@junghanacs/entwurf 0.34.2 → 0.35.1

package/pi-extensions/lib/acp/models.ts

@@ -33,9 +33,18 @@
 // re-export of `getBuiltinModels`. When pi removes compat we migrate to whatever
 // the loader then exposes.
 import { getModels } from "@earendil-works/pi-ai/compat";
+import { CURATED_ANCHOR_MODEL_ID, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./model-ids.js";
 
-/** Provider id — current pre-rename surface; S1 renames this load-bearing id to `entwurf`. */
-export const PROVIDER_ID = "entwurf";
+// The provider id and the curated ID lists live in the dependency-free
+// `model-ids.js` leaf, shared with the launch seams (#128); this file is the only
+// one that loads the upstream catalog to turn them into registry rows.
+export {
+	CORTEX_MODEL_PREFIX,
+	CURATED_ANCHOR_MODEL_ID,
+	PROVIDER_ID,
+	SUPPORTED_ANTHROPIC_MODEL_IDS,
+	SUPPORTED_CORTEX_MODEL_IDS,
+} from "./model-ids.js";
 
 // #26 auth-boundary sentinel. `pi.registerProvider` requires an apiKey when a
 // provider defines custom models, but the ACP plugin consumes NO key: backend
@@ -49,17 +58,8 @@ export const PROVIDER_ID = "entwurf";
 // check-auth-boundary gate pins this.
 export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 
-// The curated Claude ids. Adding one here is a commitment to verify it across
-// both axes (protocol smoke + agent interview) — do not extend casually.
-// Exported so the claude backend adapter (backend-adapter.ts) can answer
-// `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"] as const;
-
-/** The anchor model whose absence is a hard registry regression, not a soft skip. */
-export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-
-// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
-// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5.5, Opus 5.5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window was the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.
@@ -92,7 +92,7 @@ function claudeContextWindow(model: { id: string; contextWindow: number }): numb
 // carries the reserved `cortex-` prefix: the prefix is the SINGLE routing
 // authority (backend-adapter.ts `routeModel`) and keeps the ids off the Claude
 // native ids Cortex routes to (`cortex-claude-sonnet-5` vs the unprefixed
-// `claude-sonnet-5` the claude adapter owns). `routeModel` strips the prefix to
+// `claude-sonnet-5-5` the claude adapter owns). `routeModel` strips the prefix to
 // recover the native id, which is enforced per-turn via
 // session/set_config_option — never a launch `-m` pin (CP0-M).
 //
@@ -101,14 +101,7 @@ function claudeContextWindow(model: { id: string; contextWindow: number }): numb
 // the running cortex no longer serves fails LOUD at set-model, before the
 // prompt (measured: `Unsupported model: …` names the live set). Adding an id
 // here is the same verify-both-axes commitment as the Claude set — do not
-// extend casually.
-export const CORTEX_MODEL_PREFIX = "cortex-";
-export const SUPPORTED_CORTEX_MODEL_IDS = [
-	"cortex-auto",
-	"cortex-claude-opus-5",
-	"cortex-claude-sonnet-5",
-	"cortex-openai-gpt-5.4",
-] as const;
+// extend casually. The prefix and the four ids are declared in model-ids.js.
 
 // Hand-set conservative context window. Cortex reports the LIVE window via its
 // own ACP session config, not this curated metadata — this is a floor for the

package/pi-extensions/lib/entwurf-v2-visible-resume.ts

@@ -47,6 +47,7 @@
  * outcome for this module to claim.
  */
 
+import { ACP_MODEL_NOT_CURATED_HINT, AcpModelNotCuratedError } from "./acp/model-ids.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.ts";
 import {
 	type AcquireLockResult,
@@ -93,6 +94,7 @@ export const RESUME_OBSERVE_INTERVAL_MS = 500;
 export type VisibleResumeRejectReason =
 	| "target-invalid"
 	| "target-not-pi"
+	| "acp-model-not-curated"
 	| "target-locked"
 	| "target-live"
 	| "target-indeterminate"
@@ -227,6 +229,15 @@ export async function visibleResume(targetGardenId: string, deps: VisibleResumeD
 		try {
 			identity = deps.resolveIdentity(targetGardenId);
 		} catch (err) {
+			// #128: the recorded model is not an exact curated ACP id, so Pi would pick another row
+			// by substring. Same shape as `target-not-pi`: a named refusal matched on its FIELD.
+			if (err instanceof AcpModelNotCuratedError) {
+				return {
+					ok: false,
+					reason: err.reason,
+					detail: `${targetGardenId} would launch model ${JSON.stringify(err.model)} under the entwurf provider (the resolved launch pair, which may differ from the recorded provider)`,
+				};
+			}
 			if (err instanceof ResumeBackendUnsupportedError) {
 				return {
 					ok: false,
@@ -321,6 +332,7 @@ export async function observeSameGidSocket(
 const REJECT_HINT: Record<VisibleResumeRejectReason, string> = {
 	"target-invalid": "no citizen has that id; discover targets with entwurf_peers",
 	"target-not-pi": "that citizen's backend has no same-id resume — reach it with entwurf_v2, or open a fresh sibling",
+	"acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
 	"target-locked": "another resume or dispatch holds this citizen's lock right now",
 	"target-live": "that citizen is already running — this verb only reopens dormant ones",
 	"target-indeterminate": "the socket probe could not prove the citizen is dormant, so nothing was started",

package/pi-extensions/lib/fresh-call-dispatch.ts

@@ -25,8 +25,9 @@
  */
 
 import { spawn as spawnChildProcess } from "node:child_process";
+import { ACP_MODEL_NOT_CURATED, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { codexCallerFreshPreflight, codexFreshPreflight } from "./codex-fresh-preflight.ts";
-import { mintNonce } from "./fresh-call-composition.ts";
+import { isSafeFreshCallModel, mintNonce } from "./fresh-call-composition.ts";
 import {
 	createHerdrRunner,
 	type HerdrFreshCallResult,
@@ -67,6 +68,23 @@ export type DispatchedFreshCall =
 	| { readonly rail: "tmux"; readonly result: FreshCallResult }
 	| { readonly rail: "herdr"; readonly result: HerdrFreshCallResult };
 
+/**
+ * #128: a pi sibling asked for under the `entwurf` provider must name an EXACT curated ACP id. Pi
+ * resolves `--model` by substring among that provider's rows, so a retired `entwurf/claude-sonnet-5`
+ * would open on `cortex-claude-sonnet-5` — another vendor and billing rail — with a receipt that
+ * still names the requested id. Asked here, at the one root both rails share, so neither rail can
+ * forget it. It reads the model the way the rails will (trimmed), and only a model that already
+ * passes their grammar: a malformed one keeps its own `model-invalid` answer from the rail.
+ */
+export function isUncuratedEntwurfPiModel(backend: string, model: string): boolean {
+	if (backend !== "pi") return false;
+	const trimmed = model.trim();
+	if (!isSafeFreshCallModel(trimmed)) return false;
+	const slash = trimmed.indexOf("/");
+	if (slash < 0 || trimmed.slice(0, slash) !== PROVIDER_ID) return false;
+	return !isCuratedAcpModelId(trimmed.slice(slash + 1));
+}
+
 /**
  * Open a sibling on whichever rail this process is actually standing in.
  *
@@ -88,6 +106,12 @@ export async function dispatchFreshCall(
 	spawn?: SpawnFn,
 	nonce: string = mintNonce(),
 ): Promise<DispatchedFreshCall> {
+	// Before either rail is asked anything: both would open a pane on the wrong row.
+	if (isUncuratedEntwurfPiModel(request.backend, request.model)) {
+		return selectFreshCallRail(env) === "herdr"
+			? { rail: "herdr", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } }
+			: { rail: "tmux", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } };
+	}
 	if (selectFreshCallRail(env) === "herdr") {
 		const context = resolveHerdrContext(env);
 		if (!context.ok) {

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -119,6 +119,7 @@ export type HerdrFreshCallRejectReason =
 	// The caller-facing input contract, shared with the tmux rail so a mistyped model or an
 	// oversized task is answered with the SAME word on either placement owner.
 	| FreshCallInputRejectReason
+	| "acp-model-not-curated"
 	| "herdr-context-missing"
 	| "herdr-caller-pane-missing"
 	/** herdr would not tell us where the CALLER is sitting. Three separate names because the
@@ -1102,6 +1103,10 @@ const HERDR_REJECT_HINT: Record<HerdrFreshCallRejectReason | HerdrLaunchFailureR
 		"this surface has no record-backed identity, so a sibling would have nowhere to call home",
 	"model-empty": "pass the model you want the sibling opened with — it is never inherited from this process",
 	"model-invalid": "the model is not in the accepted grammar (no whitespace, no leading dash)",
+	// #128: decided at the dispatch root (`fresh-call-dispatch.ts`), worded here because this rail's
+	// import fence admits no ACP module. The curated list itself lives in `acp/model-ids.js`.
+	"acp-model-not-curated":
+		"an entwurf model must be one exact curated ACP id — Pi would otherwise pick another row by substring (a retired claude-sonnet-5 lands on cortex-claude-sonnet-5), so nothing was opened and nothing was aliased",
 	"task-empty": "a sibling opened with nothing to do is a window nobody asked for",
 	"task-too-long": `the task is over the ${TASK_MAX_CHARS}-character interface bound this verb shares with entwurf_v2`,
 	"herdr-context-missing":

package/pi-extensions/lib/mux-fresh-call.ts

@@ -86,6 +86,7 @@
  *     there is no "session created" field because nothing here creates one.
  */
 
+import { ACP_MODEL_NOT_CURATED_HINT } from "./acp/model-ids.js";
 import { callbackEnvAssignments } from "./callback-env.ts";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
 import {
@@ -265,6 +266,7 @@ export type FreshCallRejectReason =
 	| CodexPreflightRejectReason
 	| CodexCallerPreflightRejectReason
 	| CodexCallerSeatRejectReason
+	| "acp-model-not-curated"
 	| "caller-identity-unavailable"
 	| "model-empty"
 	| "model-invalid"
@@ -678,6 +680,7 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 		"no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
 	"model-empty": "model is empty after trimming; fresh calls require an explicit model",
 	"model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
+	"acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
 	"task-empty": "task is empty after trimming",
 	"task-too-long": `task exceeds ${TASK_MAX_CHARS} characters`,
 	"runtime-unresolved": "the backend's runtime is not installed on PATH",

package/pi-extensions/lib/resume-launch-identity.ts

@@ -20,12 +20,13 @@
 
 import { existsSync } from "node:fs";
 import path from "node:path";
+import { AcpModelNotCuratedError, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { getEntwurfExplicitExtensions, readSessionIdentity } from "./entwurf-core.ts";
 import { readAddressableMetaIdentity } from "./meta-session.ts";
 
 /**
- * The ONE expected refusal on this leaf: the target is a citizen of a backend that has no
- * same-id resume at all.
+ * One of the TWO expected refusals on this leaf: the target is a citizen of a backend that has no
+ * same-id resume at all. The other is `AcpModelNotCuratedError` (#128, `acp/model-ids.js`).
  *
  * Everything else this function throws is a defect in the record, the transcript or the
  * environment — a stale path, a foreign session file, an unrecorded model, an unresolvable
@@ -152,11 +153,18 @@ export function resolveResumeLaunchIdentity(gardenId: string): LaunchIdentity {
 	if (!identity.cwd) {
 		throw new Error(`resume-launch-identity: ${gardenId} header has no cwd (the cold-resume authority, #9).`);
 	}
+	// #128: the pair checked is the one the launch will EMIT, not the recorded provider alone —
+	// `getEntwurfExplicitExtensions` also routes a bare Claude model id to `entwurf`. Under that
+	// provider Pi resolves `--model` by substring, so a retired `claude-sonnet-5` would reopen on
+	// `cortex-claude-sonnet-5`. The record and transcript stay as they are; the resume is refused.
+	const provider = explicitExtensions.provider ?? identity.provider;
+	const model = explicitExtensions.modelOverride ?? resumeModel;
+	if (provider === PROVIDER_ID && !isCuratedAcpModelId(model)) throw new AcpModelNotCuratedError(model);
 	return {
 		sessionFile,
 		cwd: identity.cwd,
 		explicitExtensionArgs: explicitExtensions.args,
-		provider: explicitExtensions.provider ?? identity.provider,
-		model: explicitExtensions.modelOverride ?? resumeModel,
+		provider,
+		model,
 	};
 }

package/pi-extensions/meta-bridge-pi-durable.ts

@@ -58,6 +58,24 @@
  * vanished signal, a failed ring, a rejected admission or close retires the doorbell — watch
  * closed, our own marker removed, the reason kept by name — and nothing retries it.
  *
+ * WITHDRAW (#140). Each notice is a native `followUp`, placed one per run; a read drains EVERY
+ * unread body. So after a read the notices still queued for that mail would each cost a turn and an
+ * empty read. The contact keeps the native `Submission` handle of each notice it admitted, with the
+ * `.msg` names that notice announced, only while that mail is unread. After every
+ * `entwurf_inbox_read` attempt — whatever its garden id or outcome — it lists its OWN mailbox once
+ * and withdraws, through the native `Submission.abort` and the read's own invocation Context, each
+ * notice none of whose names is still `.msg.delivered`. That per-notice file predicate is the only
+ * authority: no garden-id guard, no requestId lookup, no queue of our own, no rewritten text. A placed
+ * or settled notice answers so and is let go; a withdraw that fails is let go too, named in one
+ * stderr line and on the receiver report, never retried and never retiring the doorbell; a mailbox
+ * that cannot be listed proves nothing absent, so every notice is kept and that is named the same
+ * way. The read's own result or error is returned unchanged — no diagnostic joins it. Ring passes
+ * and reads share one gate: a read waits for an admission in flight (else its drain could beat the
+ * handle it must withdraw), and an arrival during a read is rung once the read lets go. The count
+ * in a notice is its admission-time snapshot. Not covered: notices admitted before a restart (no
+ * handle), mail drained by another process (until this contact's next read), and operator abort,
+ * which natively withdraws queued notices while their mail stays unread.
+ *
  * VISIBLE IDENTITY (a static projection). `withGardenIdentity` hands the native TUI a view whose
  * every conversation label carries this citizen's garden id, so the footer the TUI keeps on screen
  * names the citizen; the bootstrap composes it only after birth succeeded. That is evidence of what
@@ -79,7 +97,8 @@
  *
  * NOT HERE: crash-safe receive. `entwurf_inbox_read` archives a body before the durable tool
  * result commits, so a crash between the two loses that body to the model; recovery settles the
- * call as interrupted and no doorbell rings again. No resume.
+ * call as interrupted and no doorbell rings again. A drain that fails part-way has archived the
+ * bodies before it (the bridge returns its error), and those too never reach the model. No resume.
  */
 
 import * as fs from "node:fs";
@@ -530,9 +549,14 @@ export interface DurableDoorbellDraft {
 	readonly requestId: string;
 }
 
-/** The part of the native `Submission` handle a doorbell records; admission is not completion. */
+/** What the native `Submission.abort` answers: only a still-queued input is withdrawn. */
+export type DurableWithdrawal = "aborted" | "already_placed" | "settled";
+
+/** The part of the native `Submission` handle a doorbell keeps; admission is not completion. */
 export interface DurableAdmittedSubmission {
 	readonly id: unknown;
+	/** Native `Submission.abort(context)`, handed the read's own invocation Context unchanged. */
+	abort(context: DurableCallContext | undefined): Promise<DurableWithdrawal>;
 }
 
 /** The overlay's `OpenDurableResult.submitToRoot`. */
@@ -562,21 +586,40 @@ export interface PiDurableDoorbellAdmission {
 	unread: number;
 }
 
+/**
+ * The LATEST notice withdrawal that failed. `inspection-failed`: the own mailbox could not be listed,
+ * so no notice was judged and every one is kept. `abort-failed`: the native withdraw of the notice
+ * named by `requestId` rejected; that notice is let go, not retried.
+ */
+export interface PiDurableWithdrawalFailure {
+	reason: "inspection-failed" | "abort-failed";
+	requestId?: string;
+	detail: string;
+}
+
 /**
  * The receiver's diagnostic. `admissions` is the LATEST successful admission only — an empty array
  * before the first ring, then exactly one entry, replaced by each later success; a retirement keeps
  * the last one. It is a diagnostic, not a history: it never grows with the host's lifetime, and its
  * length is no count of how often the root was asked (the root's own submissions are that record).
+ * `withdrawalFailure`, present only once a withdrawal failed, is likewise the latest one only.
  */
 export type PiDurableReceiverReport =
 	| { status: "off" }
-	| { status: "armed"; gardenId: string; markerPath: string; admissions: PiDurableDoorbellAdmission[] }
+	| {
+			status: "armed";
+			gardenId: string;
+			markerPath: string;
+			admissions: PiDurableDoorbellAdmission[];
+			withdrawalFailure?: PiDurableWithdrawalFailure;
+	  }
 	| {
 			status: "retired";
 			gardenId: string;
 			reason: PiDurableReceiverRetirement;
 			detail: string;
 			admissions: PiDurableDoorbellAdmission[];
+			withdrawalFailure?: PiDurableWithdrawalFailure;
 	  };
 
 export interface PiDurableAttachment {
@@ -641,6 +684,13 @@ interface ArmedDoorbell {
 	submitToRoot: DurableSubmitToRoot;
 }
 
+/** One admitted notice: its native handle and the `.msg` names it announced. */
+interface HeldNotice {
+	readonly requestId: string;
+	readonly fresh: readonly string[];
+	readonly submission: DurableAdmittedSubmission;
+}
+
 const TOOL_DESCRIPTIONS: Record<PiDurableToolName, string> = {
 	entwurf_self:
 		"Return this durable host's garden identity envelope (sessionId = garden id, agentId, cwd, replyable, rail) " +
@@ -730,7 +780,8 @@ export function createPiDurableContact(options: PiDurableContactOptions): PiDura
 				throw new Error(`${name} arguments must be an object`);
 			}
 			const client = await waitReady(context?.abortSignal);
-			const result = await client.callTool(name, (args ?? {}) as Record<string, unknown>, context?.abortSignal);
+			const call = () => client.callTool(name, (args ?? {}) as Record<string, unknown>, context?.abortSignal);
+			const result = name === "entwurf_inbox_read" ? await readInbox(call, context) : await call();
 			if (result.isError) throw new Error(result.text || `${name} failed`);
 			return { content: [{ type: "text", text: result.text }] };
 		},
@@ -745,8 +796,34 @@ export function createPiDurableContact(options: PiDurableContactOptions): PiDura
 	let doorbell: ArmedDoorbell | null = null;
 	let report: PiDurableReceiverReport = { status: "off" };
 	const admissions: PiDurableDoorbellAdmission[] = [];
-	let ringing = false;
+	/** The armed mailbox, kept past a retirement so notices admitted before it can still be judged. */
+	let inbox: string | null = null;
+	/** Every admitted notice still owed a withdraw judgement, oldest first. */
+	const notices: HeldNotice[] = [];
+	let withdrawalFailure: PiDurableWithdrawalFailure | undefined;
+	// One gate for ring passes and inbox reads; `pending` is a signal that landed while it was held.
+	let gated = false;
 	let pending = false;
+	const gateWaiters: (() => void)[] = [];
+
+	const enterGate = (): Promise<void> => {
+		if (!gated) {
+			gated = true;
+			return Promise.resolve();
+		}
+		return new Promise<void>((resolve) => gateWaiters.push(resolve));
+	};
+
+	/** Hand the gate to the next waiting read, else open it — and ring once for a signal that landed meanwhile. */
+	const leaveGate = (): void => {
+		const next = gateWaiters.shift();
+		if (next !== undefined) {
+			next();
+			return;
+		}
+		gated = false;
+		if (pending) void ring("signal");
+	};
 
 	/**
 	 * Give the doorbell back: close the watch and remove the marker, in one step, because a
@@ -791,19 +868,19 @@ export function createPiDurableContact(options: PiDurableContactOptions): PiDura
 	/**
 	 * One contract with the other self-fetch doorbells: a fresh `*.msg` is the trigger, it is
 	 * stamped `.msg.delivered` before the announce, and the announced count is every
-	 * `.msg.delivered`. Events that land while an admission is in flight coalesce into one more
-	 * pass. A failed pass retires the doorbell; it is not retried. Only a fresh `.msg` rings —
-	 * the startup pass included — so a `.msg.delivered` left undrained by an earlier host is not
-	 * announced again on its own; it shows only in the count of the next fresh arrival.
+	 * `.msg.delivered`. Events that land while an admission or an inbox read holds the gate coalesce
+	 * into one more pass. A failed pass retires the doorbell; it is not retried. Only a fresh `.msg`
+	 * rings — the startup pass included — so a `.msg.delivered` left undrained by an earlier host is
+	 * not announced again on its own; it shows only in the count of the next fresh arrival.
 	 */
 	const ring = async (why: PiDurableDoorbellAdmission["why"]): Promise<void> => {
 		const armed = doorbell;
 		if (armed === null) return;
-		if (ringing) {
+		if (gated) {
 			pending = true;
 			return;
 		}
-		ringing = true;
+		gated = true;
 		try {
 			do {
 				pending = false;
@@ -836,11 +913,71 @@ export function createPiDurableContact(options: PiDurableContactOptions): PiDura
 				}
 				// Latest only: the diagnostic names the LAST success and never grows with the host's lifetime.
 				admissions.splice(0, admissions.length, { why, requestId, submissionId: submission.id, fresh, unread });
+				notices.push({ requestId, fresh, submission });
 			} while (pending && doorbell === armed);
 		} catch (error) {
 			retire("doorbell-failed", describeError(error));
 		} finally {
-			ringing = false;
+			leaveGate();
+		}
+	};
+
+	/**
+	 * One named stderr line per failed withdrawal — stderr ALWAYS, as `entwurf-control` does, since
+	 * nothing in the native app reads the receiver report — and the report keeps the latest one.
+	 */
+	const noteWithdrawalFailure = (failure: PiDurableWithdrawalFailure): void => {
+		withdrawalFailure = failure;
+		const subject = failure.requestId === undefined ? "" : ` ${failure.requestId}`;
+		const detail = failure.detail.replace(/\s+/g, " ");
+		process.stderr.write(`[entwurf pi-durable] notice withdrawal ${failure.reason}${subject}: ${detail}\n`);
+	};
+
+	/**
+	 * Withdraw every held notice none of whose announced `.msg` names is still `.msg.delivered` in the
+	 * armed mailbox, listed once. A mailbox that cannot be listed proves nothing absent: every notice
+	 * is kept and that is named. A judged notice is let go whatever the native withdraw answers — or
+	 * when it rejects, which is named and never retried — so no handle outlives its mail by more
+	 * than one read. Never throws: the read's own answer is what the caller gets.
+	 */
+	const withdrawDrained = async (context: DurableCallContext | undefined): Promise<void> => {
+		if (inbox === null || notices.length === 0) return;
+		let unread: Set<string>;
+		try {
+			unread = new Set(fs.readdirSync(inbox).filter((name) => name.endsWith(".msg.delivered")));
+		} catch (error) {
+			noteWithdrawalFailure({ reason: "inspection-failed", detail: `${inbox}: ${describeError(error)}` });
+			return;
+		}
+		for (const notice of [...notices]) {
+			if (notice.fresh.some((name) => unread.has(`${name}.delivered`))) continue;
+			notices.splice(notices.indexOf(notice), 1);
+			try {
+				await notice.submission.abort(context);
+			} catch (error) {
+				noteWithdrawalFailure({ reason: "abort-failed", requestId: notice.requestId, detail: describeError(error) });
+			}
+		}
+	};
+
+	/**
+	 * An inbox read under the doorbell's gate, then the withdrawal its drain made due — after a
+	 * failed read too, whose partial drain may already have archived mail. The bridge's own answer,
+	 * result or rejection, is returned unchanged.
+	 */
+	const readInbox = async (
+		call: () => Promise<BridgeCallResult>,
+		context: DurableCallContext | undefined,
+	): Promise<BridgeCallResult> => {
+		await enterGate();
+		try {
+			return await call();
+		} finally {
+			try {
+				await withdrawDrained(context);
+			} finally {
+				leaveGate();
+			}
 		}
 	};
 
@@ -893,6 +1030,7 @@ export function createPiDurableContact(options: PiDurableContactOptions): PiDura
 				receiversDir: roots.receiversDir,
 			});
 			doorbell = { gardenId, ownerPid, mailbox, signal, markerPath, watcher, submitToRoot };
+			inbox = mailbox;
 			report = { status: "armed", gardenId, markerPath, admissions };
 			return markerPath;
 		} catch (error) {
@@ -1011,13 +1149,15 @@ export function createPiDurableContact(options: PiDurableContactOptions): PiDura
 			settleFailed(describeError(error));
 		},
 		receiver() {
-			return report;
+			return withdrawalFailure === undefined || report.status === "off" ? report : { ...report, withdrawalFailure };
 		},
 		async close() {
 			const previous = state;
 			settleFailed("the contact closed before attach completed");
 			state = { kind: "closed" };
 			const client = previous.kind === "ready" ? previous.client : undefined;
+			// Queued notices stay native (a continued session places them); this contact judges no more.
+			notices.length = 0;
 			await closeAll(disarmOnClose, async () => {
 				await client?.close();
 			});