@agfpd/iapeer 0.4.121 → 0.4.123

package/docs/15-fleet-api.md

@@ -81,6 +81,7 @@ Field notes:
 - `runtimes[].agent` — **agent-endpoint discovery**: `true` iff this declared runtime is an agent runtime the running core can host (listed in `host.agent_runtimes`). A channel that offers a personality's agent endpoints (a Telegram menu, a web picker) offers exactly its `agent: true` runtimes — never a consumer-side runtime list, never a `which`/PATH probe. A declared runtime the core cannot host (a newer peer profile on an older core) is `false` and is not offered. A channel runtime (`telegram`, `web`, …) is always `false`. Additive: a pre-discovery daemon omits it — clients MUST then fall back to treating no runtime as discoverable rather than guessing. Which endpoint a send reaches is a separate rule: an omitted runtime is always `default_runtime` (config-anchored, never «the live one»); a control action for the same dialogue must name the same runtime its send used.
 - `runtimes[].private_dir` — the core-owned private directory of this endpoint (docs/20: the OpenCode journal, state and provider fragments), present only for a runtime that has one (today `opencode`). An observer that the core does not launch (a console, a collector) reads the path HERE or from `iapeer private-dir <peer> [--runtime r]` — it never derives the layout from the root. Additive.
 - `runtimes[].model` — the `provider/model` the endpoint ACTUALLY used for its last assistant turn, as the runtime itself reports it (today `opencode`, from its state; docs/20 §Provider pinning). Absent until a first turn. Lets an operator see an implicit default provider. Additive.
+- `runtimes[].warnings` — the endpoint's current-session launch self-check findings (today `opencode`: a missing or failed plugin, an MCP server not connected; docs/20 §Launch self-check). Absent when clean. Additive.
 - `host.agent_runtimes` — the agent runtimes this core build can host, in preference order. It grows when an agent adapter ships (e.g. `opencode`, docs/20).
 - `runtimes[].attached` — present (`true`) only when a **human operator** is attached to that live hosted session.
 - `runtimes[].activity` — **turn activity**: is this runtime *in a turn* right now. See «Activity» below. Additive; absent on a pre-activity daemon, on every non-`live` runtime, and whenever the daemon has no evidence — clients MUST treat absence as **no claim**, never as `idle`.

package/docs/20-opencode.md

@@ -123,6 +123,23 @@ Open core contracts this ABI depends on:
   provision/unprovision per peer and runtime, like the memory slot. Until it
   exists, a manual install is not reported as final.
 
+## Launch self-check (OC04)
+
+OpenCode tolerates some broken surfaces silently: a fragment plugin whose file
+is missing or that throws on load, and an MCP server that does not connect
+(e.g. an unreachable memory MCP), all still give a «working» session with the
+surface absent. Before it reports readiness, the core plugin checks:
+- every MCP server's native status (`connected`/`disabled` are fine);
+- every `file://` plugin in the effective config exists;
+- the native log (`<XDG_DATA_HOME>/opencode/log/opencode.log`, lines of THIS
+  process found through a `iapeer-selfcheck <launchID>` marker line) for
+  `failed to load plugin`.
+Findings are never a refusal (the session is usable) and never silent:
+`runtime.ready.properties.warnings` (additive), `state.json` `warnings`,
+`ev=launch-warning` in lifecycle.log per warning, and the fleet field
+`runtimes[].warnings` (docs/15). Native run of 2026-10-18: unreachable MCP,
+missing plugin and throwing plugin each reported.
+
 ## Provider pinning
 
 Without an explicit `model`, native OpenCode uses its own hosted default
@@ -175,6 +192,15 @@ process was SIGKILLed before any answer, and the fresh next session never saw it
   (lifecycle.log) and `ev=inflight-redelivered|inflight-undelivered`
   (delivery.log).
 - A false «not processed» costs a visible duplicate, never a silent loss.
+- Interrupted turns. «Processed» (a model response began) is not «finished»: a
+  turn killed mid-tool may already have had side effects, so it is never
+  redelivered. The ledger keeps an entry until its turn finishes (claude: an
+  assistant record with a terminal `stop_reason`; codex: `task_complete`;
+  opencode: a completed assistant message for it with a finish other than
+  `tool-calls`); a finished later message covers earlier ones. If the session
+  dies with the turn unfinished, the sender gets an explicit notice from iapeer
+  («the turn was INTERRUPTED and its result is not guaranteed»), logged as
+  `ev=inflight-interrupted`.
 - Unknown is not failed. When a live receiver's acceptance record does not appear
   within the confirm window (a busy claude records a queued message late), the
   send returns `ok` with `unconfirmed: true` instead of «NOT delivered» — the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.121",
+  "version": "0.4.123",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/fleet.ts

@@ -94,6 +94,9 @@ export interface FleetRuntimeStatus {
   /** The model the runtime ACTUALLY used last (`provider/model`, from the endpoint's own state; docs/20
    *  §Provider pinning). Absent until a first assistant turn, or for runtimes that do not report it. */
   model?: string
+  /** Launch self-check warnings of the endpoint's current session (docs/20 OC04): a missing or failed
+   *  plugin, an MCP server not connected. Absent when clean. */
+  warnings?: string[]
   /** Present (true) iff a HUMAN operator is attached to this live hosted session. */
   attached?: boolean
   /** Whether this runtime is IN A TURN right now — a SEPARATE concept from `status`, which
@@ -245,11 +248,17 @@ export function buildFleetSnapshot(
    *  never emitted, which is exactly its "no claim" semantics. */
   activityOf?: (personality: string, runtime: string) => TurnActivity | undefined,
 ): FleetSnapshot {
-  const privateDirOf = (runtime: string, personality: string): { private_dir?: string; model?: string } => {
+  const privateDirOf = (runtime: string, personality: string): { private_dir?: string; model?: string; warnings?: string[] } => {
     const d = endpointPrivateDir(runtime, personality, { env })
     if (!d) return {}
-    const model = (readOpencodeState(join(d, 'state.json')) as { model?: unknown } | null)?.model
-    return { private_dir: d, ...(typeof model === 'string' && model ? { model } : {}) }
+    const st = readOpencodeState(join(d, 'state.json'))
+    const model = st?.model
+    const warnings = Array.isArray(st?.warnings) ? st!.warnings!.filter(w => typeof w === 'string') : []
+    return {
+      private_dir: d,
+      ...(typeof model === 'string' && model ? { model } : {}),
+      ...(warnings.length ? { warnings } : {}),
+    }
   }
   const peers: FleetPeer[] = ops.listPeers({ env }).map(r => {
     const runtimes: FleetRuntimeStatus[] = r.runtimes.map(s => {
@@ -608,7 +617,7 @@ export function buildFleetHandler(opts: FleetHandlerOptions = {}): FleetHandler
   // observations in; the snapshot below reads it. Reading is O(1): no file touched per request.
   const activity = opts.activity ?? new ActivityBoard()
   const activityOf = (personality: string, runtime: string): TurnActivity | undefined =>
-    activity.get(personality, runtime, Date.now())
+    structuralActivity(personality, runtime, env) ?? activity.get(personality, runtime, Date.now())
   let opsPromise: Promise<FleetOps> | undefined
   const getOps = (): Promise<FleetOps> => {
     if (opts.ops) return Promise.resolve(opts.ops)
@@ -891,6 +900,20 @@ async function runCommand(
   }
 }
 
+/**
+ * Activity of a STRUCTURAL runtime straight from its own state (docs/20: state.json `status` is the
+ * busy/idle source, not a transcript watch). busy/approval → working, idle → idle; anything else (or
+ * no private dir) → undefined, so the transcript turn-watch decides for claude/codex as before.
+ */
+export function structuralActivity(personality: string, runtime: string, env: NodeJS.ProcessEnv): TurnActivity | undefined {
+  const dir = endpointPrivateDir(runtime, personality, { env })
+  if (!dir) return undefined
+  const status = readOpencodeState(join(dir, 'state.json'))?.status
+  if (status === 'busy' || status === 'approval') return 'working'
+  if (status === 'idle') return 'idle'
+  return undefined
+}
+
 /** Serve the SSE event stream: optional replay of the newest N historical events,
  *  then live tail. At-least-once semantics (a reconnect may re-see events — `id`
  *  is the event's epoch-ms for client-side dedup); heartbeat comment every 15 s. */

package/src/daemon/main.ts

@@ -56,6 +56,7 @@ import type { ResolvedCaller } from '../identity/index.ts'
 import { findPeer, readPeersIndex } from '../registry/index.ts'
 import {
   createComposerDeliveryQueue,
+  deliveryCompleted,
   deliveryLanded,
   deliveryProcessed,
   routeSend,
@@ -78,7 +79,7 @@ import { startGoalWatch } from './goalwatch.ts'
 import { ActivityBoard, startTurnWatch } from './turnwatch.ts'
 import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index.ts'
 import { randomBytes } from 'crypto'
-import { listInflightIdentities, listOrphanIdentities, recordInflight, sweepInflight, takeOrphans, type InflightEntry } from '../lifecycle/inflight.ts'
+import { listInflightIdentities, listInterruptedIdentities, listOrphanIdentities, recordInflight, sweepInflight, takeInterrupted, takeOrphans, type InflightEntry } from '../lifecycle/inflight.ts'
 import { hostSessionAlive, hostSessionToken } from '../launch/ptyHost.ts'
 
 /** Default TCP loopback port for the always-on router. Real http MCP clients
@@ -272,6 +273,16 @@ export function redeliveryMessage(e: InflightEntry): string {
   return `${REDELIVERY_PREFIX} ${why}; originally sent ${e.sentAt}]\n${e.message}`
 }
 
+/** Body of the interrupted-turn notice (OC07 extension): processed, but the turn died mid-work. */
+export function interruptedNotice(e: InflightEntry): string {
+  return (
+    `iapeer: your message to "${e.personality}" (${e.runtime}), sent ${e.sentAt}${e.topic ? ` topic=${e.topic}` : ''}, ` +
+    `was being worked on when the receiving session died — the turn was INTERRUPTED and its result is not guaranteed ` +
+    `(it is NOT redelivered: side effects may already have happened). Check its state and resend if needed. ` +
+    `First line: ${e.message.split('\n')[0]!.slice(0, 200)}`
+  )
+}
+
 /** Body of the explicit non-delivery notice to the original sender. */
 export function undeliveredNotice(e: InflightEntry, reason: string): string {
   return (
@@ -292,18 +303,40 @@ export async function processInflight(
   cfg: LifecycleConfig,
   env: NodeJS.ProcessEnv,
   routeDeps: RouteDeps,
-  seam: { send?: typeof routeSend; processed?: (e: InflightEntry) => boolean; landed?: (e: InflightEntry) => boolean } = {},
+  seam: { send?: typeof routeSend; processed?: (e: InflightEntry) => boolean; landed?: (e: InflightEntry) => boolean; completed?: (e: InflightEntry) => boolean } = {},
 ): Promise<void> {
   const processed = seam.processed ?? ((e: InflightEntry) => deliveryProcessed(e, env))
   const send = seam.send ?? routeSend
+  /** A notice FROM iapeer to the entry's original sender (skipped when the sender is iapeer itself). */
+  const notifySender = async (e: InflightEntry, message: string): Promise<string> => {
+    try {
+      const index = readPeersIndex({ env })
+      const self = findPeer(index, 'iapeer')
+      if (!self || `${e.caller.runtime}-${e.caller.personality}` === `${self.runtime}-iapeer`) return 'skipped'
+      const sender = resolveCallerIdentity({ personality: 'iapeer', runtime: self.runtime }, index)
+      const n = await send(sender, { personality: e.caller.personality, runtime: e.caller.runtime, message, topic: e.topic ?? 'delivery-failed' }, routeDeps)
+      return String(n.ok)
+    } catch {
+      return 'false'
+    }
+  }
   for (const identity of listInflightIdentities(cfg.stateDir)) {
     const n = sweepInflight(cfg.stateDir, identity, {
       sessionToken: id => (hostSessionAlive(id, env) ? hostSessionToken(id, env) : null),
       processed,
+      completed: seam.completed ?? ((e: InflightEntry) => deliveryCompleted(e, env)),
       landed: seam.landed ?? ((e: InflightEntry) => deliveryLanded(e, env)),
     })
     if (n > 0) appendLifecycleEvent(cfg.eventLogDir, { ev: 'inflight-orphaned', identity, count: n }, { env })
   }
+  // A turn the session STARTED on a message but did not finish before dying: never redelivered (its side
+  // effects may already have happened) — the sender is told explicitly that the result is not guaranteed.
+  for (const identity of listInterruptedIdentities(cfg.stateDir)) {
+    for (const e of takeInterrupted(cfg.stateDir, identity)) {
+      const notified = await notifySender(e, interruptedNotice(e))
+      appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-interrupted', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'false', notified })
+    }
+  }
   for (const identity of listOrphanIdentities(cfg.stateDir)) {
     for (const e of takeOrphans(cfg.stateDir, identity)) {
       const index = readPeersIndex({ env })
@@ -327,18 +360,7 @@ export async function processInflight(
         reason = x instanceof Error ? x.message : String(x)
       }
       // Redelivery failed → the sender must learn it explicitly.
-      let notified = 'false'
-      try {
-        const self = findPeer(index, 'iapeer')
-        const callerAddr = `${e.caller.runtime}-${e.caller.personality}`
-        if (self && callerAddr !== `${self.runtime}-iapeer`) {
-          const sender = resolveCallerIdentity({ personality: 'iapeer', runtime: self.runtime }, index)
-          const n = await send(sender, { personality: e.caller.personality, runtime: e.caller.runtime, message: undeliveredNotice(e, reason), topic: e.topic ?? 'delivery-failed' }, routeDeps)
-          notified = String(n.ok)
-        }
-      } catch {
-        notified = 'false'
-      }
+      const notified = await notifySender(e, undeliveredNotice(e, reason))
       appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-undelivered', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'false', err: reason.slice(0, 300), notified })
     }
   }

package/src/launch/adapters/opencode.ts

@@ -125,7 +125,9 @@ export const opencodeAdapter: RuntimeAdapter = {
             const ping = await opencodeControl(controlSocket(spec.personality, env), { op: 'ping' }, 5000)
             if (!ping.ok) return { ok: false, reason: `runtime.ready seen but control ping failed: ${ping.error}` }
             if (ping.launchID !== launchID) return { ok: false, reason: `control socket answers launch ${ping.launchID}, expected ${launchID}` }
-            return { ok: true }
+            const w = (l.properties as { warnings?: unknown } | null)?.warnings
+            const warnings = Array.isArray(w) ? w.filter((x): x is string => typeof x === 'string') : []
+            return warnings.length ? { ok: true, warnings } : { ok: true }
           }
           if (l.type === 'runtime.error') {
             const e = (l.properties as { error?: unknown } | null)?.error

package/src/launch/index.ts

@@ -241,6 +241,7 @@ export const launch: LaunchFn = async (
       if (adapter.structuralReady && readyToken) {
         const r = await adapter.structuralReady(spec, readyToken, Date.now() + cfg.bootDeadlineSecs * 1000, () => hostSessionAlive(identity, env), env)
         if (!r.ok) return fail(identity, `never-became-ready (structural: ${r.reason ?? 'unknown'})`)
+        for (const w of r.warnings ?? []) appendLifecycleEvent(cfg.exitLogDir, { ev: 'launch-warning', identity, warning: w }, { env })
         if (firstMessage.trim().length === 0) return ready(identity)
         if (!adapter.deliver) return fail(identity, 'structural runtime has no deliver hook')
         const d = await adapter.deliver({ personality: spec.personality, identity }, firstMessage, env)

package/src/launch/types.ts

@@ -428,7 +428,7 @@ export interface RuntimeAdapter {
 
   /** Structural readiness replacing the pane-glyph gate: resolves when the runtime itself reported
    *  readiness for `readyToken` (fail on deadline / reported error / `alive()` false). */
-  structuralReady?(spec: LaunchSpec, readyToken: string, deadlineMs: number, alive: () => boolean, env: NodeJS.ProcessEnv): Promise<{ ok: boolean; reason?: string }>
+  structuralReady?(spec: LaunchSpec, readyToken: string, deadlineMs: number, alive: () => boolean, env: NodeJS.ProcessEnv): Promise<{ ok: boolean; reason?: string; warnings?: string[] }>
 
   /** Structural delivery (deliveryConfirm 'structural'): resolves ok only when THIS message is accepted
    *  and persisted by the runtime. */

package/src/lifecycle/index.ts

@@ -648,12 +648,17 @@ export function resolveWakeMode(
   argsResume: boolean | undefined,
   resolveResume: (cwd: string) => { ok: boolean; ref?: string; reason?: string },
   incomingTopic?: string,
+  /** OC14-1 — marker CONSUMPTION is deferred to the caller: a failed bring-up must not change the
+   *  next resume/fresh decision (a crash-looping binary used to eat .idle-reaped, and after the fix the
+   *  peer came back FRESH, its context lost). Absent → consume immediately (legacy/test callers). */
+  defer?: (consume: () => void) => void,
 ): WakeMode {
+  const done = defer ?? ((f: () => void) => f())
   // 1. folder-launch → always fresh. Consume a standing .new-eager too — the mark's
   // promise ("next bring-up is FRESH") is fulfilled by this launch; leaving it would
   // leak an eager relaunch into a LATER, unrelated death.
   if (argsResume === false) {
-    clearNewEager(cfg, identity)
+    done(() => clearNewEager(cfg, identity))
     return { resume: false, cause: 'folder-launch' }
   }
   // 1.5 — a standing .new-eager OUTRANKS EVERYTHING below, including attach-resume
@@ -664,8 +669,8 @@ export function resolveWakeMode(
   // finds it must honor it. Consume-on-fire + clear .idle-reaped (mirror .fresh-next
   // hygiene: a stale clean-park marker must not make a later crash read as resume).
   if (hasNewEager(cfg, identity)) {
-    clearNewEager(cfg, identity)
-    clearIdleReaped(cfg, identity)
+    done(() => clearNewEager(cfg, identity))
+    done(() => clearIdleReaped(cfg, identity))
     return { resume: false, cause: 'self-fresh-eager' }
   }
   // 2. attach → resume, fail-loud if nothing to resume.
@@ -682,8 +687,8 @@ export function resolveWakeMode(
   // .fresh-next AND .idle-reaped (mirror the ephemeral hygiene below — else a stale .idle-reaped would make
   // a later CRASH read as a clean park in 3b → RESUME a killed context, exactly the 3a hazard).
   if (hasFreshNext(cfg, identity)) {
-    clearFreshNext(cfg, identity)
-    clearIdleReaped(cfg, identity)
+    done(() => clearFreshNext(cfg, identity))
+    done(() => clearIdleReaped(cfg, identity))
     return { resume: false, cause: 'soft-reload' }
   }
   // 3. default (a message woke a dead/asleep peer): decide by the death cause.
@@ -692,7 +697,7 @@ export function resolveWakeMode(
   // Consume a stray .idle-reaped marker so it does not accumulate (it has no effect for
   // an ephemeral peer, which never resumes, but keep state tidy).
   if (isEphemeralPeer(cwd)) {
-    clearIdleReaped(cfg, identity)
+    done(() => clearIdleReaped(cfg, identity))
     return { resume: false, cause: 'ephemeral-policy' }
   }
   // 3a. NOT parked-clean → FRESH either way, but tell the two cases apart in the
@@ -705,7 +710,7 @@ export function resolveWakeMode(
       : { resume: false, cause: 'first-wake' }
   }
   // 3b. idle-reaped → resume-eligible. Consume the marker now (it has done its job).
-  clearIdleReaped(cfg, identity)
+  done(() => clearIdleReaped(cfg, identity))
   // human-conversational dialogue never auto-freshes; only an explicit /new resets it.
   if (isHumanConversational(cwd)) {
     const r = resolveResume(cwd)
@@ -1107,7 +1112,27 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
     // by the death cause (.idle-reaped marker) + peer-type/topic. An EXPLICIT resume
     // that finds nothing to resume fails loud. incomingTopic (args.topic) is the
     // executor discriminator.
-    const mode = resolveWakeMode(cfg, identity, cwd, args.resume, c => adapter.resolveResume(c, { personality: args.personality, env }), args.topic)
+    // OC14-1 — marker consumption is applied only once the session is actually up (see below): a
+    // failed bring-up leaves .idle-reaped / .fresh-next / .new-eager intact for the next attempt.
+    const consumeOnUp: Array<() => void> = []
+    const mode = resolveWakeMode(
+      cfg,
+      identity,
+      cwd,
+      args.resume,
+      c => adapter.resolveResume(c, { personality: args.personality, env }),
+      args.topic,
+      f => consumeOnUp.push(f),
+    )
+    const applyConsumed = (): void => {
+      for (const f of consumeOnUp.splice(0)) {
+        try {
+          f()
+        } catch {
+          /* best-effort marker hygiene — never fails a wake */
+        }
+      }
+    }
     // The bring-up decision is the durable trace — log it BEFORE launch (the decision
     // stands regardless of whether the subsequent launch succeeds). resolveWakeMode has
     // already consumed any .idle-reaped marker, so `cause` is now its only record.
@@ -1193,6 +1218,7 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
       // must still hear FAILED; we only make the live remnant supervised. Best-effort: a write
       // hiccup must not mask the original FAILED reason.
       if (sessionAlive(sock, identity, env)) {
+        applyConsumed() // a live remnant IS this bring-up's session — its markers are spent
         try {
           writeSessionState(cfg, { identity, runtime, personality: args.personality, cwd, wokeAt: Date.now() })
         } catch { /* keep the original FAILED reason — enroll is best-effort */ }
@@ -1207,6 +1233,7 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
       }
       return { status: 'FAILED', woke: false, runtime, reason: result.reason }
     }
+    applyConsumed()
     // The session is up and the message delivered. Recording supervise-state must not
     // turn a successful wake into a failure (audit #18): log loudly rather than throw
     // past a live spawn. NB since 0.2.55 (self-TTL removed) the session-state file IS

package/src/lifecycle/inflight.ts

@@ -42,6 +42,7 @@ export const UNLANDED_AFTER_MS = 120_000
 
 const inflightPath = (stateDir: string, identity: string) => join(stateDir, `${identity}.inflight.jsonl`)
 const orphansPath = (stateDir: string, identity: string) => join(stateDir, `${identity}.orphans.jsonl`)
+const interruptedPath = (stateDir: string, identity: string) => join(stateDir, `${identity}.interrupted.jsonl`)
 
 function readJsonl(path: string): InflightEntry[] {
   if (!existsSync(path)) return []
@@ -90,6 +91,8 @@ export interface InflightSweepDeps {
   sessionToken: (identity: string) => string | null
   /** Did the receiving session answer this entry? */
   processed: (entry: InflightEntry) => boolean
+  /** Did the turn this entry started FINISH? Absent → processed counts as finished (legacy). */
+  completed?: (entry: InflightEntry) => boolean
   /** Did the entry land in the session at all? Only consulted for `unconfirmed` entries. */
   landed?: (entry: InflightEntry) => boolean
   now?: number
@@ -106,14 +109,35 @@ export function sweepInflight(stateDir: string, identity: string, deps: Inflight
   const current = deps.sessionToken(identity)
   const keep: InflightEntry[] = []
   const orphaned: InflightEntry[] = []
-  for (const e of entries) {
-    let done = false
+  const interrupted: InflightEntry[] = []
+  const safe = (f: ((e: InflightEntry) => boolean) | undefined, e: InflightEntry, dflt: boolean): boolean => {
+    if (!f) return dflt
     try {
-      done = deps.processed(e)
+      return f(e)
     } catch {
-      done = false
+      return false
+    }
+  }
+  // A session works its input in order: a FINISHED turn for a later message means every earlier one
+  // was handled too (bounds the ledger when a turn-end record is missed).
+  let finishedUpTo = -Infinity
+  const finished = new Set<string>()
+  for (const e of entries) {
+    if (safe(deps.completed, e, false) || (!deps.completed && safe(deps.processed, e, false))) {
+      finished.add(e.id)
+      finishedUpTo = Math.max(finishedUpTo, e.ts)
+    }
+  }
+  for (const e of entries) {
+    if (finished.has(e.id) || e.ts < finishedUpTo) continue
+    const done = safe(deps.processed, e, false)
+    if (done) {
+      // Answered but its turn did not finish: live → still working; gone → INTERRUPTED (side effects
+      // may have happened — never redelivered, the sender is told).
+      if (current !== null && current === e.sessionToken) keep.push(e)
+      else interrupted.push(e)
+      continue
     }
-    if (done) continue
     if (current !== null && current === e.sessionToken) {
       // Unknown landing (confirm window ran out): once seen in the session it is a normal pending entry;
       // still unseen after UNLANDED_AFTER_MS → the paste was swallowed → orphan (redeliver once).
@@ -134,7 +158,8 @@ export function sweepInflight(stateDir: string, identity: string, deps: Inflight
   }
   writeJsonl(inflightPath(stateDir, identity), keep)
   if (orphaned.length) for (const o of orphaned) appendFileSync(orphansPath(stateDir, identity), JSON.stringify(o) + '\n', { mode: 0o600 })
-  return orphaned.length
+  if (interrupted.length) for (const o of interrupted) appendFileSync(interruptedPath(stateDir, identity), JSON.stringify(o) + '\n', { mode: 0o600 })
+  return orphaned.length + interrupted.length
 }
 
 export function listOrphanIdentities(stateDir: string): string[] {
@@ -155,8 +180,27 @@ export function takeOrphans(stateDir: string, identity: string): InflightEntry[]
   return entries
 }
 
+export function listInterruptedIdentities(stateDir: string): string[] {
+  let names: string[]
+  try {
+    names = readdirSync(stateDir)
+  } catch {
+    return []
+  }
+  return names.filter(n => n.endsWith('.interrupted.jsonl')).map(n => n.slice(0, -'.interrupted.jsonl'.length))
+}
+
+/** Take (and remove) an identity's interrupted entries — the caller notifies each sender. */
+export function takeInterrupted(stateDir: string, identity: string): InflightEntry[] {
+  const path = interruptedPath(stateDir, identity)
+  const entries = readJsonl(path)
+  rmSync(path, { force: true })
+  return entries
+}
+
 /** Remove an identity's ledger + orphans (peer removal). */
 export function purgeInflight(stateDir: string, identity: string): void {
   rmSync(inflightPath(stateDir, identity), { force: true })
   rmSync(orphansPath(stateDir, identity), { force: true })
+  rmSync(interruptedPath(stateDir, identity), { force: true })
 }

package/src/opencode/iapeer-plugin.mjs

@@ -8,9 +8,11 @@
 //     message delivery (acknowledged only once THIS message is persisted natively),
 //     interrupt and TUI session selection.
 // Plain ESM, no dependencies: it runs inside OpenCode's own server worker.
-import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import { createServer } from 'node:net'
+import { homedir } from 'node:os'
 import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 const SCHEMA = 1
 const DELIVER_ACK_MS = 15000
@@ -296,6 +298,66 @@ async function server(input) {
     control.listen(paths.socket, () => resolve())
   })
 
+  // ── launch self-check (OC04): problems OpenCode itself tolerates silently ─────
+  // A missing / throwing plugin from a fragment and an unreachable MCP server still give a «working»
+  // session with surfaces silently absent. They are reported in runtime.ready.properties.warnings and
+  // state.warnings — never a refusal (the session is usable), never silent.
+  function tailText(path, bytes) {
+    try {
+      const size = statSync(path).size
+      const fd = openSync(path, 'r')
+      try {
+        const start = Math.max(0, size - bytes)
+        const buf = Buffer.alloc(size - start)
+        readSync(fd, buf, 0, buf.length, start)
+        return buf.toString('utf8')
+      } finally {
+        closeSync(fd)
+      }
+    } catch {
+      return ''
+    }
+  }
+  async function selfCheck() {
+    const warnings = []
+    try {
+      const st = await client.mcp.status()
+      for (const [name, s] of Object.entries((st && st.data) || {})) {
+        if (s && s.status !== 'connected' && s.status !== 'disabled') warnings.push('mcp ' + name + ': ' + s.status + (s.error ? ' — ' + String(s.error).slice(0, 200) : ''))
+      }
+    } catch (e) {
+      warnings.push('mcp status unavailable: ' + (e instanceof Error ? e.message : String(e)))
+    }
+    try {
+      const cfg = await client.config.get()
+      for (const spec of ((cfg && cfg.data && cfg.data.plugin) || [])) {
+        if (typeof spec === 'string' && spec.startsWith('file://') && !existsSync(fileURLToPath(spec))) warnings.push('plugin missing: ' + spec)
+      }
+    } catch {}
+    // Plugin load failures are only in the native log (one shared file, lines tagged run=<id>): find
+    // THIS process's run id through a marker line, then its «failed to load plugin» lines.
+    try {
+      const marker = 'iapeer-selfcheck ' + launchID
+      await client.app.log({ body: { service: 'iapeer', level: 'warn', message: marker } })
+      const logFile = join(env.XDG_DATA_HOME || join(env.HOME || homedir(), '.local', 'share'), 'opencode', 'log', 'opencode.log')
+      let text = ''
+      for (let i = 0; i < 10 && !text.includes(marker); i++) {
+        await new Promise(r => setTimeout(r, 100))
+        text = tailText(logFile, 4 * 1024 * 1024)
+      }
+      const mine = text.split('\n').find(l => l.includes(marker))
+      const run = mine && (mine.match(/ run=([^ ]+)/) || [])[1]
+      if (run) {
+        for (const l of text.split('\n')) {
+          if (l.includes(' run=' + run + ' ') && /failed to load plugin|Failed to load plugin|plugin config hook failed/.test(l)) {
+            warnings.push('plugin failed: ' + l.replace(/^.*?message=/, '').slice(0, 300))
+          }
+        }
+      }
+    } catch {}
+    return warnings
+  }
+
   // Readiness runs AFTER init returns: calling the in-process client while OpenCode is
   // still loading this plugin would wait on the very instance state being built.
   // The socket is up and the session is known (fresh: created now) → runtime.ready —
@@ -310,8 +372,11 @@ async function server(input) {
         const hist = await client.session.messages({ path: { id: sessionID } }).catch(() => null)
         for (const m of (hist && hist.data) || []) noteModel(m && m.info)
       }
+      const warnings = await selfCheck()
+      if (warnings.length) state.warnings = warnings
+      else delete state.warnings
       if (state.status === 'starting') state.status = 'idle'
-      journal('runtime.ready', { session: got.data, resumed }, null, sessionID)
+      journal('runtime.ready', { session: got.data, resumed, ...(warnings.length ? { warnings } : {}) }, null, sessionID)
     } catch (e) {
       state.status = 'error'
       state.error = e instanceof Error ? e.message : String(e)

package/src/opencode/journal.ts

@@ -19,6 +19,8 @@ export interface OpencodeState {
   error?: string
   /** Actual `provider/model` of the last assistant turn (plugin-reported). */
   model?: string
+  /** Launch self-check findings (missing/failed plugin, MCP not connected) — docs/20 OC04. */
+  warnings?: string[]
 }
 
 export interface OpencodeJournalLine {

package/src/transport/index.ts

@@ -903,6 +903,76 @@ export function deliveryProcessed(probe: ProcessedProbe, env: NodeJS.ProcessEnv
   return false
 }
 
+/**
+ * Did the receiving session FINISH the turn this delivery started (OC07 extension)? Processed (a model
+ * response began) is not finished: a SIGKILL mid-tool leaves a processed-but-unfinished turn whose side
+ * effects may have happened — it must not be redelivered, and its sender must be told. Proof of a
+ * finished turn after the envelope's record:
+ *   claude — an assistant record with a terminal stop_reason (end_turn / stop_sequence / max_tokens);
+ *   codex  — an `event_msg` `task_complete`;
+ *   opencode — an assistant message for that user message with `time.completed` and a finish other
+ *              than `tool-calls`.
+ */
+export function deliveryCompleted(probe: ProcessedProbe, env: NodeJS.ProcessEnv = process.env): boolean {
+  const needles = confirmNeedles(probe.rendered)
+  if (!needles.length || needles.every(n => !n)) return false
+  if (getAdapter(probe.runtime).deliveryConfirm === 'structural') {
+    const dir = endpointPrivateDir(probe.runtime, probe.personality, { env })
+    if (!dir) return false
+    const path = join(dir, 'events.jsonl')
+    let size = 0
+    try {
+      size = statSync(path).size
+    } catch {
+      return false
+    }
+    const userIDs = new Set<string>()
+    for (const line of readFileTailFrom(path, Math.max(0, size - PROCESSED_TAIL_BYTES)).split('\n')) {
+      if (!line.trim()) continue
+      let e: { type?: string; properties?: { part?: { type?: string; text?: string; messageID?: string }; info?: { role?: string; parentID?: string; finish?: string; time?: { completed?: number } } } }
+      try {
+        e = JSON.parse(line)
+      } catch {
+        continue
+      }
+      const part = e.properties?.part
+      if (e.type === 'message.part.updated' && part?.type === 'text' && typeof part.text === 'string' && part.messageID) {
+        const text = part.text.replace(/\r/g, '')
+        if (needles.every(n => text.includes(n))) userIDs.add(part.messageID)
+      }
+      const info = e.properties?.info
+      if (e.type === 'message.updated' && info?.role === 'assistant' && info.parentID && userIDs.has(info.parentID) && info.time?.completed && info.finish !== 'tool-calls') return true
+    }
+    return false
+  }
+  for (const path of compactCandidateFiles(probe.runtime, probe.cwd, env)) {
+    let st
+    try {
+      st = statSync(path)
+    } catch {
+      continue
+    }
+    if (st.mtimeMs < probe.ts - 5000) continue
+    let carried = false
+    for (const line of readFileTailFrom(path, Math.max(0, st.size - PROCESSED_TAIL_BYTES)).split(/\r?\n/)) {
+      if (!line.trim()) continue
+      let o: { type?: string; message?: { stop_reason?: string }; payload?: { type?: string } }
+      try {
+        o = JSON.parse(line)
+      } catch {
+        continue
+      }
+      if (!carried) {
+        if (o.type !== 'queue-operation' && jsonStringValuesContainAll(o, needles)) carried = true
+        continue
+      }
+      if (o.type === 'assistant' && ['end_turn', 'stop_sequence', 'max_tokens'].includes(o.message?.stop_reason ?? '')) return true
+      if (o.type === 'event_msg' && o.payload?.type === 'task_complete') return true
+    }
+  }
+  return false
+}
+
 /**
  * Did the envelope LAND in the receiving session at all (any record carrying it, including claude's
  * queue-operation for a busy session)? Weaker than deliveryProcessed — it separates «queued / being