faberun 0.15.0 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
   "scripts": {
     "check": "node -e \"const{readdirSync}=require('node:fs');const{spawnSync}=require('node:child_process');const roots=['bin','.claude/hooks','src','evals','test'];const files=roots.flatMap(r=>readdirSync(r,{recursive:true}).map(String).filter(p=>p.endsWith('.mjs')).map(p=>r+'/'+p));for(const f of files)if(spawnSync(process.execPath,['--check',f],{stdio:'inherit'}).status!==0)process.exit(1);console.log(files.length+' files checked')\"",
     "typecheck": "tsc",
-    "test": "node --test test/*.test.mjs test/*/*.test.mjs",
+    "test": "node --test --import ./test/scoped-home.mjs --import ./test/setup.mjs test/*.test.mjs test/*/*.test.mjs",
     "docs": "node src/cli/manual.mjs --write",
     "docs:check": "node src/cli/manual.mjs --check",
     "prepare": "husky"

package/skills/faberun/references/operations.md

@@ -109,18 +109,29 @@ the contract is frozen with a digest, and the phone's middle ground is a note.
 
 ## Notify
 
-On `node.terminal`, `run.terminal` and `attention` the controller renders a
-one-line message from counters and identifiers only (node id, run id, state,
-attempt, error code, done/total — never model text), calls the executable named
-by `FABERUN_NOTIFY_BIN` with that event as JSON on stdin, and appends a
-timestamped receipt (`delivered`, `failed`, `no_transport`) to
+On `node.terminal`, `run.terminal` and `attention` the controller renders one
+message from persisted state, in the operator's own language (detected from
+the campaign goal, journal notes and node objectives; English otherwise):
+line one is the outcome (`✅ <node> · done in 8m · $0.09`, `🏁 run 15 · <name>
+· 2/2 done`, or `👀 <node> needs you · <error>`), then asked / done / proof
+for a node, what every node delivered for a run, or why / asked / do for
+attention, then a progress bar, a rule and the `🐦 faberun` signature with
+campaign percent, cost and elapsed; an `⬆️` line names a newer release when
+the cached update check has one. ≤2 KiB. It delivers that
+same text to every bound transport at once, appending one receipt
+(`delivered`, `failed`, `no_transport`, one entry per transport) to
 `<run-dir>/notify.jsonl`. Delivery is lossy: **exactly one attempt**, no retry,
-no backoff. Unset, nothing is spawned and the receipt is `no_transport`.
-`FABERUN_NOTIFY_BIN=os-macos` selects the bundled `osascript` adapter
-(`canWake: false`); any other value is an executable path. A resume never
-re-sends a notification already recorded for the same node, attempt and outcome.
-No transport is a default: `doctor`, `preflight` and the foreground launch warn
-when the variable is empty, and `--wake` reports no adapter can wake a session.
+no backoff. `FABERUN_NOTIFY_BIN` names an executable called with the event as
+JSON on stdin (`os-macos` selects the bundled `osascript` adapter); it pushes to
+a person, `canWake: false`. `FABERUN_NOTIFY_SESSION=auto` wakes the harness
+session the controller was launched from, `canWake: true`: the Claude Code
+inbox socket and the Codex thread the environment names. A seat window sets it;
+nothing else does, so a test suite never wakes a session. **On an inbound
+`🐦 faberun` message**: `✅` or `🏁` with nothing waiting, answer in one line
+and keep waiting; `👀`, act on the `do` command it names. A
+resume never re-sends a notification already recorded for the same node, attempt
+and outcome. No transport is a default: `doctor`, `preflight` and the foreground
+launch warn when both variables are empty, and `--wake` names what will wake.
 Campaign-level lines are queued in `.runs/inbox.jsonl`, the managed block's
 append-only record — one object per line `{schemaVersion, eventId, at, type,
 campaignId, runId, nodeId, status, errorCode, dedupeKey, summary}`, deduped on

package/src/campaign/journal.mjs

@@ -8,7 +8,7 @@
  * the journal's own `eventId` so two sessions cannot consume each other's place.
  */
 import { JOURNAL_FILE, JOURNAL_TEXT_BYTES, JOURNAL_WATCH_CURSOR_DIR, JOURNAL_WATCH_CURSOR_SCHEMA_VERSION } from "./layout.mjs";
-import { boundedText, collapseLines } from "../util.mjs";
+import { collapseLines } from "../util.mjs";
 import { campaignIdOf } from "./record.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -382,6 +382,11 @@ function normalizeEntry(entry) {
   return /** @type {JournalEntry} */ (normalized);
 }
 /**
+ * Collapse to one line and enforce the byte cap by refusing, not truncating:
+ * the journal is the record of what was written, so a note that does not fit
+ * is the author's to cut -- a silently shortened entry lies about its own
+ * write. Readers of already-stored text never pass through here.
+ *
  * @param {unknown} value
  * @param {string} label
  * @param {number} maxBytes
@@ -391,5 +396,9 @@ export function normalizeText(value, label, maxBytes = JOURNAL_TEXT_BYTES) {
   requireText(value, label);
   const collapsed = collapseLines(value);
   if (!collapsed) throw new TypeError(`${label} must not be blank`);
-  return boundedText(collapsed, maxBytes);
+  const bytes = Buffer.byteLength(collapsed, "utf8");
+  if (bytes > maxBytes) {
+    throw new TypeError(`${label} is ${bytes} bytes, over the ${maxBytes}-byte cap; cut ${bytes - maxBytes} bytes and retry`);
+  }
+  return collapsed;
 }

package/src/engine/cancel.mjs

@@ -17,7 +17,7 @@ import { terminateInvocation } from "./process.mjs";
 import { join, resolve } from "node:path";
 import { readFileSync } from "node:fs";
 import { readRunNodes } from "./scheduler.mjs";
-import { deleteRef, releaseAttemptWorktree, runRefName } from "../repo/worktree.mjs";
+import { createPreservedRef, deleteRef, releaseAttemptWorktree, runRefName } from "../repo/worktree.mjs";
 import { syncAgentSignal } from "../repo/signal.mjs";
 import { transition, writeNode } from "./state.mjs";
 import { validateContract } from "../contract/index.mjs";
@@ -26,10 +26,11 @@ import { writeJsonAtomic } from "../run/store.mjs";
 /** @typedef {import("./process.mjs").InvocationProbe} InvocationProbe */
 /** @typedef {import("../cli.mjs").LockHandle} LockHandle */
 /** @typedef {import("../run/lock.mjs").LockRecord} LockRecord */
+/** @typedef {{preservedRefs: string[], released: string[]}} CancelResult */
 
 /**
  * @param {string} runDirPath
- * @returns {Promise<boolean>}
+ * @returns {Promise<CancelResult>}
  */
 export async function cancelRun(runDirPath) {
   const runDir = resolve(runDirPath);
@@ -108,20 +109,33 @@ export async function cancelRun(runDirPath) {
       throw error;
     }
     if (!await waitForTerminal(runDir, 1_000)) throw new Error("cancel could not confirm a terminal run state");
+    // Preserved refs come first, before anything is released: a cancel that
+    // dies part-way must leave more work reachable, never less. If a creation
+    // fails here, nothing below has run and every integrated commit is as
+    // reachable as cancel found it. A node whose integratedHead is null was
+    // never integrated and gets none.
+    const preservedRefs = states
+      .filter((state) => state.integratedHead)
+      .map((state) => createPreservedRef(contract.cwd, contract.id, state.id, state.integratedHead));
     // The run directory is evidence a campaign ledger may still want, so it
     // stays; the run ref and every node's attempt branch are just git names
     // the next launch of this same contract id needs back, and cancel is the
     // operator saying this run is over. Releasing a name is not destroying a
-    // record -- each state's `worktree.branch`/`commit` fields, and the sha
-    // this ref pointed at, remain in the persisted snapshot regardless.
+    // record: the sha remains in the persisted snapshot, and the commit it
+    // names stays reachable through the preserved ref created above.
     // Idempotent both ways: `removeWorktree` and `deleteRef` already tolerate
     // an artefact a previous cancel (or the run itself) already released.
+    const released = [];
     for (const state of states) {
-      if (state.worktree?.branch) releaseAttemptWorktree(contract.cwd, state.worktree.path, state.worktree.branch);
+      if (!state.worktree?.branch) continue;
+      releaseAttemptWorktree(contract.cwd, state.worktree.path, state.worktree.branch);
+      released.push(`refs/heads/${state.worktree.branch}`);
+      if (state.worktree.path) released.push(state.worktree.path);
     }
     deleteRef(contract.cwd, runRefName(contract.id));
+    released.push(runRefName(contract.id));
     syncAgentSignal(join(runDir, ".."));
-    return true;
+    return { preservedRefs, released };
   } finally {
     controllerLock.release();
   }

package/src/engine/gate.mjs

@@ -30,6 +30,7 @@
 import { existsSync, readFileSync, statSync, openSync, closeSync, readSync, writeSync } from "node:fs";
 import { dirname } from "node:path";
 import { spawn } from "node:child_process";
+import { NOTIFY_ENV_NAMES } from "../notify/index.mjs";
 
 /** @typedef {{executable: string, args: string[], cwd: string, promptTransport: "stdin"|"argv", harness: string, env: Record<string, string|null>|null, stdoutPath: string, stderrPath: string}} GateConfig */
 
@@ -155,9 +156,13 @@ function childEnv() {
     if (value === null) delete merged[key];
     else merged[key] = value;
   }
-  // Worker providers are not a notification surface: strip the controller-only
-  // transport after the harness overlay so no harness can reintroduce it.
-  delete merged.FABERUN_NOTIFY_BIN;
+  // Worker providers are not a notification surface: strip every controller-only
+  // transport after the harness overlay so no harness can reintroduce one. The
+  // list lives in `notify/index.mjs`, not here: this line once named
+  // FABERUN_NOTIFY_BIN alone, and on 2026-09-21 a worker that inherited
+  // FABERUN_NOTIFY_SESSION ran this repository's suite, whose fixture
+  // controllers woke the operator's live session seven times in minutes.
+  for (const name of NOTIFY_ENV_NAMES) delete merged[name];
   return merged;
 }
 

package/src/engine/judge-gate.mjs

@@ -135,6 +135,74 @@ function proveVerification(id, proof, recorded) {
   return { id, kind: "verification", ref: proof.ref, pass: entry.passed === true, detail };
 }
 
+/**
+ * A command proof that declares a node:test filter (`--test-name-pattern`,
+ * `--test-skip-pattern`) is judged on more than its exit code, because the
+ * runner exits 0 whether its filter selected anything or not. The proof runs
+ * with the TAP reporter selected through `NODE_OPTIONS` and is refused when the
+ * output carries TAP's zero-plan line. Measured 2026-09-21 on node v26.8.1: a
+ * filter that matches emits `1..0` zero times, a filter that matches nothing
+ * emits it exactly once, a run with no filter emits it zero times, and an empty
+ * suite under a matching filter emits no nested zero plan. The default reporter
+ * cannot make the distinction -- both cases print identical counters, because
+ * the tick is the file rather than a test. The reporter goes through the
+ * environment because appending `--test-reporter=tap` to the command string is
+ * a no-op whenever a test file precedes it: node reads its own options
+ * left to right, so the flag lands among the script's arguments and the runner
+ * never sees it.
+ */
+const TEST_FILTER_FLAGS = ["--test-name-pattern", "--test-skip-pattern"];
+const TAP_ZERO_PLAN = /^1\.\.0$/mu;
+
+/**
+ * The environment a filtered proof runs under: the ambient environment with
+ * the TAP reporter selected through `NODE_OPTIONS`, minus `NODE_TEST_CONTEXT`.
+ * That marker belongs to whichever test runner spawned this process; a nested
+ * `node --test` that inherits it stays a runner child and emits no TAP at all
+ * (measured 2026-09-21: with the marker the zero-plan line never appears,
+ * without it exactly once) -- and a proof is judged as its own top-level run,
+ * not as the suite's child.
+ *
+ * @returns {NodeJS.ProcessEnv}
+ */
+function envForFilteredProof() {
+  const { NODE_TEST_CONTEXT: _outer, NODE_OPTIONS: existing, ...ambient } = process.env;
+  return { ...ambient, NODE_OPTIONS: existing ? `${existing} --test-reporter=tap` : "--test-reporter=tap" };
+}
+
+/**
+ * The node:test filters a command string declares, in argv order, as flag and
+ * value. Presence alone changes behaviour (the appended reporter and the
+ * zero-plan look-up); the value is read for the refusal detail alone, which is
+ * why a whitespace split is close enough even though the command runs through
+ * a shell.
+ *
+ * @param {string} ref
+ * @returns {Array<{flag: string, value: string}>}
+ */
+function declaredTestFilters(ref) {
+  const tokens = ref.split(/\s+/u).filter(Boolean);
+  /** @type {Array<{flag: string, value: string}>} */
+  const filters = [];
+  for (const [index, token] of tokens.entries()) {
+    for (const flag of TEST_FILTER_FLAGS) {
+      if (token.startsWith(`${flag}=`)) filters.push({ flag, value: unquote(token.slice(flag.length + 1)) });
+      else if (token === flag) filters.push({ flag, value: unquote(tokens[index + 1] ?? "") });
+    }
+  }
+  return filters;
+}
+
+/** @param {string} value @returns {string} */
+function unquote(value) {
+  return value.replace(/^['"]|['"]$/gu, "");
+}
+
+/** @param {Array<{flag: string, value: string}>} filters @returns {string} */
+function filterNames(filters) {
+  return filters.map(({ flag, value }) => `${flag} "${value}"`).join(", ");
+}
+
 /**
  * @param {string} id
  * @param {DefinitionOfDoneProof} proof
@@ -144,11 +212,18 @@ function proveVerification(id, proof, recorded) {
  */
 async function proveCommand(id, proof, cwd, timeoutMs) {
   const ref = proof.ref;
+  const filters = declaredTestFilters(ref);
   return new Promise((settle) => {
     // Detached on POSIX so the shell leads its own process group: `shell: true`
     // means the timeout must kill the group, not the shell, or the command the
     // shell started keeps running and keeps the result pending forever.
-    const child = spawn(ref, { cwd, shell: true, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn(ref, {
+      cwd,
+      shell: true,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"],
+      ...(filters.length ? { env: envForFilteredProof() } : {}),
+    });
     let stdout = "";
     let stderr = "";
     let settled = false;
@@ -178,6 +253,18 @@ async function proveCommand(id, proof, cwd, timeoutMs) {
       finish({ id, kind: "command", ref, pass: false, detail: boundedText(error.message) });
     });
     child.on("close", (code, signal) => {
+      // Its own detail, not an ordinary command failure: the command succeeded,
+      // so what failed is that the declared filter selected nothing to prove.
+      if (code === 0 && signal === null && filters.length > 0 && TAP_ZERO_PLAN.test(stdout)) {
+        finish({
+          id,
+          kind: "command",
+          ref,
+          pass: false,
+          detail: boundedText(`${filterNames(filters)} selected no test: exit 0 over a TAP plan of 1..0, so the proof measured nothing`),
+        });
+        return;
+      }
       const detail = signal !== null ? `killed by ${signal}` : `exit ${code ?? "?"}`;
       const pass = code === 0 && signal === null;
       finish({ id, kind: "command", ref, pass, detail: pass ? detail : boundedText(`${detail}: ${(stderr || stdout).trim()}`) });

package/src/harnesses/index.mjs

@@ -6,6 +6,7 @@ import { dshHarness } from "./dsh/index.mjs";
 import { zcodeHarness } from "./zcode/index.mjs";
 import { execJsonlHarness } from "./exec-jsonl/index.mjs";
 import { replayHarness } from "./replay/index.mjs";
+import { withoutNotifyEnv } from "../notify/index.mjs";
 
 /** Current wire-contract version for runner protocol artifacts. */
 export const PROTOCOL_SCHEMA_VERSION = 3;
@@ -451,7 +452,10 @@ export function probeRuntime(runtime, options = {}) {
     try {
       child = spawn(executable, args, {
         cwd: options.cwd,
-        env: process.env,
+        // A worker or judge never delivers a notification; the controller does.
+        // In this repository a worker runs the test suite, whose fixture
+        // controllers would otherwise inherit a live transport and deliver.
+        env: withoutNotifyEnv(process.env),
         stdio: ["ignore", "pipe", "pipe"],
       });
     } catch (error) {

package/src/host/preflight.mjs

@@ -27,6 +27,7 @@ import { errorMessage } from "../util.mjs";
 import { boundedGitSync } from "../repo/worktree.mjs";
 import { routeRuntime } from "../contract/runtime.mjs";
 import { NOTIFY_BIN_ENV, noTransportWarning } from "../notify/index.mjs";
+import { NOTIFY_SESSION_ENV, sessionWakeNotice } from "../notify/session.mjs";
 import { findExecutable } from "./platform.mjs";
 import { colorLevel, statusToken } from "../cli/brand.mjs";
 import { RUNS_DIR_NAME } from "../run/paths.mjs";
@@ -209,9 +210,9 @@ export function environmentPreflight(options) {
  */
 export function notifyTransportCheck(env = process.env) {
   const warning = noTransportWarning(env);
-  return warning
-    ? fail("notify transport", warning, true)
-    : pass("notify transport", `${NOTIFY_BIN_ENV}=${env[NOTIFY_BIN_ENV]}`);
+  if (warning) return fail("notify transport", warning, true);
+  const external = env[NOTIFY_BIN_ENV] ? `${NOTIFY_BIN_ENV}=${env[NOTIFY_BIN_ENV]}` : `${NOTIFY_BIN_ENV} unset`;
+  return pass("notify transport", `${external} · ${sessionWakeNotice(env)}`);
 }
 
 /** @param {EnvReport} report @returns {EnvCheck[]} the checks that block a dispatch */
@@ -265,6 +266,7 @@ export function declaredVerificationCommands(contract) {
  */
 const SIDE_EFFECT_ENV_KEYS = [
   NOTIFY_BIN_ENV, // a measurement must not notify a human
+  NOTIFY_SESSION_ENV, // nor wake the harness session it was measured from
   "FABERUN_CODEX_BIN", // could redirect the timed command at a live, paid codex binary instead of this repository's own fixtures
   "FABERUN_CLAUDE_BIN", // same, for the claude harness
   "FABERUN_AGY_BIN", // same, for the agy harness

package/src/notify/index.mjs

@@ -1,15 +1,19 @@
 /**
  * Direct notification dispatcher (TECH-SPEC lean, rule 6). On `node.terminal`,
  * `run.terminal` and `attention` the controller renders the message through
- * `renderRunProgress` (`report/progress.mjs`) from the run's own persisted
- * state, calls `FABERUN_NOTIFY_BIN` with the event as JSON on stdin, and
- * appends a receipt (`delivered`, `failed` or
- * `no_transport`, with the timestamp) to `<run-dir>/notify.jsonl`. Delivery is
- * lossy: an event is attempted once, a failure schedules no further attempt and
- * is never requeued, and the controller never waits on a retry it will not
- * make. The next read of the run's own artefacts carries the full state. With
- * no transport bound (`FABERUN_NOTIFY_BIN` unset) nothing is spawned and
- * a `no_transport` receipt is recorded instead — there is no implicit desktop
+ * `renderRunProgress` (`report/message.mjs`) from the run's own persisted
+ * state, delivers that one text to every bound transport at once, and appends
+ * one receipt (`delivered`, `failed` or `no_transport`, with the timestamp
+ * and one entry per transport) to `<run-dir>/notify.jsonl`. Two transports
+ * exist, additive and independently opted in: `FABERUN_NOTIFY_BIN`, an
+ * executable called with the event as JSON on stdin (a phone, a chat), and
+ * `FABERUN_NOTIFY_SESSION`, the harness session the controller was launched
+ * from (`session.mjs`), which is what wakes the operator's seat. Delivery is
+ * lossy: an event is attempted once per transport, a failure schedules no
+ * further attempt and is never requeued, and the controller never waits on a
+ * retry it will not make. The next read of the run's own artefacts carries
+ * the full state. With no transport bound nothing is spawned and a
+ * `no_transport` receipt is recorded instead — there is no implicit desktop
  * fallback. The macOS notifier is reachable only by setting
  * `FABERUN_NOTIFY_BIN=os-macos`, an explicit opt-in, never a default.
  *
@@ -46,29 +50,53 @@ import { createHash } from "node:crypto";
 import { appendFileSync, closeSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import { createMacosNotifier } from "./os-macos.mjs";
+import { NOTIFY_SESSION_ENV, deliverToSessions, resolveSessionTargets, sessionWakeNotice } from "./session.mjs";
 import { errorMessage } from "../util.mjs";
 
 /**
- * `report/progress.mjs` reaches back to this module (through
+ * `report/message.mjs` reaches back to this module (through
  * `run/node-store.mjs` -> `run/disk-gc.mjs` -> `host/preflight.mjs`, which
  * reads `NOTIFY_BIN_ENV`), so a static top-level import of it here would be a
  * real cycle: `host/preflight.mjs` would read `NOTIFY_BIN_ENV` while this
  * module's own top level was still mid-evaluation, before the `const` is
  * assigned. A dynamic import resolves this module first and defers loading
- * `report/progress.mjs` until the first call, by which point this module has
+ * `report/message.mjs` until the first call, by which point this module has
  * already finished initializing -- so the cycle is real but harmless. Cached
  * after the first call so every subsequent render reuses the same module.
- * @type {Promise<typeof import("../report/progress.mjs")>|null}
+ * @type {Promise<typeof import("../report/message.mjs")>|null}
  */
 let progressModule = null;
-/** @returns {Promise<typeof import("../report/progress.mjs")>} */
+/** @returns {Promise<typeof import("../report/message.mjs")>} */
 function loadProgressModule() {
-  progressModule ??= import("../report/progress.mjs");
+  progressModule ??= import("../report/message.mjs");
   return progressModule;
 }
 
 export const NOTIFY_BIN_ENV = "FABERUN_NOTIFY_BIN";
 const MACOS_TRANSPORT = "os-macos";
+
+/**
+ * Every variable that binds a notification transport. The controller is the
+ * only process that delivers: a worker, a judge or a verification command
+ * that inherits these would notify on the controller's behalf -- and in this
+ * repository, whose workers run its own test suite, every fixture controller
+ * the suite spawns would deliver its terminal events for real. Measured
+ * 2026-09-21: a run launched with `FABERUN_NOTIFY_SESSION=auto` woke the
+ * operator's session seven times in minutes from `test/repo/base-ref.test.mjs`
+ * fixtures its worker ran. `withoutNotifyEnv` is the boundary every child
+ * crosses; `test/setup.mjs` neutralises the same names inside the suite.
+ */
+export const NOTIFY_ENV_NAMES = Object.freeze([NOTIFY_BIN_ENV, NOTIFY_SESSION_ENV]);
+
+/**
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {NodeJS.ProcessEnv} a copy with every notify transport unbound
+ */
+export function withoutNotifyEnv(env) {
+  const copy = { ...env };
+  for (const name of NOTIFY_ENV_NAMES) delete copy[name];
+  return copy;
+}
 export const NOTIFY_LOG_FILE = "notify.jsonl";
 /**
  * The bounded retry budget the dispatcher used to spend before giving up.
@@ -129,7 +157,8 @@ export const NOTIFY_NO_TRANSPORT_WARNING = "no human notification transport is c
 /** @typedef {{schemaVersion: number, eventId: string, at: string, type: string, campaignId: string|null, runId: string|null, nodeId: string|null, status: string|null, errorCode: string|null, dedupeKey: string, summary: string}} InboxEntry */
 /** @typedef {{type: string, dedupeKey: string, summary: string, at?: string, campaignId?: string|null, runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}} InboxEvent */
 /** @typedef {{type: "node.terminal"|"run.terminal"|"attention", runId: string|null, campaignId?: string|null, nodeId?: string|null, status?: string|null, attempt?: number|null, errorCode?: string|null, done?: number|null, total?: number|null, dedupeKey?: string|null, runDir?: string|null, costUsd?: number|null, summary?: string|null, eventId?: string}} NotifyEvent */
-/** @typedef {{ok: boolean, error?: string, noTransport?: boolean}} DeliveryResult */
+/** @typedef {{id: string, ok: boolean, error?: string}} TransportOutcome one transport's own outcome, named so the receipt says which took the message */
+/** @typedef {{ok: boolean, error?: string, noTransport?: boolean, transports?: TransportOutcome[]}} DeliveryResult */
 
 /**
  * Render the message for an event. For `node.terminal`, `run.terminal` and
@@ -250,25 +279,31 @@ function truncate(value) {
  * @returns {string|null}
  */
 export function noTransportWarning(env = process.env) {
-  return env[NOTIFY_BIN_ENV] ? null : NOTIFY_NO_TRANSPORT_WARNING;
+  if (env[NOTIFY_BIN_ENV]) return null;
+  if (resolveSessionTargets(env).length) return null;
+  return NOTIFY_NO_TRANSPORT_WARNING;
 }
 
 /**
- * What `campaign watch --wake` must say about waking. No adapter declares
- * `canWake: true` (`os-macos` is `canWake: false`), so the wake verb records
- * to the inbox and the managed block and never implies a session was woken.
+ * What `campaign watch --wake` must say about waking. The external transport
+ * never wakes anything (`os-macos` and every `FABERUN_NOTIFY_BIN` executable
+ * are `canWake: false`: they push to a person); the session transports are
+ * the only `canWake: true`, and the notice says which of them the environment
+ * resolves to, so the verb never implies a session was woken when none will be.
  *
  * @param {string|undefined} [bin]
+ * @param {NodeJS.ProcessEnv} [env]
  * @returns {string}
  */
-export function wakeCapabilityNotice(bin = process.env[NOTIFY_BIN_ENV]) {
+export function wakeCapabilityNotice(bin = process.env[NOTIFY_BIN_ENV], env = process.env) {
+  const session = sessionWakeNotice(env);
   if (!bin) {
-    return "no notify transport is configured; --wake records to .runs/inbox.jsonl and the AGENTS.md managed block; no session is woken";
+    return `no external notify transport is configured; --wake records to .runs/inbox.jsonl and the AGENTS.md managed block; ${session}`;
   }
   if (bin === MACOS_TRANSPORT) {
-    return "os-macos cannot wake a session (canWake: false); --wake records to .runs/inbox.jsonl and the AGENTS.md managed block";
+    return `os-macos cannot wake a session (canWake: false); --wake records to .runs/inbox.jsonl and the AGENTS.md managed block; ${session}`;
   }
-  return `notify transport ${bin} declares canWake: false; --wake records to .runs/inbox.jsonl and the AGENTS.md managed block; no session is woken`;
+  return `notify transport ${bin} declares canWake: false; --wake records to .runs/inbox.jsonl and the AGENTS.md managed block; ${session}`;
 }
 
 /** @param {string} runsDir @returns {string} */
@@ -345,20 +380,39 @@ export function appendInbox(runsDir, event) {
 }
 
 /**
- * Deliver one event through the bound transport. No transport bound resolves
- * `{ok: false, noTransport: true}` without spawning anything.
+ * Deliver one event through every bound transport at once: the external
+ * executable and each resolved harness session, all given the same rendered
+ * text. The result is `ok` when any one of them took the message, carries
+ * every transport's own outcome for the receipt, and is
+ * `{ok: false, noTransport: true}` when nothing at all is bound -- without
+ * spawning or connecting anything.
  *
  * @param {{type: string, summary: string, campaignId?: string|null, [key: string]: unknown}} event
- * @param {{bin?: string, spawn?: typeof defaultSpawn, timeoutMs?: number}} [options]
+ * @param {{bin?: string, env?: NodeJS.ProcessEnv, spawn?: typeof defaultSpawn, timeoutMs?: number}} [options]
  * @returns {Promise<DeliveryResult>}
  */
-function deliverNotification(event, options = {}) {
-  const bin = options.bin ?? process.env[NOTIFY_BIN_ENV];
-  if (!bin) return Promise.resolve({ ok: false, noTransport: true });
-  if (bin === MACOS_TRANSPORT) {
-    return createMacosNotifier({ spawn: options.spawn }).deliver(/** @type {any} */ (event));
+async function deliverNotification(event, options = {}) {
+  const env = options.env ?? process.env;
+  const bin = options.bin ?? env[NOTIFY_BIN_ENV];
+  const targets = resolveSessionTargets(env);
+  /** @type {Promise<TransportOutcome>[]} */
+  const attempts = [];
+  if (bin) {
+    const external = bin === MACOS_TRANSPORT
+      ? createMacosNotifier({ spawn: options.spawn }).deliver(/** @type {any} */ (event))
+      : spawnDeliver(bin, event, options);
+    attempts.push(external.then((result) => ({ id: bin === MACOS_TRANSPORT ? MACOS_TRANSPORT : "bin", ...result })));
   }
-  return spawnDeliver(bin, event, options);
+  /** @type {Promise<TransportOutcome[]>} */
+  const sessions = targets.length ? deliverToSessions(event, targets, { timeoutMs: options.timeoutMs, env }) : Promise.resolve([]);
+  if (!attempts.length && !targets.length) return { ok: false, noTransport: true, transports: [] };
+  const transports = [...(await Promise.all(attempts)), ...(await sessions)];
+  const failures = transports.filter((outcome) => !outcome.ok).map((outcome) => `${outcome.id}: ${outcome.error ?? "failed"}`);
+  return {
+    ok: transports.some((outcome) => outcome.ok),
+    ...(failures.length ? { error: failures.join("; ") } : {}),
+    transports,
+  };
 }
 
 /**
@@ -472,6 +526,9 @@ export class NotifyQueue {
       summary,
       attempt: 1,
       status: result.ok ? "delivered" : result.noTransport ? "no_transport" : "failed",
+      // One entry per bound transport, so a receipt that says `delivered`
+      // also says whether the phone, the session, or both took the message.
+      transports: result.transports ?? [],
       at: new Date(this.now()).toISOString(),
     };
     if (!result.ok && !result.noTransport) receipt.error = result.error ?? null;