@code-yeongyu/senpi 2026.11.6-2 → 2026.11.6-3

package/dist/modes/rpc/host-handover-resident-writer.js

@@ -0,0 +1,57 @@
+/**
+ * The process that holds a retained session resident (senpi#6190). A host records each retained session it has
+ * open, stamped with this writer, so the next host on the endpoint can restore it after a crash; while that
+ * writer is still alive (a generation handoff's draining predecessor) the session is not its successor's to
+ * reopen - the predecessor parks it, and the unstamped park is what the successor consumes. Liveness follows the
+ * session writer claims: same host, same boot, live pid whose start time matches.
+ */
+import { BOOT_INSTANT_TOLERANCE_MS, sameBoot } from "../../core/extensions/builtin/terminal/process-identity.js";
+import { realWriterProbes } from "../../core/session-writer-claims.js";
+export function currentResidentWriter(probes = realWriterProbes) {
+    const self = probes.self();
+    return {
+        host: probes.host(),
+        pid: self.pid,
+        bootAtMs: probes.bootAtMs(),
+        processStartedAtMs: self.processStartedAtMs,
+    };
+}
+export function isResidentWriter(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const record = value;
+    return (typeof record.host === "string" &&
+        Number.isInteger(record.pid) &&
+        typeof record.bootAtMs === "number" &&
+        typeof record.processStartedAtMs === "number");
+}
+/**
+ * A liveness probe for one reopen watch, which polls: a writer found gone stays gone, and a live pid's start time
+ * (a process spawn on some platforms) is read once. A writer on another host cannot be probed from here, so it is
+ * never displaced.
+ */
+export function residentWriterProbe(probes = realWriterProbes) {
+    const gone = new Set();
+    const verified = new Set();
+    return async (writer) => {
+        const key = `${writer.host}:${writer.pid}:${writer.processStartedAtMs}`;
+        if (gone.has(key))
+            return false;
+        if (writer.host !== probes.host())
+            return true;
+        if (!sameBoot(probes.bootAtMs(), writer.bootAtMs) || !probes.pidAlive(writer.pid)) {
+            gone.add(key);
+            return false;
+        }
+        if (verified.has(key))
+            return true;
+        const startedAtMs = await probes.readProcessStartMs(writer.pid);
+        if (startedAtMs !== undefined && Math.abs(startedAtMs - writer.processStartedAtMs) > BOOT_INSTANT_TOLERANCE_MS) {
+            gone.add(key);
+            return false;
+        }
+        verified.add(key);
+        return true;
+    };
+}
+//# sourceMappingURL=host-handover-resident-writer.js.map

package/dist/modes/rpc/host-warm.d.ts

@@ -30,6 +30,11 @@ export declare class HostWarmer {
     private readonly load;
     constructor(load: (profile: HostWarmProfile) => Promise<void>);
     run(profile: HostWarmProfile): Promise<HostWarmState>;
+    /**
+     * Settles once every load of `cwd` in flight NOW has settled; `undefined` when none is. A snapshot: a warm
+     * that starts later, or one of another cwd, is not part of it.
+     */
+    inFlight(cwd: string): Promise<void> | undefined;
     private loadOnce;
 }
 /**
@@ -40,7 +45,17 @@ export declare class HostWarmer {
 export declare function createRegistryWarm(prepare: NonNullable<PreparableRuntimeFactory["prepare"]>, host: {
     agentDir: string;
     mcpRegistry?: HostMcpRegistry;
-}): HostWarm;
+}): {
+    readonly warm: HostWarm;
+    readonly inFlight: (cwd: string) => Promise<void> | undefined;
+};
+/** How an open's wait for the warms of its cwd ended. */
+export type WarmWaitOutcome = "settled" | "warm_wait_deadline";
+/**
+ * Waits for `warming` at most `boundMs`. A warm whose extension factory never settles (there is no factory
+ * timeout) must not stall an open, so past the bound the open proceeds and the reason is reported.
+ */
+export declare function waitForWarms(warming: Promise<void>, boundMs: number, cwd: string): Promise<WarmWaitOutcome>;
 type WarmCommand = Extract<RpcCommand, {
     type: "warm";
 }>;

package/dist/modes/rpc/host-warm.js

@@ -34,14 +34,24 @@ export class HostWarmer {
         const key = profileKey(profile);
         if (this.warm.has(key))
             return "already_warm";
-        let pending = this.loading.get(key);
-        if (pending === undefined) {
-            pending = this.loadOnce(key, profile);
-            this.loading.set(key, pending);
+        let load = this.loading.get(key);
+        if (load === undefined) {
+            load = { cwd: profile.cwd, pending: this.loadOnce(key, profile) };
+            this.loading.set(key, load);
         }
-        await pending;
+        await load.pending;
         return "warmed";
     }
+    /**
+     * Settles once every load of `cwd` in flight NOW has settled; `undefined` when none is. A snapshot: a warm
+     * that starts later, or one of another cwd, is not part of it.
+     */
+    inFlight(cwd) {
+        const pending = [...this.loading.values()].filter((load) => load.cwd === cwd).map((load) => load.pending);
+        if (pending.length === 0)
+            return undefined;
+        return Promise.allSettled(pending).then(() => undefined);
+    }
     async loadOnce(key, profile) {
         try {
             await this.load(profile);
@@ -85,7 +95,24 @@ export function createRegistryWarm(prepare, host) {
             scope.close();
         }
     });
-    return (profile) => warmer.run(profile);
+    return { warm: (profile) => warmer.run(profile), inFlight: (cwd) => warmer.inFlight(cwd) };
+}
+/**
+ * Waits for `warming` at most `boundMs`. A warm whose extension factory never settles (there is no factory
+ * timeout) must not stall an open, so past the bound the open proceeds and the reason is reported.
+ */
+export async function waitForWarms(warming, boundMs, cwd) {
+    let deadline;
+    const outcome = await Promise.race([
+        warming.then(() => "settled"),
+        new Promise((resolve) => {
+            deadline = setTimeout(() => resolve("warm_wait_deadline"), boundMs);
+        }),
+    ]);
+    clearTimeout(deadline);
+    if (outcome === "warm_wait_deadline")
+        process.stderr.write(`senpi rpc open: warm_wait_deadline: a warm of ${cwd} still loading after ${boundMs} ms; opening anyway\n`);
+    return outcome;
 }
 function refusal(command, code) {
     return { id: command.id, type: "response", command: "warm", success: false, error: code };

package/dist/modes/rpc/method-classes-schema-session.d.ts

@@ -478,6 +478,15 @@ export declare const SESSION_RECORD_SCHEMAS: {
     } & {
         readonly enabled: Type.TBoolean;
     }>;
+    set_permission_preset: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"set_permission_preset">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    } & {
+        readonly permissionPreset: Type.TString;
+    }>;
     set_auto_retry: Type.TObject<{
         id: Type.TOptional<Type.TString>;
         admissionId: Type.TOptional<Type.TString>;

package/dist/modes/rpc/method-classes-schema-session.js

@@ -131,6 +131,7 @@ const STATE_AND_MODEL_SCHEMAS = {
     set_follow_up_mode: session("set_follow_up_mode", { mode: literals("all", "one-at-a-time") }),
     compact: session("compact", { customInstructions: OptStr }),
     set_auto_compaction: session("set_auto_compaction", { enabled: Bool }),
+    set_permission_preset: session("set_permission_preset", { permissionPreset: Id }),
     set_auto_retry: session("set_auto_retry", { enabled: Bool }),
     abort_retry: session("abort_retry", {}),
     set_retry_fallback: session("set_retry_fallback", { retryFallback: RetryFallback }),

package/dist/modes/rpc/method-classes-schema.d.ts

@@ -852,6 +852,15 @@ export declare const RPC_INBOUND_SCHEMAS: {
     } & {
         readonly enabled: import("typebox").TBoolean;
     }>;
+    readonly set_permission_preset: import("typebox").TObject<{
+        id: import("typebox").TOptional<import("typebox").TString>;
+        admissionId: import("typebox").TOptional<import("typebox").TString>;
+        type: import("typebox").TLiteral<"set_permission_preset">;
+    } & {
+        readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
+    } & {
+        readonly permissionPreset: import("typebox").TString;
+    }>;
     readonly set_auto_retry: import("typebox").TObject<{
         id: import("typebox").TOptional<import("typebox").TString>;
         admissionId: import("typebox").TOptional<import("typebox").TString>;

package/dist/modes/rpc/method-classes.d.ts

@@ -140,6 +140,7 @@ export declare const RPC_METHOD_CLASS: {
         readonly version: 1;
     };
     readonly set_auto_compaction: "drive";
+    readonly set_permission_preset: "device_admin";
     readonly set_retry_fallback: "drive";
     readonly pause_for_run: "drive";
     readonly resume_for_run: "drive";

package/dist/modes/rpc/method-classes.js

@@ -187,6 +187,8 @@ export const RPC_METHOD_CLASS = {
     set_model: { classify: setModelClass, version: 1 },
     // a session override; set_steering_mode, set_follow_up_mode and set_auto_retry write global settings (device_admin)
     set_auto_compaction: "drive",
+    // like a preset-naming open_session: it changes what the agent may do without asking
+    set_permission_preset: "device_admin",
     set_retry_fallback: "drive",
     pause_for_run: "drive",
     resume_for_run: "drive",

package/dist/modes/rpc/multi-session-host.js

@@ -13,6 +13,7 @@ import { answerDelegation, relayExecRefusal } from "./delegated-answer.js";
 import { parseClientCapabilities } from "./custom-capability.js";
 import { ClientOccupancy } from "./host-client-occupancy.js";
 import { HostCoreGate } from "./host-core-gate.js";
+import { bindRegisteredEndpoint } from "./host-bare-endpoint-registration.js";
 import { createHostDaemonPaths } from "./host-daemon-paths.js";
 import { ENDPOINT_OWNER_FENCE_CAPABILITY, GENERATION_HANDOFF_CAPABILITY } from "./host-decision.js";
 import { HandoffAnnouncement } from "./host-handoff-announcement.js";
@@ -549,7 +550,11 @@ async function runSocketHost(options, socketPath) {
     });
     // Everything the internal listener needs is initialized: the runtime milestone of a coordinated start (senpi#4602).
     reportStartupMilestone("host_runtime");
-    boundIdentity = await listen(server, socketPath, secret);
+    const bind = () => listen(server, socketPath, secret);
+    // A host binding its own public socket keeps its registry record; a supervised one's ensure keeps it.
+    boundIdentity = await (hostWatchdogBinding() === undefined
+        ? bindRegisteredEndpoint({ agentDir: options.agentDir, socket: socketPath, log: hostLog }, bind)
+        : bind());
     // A key record that cannot be published safely ends this host: held connections are refused, never served keyless.
     await transport.publish(() => shutdown(1));
     if (supervisorPublicOwnerFile) {

package/dist/modes/rpc/permission-preset-command.d.ts

@@ -0,0 +1,6 @@
+import type { AgentSessionRuntime } from "../../core/agent-session-runtime.ts";
+import { type RpcCommand, type RpcResponse } from "./rpc-types.ts";
+export declare function runSetPermissionPreset(runtime: Pick<AgentSessionRuntime, "session" | "setPermissionPreset">, command: Extract<RpcCommand, {
+    type: "set_permission_preset";
+}>): RpcResponse;
+//# sourceMappingURL=permission-preset-command.d.ts.map

package/dist/modes/rpc/permission-preset-command.js

@@ -0,0 +1,27 @@
+import { parsePermissionPresetName } from "../../core/extensions/builtin/permission-system/cli.js";
+import { permissionModeOf, permissionModeReply } from "../../core/permission-mode.js";
+import { RPC_ERROR_INVALID_LAUNCH_PROFILE } from "./rpc-types.js";
+// The live setter a classic `--mode rpc` session has no other way to receive (it refuses `open_session`), and the
+// path-free one for a session on another device. An unknown preset is refused before anything changes, so the
+// session keeps the mode it had; a valid one is applied through the runtime the way an attach naming it applies it.
+export function runSetPermissionPreset(runtime, command) {
+    if (parsePermissionPresetName(command.permissionPreset) === undefined) {
+        return {
+            id: command.id,
+            type: "response",
+            command: "set_permission_preset",
+            success: false,
+            error: `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: unknown permissionPreset "${command.permissionPreset}"`,
+            errorCode: RPC_ERROR_INVALID_LAUNCH_PROFILE,
+        };
+    }
+    runtime.setPermissionPreset(command.permissionPreset);
+    return {
+        id: command.id,
+        type: "response",
+        command: "set_permission_preset",
+        success: true,
+        data: permissionModeReply(permissionModeOf(runtime.session)),
+    };
+}
+//# sourceMappingURL=permission-preset-command.js.map

package/dist/modes/rpc/rpc-mutation-response-types.d.ts

@@ -6,6 +6,7 @@ import type { ClientMessageIdentity } from "../../core/client-message-identity.t
 import type { CompactionResult } from "../../core/compaction/index.ts";
 import type { ServiceTier } from "../../core/extensions/builtin/service-tier.ts";
 import type { SessionControlAdmission } from "../../core/extensions/types.ts";
+import type { PermissionModeReply } from "../../core/permission-mode.ts";
 import type { ApiKeyVerification } from "../../core/verify-api-key.ts";
 import type { ClientMessageAdmission } from "./client-admission-record.ts";
 import type { RpcProjectSettings, RpcProjectTrust } from "./project-workspace-commands.ts";
@@ -234,6 +235,12 @@ export type RpcMutationResponse = {
     type: "response";
     command: "set_auto_compaction";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_permission_preset";
+    success: true;
+    data: PermissionModeReply;
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/rpc-session-command-types.d.ts

@@ -293,6 +293,10 @@ export type RpcSessionCommand = {
     id?: string;
     type: "set_auto_compaction";
     enabled: boolean;
+} | {
+    id?: string;
+    type: "set_permission_preset";
+    permissionPreset: string;
 } | {
     id?: string;
     type: "set_auto_retry";

package/dist/modes/rpc/rpc-session-event-types.d.ts

@@ -109,8 +109,11 @@ export type RpcSessionParkedEvent = {
     sessionId: string;
     /** Session file to reopen this session by. */
     sessionPath: string;
-    /** `idle`: the idle sweep parked it; `unloaded`: `unload_session` did. Absent from older hosts. */
-    reason?: "idle" | "unloaded";
+    /**
+     * `idle`: the idle sweep parked it; `unloaded`: `unload_session` did; `host_shutdown`: the host stopped with the session
+     * retained, and the next host on the endpoint reopens it. Absent from older hosts.
+     */
+    reason?: "idle" | "unloaded" | "host_shutdown";
 };
 /**
  * Sent only to the connections a headless engine's quiet takeover let go (senpi#5732): this connection no longer holds

package/dist/modes/rpc/rpc-session-state-types.d.ts

@@ -3,6 +3,7 @@ import type { Model, ProviderDiagnostic, ThinkingSelection } from "@earendil-wor
 import type { AgentAbortSource } from "../../core/agent-abort-provenance.ts";
 import type { QueuedInput } from "../../core/agent-session.ts";
 import type { HoldKind } from "../../core/engine-turn-hold.ts";
+import type { PermissionMode } from "../../core/permission-mode.ts";
 import type { ProviderOrigin } from "../../core/provider-origin.ts";
 import type { ServiceTier } from "../../core/extensions/builtin/service-tier.ts";
 import type { ContextUsage } from "../../core/extensions/types.ts";
@@ -105,7 +106,7 @@ export interface RpcSessionModelEntry {
     thinkingSelection?: ThinkingSelection;
     serviceTier?: ServiceTier;
 }
-export interface RpcSessionState {
+export interface RpcSessionState extends Partial<PermissionMode> {
     /** The running turn's id; absent when no turn is running. A steer or follow-up names it as `expectedTurnId` (senpi#5776). */
     currentTurnId?: string;
     /** Latest 64 UI-answer receipts in this session generation, oldest first. */

package/dist/modes/rpc/rpc-session-state.js

@@ -4,6 +4,7 @@
  */
 import { existsSync } from "node:fs";
 import { sanitizeProviderDiagnostic } from "@earendil-works/pi-ai";
+import { permissionModeOf } from "../../core/permission-mode.js";
 import { ProjectTrustStore } from "../../core/trust-manager.js";
 import { clientFacingIdentity } from "./client-admission-record.js";
 import { sessionQuestionBridges } from "./connection-question-bridge.js";
@@ -38,6 +39,7 @@ export function buildRpcSessionState(session, lastAbortSource) {
         lifecycle: observeLifecycle(session.lifecycle),
         pendingQuestions: sessionQuestionBridges.get(session)?.pendingQuestions(),
         pendingDialogs: sessionDialogRequests.get(session)?.snapshot() ?? [],
+        ...permissionModeOf(session),
         model: session.model,
         pendingModelSwitch: session.pendingModelSwitch
             ? {

package/dist/modes/rpc/session-attachment-commands.js

@@ -1,6 +1,6 @@
 import { takeOver } from "./attach-takeover.js";
 import { compactOpen } from "./compact-open-admission.js";
-import { clearHandoverParkedSession } from "./host-handover-parked.js";
+import { clearRetainedRecord } from "./session-router-residency.js";
 import { hostInstanceId } from "./protocol-identity.js";
 import { canonicalSessionPath } from "./session-path-key.js";
 import { recordAttachment, releaseDisconnectAttachment, releaseOwnerAttachment } from "./session-router-attachments.js";
@@ -116,8 +116,8 @@ export async function reclaimSession(host, command) {
     if (host.sessionsByConnection.get(owner)?.size === 0)
         host.sessionsByConnection.delete(owner);
     connectionLeft(host, row.sessionId, owner);
-    if (host.handoverParkedDir !== undefined && entry.sessionPath !== undefined)
-        await clearHandoverParkedSession(host.handoverParkedDir, entry.sessionPath).catch(() => { });
+    if (host.handoverParkedDir !== undefined)
+        await clearRetainedRecord(host, entry);
     if (claim.finalizer) {
         const binding = host.bindings.get(row.sessionId);
         binding?.cancelPendingExtensionUiRequests?.();

package/dist/modes/rpc/session-event-writer-connections.js

@@ -23,6 +23,7 @@ export class SessionEventWriterConnections extends SessionEventWriterLanes {
             record.type === "host_request" ||
             record.type === "relocation_due" ||
             (record.type === "extension_ui_request" &&
+                record.audience !== "session" &&
                 ["select", "confirm", "input", "editor"].includes(String(record.method))));
     }
     isSessionSealed(sessionId) {

package/dist/modes/rpc/session-event-writer.d.ts

@@ -51,7 +51,7 @@ export declare class SessionEventWriter extends SessionEventWriterDestinations {
      * session's reaches every connection. No client asked for this teardown, so there is
      * no close response to answer.
      */
-    parkSession(sessionId: string, sessionPath: string, reason: "idle" | "unloaded"): void;
+    parkSession(sessionId: string, sessionPath: string, reason: "idle" | "unloaded" | "host_shutdown"): void;
     /**
      * Seal a session `release_session` handed to a runtime outside this host and publish
      * `session_closed { reason: "released", sessionPath }`. Unlike a park the file must NOT be reopened

package/dist/modes/rpc/session-registry-attach.d.ts

@@ -1,12 +1,3 @@
-/**
- * Attach-on-open: a live session outlives individual client attachments, so a resume (or a second
- * surface) for an already-hosted path joins the existing runtime instead of failing. An entry
- * still opening holds the reservation, and an explicit open for that path waits on the entry's
- * openCompletion (bounded on the waiter only, default 45s) and attaches once it opens; on that
- * wait expiring, only the one waiting reopen fails with a retryable session_path_in_use
- * {reason: "open_in_progress", retry_after_ms} naming an attached current owner, and the in-flight
- * open keeps running untouched.
- */
 import type { SessionPathReservations } from "./host-reservations.ts";
 import { type OpenRpcSession, type RpcSessionEntry, type RpcSessionLaunchProfile, type RpcSessionOpenOptions } from "./session-registry-types.ts";
 export declare function attachToOpenSession(entries: ReadonlyMap<string, RpcSessionEntry>, sessionPath: string, profile: RpcSessionLaunchProfile, options: RpcSessionOpenOptions | undefined, pathReservations: SessionPathReservations | undefined, now: number): Promise<OpenRpcSession>;

package/dist/modes/rpc/session-registry-attach.js

@@ -1,3 +1,13 @@
+/**
+ * Attach-on-open: a live session outlives individual client attachments, so a resume (or a second
+ * surface) for an already-hosted path joins the existing runtime instead of failing. An entry
+ * still opening holds the reservation, and an explicit open for that path waits on the entry's
+ * openCompletion (bounded on the waiter only, default 45s) and attaches once it opens; on that
+ * wait expiring, only the one waiting reopen fails with a retryable session_path_in_use
+ * {reason: "open_in_progress", retry_after_ms} naming an attached current owner, and the in-flight
+ * open keeps running untouched.
+ */
+import { clientNamedPreset, withClientPreset } from "../../core/permission-mode.js";
 import { hostInstanceId } from "./protocol-identity.js";
 import { frozenProfile, RpcSessionRegistryError, } from "./session-registry-types.js";
 /** How long ONE explicit reopen waits on an in-flight open before giving up (the open keeps going). */
@@ -104,9 +114,12 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
     }
     // The preset is applied even when the record already names it: the record is not the live session,
     // so a resent attach also repairs a session that drifted from it (senpi#2842).
-    if (profile.permissionPreset !== undefined) {
-        entry.profile = frozenProfile({ ...entry.profile, permissionPreset: profile.permissionPreset });
-        entry.runtime?.setPermissionPreset(profile.permissionPreset);
+    // Only a preset the client named moves the session: an embedder's host default folded into a preset-less attach is
+    // not a choice, and applying it would turn the host default into a client-named mode (remote approval-mode rule).
+    const namedPreset = clientNamedPreset(profile);
+    if (namedPreset !== undefined) {
+        entry.profile = frozenProfile(withClientPreset(entry.profile, namedPreset));
+        entry.runtime?.setPermissionPreset(namedPreset);
     }
     entry.lastCommandAt = now;
     if (wasParked) {

package/dist/modes/rpc/session-registry-types.d.ts

@@ -57,6 +57,8 @@ export interface RpcSessionEntry {
      * Requested per `open_session`; an attach may turn it on, never off.
      */
     retainOnDisconnect?: boolean;
+    /** The session path this host's handover-parked record entry is keyed by; it follows a transcript switch. */
+    recordedPath?: string;
     /** Timestamp of the last routed command / observed activity; drives idle eviction. */
     lastCommandAt: number;
     /**

package/dist/modes/rpc/session-registry.d.ts

@@ -14,6 +14,7 @@ export declare class RpcSessionRegistry {
     readonly closeGraceMs: number;
     /** Present only when the runtime factory can build a session's services alone (`host-warm.ts`). */
     readonly warm?: HostWarm;
+    private readonly warmsInFlight?;
     /** The agent directory this host keeps its sessions (and session-move folders) under. */
     get agentDir(): string;
     constructor(options: RpcSessionRegistryOptions);
@@ -22,6 +23,7 @@ export declare class RpcSessionRegistry {
     /** Daemon-family identities come from the endpoint's claims and generation registry. */
     holderPids(observedStarts?: ReadonlyMap<number, number | undefined>): Promise<readonly number[]>;
     openSession(requested: RpcSessionLaunchProfile, options?: RpcSessionOpenOptions): Promise<OpenRpcSession>;
+    private openNow;
     /**
      * Read-only lookup with no state transitions or attachment accounting.
      * Exists so lifecycle decisions (e.g. deferring a dropped connection's

package/dist/modes/rpc/session-registry.js

@@ -1,6 +1,6 @@
 import { isAbsolute } from "node:path";
 import { assertValidSessionId } from "../../core/session-manager.js";
-import { createRegistryWarm } from "./host-warm.js";
+import { createRegistryWarm, waitForWarms } from "./host-warm.js";
 import { refreshesSessionActivity } from "./session-command-activity.js";
 import { publishedSessionContext } from "./session-context-patch.js";
 import { attachLiveSession, markPathAttached } from "./session-live-attachment.js";
@@ -20,11 +20,14 @@ export class RpcSessionRegistry {
         this.reservations = new Set();
         this.pendingClaims = new Map();
         this.nextHandle = 0;
-        if (options.createRuntime.prepare)
-            this.warm = createRegistryWarm(options.createRuntime.prepare, {
+        if (options.createRuntime.prepare) {
+            const warming = createRegistryWarm(options.createRuntime.prepare, {
                 agentDir: options.agentDir,
                 ...(options.mcpRegistry !== undefined ? { mcpRegistry: options.mcpRegistry } : {}),
             });
+            this.warm = warming.warm;
+            this.warmsInFlight = warming.inFlight;
+        }
         this.options =
             options.mcpRegistry === undefined
                 ? options
@@ -70,6 +73,16 @@ export class RpcSessionRegistry {
         return this.options.pathReservations?.holderPids?.(observedStarts) ?? Promise.resolve([]);
     }
     openSession(requested, options) {
+        // A warm in flight (the boot load of senpi#6147 included) loads on this loop and yields it between modules
+        // (senpi#6199): an open builds its runtime after the warms of ITS cwd that are loading when it arrives, so
+        // its factories never run beside that load. Other cwds and later warms are not waited on, and the wait is
+        // bounded by `closeGraceMs` like the closing-reservation wait.
+        const warming = this.warmsInFlight?.(requested.cwd);
+        if (warming === undefined)
+            return this.openNow(requested, options);
+        return waitForWarms(warming, this.closeGraceMs, requested.cwd).then(() => this.openNow(requested, options));
+    }
+    openNow(requested, options) {
         return openRegistrySession({
             entries: this.entries,
             reservations: this.reservations,

package/dist/modes/rpc/session-router-close.js

@@ -1,8 +1,30 @@
-import { clearHandoverParkedSession } from "./host-handover-parked.js";
 import { RPC_ERROR_UNKNOWN_SESSION } from "./rpc-types.js";
 import { forgetSessionOwnership, releaseOwnerAttachment } from "./session-router-attachments.js";
 import { code, error } from "./session-router-errors.js";
 import { stopSweep } from "./session-router-occupancy.js";
+import { clearRetainedRecord, recordRetainedSession } from "./session-router-residency.js";
+/** How long a stop lets a cut turn settle before its teardown proceeds anyway: the default close grace. */
+const HOST_SHUTDOWN_ABORT_BOUND_MS = 10_000;
+/** Ends the running turn as a host shutdown (senpi#6190), bounded so a run its abort cannot release never holds the stop. */
+async function abortForHostShutdownWithin(sessionId, entry) {
+    // Async wrapper: a session that throws synchronously still only fails its own abort, never the whole stop.
+    const aborting = (async () => {
+        await entry?.runtime?.session.abortForHostShutdown();
+    })().catch((cause) => {
+        process.stderr.write(`senpi rpc host shutdown abort ${sessionId} failed: ${String(cause)}\n`);
+    });
+    let timer;
+    const bound = new Promise((resolve) => {
+        timer = setTimeout(resolve, HOST_SHUTDOWN_ABORT_BOUND_MS);
+        timer.unref?.();
+    });
+    try {
+        await Promise.race([aborting, bound]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * Releases one attachment (or every attachment when draining) and reports
  * whether this caller became the finalizer. The join token is installed inside
@@ -66,10 +88,10 @@ export async function close(host, command) {
             releaseOwnerAttachment(host, owner, command.sessionId);
         if (claim.finalizer) {
             // An explicit close ends the session for good: drop any handover-parked record entry, or
-            // the session would come back on the next host start (MEDIUM-1, senpi#3282 review).
-            const entry = host.registry.peek(command.sessionId);
-            if (host.handoverParkedDir !== undefined && entry?.sessionPath !== undefined)
-                await clearHandoverParkedSession(host.handoverParkedDir, entry.sessionPath).catch(() => { });
+            // the session would come back on the next host start (MEDIUM-1, senpi#3282 review). Awaited only when a record
+            // exists, so a host without one starts the teardown in the same tick as the claim.
+            if (host.handoverParkedDir !== undefined)
+                await clearRetainedRecord(host, host.registry.peek(command.sessionId));
             await finalizeClose(host, command.sessionId, host.bindings.get(command.sessionId), () => reply.complete(true, "client_close"));
         }
         else {
@@ -189,11 +211,26 @@ export async function dispose(host) {
     if (host.admissions)
         await host.admissions.dispose();
     await Promise.all([...host.bindings.entries()].map(async ([sessionId, binding]) => {
+        const entry = host.registry.peek(sessionId);
+        // A retained session outlives this process: it parks under the transcript it is on now (its record stays
+        // for the next host on the endpoint, which reopens it) instead of closing, so attached clients do not read
+        // it as ended.
+        const parkedPath = host.handoverParkedDir !== undefined && entry?.retainOnDisconnect === true
+            ? (entry.runtime?.session.sessionFile ?? entry.sessionPath)
+            : undefined;
+        // Claimed before any await, like close(): the stop fences the session in the tick it starts.
         const claim = tryClaimClose(host, sessionId, { drainAttachments: true });
         if (!claim)
             return;
         if (claim.finalizer) {
-            await finalizeClose(host, sessionId, binding, () => host.writer.closeSession(sessionId, { type: "response", command: "close_session", success: true, data: {} }, "host_shutdown"));
+            await abortForHostShutdownWithin(sessionId, entry);
+            if (entry !== undefined && parkedPath !== undefined)
+                await recordRetainedSession(host, entry, parkedPath, false).catch((cause) => {
+                    process.stderr.write(`senpi rpc host shutdown park record ${sessionId} failed: ${String(cause)}\n`);
+                });
+            await finalizeClose(host, sessionId, binding, () => parkedPath !== undefined
+                ? host.writer.parkSession(sessionId, parkedPath, "host_shutdown")
+                : host.writer.closeSession(sessionId, { type: "response", command: "close_session", success: true, data: {} }, "host_shutdown"));
         }
         else
             await host.finalizations.get(sessionId)?.promise;

package/dist/modes/rpc/session-router-context.js

@@ -10,6 +10,7 @@ import { SessionAttachOrder } from "./session-attach-order.js";
 import { tearDownReleased } from "./session-router-close.js";
 import { routingIdOf } from "./session-router-errors.js";
 import { sweepIdleSessions } from "./session-router-occupancy.js";
+import { followRetainedRecord } from "./session-router-residency.js";
 import { registryStatusSource } from "./session-status-source.js";
 export class RouterContext {
     constructor(registry, writer, defaults, createBinding = createRpcSessionBinding, connectionOptions = {}, idle) {
@@ -74,6 +75,7 @@ export class RouterContext {
                 : { effectId: latest.effectId, kind: latest.kind, state: latest.state };
         });
         writer.afterRecord = (sessionId) => {
+            followRetainedRecord(this, sessionId);
             const session = this.registry.peek(sessionId)?.runtime?.session;
             if (session === undefined)
                 return;

package/dist/modes/rpc/session-router-occupancy.js

@@ -1,10 +1,8 @@
-import { recordHandoverParkedSession } from "./host-handover-parked.js";
-import { parkedEntryFromProfile } from "./host-handover-parked-open.js";
-import { hostInstanceId } from "./protocol-identity.js";
 import { readDrainVerdicts } from "./session-drain.js";
 import { holdUnattendedTurns } from "./session-drain-hold.js";
 import { forgetSessionOwnership } from "./session-router-attachments.js";
 import { finalizeClose, tryClaimClose } from "./session-router-close.js";
+import { recordRetainedSession } from "./session-router-residency.js";
 import { selectSweepEvictions } from "./session-sweep.js";
 const DRAIN_SWEEP_MS = 50;
 /**
@@ -128,14 +126,7 @@ export async function evictIdleSession(host, sessionId, reason) {
         parkedPath !== undefined &&
         retained?.retainOnDisconnect === true &&
         retained.sessionPath !== undefined) {
-        await recordHandoverParkedSession(host.handoverParkedDir, {
-            ...parkedEntryFromProfile({
-                sessionPath: retained.sessionPath,
-                contextOverlay: retained.contextOverlay,
-                ...(retained.durableSessionId !== undefined ? { durableSessionId: retained.durableSessionId } : {}),
-            }, retained.profile, Object.keys(host.defaults.hostContext ?? {})),
-            parkedBy: host.defaults.hostContext?.host_instance ?? hostInstanceId(),
-        }).catch((cause) => {
+        await recordRetainedSession(host, retained, retained.sessionPath, false).catch((cause) => {
             process.stderr.write(`senpi rpc handover park record ${sessionId} failed: ${String(cause)}\n`);
         });
     }

package/dist/modes/rpc/session-router-open-profile.js

@@ -70,6 +70,10 @@ export function validatedOpenProfile(host, command, options) {
                 : { host_socket: host.defaults.hostContext.host_socket }),
         },
         permissionPreset: command.permissionPreset ?? defaults?.permissionPreset,
+        // An embedder's host-level preset is the host default, never a client's choice (remote approval-mode rule).
+        ...(command.permissionPreset === undefined && defaults?.permissionPreset !== undefined
+            ? { permissionPresetSource: "host_default" }
+            : {}),
         creationModel: command.provider && command.modelId
             ? { provider: command.provider, modelId: command.modelId }
             : defaults?.creationModel,