@junghanacs/entwurf 0.41.2 → 0.50.0

package/native/win32-x64/manifest.json

@@ -12,7 +12,7 @@
 		"windowsTargetPlatformVersion": "10.0.26100.0",
 		"visualStudio": {
 			"displayName": "Visual Studio Enterprise 2026",
-			"installationVersion": "18.11.12315.225"
+			"installationVersion": "18.11.12328.437"
 		}
 	},
 	"source": {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.41.2",
-	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, retire on request and reopen pi or Claude Code in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
+	"version": "0.50.0",
+	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, retire on request, visibly reopen supported sessions under the same id, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
 		"name": "Junghan Kim",
@@ -39,6 +39,9 @@
 	],
 	"type": "module",
 	"files": [
+		"ENTWURF.json",
+		"ENTWURF-CLI.json",
+		"team.json.example",
 		"protocol.js",
 		"pi-extensions/",
 		"native/win32-x64/",
@@ -158,6 +161,7 @@
 		"check-copilot-statusline": "./run.sh check-copilot-statusline",
 		"check-copilot-launch": "./run.sh check-copilot-launch",
 		"check-pi-launch": "./run.sh check-pi-launch",
+		"check-claude-launch": "./run.sh check-claude-launch",
 		"smoke-copilot-statusline-state": "./run.sh smoke-copilot-statusline-state",
 		"smoke-copilot-mcp-state": "./run.sh smoke-copilot-mcp-state",
 		"smoke-omp-bridge-state": "./run.sh smoke-omp-bridge-state",
@@ -197,8 +201,8 @@
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication",
-		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-native-push-paused && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module && ./run.sh check-remote-pair-beside",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-native-push-paused && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-agent-guidance-beside && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module && ./run.sh check-remote-pair-beside",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-claude-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-argv-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi/pi-durable/bootstrap.mjs

@@ -14,7 +14,9 @@
 //   fails and closes itself retires that doorbell at once;
 // - a launcher's first input, when given, is admitted to the root ONCE, after that birth;
 // - the TUI is handed the native view with the garden id on every conversation label
-//   (`withGardenIdentity`).
+//   (`withGardenIdentity`);
+// - every open takes the owner fence (#157 B3) — built once here from the compiled closure — inside
+//   the session directory before its native lease; a refusal opens nothing.
 // Nothing of the native registry, controller or TUI is rebuilt here.
 //
 // The durable app itself is this package's CARRIER (./carrier/, emitted from Entwurf's owned source
@@ -27,6 +29,8 @@
 //        <entwurf>/pi/pi-durable/bootstrap.mjs \
 //        --provider <provider> --model <model id> --width task-wide [--entwurf-bootstrap <json>]
 //   ... bootstrap.mjs --continue
+//   ... bootstrap.mjs --resume
+//   ... bootstrap.mjs --session <native id>
 //
 // Explicit means the native API, not a vendor argv: upstream's durable main takes only
 // `--continue`, so `--provider`/`--model` reach pi's own `findInitialAgentModel` through the
@@ -45,9 +49,17 @@
 // address rides the process env only.
 // `--continue` opens the newest session for this directory as upstream does (not a chosen
 // record), so every flag that only a new session can honour is refused beside it by name.
+// `--session <native id>` (#157 G3 B-L1) reopens exactly that native session of this directory as it
+// was saved, through the owned runtime's `session` option, with no interactive session picker or
+// picker-specific TTY check; the normal TUI still runs. The id is the native session directory name, never a garden id: a native CLI selector, not an address. It is
+// held to the owned `isSessionName` grammar before operator-native module evaluation, TUI load, open
+// or birth; that scope is lexical (the selection stays under this cwd's session root by name), not
+// physical symlink confinement. A well-formed id this directory does not hold is the runtime's own
+// refusal, after the TUI module loads and before any TUI runs. `--continue`, `--resume` and
+// `--session` are mutually exclusive, and every new-session flag is refused beside each of them.
 //
-// `--native-module <absolute file>` (#130 P2) names ONE operator module, for a new or a continued
-// session. It is an ordinary ES module: its own top-level evaluation (top-level await included) is
+// `--native-module <absolute file>` (#130 P2) names ONE operator module, for a new, a continued, a
+// resumed or a named session. It is an ordinary ES module: its own top-level evaluation (top-level await included) is
 // its initialization, and its default export is a native durable Extension, handed to `openDurable`
 // by reference after the contact. Initialization runs before the TUI or the runtime is imported —
 // the runtime creates the provider runtime before it installs any extension (carrier/runtime.js
@@ -68,16 +80,28 @@
 // REPLACE the first extension or keep both tools. A refusal at module k leaves modules before it
 // evaluated: nothing is rolled back. No watch, no recursion, nothing persisted.
 //
+// `--entwurf-adopt <json>` (#157 B3 I-3) opens the one native session a parent reserved for this process. The
+// payload is closed: exactly `{v:1, gardenId, metaRoot, sourceGeneration}`, and any other key or value is refused. It
+// is exclusive with `--continue`, `--resume`, `--session` and every new-session flag. The garden record under
+// `metaRoot` is the address. Its native session id is the session, held to the same grammar as `--session`.
+// Before anything loads, the four `ENTWURF_META_*_DIR` values this process actually received must be `metaRoot`'s
+// standard children (the launch's fixed projection). The contact's roots are those four, whatever a seam passes.
+// The open takes the adoption fence of that context, which re-reads the record and its location inside its own
+// holds. The selection read here is never handed to the fence as evidence.
+//
 // Without that resolver the carrier's first pi-coding-agent internal import fails by name (an
 // unsupported entwurf-pi-dist: URL scheme), and that failure is the honest one.
 import { readdirSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { readAddressableMetaIdentity } from "../../mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js";
+import { createPiDurableOwnerFence } from "../../mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-owner-fence.js";
 import { decodeOmpBootstrapPayload } from "../../mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-omp.js";
 import {
 	closeAll,
 	createPiDurableContact,
 	failAfterCleanup,
+	PI_DURABLE_BACKEND,
 	PI_DURABLE_EXTENSION_NAME,
 	PI_DURABLE_TOOL_NAMES,
 	piDurableGardenIds,
@@ -87,6 +111,14 @@ import {
 const RUNTIME = "./carrier/runtime.js";
 const TUI = "./carrier/tui.js";
 const SESSIONS = "./carrier/sessions.js";
+/** The session-name grammar alone: no imports and no I/O, so reading it loads nothing an operator module may prepare. */
+const SESSION_NAME = "./carrier/session-name.js";
+
+/**
+ * The owner fence every ordinary open of this process hands the runtime (#157 B3); an adoption hands its own (below).
+ * Building it reads and writes nothing.
+ */
+const OWNER_FENCE = createPiDurableOwnerFence();
 
 /** The entwurf-bridge of THIS package closure: the one the contact spawns as its MCP hand. */
 export const PACKAGED_BRIDGE_ENTRY = fileURLToPath(
@@ -102,9 +134,20 @@ const VALUE_FLAGS = [
 	"--entwurf-bootstrap",
 	"--native-module",
 	"--native-module-dir",
+	"--session",
+	"--entwurf-adopt",
 ];
 /** Flags only a NEW session can honour. */
 const FRESH_ONLY_FLAGS = ["--provider", "--model", "--width", "--entwurf-bootstrap"];
+/** The closed adopt context's keys, sorted: nothing else rides it (#157 B3 I-3). */
+const ADOPT_KEYS = ["gardenId", "metaRoot", "sourceGeneration", "v"];
+/** Each contact root of an adoption: the env name its launch carries it in, and its standard child of `metaRoot`. */
+const ADOPT_ROOTS = {
+	sessionsDir: ["ENTWURF_META_SESSIONS_DIR", "meta-sessions"],
+	mailboxDir: ["ENTWURF_META_MAILBOX_DIR", "meta-mailbox"],
+	sendersDir: ["ENTWURF_META_SENDERS_DIR", "meta-senders"],
+	receiversDir: ["ENTWURF_META_RECEIVERS_DIR", "meta-receivers"],
+};
 
 /**
  * Extension names the durable app installs itself — the contact, then the carrier's own
@@ -124,6 +167,68 @@ function refuse(reason, detail) {
 
 const nonEmpty = (value) => typeof value === "string" && value.trim().length > 0;
 
+const messageOf = (error) => (error instanceof Error ? error.message : String(error));
+
+/**
+ * `--entwurf-adopt`'s closed context, decoded before anything loads. The key set and `v` are this grammar's own.
+ * The garden id, the generation and the absolute root are the adoption fence's checks, run here by building the
+ * fence, which reads and writes nothing.
+ */
+function decodeAdoptContext(text) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch (error) {
+		throw Object.assign(refuse("adopt-context-invalid", "--entwurf-adopt is not JSON"), { cause: error });
+	}
+	if (
+		typeof value !== "object" ||
+		value === null ||
+		Array.isArray(value) ||
+		Object.keys(value).sort().join(",") !== ADOPT_KEYS.join(",")
+	) {
+		throw refuse("adopt-context-invalid", "--entwurf-adopt is exactly {v, gardenId, metaRoot, sourceGeneration}");
+	}
+	if (value.v !== 1) throw refuse("adopt-context-invalid", "--entwurf-adopt is version 1");
+	const { gardenId, metaRoot, sourceGeneration } = value;
+	let fence;
+	try {
+		fence = createPiDurableOwnerFence({ adoption: { gardenId, metaRoot, sourceGeneration } });
+	} catch (error) {
+		throw Object.assign(refuse("adopt-context-invalid", messageOf(error)), { cause: error });
+	}
+	return { gardenId, metaRoot, sourceGeneration, fence };
+}
+
+/** An adoption's contact roots: the standard children of its `metaRoot`, the shape the parent's reserve required. */
+function adoptRoots(metaRoot) {
+	return Object.fromEntries(Object.entries(ADOPT_ROOTS).map(([key, [, child]]) => [key, join(metaRoot, child)]));
+}
+
+/** The four meta roots this process actually received must be the context's; no ambient root stands in for them. */
+function requireAdoptRootEnv(metaRoot) {
+	const mismatched = Object.values(ADOPT_ROOTS)
+		.filter(([name, child]) => process.env[name] !== join(metaRoot, child))
+		.map(([name]) => name);
+	if (mismatched.length > 0) {
+		throw refuse("adopt-root-mismatch", `${mismatched.join(", ")} must be the standard children of ${metaRoot}`);
+	}
+}
+
+/** The native session the garden record names. The record is the address, read through the addressable reader. */
+function adoptedSession({ gardenId, metaRoot }) {
+	let record;
+	try {
+		record = readAddressableMetaIdentity(gardenId, join(metaRoot, ADOPT_ROOTS.sessionsDir[1]));
+	} catch (error) {
+		throw Object.assign(refuse("adopt-record-unaddressable", `${gardenId}: ${messageOf(error)}`), { cause: error });
+	}
+	if (record.backend !== PI_DURABLE_BACKEND) {
+		throw refuse("adopt-record-not-pi-durable", `${gardenId} is a ${record.backend} record`);
+	}
+	return record.nativeSessionId;
+}
+
 /** The identity carriers present now: names and values, compared in memory and never printed. */
 function identitySnapshot() {
 	return Object.fromEntries(
@@ -291,6 +396,8 @@ async function loadNativeModules(files) {
  * checkout-only gates, which drive a private bundle) passes another one — never the launch argv.
  * `extensions` are the operator's native extensions (`--native-module` or `--native-module-dir`),
  * installed after the contact, by reference.
+ * `adopt` is a decoded `--entwurf-adopt` context (#157 B3 I-3). Its fence admits the open, in place of the ordinary
+ * one, and its `metaRoot`'s four standard roots are the contact's, spread last so no seam replaces them.
  *
  * @param {{
  *   bridgeEntry?: string,
@@ -301,7 +408,8 @@ async function loadNativeModules(files) {
  *   firstInput?: string,
  *   extensions?: readonly object[],
  *   contact?: Record<string, unknown>,
- *   open?: (options: { cwd: string, continueSession: boolean, session?: string, extensions: readonly object[], model?: { provider: string, model: string } }) => Promise<any>,
+ *   adopt?: { gardenId: string, metaRoot: string, sourceGeneration: string, fence: object },
+ *   open?: (options: { cwd: string, continueSession: boolean, session?: string, extensions: readonly object[], model?: { provider: string, model: string }, fence: object }) => Promise<any>,
  * }} options
  * @returns {Promise<{ durable: any, contact: any, attachment: { gardenId: string } & Record<string, any>, firstInput?: any, close(): Promise<void> }>}
  *   (stated, because the compiled closure carries no declarations: a cleanup path that rethrows
@@ -316,6 +424,7 @@ export async function openDurableCitizen({
 	firstInput,
 	extensions = [],
 	contact: contactOptions = {},
+	adopt,
 	open,
 }) {
 	if (continueSession && (model !== undefined || firstInput !== undefined)) {
@@ -337,7 +446,12 @@ export async function openDurableCitizen({
 		throw refuse("first-input-empty", "a first input is a non-empty task");
 	}
 	const openDurable = open ?? (await import(RUNTIME)).openDurable;
-	const contact = createPiDurableContact({ ...contactOptions, bridgeEntry });
+	const fence = adopt === undefined ? OWNER_FENCE : adopt.fence;
+	const contact = createPiDurableContact({
+		...contactOptions,
+		bridgeEntry,
+		...(adopt === undefined ? {} : adoptRoots(adopt.metaRoot)),
+	});
 	let durable;
 	try {
 		durable = await openDurable({
@@ -346,6 +460,7 @@ export async function openDurableCitizen({
 			...(session === undefined ? {} : { session }),
 			extensions: [contact.extension, ...extensions],
 			...(model === undefined ? {} : { model }),
+			fence,
 		});
 	} catch (error) {
 		contact.fail(error);
@@ -426,7 +541,42 @@ function parseArgs(argv) {
 			"--resume chooses a session and --continue opens the newest one; give one of them",
 		);
 	}
+	const session = values.get("--session");
+	if (session !== undefined && continueSession) {
+		throw refuse(
+			"session-continue-exclusive",
+			"--session names the session to reopen and --continue opens the newest one; give one of them",
+		);
+	}
+	if (session !== undefined && resume) {
+		throw refuse(
+			"session-resume-exclusive",
+			"--session names the session to reopen and --resume chooses one from a list; give one of them",
+		);
+	}
 	const fresh = FRESH_ONLY_FLAGS.filter((flag) => values.has(flag));
+	const adoptArg = values.get("--entwurf-adopt");
+	if (adoptArg !== undefined) {
+		const others = [
+			...(continueSession ? ["--continue"] : []),
+			...(resume ? ["--resume"] : []),
+			...(session === undefined ? [] : ["--session"]),
+			...fresh,
+		];
+		if (others.length > 0) {
+			throw refuse(
+				"adopt-exclusive",
+				`${others.join(", ")} cannot be given with --entwurf-adopt: an adoption opens exactly the reserved session`,
+			);
+		}
+	}
+	const adopt = adoptArg === undefined ? undefined : decodeAdoptContext(adoptArg);
+	if (session !== undefined && fresh.length > 0) {
+		throw refuse(
+			"fresh-only-argument-with-session",
+			`${fresh.join(", ")} apply only to a new session; --session reopens the named session as it was saved`,
+		);
+	}
 	if (resume && fresh.length > 0) {
 		throw refuse(
 			"fresh-only-argument-with-resume",
@@ -455,6 +605,8 @@ function parseArgs(argv) {
 				: {};
 	if (continueSession) return { continueSession, ...nativeModule };
 	if (resume) return { resume, ...nativeModule };
+	if (session !== undefined) return { session, ...nativeModule };
+	if (adopt !== undefined) return { adopt, ...nativeModule };
 	const provider = values.get("--provider");
 	if (provider === undefined) {
 		throw refuse(
@@ -543,8 +695,29 @@ async function chooseSession(cwd, sessionsDir, pick) {
  * }} [seams]
  */
 export async function main(argv, { loadTui = () => import(TUI), open, contact, bridgeEntry, pick } = {}) {
-	// Every argument refusal is decided here, before any module, the TUI or the app loads.
+	// Every argument refusal but the `--session` grammar is decided here, before any module, the TUI or
+	// the app loads.
 	const { nativeModules = [], resume = false, ...args } = parseArgs(argv);
+	// `--entwurf-adopt` (#157 B3 I-3): the roots this process received are checked against the context before
+	// anything else is read. The session is the one the garden record names, under the `--session` grammar below.
+	if (args.adopt !== undefined) {
+		requireAdoptRootEnv(args.adopt.metaRoot);
+		args.session = adoptedSession(args.adopt);
+	}
+	// `--session` is held to the owned session-name grammar the runtime selects by, before operator-native
+	// module evaluation, TUI load, open or birth. Only the import-free grammar file is read for it — never
+	// the session store, whose SDK config import fixes package state from the environment an operator
+	// module may still prepare. The shape is lexical — it names a directory under this cwd's session root
+	// by name only, which is not physical symlink confinement.
+	if (args.session !== undefined) {
+		const { isSessionName } = await import(SESSION_NAME);
+		if (!isSessionName(args.session)) {
+			throw refuse(
+				"session-id-malformed",
+				`${JSON.stringify(args.session)} is not a durable session id (<13-digit ms>-<uuid>)`,
+			);
+		}
+	}
 	// The caller's directory, fixed before any operator code runs and handed to the app explicitly.
 	const cwd = process.cwd();
 	const extensions = await loadNativeModules(nativeModules);

package/pi/pi-durable/carrier/runtime.js

@@ -1,6 +1,11 @@
                                                                      
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
-import { clampThinkingLevel, getSupportedThinkingLevels,                         } from "@earendil-works/pi-ai";
+import {
+	clampThinkingLevel,
+	cleanupSessionResources,
+	getSupportedThinkingLevels,
+	                        
+} from "@earendil-works/pi-ai";
 import {
 	                
 	                  
@@ -26,7 +31,7 @@ import {
 	ExecutionEnvs,
 	findInitialAgentModel,
 } from "./harness-setup.js";
-import { selectSession } from "./sessions.js";
+import {                                   selectSession } from "./sessions.js";
 import { Subagent } from "./subagent.js";
 
 const context = BACKGROUND_CONTEXT;
@@ -96,6 +101,8 @@ const context = BACKGROUND_CONTEXT;
 	                                           
 	                                                                                                           
 	                                                                       
+	                                                                                         
+	                             
  
 
                                     
@@ -144,7 +151,16 @@ function titleOf(entry                         )                     {
 	return { title: text.replace(/\s+/g, " ").trim() };
 }
 
-export async function openDurable(options                     = {})                             {
+/** What failed, for an owner end's `cause`. */
+function causeOf(error         )         {
+	return error instanceof Error ? error.message : String(error);
+}
+
+export async function openDurable(options                    )                             {
+	// The type requires it; a JS caller is refused here, before the session root is created.
+	if (options.fence === undefined) {
+		throw new Error("fence-required: an owned durable open takes the owner fence before its native lease");
+	}
 	if (options.model !== undefined && (options.continueSession || options.session !== undefined)) {
 		throw new Error("An explicit model applies only to a new session, not to a continued one");
 	}
@@ -152,12 +168,16 @@ export async function openDurable(options                     = {})
 		throw new Error("A chosen session and the newest one are two different sessions; name one");
 	}
 	const location = await selectSession(
+		options.fence,
 		options.cwd ?? process.cwd(),
 		options.continueSession ?? false,
 		options.session,
 	);
+	const ticket = location.ticket;
 	const envs = new ExecutionEnvs(location.cwd);
 	let harness                     ;
+	// The storage handle Harness.open is handed: if Harness.open itself rejects, this is what was opened.
+	let backendHandle                                                               ;
 	try {
 		const modelRuntime = await ModelRuntime.create();
 		const settingsManager = SettingsManager.create(location.cwd);
@@ -169,8 +189,12 @@ export async function openDurable(options                     = {})
 
 		const pendingReports            = [];
 		let report                           = (error) => pendingReports.push(error);
+		// Recorded BEFORE the call: once the open is attempted, no later outcome proves that nothing was opened.
+		ticket.storageOpenAttempted = true;
+		const backend = await openNodeSqliteStorage(location.database);
+		backendHandle = backend;
 		harness = await Harness.open(
-			await openNodeSqliteStorage(location.database),
+			backend,
 			{
 				models: modelRuntime,
 				registry,
@@ -180,6 +204,7 @@ export async function openDurable(options                     = {})
 			},
 			context,
 		);
+		await ticket.storageOpened();
 		const initial = location.created
 			? await findInitialAgentModel(settingsManager, modelRuntime, options.model)
 			: undefined;
@@ -439,20 +464,94 @@ export async function openDurable(options                     = {})
 					unsubscribeCommits();
 					conversation.dispose();
 					closeTasks();
+					// The resource end the fence records (#157 B3). Storage is `closed` only when the first actual close
+					// resolved, no failure was seen before it, and the Session's own terminal result is not `failed`.
+					const failures            = [];
+					let storage                      = "failed";
+					let envCleanup                        ;
+					let lease                    = "released";
 					try {
 						// Close writes no outcome: a running turn resumes with --continue.
 						await opened.close(context);
-						await envs.cleanup(context);
+						const ended = await opened.closed;
+						if (state.failure === undefined && ended.reason !== "failed") storage = "closed";
+						try {
+							await envs.cleanup(context);
+						} catch (error) {
+							envCleanup = "failed";
+							failures.push(error);
+						}
+					} catch (error) {
+						failures.push(error);
 					} finally {
-						await location.release();
+						// The provider connections the turns left open for reuse: pi-ai keeps a Codex WebSocket per provider
+						// session on a five-minute idle timer, and pi's AgentSession releases them on dispose. Without the same
+						// release here a closed host stays alive until that timer (#157 S3 LIVE-R1). No id: the provider session
+						// ids are docs of the storage this process alone opened, and a host process holds this one Session.
+						try {
+							cleanupSessionResources();
+						} catch (error) {
+							failures.push(error);
+						}
+						try {
+							await location.release();
+						} catch (error) {
+							lease = "failed";
+							failures.push(error);
+						}
 					}
+					const failure = failures[0] ?? (storage === "closed" ? undefined : "the session failed before close");
+					const record           = {
+						storage,
+						lease,
+						...(envCleanup === undefined ? {} : { envCleanup }),
+						...(failure === undefined ? {} : { cause: causeOf(failure) }),
+					};
+					// An env cleanup failure is the caller's error, not the resource's: the end stays `closed`.
+					try {
+						if (storage === "closed" && lease === "released") await ticket.closed(record);
+						else await ticket.closeFailed(record);
+					} catch (error) {
+						failures.push(error);
+					}
+					if (failures.length === 1) throw failures[0];
+					if (failures.length > 1) throw new AggregateError(failures, "The durable session did not close cleanly");
 				})();
 				return closing;
 			},
 		};
 	} catch (error) {
-		await harness?.close(context).catch(() => {});
-		await location.release().catch(() => {});
-		throw error;
+		// An init failure (#157 B3). Only a storage open that was never attempted, with the lease verifiably released,
+		// ends `closed`; once attempted, neither a settled Harness close nor a released lease proves the resource ended.
+		let storage                      = ticket.storageOpenAttempted ? "unknown" : "never-opened";
+		// The init error first, then every cleanup failure: none is dropped.
+		const failures            = [error];
+		// The first close of what was opened: the Harness once it opened, else the storage handle Harness.open was
+		// handed and rejected. A close that settles is no verified close here; one that rejects is a failed storage.
+		const closable = harness ?? backendHandle;
+		if (closable !== undefined) {
+			try {
+				await closable.close(context);
+			} catch (closeError) {
+				storage = "failed";
+				failures.push(closeError);
+			}
+		}
+		let lease                    = "released";
+		try {
+			await location.release();
+		} catch (releaseError) {
+			lease = "failed";
+			failures.push(releaseError);
+		}
+		const ending           = { storage, lease, cause: failures.map(causeOf).join("; ") };
+		try {
+			if (storage === "never-opened" && lease === "released") await ticket.closed(ending);
+			else await ticket.closeFailed(ending);
+		} catch (fenceError) {
+			failures.push(fenceError);
+		}
+		if (failures.length === 1) throw error;
+		throw new AggregateError(failures, `${causeOf(error)}; its cleanup or owner end failed too`);
 	}
 }

package/pi/pi-durable/carrier/session-name.js

@@ -0,0 +1,11 @@
+/**
+ * The durable session name grammar (#157 G3 B-L1), alone in its own file: no imports and no I/O, so the
+ * bootstrap can hold a `--session` value to it before an operator module prepares the environment, without
+ * loading the session store, the SDK config or a lock library first. sessions.ts selects by this same predicate.
+ */
+const SESSION_NAME = /^\d{13}-[0-9a-f-]{36}$/u;
+
+/** Whether `name` has the exact shape of a session directory name: `<13-digit ms>-<uuid>`. */
+export function isSessionName(name        )          {
+	return SESSION_NAME.test(name);
+}