[brennanb2025]

	Files	Added	Deleted	Net
Test	10	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​741	$\color{#cf222e}{\Huge{\mathbf{−}}}$​327	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​414
Prod	16	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​776	$\color{#cf222e}{\Huge{\mathbf{−}}}$​125	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​651

ELI5

Pi could appear ready without an authenticated model and accept a message it could not answer. A failure reported during opening could also be logged while the open continued. A chat now waits for a successful opening before Pi receives its first message.

What Changed

Pi now publishes its process and the host awaits its state before sending input. An unknown provider or a successful empty model list fails the start as signed out; a failed optional listing does not. Callback failure also rejects the open. The host records one failure and closes once. This keeps main's sign-in restart rule: for every agent, a later send after a signed-out result uses a new process once existing work settles, so a login made since can take effect. The same failed send is not retried. Pi's obsolete start-availability signal is removed because an empty model list now fails opening.

Why

The host owns startup failure and derives it from its phase. Pi checks its existing failure cause during opening instead of allowing a broken start to become ready. The all-agent restart rule from #26544 remains necessary because some agent programs cache login until reconnect; Pi's stricter start failure does not replace that recovery for a later turn. The unused start-availability overlay is deleted.

Differences from the common pattern

• INTENDED — A successful empty Pi model list fails startup. It is evidence that this process has no authenticated model; a transport failure in the optional read is not.
• INTENDED — Required startup reads use the host ceiling. Pi's state request uses the ten-minute ceiling and the host silence rule instead of a shorter request timeout, so an execution host can settle its start without a connected client.
• INTENDED — Restart after a signed-out result applies to every agent. Programs that cache their login need a fresh process after sign-in. Existing work keeps its owner and cleanup bookkeeping does not gate a later send.

Linked Issue

Replaces the Pi-startup portion of #26561; depends on the three lower drafts.

Visual Proof

Rendered before/after evidence is pending. Scripted tests cover the behavior; no screenshot or manual platform evidence is claimed.

Testing

• Manually tested on all supported platforms
• Automated tests added or updated

Focused Pi, all-agent sign-in restart, model-list and three-adapter startup-failure tests; Node and CI project typechecks; static checks with the accepted pinned-main HtmlDocPreview exception. Scripted macOS tests only.

Review

Reviewed the owning diff, failure paths and covered races. Tests demonstrate covered behaviors; rendered and real remote-host QA are pending.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer source is copied or translated.

Notes

Execution stays on the host owning the agent. Folder workspaces and independently updated peers retain their existing paths. Loss of contact is not process-exit evidence. Draft only; no main sync or hosted CI watch.

Checklist

• Problem, user-facing change, mechanism and approach explained
• Self-reviewed source and regression evidence
• Cross-platform, folder, SSH and older-peer behavior considered
• Final main sync, hosted CI and rendered proof completed

[brennanb2025]

Folded into #28046, which merged as 5319125. Closing this draft; nothing here is lost.