The borrow marks its own session stale when the login bounces

[czpython]

Marking a session stale on a login bounce was platform bookkeeping in app code: x-me carried a dedicated durable step whose only job was giving that one write a transaction, because the mark must land while the failing harvest's transaction rolls back.

A FatalError can now name a signal to announce itself on when the run fails. The run machinery, after recording the failure, publishes that signal in its own retrying checkpoint — feature-blind, it just forwards the exception's declared facts (broadcast_topic + broadcast_facts, both empty by default). BrowserSessionSignedOutError (exported from druks.browser) names browser.session_signed_out and carries the session name; a browser subscriber marks that session stale off the signal.

The result:

• The exception stays pure data — a code, a topic, a facts dict. No behavior, no side effects.
• The core run loop imports nothing from the browser subsystem; it publishes whatever a fatal declares.
• The reaction lives where it belongs — a declarative @subscribe in druks/browser/subscribers.py, durable and idempotent through the same publish-in-a-step machinery the run lifecycle already uses.

Flow: extension code raises BrowserSessionSignedOutError through the borrow. The door does one thing — stamps which session bounced. The run fails under browser_session_signed_out and publishes the bounce; the subscriber marks that session stale. The pane shows the stale session beside the failed run, further borrows are refused until the operator signs in again, and dead cookies are never written back. The workflow has nothing to catch; the next scheduled run proceeds once the login is back.

The descriptor's public mark_stale() loses its consumer and goes. The author guide teaches the raise. Two tests: the borrow test proves the door stamps the session and stores nothing; the durable test drives the reaction end to end — run failed under the code, row stale.

The x-me side (czpython/druks-apps#11) deletes its _mark_login_stale step, its local exception, and the whole catch: harvest raises the platform's exception and the body stays linear.