@paigy/harness 0.3.30 → 0.3.32

package/dist/main.js

@@ -4578,9 +4578,9 @@ var require_lib = __commonJS({
 // src/main.ts
 import { app, BrowserWindow, dialog, ipcMain } from "electron";
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname4, join as join12 } from "path";
 
 // ../../packages/sdk/dist/index.js
 import { createRequire as __sdkCreateRequire } from "module";
@@ -8641,6 +8641,7 @@ import { join as join2 } from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 var import_undici = __toESM(require_undici(), 1);
 var require2 = __sdkCreateRequire(import.meta.url);
+var CODEX_ENV = ["CODEX_THREAD_ID", "CODEX_SESSION_ID", "PAIGY_TOKEN", "PAIGY_SESSION_ID", "PAIGY_HARNESS", "PAIGY_INSTANCE_ID"];
 var BACKEND_URL = process.env.PAIGY_BACKEND_URL ?? "https://paigy.ai";
 var NETWORK_MSG = `Can't reach ${BACKEND_URL} \u2014 the connection was blocked or dropped before an HTTP response. If this agent runs in a sandboxed environment with a network allowlist (e.g. Claude Code on the web, CI), ask the user to add the Paigy domain (paigy.ai) to the environment's allowed domains, then retry.`;
 var PROXY_ENV = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
@@ -8695,14 +8696,14 @@ function sessionId() {
 async function reach(url, init) {
   return send(url, init, sessionId());
 }
-function reachAs(session) {
-  return (url, init) => send(url, init, session);
+function reachAs(session, instance) {
+  return (url, init) => send(url, init, session, instance);
 }
-async function send(url, init, session) {
+async function send(url, init, session, instance = envSession("PAIGY_INSTANCE_ID") ?? INSTANCE_ID) {
   try {
     const headers = {
       ...init?.headers,
-      "x-paigy-instance": INSTANCE_ID,
+      "x-paigy-instance": instance,
       "x-paigy-session": session
     };
     return await fetch(url, { ...init, headers, dispatcher: await proxy() });
@@ -9975,7 +9976,18 @@ var AskInputSchema = external_exports.object({
   ask: external_exports.string().trim().min(1).max(1e4).describe(
     "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 each question a Question on the one Goal the ask lands on, never a Goal of its own \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; ANY contact for a person already on a call JOINS that call, whatever channel you asked for, so several arrive as one call."
   ),
-  options: external_exports.array(OptionInputSchema).min(1).max(6).optional()
+  options: external_exports.array(OptionInputSchema).min(1).max(6).optional(),
+  // YOUR VIEW OF ONE OR MANY, A HINT TO PAIGY'S READ (owner, 2026-10-02: "one and many makes sense...
+  // make sure the brain that formats is aware of how it should work"). Three independent fixes went
+  // out as "All three / 1 and 3 only / Just log it" because every card was pick-one. #2943 made this
+  // field override the read; no agent sent it, so nothing changed. The read now decides each card's
+  // shape (`goal/intake.ts` `answerOf`), and this reaches it as the agent's view, weighed, not obeyed.
+  select: external_exports.enum(["one", "many"]).optional().describe(
+    `Your view of how the options are answered: "one" to pick one, "many" to tick any number of them. A hint: Paigy's read decides each card's shape, a checklist when the options can all be wanted at once, a pick when choosing one rules out the others. The person can always answer in their own words as well. Ignored without options.`
+  ),
+  answers: external_exports.string().trim().regex(/^[0-9a-fA-F-]{8,36}$/).optional().describe(
+    "Your reply answers a question the person asked you: the id the conversation shows for it (8 characters or whole). Their question closes with this reply as its answer, and any decision of yours it was holding back goes back to them. Needs parentId: the Goal the question is on. The reply is sent to them as it is; to also ask something new, send that as its own ask."
+  )
 }).strict();
 var StartContactSchema = external_exports.object({
   asks: external_exports.array(AskInputSchema).min(1).describe("The questions to pose, one per object. An ask with a parentId is filed on that Goal as it is; only an ask naming no Goal is placed in the tree by Paigy."),
@@ -9984,7 +9996,7 @@ var StartContactSchema = external_exports.object({
 }).strict();
 var ContactSchema = external_exports.union([StartContactSchema, external_exports.object({ deliveryId: external_exports.string().uuid() }).strict()]);
 var CONTACT_SCHEMA = { type: "object", ...mcpInputSchema(ContactSchema) };
-var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
+var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'select', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. Each option's label must stand on its own \u2014 the person may see only the labels \u2014 so never a label that points into your text ('All three', 'Option 2', '1 and 3 only'). Whether a card is a checklist or a pick is decided by Paigy's read: independent options they may want several of become a checklist, alternatives a pick. select:'many' or select:'one' tells it your view, a hint it weighs. The person can always answer in their own words, so never add an 'Other' option. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
 var CreateGoalSchema = external_exports.object({
   outcome: external_exports.string().trim().min(1).max(1e4),
   /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
@@ -10007,7 +10019,7 @@ var CreateGoalSchema = external_exports.object({
 var CreateGoalToolSchema = CreateGoalSchema.extend({
   idempotencyKey: CreateGoalSchema.shape.idempotencyKey.optional().describe("Optional. One is minted per call; pass your own only so a retry lands on the same Goal.")
 }).strict();
-var CREATE_GOAL_DESCRIPTION = 'Create a durable Goal for an outcome. Without parentGoalId it is placed against your open Goals: if one already IS this work, that Goal comes back (existing: true) and nothing new is created \u2014 continue it; if the work belongs under one, it is created there (parentGoalId in the receipt); otherwise it is a root. Pass parentGoalId yourself to put it under a specific Goal. Pass repo to anchor the work to a specific repository ("owner/repo" or repo name); delegated children inherit it. Pass title to name it in one to five words, as a person would refer to it out loud ("the night rings") \u2014 it heads every list and is spoken on a call; without one the brain writes it. Admission only: the owner must claim it before doing work, then update it as it advances. Returns an admission receipt with goalId, current state, revision, ownerParticipant, and the next step; no Goal content or execution lease.';
+var CREATE_GOAL_DESCRIPTION = 'Create a durable Goal for an outcome. Without parentGoalId it is placed against your open Goals: if one already IS this work, that Goal comes back (existing: true) and nothing new is created \u2014 continue it; if the work belongs under one, it is created there (parentGoalId in the receipt); otherwise it is a root. Pass parentGoalId yourself to put it under a specific Goal. Pass repo to anchor the work to a specific repository ("owner/repo" or repo name); delegated children inherit it. Pass title to name it in one to five words, as a person would refer to it out loud ("the night rings") \u2014 it heads every list and is spoken on a call; without one the brain writes it. Admission only: claim it before doing work, then update it as it advances. Returns an admission receipt with goalId, current state, revision, ownerParticipant, and the next step; no Goal content or execution lease.';
 var UpdateGoalSchema = external_exports.object({
   revision: external_exports.number().int().positive(),
   changes: external_exports.object({
@@ -10043,12 +10055,13 @@ var GetGoalSchema = external_exports.object({
    *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
   diagnose: external_exports.boolean().optional()
 }).strict();
-var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
-var UPDATE_GOAL_DESCRIPTION = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
-var CLAIM_GOAL_DESCRIPTION = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Another agent's Goal that has gone quiet for 3 days (check_replies lists them as stalledOthers) is taken over when you claim it, and becomes yours to finish or cancel. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
+var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it, including others (the ten most recent other contributors, with names, latest entry headlines and times): its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. A question in that conversation reads `open` (nothing yet), `answered` (a choice was made, and `answer` carries it), `replied` (they said something and the read settled the question on their words \u2014 NO option of yours was chosen, and the words are the reply line beside it, so read that before you act), or `closed`. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Every Goal of your person is readable, whichever of their agents owns it; another account's Goals are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
+var UPDATE_GOAL_DESCRIPTION = `Update a Goal you are on at an exact revision. You are on a Goal you own, or one you have written on (an update with progress, or a contact on it); any of your person's agents may write on any of their Goals, and one that never touched a Goal is refused (409 goal_not_joined). State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. A CONTACT ON THIS GOAL MOVES ITS REVISION: a question filed on a Goal is a change to it, so an update prepared before a contact and sent after it is refused as stale (409 goal_revision_conflict) \u2014 re-read the Goal, then write. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
+var CLAIM_GOAL_DESCRIPTION = "Claim a pending answer to your question or the oldest runnable or review-pending Goal you own. Pass goalId to join any Goal of your person; its assignment stays unchanged. Read others before overlapping another agent\u2019s work. Joining lets you contribute and change its state; use update_goal with ownerParticipant when the assignment itself should change. Returns the Goal as get_goal reads it, and marks you as on it, which never shuts another agent out: other agents of your person may write on it and change it too, and two changes at once are told apart by revision (409 goal_revision_conflict).";
 var CHECK_REPLIES_DESCRIPTION = "What is waiting for you: your open Deliveries (a request the user started toward you, a handoff), one row each with its Goals, how many decisions are still open, and the newest words in brief; `assigned`, your Goals nobody has started yet, however they became yours (claim_goal({goalId}) starts one); and `review`, your Goals with something new on them \u2014 the user's answers and notes are Entries on the Goal, not Deliveries. A pure read with no arguments: nothing is consumed, acknowledged or claimed by reading it, so call it on startup, after a long wait, or whenever you want to know what is outstanding. To act on one, claim its Goal (claim_goal) or reread a Delivery in full with contact({deliveryId}). Once you have acted on what arrived, update_goal with reviewed: true clears the Goal from `review` and closes the Deliveries addressed to you on it.";
 var CheckRepliesSchema = external_exports.object({}).strict();
 var AGENT_TOOLS = [
+  { name: "who_is_working", description: "Read your person's agents that contributed in the last 24 hours, newest first: at most 30 agents and their five most recently touched Goals, with their latest entry headline and time. Use get_goal to read a Goal and its other contributors before starting overlapping work. Read-only; no arguments.", inputSchema: mcpInputSchema(CheckRepliesSchema) },
   { name: "contact", description: CONTACT_DESCRIPTION, inputSchema: CONTACT_SCHEMA },
   { name: "check_replies", description: CHECK_REPLIES_DESCRIPTION, inputSchema: mcpInputSchema(CheckRepliesSchema) },
   { name: "create_goal", description: CREATE_GOAL_DESCRIPTION, inputSchema: mcpInputSchema(CreateGoalToolSchema) },
@@ -10058,7 +10071,7 @@ var AGENT_TOOLS = [
 ];
 var AGENT_TOOL_NAMES = AGENT_TOOLS.map((t) => t.name);
 var LIVE_MS = 3 * 6e4;
-var WORKING_MS = 30 * 6e4;
+var WORKING_MS = 60 * 6e4;
 var ContextSchema = external_exports.object({
   title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
   description: external_exports.array(external_exports.string().min(1)).describe(
@@ -10410,7 +10423,13 @@ var AgendaTurnSchema = external_exports.object({
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
-  blocking: external_exports.boolean().optional()
+  blocking: external_exports.boolean().optional(),
+  /** SPOKEN ONLY IF THEY SAY NOTHING (owner, 2026-10-01, call 812de935: "you're gonna re-ask, but it
+   *  shouldn't be the same words … more like, hey, are you still there, or are you able to answer, or
+   *  would you need more information"). The walk holds this turn out of its queue; at the queue's end it
+   *  listens for the last word, and only if that listen is silent is this turn said and asked. If they
+   *  speak, it is dropped and their words are taken like any reply. */
+  ifSilent: external_exports.boolean().optional()
 });
 var CLAIM_STALE_MS = 30 * 6e4;
 var InboxItemSchema = external_exports.object({
@@ -10611,12 +10630,13 @@ var UserSettingsSchema = external_exports.object({
    *  they are an enum on a live column across every account, and the rename is a rename of
    *  what people read (owner, 2026-09-30). */
   sessionMode: external_exports.enum(["default", "all_calls", "silent"]),
-  /** DEAD, AND ACCEPTED ANYWAY (#2813). DateNight is inbox-only with no way back, so nothing
-   *  reads this. It stays OPTIONAL rather than deleted because a phone on the old bundle
-   *  PATCHes the whole settings object and would be refused for sending a key we stopped
-   *  wanting — the same trap `voiceMode` below already documents. #2813 drops the field and
-   *  its column once no installed build still sends it. */
-  silentPush: external_exports.boolean().optional(),
+  /** `silentPush` lived here until #2813 and is now GONE, field and column both. It was kept as an
+   *  optional long after DateNight stopped reading it, on the theory that a phone on an older
+   *  bundle PATCHing the whole settings object would be REFUSED for sending a key we had stopped
+   *  wanting. That theory was wrong about this schema: these are plain `z.object`s with no
+   *  `.strict()` anywhere in this file, and zod STRIPS unknown keys rather than rejecting them, so
+   *  an old bundle's `silentPush` is accepted and ignored. Worth remembering before keeping the
+   *  next dead field for the same reason. */
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
   improveConsent: external_exports.boolean(),
   missedCall: MissedCallSchema.default("backoff_standard"),
@@ -10750,7 +10770,8 @@ var ConnectionSummarySchema = external_exports.object({
 });
 var LedgerItemSchema = external_exports.object({ id: external_exports.string(), parentId: external_exports.string(), title: external_exports.string(), createdAt: external_exports.string() });
 var AgentLedgerSchema = external_exports.object({
-  agent: external_exports.object({ id: external_exports.string(), name: external_exports.string(), revokedAt: external_exports.string().nullable() }),
+  /** Null when the agent has not named itself yet — never a placeholder (owner, 2026-10-01). */
+  agent: external_exports.object({ id: external_exports.string(), name: external_exports.string().nullable(), revokedAt: external_exports.string().nullable() }),
   /** Its own questions you have not answered. */
   asks: external_exports.array(LedgerItemSchema),
   /** Its questions you answered that nobody acted on — still owed to somebody. */
@@ -10917,7 +10938,7 @@ var QueueItemSchema = external_exports.object({
    *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
    *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
    *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
-   *  20260930222356 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+   *  20261001030911 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
    *  Work tab orders as it did before the migration rather than throwing on the missing key.
    *
    *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
@@ -11234,7 +11255,9 @@ var CallRecapSchema = external_exports.object({
      *  summarized like a pre-made option is"), so the row scans like a chosen option and their
      *  own words stay under it. Absent on every line stored before the read wrote them, and on
      *  anything that is not an answer. */
-    lines: external_exports.array(external_exports.object({ entryId: external_exports.string().uuid(), words: external_exports.string(), headline: external_exports.string().optional() }))
+    /** `about` is the request the line answered (its question), null for words that answered none —
+     *  the key the screen groups on, so one question is one row however many times it was answered. */
+    lines: external_exports.array(external_exports.object({ entryId: external_exports.string().uuid(), words: external_exports.string(), headline: external_exports.string().optional(), about: external_exports.string().nullable().optional() }))
   })),
   unfiled: external_exports.array(external_exports.object({ lineId: external_exports.string().uuid(), words: external_exports.string(), atMs: external_exports.number() })),
   more: external_exports.object({ lines: external_exports.number(), entries: external_exports.number(), topics: external_exports.number() })
@@ -11433,6 +11456,22 @@ async function claimSessions(opts = {}) {
   if (!res.ok) throw new Error(`claim_sessions failed: ${res.status}`);
   return (await res.json()).sessions;
 }
+async function claimSessionEnds(opts = {}) {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/ends/claim`, {
+    headers: { authorization: `Bearer ${authToken(opts.token)}` }
+    // the HOST's identity
+  }));
+  if (!res.ok) throw new Error(`claim_session_ends failed: ${res.status}`);
+  return (await res.json()).ends ?? [];
+}
+async function finishSessionEnd(endId, result, opts = {}) {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/ends/${encodeURIComponent(endId)}`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
+    body: JSON.stringify({ result })
+  }));
+  if (!res.ok) await fail("finish_session_end", res);
+}
 async function recordDecision(decision, opts = {}) {
   const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/host/decisions`, {
     method: "POST",
@@ -11556,7 +11595,9 @@ async function contact(input, opts = {}) {
       // this cannot see.
       repo: repoFromRemote(a.repo) ?? a.repo ?? currentRepo() ?? void 0,
       ask: a.ask,
-      options: a.options ?? []
+      options: a.options ?? [],
+      ...a.select ? { select: a.select } : {},
+      ...a.answers ? { answers: a.answers } : {}
     }));
     const res = await ensureAuthed(await send22(`${BACKEND_URL}/api/goals/contact`, {
       method: "POST",
@@ -11879,9 +11920,9 @@ function detectAll(deps = {}) {
 }
 
 // src/host.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/triage/evidence.ts
 var OPEN_STATUSES = ["open", "assigned", "in_progress"];
@@ -12554,6 +12595,59 @@ function holds(pid, procStart, deps) {
   }
   return false;
 }
+function proven(pid, procStart, deps) {
+  if (!deps.alive(pid) || typeof procStart !== "string" || !procStart.trim()) return false;
+  const want = squash(procStart);
+  return ["UTC", "local"].some((zone) => {
+    const got = deps.started(pid, zone);
+    return got !== null && squash(got) === want;
+  });
+}
+function localHolderPids(deps = {}) {
+  const dir = deps.dir ?? join6(process.env.CLAUDE_CONFIG_DIR?.trim() || join6(homedir6(), ".claude"), "sessions");
+  const list = deps.list ?? ((d) => readdirSync2(d));
+  const read = deps.read ?? ((f) => readFileSync4(f, "utf8"));
+  const check = { alive: deps.alive ?? isAlive, started: deps.started ?? psStart };
+  const held = /* @__PURE__ */ new Map();
+  let files;
+  try {
+    files = list(dir);
+  } catch {
+    return held;
+  }
+  for (const file of files) {
+    if (!/^\d+\.json$/.test(file)) continue;
+    let row;
+    try {
+      row = JSON.parse(read(join6(dir, file)));
+    } catch {
+      continue;
+    }
+    const pid = typeof row.pid === "number" ? row.pid : Number(file.slice(0, -5));
+    if (typeof row.sessionId !== "string" || !row.sessionId.trim() || !Number.isInteger(pid) || pid <= 0) continue;
+    if (!holds(pid, row.procStart, check)) continue;
+    const slot = sessionSlot(row.sessionId);
+    held.set(slot, [...held.get(slot) ?? [], { pid, proven: proven(pid, row.procStart, check) }]);
+  }
+  return held;
+}
+function psParent(pid) {
+  try {
+    const out = execFileSync3("ps", ["-o", "ppid=", "-p", String(pid)], { encoding: "utf8", timeout: 2e3 }).trim();
+    const n = Number(out);
+    return Number.isInteger(n) && n > 0 ? n : null;
+  } catch {
+    return null;
+  }
+}
+function descendsFrom(pid, ancestor, parent = psParent) {
+  let at = pid;
+  for (let i = 0; i < 32 && at !== null && at > 1; i += 1) {
+    if (at === ancestor) return true;
+    at = parent(at);
+  }
+  return false;
+}
 function localHolders(deps = {}) {
   const dir = deps.dir ?? join6(process.env.CLAUDE_CONFIG_DIR?.trim() || join6(homedir6(), ".claude"), "sessions");
   const list = deps.list ?? ((d) => readdirSync2(d));
@@ -12583,6 +12677,65 @@ function localHolders(deps = {}) {
   return held;
 }
 
+// src/end.ts
+var GRACE_MS = 5e3;
+async function endTerminal(pid, slot, deps) {
+  try {
+    deps.kill(pid, "SIGTERM");
+  } catch (e) {
+    return { ok: false, kind: "terminal", pid, why: `SIGTERM refused: ${e.message}`.slice(0, 200) };
+  }
+  const grace = deps.graceMs ?? GRACE_MS;
+  for (let waited = 0; waited < grace; waited += 250) {
+    if (!deps.alive(pid)) {
+      deps.log(`session_ended ${JSON.stringify({ sessionId: slot, pid, kind: "terminal", signal: "SIGTERM" })}`);
+      return { ok: true, kind: "terminal", pid, signal: "SIGTERM" };
+    }
+    await deps.sleep(250);
+  }
+  try {
+    deps.kill(pid, "SIGKILL");
+  } catch (e) {
+    return { ok: false, kind: "terminal", pid, why: `SIGKILL refused: ${e.message}`.slice(0, 200) };
+  }
+  deps.log(`session_ended ${JSON.stringify({ sessionId: slot, pid, kind: "terminal", signal: "SIGKILL" })}`);
+  return { ok: true, kind: "terminal", pid, signal: "SIGKILL" };
+}
+async function endSession(end, deps) {
+  const slots = deps.slotsFor(end.agent);
+  if (!slots.length) return { ok: false, why: "not_on_this_host" };
+  let ended2 = null;
+  if (end.which === "harness" || end.which === "any") {
+    for (const slot of slots) {
+      const run = deps.ownRun(slot);
+      if (!run) continue;
+      run.stop();
+      deps.log(`session_ended ${JSON.stringify({ sessionId: slot, kind: "harness", signal: "stop" })}`);
+      ended2 = { ok: true, kind: "harness", signal: "stop" };
+    }
+    if (end.which === "harness" && !ended2) return { ok: false, kind: "harness", why: "no_harness_copy_here" };
+  }
+  if (end.which === "terminal" || end.which === "any") {
+    let terminal = null;
+    let unproven = null;
+    for (const slot of slots) {
+      for (const { pid, proven: proven2 } of deps.pidsFor(slot).filter((p) => !deps.isOwn(p.pid))) {
+        if (!proven2) {
+          deps.log(`session_end_refused ${JSON.stringify({ sessionId: slot, pid, why: "no_proc_start" })}`);
+          unproven = { ok: false, kind: "terminal", pid, why: "no_proc_start" };
+          continue;
+        }
+        terminal = await endTerminal(pid, slot, deps);
+        if (!terminal.ok) return terminal;
+      }
+    }
+    if (terminal) return terminal;
+    if (unproven) return unproven;
+    if (end.which === "terminal") return { ok: false, kind: "terminal", why: "no_terminal_copy_here" };
+  }
+  return ended2 ?? { ok: false, why: "nothing_running_here" };
+}
+
 // src/owner.ts
 import { closeSync as closeSync2, openSync as openSync2, readSync, readdirSync as readdirSync3 } from "fs";
 import { homedir as homedir7 } from "os";
@@ -13979,7 +14132,18 @@ var AskInputSchema2 = external_exports.object({
   ask: external_exports.string().trim().min(1).max(1e4).describe(
     "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 each question a Question on the one Goal the ask lands on, never a Goal of its own \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; ANY contact for a person already on a call JOINS that call, whatever channel you asked for, so several arrive as one call."
   ),
-  options: external_exports.array(OptionInputSchema2).min(1).max(6).optional()
+  options: external_exports.array(OptionInputSchema2).min(1).max(6).optional(),
+  // YOUR VIEW OF ONE OR MANY, A HINT TO PAIGY'S READ (owner, 2026-10-02: "one and many makes sense...
+  // make sure the brain that formats is aware of how it should work"). Three independent fixes went
+  // out as "All three / 1 and 3 only / Just log it" because every card was pick-one. #2943 made this
+  // field override the read; no agent sent it, so nothing changed. The read now decides each card's
+  // shape (`goal/intake.ts` `answerOf`), and this reaches it as the agent's view, weighed, not obeyed.
+  select: external_exports.enum(["one", "many"]).optional().describe(
+    `Your view of how the options are answered: "one" to pick one, "many" to tick any number of them. A hint: Paigy's read decides each card's shape, a checklist when the options can all be wanted at once, a pick when choosing one rules out the others. The person can always answer in their own words as well. Ignored without options.`
+  ),
+  answers: external_exports.string().trim().regex(/^[0-9a-fA-F-]{8,36}$/).optional().describe(
+    "Your reply answers a question the person asked you: the id the conversation shows for it (8 characters or whole). Their question closes with this reply as its answer, and any decision of yours it was holding back goes back to them. Needs parentId: the Goal the question is on. The reply is sent to them as it is; to also ask something new, send that as its own ask."
+  )
 }).strict();
 var StartContactSchema2 = external_exports.object({
   asks: external_exports.array(AskInputSchema2).min(1).describe("The questions to pose, one per object. An ask with a parentId is filed on that Goal as it is; only an ask naming no Goal is placed in the tree by Paigy."),
@@ -13988,7 +14152,7 @@ var StartContactSchema2 = external_exports.object({
 }).strict();
 var ContactSchema2 = external_exports.union([StartContactSchema2, external_exports.object({ deliveryId: external_exports.string().uuid() }).strict()]);
 var CONTACT_SCHEMA2 = { type: "object", ...mcpInputSchema2(ContactSchema2) };
-var CONTACT_DESCRIPTION2 = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
+var CONTACT_DESCRIPTION2 = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'select', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. Each option's label must stand on its own \u2014 the person may see only the labels \u2014 so never a label that points into your text ('All three', 'Option 2', '1 and 3 only'). Whether a card is a checklist or a pick is decided by Paigy's read: independent options they may want several of become a checklist, alternatives a pick. select:'many' or select:'one' tells it your view, a hint it weighs. The person can always answer in their own words, so never add an 'Other' option. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
 var CreateGoalSchema2 = external_exports.object({
   outcome: external_exports.string().trim().min(1).max(1e4),
   /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
@@ -14011,7 +14175,7 @@ var CreateGoalSchema2 = external_exports.object({
 var CreateGoalToolSchema2 = CreateGoalSchema2.extend({
   idempotencyKey: CreateGoalSchema2.shape.idempotencyKey.optional().describe("Optional. One is minted per call; pass your own only so a retry lands on the same Goal.")
 }).strict();
-var CREATE_GOAL_DESCRIPTION2 = 'Create a durable Goal for an outcome. Without parentGoalId it is placed against your open Goals: if one already IS this work, that Goal comes back (existing: true) and nothing new is created \u2014 continue it; if the work belongs under one, it is created there (parentGoalId in the receipt); otherwise it is a root. Pass parentGoalId yourself to put it under a specific Goal. Pass repo to anchor the work to a specific repository ("owner/repo" or repo name); delegated children inherit it. Pass title to name it in one to five words, as a person would refer to it out loud ("the night rings") \u2014 it heads every list and is spoken on a call; without one the brain writes it. Admission only: the owner must claim it before doing work, then update it as it advances. Returns an admission receipt with goalId, current state, revision, ownerParticipant, and the next step; no Goal content or execution lease.';
+var CREATE_GOAL_DESCRIPTION2 = 'Create a durable Goal for an outcome. Without parentGoalId it is placed against your open Goals: if one already IS this work, that Goal comes back (existing: true) and nothing new is created \u2014 continue it; if the work belongs under one, it is created there (parentGoalId in the receipt); otherwise it is a root. Pass parentGoalId yourself to put it under a specific Goal. Pass repo to anchor the work to a specific repository ("owner/repo" or repo name); delegated children inherit it. Pass title to name it in one to five words, as a person would refer to it out loud ("the night rings") \u2014 it heads every list and is spoken on a call; without one the brain writes it. Admission only: claim it before doing work, then update it as it advances. Returns an admission receipt with goalId, current state, revision, ownerParticipant, and the next step; no Goal content or execution lease.';
 var UpdateGoalSchema2 = external_exports.object({
   revision: external_exports.number().int().positive(),
   changes: external_exports.object({
@@ -14047,12 +14211,13 @@ var GetGoalSchema2 = external_exports.object({
    *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
   diagnose: external_exports.boolean().optional()
 }).strict();
-var GET_GOAL_DESCRIPTION2 = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
-var UPDATE_GOAL_DESCRIPTION2 = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
-var CLAIM_GOAL_DESCRIPTION2 = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Another agent's Goal that has gone quiet for 3 days (check_replies lists them as stalledOthers) is taken over when you claim it, and becomes yours to finish or cancel. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
+var GET_GOAL_DESCRIPTION2 = "Read one Goal without claiming it, including others (the ten most recent other contributors, with names, latest entry headlines and times): its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. A question in that conversation reads `open` (nothing yet), `answered` (a choice was made, and `answer` carries it), `replied` (they said something and the read settled the question on their words \u2014 NO option of yours was chosen, and the words are the reply line beside it, so read that before you act), or `closed`. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Every Goal of your person is readable, whichever of their agents owns it; another account's Goals are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
+var UPDATE_GOAL_DESCRIPTION2 = `Update a Goal you are on at an exact revision. You are on a Goal you own, or one you have written on (an update with progress, or a contact on it); any of your person's agents may write on any of their Goals, and one that never touched a Goal is refused (409 goal_not_joined). State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. A CONTACT ON THIS GOAL MOVES ITS REVISION: a question filed on a Goal is a change to it, so an update prepared before a contact and sent after it is refused as stale (409 goal_revision_conflict) \u2014 re-read the Goal, then write. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
+var CLAIM_GOAL_DESCRIPTION2 = "Claim a pending answer to your question or the oldest runnable or review-pending Goal you own. Pass goalId to join any Goal of your person; its assignment stays unchanged. Read others before overlapping another agent\u2019s work. Joining lets you contribute and change its state; use update_goal with ownerParticipant when the assignment itself should change. Returns the Goal as get_goal reads it, and marks you as on it, which never shuts another agent out: other agents of your person may write on it and change it too, and two changes at once are told apart by revision (409 goal_revision_conflict).";
 var CHECK_REPLIES_DESCRIPTION2 = "What is waiting for you: your open Deliveries (a request the user started toward you, a handoff), one row each with its Goals, how many decisions are still open, and the newest words in brief; `assigned`, your Goals nobody has started yet, however they became yours (claim_goal({goalId}) starts one); and `review`, your Goals with something new on them \u2014 the user's answers and notes are Entries on the Goal, not Deliveries. A pure read with no arguments: nothing is consumed, acknowledged or claimed by reading it, so call it on startup, after a long wait, or whenever you want to know what is outstanding. To act on one, claim its Goal (claim_goal) or reread a Delivery in full with contact({deliveryId}). Once you have acted on what arrived, update_goal with reviewed: true clears the Goal from `review` and closes the Deliveries addressed to you on it.";
 var CheckRepliesSchema2 = external_exports.object({}).strict();
 var AGENT_TOOLS2 = [
+  { name: "who_is_working", description: "Read your person's agents that contributed in the last 24 hours, newest first: at most 30 agents and their five most recently touched Goals, with their latest entry headline and time. Use get_goal to read a Goal and its other contributors before starting overlapping work. Read-only; no arguments.", inputSchema: mcpInputSchema2(CheckRepliesSchema2) },
   { name: "contact", description: CONTACT_DESCRIPTION2, inputSchema: CONTACT_SCHEMA2 },
   { name: "check_replies", description: CHECK_REPLIES_DESCRIPTION2, inputSchema: mcpInputSchema2(CheckRepliesSchema2) },
   { name: "create_goal", description: CREATE_GOAL_DESCRIPTION2, inputSchema: mcpInputSchema2(CreateGoalToolSchema2) },
@@ -14077,7 +14242,7 @@ function entryWords(entry) {
   return entry.sources.map((source) => source.text).join("\n");
 }
 var LIVE_MS2 = 3 * 6e4;
-var WORKING_MS2 = 30 * 6e4;
+var WORKING_MS2 = 60 * 6e4;
 var ContextSchema2 = external_exports.object({
   title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
   description: external_exports.array(external_exports.string().min(1)).describe(
@@ -14429,7 +14594,13 @@ var AgendaTurnSchema2 = external_exports.object({
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
-  blocking: external_exports.boolean().optional()
+  blocking: external_exports.boolean().optional(),
+  /** SPOKEN ONLY IF THEY SAY NOTHING (owner, 2026-10-01, call 812de935: "you're gonna re-ask, but it
+   *  shouldn't be the same words … more like, hey, are you still there, or are you able to answer, or
+   *  would you need more information"). The walk holds this turn out of its queue; at the queue's end it
+   *  listens for the last word, and only if that listen is silent is this turn said and asked. If they
+   *  speak, it is dropped and their words are taken like any reply. */
+  ifSilent: external_exports.boolean().optional()
 });
 var CLAIM_STALE_MS2 = 30 * 6e4;
 var InboxItemSchema2 = external_exports.object({
@@ -14630,12 +14801,13 @@ var UserSettingsSchema2 = external_exports.object({
    *  they are an enum on a live column across every account, and the rename is a rename of
    *  what people read (owner, 2026-09-30). */
   sessionMode: external_exports.enum(["default", "all_calls", "silent"]),
-  /** DEAD, AND ACCEPTED ANYWAY (#2813). DateNight is inbox-only with no way back, so nothing
-   *  reads this. It stays OPTIONAL rather than deleted because a phone on the old bundle
-   *  PATCHes the whole settings object and would be refused for sending a key we stopped
-   *  wanting — the same trap `voiceMode` below already documents. #2813 drops the field and
-   *  its column once no installed build still sends it. */
-  silentPush: external_exports.boolean().optional(),
+  /** `silentPush` lived here until #2813 and is now GONE, field and column both. It was kept as an
+   *  optional long after DateNight stopped reading it, on the theory that a phone on an older
+   *  bundle PATCHing the whole settings object would be REFUSED for sending a key we had stopped
+   *  wanting. That theory was wrong about this schema: these are plain `z.object`s with no
+   *  `.strict()` anywhere in this file, and zod STRIPS unknown keys rather than rejecting them, so
+   *  an old bundle's `silentPush` is accepted and ignored. Worth remembering before keeping the
+   *  next dead field for the same reason. */
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
   improveConsent: external_exports.boolean(),
   missedCall: MissedCallSchema2.default("backoff_standard"),
@@ -14769,7 +14941,8 @@ var ConnectionSummarySchema2 = external_exports.object({
 });
 var LedgerItemSchema2 = external_exports.object({ id: external_exports.string(), parentId: external_exports.string(), title: external_exports.string(), createdAt: external_exports.string() });
 var AgentLedgerSchema2 = external_exports.object({
-  agent: external_exports.object({ id: external_exports.string(), name: external_exports.string(), revokedAt: external_exports.string().nullable() }),
+  /** Null when the agent has not named itself yet — never a placeholder (owner, 2026-10-01). */
+  agent: external_exports.object({ id: external_exports.string(), name: external_exports.string().nullable(), revokedAt: external_exports.string().nullable() }),
   /** Its own questions you have not answered. */
   asks: external_exports.array(LedgerItemSchema2),
   /** Its questions you answered that nobody acted on — still owed to somebody. */
@@ -14936,7 +15109,7 @@ var QueueItemSchema2 = external_exports.object({
    *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
    *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
    *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
-   *  20260930222356 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+   *  20261001030911 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
    *  Work tab orders as it did before the migration rather than throwing on the missing key.
    *
    *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
@@ -15251,7 +15424,9 @@ var CallRecapSchema2 = external_exports.object({
      *  summarized like a pre-made option is"), so the row scans like a chosen option and their
      *  own words stay under it. Absent on every line stored before the read wrote them, and on
      *  anything that is not an answer. */
-    lines: external_exports.array(external_exports.object({ entryId: external_exports.string().uuid(), words: external_exports.string(), headline: external_exports.string().optional() }))
+    /** `about` is the request the line answered (its question), null for words that answered none —
+     *  the key the screen groups on, so one question is one row however many times it was answered. */
+    lines: external_exports.array(external_exports.object({ entryId: external_exports.string().uuid(), words: external_exports.string(), headline: external_exports.string().optional(), about: external_exports.string().nullable().optional() }))
   })),
   unfiled: external_exports.array(external_exports.object({ lineId: external_exports.string().uuid(), words: external_exports.string(), atMs: external_exports.number() })),
   more: external_exports.object({ lines: external_exports.number(), entries: external_exports.number(), topics: external_exports.number() })
@@ -15277,11 +15452,14 @@ function sameTail(a, b) {
   return a.length === b.length && a.every((l, i) => l === b[i]);
 }
 
+// src/run.ts
+import { randomUUID as randomUUID6 } from "crypto";
+
 // src/harness/session.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir9 } from "os";
-import { resolve as resolve2, delimiter as delimiter3 } from "path";
+import { resolve as resolve2, delimiter as delimiter3, join as join9 } from "path";
 
 // src/harness/acp.ts
 var none = { events: [], writes: [] };
@@ -15652,6 +15830,21 @@ function startSession(opts) {
   if (!existsSync4(cwd)) {
     queueMicrotask(() => opts.onEvent({ kind: "error", message: `workspace does not exist: ${cwd}` }));
   }
+  const codexConfig = opts.harness === "codex" ? JSON.parse(process.env.CODEX_CONFIG || "{}") : null;
+  if (codexConfig) {
+    const key = "mcp_servers.paigy.env_vars";
+    const configPath = join9(process.env.CODEX_HOME || join9(homedir9(), ".codex"), "config.toml");
+    const saved = existsSync4(configPath) ? readFileSync5(configPath, "utf8") : "";
+    const registered = /\[mcp_servers\.paigy\][\s\S]*?(?=\n\[|$)/.exec(saved)?.[0];
+    const configured = codexConfig["mcp_servers.paigy.command"] || codexConfig["mcp_servers.paigy.url"] || codexConfig.mcp_servers?.paigy?.command || codexConfig.mcp_servers?.paigy?.url;
+    if (!configured && !registered) {
+      codexConfig["mcp_servers.paigy.command"] = "npx";
+      codexConfig["mcp_servers.paigy.args"] = ["-y", "@paigy/mcp@latest"];
+    }
+    const savedVars = registered?.match(/env_vars\s*=\s*\[([\s\S]*?)\]/)?.[1] ?? "";
+    const inherited = [...savedVars.matchAll(/["']([A-Za-z_][A-Za-z0-9_]*)["']/g)].map((match) => match[1]);
+    codexConfig[key] = [.../* @__PURE__ */ new Set([...inherited, ...codexConfig[key] ?? codexConfig.mcp_servers?.paigy?.env_vars ?? [], ...CODEX_ENV])];
+  }
   const child = (opts.spawnFn ?? spawn)(opts.bin ?? ADAPTER_BIN[opts.harness], [], {
     cwd,
     // The adapter shells out to its vendor CLI (`claude`, `codex`), and a GUI- or
@@ -15662,7 +15855,9 @@ function startSession(opts) {
       ...process.env,
       PATH: [process.env.PATH, ...probeDirs()].filter(Boolean).join(delimiter3),
       ...opts.token ? { PAIGY_TOKEN: opts.token } : {},
-      ...opts.resume ?? opts.session ? { PAIGY_SESSION_ID: opts.resume ?? opts.session } : {},
+      ...opts.instance ? { PAIGY_INSTANCE_ID: opts.instance } : {},
+      ...codexConfig ? { CODEX_CONFIG: JSON.stringify(codexConfig) } : {},
+      ...opts.session ?? opts.resume ? { PAIGY_SESSION_ID: opts.session ?? opts.resume } : {},
       // A PUMP DRIVES THIS PROCESS (2026-09-22, #2265): every run `runHarness` starts has the
       // bridge's pump typing answers in, so nothing inside it may start a second delivery path.
       // Exported on EVERY spawn — `PAIGY_SESSION_ID` above is the conversation to resume, and a
@@ -15921,9 +16116,13 @@ async function finish(result, state, rail, opts) {
   const progress = result?.trim().slice(0, 1e4) || void 0;
   let revision = goal.revision;
   try {
-    const held = await rail.claim(goal.id);
+    const held = await rail.read(goal.id);
     revision = held.revision ?? revision;
     const owed = state.noted?.some((b) => b.goals.includes(goal.id));
+    if (held.state === "done" || held.state === "cancelled") {
+      if (!owed) state.goal = void 0;
+      return;
+    }
     if (!held.openDecisionNeedIds?.length && !owed) {
       await rail.update(goal.id, { revision, changes: { state: "done", ...progress ? { progress } : {} }, reason: "The agent finished its turn." });
       state.goal = void 0;
@@ -16012,11 +16211,16 @@ function beat() {
 }
 var BEAT_REPORT_MS = 10 * 6e4;
 var ended = (state) => state === "done" || state === "cancelled";
-function unheard(brief, state, since = null, after = -1) {
+function unheard(brief, state, since = null, after = -1, reviewSince) {
   const seen = state.seen ??= /* @__PURE__ */ new Set();
   const words2 = [];
+  const pendingAt = reviewSince ? Date.parse(reviewSince) : null;
   for (const [i, e] of (brief.entries ?? []).entries()) {
     if (seen.has(e.entryId) || !e.authorParticipant.startsWith("human:")) continue;
+    if (pendingAt !== null && Date.parse(e.createdAt) < pendingAt) {
+      seen.add(e.entryId);
+      continue;
+    }
     if (i <= after) {
       seen.add(e.entryId);
       continue;
@@ -16027,6 +16231,12 @@ function unheard(brief, state, since = null, after = -1) {
     const text = entryWords(e).trim();
     if (text) words2.push(text);
   }
+  if (pendingAt !== null) for (const answer of brief.answers ?? []) {
+    const key = `answer:${answer.decisionNeedId}`;
+    if (seen.has(key) || Date.parse(answer.acceptedAt) < pendingAt) continue;
+    seen.add(key);
+    words2.push(`Answer to question ${answer.decisionNeedId}: ${JSON.stringify(answer.result)}`);
+  }
   return words2;
 }
 function sinceTheWork(brief) {
@@ -16095,9 +16305,9 @@ async function gather(state, rail, held) {
       }
     }
     read.add(goalId);
-    const fresh = found.via === "waiting work" || found.via === "assigned" ? sinceTheWork(brief) : { after: -1 };
+    const fresh = !brief.reviewSince && (found.via === "waiting work" || found.via === "assigned") ? sinceTheWork(brief) : { after: -1 };
     if (found.via === "assigned") announced.add(goalId);
-    heard.push({ goalId, ...found, brief, words: unheard(brief, state, since ?? null, fresh.after), ...fresh.note ? { note: fresh.note } : {} });
+    heard.push({ goalId, ...found, brief, words: unheard(brief, state, brief.reviewSince ? null : since ?? null, fresh.after, brief.reviewSince), ...fresh.note ? { note: fresh.note } : {} });
   }
   for (const { goal, since } of moved) if (read.has(goal.goalId)) state.below.goals.set(goal.goalId, { since, at: goal.updatedAt ?? null });
   return { heard, listed };
@@ -16183,8 +16393,8 @@ async function acknowledge(goalId, brief, state, rail, log2) {
   if (acked.has(goalId) && acked.get(goalId) === brief.revision) return;
   acked.set(goalId, brief.revision);
   try {
-    const claimed = await rail.claim(goalId);
-    const done = await rail.update(goalId, { revision: claimed.revision ?? brief.revision ?? 1, changes: { reviewed: true }, reason: "Read by the harness session; the person's words on it are typed in." });
+    if (brief.revision === void 0) throw new Error("review_revision_missing");
+    const done = await rail.update(goalId, { revision: brief.revision, changes: { reviewed: true }, reason: "Read by the harness session; the person's words on it are typed in." });
     acked.set(goalId, done.revision);
     if (state.goal?.id === goalId && done.revision !== void 0) state.goal.revision = done.revision;
   } catch (error) {
@@ -16221,25 +16431,26 @@ async function look(session, state, rail, opts) {
         brief2 = await rail.claim();
         if (!brief2.goalId || brief2.revision === void 0) {
           state.goal = { id: admitted.goalId, revision: admitted.revision };
-          send2(session, state, [HARNESS_INSTRUCTION, prompt].join("\n\n"));
+          send2(session, state, [HARNESS_INSTRUCTION, named(admitted.goalId, void 0, { outcome: prompt }), prompt].join("\n\n"));
           return;
         }
       } else {
         return;
       }
     }
-    unheard(brief2, state);
-    if (ended(brief2.state)) await rail.update(brief2.goalId, { revision: brief2.revision, changes: { reviewed: true }, reason: "Typed into the session." });
-    else {
+    const pendingWords = brief2.reviewSince ? unheard(brief2, state, null, -1, brief2.reviewSince) : null;
+    if (!pendingWords) unheard(brief2, state);
+    if (!ended(brief2.state)) {
       state.goal = { id: brief2.goalId, revision: brief2.revision };
       state.below = baseline(brief2.goalId, brief2.subtree);
     }
     const outcome2 = brief2.outcome?.trim() ?? "";
-    const said = (brief2.entries ?? []).map((e) => entryWords(e).trim()).filter((w) => w && w.toLowerCase() !== outcome2.toLowerCase());
+    const said = (pendingWords ?? (brief2.entries ?? []).map((e) => entryWords(e).trim())).filter((w) => w && w.toLowerCase() !== outcome2.toLowerCase());
     const left = brief2.earlier ? brief2.earlier.omitted + brief2.earlier.shortened : 0;
     const earlier = left ? `(${left} earlier entries on this Goal are left out or shortened; get_goal with history: true reads them in full.)` : "";
     const fullText = [outcome2, earlier, ...said].filter(Boolean).join("\n\n");
-    send2(session, state, [HARNESS_INSTRUCTION, fullText].filter(Boolean).join("\n\n"));
+    send2(session, state, [HARNESS_INSTRUCTION, named(brief2.goalId, void 0, brief2), fullText].filter(Boolean).join("\n\n"));
+    if (ended(brief2.state)) await acknowledge(brief2.goalId, brief2, state, rail, opts?.log);
     return;
   }
   const brief = await rail.read(state.goal.id);
@@ -16248,6 +16459,7 @@ async function look(session, state, rail, opts) {
     const resolve3 = state.asks?.get(answer.requestEntryId);
     if (!resolve3) continue;
     state.asks.delete(answer.requestEntryId);
+    (state.seen ??= /* @__PURE__ */ new Set()).add(`answer:${answer.decisionNeedId}`);
     resolve3(answer.result);
   }
   if (ended(brief.state)) {
@@ -16325,8 +16537,9 @@ function runHarness(opts) {
   const state = { resting: true };
   const clock4 = beat();
   let session = null;
-  const speaksAs = opts.resume ?? opts.session;
-  const rail = railFor({ token: opts.token, ...speaksAs ? { reach: reachAs(speaksAs) } : {} });
+  const speaksAs = opts.session ?? opts.resume ?? sessionId();
+  const instance = randomUUID6();
+  const rail = railFor({ token: opts.token, reach: reachAs(speaksAs, instance) });
   let inbox;
   if (opts.harness === "claude") {
     try {
@@ -16382,6 +16595,7 @@ ${event.message}`, state, rail, { log: opts.log });
     }
   }
   session = startSession({
+    instance,
     harness: opts.harness,
     cwd: opts.cwd,
     mode: opts.mode,
@@ -16425,7 +16639,7 @@ ${event.message}`, state, rail, { log: opts.log });
 // src/update.ts
 import { execFile } from "child_process";
 import { createRequire } from "module";
-import { dirname as dirname3, join as join9 } from "path";
+import { dirname as dirname3, join as join10 } from "path";
 import { promisify } from "util";
 var SERVICE_LABEL = "ai.paigy.harness";
 var VERSION = createRequire(import.meta.url)("../package.json").version;
@@ -16452,7 +16666,7 @@ async function latestVersion() {
 }
 async function install(version) {
   const bin = dirname3(process.execPath);
-  await promisify(execFile)(join9(bin, "npm"), ["install", "-g", `@paigy/harness@${version}`], {
+  await promisify(execFile)(join10(bin, "npm"), ["install", "-g", `@paigy/harness@${version}`], {
     env: { ...process.env, PATH: `${bin}:${process.env.PATH ?? ""}`, npm_config_update_notifier: "false" },
     timeout: 5 * 6e4
   });
@@ -16503,7 +16717,7 @@ function selfUpdater(deps) {
 }
 
 // src/host.ts
-var HOST_FILE = join10(homedir10(), ".paigy", "host.json");
+var HOST_FILE = join11(homedir10(), ".paigy", "host.json");
 function wakeHarness(slot, saved, claudeTranscript) {
   if (slot === "Desktop") return void 0;
   if (saved !== null) return saved === "agy" || saved === "codex" || saved === "claude" ? saved : void 0;
@@ -16515,7 +16729,7 @@ function wakeHarness(slot, saved, claudeTranscript) {
 }
 function readHostState() {
   try {
-    const s = JSON.parse(readFileSync5(HOST_FILE, "utf8"));
+    const s = JSON.parse(readFileSync6(HOST_FILE, "utf8"));
     if (Date.now() - s.at > 2e4) return null;
     try {
       process.kill(s.pid, 0);
@@ -16687,6 +16901,31 @@ function startHost(opts) {
       void refreshIdentities();
       opts.log(`\u25B6 phone-launched ${label} (${spec.harness}) in ${spec.workspace}`);
     }
+    const ends = await claimSessionEnds(asHost).catch(() => []);
+    for (const end of ends) {
+      const result = await endSession(end, {
+        slotsFor: (agent2) => listSlots().filter((slot) => slot !== "Desktop" && slotIdentity(slot).tokenId === agent2),
+        pidsFor: (slot) => localHolderPids().get(slot) ?? [],
+        ownRun: (slot) => runs.get(runKey(slot))?.run ?? null,
+        isOwn: (pid) => descendsFrom(pid, process.pid),
+        kill: (pid, signal) => {
+          process.kill(pid, signal);
+        },
+        alive: (pid) => {
+          try {
+            process.kill(pid, 0);
+            return true;
+          } catch (e) {
+            return e.code === "EPERM";
+          }
+        },
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+        log: opts.log
+      }).catch((e) => ({ ok: false, why: `end_threw: ${e.message}`.slice(0, 200) }));
+      opts.log(result.ok ? `\u25A0 ended ${end.which} copy of ${end.agent.slice(0, 8)}` : `\u25CC end of ${end.agent.slice(0, 8)} not done here: ${result.why}`);
+      await finishSessionEnd(end.endId, result, asHost).catch(() => {
+      });
+    }
   }
   async function presenceMap() {
     const presence = /* @__PURE__ */ new Map();
@@ -16711,6 +16950,14 @@ function startHost(opts) {
       const key = runKey(slot);
       if (slot === "Desktop" || isRevoked(slot)) return;
       const live = runs.get(key);
+      if (live) {
+        const theirs = (localHolderPids().get(slot) ?? []).map((p) => p.pid).filter((pid) => !descendsFrom(pid, process.pid));
+        if (theirs.length) {
+          opts.log(`session_stood_back ${JSON.stringify({ sessionId: slot, livePid: theirs[0] })} \u2014 a terminal runs this conversation; stopping this host's copy`);
+          live.run.stop();
+          return;
+        }
+      }
       const tokenId = slotIdentity(slot).tokenId;
       const seenByServer = tokenId ? presence.get(tokenId) : void 0;
       const holder = holders.get(slot);
@@ -16956,7 +17203,7 @@ var win = null;
 function log(message) {
   win?.webContents.send("paigy:log", message);
 }
-var ICON = join11(here, "..", "assets", "icon.png");
+var ICON = join12(here, "..", "assets", "icon.png");
 function createWindow() {
   win = new BrowserWindow({
     // Sized for the working log, which is now the window's centerpiece; the layout is a
@@ -16968,9 +17215,9 @@ function createWindow() {
     minHeight: 520,
     icon: ICON,
     // Windows/Linux window icon; macOS uses the dock icon below
-    webPreferences: { preload: join11(here, "preload.cjs"), contextIsolation: true, nodeIntegration: false }
+    webPreferences: { preload: join12(here, "preload.cjs"), contextIsolation: true, nodeIntegration: false }
   });
-  void win.loadFile(join11(here, "..", "renderer", "index.html"));
+  void win.loadFile(join12(here, "..", "renderer", "index.html"));
 }
 var host = null;
 app.whenReady().then(() => {
@@ -17039,7 +17286,7 @@ ipcMain.handle("paigy:agent", async (_e, name) => {
 });
 ipcMain.handle("paigy:agent-log", (_e, name) => {
   try {
-    const all = readFileSync6(join11(homedir11(), ".paigy", "host.log"), "utf8").split("\n");
+    const all = readFileSync7(join12(homedir11(), ".paigy", "host.log"), "utf8").split("\n");
     const mine = all.filter((l) => l.includes(`[${name}]`) || /[▶✖◉⚠]/.test(l) && l.includes(name));
     return mine.slice(-500).join("\n");
   } catch {