	supervisorHandle: string,
 	opts: { allowBlocking?: boolean } = {},
@@ -125,13 +126,14 @@ export function makeContactSupervisorTool(
 			const message = boundContactMessage(params.message);
 			if (kind === "progress") {
 				try {
-					const delivered = bus.send(fromHandle, supervisorHandle, message, "progress");
+					const delivered = await bus.send(fromHandle, supervisorHandle, message, "progress", signal);
+					if (signal?.aborted) return result("The progress update was cancelled; delivery could not be confirmed.", { kind, delivered: false, outcome: "cancelled" });
 					return result(
-						delivered ? "Progress reported to the supervisor." : "(no supervisor listening or progress delivery could not be confirmed; progress dropped)",
+						delivered ? "Progress reported to the supervisor." : "Progress delivery could not be confirmed. The supervisor may already have received the update.",
 						{ kind, delivered, outcome: delivered ? "reported" : "unavailable" },
 					);
 				} catch {
-					return result("(progress could not be sent; delivery could not be confirmed)", { kind, delivered: false, outcome: "failed" });
+					return result("Progress delivery could not be confirmed. The supervisor may already have received the update.", { kind, delivered: false, outcome: "failed" });
 				}
 			}
 
@@ -140,13 +142,14 @@ export function makeContactSupervisorTool(
 			if (!allowBlocking) {
 				let delivered: boolean;
 				try {
-					delivered = bus.send(fromHandle, supervisorHandle, message, kind);
+					delivered = await bus.send(fromHandle, supervisorHandle, message, kind, signal);
 				} catch {
 					return result(
-						`The question could not be sent; no answer is possible in this path. ${unresolvedGuidance(kind)}`,
+						`Delivery of the question could not be confirmed. The supervisor may already have received it; no answer is possible in this path. ${unresolvedGuidance(kind)}`,
 						{ kind, delivered: false, outcome: "failed" },
 					);
 				}
+				if (signal?.aborted) return result(`The request was cancelled. ${unresolvedGuidance(kind)}`, { kind, delivered: false, outcome: "cancelled" });
 				const delivery = delivered ? "question sent one-way" : "question delivery could not be confirmed";
 				return result(
 					`The supervisor is busy right now; ${delivery}, and no answer is possible in this path. ${unresolvedGuidance(kind)}`,