@junghanacs/entwurf 0.35.1 → 0.36.0

package/scripts/mutants/control-send-receipt.json

@@ -181,7 +181,7 @@
 			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
 			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-agent-core\": \"1.1.0\","],
+			"find": ["\"@earendil-works/pi-agent-core\": \"1.2.0\","],
 			"replace": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,

package/scripts/mutants/pack-install.json

@@ -6,7 +6,7 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.1\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.2\\.0(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.1\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.1\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.2\\.0(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.2\\.0(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",

package/scripts/mutants/pi-durable.json

@@ -458,7 +458,7 @@
 			"claim": "PI-DURABLE-CARRIER-PIN-MATCHES",
 			"title": "the pin records a digest the committed carrier file does not carry, so a carrier edited after emission would still be the declared one",
 			"subject": "pi/pi-durable/overlay/upstream-pin.json",
-			"find": ["\"sha256\": \"bfd88844fae61e8bd32d57b5b986f48056c64eebb5466d9826318a0783ac9005\""],
+			"find": ["\"sha256\": \"60c2965eadbdbbe78fce1b7eeb89d97eb3104a30b7d58ebca87009d2e9118403\""],
 			"replace": ["\"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\""],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
@@ -833,19 +833,40 @@
 			}
 		},
 		{
-			"claim": "PI-DURABLE-CARRIER-PATCH-SECTIONS",
-			"title": "a declared patched file with no section of its own passes the patch-shape check, so the emitter would ship that file unpatched",
+			"claim": "PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL",
+			"title": "the owned source changes and the carrier is not re-emitted, so the shipped app is no longer the emission of the source the repository reviews",
+			"subject": "pi/pi-durable/src/experimental/durable/tui.ts",
+			"find": ["\t\tconst forms = [...detailed, tasks, `⏳ ${n}`, `⏳${n}`, `*${n}`, \"*+\", \"*\"];"],
+			"replace": ["\t\tconst forms = [...detailed, tasks, `⏳ ${n}`, `⏳${n}`, `*${n}`, \"*\"];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-EMIT-NODE-EXACT",
+			"title": "the emitter stops comparing its own Node with the pinned one, so a carrier emitted under any Node reads as the pinned emission",
 			"subject": "scripts/emit-pi-durable-carrier.ts",
-			"find": ["\tif (undeclared.length > 0 || missing.length > 0) {"],
-			"replace": ["\tif (undeclared.length > 0) {"],
+			"find": ["\tif (pinned !== running) {"],
+			"replace": ["\tif (false) {"],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-CARRIER-PATCH-SECTIONS]",
+			"signature": "[QK:PI-DURABLE-CARRIER-EMIT-NODE-EXACT]",
 			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-SOURCE-FENCE-RESOLVES",
+			"title": "the source fence inherits the root program's exclusion of pi/pi-durable/src, so the owned source sits in no typecheck program at all",
+			"subject": "pi/pi-durable/tsconfig.json",
+			"find": ["\t\"exclude\": []"],
+			"replace": ["\t\"files\": []"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SOURCE-FENCE-RESOLVES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
 		},
 		{
 			"claim": "PI-DURABLE-FOOTER-GRAPH-LIFETIME",
@@ -898,12 +919,8 @@
 			"claim": "PI-DURABLE-FOOTER-BADGE-PROTECTED",
 			"title": "the badge sits last in the dock, so the renderer's bottom clip drops it first on a short terminal",
 			"subject": "pi/pi-durable/carrier/tui.js",
-			"find": [
-				"\t\t{ component: new VStack([{ component: badge, shrink: 0 }, ...dock]), basis: \"auto\", grow: 0, shrink: 1, minSize: 1 },"
-			],
-			"replace": [
-				"\t\t{ component: new VStack([...dock, { component: badge, shrink: 0 }]), basis: \"auto\", grow: 0, shrink: 1, minSize: 1 },"
-			],
+			"find": ["\t\t\tcomponent: new VStack([{ component: badge, shrink: 0 }, ...dock]),"],
+			"replace": ["\t\t\tcomponent: new VStack([...dock, { component: badge, shrink: 0 }]),"],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-DURABLE-FOOTER-BADGE-PROTECTED]",
@@ -1002,6 +1019,138 @@
 				"argv": ["bash", "scripts/build-bridge.sh"],
 				"output": "mcp/entwurf-bridge/dist"
 			}
+		},
+		{
+			"claim": "PI-DURABLE-SOURCE-NOT-SHIPPED",
+			"title": "the files allowlist admits pi/pi-durable/src, so the owned TypeScript source rides the tarball beside the carrier an installed consumer runs",
+			"subject": "package.json",
+			"find": ["\t\t\"pi/pi-durable/carrier/\",\n"],
+			"replace": ["\t\t\"pi/pi-durable/carrier/\",\n\t\t\"pi/pi-durable/src/\",\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SOURCE-NOT-SHIPPED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-EMITTER-NODE-CI-BOUND",
+			"title": "the CI check job floats its Node major again, so the floor that proves the carrier emission runs under a Node other than the pinned emitter",
+			"subject": ".github/workflows/ci.yml",
+			"find": ["          node-version: 24.18.1\n"],
+			"replace": ["          node-version: 24\n"],
+			"gate": ["bash", "run.sh", "check-node-floor-coherence"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DURABLE-EMITTER-NODE-CI-BOUND]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PI-DURABLE-EMITTER-NODE-CI-REQUIRED",
+			"title": "the check:full step's ENTWURF_REQUIRE_EMITTER_NODE line is commented out, so an emitter-identity mismatch on the CI floor becomes a skip while the workflow text still names the variable",
+			"subject": ".github/workflows/ci.yml",
+			"find": ["          ENTWURF_REQUIRE_EMITTER_NODE: \"1\"\n"],
+			"replace": ["          # ENTWURF_REQUIRE_EMITTER_NODE: \"1\"\n"],
+			"gate": ["bash", "run.sh", "check-node-floor-coherence"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DURABLE-EMITTER-NODE-CI-REQUIRED]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PI-DURABLE-SUBAGENT-OUTPUT-MODEL-VISIBLE",
+			"title": "the emitted subagent answers in `content`, the 1.1 field: on 1.2 the result still type-checks against the all-optional result and the parent model reads nothing of the child's answer",
+			"subject": "pi/pi-durable/carrier/subagent.js",
+			"find": ["\t\t\t\t\toutput: [{ type: \"text\", text }],"],
+			"replace": ["\t\t\t\t\tcontent: [{ type: \"text\", text }],"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SUBAGENT-OUTPUT-MODEL-VISIBLE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-BRIDGE-TOOL-OUTPUT-MODEL-VISIBLE",
+			"title": "the contact's bridge tools answer in `content`, the 1.1 field, past the declared result type: the bridge still builds and the model reads none of the bridge's text",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\t\treturn { output: [{ type: \"text\", text: result.text }] };"],
+			"replace": ["\t\t\treturn { content: [{ type: \"text\", text: result.text }] } as unknown as DurableToolResult;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BRIDGE-TOOL-OUTPUT-MODEL-VISIBLE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-FATAL-SESSION-VIEW",
+			"title": "the close listener stops recording the failure: a Session that failed and closed itself looks open, and the host learns of it only if `closed` ever settles, which a tool ignoring its abort can hold off for good",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\t\tupdate({ failure: {} });"],
+			"replace": ["\t\t\t// the failure is not recorded"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FATAL-SESSION-VIEW]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-FATAL-SESSION-SHOWN",
+			"title": "the TUI stops drawing the failed session's line: the view knows, the screen keeps the last live frame and every later keystroke looks accepted",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\tif (view.failure !== undefined) {"],
+			"replace": ["\tif (view.failure === null) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FATAL-SESSION-SHOWN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-FATAL-SUBMIT-REFUSED",
+			"title": "input to a failed session is handed to the SDK instead of being refused by name: it fails later with the SDK's generic error and the user is not told the session takes no input",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\t\t\t\tif (state.failure !== undefined) {"],
+			"replace": ["\t\t\t\t\tif (state.failure === null) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FATAL-SUBMIT-REFUSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-RETIRE-ON-FATAL",
+			"title": "the doorbell ignores the session's failure: its marker stays and senders keep waking a host that can admit nothing, until a ring happens to be rejected",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["const problems = retire(\"session-failed\", \"the durable session failed and closed itself\");"],
+			"replace": ["const problems: string[] = [];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-RETIRE-ON-FATAL]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-SELF-CLOSE-NOT-FAILURE",
+			"title": "close() keeps its close listener subscribed: every normal exit reports a failed session and retires its listeners as if the storage had failed",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": [
+				"\t\t\t\t\t// First: the Session runs its close listeners inside its own close call.\n\t\t\t\t\tunsubscribeClose();"
+			],
+			"replace": ["\t\t\t\t\t// First: the Session runs its close listeners inside its own close call."],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SELF-CLOSE-NOT-FAILURE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-COMPACTION-FAILURE-SHOWN",
+			"title": "the TUI drops the conversation's retained compaction failure: a failed background compaction vanishes from the screen once its status is removed",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\tif (compaction !== undefined) {\n\t\tlines.push"],
+			"replace": ["\tif (compaction === null) {\n\t\tlines.push"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-COMPACTION-FAILURE-SHOWN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
 		}
 	]
 }

package/scripts/mutants/pi-floor.json

@@ -7,10 +7,10 @@
 			"title": "one row of the pnpm workspace closure is left on the previous floor while every other surface moved — the shape a version bump actually fails in. Nothing else reads that file, so the stranded row surfaces only at install time, in a different command, far from the change that stranded it",
 			"subject": "pnpm-workspace.yaml",
 			"find": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0 || 1.2.0'"
 			],
 			"replace": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0'"
 			],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,
@@ -21,8 +21,8 @@
 			"claim": "PI-SDK-PRODUCTION-SET",
 			"title": "the durable library's production pin falls one release behind the SDK set the pin declares, so the carrier would bind a pi-durable nobody verified it against",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-durable\": \"1.1.0\","],
-			"replace": ["\"@earendil-works/pi-durable\": \"1.0.4\","],
+			"find": ["\"@earendil-works/pi-durable\": \"1.2.0\","],
+			"replace": ["\"@earendil-works/pi-durable\": \"1.1.0\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-SDK-PRODUCTION-SET]",
@@ -33,7 +33,7 @@
 			"title": "an @earendil-works package returns as a dev dependency beside its production pin, one name in two dependency classes",
 			"subject": "package.json",
 			"find": ["\"@biomejs/biome\": \"^2.4.13\","],
-			"replace": ["\"@biomejs/biome\": \"^2.4.13\",\n\t\t\"@earendil-works/pi-ai\": \"1.1.0\","],
+			"replace": ["\"@biomejs/biome\": \"^2.4.13\",\n\t\t\"@earendil-works/pi-ai\": \"1.2.0\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-SDK-NO-DUAL-DECLARATION]",

package/scripts/pi-durable-contact-host.mjs

@@ -68,7 +68,7 @@ try {
 		const tool = citizen.contact.extension.tools.find((t) => t.name === name);
 		if (tool === undefined) throw new Error(`the contact registers no ${name}`);
 		const result = await tool.execute({}, undefined, {});
-		return result.content.map((block) => block.text).join("\n");
+		return result.output.map((block) => block.text).join("\n");
 	};
 	const view = citizen.durable.view.current();
 	const report = {

package/pi/pi-durable/overlay/runtime-contacts.patch

@@ -1,283 +0,0 @@
-diff --git a/packages/coding-agent/src/experimental/durable/runtime.ts b/packages/coding-agent/src/experimental/durable/runtime.ts
-index fcd6e523..7f00e27f 100644
---- a/packages/coding-agent/src/experimental/durable/runtime.ts
-+++ b/packages/coding-agent/src/experimental/durable/runtime.ts
-@@ -8,7 +8,9 @@ import {
- 	type ConversationView,
- 	type Cursor,
- 	type EntryRecord,
-+	type Extension,
- 	Harness,
-+	type InputSubmissionDraft,
- 	type ModelRef,
- 	ROOT_CONVERSATION_ID,
- 	type Submission,
-@@ -56,8 +58,10 @@ export interface DurableView {
- 	readonly conversations: readonly ConversationSummary[];
- 	readonly models: readonly ModelSummary[];
- 	readonly notices: readonly Notice[];
--	/** The live task graph while the task panel is open. */
-+	/** The live task graph, observed for the session's lifetime whether or not its panel is shown. */
- 	readonly tasks?: TaskGraph;
-+	/** Whether the task panel is shown; /tasks toggles only this. */
-+	readonly tasksPanel: boolean;
- }
- 
- export interface DurableViewSource {
-@@ -81,6 +85,10 @@ export interface DurableController {
- export interface OpenDurableOptions {
- 	readonly cwd?: string;
- 	readonly continueSession?: boolean;
-+	/** Installed after the built-in extensions and before the Harness opens, so recovered work finds their tools. */
-+	readonly extensions?: readonly Extension[];
-+	/** A new session's explicit model, resolved as pi's `--provider`/`--model`; unresolved, the open fails. */
-+	readonly model?: { readonly provider: string; readonly model: string };
- }
- 
- export interface OpenDurableResult {
-@@ -88,6 +96,8 @@ export interface OpenDurableResult {
- 	readonly controller: DurableController;
- 	/** pi's settings, for the TUI's theme and terminal capabilities. */
- 	readonly settings: SettingsManager;
-+	/** Admits input to the root conversation, whichever one is on screen; resolves at admission, not at the answer. */
-+	submitToRoot(draft: InputSubmissionDraft): Promise<Submission>;
- 	close(): Promise<void>;
- }
- 
-@@ -122,6 +132,9 @@ function titleOf(entry: EntryRecord | undefined): { title?: string } {
- }
- 
- export async function openDurable(options: OpenDurableOptions = {}): Promise<OpenDurableResult> {
-+	if (options.model !== undefined && options.continueSession) {
-+		throw new Error("An explicit model applies only to a new session, not to a continued one");
-+	}
- 	const location = await selectSession(options.cwd ?? process.cwd(), options.continueSession ?? false);
- 	const envs = new ExecutionEnvs(location.cwd);
- 	let harness: Harness | undefined;
-@@ -132,6 +145,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
- 		const settings = createHarnessSettings(settingsManager);
- 		const registry = createCodingRegistry(settingsManager, location.cwd);
- 		registry.install(Subagent);
-+		for (const extension of options.extensions ?? []) registry.install(extension);
- 
- 		const pendingReports: unknown[] = [];
- 		let report: (error: unknown) => void = (error) => pendingReports.push(error);
-@@ -146,7 +160,29 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
- 			},
- 			context,
- 		);
--		const initial = location.created ? await findInitialAgentModel(settingsManager, modelRuntime) : undefined;
-+		const initial = location.created
-+			? await findInitialAgentModel(settingsManager, modelRuntime, options.model)
-+			: undefined;
-+		if (options.model !== undefined) {
-+			// pi resolves case-insensitive, partial and unknown ids too (a custom-id fallback with only a warning);
-+			// an explicit model must be exactly one registered catalog model, named by its canonical id.
-+			const asked = options.model;
-+			const ref = initial?.model;
-+			const thinking = initial?.thinkingLevel;
-+			const registered = ref !== undefined && modelRuntime.getModel(ref.provider, ref.modelId) !== undefined;
-+			const named =
-+				ref !== undefined &&
-+				(asked.model === ref.modelId || (thinking !== undefined && asked.model === `${ref.modelId}:${thinking}`));
-+			if (ref === undefined || ref.provider !== asked.provider || !registered || !named) {
-+				const resolved =
-+					ref === undefined
-+						? "none"
-+						: `${ref.provider}/${ref.modelId}${thinking === undefined ? "" : `:${thinking}`}`;
-+				throw new Error(
-+					`explicit-model-not-exact: asked ${asked.provider}/${asked.model}, resolved ${resolved} (registered=${registered})`,
-+				);
-+			}
-+		}
- 		const root = await harness.root(context, {
- 			agent: {
- 				cwd: location.cwd,
-@@ -179,6 +215,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
- 			conversations: summaries,
- 			models: models(),
- 			notices: [],
-+			tasksPanel: true,
- 		};
- 		const listeners = new Set<() => void>();
- 		let notifying = false;
-@@ -296,17 +333,8 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
- 					const thinking: ModelThinkingLevel = agentOf(state.conversation).thinkingLevel ?? "off";
- 					await current.configure({ model: ref, thinkingLevel: clampThinkingLevel(model, thinking) }, context);
- 				}),
--			toggleTasks: () =>
--				command(async () => {
--					if (tasks !== undefined) {
--						closeTasks();
--						update({ tasks: undefined });
--						return;
--					}
--					const graph = await opened.taskGraph(context);
--					tasks = graph;
--					unsubscribeTasks = graph.subscribe((value) => update({ tasks: value }));
--				}),
-+			// Only the panel: the graph stays observed, so live background work is never out of view.
-+			toggleTasks: () => command(async () => update({ tasksPanel: !state.tasksPanel })),
- 			switchConversation: (id) =>
- 				command(async () => {
- 					const next = await opened.conversation(id, context);
-@@ -326,8 +354,11 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
- 			notice("warning", `Saved model is unavailable: ${saved.provider}/${saved.modelId}`);
- 		}
- 		if (initial?.fallbackMessage !== undefined) notice("info", initial.fallbackMessage);
--		// The task panel starts open; /tasks hides it.
--		await controller.toggleTasks();
-+		// The task graph is observed until close; its panel starts open and /tasks hides it.
-+		const graph = await opened.taskGraph(context);
-+		tasks = graph;
-+		update({ tasks: graph.value });
-+		unsubscribeTasks = graph.subscribe((value) => update({ tasks: value }));
- 		// Recovered work from an interrupted turn continues now.
- 		harness.resume();
- 
-@@ -342,6 +373,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
- 			},
- 			controller,
- 			settings: settingsManager,
-+			submitToRoot: (draft) => root.submit(draft, context),
- 			close() {
- 				closing ??= (async () => {
- 					unsubscribe();
-diff --git a/packages/coding-agent/src/experimental/durable/tui.ts b/packages/coding-agent/src/experimental/durable/tui.ts
-index 397b276c..6a8fce8f 100644
---- a/packages/coding-agent/src/experimental/durable/tui.ts
-+++ b/packages/coding-agent/src/experimental/durable/tui.ts
-@@ -23,12 +23,14 @@ import {
- 	SelectList,
- 	type SelectListTheme,
- 	Spacer,
-+	type StackEntry,
- 	setCapabilityOverrides,
- 	setKeybindings,
- 	Text,
- 	TruncatedText,
- 	TuiAltScreen,
- 	VStack,
-+	visibleWidth,
- } from "@earendil-works/pi-tui";
- import { getAgentDir } from "../../config.ts";
- import { KeybindingsManager } from "../../core/keybindings.ts";
-@@ -150,10 +152,75 @@ interface Handlers {
- 	cycleThinking(): void;
- }
- 
-+/**
-+ * The live background-task badge: the dock's first row, never shrunk, so live background work stays on
-+ * screen however small the terminal gets. It counts the graph's background tasks whatever their kind and
-+ * names the ones that are not running; with none it renders nothing and the dock is upstream's.
-+ */
-+export class TaskBadge implements Component {
-+	#count = 0;
-+	#detail = "";
-+
-+	get count(): number {
-+		return this.#count;
-+	}
-+
-+	set(graph: TaskGraph | undefined): void {
-+		const nodes = Object.values(graph?.tasks ?? {}).filter((node) => node.background);
-+		const tally = (state: string, match: (node: TaskGraphNode) => boolean): string[] => {
-+			const n = nodes.filter(match).length;
-+			return n === 0 ? [] : [`${n} ${state}`];
-+		};
-+		this.#count = nodes.length;
-+		this.#detail = [
-+			...tally("aborting", (node) => node.abortRequested),
-+			...tally("completing", (node) => !node.abortRequested && node.state.status === "completing"),
-+			...tally("waiting", (node) => !node.abortRequested && node.state.status === "waiting"),
-+			...tally("pending", (node) => !node.abortRequested && node.state.status === "pending"),
-+		].join(", ");
-+	}
-+
-+	/** The widest form that fits, padded when there is room; narrower terminals drop detail, then words. */
-+	render(width: number): string[] {
-+		const n = this.#count;
-+		if (n === 0) return [];
-+		const tasks = `⏳ ${n} ${n === 1 ? "task" : "tasks"}`;
-+		const detailed = this.#detail ? [`${tasks} (${this.#detail})`] : [];
-+		const forms = [...detailed, tasks, `⏳ ${n}`, `⏳${n}`, `*${n}`, "*+", "*"];
-+		for (const form of forms) {
-+			if (visibleWidth(form) < width) return [theme.fg("accent", ` ${form}`)];
-+			if (visibleWidth(form) === width) return [theme.fg("accent", form)];
-+		}
-+		return [theme.fg("accent", "*")];
-+	}
-+
-+	invalidate(): void {}
-+}
-+
-+/**
-+ * The screen: the transcript above the dock. The badge is the dock's first row and never shrinks, so the
-+ * renderer, which clips from the bottom, drops the editor and the footer before it; a one-row terminal
-+ * with live background work shows the badge instead of the transcript.
-+ */
-+export function durableLayout(transcript: Component, badge: TaskBadge, dock: readonly StackEntry[]): VStack {
-+	return new VStack([
-+		{
-+			component: transcript,
-+			basis: 0,
-+			grow: 1,
-+			shrink: 1,
-+			minSize: 1,
-+			visible: (viewport) => badge.count === 0 || viewport.height > 1,
-+		},
-+		{ component: new VStack([{ component: badge, shrink: 0 }, ...dock]), basis: "auto", grow: 0, shrink: 1, minSize: 1 },
-+	]);
-+}
-+
- class DurableTui {
- 	static readonly #renderers: Record<string, ToolRenderers> = createAllToolRenderers();
- 	readonly #ui: TuiAltScreen;
- 	readonly #chat = new Container();
-+	readonly #taskBadge = new TaskBadge();
- 	readonly #tasks = new Container();
- 	readonly #queue = new Container();
- 	readonly #notices = new Container();
-@@ -216,15 +283,9 @@ class DurableTui {
- 		content.addChild(new Spacer(1));
- 		const transcript = new ScrollView(content, { follow: "end", primary: true, overscroll: "chain" });
- 		this.#transcript = transcript;
--		const dock = new VStack([
--			{ component: this.#tasks, shrink: 1, minSize: 0 },
--			{ component: this.#queue, shrink: 1, minSize: 0 },
--			{ component: this.#notices, shrink: 1, minSize: 0 },
--			{ component: this.#editorContainer, shrink: 1, minSize: 3 },
--			{ component: this.#footer, shrink: 1, minSize: 0 },
--		]);
- 		for (const component of [
- 			this.#chat,
-+			this.#taskBadge,
- 			this.#tasks,
- 			this.#queue,
- 			this.#notices,
-@@ -234,9 +295,12 @@ class DurableTui {
- 			this.#ui.addChild(component);
- 		}
- 		this.#ui.setLayoutRoot(
--			new VStack([
--				{ component: transcript, basis: 0, grow: 1, shrink: 1, minSize: 1 },
--				{ component: dock, basis: "auto", grow: 0, shrink: 1, minSize: 1 },
-+			durableLayout(transcript, this.#taskBadge, [
-+				{ component: this.#tasks, shrink: 1, minSize: 0 },
-+				{ component: this.#queue, shrink: 1, minSize: 0 },
-+				{ component: this.#notices, shrink: 1, minSize: 0 },
-+				{ component: this.#editorContainer, shrink: 1, minSize: 3 },
-+				{ component: this.#footer, shrink: 1, minSize: 0 },
- 			]),
- 		);
- 		this.#ui.setFocus(this.#editor);
-@@ -299,7 +363,8 @@ class DurableTui {
- 				);
- 			}
- 		}
--		this.#syncTasks(view.tasks);
-+		this.#taskBadge.set(view.tasks);
-+		this.#syncTasks(view.tasksPanel ? view.tasks : undefined);
- 		this.#syncQueue((view.conversation.docs["pi.inbox"] ?? { items: [] }) as InboxState);
- 		this.#syncNotices(view);
- 		this.#editor.borderColor = theme.getThinkingBorderColor(agentOf(view.conversation).thinkingLevel ?? "off");