dsh-cindy-host 0.1.33 → 0.1.34

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.34 — 2026-11-05
+
+- Project durable native failed turns as stable, sanitized error rows and terminal maker events in both cold history and live delivery. Preserve native failure/retry ownership, expose only fixed known-code messages and validated HTTP status, and repair reconnect state without stopping newer turns or leaking provider diagnostics.
+
+- Register user questions before either surface displays them, including sessions a phone has never visited. Replay the existing pending cards on session subscribe/reconnect; keep them through temporary relay recovery and remove the hidden Host question timeout, without changing permission ownership/deadlines.
+- Settle local and phone answers through the same pending completion; preserve native cancellation/timeout errors and clear both cards on task stop instead of returning empty/undefined answers. Keep the existing Cindy protocol and DSH native UI. Add focused Host regressions and opt-in tests against installed Cordis/userQuestions/Gateway; these are not live-handset acceptance or a production deployment.
+
 ## 0.1.33 — 2026-11-04
 
 - Add authorized current-surface reference-source history through native observations, real message identities, filters/cursors and explicit clipping metadata. Keep frozen target-reference capability false and reject structured contexts before every admission/edit/preparation/replay boundary; do not disguise source reads or plain links as target consumption.

package/README.md

@@ -4,12 +4,12 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.33** adds the regional authentication UI, public reasoning streaming and the native capability subsets described below.
+Version **0.1.34** improves native/phone question synchronization and cancellation, and safely displays durable model/turn failures. It retains 0.1.33's regional authentication UI, public reasoning streaming and native capability subsets.
 
 It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.33
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.34
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.
@@ -99,6 +99,20 @@ During generation, `assistant/chunk` reasoning deltas are displayed as temporary
 
 This ships in 0.1.33; handset acceptance is separate from package checks and local Host activation. Offline regressions execute the pinned real Cindy mobile thinking normalizer; live phone/network acceptance remains separate.
 
+## Questions on DSH and Cindy
+
+While the Host bridge is enabled, questions are registered before presentation, even if no phone has opened that session. DSH's native question UI and the existing Cindy card can both answer; the first accepted answer settles the shared pending entry and dismisses the other surface. Session open/reconnect replays pending cards with the same request IDs. Temporary relay loss does not cancel questions.
+
+Questions have no extra Host timeout. The caller's stop/cancel and DSH's own timed-question lifecycle still apply; explicit Host switch-off/unload cancels outstanding bridge waits. Permission cards retain their existing ownership and deadline. No Cindy/DSH patch or phone protocol upgrade is needed. This does not add cross-process recovery or mobile late-answer support after DSH has continued a timed call.
+
+Run the focused regressions with:
+
+```sh
+node --test test/user-question-bridge.test.js test/host-approvals.test.js test/dsh-plugin.test.js
+```
+
+The opt-in installed-runtime suite additionally exercises real Cordis, userQuestions and Gateway event delivery/replay/cancellation. Point `DSH_TEST_NATIVE_MODULES` at a built DSH node_modules directory, then run `node --test --test-isolation=none test/user-question-native.test.js`. For an Electron asar installation use the installed executable with `ELECTRON_RUN_AS_NODE=1`. These checks use isolated contexts and do not reload the running GUI; real-handset acceptance is separate.
+
 ## Model switching follows DSH
 
 When native `sessionController.selectModel` is composed, the Host tells Cindy to delegate model-window decisions to DSH. Users may select another model during a running turn and select the original model again. DSH validates the provider/model/effort and records the selection for the **next model request**; an already-issued request is not interrupted. DSH owns context preparation and compaction, not Cindy's legacy 90%-window precheck or a Host-side summary/rebuild implementation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.33",
+  "version": "0.1.34",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",

package/src/cindy-channels.js

@@ -609,13 +609,17 @@ export function createChannelRouter({
           }
         }
         for (const sessionId of sessionIds) {
-          let row = live === null ? null : live.find((candidate) => String(candidate?.id) === sessionId) ?? null;
-          if (typeof getSession === 'function') {
-            try { row = await getSession(sessionId) ?? null; } catch { row = null; }
+          if (typeof subscribing.restoreTurnState === 'function') {
+            await subscribing.restoreTurnState(request.src, sessionId);
+          } else {
+            let row = live === null ? null : live.find((candidate) => String(candidate?.id) === sessionId) ?? null;
+            if (typeof getSession === 'function') {
+              try { row = await getSession(sessionId) ?? null; } catch { row = null; }
+            }
+            const running = row === null ? subscribing.isSessionRunning(sessionId) === true : row.running === true;
+            if (running) subscribing.pushTurnRunning(sessionId);
+            else subscribing.pushTurnIdle(sessionId);
           }
-          const running = row === null ? subscribing.isSessionRunning(sessionId) === true : row.running === true;
-          if (running) subscribing.pushTurnRunning(sessionId);
-          else subscribing.pushTurnIdle(sessionId);
           // …and the two things a push that never arrived would have carried.
           //
           // Measured: an app returning from the background does an unsubscribe → resubscribe

package/src/dsh-message-fold.js

@@ -17,6 +17,7 @@
  */
 import { deriveEventMessage, isAppendSurfaceEvent } from '@deepseek-ai/dsh-session/surface';
 import { createReasoningStream } from './reasoning-stream.js';
+import { turnErrorRow, turnStateFromEvents } from './turn-error.js';
 import { toCindyMessageRows, toCindyMessages, hydrateImageAttachments } from './cindy-message-row.js';
 
 /** Default page size when the controller does not ask for one. */
@@ -81,6 +82,8 @@ export const TRANSCRIPT_CACHE_SESSIONS = 3;
  */
 export function foldSessionEvent(event, { sessionId, now = () => new Date() }) {
   if (event === null || typeof event !== 'object') return [];
+  const error = turnErrorRow(event, sessionId);
+  if (error) return [error];
   if (!isAppendSurfaceEvent(event)) return [];
   let message;
   try {
@@ -387,6 +390,11 @@ export function createMessageReader({
       // gap as "nothing happened here".
       if (Number.isFinite(event.seq)) lastSeq = event.seq;
       reasoning.consume(event);
+      const error = turnErrorRow(event, sessionId);
+      if (error) {
+        entries.push({ rows: [error] });
+        continue;
+      }
       const todo = entryForTodoWrite(event);
       if (todo !== null) {
         entries.push(todo);
@@ -477,7 +485,15 @@ export function createMessageReader({
     flight.promise = Promise.resolve().then(async () => {
       try {
         const read = await entriesFor(sessionId);
-        const rows = toCindyMessages(read.entries, { sessionId, now });
+        // Error rows are presentation, never fabricated model messages. Keep each
+        // message's block order while reversing event order, as toCindyMessages does.
+        const seen = new Set();
+        const rows = read.entries.slice().reverse().flatMap(entry => entry.rows
+          ?? toCindyMessages([entry], { sessionId, now })).filter(row => {
+          if (seen.has(row.id)) return false;
+          seen.add(row.id);
+          return true;
+        });
         // A live event during replay makes the snapshot unsafe to cache. Explicit
         // invalidation also detaches this flight so a post-invalidation read starts
         // fresh; an older completion must never overwrite that newer generation.
@@ -593,6 +609,12 @@ export function createMessageReader({
    * The array is the cache's own, so callers treat it as read-only.
    */
   readMessages.all = async (sessionId) => visibleRows(await ensureTranscript(sessionId));
+  // Recovery deliberately bypasses the transcript cache: stale history cannot
+  // decide whether the *current* turn has ended. Runtime generation guards the read.
+  readMessages.turnState = async (sessionId) => {
+    const snapshot = await readSessionLog(sessionId);
+    return turnStateFromEvents(snapshot?.events, sessionId);
+  };
   readMessages.stats = stats;
   return readMessages;
 }

package/src/dsh-plugin.js

@@ -1685,48 +1685,43 @@ export function createSettingsScope(ctx, entryId, projected) {
 
 
 /**
- * Present one interaction to Cindy and the downstream DSH UI, settling on the first answer.
- * The downstream branch receives a private abort signal so the losing local card is dismissed;
- * without that cancellation contract a Promise.race would leak a parked waterfall listener.
+ * Forward once to DSH and settle both surfaces through the existing registry.
+ * The losing native card is dismissed through its private cancellation signal.
  */
 export async function arbitrateInteraction({ request, next, begin, settleLocal }) {
-  const handle = await begin();
-  if (handle === null) return next();
-
   const downstreamAbort = new AbortController();
   const upstreamSignal = request?.signal;
   const downstreamSignal = upstreamSignal === undefined
     ? downstreamAbort.signal
     : AbortSignal.any([upstreamSignal, downstreamAbort.signal]);
-  let cancellable = false;
   try {
     request.signal = downstreamSignal;
-    cancellable = request.signal === downstreamSignal;
   } catch {
     try {
       Object.defineProperty(request, 'signal', { value: downstreamSignal, configurable: true, writable: true });
-      cancellable = request.signal === downstreamSignal;
     } catch {
-      cancellable = false;
+      // Without cancellation, use the original native path rather than a phone-only card.
+      return next();
     }
   }
-  // Never start a branch we cannot dismiss; keep the existing Cindy answer path instead.
-  if (!cancellable) return handle.answered;
+  if (request.signal !== downstreamSignal) return next();
+  const handle = await begin(upstreamSignal);
+  if (handle === null) return next();
 
-  const controller = Promise.resolve(handle.answered).then((value) => ({ kind: 'controller', value }));
-  const local = Promise.resolve().then(next).then(
-    (value) => ({ kind: 'local', value }),
-    (error) => ({ kind: 'local-error', error }),
-  );
-  const first = await Promise.race([controller, local]);
-  if (first.kind === 'local-error') return (await controller).value;
-  if (first.kind === 'local') {
-    settleLocal(handle.requestId, first.value);
-    return first.value;
+  void Promise.resolve().then(next).then(
+    (value) => settleLocal(handle.requestId, value),
+    (error) => {
+      // Native cancellation/timeout is a lifecycle result, not a failed delivery.
+      // A missing/disconnected local answerer still leaves the phone usable.
+      if (error?.name === 'UserQuestionError' && error.code !== 'NO_PROVIDER') handle.cancel?.(error);
+    },
+  ).catch((error) => handle.cancel?.(error));
+  try {
+    // A rejected late local settlement cannot override an already accepted phone answer.
+    return await handle.answered;
+  } finally {
+    downstreamAbort.abort(new Error('interaction settled'));
   }
-  downstreamAbort.abort(new Error('interaction settled by Cindy'));
-  void local.then(() => undefined, () => undefined);
-  return first.value;
 }
 
 export function apply(ctx, config) {
@@ -1784,27 +1779,30 @@ export function apply(ctx, config) {
   }
 
   /**
-   * Wrap one host-facing listener in the plugin's single guarded entry point.
+   * Record failures; contain side effects but propagate awaited question failures.
    * @param label - what this listener is, for the diagnostics record.
    * @param listener - the listener as written.
-   * @returns a listener that cannot let its failure escape.
+   * @param options - rethrow only for awaited requests, never fire-and-forget events.
+   * @returns the guarded listener.
    */
-  function guarded(label, listener) {
+  function guarded(label, listener, { rethrow = false } = {}) {
     guardedListeners.push(label);
     return (...args) => {
       try {
         const result = listener(...args);
         if (result !== null && typeof result === 'object' && typeof result.then === 'function') {
-          // A waterfall listener's rejection is the dangerous shape: DSH awaits what it
-          // returns, so a rejection here arrives as an unhandled one at the process level.
+          // Awaited questions reach userQuestions.ask so cancellation keeps its
+          // meaning; fire-and-forget side effects still contain their failures.
           return result.catch((error) => {
             noteBoundaryError(label, error);
+            if (rethrow) throw error;
             return undefined;
           });
         }
         return result;
       } catch (error) {
         noteBoundaryError(label, error);
+        if (rethrow) throw error;
         return undefined;
       }
     };
@@ -2004,9 +2002,7 @@ export function apply(ctx, config) {
     // stopped its timer while the agent was still generating. `turn/start` and
     // `turn/end` are the boundaries that mean what the phone reads into them.
     if (event?.type === 'turn/start' && typeof runtime.pushTurnRunning === 'function') {
-      runtime.pushTurnRunning(sessionId);
-    } else if (event?.type === 'turn/end' && typeof runtime.pushTurnIdle === 'function') {
-      runtime.pushTurnIdle(sessionId);
+      runtime.pushTurnRunning(sessionId, event);
     }
     // A real boundary needs no fallback, and arming one here is not harmless: this
     // handler runs *after* the boundary was announced, so it re-armed the very
@@ -2034,6 +2030,9 @@ export function apply(ctx, config) {
       currentSeam.readMessages.noteEvent(sessionId, event);
       currentSource?.invalidateActivityEvidence?.(sessionId);
     }
+    // Make the failed history row readable before publishing its terminal identity.
+    // Everything above is synchronous, so a new turn cannot interleave here.
+    if (event?.type === 'turn/end' && typeof runtime.pushTurnIdle === 'function') runtime.pushTurnIdle(sessionId, event);
     // Chunks are intentionally absent from deriveEventMessage. Publish a temporary
     // thinking overlay too, retiring it before the durable assistant rows below.
     runtime.pushSessionReasoning?.(sessionId, event, {
@@ -2065,12 +2064,12 @@ export function apply(ctx, config) {
     return arbitrateInteraction({
       request: req,
       next,
-      begin: () => runtime.beginApproval({
+      begin: (signal) => runtime.beginApproval({
         sessionId: typeof sessionId === 'string' ? sessionId : '',
         toolName: typeof req?.toolName === 'string' ? req.toolName : '',
         reason: req?.reason,
         callId: req?.callId,
-        signal: req?.signal,
+        signal,
       }),
       settleLocal: (requestId, outcome) => runtime.settleInteractionOutcome(requestId, outcome),
     });
@@ -2092,28 +2091,26 @@ export function apply(ctx, config) {
     // to the browser path unchanged.
   }), { prepend: true, global: true }), 'dsh-cindy-host: approval answerer');
 
-  // The `ask_user` tool blocks on a different waterfall from approvals, and the
-  // controller renders it as its own card. Leaving it unanswered does not degrade
-  // the conversation — it stops it: the tool call waits for a human who never saw
-  // the question. Same rule as approvals: only claim questions for a session a
-  // controller is watching, and pass the rest down the chain.
+  // Questions are registered even before a phone opens the session, then also
+  // forwarded to DSH. Unlike side-effect listeners this awaited waterfall must
+  // propagate cancellation instead of returning an undefined successful result.
   ctx.effect(() => ctx.on('user-questions/request', guarded('user-questions-request', async (request, next) => {
     if (!runtime || typeof runtime.beginUserQuestion !== 'function') return next();
     const sessionId = request?.agent?.session?.header?.id;
     return arbitrateInteraction({
       request,
       next,
-      begin: () => runtime.beginUserQuestion({
+      begin: (signal) => runtime.beginUserQuestion({
         sessionId: typeof sessionId === 'string' ? sessionId : '',
         questions: request?.questions,
-        signal: request?.signal,
+        signal,
       }),
       settleLocal: (requestId, outcome) => runtime.settleInteractionOutcome(requestId, outcome),
     });
     // Same `prepend` + `global` requirement as the approval answerer above, and the
     // same reason: this waterfall is agent-scoped and the Web bundle's remote
     // forwarding listener parks ahead of a late registration.
-  }), { prepend: true, global: true }), 'dsh-cindy-host: user-question answerer');
+  }, { rethrow: true }), { prepend: true, global: true }), 'dsh-cindy-host: user-question answerer');
 
   // The settings page reaches the Host through this route. `webServer` is absent
   // in headless compositions, so the row is injected optionally: the runtime and

package/src/host-approvals.js

@@ -15,7 +15,9 @@
  *
  * Outcomes are DSH's own vocabulary (`'allowed-once' | 'rejected' | 'cancelled' |
  * 'unavailable'`), not the controller's: `'allowed-once'` is the only grant DSH
- * defines, so every non-allow answer maps to `'rejected'`.
+ * defines, so every non-allow answer maps to `'rejected'`. Structured questions
+ * are registered independently of watching and have no Host timeout; their
+ * caller's cancellation is propagated as a question failure.
  */
 
 /** The controller's interaction kind for a permission question. */
@@ -145,17 +147,20 @@ export function createApprovalRegistry({
   /**
    * Register one pending interaction and hand back its lifetime controls.
    *
-   * Both seams go through here so their timeouts, aborts and dismissals behave
-   * identically — a question that can hang a turn deserves the same care as an
-   * approval that can.
+   * Both seams share single settlement and dismissal. Permission waits have a
+   * deadline; structured questions follow the calling task's lifetime only.
    */
-  function register({ sessionId, request, prefix, signal, answerOf }) {
+  function register({ sessionId, request, signal, answerOf, waitMs = timeoutMs }) {
     let settle;
-    const answered = new Promise((resolve) => {
+    let reject;
+    const answered = new Promise((resolve, fail) => {
       settle = resolve;
+      reject = fail;
     });
+    // The upstream signal may already be aborted before the async caller attaches.
+    void answered.catch(() => {});
 
-    const finish = (outcome) => {
+    const finish = (outcome, error) => {
       const entry = pending.get(request.requestId);
       if (entry === undefined) return;
       pending.delete(request.requestId);
@@ -180,22 +185,31 @@ export function createApprovalRegistry({
           kind: request.kind,
         });
       }
-      settle(outcome);
+      if (error !== undefined) reject(error);
+      else settle(outcome);
+    };
+    const cancel = (reason) => {
+      if (request.kind !== QUESTION_KIND) return finish(answerOf.cancelled);
+      const error = reason?.name === 'UserQuestionError' ? reason : Object.assign(
+        new Error('ask_user_question was cancelled', { cause: reason }),
+        { name: 'UserQuestionError', code: 'ASK_ABORTED' },
+      );
+      finish(undefined, error);
     };
 
-    // The asker withdrawing the question settles it immediately, and a late
-    // answer from the controller is then discarded by `finish`'s guard.
-    const onAbort = signal === undefined ? null : () => finish(answerOf.cancelled);
+    // Withdrawals end the wait, but are never an empty successful answer.
+    const onAbort = signal === undefined ? null : () => cancel(signal.reason);
     if (onAbort !== null) signal.addEventListener('abort', onAbort, { once: true });
 
-    const timer = timeoutMs > 0
-      ? setTimer(() => finish(answerOf.cancelled), timeoutMs)
+    const timer = waitMs > 0
+      ? setTimer(() => cancel(), waitMs)
       : null;
     if (typeof timer?.unref === 'function') timer.unref();
 
-    pending.set(request.requestId, { sessionId, request, settle: finish, timer, onAbort, answerOf });
-    if (request.kind === QUESTION_KIND) notifyQuestionObservers(questionRequestEvent(request));
-    return { requestId: request.requestId, request, answered };
+    pending.set(request.requestId, { sessionId, request, settle: finish, cancel, timer, onAbort, answerOf });
+    if (signal?.aborted) cancel(signal.reason);
+    else if (request.kind === QUESTION_KIND) notifyQuestionObservers(questionRequestEvent(request));
+    return { requestId: request.requestId, request, answered, cancel };
   }
 
   /**
@@ -234,7 +248,7 @@ export function createApprovalRegistry({
    * sees the card cannot answer it, and the conversation stops there.
    *
    * @param options - the questions, the asking session, and the caller's abort signal.
-   * @returns DSH's `AskUserQuestionAnswer`; a cancellation answers every question with nothing.
+   * @returns A pending handle; cancellation rejects with DSH's question error vocabulary.
    */
   async function askUser({ sessionId, questions, signal }) {
     const items = Array.isArray(questions) ? questions : [];
@@ -247,13 +261,12 @@ export function createApprovalRegistry({
       questions: items.map((question) => ({ ...question })),
       createdAt: now().toISOString(),
     };
-    const cancelled = { answers: items.map((question) => ({ id: String(question?.id ?? ''), selected: [] })) };
     return register({
       sessionId,
       request,
       signal,
+      waitMs: 0, // Like Cindy ask/plan, only the caller's lifecycle ends this wait.
       answerOf: {
-        cancelled,
         from: (decision) => questionAnswerOf(items, decision),
       },
     });
@@ -318,10 +331,11 @@ export function createApprovalRegistry({
     return { accepted: true };
   }
 
-  /** Forget every open question (the switch going off). */
-  function clear() {
-    for (const requestId of [...pending.keys()]) {
-      pending.get(requestId).settle(pending.get(requestId).answerOf.cancelled);
+  /** A relay retry preserves questions; explicit shutdown cancels all waits. */
+  function clear({ preserveQuestions = false } = {}) {
+    for (const entry of [...pending.values()]) {
+      if (preserveQuestions && entry.request.kind === QUESTION_KIND) continue;
+      entry.cancel();
     }
   }
 

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.33';
+export const HOST_PLUGIN_VERSION = '0.1.34';

package/src/host.js

@@ -36,6 +36,7 @@ import { SessionReadModel } from './session-read-model.js';
 import { ProjectionReadModelSink } from './projection-read-model-sink.js';
 import { publishLifecycle, runningStatusEvent, turnEventFor } from './session-publisher.js';
 import { createReasoningPublisher } from './reasoning-publisher.js';
+import { turnErrorRow, turnErrorPayload } from './turn-error.js';
 import { acceptLink } from './host-authorization.js';
 import { AuthorizationPolicy } from './authorization-policy.js';
 import { HostStatus } from './host-status.js';
@@ -338,14 +339,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   /** Questions DSH is waiting on, answered by whichever controller is watching. */
   const approvals = createApprovalRegistry({
     now,
-    // How long a controller has to answer a card before the asker is released with
-    // "cancelled". Two minutes was the default and it is the wrong budget for the
-    // surface this Host serves: the phone's card has no countdown, the user may be
-    // away from it, and the path this replaces (the Web bundle's remote forwarder)
-    // waits indefinitely — so a short Host timeout is strictly worse than the
-    // reference. Half an hour with cancellation as the escape hatch
-    // (`maker:input:stop` settles the card immediately) mirrors the reference while
-    // still bounding a forgotten turn.
+    // Permission cards keep their existing deadline. Questions have no Host
+    // timeout: only an answer or the caller's stop/cancel lifecycle ends them.
     timeoutMs: 30 * 60_000,
     // Push the dismissal to every watcher, not just the controller that
     // answered: the card is gone for all of them.
@@ -703,7 +698,11 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       // ones: a running badge on the session list depends on them, so they must
       // be answerable from diagnostics too.
       const record = (channel, watchers, payload) => recordPush(null, channel, watchers, payload);
-      if (ws !== null) publishLifecycle(ws, subscribers, item, record);
+      // A summary-level error is only an invalidation hint; it must not
+      // terminate a newer turn on list-only phones either.
+      const nativeRecovery = typeof options.resolveCapabilities?.()?.readMessages?.turnState === 'function';
+      const lifecycle = item.phase === 'error' && nativeRecovery ? { ...item, phase: 'active' } : item;
+      if (ws !== null) publishLifecycle(ws, subscribers, lifecycle, record);
       publishTurnEvent(item);
     }));
     await projection.start(source);
@@ -721,6 +720,18 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * @param item - one lifecycle item from the projection sink.
    */
   function publishTurnEvent(item) {
+    // The summary error signal has no durable identity and can arrive late.
+    // Recover from native boundaries instead of inventing a successful done.
+    if (item?.phase === 'error') {
+      if (typeof options.resolveCapabilities?.()?.readMessages?.turnState !== 'function') {
+        announceTurnIdle(item.sessionId); // Legacy source: keep its status-only correction.
+        return;
+      }
+      for (const deviceId of sessionSubscribers.get(item.sessionId) ?? []) {
+        void restoreWatchedTurnState(deviceId, item.sessionId);
+      }
+      return;
+    }
     // Keep the cached row's turn state in step with the lifecycle itself.
     //
     // The cache is refreshed by a **list read**, and a controller sitting inside
@@ -749,6 +760,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   async function setSource(next) {
     if (source !== next) {
       sourceRevision++;
+      nativeBoundaries.clear();
+      turnVersions.clear();
+      terminalIdentities.clear();
       source?.manualCompact?.cancelAll('DSH source replaced');
       source?.forkSession?.cancelAll();
       source?.keywordSearch?.cancelAll();
@@ -872,6 +886,18 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * terminal announcement for the same turn; this is the de-duplication window.
    */
   const lastTerminalAnnounce = new Map();
+  // Disposable delivery guards, not a second error ledger. Only the latest
+  // identity per device/session and native boundary per session are retained.
+  const terminalIdentities = new Map();
+  const subscriptionLeases = new Map();
+  const nativeBoundaries = new Map();
+  const turnVersions = new Map();
+
+  function renewTurnLease(deviceId, sessionId) {
+    const key = terminalAnnounceKey(deviceId, sessionId);
+    subscriptionLeases.set(key, (subscriptionLeases.get(key) ?? 0) + 1);
+    terminalIdentities.delete(key);
+  }
   const TERMINAL_ANNOUNCE_WINDOW_MS = 30_000;
   /**
    * Devices the relay has told us it cannot route to.
@@ -898,6 +924,79 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     return `${deviceId}\u0000${sessionId}`;
   }
 
+  /** Send a native terminal identity once per authorized subscription/connection. */
+  function sendNativeTerminal(deviceId, sessionId, payload, identity) {
+    if (stopped || !active || !acceptedControllers.has(deviceId) || !policy.canAccept(deviceId) || sessionIsHidden(sessionId)
+      || !sessionSubscribers.get(sessionId)?.has(deviceId)) return false;
+    const key = terminalAnnounceKey(deviceId, sessionId);
+    const stamp = `${generation}:${subscriptionLeases.get(key) ?? 0}:${identity}`;
+    if (terminalIdentities.get(key) === stamp) return false;
+    recordPush(sessionId, 'maker:event', offlineDevices.has(deviceId) ? 0 : 1, payload);
+    send({ v: PROTOCOL_VERSION, kind: 'push', dst: deviceId, payload: { channel: 'maker:event', payload } });
+    if (!offlineDevices.has(deviceId)) {
+      terminalIdentities.set(key, stamp);
+      noteTerminalAnnounce(deviceId, sessionId);
+    }
+    return true;
+  }
+
+  /** Event callers intentionally fire-and-forget; provider replacement must not
+   * turn a failed recovery into an unhandled rejection at the DSH boundary. */
+  async function restoreWatchedTurnState(deviceId, sessionId) {
+    try { await readWatchedTurnState(deviceId, sessionId); } catch {
+      if (!stopped) recordHandlerError('turn-recovery', new Error('Native turn recovery capability is unavailable'));
+    }
+  }
+
+  /** Cold/reconnect repair uses fresh native evidence; every await is generation guarded. */
+  async function readWatchedTurnState(deviceId, sessionId) {
+    const reader = options.resolveCapabilities?.()?.readMessages;
+    if (typeof reader?.turnState !== 'function') {
+      announceWatchedTurnState(deviceId, sessionId);
+      return;
+    }
+    const owner = source; const revision = sourceRevision; const connection = generation;
+    const version = turnVersions.get(sessionId);
+    const key = terminalAnnounceKey(deviceId, sessionId);
+    const lease = subscriptionLeases.get(key);
+    const valid = () => !stopped && active && source === owner && sourceRevision === revision
+      && generation === connection && turnVersions.get(sessionId) === version
+      && subscriptionLeases.get(key) === lease && acceptedControllers.has(deviceId) && policy.canAccept(deviceId)
+      && !sessionIsHidden(sessionId) && sessionSubscribers.get(sessionId)?.has(deviceId)
+      && options.resolveCapabilities?.()?.readMessages === reader;
+    if (!valid()) return;
+    try {
+      const state = await reader.turnState(sessionId);
+      if (!valid() || !state) return;
+      // The log can end before a newly admitted turn has appended its start.
+      // A live registry check after replay prevents that gap being called idle.
+      let live;
+      if (typeof owner?.listSessionStates === 'function') {
+        const rows = await owner.listSessionStates(sessionId);
+        live = Array.isArray(rows) ? rows.find(row => String(row?.id) === sessionId) : null;
+      } else if (typeof owner?.getSession === 'function') live = await owner.getSession(sessionId);
+      if (!valid() || !live || typeof live.running !== 'boolean') return;
+      if (live.running) {
+        setCachedRunning(sessionId, true);
+        const payload = { sessionId, event: runningStatusEvent() };
+        recordPush(sessionId, 'maker:event', 1, payload);
+        send({ v: PROTOCOL_VERSION, kind: 'push', dst: deviceId, payload: { channel: 'maker:event', payload } });
+        return;
+      }
+      if (state.running) return; // An unfinished historical turn is not live-registry evidence.
+      if ((nativeBoundaries.get(sessionId)?.seq ?? -1) > state.boundarySeq) return;
+      // No await after the final guard: a new boundary cannot interleave with send.
+      setCachedRunning(sessionId, false);
+      const payload = state.error ? turnErrorPayload(state.error) : { sessionId, event: { type: 'done' } };
+      sendNativeTerminal(deviceId, sessionId, payload, `end:${state.boundarySeq}`);
+    } catch {
+      if (!valid()) return;
+      // Never reflect arbitrary upstream exception prose into remote diagnostics.
+      recordHandlerError('turn-recovery', new Error('Native turn state is unavailable; retry on the next synchronization'));
+      if (valid()) pushHistoryViewChanged(sessionId);
+    }
+  }
+
   /** Note that one device has just been told a session's turn is over. */
   function noteTerminalAnnounce(deviceId, sessionId) {
     lastTerminalAnnounce.set(terminalAnnounceKey(deviceId, sessionId), now().getTime());
@@ -942,6 +1041,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   function markDeviceUnreachable(deviceId) {
     if (typeof deviceId !== 'string' || deviceId === '') return;
     offlineDevices.add(deviceId);
+    for (const sessionId of watchedSessionsByDevice.get(deviceId) ?? []) renewTurnLease(deviceId, sessionId);
   }
 
   /**
@@ -964,6 +1064,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     for (const sessionId of sessions) {
       announceWatchedTurnState(deviceId, sessionId);
       pushHistoryViewChanged(sessionId);
+      replayUserQuestions(sessionId);
     }
     return sessions;
   }
@@ -980,6 +1081,10 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * @param sessionId - the session whose turn state to report.
    */
   function announceWatchedTurnState(deviceId, sessionId) {
+    if (typeof options.resolveCapabilities?.()?.readMessages?.turnState === 'function') {
+      void restoreWatchedTurnState(deviceId, sessionId);
+      return;
+    }
     const cached = sessionRowFor(sessionId);
     if (cached === undefined || cached.running === true) return;
     const key = terminalAnnounceKey(deviceId, sessionId);
@@ -1096,6 +1201,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         watchedListDevices.add(deviceId);
       } else if (topic.startsWith('session:')) {
         const sessionId = topic.slice('session:'.length);
+        renewTurnLease(deviceId, sessionId);
         const devices = sessionSubscribers.get(sessionId) ?? new Set();
         devices.add(deviceId);
         sessionSubscribers.set(sessionId, devices);
@@ -1107,6 +1213,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         // …and beyond a *disconnect*: when this device re-links, the Host has to be able to
         // tell it the turn state of every session it was inside, not just the running ones.
         rememberWatchedSession(deviceId, sessionId);
+        replayUserQuestions(sessionId);
       }
     }
   }
@@ -1116,6 +1223,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       if (topic === 'sessions') subscribers.delete(deviceId);
       else if (topic.startsWith('session:')) {
         const sessionId = topic.slice('session:'.length);
+        renewTurnLease(deviceId, sessionId);
         const devices = sessionSubscribers.get(sessionId);
         if (devices === undefined) continue;
         devices.delete(deviceId);
@@ -1214,25 +1322,27 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   }
 
   /**
-   * Ask the controllers watching a session a structured question.
-   *
-   * DSH's `user-questions/request` waterfall blocks the tool call until this
-   * resolves, so an unanswered question does not degrade the conversation — it
-   * stops it. The answerer therefore only claims questions for a session a
-   * controller is actually watching, and passes every other one down the chain
-   * so the local UI can answer it.
-   *
-   * Returns `null` when nobody is watching, which is the answerer's cue to call
-   * `next()`.
+   * Register before presentation, even when no phone has opened this session.
+   * Watching controls push delivery only; late phones query the same pending
+   * request while the plugin also forwards it to DSH's native answerer.
+   * Returns null when the bridge is disabled or the session is unidentified.
    */
   async function beginUserQuestion({ sessionId, questions, signal }) {
     if (typeof sessionId !== 'string' || sessionId === '') return null;
-    if (!claimsInteraction(sessionId)) return null;
+    if (!active || stopped) return null;
     const handle = await approvals.askUser({ sessionId, questions, signal });
-    pushSessionUpdate(sessionId, 'maker:interaction-request', { sessionId, request: handle.request });
+    if (!signal?.aborted) pushSessionUpdate(sessionId, 'maker:interaction-request', { sessionId, request: handle.request });
     return handle;
   }
 
+  function replayUserQuestions(sessionId) {
+    for (const { request } of approvals.list(sessionId)) {
+      if (request.kind === 'ask_user_question') {
+        pushSessionUpdate(sessionId, 'maker:interaction-request', { sessionId, request });
+      }
+    }
+  }
+
   async function askUserQuestion(options) {
     const handle = await beginUserQuestion(options);
     return handle === null ? null : handle.answered;
@@ -1253,7 +1363,10 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    */
   function pushSessionUpdate(sessionId, channel, payload) {
     if (channel === 'maker:input:projection' && activeDelivery) payload = activeDelivery.currentProjection(sessionId, [], payload);
-    const devices = sessionSubscribers.get(sessionId);
+    const guarded = payload?.message?.role === 'error' || payload?.event?.type === 'error';
+    const devices = guarded
+      ? new Set([...(sessionSubscribers.get(sessionId) ?? [])].filter(id => !sessionIsHidden(sessionId) && acceptedControllers.has(id) && policy.canAccept(id)))
+      : sessionSubscribers.get(sessionId);
     const watchers = devices === undefined ? 0 : devices.size;
     const reachable = devices === undefined ? 0 : [...devices].filter((deviceId) => !offlineDevices.has(deviceId)).length;
     recordPush(sessionId, channel, reachable, payload);
@@ -1337,7 +1450,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       // nothing, which is the same class of failure as the bug being fixed.)
       const provider = typeof options.resolveCapabilities === 'function' ? options.resolveCapabilities() : undefined;
       const hydrate = provider?.hydrateImages;
-      if (typeof hydrate === 'function') await hydrate([message]);
+      if (message?.role !== 'error' && typeof hydrate === 'function') await hydrate([message]);
     } catch {
       // Un-hydrated is still worth sending.
     }
@@ -1567,6 +1680,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
        * running turn must be told so rather than left to infer it from silence.
        */
       pushTurnRunning: (sessionId) => announceTurnRunning(sessionId),
+      restoreTurnState: typeof provided.readMessages?.turnState === 'function' ? restoreWatchedTurnState : undefined,
       // The controller's goal panel refreshes from this push, so a write made on
       // the phone reaches any other screen watching the same session.
       pushGoalStatus: (sessionId, status) => pushSessionUpdate(sessionId, 'maker:goal:status-changed', { sessionId, goal: status }),
@@ -1697,7 +1811,23 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * pure noise.
    * @param sessionId - the session whose turn ended.
    */
-  function announceTurnIdle(sessionId) {
+  function announceTurnIdle(sessionId, event) {
+    if (!event && typeof options.resolveCapabilities?.()?.readMessages?.turnState === 'function') {
+      for (const deviceId of sessionSubscribers.get(sessionId) ?? []) void restoreWatchedTurnState(deviceId, sessionId);
+      return;
+    }
+    const error = turnErrorRow(event, sessionId);
+    const failed = event?.data?.reason?.kind === 'error';
+    if (failed && !error) {
+      recordHandlerError('turn-error', new Error('Invalid native failed-turn identity; history resynchronization required'));
+      pushHistoryViewChanged(sessionId);
+      return;
+    }
+    if (event && Number.isSafeInteger(event.seq)) {
+      if ((nativeBoundaries.get(sessionId)?.seq ?? -1) >= event.seq) return;
+      nativeBoundaries.set(sessionId, { seq: event.seq });
+    }
+    turnVersions.set(sessionId, (turnVersions.get(sessionId) ?? 0) + 1);
     const timer = pendingReconciles.get(sessionId);
     if (timer !== undefined) {
       pendingReconciles.delete(sessionId);
@@ -1709,7 +1839,16 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     // tells it first — and the re-link repair depends on that record meaning "it arrived", so a
     // device the relay calls unreachable must not be written into it.
     const watchers = [...(sessionSubscribers.get(sessionId) ?? [])];
-    pushSessionUpdate(sessionId, 'maker:event', { sessionId, event: { type: 'done' } });
+    if (failed) {
+      const payload = turnErrorPayload(error);
+      for (const deviceId of watchers) sendNativeTerminal(deviceId, sessionId, payload, `end:${event.seq}`);
+      // Error detail never goes to list subscribers or unwatched controllers.
+      publishRowTurnState(sessionId, false);
+      return;
+    }
+    if (event && Number.isSafeInteger(event.seq)) {
+      for (const deviceId of watchers) sendNativeTerminal(deviceId, sessionId, { sessionId, event: { type: 'done' } }, `end:${event.seq}`);
+    } else pushSessionUpdate(sessionId, 'maker:event', { sessionId, event: { type: 'done' } });
     for (const deviceId of watchers) {
       if (!offlineDevices.has(deviceId)) noteTerminalAnnounce(deviceId, sessionId);
     }
@@ -1858,7 +1997,12 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * Announce that a turn is live.
    * @param sessionId - the session whose turn started.
    */
-  function announceTurnRunning(sessionId) {
+  function announceTurnRunning(sessionId, event) {
+    if (event && Number.isSafeInteger(event.seq)) {
+      if ((nativeBoundaries.get(sessionId)?.seq ?? -1) >= event.seq) return;
+      nativeBoundaries.set(sessionId, { seq: event.seq });
+    }
+    turnVersions.set(sessionId, (turnVersions.get(sessionId) ?? 0) + 1);
     setCachedRunning(sessionId, true);
     pushSessionUpdate(sessionId, 'maker:event', { sessionId, event: runningStatusEvent() });
     publishRowTurnState(sessionId, true);
@@ -2245,6 +2389,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       case 'link-open': {
         if (typeof frame.id !== 'string' || typeof frame.src !== 'string') return;
         if (!policy.canAccept(frame.src)) return;
+        for (const sessionId of watchedSessionsByDevice.get(frame.src) ?? []) renewTurnLease(frame.src, sessionId);
         // A link-open is itself proof the relay has a route to this device.
         markDeviceReachable(frame.src);
         linkController(frame.src);
@@ -2271,6 +2416,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       }
       case 'link-close': {
         if (typeof frame.src !== 'string') return;
+        for (const sessionId of watchedSessionsByDevice.get(frame.src) ?? []) renewTurnLease(frame.src, sessionId);
         filePeer.closePeer(frame.src);
         acceptedControllers.delete(frame.src);
         observeRemindersSource();
@@ -2497,11 +2643,15 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     subscribers.clear();
     sessionSubscribers.clear();
     liveTurnState.clear();
+    nativeBoundaries.clear();
+    turnVersions.clear();
+    terminalIdentities.clear();
+    subscriptionLeases.clear();
     lastRepairPulse.clear();
     directoryAsked.clear();
-    // A question asked over a link that is going away can never be answered;
-    // settling them cancelled is what releases DSH's awaiting turn.
-    approvals.clear();
+    // Relay recovery is not task cancellation. Keep questions for the next
+    // subscription; explicit switch-off/stop still releases all waits.
+    approvals.clear({ preserveQuestions: keepSwitch });
     inputQueue.clear();
     projections.clear();
 
@@ -2703,8 +2853,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
      * projection's running flag flaps inside a single turn, so it is not allowed
      * to end one (see `turnEventFor`).
      */
-    pushTurnRunning: (sessionId) => announceTurnRunning(sessionId),
-    pushTurnIdle: (sessionId) => announceTurnIdle(sessionId),
+    pushTurnRunning: (sessionId, event) => announceTurnRunning(sessionId, event),
+    pushTurnIdle: (sessionId, event) => announceTurnIdle(sessionId, event),
     /**
      * Make sure a controller is not left spinning after a turn it was watching.
      *

package/src/session-publisher.js

@@ -107,9 +107,10 @@ export function turnEventFor(item) {
       return { channel: 'maker:event', payload: { sessionId, event: runningStatusEvent() } };
     case 'waiting':
       return { channel: 'maker:event', payload: { sessionId, event: runningStatusEvent('waiting on input') } };
-    // A failure is unambiguous.
+    // Summary errors have no turn identity. The native boundary/recovery path
+    // publishes an error with persistId; a bare done would erase that distinction.
     case 'error':
-      return { channel: 'maker:event', payload: { sessionId, event: { type: 'done' } } };
+      return null;
     // `idle` is deliberately NOT an ending here.
     //
     // This flag flaps: `api-session/status` reports `running: false` for a moment

package/src/turn-error.js

@@ -0,0 +1,60 @@
+/** Display-only projection of a durable failed turn. DSH owns failure and retry policy. */
+const SAFE_MESSAGES = new Map([
+  ['AUTH', 'Model authentication failed. Check the provider configuration.'],
+  ['MISSING_CREDENTIAL', 'Model credentials are missing. Check the provider configuration.'],
+  ['INVALID_CREDENTIAL', 'Model credentials are invalid. Check the provider configuration.'],
+  ['RATE_LIMIT', 'The model request was rate limited.'],
+  ['QUOTA', 'The model account quota is exhausted.'],
+  ['ACCOUNT_QUOTA', 'The model account quota is exhausted.'],
+  ['CONTEXT_WINDOW_EXCEEDED', 'The model context window was exceeded.'],
+  ['TIMEOUT', 'The model request timed out.'],
+  ['TRANSPORT', 'The model connection failed.'],
+  ['SERVER', 'The model service failed.'],
+  ['EMPTY_RESPONSE', 'The model returned an empty response.'],
+  ['NO_ADAPTER', 'The selected model route is unavailable.'],
+]);
+
+/** Never copy provider prose, unknown codes, request IDs or nested diagnostic objects. */
+export function turnErrorRow(event, sessionId) {
+  if (event?.type !== 'turn/end' || event.data?.reason?.kind !== 'error') return null;
+  if (typeof sessionId !== 'string' || !sessionId || !Number.isSafeInteger(event.seq) || event.seq < 0) return null;
+  // No wall-clock fallback: cold replay and live delivery must produce identical rows.
+  if (!Number.isFinite(event.time) || !Number.isFinite(new Date(event.time).getTime())) return null;
+  const failure = event.data.reason.error;
+  const code = SAFE_MESSAGES.has(failure?.code) ? failure.code : null;
+  const status = Number.isInteger(failure?.status) && failure.status >= 100 && failure.status <= 599 ? failure.status : null;
+  const detail = [code, status === null ? null : `HTTP ${status}`].filter(Boolean).join('; ');
+  const message = (SAFE_MESSAGES.get(code) ?? 'This turn failed. See the local DSH diagnostics for details.')
+    + (detail ? ` (${detail})` : '');
+  const id = `${sessionId}:turn-error:${event.seq}`;
+  return { id, clientId: id, sessionId, role: 'error', toolUseId: null, agentMeta: null,
+    createdAt: new Date(event.time).toISOString(),
+    content: { message, reason: 'dsh-turn-error', ...(code ? { code } : {}), ...(status === null ? {} : { status }) } };
+}
+
+/** The maker envelope and the history row share one durable identity. */
+export function turnErrorPayload(row) {
+  return { sessionId: row.sessionId, persistId: row.clientId, event: { type: 'error',
+    data: { ...row.content, isTerminal: true, willRetry: false } } };
+}
+
+/** Latest native turn boundary, not the latest error in an arbitrary history page. */
+export function turnStateFromEvents(events, sessionId) {
+  if (!Array.isArray(events)) throw new TypeError('Native turn recovery requires a session event snapshot');
+  let boundary = null;
+  let seq = -1;
+  for (const event of events) {
+    if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || event.seq <= seq
+      || (seq >= 0 && event.seq !== seq + 1)) {
+      throw new TypeError('Native turn recovery requires ordered unique event sequences');
+    }
+    seq = event.seq;
+    if (event.type === 'turn/start' || event.type === 'turn/end') boundary = event;
+  }
+  if (!boundary) return null;
+  if (boundary.type === 'turn/start') return { seq, boundarySeq: boundary.seq, running: true, error: null };
+  const error = turnErrorRow(boundary, sessionId);
+  // A malformed failure is not evidence of a successful ending.
+  if (boundary.data?.reason?.kind === 'error' && !error) throw new TypeError('Invalid native failed-turn identity');
+  return { seq, boundarySeq: boundary.seq, running: false, error };
+}