@intentic/sandbox-contract 1.344.0 → 1.346.0

package/src/events/requests.ts

@@ -371,8 +371,10 @@ export const CredentialReceiptSchema = z.object({
 });
 export type CredentialReceipt = z.infer<typeof CredentialReceiptSchema>;
 
-// The three requests a turn journal can restore verbatim after a daemon restart. `browser_help`/`terminal_help` are
-// excluded: their Chromium/waiting command dies with the container, so those can only be reported, not restored.
+// The requests a turn journal can restore verbatim after a daemon restart, raised by the turn itself or by a gate it
+// called. `browser_help`/`terminal_help` are excluded: their Chromium/waiting command dies with the container, so those
+// can only be reported, not restored. A gate's offer comes back as a card whose answer is told to a turn of its own,
+// since the call that raised it died with the daemon: a yes is the agent's to act on by asking again.
 export const PlanRequestSchema = z.object({
     kind: z.literal("plan").describe("The agent has written a plan and is waiting for a yes."),
     ...planRequest,
@@ -385,5 +387,41 @@ export const PermissionRequestSchema = PermissionAskSchema.extend({
     kind: z.literal("permission").describe("The agent wants to use a tool it needs permission for."),
     ...permissionRequest,
 });
-export const ParkedRequestSchema = z.discriminatedUnion("kind", [PlanRequestSchema, QuestionRequestSchema, PermissionRequestSchema]);
+export const PageAskRequestSchema = z.object({
+    kind: z.literal("page_ask").describe("The agent has shown a page to be answered on and is waiting."),
+    ...pageAskRequest,
+});
+export const CapabilityOfferRequestSchema = z.object({
+    kind: z.literal("capability_offer").describe("The agent asks for something to be connected."),
+    ...capabilityOfferRequest,
+});
+export const PaymentOfferRequestSchema = z.object({
+    kind: z.literal("payment_offer").describe("The agent asks to pay for something."),
+    ...paymentOfferRequest,
+});
+export const CredentialOfferRequestSchema = z.object({
+    kind: z.literal("credential_offer").describe("The agent asks a named person to release a credential."),
+    ...credentialOfferRequest,
+});
+export const ParkedRequestSchema = z.discriminatedUnion("kind", [
+    PlanRequestSchema,
+    QuestionRequestSchema,
+    PermissionRequestSchema,
+    PageAskRequestSchema,
+    CapabilityOfferRequestSchema,
+    PaymentOfferRequestSchema,
+    CredentialOfferRequestSchema,
+]);
+// Whether a frame is a card the journal keeps for a restart to put back; a record, so a kind added above fails to compile
+// until it is named here.
+const RESTORABLE = {
+    plan: true,
+    question: true,
+    permission: true,
+    page_ask: true,
+    capability_offer: true,
+    payment_offer: true,
+    credential_offer: true,
+} as const satisfies Record<ParkedRequest["kind"], true>;
+export const isRestorableRequest = (event: { readonly kind: string }): event is ParkedRequest => Object.hasOwn(RESTORABLE, event.kind);
 export type ParkedRequest = z.infer<typeof ParkedRequestSchema>;

package/src/events/sandbox-notice.ts

@@ -16,13 +16,22 @@ export const NoticeCodeSchema = z.object({
 });
 export type NoticeCode = z.infer<typeof NoticeCodeSchema>;
 
+/** A failure's facts as every failure notice carries them (the `failure` params below), before the clause it adds. */
+export interface FailureSaid {
+    readonly message: string;
+    readonly error?: string | undefined;
+    readonly own?: boolean | undefined;
+}
+
 const count = z.number().int().nonnegative();
 
-// A failure's own sentence, which the notice's clause follows: the provider's words, or the sandbox's under `error`, its
-// failure code, for a reader that words a failure it knows itself.
+// A failure's own sentence, which the notice's clause follows, its failure code (`error`; absent for a failure nobody
+// named), and whether the sandbox worded the sentence (`own`). Absent `own`, the sentence is the provider's or the
+// harness's: a reader leads with its own line for the code and keeps those words behind a press.
 const failure = {
     message: z.string(),
     error: z.string().optional(),
+    own: z.boolean().optional(),
 };
 
 // The re-runs a resumed turn's row can name (events/resume.ts); a reason a reader does not know draws the row's text.
@@ -63,6 +72,9 @@ export const SandboxNoticeSchema = z.discriminatedUnion("code", [
     z.object({ code: z.literal("renewalWithdrawn"), params: z.object(failure) }),
     z.object({ code: z.literal("reconnect"), params: z.object(failure) }),
     z.object({ code: z.literal("undelivered"), params: z.object({ ...failure, unattended: z.boolean().optional() }) }),
+    // A door refusal that came after the turn had already run (a trial spent mid-turn): what it did stays, nothing is
+    // held, and `switchModel` when another model gets past the refusal.
+    z.object({ code: z.literal("stoppedPartway"), params: z.object({ ...failure, switchModel: z.boolean().optional() }) }),
     // A turn the sandbox kept whole, its message above; `memory` when a memory hold kept it.
     z.object({ code: z.literal("kept"), params: z.object({ ...failure, memory: z.boolean().optional() }) }),
     z.object({ code: z.literal("memoryHeld"), params: z.object(failure) }),

package/src/events/system-events.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { AgentSummarySchema } from "../schemas/agents.js";
-import { AccountUsageSchema, ProviderRefusalSchema } from "../schemas/providers/plan-limits.js";
+import { AccountUsageSchema, type ProviderRefusal, ProviderRefusalSchema } from "../schemas/providers/plan-limits.js";
 import { MemberRoleSchema } from "../schemas/shared.js";
 import { WorkspaceTreeDeltaSchema } from "../schemas/workspace/workspace-tree.js";
 
@@ -147,11 +147,21 @@ export const AccountUsageChangedSchema = z.object({
 });
 export type AccountUsageChanged = z.infer<typeof AccountUsageChangedSchema>;
 
-// A provider's last refusal was recorded or settled, the observed half of "can I run on this". `refusal` absent means
-// settled, nothing stands.
-export const ProviderRefusalChangedSchema = z.object({ kind: z.literal("providerRefusal"), provider: z.string(), refusal: ProviderRefusalSchema.optional() });
+// A provider's refusals on file changed (one recorded, settled or forgotten), the observed half of "can I run on this":
+// every one it still holds, so a window judges by exactly what the daemon does. Empty means nothing stands. A daemon at
+// the floor sends only its last `refusal` (absent: settled), so `refusals` stays optional; read both with refusalsOf.
+export const ProviderRefusalChangedSchema = z.object({
+    kind: z.literal("providerRefusal"),
+    provider: z.string(),
+    refusals: z.array(ProviderRefusalSchema).optional(),
+    refusal: ProviderRefusalSchema.optional(),
+});
 export type ProviderRefusalChanged = z.infer<typeof ProviderRefusalChangedSchema>;
 
+// Every refusal a frame says stands, from a daemon that sends the whole list or one at the floor that sends its last.
+export const refusalsOf = (event: ProviderRefusalChanged): readonly ProviderRefusal[] =>
+    event.refusals ?? (event.refusal === undefined ? [] : [event.refusal]);
+
 // What moved in the shared tree, once the daemon's resident copy re-listed a batch: a tab holding the generation it
 // counts from patches its tree, and one holding any other fetches it afresh.
 export const TreeChangedSchema = WorkspaceTreeDeltaSchema.extend({ kind: z.literal("treeChanged") });

package/src/events/transcript.ts

@@ -1,8 +1,7 @@
 import { z } from "zod";
-import { AgentHarnessSchema, AgentProviderSchema } from "../schemas/agent.js";
 import { ShareDetailSchema } from "../schemas/share.js";
 import { TurnErrandSchema, TurnSpeakerSchema } from "../schemas/speaker.js";
-import { SubagentKindSchema, SubagentStatusSchema, SubagentVerificationSchema } from "../schemas/terminal.js";
+import { SubagentKindSchema, SubagentSdkRecordSchema, SubagentStatusSchema, SubagentVerificationSchema } from "../schemas/terminal.js";
 import { NeedSchema } from "../schemas/needs.js";
 import { HeldEndingSchema, RetryLadderSchema } from "../schemas/turn-break.js";
 import { HandoffOfferSchema } from "../schemas/providers/handoff.js";
@@ -172,6 +171,9 @@ export const TranscriptSubagentSchema = z.object({
     summary: z.string().optional(),
     error: z.string().optional(),
     verification: SubagentVerificationSchema.optional(),
+    sdk: SubagentSdkRecordSchema.optional().describe(
+        "Where the Claude runtime keeps this in-process subagent's own record, so its whole run reads back once nothing in memory remembers it. Absent for every other kind, and until the daemon has paired it.",
+    ),
 });
 export type TranscriptSubagent = z.infer<typeof TranscriptSubagentSchema>;
 // Mutable, unlike most of this file: the fold settles a card in place when its result lands turns later, saving a
@@ -269,6 +271,15 @@ export const TranscriptRowSchema = z.object({
             "Who said it. A notice is neither side: it is something that happened to the turn, recorded so a reopened conversation can say it. Without those, a turn a provider refused ends on the user's message and reads as broken.",
         ),
     text: z.string().describe("The words."),
+    // The row's own name, minted once where the row is made (the live fold, or the record for a row written outside a
+    // run) and carried on every copy: the live head's, each patch's, the record's, a client's mirror. Positions move
+    // under a rewind and contents grow while a run streams, so this is how a reader says "this row" across all of them.
+    rowId: z
+        .string()
+        .optional()
+        .describe(
+            "The row's own id: the same on the live turn's copy, every change to it, the record, and a reader's own copy, so a reader updates the row it already holds instead of matching it by content. Rows recorded before rows had ids are named by their position (`@12`). Absent from a sandbox older than ids.",
+        ),
     // Which run produced this row, carried on every copy of it: the live head's, the record's, a client's mirror.
     // It is how a client says "I am already showing this run" without comparing content, which cannot answer that
     // while the run's last row is still growing.
@@ -339,9 +350,10 @@ export const TranscriptRowSchema = z.object({
         ),
     // The follow-up this notice offers, by name; the chat decides what it does, and whether it stands. `sendAnyway` sends
     // the held message; `sandboxMemory` offers that and a raise of the sandbox's memory; `sendAgain` sends a turn the
-    // sandbox kept after a refusal no raise would clear.
+    // sandbox kept after a refusal no raise would clear; `switchModel` opens the model list for a turn a model's refusal
+    // stopped partway, so the same conversation carries on with another.
     noticeAction: z
-        .enum(["landHold", "depsInstall", "watchStop", "sandboxMemory", "sendAnyway", "sendAgain"])
+        .enum(["landHold", "depsInstall", "watchStop", "sandboxMemory", "sendAnyway", "sendAgain", "switchModel"])
         .optional()
         .describe("A one-press follow-up this notice offers, by name. The chat decides what it does and whether it still applies."),
     // Where a refused turn's words wait decides what the notice's press does: the conversation's queue, or the sandbox.
@@ -416,33 +428,45 @@ export const holdsRequest = (row: TranscriptRequests): boolean => REQUEST_FIELDS
 // Whether a row is holding the turn open on a card nobody has answered.
 export const isAwaitingDecision = (row: TranscriptRequests): boolean => REQUEST_FIELDS.some((field) => row[field]?.status === "pending");
 
+// The row a patch changes, by its own id, beside the index older readers count from.
+const patchRowId = z
+    .string()
+    .optional()
+    .describe("The id of the row this changes. A reader holding a row by that id changes it there, wherever it sits; `index` is for one that does not.");
+
 // One change to a run's rows, so a client keeps rows rather than frames. Prose/thinking append to a row or a card; a
 // `tool` card replaces its own fields by id, never its nested calls or thinking, which arrive by their own patches;
-// everything else replaces its row; `drop` removes a row that opened and never wrote.
+// everything else replaces its row; `drop` removes a row that opened and never wrote. Each names its row twice: by
+// `index` from where the run's rows start, and by `rowId`, which needs no counting and survives a row dropped above it.
 export const TranscriptPatchSchema = z.discriminatedUnion("op", [
     z.object({ op: z.literal("append").describe("A new row at the end."), row: TranscriptRowSchema }),
     z.object({
         op: z.literal("replace").describe("This row, whole, in place of the one at that index."),
         index: z.number().int().nonnegative(),
+        rowId: patchRowId,
         row: TranscriptRowSchema,
     }),
     z.object({
         op: z.literal("drop").describe("The row at that index is gone: it was opened and never written into."),
         index: z.number().int().nonnegative(),
+        rowId: patchRowId,
     }),
     z.object({
         op: z.literal("text").describe("More of the agent's prose, onto that row's text."),
         index: z.number().int().nonnegative(),
+        rowId: patchRowId,
         text: z.string(),
     }),
     z.object({
         op: z.literal("thinking").describe("More of the agent's reasoning, onto that row's thinking."),
         index: z.number().int().nonnegative(),
+        rowId: patchRowId,
         text: z.string(),
     }),
     z.object({
         op: z.literal("toolThinking").describe("More of a delegated subagent's reasoning, onto the thinking of the card that started it."),
         index: z.number().int().nonnegative(),
+        rowId: patchRowId,
         id: z.string().describe("The card's id, matched wherever it nests."),
         text: z.string(),
     }),
@@ -453,6 +477,7 @@ export const TranscriptPatchSchema = z.discriminatedUnion("op", [
                 "A tool card's own fields: new, or the latest state of one already there, matched by id wherever it nests. Carries no `children` or `thinking`; a card already there keeps its own.",
             ),
         index: z.number().int().nonnegative(),
+        rowId: patchRowId,
         tool: TranscriptToolSchema,
         parent: z.string().optional().describe("The card this one nests under, when it is a delegated subagent's own call."),
     }),
@@ -527,29 +552,6 @@ export const TurnEndingSchema = z.object({
 });
 export type TurnEnding = z.infer<typeof TurnEndingSchema>;
 
-// The record a reopened tab rebuilds from: messages plus what the session is bound to (provider, runtime, account). A
-// client can't derive these: after a mid-chat switch, its own picks belong to a different session.
-export const AgentTranscriptSchema = SessionTranscriptSchema.extend({
-    sessionId: z.string().optional().describe("The provider session behind the last turn, when there is one."),
-    provider: AgentProviderSchema.optional().describe("Which provider minted that session."),
-    harness: AgentHarnessSchema.optional().describe("Which runtime minted it: a session resumes only on the loop that opened it."),
-    account: z
-        .string()
-        .optional()
-        .describe("Which stored account it belongs to, as the daemon resolved it. Absent when no stored account paid for the turn."),
-    // How the last turn ended, for endings that leave a live session with just a press to offer; absent otherwise.
-    ending: TurnEndingSchema.optional().describe(
-        "How the last turn ended, when it left work behind that one press finishes. Absent for a conversation whose last turn ended on its own, and for the failures that name something to repair first.",
-    ),
-    // `from` offsets every `rewindIndex` here, and is the `before` for the page above; `more` flags older messages.
-    from: z
-        .number()
-        .int()
-        .nonnegative()
-        .describe("Where the first message sits in the whole record, and the `before` that asks for the page above this one."),
-    more: z.boolean().describe("Whether older messages precede this page."),
-});
-
 // A delegation's own run, fetched when its card opens; empty when the record no longer holds it.
 export const AgentToolChildrenSchema = z.object({
     children: z.array(TranscriptToolSchema).describe("The calls the delegated agent made, in the order it made them."),

package/src/ids/conversation-ids.ts

@@ -8,6 +8,13 @@ export const CONVERSATION_ID = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 // Safe to interpolate into a path or a branch name. `false` for anything else, including the empty string.
 export const isConversationId = (value: string): boolean => CONVERSATION_ID.test(value);
 
+// The longest title a conversation opens with (AgentTurn.title). A title made by joining words (a fresh session's
+// "Code review: " and its origin's whole title) runs past it easily, and a turn naming one is refused outright, so a
+// sender clips it first rather than lose the turn to its name.
+export const CONVERSATION_TITLE_MAX = 80;
+export const clipTitle = (title: string): string =>
+    title.length <= CONVERSATION_TITLE_MAX ? title : `${title.slice(0, CONVERSATION_TITLE_MAX - 1).trimEnd()}…`;
+
 // Short (nothing over seven letters) and visually distinct: no near-rhymes, no shared first syllable.
 const ADJECTIVES = [
     "amber",

package/src/ids/project-dir.test.ts

@@ -59,8 +59,8 @@ test("a project dir is exactly one valid name under the workspace root", () => {
     expect(projectDirNameOf("/srv/work/my-app", "/srv/work")).toBe("my-app");
 });
 
-// A second folder of the same name takes a name that says which one it is: its parent's in front (machine_sandbox.rs
-// `unique_name` takes the first one free). Where a folder is (a drive, a network share) never lends a name.
+// A second folder of the same name takes a name that says which one it is: its parent's in front. Where a folder is (a
+// drive, a network share) never lends a name.
 const NAMED: readonly { readonly path: string; readonly names: string[] }[] = [
     { path: "C:\\Users\\ada\\code\\app", names: ["app-project", "code-app", "ada-code-app"] },
     { path: "C:\\Users\\ada\\work\\My App", names: ["My-App", "work-My-App", "ada-work-My-App"] },

package/src/ids/project-dir.ts

@@ -56,10 +56,10 @@ export const projectDirNameFor = (folderBasename: string): string => {
     return RESERVED_PROJECT_DIR_NAMES.includes(name) ? `${name}-project` : name;
 };
 
-// The names a folder may take in this computer's sandbox, best first: its own name, then its parent's name in front of
-// it, then its grandparent's too (`app`, `code-app`, `radar-code-app`), each one `isProjectDirName` accepts and none
-// twice. The desktop app takes the first one free (machine_sandbox.rs `unique_name`) and numbers only past all of them,
-// so a second folder called `app` reads as `code-app`, which says which one it is, rather than `app-2` (2026-10-12). A
+// The names a folder may take in a sandbox's /work, best first: its own name, then its parent's name in front of it,
+// then its grandparent's too (`app`, `code-app`, `radar-code-app`), each one `isProjectDirName` accepts and none
+// twice. Written (2026-10-12) for the desktop app's one sandbox per computer, where a second folder called `app` read as
+// `code-app` rather than `app-2`; since 2026-10-21 each folder has a sandbox of its own and takes its own name. A
 // drive (`C:`) and a network share's server and share (`\\server\share`, `\\wsl.localhost\<distro>`) are where a folder
 // is, not what it is called, so they never lend a name.
 export const projectDirCandidates = (hostPath: string): string[] => {

package/src/ids/row-ids.ts

@@ -0,0 +1,20 @@
+// A transcript row's own name (TranscriptRow.rowId). Minted once, where the row is made: the live fold for a run's rows,
+// the record for a row written outside a run. Random rather than counted, since two makers (a run and a placed line) can
+// write into one conversation without asking each other, and nothing reads order out of it: position is the record's.
+
+const ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz";
+// Twelve characters of base 36, about 62 bits: unique within any conversation by a wide margin, and short, since every
+// row of every record carries one.
+const LENGTH = 12;
+
+export const newRowId = (): string => {
+    let id = "";
+    for (const byte of globalThis.crypto.getRandomValues(new Uint8Array(LENGTH))) {
+        id += ALPHABET[byte % ALPHABET.length];
+    }
+    return id;
+};
+
+// The name of a row recorded before rows had ids: its position, which never moves for a row that stays (a rewind only
+// drops rows after the point it keeps, and what is written after gets minted ids). The `@` keeps it apart from a minted id.
+export const positionRowId = (position: number): string => `@${position}`;

package/src/models/agent-lanes.ts

@@ -1,17 +1,8 @@
 import type { AgentAttention } from "../schemas/agents.js";
 import type { AutomationApproval } from "../schemas/automations.js";
+import { goesBySelf } from "../schemas/agent-next.js";
 import { parentOf } from "./agent-starter.js";
-import {
-    type AgentStanding,
-    blocked,
-    heardByParent,
-    limitScheduled,
-    onlyOwnerCanAnswer,
-    scheduledSend,
-    turnInFlight,
-    turnWorking,
-    watching,
-} from "./agent-standing.js";
+import { type AgentStanding, blocked, heardByParent, onlyOwnerCanAnswer, turnInFlight, turnWorking, watching } from "./agent-standing.js";
 
 // The lane every surface files a conversation in, and what of a fleet calls the person. Moved here from the editor
 // (_editor/web/src/models/agent-status/agentStatus-lanes.ts, which re-exports it) on 2026-10-16, so the daemon's
@@ -23,11 +14,15 @@ import {
 // reader's once it no longer does: nothing running there to hear it and nothing armed to wake it, which is a parent out
 // of Active. That holds only until the parent moves past it (heardByParent). After that the stop is the family's
 // history, drawn in the tray, and no longer something the reader owes a press. The sandbox draws the same line for a
-// child's land news (subagents/child-lands.ts): the parent's while it has a live turn, the owner's after.
+// child's land news (subagents/child-lands.ts): the parent's while it has a live turn, the owner's after. A fresh
+// session is the exception: its parent never supervises it (nothing it does is reported there), so whatever it stops on
+// is the reader's from the start, through its parent's card, however busy the parent is.
 export const callsOwner = (
     child: AgentStanding & { readonly updatedAt: number },
     family: { readonly child: FleetLane; readonly parent: FleetLane; readonly parentAt: number },
-): boolean => onlyOwnerCanAnswer(child) || (family.child === "attention" && family.parent !== "active" && !heardByParent(child, family.parentAt));
+): boolean =>
+    onlyOwnerCanAnswer(child) ||
+    (family.child === "attention" && (family.parent !== "active" || child.fresh !== undefined) && !heardByParent(child, family.parentAt));
 
 export type FleetLane = "attention" | "active" | "finished";
 
@@ -46,7 +41,7 @@ export const NO_ATTENTION: AgentAttention = {
 // "finished" needs no explicit timer since auto-land already flips a cleanly-completed turn to landed/idle within
 // ms, and any follow-up message moves the card back to active. Unread stays a badge, not a lane.
 export const laneOf = (agent: AgentStanding): FleetLane => {
-    // A spent allowance nothing is booked for reaches Attention through `blocked` alone, no branch of its own, and ahead
+    // A spent allowance nothing carries on reaches Attention through `blocked` alone, no branch of its own, and ahead
     // of the `watching` branch below: a watch is the agent's own plan for waiting, a spent allowance an obstacle in
     // the way of it, and a watch firing into a shut window runs nothing (turn-admission.ts holds its words back).
     if (blocked(agent) || agent.status === "awaiting" || agent.status === "conflict") {
@@ -70,15 +65,10 @@ export const laneOf = (agent: AgentStanding): FleetLane => {
     if (watching(agent)) {
         return "active";
     }
-    // A stranded turn booked to go again is Active: at the reset, or on the resume pass's next beat for a move to another
-    // account. Reached only because `blocked` let it through; stated explicitly or the card would fall through to
-    // Finished, which would announce as over work that resumes by itself.
-    if (limitScheduled(agent)) {
-        return "active";
-    }
-    // Messages booked for later are the same: the conversation starts again by itself, at a time or once the agent it
-    // waits for has landed, so filing it Finished would announce as done work that has not started yet.
-    if (scheduledSend(agent)) {
+    // Whatever carries it on by itself (`next`: a held turn re-run or moved, a send once memory frees, messages booked
+    // for a time or another agent's land) is Active: filing it Finished would announce as over work that resumes or has
+    // not started yet. An ending it answers reached here because `blocked` let it through on the same reading.
+    if (goesBySelf(agent)) {
         return "active";
     }
     // `landed`/`idle`/`ready` all finish here: `ready` is work held on the branch because auto-land is off, still
@@ -127,7 +117,9 @@ export const attentionCalls = (agents: readonly CallerStanding[]): readonly { re
     const calls: { readonly id: string; readonly card: string }[] = [];
     for (const agent of agents) {
         const parent = parentIn(agent);
-        if (parent === undefined || agent.unsent === true) {
+        // Words left in a child's composer give it a card of its own (childFold.standsAlone), except a fresh session's:
+        // its composer is the person's anyway, and it rides its origin's card whatever it holds.
+        if (parent === undefined || (agent.unsent === true && agent.fresh === undefined)) {
             if (laneOf(agent) === "attention") {
                 calls.push({ id: agent.id, card: agent.id });
             }

package/src/models/agent-runtimes.ts

@@ -252,7 +252,7 @@ export const ACP: AgentCapabilities = {
     isolation: "cwd",
     commands: true,
     terminals: true,
-    // A failure the agent words as a spent allowance or an outgrown window is coded (acp-agent.ts ACP_FAILURES), but the
+    // A failure the agent words as a spent allowance or an outgrown window is coded (error-frames.ts codedFailure), but the
     // words are each agent's own and the protocol marks no outage, so nothing promises the codes auto-resume keys off.
     recovery: false,
     warm: false,
@@ -332,7 +332,7 @@ export const PI: AgentCapabilities = {
     // session, as the Claude loop's Bash hook does (pi-hooks.ts).
     terminals: true,
     // Pi reports a provider failure as its own event (auto_retry_end, an errored message_end) carrying the provider's
-    // sentence, status code included, which the shared rules code (pi-events.ts PI_FAILURES).
+    // sentence, status code included, which the shared rules code (error-frames.ts codedFailure).
     recovery: true,
     warm: false,
     // `--system-prompt` replaces Pi's base and `--append-system-prompt` adds to it, both per process; `--no-context-files`