@junghanacs/entwurf 0.35.1 → 0.36.1

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js

@@ -3,8 +3,9 @@
  *
  * WHAT THIS IS. The long-running durable app (`@earendil-works/pi-coding-agent`
  * `experimental/durable`, which upstream omits from its npm distribution — Entwurf's package
- * supplies it as a pinned carrier, #130, not as an operator prerequisite) owns its runtime, TUI,
- * models/auth, storage, prompt and recovery. This module is the whole Entwurf side of its contact:
+ * supplies it as a carrier emitted from its owned source, #130/#141, not as an operator
+ * prerequisite) owns its runtime, TUI, models/auth, storage, prompt and recovery. This module is
+ * the whole Entwurf side of its contact:
  *
  *   createPiDurableContact({ bridgeEntry })
  *     .extension          tools-only durable Extension, handed to the overlay's
@@ -49,14 +50,16 @@
  * bridge whose list differs: the callable bridge schema is the truth, the copy only has to agree.
  *
  * RECEIVE (self-fetch, announce-only). When the bootstrap hands `attach` the overlay's
- * `submitToRoot`, the contact arms a doorbell after the bridge is ready: mailbox, then signal,
+ * `submitToRoot` and `onFailed`, the contact arms a doorbell after the bridge is ready: mailbox, then signal,
  * then the watch, then a check that the record and this process's sender marker still name the
  * session, and only then the receiver marker. A fresh `.msg` is stamped `.msg.delivered` and
  * announced to the ROOT conversation as input; the body stays in the mailbox until the model
  * calls `entwurf_inbox_read`, which is the read receipt. The watch and the sender marker share
  * this process's pid, so the #101 owner join applies (`pi-durable-host`). A watch error, a
- * vanished signal, a failed ring, a rejected admission or close retires the doorbell — watch
- * closed, our own marker removed, the reason kept by name — and nothing retries it.
+ * vanished signal, a failed ring, a rejected admission, the session failing (at once, from the
+ * overlay's `onFailed`, not at the next ring — and before `attach` returns when it had already
+ * failed, with no receiver marker left behind) or close retires the doorbell — watch closed, our own
+ * marker removed, the reason kept by name — and nothing retries it.
  *
  * WITHDRAW (#140). Each notice is a native `followUp`, placed one per run; a read drains EVERY
  * unread body. So after a read the notices still queued for that mail would each cost a turn and an
@@ -484,7 +487,7 @@ export function createPiDurableContact(options) {
             const result = name === "entwurf_inbox_read" ? await readInbox(call, context) : await call();
             if (result.isError)
                 throw new Error(result.text || `${name} failed`);
-            return { content: [{ type: "text", text: result.text }] };
+            return { output: [{ type: "text", text: result.text }] };
         },
     });
     const extension = {
@@ -534,6 +537,7 @@ export function createPiDurableContact(options) {
         if (armed === null)
             return [];
         doorbell = null;
+        armed.unsubscribeFailed();
         const problems = [];
         try {
             armed.watcher.close();
@@ -686,9 +690,10 @@ export function createPiDurableContact(options) {
      * Mailbox, signal, watch — then the check that the record and this process's sender marker
      * still name the session — and only then the receiver marker, the one fact a sender reads.
      * Synchronous, so nothing can close the contact between the check and the publish. Throws,
-     * after closing whatever it opened, when any step fails.
+     * after closing whatever it opened, when any step fails. Returns null when the session had
+     * already failed: the doorbell was retired as `session-failed` before this returned.
      */
-    const arm = (gardenId, nativeSessionId, ownerPid, roots, submitToRoot) => {
+    const arm = (gardenId, nativeSessionId, ownerPid, roots, root) => {
         if (ownerPid !== process.pid) {
             throw new Error(`the doorbell's watch lives in this process (${process.pid}); a receiver marker naming owner ${ownerPid} would advertise a watch that pid does not hold`);
         }
@@ -698,6 +703,7 @@ export function createPiDurableContact(options) {
         if (!fs.existsSync(signal))
             fs.writeFileSync(signal, "", { mode: 0o600 });
         const watcher = watch(signal, () => void ring("signal"));
+        let unsubscribeFailed = () => { };
         try {
             watcher.on("error", (error) => retire("watch-error", describeError(error)));
             const identity = readAddressableMetaIdentity(gardenId, roots.sessionsDir);
@@ -710,6 +716,22 @@ export function createPiDurableContact(options) {
                     ? `no live sender marker for owner ${ownerPid}`
                     : `the sender marker for owner ${ownerPid} names ${sender.gardenId}/${sender.nativeSessionId}, not ${gardenId}/${nativeSessionId}`);
             }
+            // A failed session admits nothing: retire at once, so no sender reads a marker for a host that cannot wake.
+            // Subscribed before the marker is written, so a registration that throws leaves no marker. A session that
+            // failed before this arm says so during the subscription, before the doorbell exists: that is noted, and
+            // the retirement runs once the doorbell is published below. It is final; nothing re-arms.
+            let published = false;
+            let failedBeforePublished = false;
+            const sessionFailed = () => {
+                if (!published) {
+                    failedBeforePublished = true;
+                    return;
+                }
+                const problems = retire("session-failed", "the durable session failed and closed itself");
+                if (problems.length > 0)
+                    throw new Error(`the doorbell did not retire cleanly: ${problems.join("; ")}`);
+            };
+            unsubscribeFailed = root.onFailed(sessionFailed);
             const markerPath = writeMetaReceiverMarker({
                 gardenId,
                 backend: PI_DURABLE_BACKEND,
@@ -719,17 +741,37 @@ export function createPiDurableContact(options) {
                 armProvenance: "session-start",
                 receiversDir: roots.receiversDir,
             });
-            doorbell = { gardenId, ownerPid, mailbox, signal, markerPath, watcher, submitToRoot };
+            doorbell = {
+                gardenId,
+                ownerPid,
+                mailbox,
+                signal,
+                markerPath,
+                watcher,
+                submitToRoot: root.submitToRoot,
+                unsubscribeFailed,
+            };
             inbox = mailbox;
             report = { status: "armed", gardenId, markerPath, admissions };
+            published = true;
+            if (failedBeforePublished) {
+                sessionFailed();
+                return null;
+            }
             return markerPath;
         }
         catch (error) {
-            try {
-                watcher.close();
+            const cleanup = [];
+            for (const step of [unsubscribeFailed, () => watcher.close()]) {
+                try {
+                    step();
+                }
+                catch (cleanupError) {
+                    cleanup.push(cleanupError);
+                }
             }
-            catch (closeError) {
-                throw new AggregateError([error, closeError], `${describeError(error)} (cleanup also failed: ${describeError(closeError)})`);
+            if (cleanup.length > 0) {
+                throw new AggregateError([error, ...cleanup], `${describeError(error)} (cleanup also failed: ${cleanup.map(describeError).join("; ")})`);
             }
             throw error;
         }
@@ -757,6 +799,9 @@ export function createPiDurableContact(options) {
                 if (root !== undefined && typeof root.submitToRoot !== "function") {
                     throw new Error("the root admission handed to attach has no submitToRoot function");
                 }
+                if (root !== undefined && typeof root.onFailed !== "function") {
+                    throw new Error("the root admission handed to attach has no onFailed function");
+                }
                 const ownerPid = options.ownerPid ?? process.pid;
                 const sendersDir = path.resolve(options.sendersDir ?? defaultMetaSendersDir());
                 const upsert = upsertMetaSession({
@@ -806,7 +851,7 @@ export function createPiDurableContact(options) {
                 let receiverMarkerPath = null;
                 if (root !== undefined) {
                     try {
-                        receiverMarkerPath = arm(gardenId, id, ownerPid, roots, root.submitToRoot);
+                        receiverMarkerPath = arm(gardenId, id, ownerPid, roots, root);
                     }
                     catch (error) {
                         return await failAfterCleanup(new Error(`the doorbell did not arm: ${describeError(error)}`), () => client.close());

package/mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js

@@ -0,0 +1,44 @@
+/**
+ * codex-socket-classify — classify the Codex app-server default control socket for THIS
+ * environment, through the one product classifier, and print the answer for a shell.
+ *
+ * WHY A LEAF. `entwurf codex-app-server` is a bash launcher, and it has to decide whether a
+ * launch would clobber something. From Codex 0.162.1 the advertised socket path is a
+ * rendezvous alias into a vendor-owned directory, and telling the vendor's exact alias from any
+ * other symlink takes a hash, an exact readlink comparison and ownership/mode checks. Doing that
+ * in the launcher's Python would be a second implementation of a security classification, and
+ * `codex-socket-path.ts` records what a second spelling of this socket did once (it diverged).
+ * So the launcher asks `checkCodexSocketFile`, the classifier delivery and preflight use, and
+ * only connects to what it was told.
+ *
+ * HOW IT IS REACHED. The launcher runs this file's COMPILED twin,
+ * `mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`, directly with `node` — in a checkout
+ * and in an installed package alike. There is no `run.sh` verb and no `run_ts` crossing for it:
+ * `build-bridge` emits it (`pnpm install` runs that through `prepare`, packing through `prepack`),
+ * and a missing twin is an incomplete installation the launcher refuses by name.
+ *
+ * One line on stdout, a word then a tab-separated detail:
+ *   socket <connectPath>       a verified socket; the launcher connects there to tell live from stale
+ *   absent                     nothing at the advertised path
+ *   dangling <reason>          Codex's own alias whose socket is gone; the vendor removes it on start
+ *   indeterminate <reason>     anything else; the launcher refuses
+ *
+ * Reads `process.env` and takes no argument, for the reason `codex-socket-path.ts` gives: an argv
+ * seam would be a way to redirect the address. It has no daemon-root input either; the gate's
+ * exact-alias cells drive `checkCodexSocketFile` directly with a sandbox root.
+ */
+import { checkCodexSocketFile, resolveCodexDefaultSocketPath, } from "../pi-extensions/lib/native-push/codex-ws-client.js";
+if (process.argv.length > 2) {
+    console.error("usage: codex-socket-classify   (no arguments; the environment is the input)");
+    process.exit(2);
+}
+const oneLine = (text) => text.replace(/[\t\r\n]+/g, " ");
+const check = checkCodexSocketFile(resolveCodexDefaultSocketPath(process.env));
+if (check.ok)
+    process.stdout.write(`socket\t${check.connectPath}`);
+else if (check.status === "dead" && check.layout === "absent")
+    process.stdout.write("absent");
+else if (check.status === "dead")
+    process.stdout.write(`dangling\t${oneLine(check.reason)}`);
+else
+    process.stdout.write(`indeterminate\t${oneLine(check.reason)}`);

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -122,6 +122,10 @@
 	// twin would make the one-command launch die before its first line. Its only repo import is
 	// native-push/codex-ws-client.ts, ALREADY emitted for meta-bridge-hook-codex, so this adds ONE
 	// leaf JS and ZERO new deps.
+	// WHY codex-socket-classify rides THIS build (#141): the same launcher asks it whether a launch
+	// would clobber something, and runs THIS compiled twin directly with `node` in a checkout and an
+	// installed package alike (no run.sh verb, no run_ts crossing), so the emitted file is the only
+	// route. Its only repo import is that same codex-ws-client.ts: ONE leaf JS, ZERO new deps.
 	// WHY meta-bridge-pi-durable rides THIS build (#129 W, L4): the packaged durable bootstrap
 	// (pi/pi-durable/bootstrap.mjs) imports the contact from THIS closure — the same closure whose
 	// bridge entry the contact spawns and whose meta-bridge-omp.js decodes the first-input payload —
@@ -151,6 +155,7 @@
 		"../../scripts/peer-facts.ts",
 		"../../scripts/omp-receive-facts.ts",
 		"../../scripts/codex-socket-path.ts",
+		"../../scripts/codex-socket-classify.ts",
 		"../../pi-extensions/meta-bridge-hook.ts",
 		"../../pi-extensions/meta-bridge-hook-copilot.ts",
 		"../../pi-extensions/meta-bridge-hook-codex.ts",

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.35.1",
-	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
+	"version": "0.36.1",
+	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, reopen pi in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
 		"name": "Junghan Kim",
@@ -30,7 +30,12 @@
 		"copilot",
 		"antigravity",
 		"pi-coding-agent",
-		"pi-extension"
+		"pi-extension",
+		"herdr",
+		"tmux",
+		"visible-sessions",
+		"session-lifecycle",
+		"multi-agent"
 	],
 	"type": "module",
 	"files": [
@@ -59,7 +64,6 @@
 		"pi/pi-durable/carrier-resolver.mjs",
 		"pi/pi-durable/carrier/",
 		"pi/pi-durable/overlay/upstream-pin.json",
-		"pi/pi-durable/overlay/runtime-contacts.patch",
 		"pi/meta-bridge/.claude-plugin/marketplace.json",
 		"pi/meta-bridge/entwurf-meta-receive/.claude-plugin/plugin.json",
 		"pi/meta-bridge/entwurf-meta-receive/hooks/hooks.json",
@@ -92,18 +96,18 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.85.1",
-		"@agentclientprotocol/sdk": "1.6.0",
+		"@agentclientprotocol/claude-agent-acp": "0.90.0",
+		"@agentclientprotocol/sdk": "1.8.0",
 		"@anthropic-ai/sdk": "0.100.1",
-		"@earendil-works/chord": "1.1.0",
-		"@earendil-works/pi-agent-core": "1.1.0",
-		"@earendil-works/pi-ai": "1.1.0",
-		"@earendil-works/pi-codemode": "1.1.0",
-		"@earendil-works/pi-coding-agent": "1.1.0",
-		"@earendil-works/pi-durable": "1.1.0",
-		"@earendil-works/pi-mcp": "1.1.0",
-		"@earendil-works/pi-telemetry": "1.1.0",
-		"@earendil-works/pi-tui": "1.1.0",
+		"@earendil-works/chord": "1.2.0",
+		"@earendil-works/pi-agent-core": "1.2.0",
+		"@earendil-works/pi-ai": "1.2.0",
+		"@earendil-works/pi-codemode": "1.2.0",
+		"@earendil-works/pi-coding-agent": "1.2.0",
+		"@earendil-works/pi-durable": "1.2.0",
+		"@earendil-works/pi-mcp": "1.2.0",
+		"@earendil-works/pi-telemetry": "1.2.0",
+		"@earendil-works/pi-tui": "1.2.0",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"proper-lockfile": "4.1.2",
 		"smol-toml": "^1.8.0",
@@ -115,6 +119,7 @@
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
 		"@types/node": "^24.3.0",
+		"@types/proper-lockfile": "4.1.4",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
 		"typescript": "^6.0.2",
@@ -178,7 +183,7 @@
 		"test": "vitest run",
 		"test:watch": "vitest",
 		"test:pack": "pnpm run check-pack && pnpm run check-pack-install",
-		"typecheck": "tsc --noEmit && tsc -p mcp/tsconfig.json && tsc -p scripts/tsconfig.json",
+		"typecheck": "tsc --noEmit && tsc -p mcp/tsconfig.json && tsc -p scripts/tsconfig.json && tsc -p pi/pi-durable/tsconfig.json",
 		"lint": "biome check .",
 		"format": "biome check --write .",
 		"check-meta-manifest-schema": "./run.sh check-meta-manifest-schema",

package/pi/pi-durable/bootstrap.mjs

@@ -9,15 +9,16 @@
 // with these differences:
 // - Entwurf's tools-only extension is handed to `openDurable`;
 // - a NEW session is opened with an explicit model and an explicit width, never a default (below);
-// - the citizen is born once `openDurable` returns, with the overlay's `submitToRoot` so its
-//   doorbell can announce mail to the root conversation;
+// - the citizen is born once `openDurable` returns, with the owned runtime's `submitToRoot` so its
+//   doorbell can announce mail to the root conversation, and its `onFailed` so a session that
+//   fails and closes itself retires that doorbell at once;
 // - a launcher's first input, when given, is admitted to the root ONCE, after that birth;
 // - the TUI is handed the native view with the garden id on every conversation label
 //   (`withGardenIdentity`).
 // Nothing of the native registry, controller or TUI is rebuilt here.
 //
-// The durable app itself is this package's CARRIER (./carrier/, the pinned upstream files emitted by
-// the maintainer — upstream publishes no experimental app), and it runs under the carrier's resolver,
+// The durable app itself is this package's CARRIER (./carrier/, emitted from Entwurf's owned source
+// pi/pi-durable/src — upstream publishes no experimental app), and it runs under the carrier's resolver,
 // which maps the app's pi-coding-agent internals to the published package the carrier resolves.
 // `entwurf pi-durable` (run.sh) verifies the carrier and its SDK set (pi-durable-runtime.ts) and
 // execs:
@@ -29,11 +30,11 @@
 //
 // Explicit means the native API, not a vendor argv: upstream's durable main takes only
 // `--continue`, so `--provider`/`--model` reach pi's own `findInitialAgentModel` through the
-// overlay's `model` option, for a new session only, and an unresolvable pair fails the open
+// owned runtime's `model` option, for a new session only, and an unresolvable pair fails the open
 // before any citizen is born (the native session directory may already exist by then). The model
 // must be one registered catalog model of that provider, named by its canonical id or by
 // `id:<level>` as pi's own parser reads a thinking level: a typo, a partial or case-variant match, a
-// provider-prefixed id or an unregistered custom-id fallback is refused by the overlay as
+// provider-prefixed id or an unregistered custom-id fallback is refused by the owned runtime as
 // `explicit-model-not-exact`, before the birth and the first input.
 // `--width task-wide` is the one width: no tool filter, so the model is offered exactly the tools
 // the installed extensions register. It is a statement of what is OFFERED, not an approval or
@@ -50,7 +51,7 @@
 // its initialization, and its default export is a native durable Extension, handed to `openDurable`
 // by reference after the contact. Initialization runs before the TUI or the runtime is imported —
 // the runtime creates the provider runtime before it installs any extension (carrier/runtime.js
-// 142-148), so an extension object cannot carry an environment phase. Entwurf checks only what the
+// 153-159), so an extension object cannot carry an environment phase. Entwurf checks only what the
 // ingress needs: a default export object with a name, no extension name the app installs itself (a
 // same-name install REPLACES), and no tool name of the contact. Every other field is the native
 // registry's to validate. The module is trusted operator code: the identity carriers and the
@@ -341,7 +342,10 @@ export async function openDurableCitizen({
 	}
 	let attachment;
 	try {
-		attachment = await contact.attach(durable.view.current().session, { submitToRoot: durable.submitToRoot });
+		attachment = await contact.attach(durable.view.current().session, {
+			submitToRoot: durable.submitToRoot,
+			onFailed: durable.onFailed,
+		});
 	} catch (error) {
 		return failAfterCleanup(
 			error,

package/pi/pi-durable/carrier/runtime.js

@@ -62,6 +62,11 @@ const context = BACKGROUND_CONTEXT;
 	                           
 	                                                                 
 	                             
+	   
+	                                                                                                               
+	                                                                                             
+	   
+	                                               
  
 
                                     
@@ -98,6 +103,12 @@ const context = BACKGROUND_CONTEXT;
 	                                   
 	                                                                                                                   
 	                                                               
+	   
+	                                                                                                                  
+	                                                                                                                
+	                                            
+	   
+	                                           
 	                       
  
 
@@ -234,8 +245,27 @@ export async function openDurable(options                     = {})
 			update({ notices: [...state.notices, { id: nextNotice++, level, message }].slice(-20) });
 		};
 		const fail = (error         )       => notice("error", error instanceof Error ? error.message : String(error));
-		report = (error) => notice("warning", error instanceof Error ? error.message : String(error));
+		report = (error) => {
+			const message = error instanceof Error ? error.message : String(error);
+			// A failing Session runs its close listeners first and reports the cause right after: that report names it.
+			if (state.failure !== undefined && state.failure.error === undefined) update({ failure: { error: message } });
+			else notice("warning", message);
+		};
 		for (const error of pendingReports) report(error);
+		const failedListeners = new Set            ();
+		// The Session closes itself when its Storage fails. Its `closed` settles only after every running task returned,
+		// which a task ignoring its abort can delay without end, so the failure is shown from the close listener itself.
+		// `close()` unsubscribes before it closes the Session, so only a Session closing itself gets here.
+		const unsubscribeClose = harness.subscribeClose(() => {
+			update({ failure: {} });
+			for (const listener of failedListeners) {
+				try {
+					listener();
+				} catch (error) {
+					fail(error);
+				}
+			}
+		});
 		let unsubscribe = conversation.subscribe((value) => update({ conversation: value }));
 		// Subagents appear as their conversations are created. A commit listener only records; it calls no Session API.
 		const unsubscribeCommits = harness.subscribeCommits((publication) => {
@@ -286,7 +316,12 @@ export async function openDurable(options                     = {})
 		};
 		const controller                    = {
 			submit: (text, whenBusy) =>
-				command(async () => watchAnswer(await current.submit({ type: "input", content: text, whenBusy }, context))),
+				command(async () => {
+					if (state.failure !== undefined) {
+						throw new Error("The session failed and takes no input. Close it, then reopen it with --continue.");
+					}
+					watchAnswer(await current.submit({ type: "input", content: text, whenBusy }, context));
+				}),
 			compact: (instructions) =>
 				command(async () => {
 					const id = await current.compact(instructions, context);
@@ -374,8 +409,23 @@ export async function openDurable(options                     = {})
 			controller,
 			settings: settingsManager,
 			submitToRoot: (draft) => root.submit(draft, context),
+			onFailed(listener) {
+				// The failure is kept in the view, so a listener that comes after it is told at once, and still only once.
+				if (state.failure !== undefined) {
+					try {
+						listener();
+					} catch (error) {
+						fail(error);
+					}
+					return () => {};
+				}
+				failedListeners.add(listener);
+				return () => failedListeners.delete(listener);
+			},
 			close() {
 				closing ??= (async () => {
+					// First: the Session runs its close listeners inside its own close call.
+					unsubscribeClose();
 					unsubscribe();
 					unsubscribeCommits();
 					conversation.dispose();

package/pi/pi-durable/carrier/subagent.js

@@ -8,6 +8,7 @@ import {
 	             
 	               
 	                      
+	                         
 } from "@earendil-works/pi-durable";
 
 async function answerText(api                  , answer         , context         )                  {
@@ -48,7 +49,11 @@ export const Subagent            = defineExtension({
 					throw new Error(`Subagent ${child} failed: ${settled.status}`);
 				}
 				const text = await answerText(api, settled.answer, context);
-				return { content: [{ type: "text", text }], details: { conversationId: child } };
+				// `output` is what the model reads; spelled out so the result shape is checked, not just accepted.
+				return {
+					output: [{ type: "text", text }],
+					details: { conversationId: child },
+				}                              ;
 			},
 		}),
 	],

package/pi/pi-durable/carrier/tui.js

@@ -46,7 +46,7 @@ import { ToolExecutionComponent,                    } from "entwurf-pi-dist:mode
 import { UserMessageComponent } from "entwurf-pi-dist:modes/interactive/components/user-message.js";
 import { getEditorTheme, getMarkdownTheme, initTheme, theme } from "entwurf-pi-dist:modes/interactive/theme/theme.js";
 import { InteractiveThemeController } from "entwurf-pi-dist:modes/interactive/theme/theme-controller.js";
-import { agentOf,                                                                  } from "./runtime.js";
+import { agentOf,                                                                               } from "./runtime.js";
 
 const SELECT_THEME                  = {
 	selectedPrefix: (text) => theme.fg("accent", text),
@@ -152,6 +152,26 @@ class CompactionComponent extends Box {
 	                      
  
 
+/**
+ * The lines above the editor: first what stays true for as long as it is true, the session's failure and the
+ * compaction failure a conversation keeps until a compaction produces a summary, then the latest notices.
+ */
+export function durableNotices(view             )                                               {
+	const lines                                      = [];
+	if (view.failure !== undefined) {
+		const cause = view.failure.error === undefined ? "" : `: ${view.failure.error}`;
+		lines.push({
+			level: "error",
+			message: `Session failed${cause}. It takes no more input, and a tool still running may take a while to stop. Close this session, then reopen it with --continue.`,
+		});
+	}
+	const compaction = ((view.conversation.docs["pi.live"] ?? {})             ).compactionFailure;
+	if (compaction !== undefined) {
+		lines.push({ level: "error", message: `Compaction failed (${compaction.reason}): ${compaction.error}` });
+	}
+	return [...lines, ...view.notices.slice(-4)];
+}
+
 /**
  * The live background-task badge: the dock's first row, never shrunk, so live background work stays on
  * screen however small the terminal gets. It counts the graph's background tasks whatever their kind and
@@ -212,7 +232,13 @@ export function durableLayout(transcript           , badge           , dock
 			minSize: 1,
 			visible: (viewport) => badge.count === 0 || viewport.height > 1,
 		},
-		{ component: new VStack([{ component: badge, shrink: 0 }, ...dock]), basis: "auto", grow: 0, shrink: 1, minSize: 1 },
+		{
+			component: new VStack([{ component: badge, shrink: 0 }, ...dock]),
+			basis: "auto",
+			grow: 0,
+			shrink: 1,
+			minSize: 1,
+		},
 	]);
 }
 
@@ -368,7 +394,8 @@ class DurableTui {
 		this.#syncQueue((view.conversation.docs["pi.inbox"] ?? { items: [] })              );
 		this.#syncNotices(view);
 		this.#editor.borderColor = theme.getThinkingBorderColor(agentOf(view.conversation).thinkingLevel ?? "off");
-		this.#syncStatus(live);
+		// A failed session's live state is its last one; nothing is working any more.
+		this.#syncStatus(view.failure === undefined ? live : {});
 		this.#syncFooter(view);
 		if (this.#rebuilt) this.#transcript.scrollToEnd();
 		this.#ui.requestRender(this.#rebuilt);
@@ -409,7 +436,7 @@ class DurableTui {
 
 	#syncNotices(view             )       {
 		this.#notices.clear();
-		for (const item of view.notices.slice(-4)) {
+		for (const item of durableNotices(view)) {
 			const color = item.level === "error" ? "error" : item.level === "warning" ? "warning" : "muted";
 			this.#notices.addChild(new TruncatedText(theme.fg(color, item.message), 1, 0));
 		}

package/pi/pi-durable/carrier-relocation.mjs

@@ -3,8 +3,8 @@
 // rewrite the emitter performs and the resolution the runtime accepts cannot drift apart.
 //
 // The durable app is source-only upstream: published `@earendil-works/pi-coding-agent` ships no
-// `dist/experimental`, and its exports map exposes no deep `dist/` path. The carrier is the pinned
-// upstream app files, type-stripped, with exactly two rewrites:
+// `dist/experimental`, and its exports map exposes no deep `dist/` path. The carrier is Entwurf's
+// owned app source (pi/pi-durable/src, #141), type-stripped, with exactly two rewrites:
 //
 //   "./<sibling>.ts"   → "./<sibling>.js"                 a carrier file importing another carrier file
 //   "../../<path>.ts"  → entwurf-pi-dist:<path>.js        the app importing a pi-coding-agent internal