pi-better-harness 0.37.0 → 0.38.0

package/node_modules/pi-better-subagents/README.md

@@ -12,7 +12,7 @@ Use `pi-better-subagents` when you want Pi to launch independent agent work with
 
 ## Core Features
 - Non-blocking subagent launches, with an optional role and named-agent catalog (`docs/agent-catalog.md`, `docs/agent-catalog-lifecycle.md`).
-- Completed-subagent continuation: `subagent_resume` continues a saved single or batch conversation under a new attempt id. Retention is optional cleanup protection: `retain_session` pins artifacts, and `subagent_release` removes that protection without invalidating history that still exists. See [continuing a completed subagent](docs/usage.md#continuing-a-completed-subagent).
+- Continue a saved conversation with `subagent_spawn({ session_id, prompt })`, or use `session_name` for a unique name in the current folder. Sessions persist by default. Lists show session IDs and search locally; `all:true` searches globally. Batch jobs use the same selectors. See [continuing a saved conversation](docs/usage.md#continuing-a-saved-conversation).
 - Typed foreground `subagent_spawn_batch` launch receipts for native Pi codemode (Pi 0.99.1+), preserving direct tool calls, per-run callbacks, and batch capacity/catalog guarantees. See [codemode batch launches](docs/usage.md#codemode-batch-launches).
 - Opt-in OS task sandboxing on macOS and Linux.
 - Explicit tool allowlists for child sessions.

package/node_modules/pi-better-subagents/batch.mjs

@@ -25,7 +25,7 @@ export const batchLaunchOutputSchema = {
             type: "array",
             items: {
                 type: "object",
-                properties: { job: { type: "integer", minimum: 1 }, name: { type: "string" }, id: { type: "string" }, modelNote: { type: "string" } },
+                properties: { job: { type: "integer", minimum: 1 }, name: { type: "string" }, id: { type: "string" }, sessionId: { type: "string" }, continuedFrom: { type: "string" }, modelNote: { type: "string" } },
                 required: ["job", "name", "id"],
                 additionalProperties: false,
             },
@@ -94,6 +94,10 @@ export function mergeJobOptions(shared, job) {
         git_clone_workspace: job.git_clone_workspace ?? shared?.git_clone_workspace,
         approve: job.approve ?? shared?.approve,
         allow_nested: job.allow_nested ?? shared?.allow_nested,
+        // Native session id selected for this JOB only. A shared value would make
+        // every job contend for the same conversation writer, so it is not inherited.
+        session_id: typeof job.session_id === "string" ? job.session_id : undefined,
+        session_name: typeof job.session_name === "string" ? job.session_name : undefined,
         // Harness timing; an explicit null means "not set", so it falls through to shared.
         deadline_minutes: job.deadline_minutes ?? shared?.deadline_minutes,
         grace_minutes: job.grace_minutes ?? shared?.grace_minutes,
@@ -149,6 +153,11 @@ export function validateBatchPlan({ shared, jobs, onCapacity, config }) {
         if (typeof job.prompt !== "string" || job.prompt.trim() === "") {
             throw new Error(`job ${i + 1} is missing a non-empty prompt.`);
         }
+        if (job.session_id !== undefined && job.session_name !== undefined) throw new Error(`job ${i + 1}: pass either session_id or session_name, not both.`);
+        if (job.session_name !== undefined && (typeof job.session_name !== "string" || job.session_name.trim() === "")) throw new Error(`job ${i + 1} session_name must be a non-empty name.`);
+        if (job.session_id !== undefined && (typeof job.session_id !== "string" || job.session_id.trim() === "")) {
+            throw new Error(`job ${i + 1} session_id must be a non-empty native session id.`);
+        }
         if (seenPrompts.has(job.prompt)) {
             // Duplicate prompts are allowed, but a batch with every prompt
             // identical is a common mistake; warn via the error path only when
@@ -273,8 +282,8 @@ export function formatBatchLaunchResponse({ batchId, batchName, launched, skippe
         lines.push(
             `Batch ${label} launched ${launched.length} subagent(s):`,
         );
-        for (const { name, id, modelNote } of launched) {
-            lines.push(`• ${name} → ${id}${modelNote ? ` · ${modelNote}` : ""}`);
+        for (const { name, id, sessionId, modelNote } of launched) {
+            lines.push(`• ${name} → ${id}${sessionId && sessionId !== id ? ` (session ${sessionId})` : ""}${modelNote ? ` · ${modelNote}` : ""}`);
         }
     }
 

package/node_modules/pi-better-subagents/catalog-runtime.ts

@@ -222,12 +222,16 @@ export async function clarifyCatalogRequest(
     const normalized = jobs.map((job, index) => ({
         job: { ...job, catalogJobIndex: index },
         index,
-        agent: agentIdOf(job),
-        roles: roleIdsOf(job),
+        continuation: job.session_id !== undefined || job.session_name !== undefined,
+        agent: job.session_id !== undefined || job.session_name !== undefined ? undefined : agentIdOf(job),
+        roles: job.session_id !== undefined || job.session_name !== undefined ? [] : roleIdsOf(job),
     }));
     const clean: CatalogJobFields[] = [];
     const pending: { job: CatalogJobFields; index: number; agent?: string; roles: string[] }[] = [];
     for (const item of normalized) {
+        // Saved conversations keep their launch recipe. Repeated selectors are
+        // checked against that recipe at admission, never clarified or expanded.
+        if (item.continuation) { clean.push(item.job); continue; }
         if (item.roles.length > 1 || (item.agent && item.roles.length > 0)) pending.push(item);
         else clean.push(withSelector(item.job, { agent: item.agent, role: item.roles[0] }));
     }

package/node_modules/pi-better-subagents/child-codemode.ts

@@ -0,0 +1,17 @@
+/** Native Pi codemode, explicitly loaded because children disable extension discovery. */
+import * as SDK from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+/** Older supported SDKs have no native codemode; keep their existing tool set. */
+export function installChildCodemode(pi: ExtensionAPI, confined = false): boolean {
+    const factory = (SDK as any).createCodemodeExtension;
+    if (typeof factory !== "function") return false;
+    // Model globals make direct provider calls outside nested tool hooks.
+    // Confined children get only tool dispatch, which passes through the guard.
+    factory(confined ? { models: false } : {})(pi);
+    return true;
+}
+
+export default function childCodemode(pi: ExtensionAPI): void {
+    installChildCodemode(pi);
+}

package/node_modules/pi-better-subagents/cleanup.ts

@@ -11,6 +11,7 @@ import { join, relative, sep } from "node:path";
 import {
     baseDir,
     listMetas,
+    observeArchivePublication,
     ownedByThisParent,
     orphanedTaskRuntimeProvenance,
     processStartToken,
@@ -35,6 +36,7 @@ import {
     withConversationMutation,
 } from "./continuation.ts";
 import { processExists } from "./spawn.ts";
+import { archiveCompletedAttempt, archivePublicationPending, listArchivedAttempts } from "./session-store.ts";
 
 export const DEFAULT_CLEANUP_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 
@@ -346,6 +348,70 @@ function planCleanupOccupancy(
 interface CleanupScope {
     occupancy: CleanupOccupancy;
     runIdsBySession: Map<string, string[]>;
+    /**
+     * Conversations whose saved session and launch recipe live in durable
+     * storage. Their history and owned clone workspace never age out; only the
+     * volatile log, metadata, and task scratch are reclaimed.
+     */
+    persistent: ReadonlySet<string>;
+    /**
+     * Completed attempts whose compact durable record is still unpublished. The
+     * volatile run directory holds the only copy of the recipe, so both bounds
+     * retain the whole run until a sweep can publish it.
+     */
+    archivePending: ReadonlySet<string>;
+}
+
+/**
+ * Conversations with a durable continuation record: a completed attempt saved
+ * its compact metadata and frozen recipe under the Pi agent directory. Their
+ * saved history and owned clone workspace are kept indefinitely; only the
+ * volatile log, metadata, and task scratch are reclaimed.
+ *
+ * A completed durable-layout attempt whose compact record could not be published
+ * belongs here too: it is not resumable yet, but its recipe, saved history, and
+ * clone are the only copy of that conversation.
+ *
+ * Legacy attempts (recipes pointing at the old temporary session directory, or
+ * fixtures without a recipe) never publish that record and keep the existing
+ * reclaimable behavior. A conversation that only ever failed is not resumable,
+ * so its artifacts stay ordinary aged history and do not pin a clone forever.
+ */
+function persistentSessionIds(
+    metas: readonly RunMeta[],
+    archivePending: ReadonlySet<string>,
+): Set<string> {
+    const sessions = new Set(listArchivedAttempts().map((meta) => meta.sessionId));
+    for (const meta of metas) {
+        if (archivePending.has(meta.id)) sessions.add(meta.sessionId);
+    }
+    return sessions;
+}
+
+/**
+ * Retry publication of every completed attempt whose compact durable record is
+ * missing, BEFORE either bound decides what to delete.
+ *
+ * The volatile run directory is the only place a completed attempt's recipe
+ * lives until that record is published, so this pass is what makes the age and
+ * size bounds safe: while it keeps failing, the runs it names are retained (see
+ * `CleanupScope.archivePending`), and once it succeeds they are ordinary
+ * persistent conversations whose raw logs may be reclaimed.
+ *
+ * Returns the run ids still unpublished.
+ */
+function retryPendingArchives(metas: readonly RunMeta[]): Set<string> {
+    const pending = new Set<string>();
+    for (const meta of metas) {
+        if (!archivePublicationPending(meta)) continue;
+        try {
+            if (archiveCompletedAttempt(meta)) observeArchivePublication(meta.id);
+        } catch (error) {
+            observeArchivePublication(meta.id, error);
+        }
+        if (archivePublicationPending(meta)) pending.add(meta.id);
+    }
+    return pending;
 }
 
 function runIdsBySession(metas: readonly RunMeta[]): Map<string, string[]> {
@@ -457,7 +523,7 @@ function cleanRunDirs(cutoff: number, scope: CleanupScope, errors: string[]): nu
         const dir = runDir(id);
         const meta = readMeta(id);
         if (meta) {
-            if (!ageSweepEligible(meta, cutoff, retained, scope.occupancy)) continue;
+            if (!ageSweepEligible(meta, cutoff, retained, scope)) continue;
             if (removeAgedRunArtifacts(meta, cutoff, retained, scope, errors)) removed += 1;
             continue;
         }
@@ -480,13 +546,15 @@ function ageSweepEligible(
     meta: RunMeta,
     cutoff: number,
     retained: ReadonlySet<string>,
-    occupancy: CleanupOccupancy,
+    scope: CleanupScope,
 ): boolean {
     if (!TERMINAL_CLEANUP_STATUSES.has(meta.status)) return false;
     if (retained.has(meta.sessionId)) return false;
+    // The run directory still holds the only copy of this conversation's recipe.
+    if (scope.archivePending.has(meta.id)) return false;
     // A released conversation can still be in use: a later attempt may run
     // inside this root's clone, or a stop/kill may not have landed.
-    if (occupancy.runIds.has(meta.id)) return false;
+    if (scope.occupancy.runIds.has(meta.id)) return false;
     return terminalTimestamp(meta) < cutoff;
 }
 
@@ -515,8 +583,8 @@ function removeAgedRunArtifacts(
     return withConversationSerialization(meta.sessionId, () => {
         if (!conversationQuiescentUnderLock(meta.sessionId, runIds)) return false;
         const fresh = readMeta(meta.id) ?? meta;
-        if (!ageSweepEligible(fresh, cutoff, retained, scope.occupancy)) return false;
-        if (removeMetaArtifacts(fresh)) return true;
+        if (!ageSweepEligible(fresh, cutoff, retained, scope)) return false;
+        if (removeMetaArtifacts(fresh, { keepWorkspace: scope.persistent.has(fresh.sessionId) })) return true;
         errors.push(`${runDir(meta.id)}: could not remove run artifacts`);
         return false;
     }, () => false);
@@ -528,8 +596,8 @@ function removeAgedRunArtifacts(
  * `<timestamp>_<sessionId>.jsonl` name, or the bare conversation name. History
  * that resolves to nothing this sweep knows stays on the ordinary path.
  */
-function sessionIdForPath(path: string, serialized: ReadonlySet<string>): string | undefined {
-    const rel = relative(sessionsDir(), path);
+function sessionIdForPath(root: string, path: string, serialized: ReadonlySet<string>): string | undefined {
+    const rel = relative(root, path);
     if (!rel || rel.startsWith("..")) return undefined;
     const known = [...new Set(pathNameCandidates(rel.split(sep)))].filter((candidate) => serialized.has(candidate));
     // Two different tracked conversations in one path is not a layout this
@@ -553,12 +621,13 @@ function* pathNameCandidates(parts: readonly string[]): Generator<string> {
  * when this sweep tracks that conversation.
  */
 function removeSessionPath(
+    root: string,
     path: string,
     serialized: ReadonlySet<string>,
     scope: CleanupScope,
     errors: string[],
 ): boolean {
-    const sessionId = sessionIdForPath(path, serialized);
+    const sessionId = sessionIdForPath(root, path, serialized);
     if (!sessionId) return removePath(path, errors);
     const runIds = scope.runIdsBySession.get(sessionId) ?? [];
     return withConversationSerialization(sessionId, () => {
@@ -567,7 +636,7 @@ function removeSessionPath(
     }, () => false);
 }
 
-function activeSessionIds(metas: RunMeta[], occupancy: CleanupOccupancy): Set<string> {
+function activeSessionIds(metas: RunMeta[], occupancy: CleanupOccupancy, persistent: ReadonlySet<string>): Set<string> {
     const active = new Set<string>(occupancy.sessions);
     for (const meta of metas) {
         if (meta.status === "running" || meta.status === "orphaned") active.add(meta.sessionId);
@@ -575,12 +644,14 @@ function activeSessionIds(metas: RunMeta[], occupancy: CleanupOccupancy): Set<st
     // A retained completed conversation is not active work, but its saved
     // session file is the history a continuation reopens.
     for (const sessionId of retainedSessionIds()) active.add(sessionId);
+    // Durable conversations never expire with the volatile sweeps either.
+    for (const sessionId of persistent) active.add(sessionId);
     return active;
 }
 
-function pathMentionsActiveSession(path: string, active: Set<string>): boolean {
+function pathMentionsActiveSession(root: string, path: string, active: Set<string>): boolean {
     if (active.size === 0) return false;
-    const rel = relative(sessionsDir(), path);
+    const rel = relative(root, path);
     for (const sessionId of active) {
         if (sessionId && rel.includes(sessionId)) return true;
     }
@@ -588,6 +659,7 @@ function pathMentionsActiveSession(path: string, active: Set<string>): boolean {
 }
 
 function cleanSessionTree(
+    root: string,
     cutoff: number,
     active: Set<string>,
     protectedPaths: readonly string[],
@@ -595,7 +667,6 @@ function cleanSessionTree(
     serialized: ReadonlySet<string>,
     errors: string[],
 ): number {
-    const root = sessionsDir();
     if (!existsSync(root)) return 0;
     let removed = 0;
 
@@ -614,10 +685,10 @@ function cleanSessionTree(
             if (entry.isDirectory()) {
                 const childEmpty = visit(path);
                 if (childEmpty
-                    && !pathMentionsActiveSession(path, active)
+                    && !pathMentionsActiveSession(root, path, active)
                     && !pathOverlapsProtected(path, protectedPaths)) {
                     const mtimeMs = safeStatMtime(path);
-                    if (mtimeMs !== undefined && mtimeMs < cutoff && removeSessionPath(path, serialized, scope, errors)) {
+                    if (mtimeMs !== undefined && mtimeMs < cutoff && removeSessionPath(root, path, serialized, scope, errors)) {
                         removed += 1;
                         continue;
                     }
@@ -626,12 +697,12 @@ function cleanSessionTree(
                 continue;
             }
 
-            if (pathMentionsActiveSession(path, active) || pathOverlapsProtected(path, protectedPaths)) {
+            if (pathMentionsActiveSession(root, path, active) || pathOverlapsProtected(path, protectedPaths)) {
                 empty = false;
                 continue;
             }
             const mtimeMs = safeStatMtime(path);
-            if (mtimeMs !== undefined && mtimeMs < cutoff && removeSessionPath(path, serialized, scope, errors)) {
+            if (mtimeMs !== undefined && mtimeMs < cutoff && removeSessionPath(root, path, serialized, scope, errors)) {
                 removed += 1;
                 continue;
             }
@@ -656,19 +727,33 @@ export function runDailyCleanupOnce(options: DailyCleanupOptions = {}): DailyCle
     const terminalRetention = retentionMs(options.terminalRunRetentionMs, options.config?.cleanupTerminalRunRetentionMs);
     const sessionRetention = retentionMs(options.sessionRetentionMs, options.config?.cleanupSessionRetentionMs);
     const metas = listMetas();
+    // Publish any outstanding compact record before this sweep reclaims the only
+    // copy of a completed attempt's recipe.
+    const archivePending = retryPendingArchives(metas);
+    const persistent = persistentSessionIds(metas, archivePending);
     const scope: CleanupScope = {
         occupancy: planCleanupOccupancy(metas, options.protect),
         runIdsBySession: runIdsBySession(metas),
+        persistent,
+        archivePending,
     };
     const removedRunDirs = cleanRunDirs(now - terminalRetention, scope, errors);
-    const removedSessionPaths = cleanSessionTree(
-        now - sessionRetention,
-        activeSessionIds(metas, scope.occupancy),
-        scope.occupancy.paths,
-        scope,
-        serializedConversations(metas),
-        errors,
-    );
+    // Native saved history is durable regardless of the latest attempt status.
+    // Sweep only legacy temporary sessions; eligibility to resume must never
+    // determine whether a durable native conversation is kept.
+    const sessionRoots = [join(baseDir(), "sessions")];
+    let removedSessionPaths = 0;
+    for (const root of sessionRoots) {
+        removedSessionPaths += cleanSessionTree(
+            root,
+            now - sessionRetention,
+            activeSessionIds(metas, scope.occupancy, persistent),
+            scope.occupancy.paths,
+            scope,
+            serializedConversations(metas),
+            errors,
+        );
+    }
 
     try {
         writeCleanupState({ lastLocalDate: dateKey, lastRunAt: now });
@@ -767,6 +852,10 @@ export function enforceRegistrySizeCapOnce(options: SizeCapOptions = {}): SizeCa
         ?? (Number.isFinite(configured) && configured! > 0 ? configured! : DEFAULT_MAX_REGISTRY_BYTES);
 
     const errors: string[] = [];
+    // Same ordering as the age sweep: retry archival first, so a run whose
+    // recipe only exists in its volatile directory is never a removal candidate.
+    const metas = listMetas();
+    const archivePending = retryPendingArchives(metas);
     const entries = collectSizeCapEntries();
     // Retained conversations and their workspaces are exempt from the byte
     // bound until the owner releases them; a size sweep must not delete the
@@ -776,17 +865,20 @@ export function enforceRegistrySizeCapOnce(options: SizeCapOptions = {}): SizeCa
     // Occupancy costs a metadata scan and lease reads, so it is only computed
     // when this sweep would actually remove something.
     const totalBytes = entries.reduce((sum, entry) => sum + entry.bytes, 0);
-    const metas = listMetas();
     const occupancy = totalBytes > maxBytes ? planCleanupOccupancy(metas, options.protect) : undefined;
     const protectedIds = new Set([
         ...(options.protectedIds ?? ownRunIds(metas)),
         ...retainedRunIds(metas),
         ...(occupancy?.runIds ?? []),
+        // An unpublished compact record is the recipe's only copy.
+        ...archivePending,
     ]);
     const plan = planRegistrySizeCap(entries, { maxBytes, protectedIds });
     const scope: CleanupScope = {
         occupancy: occupancy ?? { sessions: new Set(), runIds: new Set(), paths: [] },
         runIdsBySession: runIdsBySession(metas),
+        persistent: persistentSessionIds(metas, archivePending),
+        archivePending,
     };
     const bytesById = new Map(entries.map((entry) => [entry.id, entry.bytes]));
     const removed: string[] = [];
@@ -830,7 +922,7 @@ function removeSizeCappedRun(
         const fresh = readMeta(id) ?? meta;
         if (!TERMINAL_CLEANUP_STATUSES.has(fresh.status)) return "retained";
         if (scope.occupancy.runIds.has(fresh.id)) return "retained";
-        if (removeMetaArtifacts(fresh)) return "removed";
+        if (removeMetaArtifacts(fresh, { keepWorkspace: scope.persistent.has(fresh.sessionId) })) return "removed";
         errors.push(`${runDir(id)}: could not remove run artifacts`);
         return "failed";
     }, () => "retained");

package/node_modules/pi-better-subagents/config.json

@@ -1,6 +1,6 @@
 {
   "defaultModel": null,
-  "defaultTools": "read, bash, edit, write, web_search, web_fetch",
+  "defaultTools": "read, bash, edit, write, web_search, web_fetch, codemode",
   "maxConcurrent": 6,
   "delegationMode": "adaptive",
 

package/node_modules/pi-better-subagents/config.ts

@@ -85,7 +85,7 @@ export function normalizeConcurrencyCap(value: unknown): number {
 }
 
 /** Built-in default tool set when config.json sets nothing. */
-export const SAFE_DEFAULT_TOOLS = "read, bash, edit, write, web_search, web_fetch";
+export const SAFE_DEFAULT_TOOLS = "read, bash, edit, write, web_search, web_fetch, codemode";
 /** Safe default for a hermetic (clean) child where extension tools don't exist. */
 export const SAFE_CLEAN_TOOLS = "read, bash";
 

package/node_modules/pi-better-subagents/continuation.ts

@@ -18,9 +18,19 @@
  *    clean/nesting/approval intent, confinement, model, effort, role identity,
  *    workspace intent) on run metadata.
  * 3. **Explicit retention.** `retain_session` records a bounded promise that a
- *    completed conversation and its workspace stay out of cleanup until the
- *    owner releases it. Retention lives in the existing runtime storage, so
- *    system-temp reaping can still remove it; a missing conversation refuses.
+ *    completed conversation and its workspace stay out of cleanup until a
+ *    foreground session releases it. Retention lives in the existing runtime
+ *    storage, so system-temp reaping can still remove it; a missing
+ *    conversation refuses.
+ *
+ * Foreground-session ownership is provenance, not an authorization boundary:
+ * Pi sessions are ordinary files on disk, so any foreground session that can
+ * name a completed attempt with a verifiable saved conversation, workspace, and
+ * launch recipe may continue it (or release its optional retention). The new
+ * attempt records the INVOKING foreground as its callback origin and its
+ * permission admission is re-resolved from the current profile, so continuing
+ * transfers the run to the caller instead of borrowing the original owner's
+ * authority.
  * 4. **Conversation writer lease.** A cross-process token lease held from
  *    admission through child lifetime and finalization. Duplicate continuations
  *    of one conversation admit exactly one writer. Lease-path and retention
@@ -66,6 +76,7 @@ import {
     type RunStatus,
 } from "./registry.ts";
 import { processExists } from "./spawn.ts";
+import { durableSubagentRoot } from "./session-store.ts";
 
 const nodeRequire = createRequire(import.meta.url);
 
@@ -231,7 +242,11 @@ export interface RetentionRecord {
     ownerRunId: string;
     /** Canonical workspace kept available for continuation. */
     workspace: string;
-    /** Foreground session that may continue or release this conversation. */
+    /**
+     * Foreground session that first retained this conversation. Provenance for
+     * diagnostics only: retention is optional convenience, not a tenancy
+     * boundary, so any foreground session may release it.
+     */
     ownerOrigin: RunCallbackOrigin;
     retainedAt: number;
     lastAttemptId: string;
@@ -398,7 +413,14 @@ export function markRetentionReleased(
 
 // ---- ownership and continuation plan ------------------------------------
 
-/** True when `origin` is the foreground session recorded on the run. */
+/**
+ * True when `origin` is the foreground session recorded on the run.
+ *
+ * This is a provenance/labelling helper, deliberately NOT an admission gate: a
+ * different foreground session may continue a completed attempt (see the
+ * module header). Callers that need to route a notification use it to decide
+ * which foreground a run belongs to, not to deny an operation.
+ */
 export function ownedByOrigin(meta: RunMeta, origin: RunCallbackOrigin | undefined): boolean {
     const recorded = meta.callbackOrigin;
     if (!origin?.sessionId || typeof origin.cwd !== "string") return false;
@@ -441,8 +463,12 @@ export function planContinuation(options: {
 }): ContinuationPlan {
     const { id, prior, origin, others } = options;
     if (!prior) throw refusal(id, "no such run id.");
+    // The invoking foreground is still required, because the new attempt's
+    // completion callback and navigator entry are routed to it. It is not
+    // required to be the attempt's original owner: the saved session, workspace,
+    // and recipe are the thing being continued, and Pi sessions are shared
+    // on-disk state rather than a per-foreground boundary.
     if (!origin?.sessionId) throw refusal(id, "the active foreground session identity is unavailable.");
-    if (!ownedByOrigin(prior, origin)) throw refusal(id, "only its owning foreground session may continue it.");
     if (prior.status !== "completed") {
         throw refusal(id, `its status is ${prior.status}; only a completed run can be continued. Stop or launch a new run instead.`);
     }
@@ -490,13 +516,13 @@ export function planRetentionRelease(options: {
 }): RetentionRecord {
     const { id, prior, origin, others } = options;
     if (!prior) throw new ContinuationError(`Cannot release ${id}: no such run id.`);
+    // Release is the same on-disk convenience promise as continuation: any
+    // foreground that can name the attempt may drop optional retention. The
+    // invoking identity is still required, because the record keeps `releasedBy`
+    // and the decision must be attributable to a real foreground session.
     if (!origin?.sessionId) throw new ContinuationError(`Cannot release ${id}: the active foreground session identity is unavailable.`);
-    if (!ownedByOrigin(prior, origin)) throw new ContinuationError(`Cannot release ${id}: only its owning foreground session may change retention.`);
     const record = readRetention(prior.sessionId);
     if (!record) throw new ContinuationError(`Cannot release ${id}: it was not launched with retain_session, so it has no retained conversation.`);
-    if (!record.ownerOrigin.sessionId || record.ownerOrigin.sessionId !== origin.sessionId || record.ownerOrigin.cwd !== origin.cwd) {
-        throw new ContinuationError(`Cannot release ${id}: only the foreground session that retained this conversation may release it.`);
-    }
     if (record.releasedAt !== undefined) {
         throw new ContinuationError(`Cannot release ${id}: its retention was already released at ${new Date(record.releasedAt).toISOString()}.`);
     }
@@ -541,8 +567,14 @@ const ADMISSION_LOCK_WAIT_MS = 0;
 const RELEASE_LOCK_WAIT_MS = 1_000;
 const RETENTION_LOCK_WAIT_MS = 1_000;
 
+/**
+ * Stable writer-lease root, independent of TMPDIR: a conversation is ordinary
+ * on-disk Pi state, so a foreground that restarts under a different temp root
+ * must still see the one writer slot. Retention records stay in the volatile
+ * registry as before.
+ */
 export function conversationLeaseDir(): string {
-    return join(baseDir(), "conversation-leases");
+    return join(durableSubagentRoot(), "conversation-leases");
 }
 
 function leasePathFor(sessionId: string): string {