@junghanacs/entwurf 0.35.0 → 0.36.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/native-push/codex-ws-client.js

@@ -15,30 +15,108 @@ export function resolveCodexHome(env) {
 export function resolveCodexDefaultSocketPath(env) {
     return path.join(resolveCodexHome(env), "app-server-control", "app-server-control.sock");
 }
-export function checkCodexSocketFile(socketPath) {
+/**
+ * The advertised path is exactly one of two layouts, and anything else is refused.
+ *
+ * (A) A plain socket owned by the effective uid: Codex up to 0.153.4 binds the advertised
+ *     path itself. `connectPath` is that path.
+ * (B) Codex's rendezvous alias. From 0.162.1 the advertised path "is only an alias": the
+ *     server binds a 0600 socket under `realpath(/tmp)/codex-daemon-<euid>/` named by the
+ *     sha256 of the canonical advertised path, then symlinks the advertised path to it
+ *     (`[source]` rust-v0.162.1 `app-server-transport/src/transport/unix_socket.rs:43-131,
+ *     290-304`; `uds/src/daemon_directory.rs:1-38`). Upstream's reason is a privileged
+ *     rendezvous root that sandboxes hide; the alias also keeps an over-long advertised path
+ *     usable (`uds/src/lib.rs:167-174`). The alias is accepted only when every hop is the
+ *     vendor's own: the link is owned by the effective uid; its target is BYTE-EQUAL to the
+ *     path Codex derives (a relative, foreign, re-hashed or chained target is refused); the
+ *     daemon directory is a real directory owned by the effective uid with `mode & 0o777`
+ *     exactly 0700, the vendor's own rule; and the target is a socket owned by the effective
+ *     uid that no group or other user can open. `connectPath` is the verified target, so the
+ *     alias is never re-resolved between this check and the connect. A same-euid process can
+ *     still replace the verified socket file itself; that residual is named, not locked.
+ *
+ * Only `lstat` and one `readlink` touch the alias; it is never followed or `realpath`ed.
+ * The effective uid is the vendor's (`libc::geteuid`), not the real uid.
+ */
+export function checkCodexSocketFile(socketPath, deps = {}) {
+    const euid = deps.euid ?? process.geteuid?.();
+    let stat;
     try {
-        const stat = fs.lstatSync(socketPath);
-        if (stat.isSymbolicLink()) {
-            return { ok: false, status: "indeterminate", reason: `app-server socket is a symlink: ${socketPath}` };
-        }
-        if (!stat.isSocket()) {
-            return { ok: false, status: "indeterminate", reason: `app-server path is not a socket: ${socketPath}` };
+        stat = fs.lstatSync(socketPath);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT") {
+            return { ok: false, status: "dead", layout: "absent", reason: `app-server socket is absent: ${socketPath}` };
         }
-        if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+        return { ok: false, status: "indeterminate", reason: error instanceof Error ? error.message : String(error) };
+    }
+    if (stat.isSymbolicLink())
+        return checkCodexRendezvousAlias(socketPath, stat, euid, deps);
+    if (!stat.isSocket()) {
+        return { ok: false, status: "indeterminate", reason: `app-server path is not a socket: ${socketPath}` };
+    }
+    if (euid !== undefined && stat.uid !== euid) {
+        return {
+            ok: false,
+            status: "indeterminate",
+            reason: `app-server socket is owned by uid ${stat.uid}, not the effective uid ${euid}`,
+        };
+    }
+    return { ok: true, connectPath: socketPath };
+}
+function checkCodexRendezvousAlias(socketPath, link, euid, deps) {
+    const refuse = (reason) => ({ ok: false, status: "indeterminate", reason });
+    if (euid === undefined) {
+        return refuse(`app-server socket is a symlink and this platform has no effective uid to verify it: ${socketPath}`);
+    }
+    if (link.uid !== euid) {
+        return refuse(`app-server socket symlink is owned by uid ${link.uid}, not the effective uid ${euid}`);
+    }
+    let daemonRoot;
+    let expected;
+    let target;
+    try {
+        daemonRoot = deps.daemonRoot ?? path.join(fs.realpathSync("/tmp"), `codex-daemon-${euid}`);
+        const canonical = path.join(fs.realpathSync(path.dirname(socketPath)), path.basename(socketPath));
+        expected = path.join(daemonRoot, crypto.createHash("sha256").update(canonical).digest("hex"));
+        target = fs.readlinkSync(socketPath);
+    }
+    catch (error) {
+        return refuse(`could not verify the app-server socket symlink ${socketPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (target !== expected) {
+        return refuse(`app-server socket is a symlink that is not Codex's rendezvous alias: ${socketPath} -> ${target}`);
+    }
+    let directory;
+    try {
+        directory = fs.lstatSync(daemonRoot);
+    }
+    catch (error) {
+        return refuse(`Codex's socket directory cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!directory.isDirectory() || directory.uid !== euid || (directory.mode & 0o777) !== 0o700) {
+        return refuse(`Codex's socket directory ${daemonRoot} must be a real directory owned by uid ${euid} with mode 0700`);
+    }
+    let physical;
+    try {
+        physical = fs.lstatSync(expected);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
             return {
                 ok: false,
-                status: "indeterminate",
-                reason: `app-server socket is owned by uid ${stat.uid}, not ${process.getuid()}`,
+                status: "dead",
+                layout: "dangling-alias",
+                reason: `app-server socket is a dangling rendezvous alias: ${socketPath} -> ${expected}`,
             };
         }
-        return { ok: true };
+        return refuse(error instanceof Error ? error.message : String(error));
     }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOENT")
-            return { ok: false, status: "dead", reason: `app-server socket is absent: ${socketPath}` };
-        return { ok: false, status: "indeterminate", reason: error instanceof Error ? error.message : String(error) };
+    if (!physical.isSocket() || physical.uid !== euid || (physical.mode & 0o077) !== 0) {
+        return refuse(`Codex's physical socket ${expected} must be a socket owned by uid ${euid} that no group or other user can open`);
     }
+    return { ok: true, connectPath: expected };
 }
 function promiseResolvers() {
     return Promise.withResolvers();
@@ -302,10 +380,13 @@ const realCodexExecRunner = {
     },
 };
 export async function probeCodexThread(nativeSessionId, deps = {}) {
-    const socketPath = resolveCodexDefaultSocketPath(deps.env ?? process.env);
-    const socketCheck = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+    const socketCheck = (deps.checkSocket ?? checkCodexSocketFile)(resolveCodexDefaultSocketPath(deps.env ?? process.env));
     if (!socketCheck.ok)
         return { status: socketCheck.status, reason: socketCheck.reason };
+    // The probe, and the queue send its route carries, both use the endpoint just verified. The
+    // advertised path is not resolved again: on 0.162.1 it is an alias that could be retargeted
+    // between the check and a second transport.
+    const socketPath = socketCheck.connectPath;
     let protocol;
     try {
         protocol = await (deps.openProtocol ?? realCodexProtocolOpener).open(socketPath);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-runtime.js

@@ -3,9 +3,9 @@
  * under (#129 W, #130).
  *
  * The experimental durable app is source-only upstream: published `@earendil-works/pi-coding-agent`
- * ships no `dist/experimental`. Entwurf therefore ships the app itself as a CARRIER — the pinned
- * upstream files, type-stripped and relocated (pi/pi-durable/carrier/, emitted only by the
- * maintainer's scripts/emit-pi-durable-carrier.ts) — and declares the published SDK set it runs
+ * ships no `dist/experimental`. Entwurf therefore ships the app itself as a CARRIER — its owned
+ * source (pi/pi-durable/src, #141), type-stripped and relocated (pi/pi-durable/carrier/, emitted only
+ * by scripts/emit-pi-durable-carrier.ts) — and declares the published SDK set it runs
  * against as exact production dependencies. Nothing is provisioned beside the package: there is no
  * runtime directory, no source checkout and no model data to copy (it rides the published pi-ai).
  *

package/mcp/entwurf-bridge/dist/pi-extensions/lib/resume-launch-identity.js

@@ -19,11 +19,12 @@
  */
 import { existsSync } from "node:fs";
 import path from "node:path";
+import { AcpModelNotCuratedError, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { getEntwurfExplicitExtensions, readSessionIdentity } from "./entwurf-core.js";
 import { readAddressableMetaIdentity } from "./meta-session.js";
 /**
- * The ONE expected refusal on this leaf: the target is a citizen of a backend that has no
- * same-id resume at all.
+ * One of the TWO expected refusals on this leaf: the target is a citizen of a backend that has no
+ * same-id resume at all. The other is `AcpModelNotCuratedError` (#128, `acp/model-ids.js`).
  *
  * Everything else this function throws is a defect in the record, the transcript or the
  * environment — a stale path, a foreign session file, an unrecorded model, an unresolvable
@@ -126,11 +127,19 @@ export function resolveResumeLaunchIdentity(gardenId) {
     if (!identity.cwd) {
         throw new Error(`resume-launch-identity: ${gardenId} header has no cwd (the cold-resume authority, #9).`);
     }
+    // #128: the pair checked is the one the launch will EMIT, not the recorded provider alone —
+    // `getEntwurfExplicitExtensions` also routes a bare Claude model id to `entwurf`. Under that
+    // provider Pi resolves `--model` by substring, so a retired `claude-sonnet-5` would reopen on
+    // `cortex-claude-sonnet-5`. The record and transcript stay as they are; the resume is refused.
+    const provider = explicitExtensions.provider ?? identity.provider;
+    const model = explicitExtensions.modelOverride ?? resumeModel;
+    if (provider === PROVIDER_ID && !isCuratedAcpModelId(model))
+        throw new AcpModelNotCuratedError(model);
     return {
         sessionFile,
         cwd: identity.cwd,
         explicitExtensionArgs: explicitExtensions.args,
-        provider: explicitExtensions.provider ?? identity.provider,
-        model: explicitExtensions.modelOverride ?? resumeModel,
+        provider,
+        model,
     };
 }

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js

@@ -3,8 +3,9 @@
  *
  * WHAT THIS IS. The long-running durable app (`@earendil-works/pi-coding-agent`
  * `experimental/durable`, which upstream omits from its npm distribution — Entwurf's package
- * supplies it as a pinned carrier, #130, not as an operator prerequisite) owns its runtime, TUI,
- * models/auth, storage, prompt and recovery. This module is the whole Entwurf side of its contact:
+ * supplies it as a carrier emitted from its owned source, #130/#141, not as an operator
+ * prerequisite) owns its runtime, TUI, models/auth, storage, prompt and recovery. This module is
+ * the whole Entwurf side of its contact:
  *
  *   createPiDurableContact({ bridgeEntry })
  *     .extension          tools-only durable Extension, handed to the overlay's
@@ -49,14 +50,34 @@
  * bridge whose list differs: the callable bridge schema is the truth, the copy only has to agree.
  *
  * RECEIVE (self-fetch, announce-only). When the bootstrap hands `attach` the overlay's
- * `submitToRoot`, the contact arms a doorbell after the bridge is ready: mailbox, then signal,
+ * `submitToRoot` and `onFailed`, the contact arms a doorbell after the bridge is ready: mailbox, then signal,
  * then the watch, then a check that the record and this process's sender marker still name the
  * session, and only then the receiver marker. A fresh `.msg` is stamped `.msg.delivered` and
  * announced to the ROOT conversation as input; the body stays in the mailbox until the model
  * calls `entwurf_inbox_read`, which is the read receipt. The watch and the sender marker share
  * this process's pid, so the #101 owner join applies (`pi-durable-host`). A watch error, a
- * vanished signal, a failed ring, a rejected admission or close retires the doorbell — watch
- * closed, our own marker removed, the reason kept by name — and nothing retries it.
+ * vanished signal, a failed ring, a rejected admission, the session failing (at once, from the
+ * overlay's `onFailed`, not at the next ring — and before `attach` returns when it had already
+ * failed, with no receiver marker left behind) or close retires the doorbell — watch closed, our own
+ * marker removed, the reason kept by name — and nothing retries it.
+ *
+ * WITHDRAW (#140). Each notice is a native `followUp`, placed one per run; a read drains EVERY
+ * unread body. So after a read the notices still queued for that mail would each cost a turn and an
+ * empty read. The contact keeps the native `Submission` handle of each notice it admitted, with the
+ * `.msg` names that notice announced, only while that mail is unread. After every
+ * `entwurf_inbox_read` attempt — whatever its garden id or outcome — it lists its OWN mailbox once
+ * and withdraws, through the native `Submission.abort` and the read's own invocation Context, each
+ * notice none of whose names is still `.msg.delivered`. That per-notice file predicate is the only
+ * authority: no garden-id guard, no requestId lookup, no queue of our own, no rewritten text. A placed
+ * or settled notice answers so and is let go; a withdraw that fails is let go too, named in one
+ * stderr line and on the receiver report, never retried and never retiring the doorbell; a mailbox
+ * that cannot be listed proves nothing absent, so every notice is kept and that is named the same
+ * way. The read's own result or error is returned unchanged — no diagnostic joins it. Ring passes
+ * and reads share one gate: a read waits for an admission in flight (else its drain could beat the
+ * handle it must withdraw), and an arrival during a read is rung once the read lets go. The count
+ * in a notice is its admission-time snapshot. Not covered: notices admitted before a restart (no
+ * handle), mail drained by another process (until this contact's next read), and operator abort,
+ * which natively withdraws queued notices while their mail stays unread.
  *
  * VISIBLE IDENTITY (a static projection). `withGardenIdentity` hands the native TUI a view whose
  * every conversation label carries this citizen's garden id, so the footer the TUI keeps on screen
@@ -79,7 +100,8 @@
  *
  * NOT HERE: crash-safe receive. `entwurf_inbox_read` archives a body before the durable tool
  * result commits, so a crash between the two loses that body to the model; recovery settles the
- * call as interrupted and no doorbell rings again. No resume.
+ * call as interrupted and no doorbell rings again. A drain that fails part-way has archived the
+ * bodies before it (the bridge returns its error), and those too never reach the model. No resume.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -461,10 +483,11 @@ export function createPiDurableContact(options) {
                 throw new Error(`${name} arguments must be an object`);
             }
             const client = await waitReady(context?.abortSignal);
-            const result = await client.callTool(name, (args ?? {}), context?.abortSignal);
+            const call = () => client.callTool(name, (args ?? {}), context?.abortSignal);
+            const result = name === "entwurf_inbox_read" ? await readInbox(call, context) : await call();
             if (result.isError)
                 throw new Error(result.text || `${name} failed`);
-            return { content: [{ type: "text", text: result.text }] };
+            return { output: [{ type: "text", text: result.text }] };
         },
     });
     const extension = {
@@ -475,8 +498,33 @@ export function createPiDurableContact(options) {
     let doorbell = null;
     let report = { status: "off" };
     const admissions = [];
-    let ringing = false;
+    /** The armed mailbox, kept past a retirement so notices admitted before it can still be judged. */
+    let inbox = null;
+    /** Every admitted notice still owed a withdraw judgement, oldest first. */
+    const notices = [];
+    let withdrawalFailure;
+    // One gate for ring passes and inbox reads; `pending` is a signal that landed while it was held.
+    let gated = false;
     let pending = false;
+    const gateWaiters = [];
+    const enterGate = () => {
+        if (!gated) {
+            gated = true;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => gateWaiters.push(resolve));
+    };
+    /** Hand the gate to the next waiting read, else open it — and ring once for a signal that landed meanwhile. */
+    const leaveGate = () => {
+        const next = gateWaiters.shift();
+        if (next !== undefined) {
+            next();
+            return;
+        }
+        gated = false;
+        if (pending)
+            void ring("signal");
+    };
     /**
      * Give the doorbell back: close the watch and remove the marker, in one step, because a
      * closed watch under a surviving marker is the false deliverability this unit refuses. Only a
@@ -489,6 +537,7 @@ export function createPiDurableContact(options) {
         if (armed === null)
             return [];
         doorbell = null;
+        armed.unsubscribeFailed();
         const problems = [];
         try {
             armed.watcher.close();
@@ -520,20 +569,20 @@ export function createPiDurableContact(options) {
     /**
      * One contract with the other self-fetch doorbells: a fresh `*.msg` is the trigger, it is
      * stamped `.msg.delivered` before the announce, and the announced count is every
-     * `.msg.delivered`. Events that land while an admission is in flight coalesce into one more
-     * pass. A failed pass retires the doorbell; it is not retried. Only a fresh `.msg` rings —
-     * the startup pass included — so a `.msg.delivered` left undrained by an earlier host is not
-     * announced again on its own; it shows only in the count of the next fresh arrival.
+     * `.msg.delivered`. Events that land while an admission or an inbox read holds the gate coalesce
+     * into one more pass. A failed pass retires the doorbell; it is not retried. Only a fresh `.msg`
+     * rings — the startup pass included — so a `.msg.delivered` left undrained by an earlier host is
+     * not announced again on its own; it shows only in the count of the next fresh arrival.
      */
     const ring = async (why) => {
         const armed = doorbell;
         if (armed === null)
             return;
-        if (ringing) {
+        if (gated) {
             pending = true;
             return;
         }
-        ringing = true;
+        gated = true;
         try {
             do {
                 pending = false;
@@ -568,22 +617,83 @@ export function createPiDurableContact(options) {
                 }
                 // Latest only: the diagnostic names the LAST success and never grows with the host's lifetime.
                 admissions.splice(0, admissions.length, { why, requestId, submissionId: submission.id, fresh, unread });
+                notices.push({ requestId, fresh, submission });
             } while (pending && doorbell === armed);
         }
         catch (error) {
             retire("doorbell-failed", describeError(error));
         }
         finally {
-            ringing = false;
+            leaveGate();
+        }
+    };
+    /**
+     * One named stderr line per failed withdrawal — stderr ALWAYS, as `entwurf-control` does, since
+     * nothing in the native app reads the receiver report — and the report keeps the latest one.
+     */
+    const noteWithdrawalFailure = (failure) => {
+        withdrawalFailure = failure;
+        const subject = failure.requestId === undefined ? "" : ` ${failure.requestId}`;
+        const detail = failure.detail.replace(/\s+/g, " ");
+        process.stderr.write(`[entwurf pi-durable] notice withdrawal ${failure.reason}${subject}: ${detail}\n`);
+    };
+    /**
+     * Withdraw every held notice none of whose announced `.msg` names is still `.msg.delivered` in the
+     * armed mailbox, listed once. A mailbox that cannot be listed proves nothing absent: every notice
+     * is kept and that is named. A judged notice is let go whatever the native withdraw answers — or
+     * when it rejects, which is named and never retried — so no handle outlives its mail by more
+     * than one read. Never throws: the read's own answer is what the caller gets.
+     */
+    const withdrawDrained = async (context) => {
+        if (inbox === null || notices.length === 0)
+            return;
+        let unread;
+        try {
+            unread = new Set(fs.readdirSync(inbox).filter((name) => name.endsWith(".msg.delivered")));
+        }
+        catch (error) {
+            noteWithdrawalFailure({ reason: "inspection-failed", detail: `${inbox}: ${describeError(error)}` });
+            return;
+        }
+        for (const notice of [...notices]) {
+            if (notice.fresh.some((name) => unread.has(`${name}.delivered`)))
+                continue;
+            notices.splice(notices.indexOf(notice), 1);
+            try {
+                await notice.submission.abort(context);
+            }
+            catch (error) {
+                noteWithdrawalFailure({ reason: "abort-failed", requestId: notice.requestId, detail: describeError(error) });
+            }
+        }
+    };
+    /**
+     * An inbox read under the doorbell's gate, then the withdrawal its drain made due — after a
+     * failed read too, whose partial drain may already have archived mail. The bridge's own answer,
+     * result or rejection, is returned unchanged.
+     */
+    const readInbox = async (call, context) => {
+        await enterGate();
+        try {
+            return await call();
+        }
+        finally {
+            try {
+                await withdrawDrained(context);
+            }
+            finally {
+                leaveGate();
+            }
         }
     };
     /**
      * Mailbox, signal, watch — then the check that the record and this process's sender marker
      * still name the session — and only then the receiver marker, the one fact a sender reads.
      * Synchronous, so nothing can close the contact between the check and the publish. Throws,
-     * after closing whatever it opened, when any step fails.
+     * after closing whatever it opened, when any step fails. Returns null when the session had
+     * already failed: the doorbell was retired as `session-failed` before this returned.
      */
-    const arm = (gardenId, nativeSessionId, ownerPid, roots, submitToRoot) => {
+    const arm = (gardenId, nativeSessionId, ownerPid, roots, root) => {
         if (ownerPid !== process.pid) {
             throw new Error(`the doorbell's watch lives in this process (${process.pid}); a receiver marker naming owner ${ownerPid} would advertise a watch that pid does not hold`);
         }
@@ -593,6 +703,7 @@ export function createPiDurableContact(options) {
         if (!fs.existsSync(signal))
             fs.writeFileSync(signal, "", { mode: 0o600 });
         const watcher = watch(signal, () => void ring("signal"));
+        let unsubscribeFailed = () => { };
         try {
             watcher.on("error", (error) => retire("watch-error", describeError(error)));
             const identity = readAddressableMetaIdentity(gardenId, roots.sessionsDir);
@@ -605,6 +716,22 @@ export function createPiDurableContact(options) {
                     ? `no live sender marker for owner ${ownerPid}`
                     : `the sender marker for owner ${ownerPid} names ${sender.gardenId}/${sender.nativeSessionId}, not ${gardenId}/${nativeSessionId}`);
             }
+            // A failed session admits nothing: retire at once, so no sender reads a marker for a host that cannot wake.
+            // Subscribed before the marker is written, so a registration that throws leaves no marker. A session that
+            // failed before this arm says so during the subscription, before the doorbell exists: that is noted, and
+            // the retirement runs once the doorbell is published below. It is final; nothing re-arms.
+            let published = false;
+            let failedBeforePublished = false;
+            const sessionFailed = () => {
+                if (!published) {
+                    failedBeforePublished = true;
+                    return;
+                }
+                const problems = retire("session-failed", "the durable session failed and closed itself");
+                if (problems.length > 0)
+                    throw new Error(`the doorbell did not retire cleanly: ${problems.join("; ")}`);
+            };
+            unsubscribeFailed = root.onFailed(sessionFailed);
             const markerPath = writeMetaReceiverMarker({
                 gardenId,
                 backend: PI_DURABLE_BACKEND,
@@ -614,16 +741,37 @@ export function createPiDurableContact(options) {
                 armProvenance: "session-start",
                 receiversDir: roots.receiversDir,
             });
-            doorbell = { gardenId, ownerPid, mailbox, signal, markerPath, watcher, submitToRoot };
+            doorbell = {
+                gardenId,
+                ownerPid,
+                mailbox,
+                signal,
+                markerPath,
+                watcher,
+                submitToRoot: root.submitToRoot,
+                unsubscribeFailed,
+            };
+            inbox = mailbox;
             report = { status: "armed", gardenId, markerPath, admissions };
+            published = true;
+            if (failedBeforePublished) {
+                sessionFailed();
+                return null;
+            }
             return markerPath;
         }
         catch (error) {
-            try {
-                watcher.close();
+            const cleanup = [];
+            for (const step of [unsubscribeFailed, () => watcher.close()]) {
+                try {
+                    step();
+                }
+                catch (cleanupError) {
+                    cleanup.push(cleanupError);
+                }
             }
-            catch (closeError) {
-                throw new AggregateError([error, closeError], `${describeError(error)} (cleanup also failed: ${describeError(closeError)})`);
+            if (cleanup.length > 0) {
+                throw new AggregateError([error, ...cleanup], `${describeError(error)} (cleanup also failed: ${cleanup.map(describeError).join("; ")})`);
             }
             throw error;
         }
@@ -651,6 +799,9 @@ export function createPiDurableContact(options) {
                 if (root !== undefined && typeof root.submitToRoot !== "function") {
                     throw new Error("the root admission handed to attach has no submitToRoot function");
                 }
+                if (root !== undefined && typeof root.onFailed !== "function") {
+                    throw new Error("the root admission handed to attach has no onFailed function");
+                }
                 const ownerPid = options.ownerPid ?? process.pid;
                 const sendersDir = path.resolve(options.sendersDir ?? defaultMetaSendersDir());
                 const upsert = upsertMetaSession({
@@ -700,7 +851,7 @@ export function createPiDurableContact(options) {
                 let receiverMarkerPath = null;
                 if (root !== undefined) {
                     try {
-                        receiverMarkerPath = arm(gardenId, id, ownerPid, roots, root.submitToRoot);
+                        receiverMarkerPath = arm(gardenId, id, ownerPid, roots, root);
                     }
                     catch (error) {
                         return await failAfterCleanup(new Error(`the doorbell did not arm: ${describeError(error)}`), () => client.close());
@@ -731,13 +882,15 @@ export function createPiDurableContact(options) {
             settleFailed(describeError(error));
         },
         receiver() {
-            return report;
+            return withdrawalFailure === undefined || report.status === "off" ? report : { ...report, withdrawalFailure };
         },
         async close() {
             const previous = state;
             settleFailed("the contact closed before attach completed");
             state = { kind: "closed" };
             const client = previous.kind === "ready" ? previous.client : undefined;
+            // Queued notices stay native (a continued session places them); this contact judges no more.
+            notices.length = 0;
             await closeAll(disarmOnClose, async () => {
                 await client?.close();
             });

package/mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js

@@ -0,0 +1,44 @@
+/**
+ * codex-socket-classify — classify the Codex app-server default control socket for THIS
+ * environment, through the one product classifier, and print the answer for a shell.
+ *
+ * WHY A LEAF. `entwurf codex-app-server` is a bash launcher, and it has to decide whether a
+ * launch would clobber something. From Codex 0.162.1 the advertised socket path is a
+ * rendezvous alias into a vendor-owned directory, and telling the vendor's exact alias from any
+ * other symlink takes a hash, an exact readlink comparison and ownership/mode checks. Doing that
+ * in the launcher's Python would be a second implementation of a security classification, and
+ * `codex-socket-path.ts` records what a second spelling of this socket did once (it diverged).
+ * So the launcher asks `checkCodexSocketFile`, the classifier delivery and preflight use, and
+ * only connects to what it was told.
+ *
+ * HOW IT IS REACHED. The launcher runs this file's COMPILED twin,
+ * `mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`, directly with `node` — in a checkout
+ * and in an installed package alike. There is no `run.sh` verb and no `run_ts` crossing for it:
+ * `build-bridge` emits it (`pnpm install` runs that through `prepare`, packing through `prepack`),
+ * and a missing twin is an incomplete installation the launcher refuses by name.
+ *
+ * One line on stdout, a word then a tab-separated detail:
+ *   socket <connectPath>       a verified socket; the launcher connects there to tell live from stale
+ *   absent                     nothing at the advertised path
+ *   dangling <reason>          Codex's own alias whose socket is gone; the vendor removes it on start
+ *   indeterminate <reason>     anything else; the launcher refuses
+ *
+ * Reads `process.env` and takes no argument, for the reason `codex-socket-path.ts` gives: an argv
+ * seam would be a way to redirect the address. It has no daemon-root input either; the gate's
+ * exact-alias cells drive `checkCodexSocketFile` directly with a sandbox root.
+ */
+import { checkCodexSocketFile, resolveCodexDefaultSocketPath, } from "../pi-extensions/lib/native-push/codex-ws-client.js";
+if (process.argv.length > 2) {
+    console.error("usage: codex-socket-classify   (no arguments; the environment is the input)");
+    process.exit(2);
+}
+const oneLine = (text) => text.replace(/[\t\r\n]+/g, " ");
+const check = checkCodexSocketFile(resolveCodexDefaultSocketPath(process.env));
+if (check.ok)
+    process.stdout.write(`socket\t${check.connectPath}`);
+else if (check.status === "dead" && check.layout === "absent")
+    process.stdout.write("absent");
+else if (check.status === "dead")
+    process.stdout.write(`dangling\t${oneLine(check.reason)}`);
+else
+    process.stdout.write(`indeterminate\t${oneLine(check.reason)}`);

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -122,6 +122,10 @@
 	// twin would make the one-command launch die before its first line. Its only repo import is
 	// native-push/codex-ws-client.ts, ALREADY emitted for meta-bridge-hook-codex, so this adds ONE
 	// leaf JS and ZERO new deps.
+	// WHY codex-socket-classify rides THIS build (#141): the same launcher asks it whether a launch
+	// would clobber something, and runs THIS compiled twin directly with `node` in a checkout and an
+	// installed package alike (no run.sh verb, no run_ts crossing), so the emitted file is the only
+	// route. Its only repo import is that same codex-ws-client.ts: ONE leaf JS, ZERO new deps.
 	// WHY meta-bridge-pi-durable rides THIS build (#129 W, L4): the packaged durable bootstrap
 	// (pi/pi-durable/bootstrap.mjs) imports the contact from THIS closure — the same closure whose
 	// bridge entry the contact spawns and whose meta-bridge-omp.js decodes the first-input payload —
@@ -151,6 +155,7 @@
 		"../../scripts/peer-facts.ts",
 		"../../scripts/omp-receive-facts.ts",
 		"../../scripts/codex-socket-path.ts",
+		"../../scripts/codex-socket-classify.ts",
 		"../../pi-extensions/meta-bridge-hook.ts",
 		"../../pi-extensions/meta-bridge-hook-copilot.ts",
 		"../../pi-extensions/meta-bridge-hook-codex.ts",