@murmurv2/cli 2.11.0 → 2.12.0

package/runtime/scripts/codex-app-server-wake.mjs

@@ -10,6 +10,7 @@ import path from "node:path";
 const DEFAULT_TIMEOUT_MS = 10000;
 const INITIALIZE_TIMEOUT_MS = 10000;
 const DEFAULT_TURN_COMPLETION_TIMEOUT_MS = 180000;
+const DEFAULT_UNOBSERVABLE_TIMEOUT_MS = 300000;
 const SESSION_LOG_POLL_INTERVAL_MS = 1000;
 const SESSION_LOG_TAIL_BYTES = 8 * 1024 * 1024;
 
@@ -87,15 +88,16 @@ const readSessionLogTail = (sessionPath) => {
   }
 };
 
-export const readFinalAnswerFromSessionLog = (sessionPath, turnId) => {
-  if (!sessionPath || !turnId) return "";
+const readTurnFromSessionLog = (sessionPath, turnId) => {
+  if (!sessionPath || !turnId) return null;
   let data = "";
   try {
     data = readSessionLogTail(sessionPath);
   } catch {
-    return "";
+    return null;
   }
 
+  let finalText = '';
   const lines = data.split("\n").filter(Boolean);
   for (let index = lines.length - 1; index >= 0; index -= 1) {
     const line = lines[index];
@@ -110,7 +112,9 @@ export const readFinalAnswerFromSessionLog = (sessionPath, turnId) => {
 
     const payload = entry?.payload || {};
     if (entry.type === "event_msg" && payload.type === "task_complete" && payload.turn_id === turnId) {
-      return typeof payload.last_agent_message === "string" ? payload.last_agent_message : "";
+      return { turnId, status: payload.error == null ? 'completed' : 'failed',
+        error: typeof payload.error === 'string' ? { message: payload.error } : payload.error ?? null,
+        finalText: typeof payload.last_agent_message === "string" ? payload.last_agent_message : finalText };
     }
 
     const metadataTurnId = payload?.internal_chat_message_metadata_passthrough?.turn_id;
@@ -121,12 +125,14 @@ export const readFinalAnswerFromSessionLog = (sessionPath, turnId) => {
       && metadataTurnId === turnId
       && Array.isArray(payload.content)
     ) {
-      return payload.content.map((part) => part?.text || "").join("\n").trim();
+      finalText ||= payload.content.map((part) => part?.text || "").join("\n").trim();
     }
   }
-  return "";
+  return finalText ? { turnId, status: 'inProgress', finalText } : null;
 };
 
+export const readFinalAnswerFromSessionLog = (sessionPath, turnId) => readTurnFromSessionLog(sessionPath, turnId)?.finalText ?? '';
+
 export const buildThreadStartParams = (binding = null, peer = null) => ({
   model: binding?.model ?? peer?.model ?? null,
   modelProvider: null,
@@ -259,13 +265,24 @@ export class CodexAppServerClient {
   startTurnAndWaitForFinal(params, {
     completionTimeoutMs = DEFAULT_TURN_COMPLETION_TIMEOUT_MS,
     sessionPath = null,
+    acceptedTurn = null,
+    onAccepted = () => {},
+    onWorking = () => {},
+    onObservation = () => {},
+    unobservableTimeoutMs = DEFAULT_UNOBSERVABLE_TIMEOUT_MS,
+    pollIntervalMs = SESSION_LOG_POLL_INTERVAL_MS,
+    maxPollIntervalMs = 30000,
   } = {}) {
     return new Promise((resolve, reject) => {
       let settled = false;
       let initialized = false;
-      let turnId = null;
+      let turnId = acceptedTurn?.turnId ?? null;
       let startResult = null;
       let finalText = "";
+      let receipt = Promise.resolve();
+      let observing = Boolean(turnId), polling = false, reported = null;
+      let unobservableSince = acceptedTurn?.unobservableSince ?? null;
+      let unobservableTimer = null, sessionLogTimer = null, pollDelay = pollIntervalMs;
       const requestId = this.nextId++;
       const initId = `init-${this.nextId++}`;
       const url = `ws+unix://${this.socketPath}:/`;
@@ -273,29 +290,86 @@ export class CodexAppServerClient {
         perMessageDeflate: false,
         handshakeTimeout: Math.min(this.timeoutMs, INITIALIZE_TIMEOUT_MS),
       });
-      const timer = setTimeout(() => {
-        finish(new Error(`codex-app-server-turn-completion-timeout:${this.socketPath}:${turnId || "unknown"}`));
-      }, completionTimeoutMs);
-      const sessionLogTimer = setInterval(() => {
-        if (settled || !sessionPath || !turnId) return;
-        const text = readFinalAnswerFromSessionLog(sessionPath, turnId);
-        if (!text) return;
-        finalText = finalText || text;
-        finish(null, { ...startResult, finalText, turnId, source: "session-log" });
-      }, SESSION_LOG_POLL_INTERVAL_MS);
+      const working = (reason) => {
+        observing = true;
+        if (reported !== reason) { reported = reason; onWorking({ threadId: params.threadId, turnId, reason }); }
+      };
+      const recordObservation = (since) => {
+        if (since === unobservableSince) return;
+        unobservableSince = since;
+        receipt = receipt.then(() => onObservation({ unobservableSince: since }));
+        receipt.catch(() => {});
+      };
+      const unavailable = () => {
+        if (settled) return;
+        if (!unobservableSince) recordObservation(new Date().toISOString());
+        working('accepted-turn-unobservable');
+        if (unobservableTimer === null) {
+          const remaining = unobservableTimeoutMs - (Date.now() - Date.parse(unobservableSince));
+          unobservableTimer = setTimeout(() => finish(Object.assign(
+            new Error('accepted-turn-unobservable'), { retryable: false })), Math.max(0, remaining));
+        }
+      };
+      const observable = () => {
+        clearTimeout(unobservableTimer); unobservableTimer = null;
+        recordObservation(null);
+      };
+      let timer = setTimeout(() => {
+        if (turnId) working('completion-window-elapsed');
+        else finish(new Error('codex-app-server-turn-start-timeout'));
+      }, turnId ? completionTimeoutMs : this.timeoutMs);
+      const accept = (id) => {
+        if (!id || turnId) return;
+        turnId = id;
+        try { receipt = Promise.resolve(onAccepted({ threadId: params.threadId, turnId, sessionPath })); }
+        catch (error) { receipt = Promise.reject(error); }
+        // Observe receipt-write failures immediately, without losing the accepted ID.
+        receipt.catch(() => {});
+        clearTimeout(timer);
+        timer = setTimeout(() => working('completion-window-elapsed'), completionTimeoutMs);
+      };
+      const inspect = async () => {
+        if (settled || !turnId || polling) return;
+        const savedTurn = sessionPath && readTurnFromSessionLog(sessionPath, turnId);
+        if (savedTurn && ['completed', 'failed'].includes(savedTurn.status)) {
+          finish(null, { ...startResult, ...savedTurn, finalText: finalText || savedTurn.finalText, source: "session-log" });
+          return;
+        }
+        if (!observing) return;
+        polling = true;
+        try {
+          const turn = await this.readTurn(params.threadId, turnId);
+          if (settled) return;
+          if (!turn || !['inProgress', 'completed', 'failed', 'interrupted'].includes(turn.status)) { unavailable(); return; }
+          observable();
+          if (turn.status === 'inProgress') return;
+          const answer = turn.items?.filter(item => item.type === 'agentMessage' && item.phase === 'final_answer')
+            .map(item => item.text ?? '').join('\n').trim();
+          finish(null, { finalText: finalText || answer || '', turnId, status: turn.status,
+            error: turn.error ?? null, source: 'app-server-read' });
+        } catch { unavailable(); }
+        finally { polling = false; }
+      };
+      const poll = async () => {
+        await inspect();
+        if (settled) return;
+        pollDelay = Math.min(maxPollIntervalMs, pollDelay * 2);
+        sessionLogTimer = setTimeout(poll, pollDelay);
+      };
+      sessionLogTimer = setTimeout(poll, pollDelay);
 
       const finish = (err, result) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        clearInterval(sessionLogTimer);
+        clearTimeout(sessionLogTimer);
+        clearTimeout(unobservableTimer);
         try {
           socket.close();
         } catch {
           // Ignore close races; the request already has a terminal result.
         }
-        if (err) reject(err);
-        else resolve(result);
+        receipt.then(() => err ? reject(err) : resolve(result), reject);
       };
 
       const sendJson = (message) => socket.send(JSON.stringify(message));
@@ -342,12 +416,17 @@ export class CodexAppServerClient {
 
         if (message.id === initId) {
           if (message.error) {
+            if (turnId) { unavailable(); return; }
             finish(new Error(`codex-app-server-initialize-error:${message.error.message || JSON.stringify(message.error)}`));
             return;
           }
           initialized = true;
           sendJson({ method: "initialized" });
-          sendJson({ id: requestId, method: "turn/start", params });
+          if (acceptedTurn) {
+            // Subscribe to the existing thread; never submit this letter again.
+            sendJson({ id: requestId, method: "thread/resume", params: { threadId: params.threadId } });
+            void inspect();
+          } else sendJson({ id: requestId, method: "turn/start", params });
           return;
         }
 
@@ -355,37 +434,38 @@ export class CodexAppServerClient {
 
         if (message.id === requestId) {
           if (message.error) {
+            if (turnId) { unavailable(); return; }
             finish(new Error(`codex-app-server-error:${message.error.message || JSON.stringify(message.error)}`));
             return;
           }
           startResult = message.result;
-          turnId = message.result?.turn?.id || turnId;
+          if (acceptedTurn) sessionPath = message.result?.thread?.path || sessionPath;
+          else accept(message.result?.turn?.id);
           return;
         }
 
+        if (!turnId || (message.params?.threadId && message.params.threadId !== params.threadId)) return;
         if (message.method === "turn/started" && message.params?.turn?.id) {
-          turnId = turnId || message.params.turn.id;
           return;
         }
 
         if (message.method === "item/completed" && message.params?.turnId) {
-          turnId = turnId || message.params.turnId;
           if (message.params.turnId !== turnId) return;
+          observable();
           const item = message.params.item;
           if (item?.type === "agentMessage" && item.phase === "final_answer" && typeof item.text === "string") {
             finalText = item.text;
-            finish(null, { ...startResult, finalText, turnId, source: "app-server-final-item" });
           }
           return;
         }
 
         if (message.method === "turn/completed" && message.params?.turn?.id) {
-          turnId = turnId || message.params.turn.id;
           if (message.params.turn.id !== turnId) return;
           // #106 — `turn.status` (completed | interrupted | failed | inProgress) and
           // `turn.error` are part of the notification; a caller that ignores them cannot
           // tell a finished turn from a broken one.
           const turn = message.params.turn;
+          if (turn.status === 'inProgress') { observable(); working('turn-in-progress'); return; }
           finish(null, {
             ...startResult,
             finalText,
@@ -397,13 +477,38 @@ export class CodexAppServerClient {
         }
       });
       socket.on("error", (err) => {
+        if (settled) return;
+        if (turnId) { unavailable(); return; }
         finish(new Error(`codex-app-server-connect-failed:${this.socketPath}:${err.message}`));
       });
       socket.on("close", () => {
+        if (settled) return;
+        if (turnId) { unavailable(); return; }
         if (!settled) finish(new Error(`codex-app-server-closed-before-response:${this.socketPath}:${initialized ? "after-initialize" : "before-initialize"}`));
       });
     });
   }
+
+  async readTurn(threadId, turnId) {
+    try {
+      const result = await this.request('thread/read', { threadId, includeTurns: true });
+      if (result?.thread?.id !== threadId) return null;
+      const turn = result.thread.turns?.find(turn => turn.id === turnId);
+      if (turn) return turn;
+    } catch (error) {
+      // New paginated threads reject the legacy full-history read.
+      if (!/paginat|includeTurns|full.history/i.test(error.message)) throw error;
+    }
+    let cursor;
+    for (let page = 0; page < 20; page++) {
+      const result = await this.request('thread/turns/list', { threadId, limit: 50, sortDirection: 'desc', itemsView: 'full', ...(cursor ? { cursor } : {}) });
+      const turn = result?.data?.find(turn => turn.id === turnId);
+      if (turn) return turn;
+      if (!result?.nextCursor || result.nextCursor === cursor) return null;
+      cursor = result.nextCursor;
+    }
+    return null;
+  }
 }
 
 /**
@@ -536,6 +641,15 @@ export const createCodexAppServerInjector = ({
   // so the mapping survives restarts; without one it still lives per conversation, only
   // in memory. A static `peer.threadId` is an explicit pin and is never written here.
   const memoryThreads = new Map();
+  const memoryTurns = new Map();
+  const turns = {
+    get: async msgId => memoryTurns.get(msgId) ?? await threadStore?.getWakeTurn?.(msgId),
+    set: async record => { memoryTurns.set(record.msgId, record); await threadStore?.setWakeTurn?.(record); },
+    delete: async (msgId, turnId) => {
+      await threadStore?.deleteWakeTurn?.(msgId, turnId);
+      if (memoryTurns.get(msgId)?.turnId === turnId) memoryTurns.delete(msgId);
+    },
+  };
   const threads = threadStore ?? {
     getWakeThread: async (peerId, conversationId) => memoryThreads.get(`${peerId}|${conversationId}`),
     setWakeThread: async (record) => { memoryThreads.set(`${record.peerId}|${record.conversationId}`, record); },
@@ -559,12 +673,17 @@ export const createCodexAppServerInjector = ({
       return { finalText: null, turnId: null, source: "relay-idempotent", replyMsgId };
     }
 
+    const accepted = await turns.get(payload.msgId);
+    if (accepted && (accepted.peerId !== String(payload.from ?? '')
+      || accepted.conversationId !== String(payload.conversationId ?? '') || accepted.socketPath !== socketPath)) {
+      throw Object.assign(new Error('codex-app-server-accepted-turn-binding-changed'), { retryable: false });
+    }
     const client = new Client({ socketPath, timeoutMs });
     const text = buildCodexTurnText(payload, peer);
     const threadStartBinding = peer?.threadStartBinding ?? (resolveThreadStartBinding ? await resolveThreadStartBinding(payload, peer) : null);
     const bindingMetadata = threadStartBinding?.metadata ?? {};
     const shouldResumeThread = peer?.resume === true || (peer?.resume !== false && peer?.relayFinalToMurmur === true);
-    let threadPath = null;
+    let threadPath = accepted?.sessionPath ?? null;
     const resumeThread = async (threadId) => {
       if (!threadId || peer?.resume === false) return;
       try {
@@ -592,13 +711,30 @@ export const createCodexAppServerInjector = ({
       },
     });
     const startTurn = async (threadId) => {
-      if (relayEnabled) {
+      // A configuration change must not turn an accepted receipt back into a
+      // fire-and-forget start. Observe it even if reply relay was disabled later.
+      if (relayEnabled || accepted) {
         const result = await client.startTurnAndWaitForFinal(turnParams(threadId), {
           completionTimeoutMs: Number(peer?.replyTimeoutMs) || DEFAULT_TURN_COMPLETION_TIMEOUT_MS,
           sessionPath: threadPath,
+          acceptedTurn: accepted,
+          unobservableTimeoutMs: peer?.unobservableTimeoutMs ?? DEFAULT_UNOBSERVABLE_TIMEOUT_MS,
+          onAccepted: async receipt => {
+            await turns.set({ ...receipt, msgId: payload.msgId, peerId: String(payload.from ?? ''),
+              conversationId: String(payload.conversationId ?? ''), socketPath });
+            log('info', 'Codex app-server wake turn accepted', { msgId: payload.msgId, threadId, turnId: receipt.turnId });
+          },
+          onWorking: ({ turnId, reason }) => log(reason === 'accepted-turn-unobservable' ? 'warn' : 'info',
+            reason === 'accepted-turn-unobservable' ? 'Codex accepted turn outcome unavailable; wake retained' : 'Codex Assistant still working; wake retained',
+            { msgId: payload.msgId, threadId, turnId, reason }),
+          onObservation: async ({ unobservableSince }) => {
+            const receipt = await turns.get(payload.msgId);
+            if (receipt) await turns.set({ ...receipt, unobservableSince });
+          },
         });
         const status = typeof result?.status === "string" ? result.status : null;
         if (status && status !== "completed") {
+          if (status === 'failed' && result.turnId) await turns.delete(payload.msgId, result.turnId);
           // #106 — a turn that failed or was interrupted is not a success, whatever text
           // it left behind. `failed` may clear on a retry (model/provider hiccup);
           // `interrupted` means someone stopped it on purpose — do not run it again.
@@ -616,6 +752,7 @@ export const createCodexAppServerInjector = ({
             { retryable: status === "failed" },
           );
         }
+        if (!relayEnabled) return result;
         const finalText = String(result?.finalText || "").trim();
         if (!finalText) {
           // #106 — the turn ended and there is nothing to relay. That is not a relay;
@@ -670,9 +807,9 @@ export const createCodexAppServerInjector = ({
 
     // Resolution order: a remembered thread for this conversation, unless it was seeded to
     // replace a pin that has since changed; then the static pin; then a fresh seed.
-    const remembered = await threads.getWakeThread(threadKey.peerId, threadKey.conversationId);
+    const remembered = accepted ? null : await threads.getWakeThread(threadKey.peerId, threadKey.conversationId);
     const rememberedUsable = remembered && (!peer?.threadId || !remembered.replacesThreadId || remembered.replacesThreadId === peer.threadId);
-    let threadId = rememberedUsable ? remembered.threadId : peer?.threadId;
+    let threadId = accepted?.threadId ?? (rememberedUsable ? remembered.threadId : peer?.threadId);
     if (rememberedUsable && remembered.threadPath) threadPath = remembered.threadPath;
     let seededHere = false;
     if (!threadId) {
@@ -682,11 +819,11 @@ export const createCodexAppServerInjector = ({
 
     let result;
     try {
-      if (shouldResumeThread && !seededHere) await resumeThread(threadId);
+      if (shouldResumeThread && !seededHere && !accepted) await resumeThread(threadId);
       result = await startTurn(threadId);
     } catch (err) {
       const e = err instanceof Error ? err : new Error(String(err));
-      if (!e.message.startsWith("codex-app-server-error:thread not found:")) throw e;
+      if (accepted || !e.message.startsWith("codex-app-server-error:thread not found:")) throw e;
       threadId = await seedThread("re-seeded");
       result = await startTurn(threadId);
     }

package/runtime/scripts/daemon-contacts.mjs

@@ -0,0 +1,56 @@
+import { AgentConfigCache } from '../packages/mcp-server/dist/src/agent-config.js';
+import { isDeepStrictEqual } from 'node:util';
+
+const key = value => typeof value === 'string' && Buffer.from(value, 'base64').length === 32
+  && Buffer.from(value, 'base64').toString('base64') === value;
+const contactId = value => /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(value);
+
+/** The config file's atomic replacement is the cross-platform reload trigger.
+ * Share MCP's owner/path/identity/runtime pinning. Failed reads cannot introduce
+ * new trust: keep the last valid Contacts available and report the failure. */
+export function createDaemonContacts(configPath, log = () => {}) {
+  const cache = new AgentConfigCache(configPath);
+  const initial = cache.read();
+  const config = { ...initial, peers: {} };
+  let applied, failure, invalidSignature = '[]';
+  let diagnostic = { state: 'current', count: 0, invalidCount: 0,
+    lastSuccessAt: null, lastError: null, lastErrorAt: null };
+  const refresh = (force = false) => {
+    try {
+      const next = cache.read(force);
+      if (applied === next && !failure) return config.peers;
+      const invalid = [];
+      const peers = Object.fromEntries(Object.entries(next.peers).filter(([id, peer]) => {
+        if (contactId(id) && peer && typeof peer.subject === 'string' && /^[A-Za-z0-9_.:-]+$/.test(peer.subject)
+            && key(peer.encryption?.publicKey) && key(peer.signing?.publicKey)) return true;
+        invalid.push(contactId(id) ? id : null);
+        return false;
+      }));
+      const signature = JSON.stringify(invalid.sort());
+      const changed = !isDeepStrictEqual(config.peers, peers);
+      config.peers = peers;
+      const at = new Date().toISOString();
+      diagnostic = { state: invalid.length ? 'partial' : 'current', count: Object.keys(peers).length,
+        invalidCount: invalid.length, lastSuccessAt: at,
+        lastError: invalid.length ? 'agent-config-peer-invalid' : null,
+        lastErrorAt: invalid.length ? signature !== invalidSignature || failure ? at : diagnostic.lastErrorAt : null };
+      if (invalid.length && (signature !== invalidSignature || failure))
+        log('warn', 'Invalid Contacts skipped', { reason: 'agent-config-peer-invalid', contacts: invalid, count: invalid.length });
+      // MCP may change ctime by protecting the same file. Compare content, not
+      // cache object identity, before claiming that Contacts changed.
+      if ((applied && changed) || failure) log('info', 'Contacts reloaded', { count: diagnostic.count });
+      invalidSignature = signature;
+      applied = next; failure = undefined;
+      return config.peers;
+    } catch (error) {
+      const reason = /^agent-config-[a-z-]+$/.test(error?.message) ? error.message : 'agent-config-unavailable-retry-or-restart';
+      if (failure !== reason) log('error', 'Contacts reload failed', { reason });
+      diagnostic = { ...diagnostic, state: 'retained', lastError: reason,
+        lastErrorAt: failure === reason ? diagnostic.lastErrorAt : new Date().toISOString() };
+      failure = reason;
+      return config.peers;
+    }
+  };
+  refresh();
+  return { config, refresh, diagnostics: () => ({ ...diagnostic }) };
+}

package/runtime/scripts/daemon-flush-tick.mjs

@@ -0,0 +1,25 @@
+// One pass of the daemon delivery loop. Outbound letters and notifications keep flowing
+// while an assistant works: a wake turn can last many minutes, and awaiting it here held
+// every reply in the outbox until the turn ended or timed out (24.09, the Mac sat on a
+// ping from 11:29 to 11:36). WakeMonitor.drain() is single-flight, so starting it on
+// every tick only kicks the running dispatcher; its rows stay durable across restarts.
+export async function flushTick({ flushOutbox, flushNotify, drainWake, log }) {
+  try {
+    await flushOutbox();
+  } catch (err) {
+    log("error", "Outbox flush error", { error: err instanceof Error ? err.message : String(err) });
+  }
+
+  try {
+    await flushNotify();
+  } catch (err) {
+    log("error", "Notify flush error", { error: err instanceof Error ? err.message : String(err) });
+  }
+
+  // #105 — retry tick. With no drain running this reads the table: deliveries whose
+  // backoff has elapsed and rows a previous process left behind. A running drain is
+  // only nudged; such rows wait until it frees its conversations.
+  Promise.resolve()
+    .then(drainWake)
+    .catch((err) => log("error", "Wake retry drain error", { error: err instanceof Error ? err.message : String(err) }));
+}

package/runtime/scripts/daemon-link-watch.mjs

@@ -0,0 +1,60 @@
+/**
+ * Exit when the server link is gone (#276).
+ *
+ * A daemon whose broker connection has closed for good, or has been lost longer than the
+ * operator allows, keeps its PID and its supervisor's "healthy" while delivering nothing.
+ * This watch turns that into a non-zero exit so systemd, launchd or the Windows Service
+ * manager restart the daemon and the failure becomes visible in their status.
+ *
+ * - `exitOnClosed` (default on): the connection reported `closed` — auth abort after a
+ *   rotated token, reconnect attempts exhausted — and will never come back by itself.
+ * - `maxDisconnectedMs` (default 0 = off): the link has been lost longer than this.
+ */
+export function createLinkWatch({ observation, maxDisconnectedMs = 0, exitOnClosed = true, intervalMs, log = () => {}, onLost, now = () => Date.now() }) {
+  const limit = Number.isFinite(maxDisconnectedMs) && maxDisconnectedMs > 0 ? Math.floor(maxDisconnectedMs) : 0;
+  const enabled = exitOnClosed || limit > 0;
+  const period = intervalMs ?? (limit > 0 ? Math.max(1000, Math.min(30000, Math.floor(limit / 4))) : 5000);
+  let timer;
+  let fired = false;
+
+  const fire = (reason, data) => {
+    if (fired) return true;
+    fired = true;
+    log("fatal", "Server link is gone; exiting so the supervisor restarts the daemon", { reason, ...data });
+    onLost?.(reason);
+    return true;
+  };
+
+  const check = () => {
+    if (fired) return true;
+    if (!enabled) return false;
+    const broker = observation.broker();
+    if (exitOnClosed && broker.state === "closed") {
+      return fire("broker.link-closed", { lastError: broker.lastError, disconnectedAt: broker.disconnectedAt });
+    }
+    if (limit > 0) {
+      const disconnectedForMs = observation.disconnectedForMs(now());
+      if (disconnectedForMs > limit) {
+        return fire("broker.link-lost", { disconnectedAt: broker.disconnectedAt, disconnectedForMs, maxDisconnectedMs: limit,
+          reconnectAttempts: broker.reconnectAttempts });
+      }
+    }
+    return false;
+  };
+
+  return {
+    enabled,
+    maxDisconnectedMs: limit,
+    intervalMs: period,
+    start() {
+      if (!enabled || timer) return;
+      timer = setInterval(check, period);
+      timer.unref();
+    },
+    stop() {
+      if (timer) clearInterval(timer);
+      timer = undefined;
+    },
+    check,
+  };
+}

package/runtime/scripts/daemon-observation.mjs

@@ -3,38 +3,94 @@ import { realpath } from "node:fs/promises";
 import { writePrivateJson } from "./secure-state.mjs";
 
 /** Non-secret, PID/store-bound liveness evidence for the read-only setup CLI. */
-export function createDaemonObservation({ dataDir, storePath, agentId, wake, log = () => {} }) {
+export function createDaemonObservation({ dataDir, storePath, agentId, wake, contacts = () => null, log = () => {} }) {
   const startedAt = new Date().toISOString();
   const snapshot = { schema: "murmur.runtime/1", agentId, pid: process.pid, startedAt,
     storePath: null, measuredAt: null, wake: { ...wake, lastFault: null, lastFaultAt: null },
-    broker: { state: "unknown", connectedAt: null, lastError: null, lastErrorAt: null } };
-  let writing = false;
+    broker: { state: "disconnected", connectedAt: null, disconnectedAt: startedAt, reconnectAttempts: 0,
+      lastError: "broker.connecting", lastErrorAt: startedAt } };
+  const knownReasons = ["broker.unauthorized", "broker.permission-denied", "broker.connection-refused", "broker.name-unresolved",
+    "broker.timeout", "broker.connection-failed", "broker.stale-connection", "broker.closed"];
+  const safeReason = (value) => knownReasons.includes(value) ? value : "broker.connection-failed";
+  let writes = Promise.resolve();
   let timer;
-  const write = async () => {
-    if (writing) return;
-    writing = true;
+  const write = () => writes = writes.then(async () => {
     try {
       snapshot.storePath = await realpath(storePath);
       snapshot.measuredAt = new Date().toISOString();
+      snapshot.contacts = contacts();
       await writePrivateJson(path.join(dataDir, "daemon-observation.json"), snapshot);
     } catch { log("warn", "Daemon observation write failed", { reason: "runtime.observation-write-failed" }); }
-    finally { writing = false; }
-  };
+  });
   return {
-    async start() { await write(); timer = setInterval(() => { void write(); }, 5000); timer.unref(); },
-    async connected() { snapshot.broker.state = "connected"; snapshot.broker.connectedAt = new Date().toISOString(); await write(); },
+    async start() {
+      log("info", "Connecting to server", { reason: "broker.connecting" });
+      await write(); timer = setInterval(() => { void write(); }, 5000); timer.unref();
+    },
+    async connected() {
+      const broker = snapshot.broker;
+      broker.state = "connected"; broker.connectedAt = new Date().toISOString();
+      broker.disconnectedAt = null; broker.reconnectAttempts = 0;
+      await write();
+    },
     onStatus(event) {
-      if (event.type === "disconnect") {
-        snapshot.broker.state = "disconnected";
-        snapshot.broker.lastError = "broker.disconnected";
-        snapshot.broker.lastErrorAt = new Date().toISOString();
+      const broker = snapshot.broker;
+      const at = new Date().toISOString();
+      if (event.type === "connect_error") {
+        const reason = safeReason(event.data?.reason);
+        broker.state = reason === "broker.unauthorized" ? "unauthorized" : "disconnected";
+        broker.lastError = reason;
+        broker.lastErrorAt = at;
+        if (broker.disconnectedAt === null) broker.disconnectedAt = at;
+        log("warn", "Server connection failed; will retry", { reason });
+      } else if (event.type === "disconnect") {
+        broker.state = "disconnected";
+        broker.lastError = "broker.disconnected";
+        broker.lastErrorAt = at;
+        if (broker.disconnectedAt === null) broker.disconnectedAt = at;
+        broker.reconnectAttempts = 0;
+      } else if (event.type === "reconnecting") {
+        // #276 — every failed reconnect attempt is counted here; the broker logs them rate-limited.
+        if (broker.state === "connected") broker.state = "disconnected";
+        if (broker.disconnectedAt === null) {
+          broker.disconnectedAt = typeof event.data?.disconnectedAt === "string" ? event.data.disconnectedAt : at;
+        }
+        broker.reconnectAttempts = Number.isSafeInteger(event.data?.attempts) ? event.data.attempts : broker.reconnectAttempts + 1;
+        broker.lastError = "broker.reconnecting";
+        broker.lastErrorAt = at;
+      } else if (event.type === "error" || event.type === "staleConnection") {
+        const reason = safeReason(event.data?.reason);
+        broker.lastError = reason;
+        broker.lastErrorAt = at;
+        if (reason === "broker.unauthorized" && broker.state !== "connected") broker.state = "unauthorized";
+      } else if (event.type === "closed") {
+        // The client gave up (auth abort, attempts exhausted): nothing reconnects this process.
+        const reason = safeReason(event.data?.reason);
+        broker.state = "closed";
+        broker.lastError = reason;
+        broker.lastErrorAt = at;
+        if (broker.disconnectedAt === null) broker.disconnectedAt = at;
+        log("error", "Server connection closed for good; it will not reconnect on its own", { reason });
       } else if (event.type === "reconnect") {
-        snapshot.broker.state = "connected";
-        snapshot.broker.connectedAt = new Date().toISOString();
+        broker.state = "connected";
+        broker.connectedAt = at;
+        broker.disconnectedAt = null;
+        broker.reconnectAttempts = 0;
       }
-      void write();
+      return write();
+    },
+    /** Read-only copy of the broker part of the snapshot. */
+    broker() { return { ...snapshot.broker }; },
+    /** Milliseconds since the server link was lost; 0 while connected. */
+    disconnectedForMs(now = Date.now()) {
+      const broker = snapshot.broker;
+      if (broker.state === "connected" || !broker.disconnectedAt) return 0;
+      return Math.max(0, now - Date.parse(broker.disconnectedAt));
     },
     observeLog(level, message, data) {
+      // This verdict was already committed to its message row. Let status follow
+      // that row (including an explicit CLI dismissal), not a sticky runtime fault.
+      if (message === 'WakeMonitor wake dead-lettered' && data?.error === 'accepted-turn-unobservable') return;
       // Preserve a monitor crash even when SQLite could not record the failed wake.
       // Never persist hook commands, stdout, message text or arbitrary error strings.
       if ((level === "error" || level === "fatal") && message.startsWith("WakeMonitor")) {
@@ -43,6 +99,6 @@ export function createDaemonObservation({ dataDir, storePath, agentId, wake, log
         return write();
       }
     },
-    stop() { if (timer) clearInterval(timer); },
+    async stop() { if (timer) clearInterval(timer); await writes; },
   };
 }