@junghanacs/entwurf 0.35.1 → 0.36.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/native-push/codex-ws-client.js

@@ -15,30 +15,108 @@ export function resolveCodexHome(env) {
 export function resolveCodexDefaultSocketPath(env) {
     return path.join(resolveCodexHome(env), "app-server-control", "app-server-control.sock");
 }
-export function checkCodexSocketFile(socketPath) {
+/**
+ * The advertised path is exactly one of two layouts, and anything else is refused.
+ *
+ * (A) A plain socket owned by the effective uid: Codex up to 0.153.4 binds the advertised
+ *     path itself. `connectPath` is that path.
+ * (B) Codex's rendezvous alias. From 0.162.1 the advertised path "is only an alias": the
+ *     server binds a 0600 socket under `realpath(/tmp)/codex-daemon-<euid>/` named by the
+ *     sha256 of the canonical advertised path, then symlinks the advertised path to it
+ *     (`[source]` rust-v0.162.1 `app-server-transport/src/transport/unix_socket.rs:43-131,
+ *     290-304`; `uds/src/daemon_directory.rs:1-38`). Upstream's reason is a privileged
+ *     rendezvous root that sandboxes hide; the alias also keeps an over-long advertised path
+ *     usable (`uds/src/lib.rs:167-174`). The alias is accepted only when every hop is the
+ *     vendor's own: the link is owned by the effective uid; its target is BYTE-EQUAL to the
+ *     path Codex derives (a relative, foreign, re-hashed or chained target is refused); the
+ *     daemon directory is a real directory owned by the effective uid with `mode & 0o777`
+ *     exactly 0700, the vendor's own rule; and the target is a socket owned by the effective
+ *     uid that no group or other user can open. `connectPath` is the verified target, so the
+ *     alias is never re-resolved between this check and the connect. A same-euid process can
+ *     still replace the verified socket file itself; that residual is named, not locked.
+ *
+ * Only `lstat` and one `readlink` touch the alias; it is never followed or `realpath`ed.
+ * The effective uid is the vendor's (`libc::geteuid`), not the real uid.
+ */
+export function checkCodexSocketFile(socketPath, deps = {}) {
+    const euid = deps.euid ?? process.geteuid?.();
+    let stat;
     try {
-        const stat = fs.lstatSync(socketPath);
-        if (stat.isSymbolicLink()) {
-            return { ok: false, status: "indeterminate", reason: `app-server socket is a symlink: ${socketPath}` };
-        }
-        if (!stat.isSocket()) {
-            return { ok: false, status: "indeterminate", reason: `app-server path is not a socket: ${socketPath}` };
+        stat = fs.lstatSync(socketPath);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT") {
+            return { ok: false, status: "dead", layout: "absent", reason: `app-server socket is absent: ${socketPath}` };
         }
-        if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+        return { ok: false, status: "indeterminate", reason: error instanceof Error ? error.message : String(error) };
+    }
+    if (stat.isSymbolicLink())
+        return checkCodexRendezvousAlias(socketPath, stat, euid, deps);
+    if (!stat.isSocket()) {
+        return { ok: false, status: "indeterminate", reason: `app-server path is not a socket: ${socketPath}` };
+    }
+    if (euid !== undefined && stat.uid !== euid) {
+        return {
+            ok: false,
+            status: "indeterminate",
+            reason: `app-server socket is owned by uid ${stat.uid}, not the effective uid ${euid}`,
+        };
+    }
+    return { ok: true, connectPath: socketPath };
+}
+function checkCodexRendezvousAlias(socketPath, link, euid, deps) {
+    const refuse = (reason) => ({ ok: false, status: "indeterminate", reason });
+    if (euid === undefined) {
+        return refuse(`app-server socket is a symlink and this platform has no effective uid to verify it: ${socketPath}`);
+    }
+    if (link.uid !== euid) {
+        return refuse(`app-server socket symlink is owned by uid ${link.uid}, not the effective uid ${euid}`);
+    }
+    let daemonRoot;
+    let expected;
+    let target;
+    try {
+        daemonRoot = deps.daemonRoot ?? path.join(fs.realpathSync("/tmp"), `codex-daemon-${euid}`);
+        const canonical = path.join(fs.realpathSync(path.dirname(socketPath)), path.basename(socketPath));
+        expected = path.join(daemonRoot, crypto.createHash("sha256").update(canonical).digest("hex"));
+        target = fs.readlinkSync(socketPath);
+    }
+    catch (error) {
+        return refuse(`could not verify the app-server socket symlink ${socketPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (target !== expected) {
+        return refuse(`app-server socket is a symlink that is not Codex's rendezvous alias: ${socketPath} -> ${target}`);
+    }
+    let directory;
+    try {
+        directory = fs.lstatSync(daemonRoot);
+    }
+    catch (error) {
+        return refuse(`Codex's socket directory cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!directory.isDirectory() || directory.uid !== euid || (directory.mode & 0o777) !== 0o700) {
+        return refuse(`Codex's socket directory ${daemonRoot} must be a real directory owned by uid ${euid} with mode 0700`);
+    }
+    let physical;
+    try {
+        physical = fs.lstatSync(expected);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
             return {
                 ok: false,
-                status: "indeterminate",
-                reason: `app-server socket is owned by uid ${stat.uid}, not ${process.getuid()}`,
+                status: "dead",
+                layout: "dangling-alias",
+                reason: `app-server socket is a dangling rendezvous alias: ${socketPath} -> ${expected}`,
             };
         }
-        return { ok: true };
+        return refuse(error instanceof Error ? error.message : String(error));
     }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOENT")
-            return { ok: false, status: "dead", reason: `app-server socket is absent: ${socketPath}` };
-        return { ok: false, status: "indeterminate", reason: error instanceof Error ? error.message : String(error) };
+    if (!physical.isSocket() || physical.uid !== euid || (physical.mode & 0o077) !== 0) {
+        return refuse(`Codex's physical socket ${expected} must be a socket owned by uid ${euid} that no group or other user can open`);
     }
+    return { ok: true, connectPath: expected };
 }
 function promiseResolvers() {
     return Promise.withResolvers();
@@ -302,10 +380,13 @@ const realCodexExecRunner = {
     },
 };
 export async function probeCodexThread(nativeSessionId, deps = {}) {
-    const socketPath = resolveCodexDefaultSocketPath(deps.env ?? process.env);
-    const socketCheck = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+    const socketCheck = (deps.checkSocket ?? checkCodexSocketFile)(resolveCodexDefaultSocketPath(deps.env ?? process.env));
     if (!socketCheck.ok)
         return { status: socketCheck.status, reason: socketCheck.reason };
+    // The probe, and the queue send its route carries, both use the endpoint just verified. The
+    // advertised path is not resolved again: on 0.162.1 it is an alias that could be retargeted
+    // between the check and a second transport.
+    const socketPath = socketCheck.connectPath;
     let protocol;
     try {
         protocol = await (deps.openProtocol ?? realCodexProtocolOpener).open(socketPath);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-runtime.js

@@ -3,9 +3,9 @@
  * under (#129 W, #130).
  *
  * The experimental durable app is source-only upstream: published `@earendil-works/pi-coding-agent`
- * ships no `dist/experimental`. Entwurf therefore ships the app itself as a CARRIER — the pinned
- * upstream files, type-stripped and relocated (pi/pi-durable/carrier/, emitted only by the
- * maintainer's scripts/emit-pi-durable-carrier.ts) — and declares the published SDK set it runs
+ * ships no `dist/experimental`. Entwurf therefore ships the app itself as a CARRIER — its owned
+ * source (pi/pi-durable/src, #141), type-stripped and relocated (pi/pi-durable/carrier/, emitted only
+ * by scripts/emit-pi-durable-carrier.ts) — and declares the published SDK set it runs
  * against as exact production dependencies. Nothing is provisioned beside the package: there is no
  * runtime directory, no source checkout and no model data to copy (it rides the published pi-ai).
  *

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js

@@ -3,8 +3,9 @@
  *
  * WHAT THIS IS. The long-running durable app (`@earendil-works/pi-coding-agent`
  * `experimental/durable`, which upstream omits from its npm distribution — Entwurf's package
- * supplies it as a pinned carrier, #130, not as an operator prerequisite) owns its runtime, TUI,
- * models/auth, storage, prompt and recovery. This module is the whole Entwurf side of its contact:
+ * supplies it as a carrier emitted from its owned source, #130/#141, not as an operator
+ * prerequisite) owns its runtime, TUI, models/auth, storage, prompt and recovery. This module is
+ * the whole Entwurf side of its contact:
  *
  *   createPiDurableContact({ bridgeEntry })
  *     .extension          tools-only durable Extension, handed to the overlay's
@@ -49,14 +50,16 @@
  * bridge whose list differs: the callable bridge schema is the truth, the copy only has to agree.
  *
  * RECEIVE (self-fetch, announce-only). When the bootstrap hands `attach` the overlay's
- * `submitToRoot`, the contact arms a doorbell after the bridge is ready: mailbox, then signal,
+ * `submitToRoot` and `onFailed`, the contact arms a doorbell after the bridge is ready: mailbox, then signal,
  * then the watch, then a check that the record and this process's sender marker still name the
  * session, and only then the receiver marker. A fresh `.msg` is stamped `.msg.delivered` and
  * announced to the ROOT conversation as input; the body stays in the mailbox until the model
  * calls `entwurf_inbox_read`, which is the read receipt. The watch and the sender marker share
  * this process's pid, so the #101 owner join applies (`pi-durable-host`). A watch error, a
- * vanished signal, a failed ring, a rejected admission or close retires the doorbell — watch
- * closed, our own marker removed, the reason kept by name — and nothing retries it.
+ * vanished signal, a failed ring, a rejected admission, the session failing (at once, from the
+ * overlay's `onFailed`, not at the next ring — and before `attach` returns when it had already
+ * failed, with no receiver marker left behind) or close retires the doorbell — watch closed, our own
+ * marker removed, the reason kept by name — and nothing retries it.
  *
  * WITHDRAW (#140). Each notice is a native `followUp`, placed one per run; a read drains EVERY
  * unread body. So after a read the notices still queued for that mail would each cost a turn and an
@@ -484,7 +487,7 @@ export function createPiDurableContact(options) {
             const result = name === "entwurf_inbox_read" ? await readInbox(call, context) : await call();
             if (result.isError)
                 throw new Error(result.text || `${name} failed`);
-            return { content: [{ type: "text", text: result.text }] };
+            return { output: [{ type: "text", text: result.text }] };
         },
     });
     const extension = {
@@ -534,6 +537,7 @@ export function createPiDurableContact(options) {
         if (armed === null)
             return [];
         doorbell = null;
+        armed.unsubscribeFailed();
         const problems = [];
         try {
             armed.watcher.close();
@@ -686,9 +690,10 @@ export function createPiDurableContact(options) {
      * Mailbox, signal, watch — then the check that the record and this process's sender marker
      * still name the session — and only then the receiver marker, the one fact a sender reads.
      * Synchronous, so nothing can close the contact between the check and the publish. Throws,
-     * after closing whatever it opened, when any step fails.
+     * after closing whatever it opened, when any step fails. Returns null when the session had
+     * already failed: the doorbell was retired as `session-failed` before this returned.
      */
-    const arm = (gardenId, nativeSessionId, ownerPid, roots, submitToRoot) => {
+    const arm = (gardenId, nativeSessionId, ownerPid, roots, root) => {
         if (ownerPid !== process.pid) {
             throw new Error(`the doorbell's watch lives in this process (${process.pid}); a receiver marker naming owner ${ownerPid} would advertise a watch that pid does not hold`);
         }
@@ -698,6 +703,7 @@ export function createPiDurableContact(options) {
         if (!fs.existsSync(signal))
             fs.writeFileSync(signal, "", { mode: 0o600 });
         const watcher = watch(signal, () => void ring("signal"));
+        let unsubscribeFailed = () => { };
         try {
             watcher.on("error", (error) => retire("watch-error", describeError(error)));
             const identity = readAddressableMetaIdentity(gardenId, roots.sessionsDir);
@@ -710,6 +716,22 @@ export function createPiDurableContact(options) {
                     ? `no live sender marker for owner ${ownerPid}`
                     : `the sender marker for owner ${ownerPid} names ${sender.gardenId}/${sender.nativeSessionId}, not ${gardenId}/${nativeSessionId}`);
             }
+            // A failed session admits nothing: retire at once, so no sender reads a marker for a host that cannot wake.
+            // Subscribed before the marker is written, so a registration that throws leaves no marker. A session that
+            // failed before this arm says so during the subscription, before the doorbell exists: that is noted, and
+            // the retirement runs once the doorbell is published below. It is final; nothing re-arms.
+            let published = false;
+            let failedBeforePublished = false;
+            const sessionFailed = () => {
+                if (!published) {
+                    failedBeforePublished = true;
+                    return;
+                }
+                const problems = retire("session-failed", "the durable session failed and closed itself");
+                if (problems.length > 0)
+                    throw new Error(`the doorbell did not retire cleanly: ${problems.join("; ")}`);
+            };
+            unsubscribeFailed = root.onFailed(sessionFailed);
             const markerPath = writeMetaReceiverMarker({
                 gardenId,
                 backend: PI_DURABLE_BACKEND,
@@ -719,17 +741,37 @@ export function createPiDurableContact(options) {
                 armProvenance: "session-start",
                 receiversDir: roots.receiversDir,
             });
-            doorbell = { gardenId, ownerPid, mailbox, signal, markerPath, watcher, submitToRoot };
+            doorbell = {
+                gardenId,
+                ownerPid,
+                mailbox,
+                signal,
+                markerPath,
+                watcher,
+                submitToRoot: root.submitToRoot,
+                unsubscribeFailed,
+            };
             inbox = mailbox;
             report = { status: "armed", gardenId, markerPath, admissions };
+            published = true;
+            if (failedBeforePublished) {
+                sessionFailed();
+                return null;
+            }
             return markerPath;
         }
         catch (error) {
-            try {
-                watcher.close();
+            const cleanup = [];
+            for (const step of [unsubscribeFailed, () => watcher.close()]) {
+                try {
+                    step();
+                }
+                catch (cleanupError) {
+                    cleanup.push(cleanupError);
+                }
             }
-            catch (closeError) {
-                throw new AggregateError([error, closeError], `${describeError(error)} (cleanup also failed: ${describeError(closeError)})`);
+            if (cleanup.length > 0) {
+                throw new AggregateError([error, ...cleanup], `${describeError(error)} (cleanup also failed: ${cleanup.map(describeError).join("; ")})`);
             }
             throw error;
         }
@@ -757,6 +799,9 @@ export function createPiDurableContact(options) {
                 if (root !== undefined && typeof root.submitToRoot !== "function") {
                     throw new Error("the root admission handed to attach has no submitToRoot function");
                 }
+                if (root !== undefined && typeof root.onFailed !== "function") {
+                    throw new Error("the root admission handed to attach has no onFailed function");
+                }
                 const ownerPid = options.ownerPid ?? process.pid;
                 const sendersDir = path.resolve(options.sendersDir ?? defaultMetaSendersDir());
                 const upsert = upsertMetaSession({
@@ -806,7 +851,7 @@ export function createPiDurableContact(options) {
                 let receiverMarkerPath = null;
                 if (root !== undefined) {
                     try {
-                        receiverMarkerPath = arm(gardenId, id, ownerPid, roots, root.submitToRoot);
+                        receiverMarkerPath = arm(gardenId, id, ownerPid, roots, root);
                     }
                     catch (error) {
                         return await failAfterCleanup(new Error(`the doorbell did not arm: ${describeError(error)}`), () => client.close());

package/mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js

@@ -0,0 +1,44 @@
+/**
+ * codex-socket-classify — classify the Codex app-server default control socket for THIS
+ * environment, through the one product classifier, and print the answer for a shell.
+ *
+ * WHY A LEAF. `entwurf codex-app-server` is a bash launcher, and it has to decide whether a
+ * launch would clobber something. From Codex 0.162.1 the advertised socket path is a
+ * rendezvous alias into a vendor-owned directory, and telling the vendor's exact alias from any
+ * other symlink takes a hash, an exact readlink comparison and ownership/mode checks. Doing that
+ * in the launcher's Python would be a second implementation of a security classification, and
+ * `codex-socket-path.ts` records what a second spelling of this socket did once (it diverged).
+ * So the launcher asks `checkCodexSocketFile`, the classifier delivery and preflight use, and
+ * only connects to what it was told.
+ *
+ * HOW IT IS REACHED. The launcher runs this file's COMPILED twin,
+ * `mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`, directly with `node` — in a checkout
+ * and in an installed package alike. There is no `run.sh` verb and no `run_ts` crossing for it:
+ * `build-bridge` emits it (`pnpm install` runs that through `prepare`, packing through `prepack`),
+ * and a missing twin is an incomplete installation the launcher refuses by name.
+ *
+ * One line on stdout, a word then a tab-separated detail:
+ *   socket <connectPath>       a verified socket; the launcher connects there to tell live from stale
+ *   absent                     nothing at the advertised path
+ *   dangling <reason>          Codex's own alias whose socket is gone; the vendor removes it on start
+ *   indeterminate <reason>     anything else; the launcher refuses
+ *
+ * Reads `process.env` and takes no argument, for the reason `codex-socket-path.ts` gives: an argv
+ * seam would be a way to redirect the address. It has no daemon-root input either; the gate's
+ * exact-alias cells drive `checkCodexSocketFile` directly with a sandbox root.
+ */
+import { checkCodexSocketFile, resolveCodexDefaultSocketPath, } from "../pi-extensions/lib/native-push/codex-ws-client.js";
+if (process.argv.length > 2) {
+    console.error("usage: codex-socket-classify   (no arguments; the environment is the input)");
+    process.exit(2);
+}
+const oneLine = (text) => text.replace(/[\t\r\n]+/g, " ");
+const check = checkCodexSocketFile(resolveCodexDefaultSocketPath(process.env));
+if (check.ok)
+    process.stdout.write(`socket\t${check.connectPath}`);
+else if (check.status === "dead" && check.layout === "absent")
+    process.stdout.write("absent");
+else if (check.status === "dead")
+    process.stdout.write(`dangling\t${oneLine(check.reason)}`);
+else
+    process.stdout.write(`indeterminate\t${oneLine(check.reason)}`);

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -122,6 +122,10 @@
 	// twin would make the one-command launch die before its first line. Its only repo import is
 	// native-push/codex-ws-client.ts, ALREADY emitted for meta-bridge-hook-codex, so this adds ONE
 	// leaf JS and ZERO new deps.
+	// WHY codex-socket-classify rides THIS build (#141): the same launcher asks it whether a launch
+	// would clobber something, and runs THIS compiled twin directly with `node` in a checkout and an
+	// installed package alike (no run.sh verb, no run_ts crossing), so the emitted file is the only
+	// route. Its only repo import is that same codex-ws-client.ts: ONE leaf JS, ZERO new deps.
 	// WHY meta-bridge-pi-durable rides THIS build (#129 W, L4): the packaged durable bootstrap
 	// (pi/pi-durable/bootstrap.mjs) imports the contact from THIS closure — the same closure whose
 	// bridge entry the contact spawns and whose meta-bridge-omp.js decodes the first-input payload —
@@ -151,6 +155,7 @@
 		"../../scripts/peer-facts.ts",
 		"../../scripts/omp-receive-facts.ts",
 		"../../scripts/codex-socket-path.ts",
+		"../../scripts/codex-socket-classify.ts",
 		"../../pi-extensions/meta-bridge-hook.ts",
 		"../../pi-extensions/meta-bridge-hook-copilot.ts",
 		"../../pi-extensions/meta-bridge-hook-codex.ts",

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.35.1",
-	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
+	"version": "0.36.0",
+	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, reopen pi in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
 		"name": "Junghan Kim",
@@ -30,7 +30,12 @@
 		"copilot",
 		"antigravity",
 		"pi-coding-agent",
-		"pi-extension"
+		"pi-extension",
+		"herdr",
+		"tmux",
+		"visible-sessions",
+		"session-lifecycle",
+		"multi-agent"
 	],
 	"type": "module",
 	"files": [
@@ -59,7 +64,6 @@
 		"pi/pi-durable/carrier-resolver.mjs",
 		"pi/pi-durable/carrier/",
 		"pi/pi-durable/overlay/upstream-pin.json",
-		"pi/pi-durable/overlay/runtime-contacts.patch",
 		"pi/meta-bridge/.claude-plugin/marketplace.json",
 		"pi/meta-bridge/entwurf-meta-receive/.claude-plugin/plugin.json",
 		"pi/meta-bridge/entwurf-meta-receive/hooks/hooks.json",
@@ -95,15 +99,15 @@
 		"@agentclientprotocol/claude-agent-acp": "0.85.1",
 		"@agentclientprotocol/sdk": "1.6.0",
 		"@anthropic-ai/sdk": "0.100.1",
-		"@earendil-works/chord": "1.1.0",
-		"@earendil-works/pi-agent-core": "1.1.0",
-		"@earendil-works/pi-ai": "1.1.0",
-		"@earendil-works/pi-codemode": "1.1.0",
-		"@earendil-works/pi-coding-agent": "1.1.0",
-		"@earendil-works/pi-durable": "1.1.0",
-		"@earendil-works/pi-mcp": "1.1.0",
-		"@earendil-works/pi-telemetry": "1.1.0",
-		"@earendil-works/pi-tui": "1.1.0",
+		"@earendil-works/chord": "1.2.0",
+		"@earendil-works/pi-agent-core": "1.2.0",
+		"@earendil-works/pi-ai": "1.2.0",
+		"@earendil-works/pi-codemode": "1.2.0",
+		"@earendil-works/pi-coding-agent": "1.2.0",
+		"@earendil-works/pi-durable": "1.2.0",
+		"@earendil-works/pi-mcp": "1.2.0",
+		"@earendil-works/pi-telemetry": "1.2.0",
+		"@earendil-works/pi-tui": "1.2.0",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"proper-lockfile": "4.1.2",
 		"smol-toml": "^1.8.0",
@@ -115,6 +119,7 @@
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
 		"@types/node": "^24.3.0",
+		"@types/proper-lockfile": "4.1.4",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
 		"typescript": "^6.0.2",
@@ -178,7 +183,7 @@
 		"test": "vitest run",
 		"test:watch": "vitest",
 		"test:pack": "pnpm run check-pack && pnpm run check-pack-install",
-		"typecheck": "tsc --noEmit && tsc -p mcp/tsconfig.json && tsc -p scripts/tsconfig.json",
+		"typecheck": "tsc --noEmit && tsc -p mcp/tsconfig.json && tsc -p scripts/tsconfig.json && tsc -p pi/pi-durable/tsconfig.json",
 		"lint": "biome check .",
 		"format": "biome check --write .",
 		"check-meta-manifest-schema": "./run.sh check-meta-manifest-schema",

package/pi/pi-durable/bootstrap.mjs

@@ -9,15 +9,16 @@
 // with these differences:
 // - Entwurf's tools-only extension is handed to `openDurable`;
 // - a NEW session is opened with an explicit model and an explicit width, never a default (below);
-// - the citizen is born once `openDurable` returns, with the overlay's `submitToRoot` so its
-//   doorbell can announce mail to the root conversation;
+// - the citizen is born once `openDurable` returns, with the owned runtime's `submitToRoot` so its
+//   doorbell can announce mail to the root conversation, and its `onFailed` so a session that
+//   fails and closes itself retires that doorbell at once;
 // - a launcher's first input, when given, is admitted to the root ONCE, after that birth;
 // - the TUI is handed the native view with the garden id on every conversation label
 //   (`withGardenIdentity`).
 // Nothing of the native registry, controller or TUI is rebuilt here.
 //
-// The durable app itself is this package's CARRIER (./carrier/, the pinned upstream files emitted by
-// the maintainer — upstream publishes no experimental app), and it runs under the carrier's resolver,
+// The durable app itself is this package's CARRIER (./carrier/, emitted from Entwurf's owned source
+// pi/pi-durable/src — upstream publishes no experimental app), and it runs under the carrier's resolver,
 // which maps the app's pi-coding-agent internals to the published package the carrier resolves.
 // `entwurf pi-durable` (run.sh) verifies the carrier and its SDK set (pi-durable-runtime.ts) and
 // execs:
@@ -29,11 +30,11 @@
 //
 // Explicit means the native API, not a vendor argv: upstream's durable main takes only
 // `--continue`, so `--provider`/`--model` reach pi's own `findInitialAgentModel` through the
-// overlay's `model` option, for a new session only, and an unresolvable pair fails the open
+// owned runtime's `model` option, for a new session only, and an unresolvable pair fails the open
 // before any citizen is born (the native session directory may already exist by then). The model
 // must be one registered catalog model of that provider, named by its canonical id or by
 // `id:<level>` as pi's own parser reads a thinking level: a typo, a partial or case-variant match, a
-// provider-prefixed id or an unregistered custom-id fallback is refused by the overlay as
+// provider-prefixed id or an unregistered custom-id fallback is refused by the owned runtime as
 // `explicit-model-not-exact`, before the birth and the first input.
 // `--width task-wide` is the one width: no tool filter, so the model is offered exactly the tools
 // the installed extensions register. It is a statement of what is OFFERED, not an approval or
@@ -50,7 +51,7 @@
 // its initialization, and its default export is a native durable Extension, handed to `openDurable`
 // by reference after the contact. Initialization runs before the TUI or the runtime is imported —
 // the runtime creates the provider runtime before it installs any extension (carrier/runtime.js
-// 142-148), so an extension object cannot carry an environment phase. Entwurf checks only what the
+// 153-159), so an extension object cannot carry an environment phase. Entwurf checks only what the
 // ingress needs: a default export object with a name, no extension name the app installs itself (a
 // same-name install REPLACES), and no tool name of the contact. Every other field is the native
 // registry's to validate. The module is trusted operator code: the identity carriers and the
@@ -341,7 +342,10 @@ export async function openDurableCitizen({
 	}
 	let attachment;
 	try {
-		attachment = await contact.attach(durable.view.current().session, { submitToRoot: durable.submitToRoot });
+		attachment = await contact.attach(durable.view.current().session, {
+			submitToRoot: durable.submitToRoot,
+			onFailed: durable.onFailed,
+		});
 	} catch (error) {
 		return failAfterCleanup(
 			error,

package/pi/pi-durable/carrier/runtime.js

@@ -62,6 +62,11 @@ const context = BACKGROUND_CONTEXT;
 	                           
 	                                                                 
 	                             
+	   
+	                                                                                                               
+	                                                                                             
+	   
+	                                               
  
 
                                     
@@ -98,6 +103,12 @@ const context = BACKGROUND_CONTEXT;
 	                                   
 	                                                                                                                   
 	                                                               
+	   
+	                                                                                                                  
+	                                                                                                                
+	                                            
+	   
+	                                           
 	                       
  
 
@@ -234,8 +245,27 @@ export async function openDurable(options                     = {})
 			update({ notices: [...state.notices, { id: nextNotice++, level, message }].slice(-20) });
 		};
 		const fail = (error         )       => notice("error", error instanceof Error ? error.message : String(error));
-		report = (error) => notice("warning", error instanceof Error ? error.message : String(error));
+		report = (error) => {
+			const message = error instanceof Error ? error.message : String(error);
+			// A failing Session runs its close listeners first and reports the cause right after: that report names it.
+			if (state.failure !== undefined && state.failure.error === undefined) update({ failure: { error: message } });
+			else notice("warning", message);
+		};
 		for (const error of pendingReports) report(error);
+		const failedListeners = new Set            ();
+		// The Session closes itself when its Storage fails. Its `closed` settles only after every running task returned,
+		// which a task ignoring its abort can delay without end, so the failure is shown from the close listener itself.
+		// `close()` unsubscribes before it closes the Session, so only a Session closing itself gets here.
+		const unsubscribeClose = harness.subscribeClose(() => {
+			update({ failure: {} });
+			for (const listener of failedListeners) {
+				try {
+					listener();
+				} catch (error) {
+					fail(error);
+				}
+			}
+		});
 		let unsubscribe = conversation.subscribe((value) => update({ conversation: value }));
 		// Subagents appear as their conversations are created. A commit listener only records; it calls no Session API.
 		const unsubscribeCommits = harness.subscribeCommits((publication) => {
@@ -286,7 +316,12 @@ export async function openDurable(options                     = {})
 		};
 		const controller                    = {
 			submit: (text, whenBusy) =>
-				command(async () => watchAnswer(await current.submit({ type: "input", content: text, whenBusy }, context))),
+				command(async () => {
+					if (state.failure !== undefined) {
+						throw new Error("The session failed and takes no input. Close it, then reopen it with --continue.");
+					}
+					watchAnswer(await current.submit({ type: "input", content: text, whenBusy }, context));
+				}),
 			compact: (instructions) =>
 				command(async () => {
 					const id = await current.compact(instructions, context);
@@ -374,8 +409,23 @@ export async function openDurable(options                     = {})
 			controller,
 			settings: settingsManager,
 			submitToRoot: (draft) => root.submit(draft, context),
+			onFailed(listener) {
+				// The failure is kept in the view, so a listener that comes after it is told at once, and still only once.
+				if (state.failure !== undefined) {
+					try {
+						listener();
+					} catch (error) {
+						fail(error);
+					}
+					return () => {};
+				}
+				failedListeners.add(listener);
+				return () => failedListeners.delete(listener);
+			},
 			close() {
 				closing ??= (async () => {
+					// First: the Session runs its close listeners inside its own close call.
+					unsubscribeClose();
 					unsubscribe();
 					unsubscribeCommits();
 					conversation.dispose();

package/pi/pi-durable/carrier/subagent.js

@@ -8,6 +8,7 @@ import {
 	             
 	               
 	                      
+	                         
 } from "@earendil-works/pi-durable";
 
 async function answerText(api                  , answer         , context         )                  {
@@ -48,7 +49,11 @@ export const Subagent            = defineExtension({
 					throw new Error(`Subagent ${child} failed: ${settled.status}`);
 				}
 				const text = await answerText(api, settled.answer, context);
-				return { content: [{ type: "text", text }], details: { conversationId: child } };
+				// `output` is what the model reads; spelled out so the result shape is checked, not just accepted.
+				return {
+					output: [{ type: "text", text }],
+					details: { conversationId: child },
+				}                              ;
 			},
 		}),
 	],