@byok-sdk/client 0.11.0 → 0.13.0

package/dist/bin/byok-agent.js

@@ -3,7 +3,7 @@ import { randomUUID, createHash, randomBytes, timingSafeEqual, createHmac, creat
 import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, existsSync, realpathSync, mkdirSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
 import * as path3 from 'path';
 import path3__default, { isAbsolute, join } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, TERMINAL_PROJECTION_SELECTION_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
 import net, { createServer, createConnection } from 'net';
 import * as os from 'os';
 import os__default from 'os';
@@ -13,7 +13,6 @@ import 'readline';
 import { isTenantId, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, nonceSigningBytes, CapabilityDeclarationSchema, hasCapability, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
 import { promisify } from 'util';
 import * as fs13 from 'fs/promises';
-import { WebSocket } from 'ws';
 import { createRequire } from 'module';
 import { createInterface } from 'readline/promises';
 
@@ -445,6 +444,23 @@ async function resolveExistingAncestor(inputPath) {
     }
   }
 }
+async function canonicalPath(inputPath) {
+  const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
+  return path3__default.resolve(canonical2, ...tail);
+}
+async function assertRealDirectoryIfPresent(target) {
+  let stat;
+  try {
+    stat = await promises.lstat(target);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return;
+    throw error;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new AgentHomeResolutionError(`Agent home path component is not a real directory: ${target}`);
+  }
+}
 async function materializeDirectory(inputPath) {
   const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
   let cursor = canonical2;
@@ -539,6 +555,39 @@ var AgentHomeLayout = class {
       await gate.release();
     }
   }
+  /**
+   * Pure canonical-home derivation for read-only callers, such as the
+   * pre-admission single-writer count. It validates the AgentRef and joins
+   * exactly the same `<hostStorageRoot>/agents/<agentId>` segments
+   * {@link AgentHomeLayout.resolve} would, canonicalizing only the components
+   * that already exist.
+   *
+   * It deliberately creates no directory, takes no cross-process mutation
+   * gate and records no Agent binding, so an offer the host vetoes after the
+   * count leaves nothing behind on disk. `resolve()` stays the only path that
+   * may materialize a home or bind it to an Agent identity.
+   *
+   * An `agents` root or `agents/<agentId>` leaf that already exists but is a
+   * symlink (or any non-directory) is rejected here with the same error class
+   * and message `resolve()` raises for it, so an in-root `two -> one` link
+   * fails closed instead of silently keying the count of `one`. A leaf that
+   * does not exist yet is not an error: this derivation runs before the home
+   * is materialized. A home canonicalizing outside the `agents` root stays
+   * rejected as before.
+   */
+  async canonicalHomePath(agentRefInput) {
+    const agentRef = validateAgentRef(agentRefInput);
+    const hostStorageRoot = this.canonicalRoot ?? await canonicalPath(this.hostStorageRootInput);
+    const agentsRoot = path3__default.join(hostStorageRoot, AGENT_HOME_DIRECTORY);
+    await assertRealDirectoryIfPresent(agentsRoot);
+    const lexicalHome = path3__default.join(agentsRoot, agentRef.agentId);
+    await assertRealDirectoryIfPresent(lexicalHome);
+    const canonicalHome = await canonicalPath(lexicalHome);
+    if (canonicalHome === agentsRoot || !isWithin(agentsRoot, canonicalHome)) {
+      throw new AgentHomeResolutionError(`Agent home resolves outside the Agent home root: ${canonicalHome}`);
+    }
+    return canonicalHome;
+  }
   /**
    * Prove the canonical root is materializable and writable before the daemon
    * advertises Agent-home capability. No Agent identity or persistent Agent
@@ -768,6 +817,158 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
     }
   }
 };
+function executionKey(input) {
+  const value = input.sessionRef === void 0 ? input.taskId : input.sessionRef;
+  const label = input.sessionRef === void 0 ? "taskId" : "sessionRef";
+  if (typeof value !== "string" || value.length === 0 || /[\u0000\r\n]/u.test(value)) {
+    throw new AgentHomeResolutionError(`Agent execution ${label} must be a non-empty single-line string`);
+  }
+  return `${input.sessionRef === void 0 ? "task" : "session"}\0${value}`;
+}
+var AgentHomeExecutionLeaseManager = class _AgentHomeExecutionLeaseManager {
+  constructor(manager) {
+    this.manager = manager;
+  }
+  manager;
+  static groups = /* @__PURE__ */ new Map();
+  static queues = /* @__PURE__ */ new Map();
+  async acquire(resolution, input) {
+    const initialKey = executionKey(input);
+    return this.exclusive(resolution.canonicalHome, async () => {
+      let group = _AgentHomeExecutionLeaseManager.groups.get(resolution.canonicalHome);
+      if (group === void 0) {
+        const baseLease = await this.manager.acquire(resolution);
+        group = {
+          manager: this.manager,
+          baseLease,
+          agentId: resolution.agentRef.agentId,
+          leasesByKey: /* @__PURE__ */ new Map()
+        };
+        _AgentHomeExecutionLeaseManager.groups.set(resolution.canonicalHome, group);
+      } else if (group.manager !== this.manager || group.agentId !== resolution.agentRef.agentId) {
+        throw new AgentHomeBusyError(`Agent home ${resolution.canonicalHome} is active under another execution owner`);
+      }
+      if (group.leasesByKey.has(initialKey)) {
+        throw new AgentHomeBusyError(`Agent session already has an active execution lease in ${resolution.canonicalHome}`);
+      }
+      const leaseId = randomUUID();
+      group.leasesByKey.set(initialKey, leaseId);
+      let currentKey = initialKey;
+      let sessionBound = input.sessionRef !== void 0;
+      let released = false;
+      return Object.freeze({
+        leaseId,
+        agentRef: resolution.agentRef,
+        canonicalHome: resolution.canonicalHome,
+        cwd: resolution.canonicalHome,
+        homeIdentity: group.baseLease.homeIdentity,
+        bindSession: async (sessionRef) => {
+          const nextKey = executionKey({ taskId: input.taskId, sessionRef });
+          await this.exclusive(resolution.canonicalHome, async () => {
+            if (released) throw new AgentHomeBusyError(`Agent execution lease ${leaseId} is already released`);
+            const currentGroup = _AgentHomeExecutionLeaseManager.groups.get(resolution.canonicalHome);
+            if (currentGroup !== group || currentGroup.leasesByKey.get(currentKey) !== leaseId) {
+              throw new AgentHomeBusyError(`Agent execution lease ${leaseId} is no longer owned by this process`);
+            }
+            if (nextKey === currentKey) return;
+            if (sessionBound) {
+              throw new AgentHomeBusyError(
+                `Agent session execution lease ${leaseId} cannot rebind to a different runtime session`
+              );
+            }
+            if (currentGroup.leasesByKey.has(nextKey)) {
+              throw new AgentHomeBusyError(`Agent session already has an active execution lease in ${resolution.canonicalHome}`);
+            }
+            currentGroup.leasesByKey.set(nextKey, leaseId);
+            currentGroup.leasesByKey.delete(currentKey);
+            currentKey = nextKey;
+            sessionBound = true;
+          });
+        },
+        release: async () => {
+          await this.exclusive(resolution.canonicalHome, async () => {
+            if (released) return;
+            const currentGroup = _AgentHomeExecutionLeaseManager.groups.get(resolution.canonicalHome);
+            if (currentGroup !== group || currentGroup.leasesByKey.get(currentKey) !== leaseId) {
+              released = true;
+              throw new AgentHomeBusyError(`Agent execution lease ${leaseId} is no longer owned by this process`);
+            }
+            currentGroup.leasesByKey.delete(currentKey);
+            released = true;
+            if (currentGroup.leasesByKey.size === 0) {
+              _AgentHomeExecutionLeaseManager.groups.delete(resolution.canonicalHome);
+              await currentGroup.baseLease.release();
+            }
+          });
+        }
+      });
+    });
+  }
+  /**
+   * WP0: Attempts currently holding an execution lease on this exact
+   * canonical home, across every lane and every session. This is the number
+   * the daemon's admission gate reads before any side effect — see
+   * `TaskRunner.handleOffer`'s per-home busy gate.
+   *
+   * Derived from the one lease registry above rather than a second tally, so
+   * it inherits the lease lifecycle exactly: an entry appears at `acquire()`,
+   * survives `bindSession()` (which rekeys in place), and disappears only at
+   * `release()`, which the task runner calls after the attempt is terminal
+   * AND `Session.close()` resolved. A failed disposal never reaches
+   * `release()`, so the slot stays held — fail closed, the same posture as
+   * `runtime-disposal-failed`. Crash residue needs nothing extra here: a
+   * restarted daemon starts with an empty registry and reclaims the on-disk
+   * marker only under the same stable owner identity (`openLeaseMarker`).
+   *
+   * Counted regardless of which lease manager owns the group: the invariant
+   * being protected is the filesystem path (`MEMORY.md`, `notes/`, `.git`),
+   * not the owner identity.
+   */
+  activeAttemptCount(canonicalHome) {
+    return _AgentHomeExecutionLeaseManager.groups.get(canonicalHome)?.leasesByKey.size ?? 0;
+  }
+  /**
+   * Counts-only readback for daemon/control status. Scoped to this manager's
+   * own leases, so the number describes this daemon rather than every home
+   * any manager in the process happens to hold. Never exposes a home path.
+   */
+  activeAttemptSummary() {
+    let homes = 0;
+    let attempts = 0;
+    for (const group of _AgentHomeExecutionLeaseManager.groups.values()) {
+      if (group.manager !== this.manager) continue;
+      homes += 1;
+      attempts += group.leasesByKey.size;
+    }
+    return { homes, attempts };
+  }
+  async mutate(binding, operation) {
+    return this.exclusive(binding.resolution.canonicalHome, async () => {
+      const group = _AgentHomeExecutionLeaseManager.groups.get(binding.resolution.canonicalHome);
+      if (group === void 0 || group.manager !== this.manager || ![...group.leasesByKey.values()].includes(binding.lease.leaseId)) {
+        throw new AgentHomeBusyError("Agent execution lease does not own this home mutation");
+      }
+      return operation();
+    });
+  }
+  async exclusive(canonicalHome, operation) {
+    const prior = _AgentHomeExecutionLeaseManager.queues.get(canonicalHome) ?? Promise.resolve();
+    let release;
+    const tail = new Promise((resolve) => {
+      release = resolve;
+    });
+    _AgentHomeExecutionLeaseManager.queues.set(canonicalHome, tail);
+    await prior;
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (_AgentHomeExecutionLeaseManager.queues.get(canonicalHome) === tail) {
+        _AgentHomeExecutionLeaseManager.queues.delete(canonicalHome);
+      }
+    }
+  }
+};
 async function initializeAgentHome(resolution) {
   await ensureDirectoryNoSymlink(
     resolution.canonicalHome,
@@ -843,10 +1044,12 @@ var AgentHomeManager = class {
   layout;
   projection;
   leaseManager;
+  executionLeaseManager;
   constructor(options) {
     this.layout = new AgentHomeLayout(options.hostStorageRoot);
     this.projection = options.projection;
     this.leaseManager = options.leaseManager ?? new AgentHomeLeaseManager();
+    this.executionLeaseManager = new AgentHomeExecutionLeaseManager(this.leaseManager);
   }
   async prepare(agentRef) {
     const binding = await this.acquire(agentRef);
@@ -873,12 +1076,25 @@ var AgentHomeManager = class {
     const lease = await this.leaseManager.acquire(resolution);
     return Object.freeze({ resolution, lease });
   }
+  async acquireExecution(agentRef, input) {
+    const resolution = await this.layout.resolve(agentRef);
+    const lease = await this.executionLeaseManager.acquire(resolution, input);
+    return Object.freeze({ resolution, lease });
+  }
   /** Initialize only after any requested session exact-match has succeeded. */
   async initialize(binding) {
-    const { resolution, lease } = binding;
+    await this.initializeResolved(binding.resolution, binding.lease.cwd);
+  }
+  async initializeExecution(binding) {
+    await this.mutateExecution(binding, () => this.initializeResolved(binding.resolution, binding.lease.cwd));
+  }
+  async mutateExecution(binding, operation) {
+    return this.executionLeaseManager.mutate(binding, operation);
+  }
+  async initializeResolved(resolution, cwd) {
     await initializeAgentHome(resolution);
     const prepare = this.projection?.prepare;
-    if (prepare !== void 0) await prepare({ ...resolution, cwd: lease.cwd });
+    if (prepare !== void 0) await prepare({ ...resolution, cwd });
     if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
       throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
     }
@@ -1689,13 +1905,22 @@ function freezeRuntimeAdapterDescriptor(descriptor) {
   });
 }
 function sealRuntimeOperationManifest(manifest) {
+  const dispatchSelection = manifest.dispatchSelection === void 0 ? void 0 : manifest.dispatchSelection.lane === "byok-profile" ? Object.freeze({
+    ...manifest.dispatchSelection,
+    providerProfile: Object.freeze({
+      ...manifest.dispatchSelection.providerProfile,
+      requiredCapabilities: Object.freeze([
+        ...manifest.dispatchSelection.providerProfile.requiredCapabilities
+      ])
+    })
+  }) : Object.freeze({ ...manifest.dispatchSelection });
   return Object.freeze({
     taskId: manifest.taskId,
     runtimeId: manifest.runtimeId,
     descriptor: freezeRuntimeAdapterDescriptor(manifest.descriptor),
     policy: frozenPolicy(manifest.policy),
     requiredToolsetIds: Object.freeze([...manifest.requiredToolsetIds]),
-    ...manifest.dispatchSelection === void 0 ? {} : { dispatchSelection: Object.freeze({ ...manifest.dispatchSelection }) },
+    ...dispatchSelection === void 0 ? {} : { dispatchSelection },
     ...manifest.sessionRef === void 0 ? {} : { sessionRef: manifest.sessionRef },
     ...manifest.agentRef === void 0 ? {} : { agentRef: Object.freeze({ agentId: manifest.agentRef.agentId, profileRevision: manifest.agentRef.profileRevision }) },
     cwd: manifest.cwd ?? manifest.workspace.workspaceDir,
@@ -3723,7 +3948,11 @@ function validatePiByokLauncherConfig(launcher) {
     "--macos-keychain-path",
     "--secret-service-prefix",
     "--provider",
-    "--model"
+    "--model",
+    "--profile-revision",
+    "--profile-hash",
+    "--required-capabilities",
+    "--validate-only"
   ]);
   const conflicting = launcher.args?.find((arg) => reserved.has(arg));
   if (conflicting !== void 0) {
@@ -3785,11 +4014,17 @@ var PiAdapter = class {
     const bin = this.resolveBin();
     const extensions = (this.options.resolveExtensions ?? resolvePiExtensions)();
     const selection = input.offer.dispatchSelection;
-    const pinnedSelection = selection === void 0 ? void 0 : Object.freeze({ ...selection });
+    const pinnedSelection = selection === void 0 ? void 0 : selection.lane === "byok-profile" ? Object.freeze({
+      ...selection,
+      providerProfile: Object.freeze({
+        ...selection.providerProfile,
+        requiredCapabilities: Object.freeze([...selection.providerProfile.requiredCapabilities])
+      })
+    }) : Object.freeze({ ...selection });
     let command = bin.command;
     let launcherArgs;
     if (pinnedSelection !== void 0) {
-      if (pinnedSelection.lane !== "byok" || pinnedSelection.runtimeId !== "pi") {
+      if (pinnedSelection.lane !== "byok" && pinnedSelection.lane !== "byok-profile" || pinnedSelection.runtimeId !== "pi") {
         return { kind: "reject", reason: `pi adapter cannot execute ${pinnedSelection.lane} selection for runtime ${pinnedSelection.runtimeId}`, retryable: false };
       }
       const launcher = this.options.byokLauncher;
@@ -3797,6 +4032,21 @@ var PiAdapter = class {
         return { kind: "reject", reason: "pi BYOK selection requires a configured credential-custody launcher", retryable: false };
       }
       command = launcher.command;
+      const providerProfile = pinnedSelection.lane === "byok-profile" ? pinnedSelection.providerProfile : void 0;
+      if (providerProfile !== void 0) {
+        try {
+          await (this.options.validateProviderProfileBinding ?? validateProviderProfileBindingWithLauncher)(
+            providerProfile,
+            launcher
+          );
+        } catch (error) {
+          return {
+            kind: "reject",
+            reason: `provider profile admission failed: ${errorMessage2(error)}`,
+            retryable: false
+          };
+        }
+      }
       launcherArgs = [
         ...launcher.args ?? [],
         "--pi-bin",
@@ -3808,9 +4058,19 @@ var PiAdapter = class {
         ...launcher.macosKeychainPath !== void 0 ? ["--macos-keychain-path", launcher.macosKeychainPath] : [],
         ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
         "--provider",
-        pinnedSelection.providerId,
+        providerProfile?.profileRef ?? (pinnedSelection.lane === "byok" ? pinnedSelection.providerId : ""),
         "--model",
-        pinnedSelection.modelId
+        providerProfile?.modelId ?? (pinnedSelection.lane === "byok" ? pinnedSelection.modelId : ""),
+        ...providerProfile === void 0 ? [] : [
+          "--profile-revision",
+          providerProfile.profileRevision,
+          "--profile-hash",
+          providerProfile.profileHash,
+          "--required-capabilities",
+          JSON.stringify(providerProfile.requiredCapabilities),
+          "--validate-only",
+          "false"
+        ]
       ];
     }
     return {
@@ -3953,8 +4213,42 @@ var PiAdapter = class {
     return (this.options.resolveBin ?? resolvePiBin)();
   }
 };
+async function validateProviderProfileBindingWithLauncher(binding, launcher) {
+  await execFileAsync(launcher.command, [
+    ...launcher.args ?? [],
+    "--pi-bin",
+    process.execPath,
+    "--profile-db",
+    launcher.profileDbPath,
+    "--session-dir",
+    launcher.sessionDir,
+    "--provider",
+    binding.profileRef,
+    "--model",
+    binding.modelId,
+    "--profile-revision",
+    binding.profileRevision,
+    "--profile-hash",
+    binding.profileHash,
+    "--required-capabilities",
+    JSON.stringify(binding.requiredCapabilities),
+    "--validate-only",
+    "true",
+    ...launcher.macosKeychainPath !== void 0 ? ["--macos-keychain-path", launcher.macosKeychainPath] : [],
+    ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : []
+  ], { timeout: DETECT_TIMEOUT_MS });
+}
 function sameDispatchSelection(left, right) {
   if (left === void 0 || right === void 0) return left === right;
+  if (left.lane === "byok-profile" || right.lane === "byok-profile") {
+    if (left.lane !== "byok-profile" || right.lane !== "byok-profile") return false;
+    if (left.runtimeId !== right.runtimeId) return false;
+    const leftProfile = left.providerProfile;
+    const rightProfile = right.providerProfile;
+    return leftProfile.profileRef === rightProfile.profileRef && leftProfile.profileRevision === rightProfile.profileRevision && leftProfile.profileHash === rightProfile.profileHash && leftProfile.modelId === rightProfile.modelId && leftProfile.requiredCapabilities.length === rightProfile.requiredCapabilities.length && leftProfile.requiredCapabilities.every(
+      (capability, index) => capability === rightProfile.requiredCapabilities[index]
+    );
+  }
   return left.lane === right.lane && left.runtimeId === right.runtimeId && left.providerId === right.providerId && left.modelId === right.modelId;
 }
 async function resolveAuthoritativeSessionId(rpc) {
@@ -6371,9 +6665,18 @@ function assertRecord(value) {
     throw new DeviceCredentialStoreError("OS credential entry has an incomplete device credential");
   }
 }
-function encode(record) {
-  assertRecord(record);
-  const encoded = Buffer.from(JSON.stringify(record), "utf8").toString("base64");
+function isFirstPairingAttempt(value) {
+  return "kind" in value && value.kind === "first-pairing-attempt-v1";
+}
+function assertFirstPairingAttempt(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value) || value.kind !== "first-pairing-attempt-v1" || typeof value.deviceName !== "string" || typeof value.devicePublicKey !== "string" || typeof value.devicePrivateKeyPem !== "string" || value.machineId !== void 0 && typeof value.machineId !== "string" || value.deviceName.length === 0 || value.devicePublicKey.length === 0 || value.devicePrivateKeyPem.length === 0) {
+    throw new DeviceCredentialStoreError("OS credential entry has an invalid first-pairing attempt shape");
+  }
+}
+function encode(authority) {
+  if (isFirstPairingAttempt(authority)) assertFirstPairingAttempt(authority);
+  else assertRecord(authority);
+  const encoded = Buffer.from(JSON.stringify(authority), "utf8").toString("base64");
   const value = `${ENCODED_PREFIX}${encoded}`;
   if (Buffer.byteLength(value, "utf8") > 2400) {
     throw new DeviceCredentialStoreError("device credential exceeds the OS credential entry bound");
@@ -6402,6 +6705,16 @@ function decode(value) {
   } catch {
     throw new DeviceCredentialStoreError("OS credential entry is not valid JSON");
   }
+  if (typeof parsed === "object" && parsed !== null && parsed.kind === "first-pairing-attempt-v1") {
+    assertFirstPairingAttempt(parsed);
+    return Object.freeze({
+      kind: parsed.kind,
+      deviceName: parsed.deviceName,
+      devicePublicKey: parsed.devicePublicKey,
+      devicePrivateKeyPem: parsed.devicePrivateKeyPem,
+      ...parsed.machineId === void 0 ? {} : { machineId: parsed.machineId }
+    });
+  }
   assertRecord(parsed);
   return Object.freeze({
     deviceId: parsed.deviceId,
@@ -6432,6 +6745,18 @@ var DeviceCredentialStore = class {
     this.#run = options.commandRunner ?? runDeviceCommand;
   }
   async read() {
+    const authority = await this.#readAuthority();
+    return authority === void 0 || isFirstPairingAttempt(authority) ? void 0 : authority;
+  }
+  async readFirstPairingAttempt() {
+    const authority = await this.#readAuthority();
+    return authority !== void 0 && isFirstPairingAttempt(authority) ? authority : void 0;
+  }
+  async saveFirstPairingAttempt(attempt) {
+    assertFirstPairingAttempt(attempt);
+    await this.#replaceAuthority(attempt);
+  }
+  async #readAuthority() {
     const result = await this.#invoke("read");
     if (result.exitCode === NOT_FOUND || this.#platform === "linux" && result.exitCode === 1 && result.stderr.trim().length === 0) return void 0;
     if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
@@ -6444,6 +6769,12 @@ var DeviceCredentialStore = class {
   }
   async replace(record) {
     const encoded = encode(record);
+    await this.#replaceEncoded(encoded);
+  }
+  async #replaceAuthority(authority) {
+    await this.#replaceEncoded(encode(authority));
+  }
+  async #replaceEncoded(encoded) {
     const result = await this.#invoke("replace", encoded);
     if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
     if (result.exitCode !== 0) {
@@ -6454,7 +6785,7 @@ var DeviceCredentialStore = class {
   }
   /** Returns true only after the sole secret authority is confirmed absent. */
   async clear() {
-    const before = await this.read();
+    const before = await this.#readAuthority();
     if (before === void 0) return false;
     const result = await this.#invoke("clear");
     if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
@@ -6463,7 +6794,7 @@ var DeviceCredentialStore = class {
         `operating-system credential provider could not clear device credentials${providerDiagnostic(result.stderr)}`
       );
     }
-    if (await this.read() !== void 0) {
+    if (await this.#readAuthority() !== void 0) {
       throw new DeviceCredentialStoreError("operating-system credential provider reported deletion but device credentials remain");
     }
     return true;
@@ -6538,17 +6869,24 @@ var DeviceCredentialStore = class {
   }
 };
 var InMemoryDeviceCredentialStore = class {
-  #record;
+  #authority;
   async read() {
-    return this.#record === void 0 ? void 0 : Object.freeze({ ...this.#record });
+    return this.#authority === void 0 || isFirstPairingAttempt(this.#authority) ? void 0 : Object.freeze({ ...this.#authority });
+  }
+  async readFirstPairingAttempt() {
+    return this.#authority !== void 0 && isFirstPairingAttempt(this.#authority) ? Object.freeze({ ...this.#authority }) : void 0;
+  }
+  async saveFirstPairingAttempt(attempt) {
+    assertFirstPairingAttempt(attempt);
+    this.#authority = Object.freeze({ ...attempt });
   }
   async replace(record) {
     assertRecord(record);
-    this.#record = Object.freeze({ ...record });
+    this.#authority = Object.freeze({ ...record });
   }
   async clear() {
-    const had = this.#record !== void 0;
-    this.#record = void 0;
+    const had = this.#authority !== void 0;
+    this.#authority = void 0;
     return had;
   }
 };
@@ -6803,23 +7141,22 @@ function signNonce(privateKey, nonce) {
   const signature = sign(null, nonceSigningBytes(nonce), privateKey);
   return signature.toString("base64url");
 }
+
+// src/daemon/url.ts
 function toHttpBase(serverUrl) {
   const url = new URL(serverUrl);
-  if (url.protocol === "ws:") url.protocol = "http:";
-  else if (url.protocol === "wss:") url.protocol = "https:";
   url.pathname = "/";
   url.search = "";
   return url.toString();
 }
-function toWsUrl(serverUrl) {
-  const url = new URL(BYOK_WS_PATH, toHttpBase(serverUrl));
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  return url.toString();
-}
 function describeEndpoint(transport, url) {
   const parsed = typeof url === "string" ? new URL(url) : url;
   return { transport, host: parsed.host, path: parsed.pathname };
 }
+function formatServerUrl(value) {
+  const url = typeof value === "string" ? new URL(value) : value;
+  return `${url.protocol}//${url.host}${url.pathname}`;
+}
 var InsecureServerUrlError = class extends Error {
   constructor(message) {
     super(message);
@@ -6838,22 +7175,21 @@ function assertServerUrlAllowed(rawUrl, opts = {}) {
   let url;
   try {
     url = new URL(rawUrl);
-  } catch (err) {
-    throw new InsecureServerUrlError(`invalid server URL "${rawUrl}": ${err instanceof Error ? err.message : String(err)}`);
+  } catch {
+    throw new InsecureServerUrlError("invalid server URL");
   }
+  const endpoint = formatServerUrl(url);
   switch (url.protocol) {
     case "https:":
-    case "wss:":
       return;
     case "http:":
-    case "ws:":
       if (opts.dangerouslyAllowInsecureRemote || isLoopbackHostname(url.hostname)) return;
       throw new InsecureServerUrlError(
-        `refusing to connect to "${rawUrl}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use wss:/https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
+        `refusing to connect to "${endpoint}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
       );
     default:
       throw new InsecureServerUrlError(
-        `refusing to connect to "${rawUrl}" \u2014 unsupported scheme "${url.protocol}" (expected http:, https:, ws:, or wss:).`
+        `refusing to connect to "${endpoint}" \u2014 unsupported scheme "${url.protocol}" (expected http: or https:).`
       );
   }
 }
@@ -6865,12 +7201,22 @@ var DeviceRevokedError = class extends Error {
     this.name = "DeviceRevokedError";
   }
 };
+var AuthRequestAbortedError = class extends Error {
+  constructor(reason) {
+    super(reason === "deadline" ? "authentication request exceeded its deadline" : "authentication request was cancelled during shutdown");
+    this.reason = reason;
+    this.name = "AuthRequestAbortedError";
+  }
+  reason;
+};
 var ASSUMED_PAIR_TOKEN_TTL_MS = 45 * 60 * 1e3;
 var RENEW_MARGIN_MS = 60 * 1e3;
+var DEFAULT_AUTH_REQUEST_DEADLINE_MS = 15e3;
 var AuthManager = class {
   constructor(opts) {
     this.opts = opts;
     this.credentials = opts.credentials ?? opts.store.credentials;
+    this.requestDeadlineMs = resolveRequestDeadlineMs(opts.authRequestDeadlineMs);
   }
   opts;
   record;
@@ -6880,7 +7226,10 @@ var AuthManager = class {
   stopped = false;
   pairing = false;
   credentialMutationTail = Promise.resolve();
+  /** The sole cancellation authority for the request currently inside the serialized credential mutation. */
+  activeRequest;
   credentials;
+  requestDeadlineMs;
   get deviceId() {
     return this.record?.deviceId;
   }
@@ -6916,23 +7265,51 @@ var AuthManager = class {
             if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
           }
         }
-        const keyPair = existing ? { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey } : generateDeviceKeyPair();
+        const observedDeviceName = this.opts.deviceName ?? os__default.hostname();
+        const observedMachineId = await this.opts.machineId?.();
+        let keyPair;
+        let pairingDeviceName = observedDeviceName;
+        let pairingMachineId = observedMachineId;
+        if (existing) {
+          keyPair = { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey };
+        } else {
+          const firstAttempt = await this.credentials.readFirstPairingAttempt();
+          if (firstAttempt) {
+            keyPair = {
+              privateKey: importPrivateKeyPem(firstAttempt.devicePrivateKeyPem),
+              publicKeyBase64Url: firstAttempt.devicePublicKey
+            };
+            pairingDeviceName = firstAttempt.deviceName;
+            pairingMachineId = firstAttempt.machineId;
+          } else {
+            keyPair = generateDeviceKeyPair();
+            await this.credentials.saveFirstPairingAttempt({
+              kind: "first-pairing-attempt-v1",
+              deviceName: pairingDeviceName,
+              devicePublicKey: keyPair.publicKeyBase64Url,
+              devicePrivateKeyPem: exportPrivateKeyPem(keyPair.privateKey),
+              ...pairingMachineId === void 0 ? {} : { machineId: pairingMachineId }
+            });
+          }
+        }
         const url = new URL(BYOK_PAIR_PATH, toHttpBase(this.opts.serverUrl));
-        const machineId = await this.opts.machineId?.();
-        const res = await fetch(url, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            pairingCode,
-            deviceName: this.opts.deviceName ?? os__default.hostname(),
-            devicePublicKey: keyPair.publicKeyBase64Url,
-            ...machineId === void 0 ? {} : { machineId }
-          })
+        const body = await this.runRequest(async (signal) => {
+          const res = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              pairingCode,
+              deviceName: pairingDeviceName,
+              devicePublicKey: keyPair.publicKeyBase64Url,
+              ...pairingMachineId === void 0 ? {} : { machineId: pairingMachineId }
+            }),
+            signal
+          });
+          if (!res.ok) {
+            throw new Error(`pairing failed: HTTP ${res.status} ${await safeErrorText(res)}`.trimEnd());
+          }
+          return PairResponseSchema.parse(await res.json());
         });
-        if (!res.ok) {
-          throw new Error(`pairing failed: HTTP ${res.status} ${await safeErrorText(res)}`.trimEnd());
-        }
-        const body = PairResponseSchema.parse(await res.json());
         const metadata = {
           deviceId: body.deviceId,
           tenantId: body.tenantId,
@@ -6971,6 +7348,7 @@ var AuthManager = class {
     this.stopped = true;
     if (this.proactiveTimer) clearTimeout(this.proactiveTimer);
     this.proactiveTimer = void 0;
+    this.activeRequest?.abort();
     await this.credentialMutationTail;
   }
   async renew() {
@@ -6987,29 +7365,35 @@ var AuthManager = class {
     const record = this.record;
     const base = toHttpBase(this.opts.serverUrl);
     const privateKey = importPrivateKeyPem(record.devicePrivateKeyPem);
-    const challengeRes = await fetch(new URL(BYOK_CHALLENGE_PATH, base), {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ deviceId: record.deviceId })
+    const { nonce } = await this.runRequest(async (signal) => {
+      const challengeRes = await fetch(new URL(BYOK_CHALLENGE_PATH, base), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceId: record.deviceId }),
+        signal
+      });
+      if (challengeRes.status === 401) this.markRevoked();
+      if (!challengeRes.ok) {
+        throw new Error(
+          `token renewal (challenge) failed: HTTP ${challengeRes.status} ${await safeErrorText(challengeRes)}`.trimEnd()
+        );
+      }
+      return await challengeRes.json();
     });
-    if (challengeRes.status === 401) this.markRevoked();
-    if (!challengeRes.ok) {
-      throw new Error(
-        `token renewal (challenge) failed: HTTP ${challengeRes.status} ${await safeErrorText(challengeRes)}`.trimEnd()
-      );
-    }
-    const { nonce } = await challengeRes.json();
     const signature = signNonce(privateKey, nonce);
-    const tokenRes = await fetch(new URL(BYOK_TOKEN_PATH, base), {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ deviceId: record.deviceId, nonce, signature })
+    const body = await this.runRequest(async (signal) => {
+      const tokenRes = await fetch(new URL(BYOK_TOKEN_PATH, base), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceId: record.deviceId, nonce, signature }),
+        signal
+      });
+      if (tokenRes.status === 401) this.markRevoked();
+      if (!tokenRes.ok) {
+        throw new Error(`token renewal (token) failed: HTTP ${tokenRes.status} ${await safeErrorText(tokenRes)}`.trimEnd());
+      }
+      return await tokenRes.json();
     });
-    if (tokenRes.status === 401) this.markRevoked();
-    if (!tokenRes.ok) {
-      throw new Error(`token renewal (token) failed: HTTP ${tokenRes.status} ${await safeErrorText(tokenRes)}`.trimEnd());
-    }
-    const body = await tokenRes.json();
     const updated = {
       ...record,
       accessToken: body.accessToken,
@@ -7039,6 +7423,37 @@ var AuthManager = class {
     timer.unref?.();
     this.proactiveTimer = timer;
   }
+  /**
+   * Bounds one complete auth exchange rather than fetch alone. Keeping the
+   * controller active through `json()`/`text()` makes a non-cooperative or
+   * partial response body cancellable by the same authority that owns fetch.
+   */
+  async runRequest(operation) {
+    if (this.stopped) throw new AuthRequestAbortedError("stopped");
+    const controller = new AbortController();
+    this.activeRequest = controller;
+    let deadlineElapsed = false;
+    const deadline = setTimeout(() => {
+      deadlineElapsed = true;
+      controller.abort();
+    }, this.requestDeadlineMs);
+    let rejectOnAbort;
+    const aborted = new Promise((_, reject) => {
+      rejectOnAbort = reject;
+    });
+    const onAbort = () => rejectOnAbort(new AuthRequestAbortedError(deadlineElapsed ? "deadline" : "stopped"));
+    controller.signal.addEventListener("abort", onAbort, { once: true });
+    try {
+      return await Promise.race([operation(controller.signal), aborted]);
+    } catch (error) {
+      if (controller.signal.aborted) throw new AuthRequestAbortedError(deadlineElapsed ? "deadline" : "stopped");
+      throw error;
+    } finally {
+      clearTimeout(deadline);
+      controller.signal.removeEventListener("abort", onAbort);
+      if (this.activeRequest === controller) this.activeRequest = void 0;
+    }
+  }
   async runCredentialMutation(operation) {
     const predecessor = this.credentialMutationTail;
     let release;
@@ -7081,6 +7496,13 @@ function resolvePairExpiry(refreshHint) {
   }
   return new Date(Date.now() + ASSUMED_PAIR_TOKEN_TTL_MS).toISOString();
 }
+function resolveRequestDeadlineMs(value) {
+  const deadline = value ?? DEFAULT_AUTH_REQUEST_DEADLINE_MS;
+  if (!Number.isSafeInteger(deadline) || deadline <= 0) {
+    throw new Error("authRequestDeadlineMs must be a positive safe integer");
+  }
+  return deadline;
+}
 async function safeErrorText(res) {
   try {
     return await res.text();
@@ -7102,37 +7524,48 @@ function withAuth(init, token) {
 }
 
 // src/daemon/blob-client.ts
-async function safeErrorText2(res) {
-  try {
-    return await res.text();
-  } catch {
-    return "";
+var BlobRequestAbortedError = class extends Error {
+  constructor(reason) {
+    super(reason === "deadline" ? "blob request deadline elapsed" : "blob request cancelled");
+    this.reason = reason;
+    this.name = "BlobRequestAbortedError";
   }
-}
+  reason;
+};
 var BlobClient = class {
-  constructor(serverUrl, auth) {
+  constructor(serverUrl, auth, options = {}) {
     this.serverUrl = serverUrl;
     this.auth = auth;
+    this.options = options;
+    const requestDeadlineMs = options.requestDeadlineMs ?? 15e3;
+    if (!Number.isSafeInteger(requestDeadlineMs) || requestDeadlineMs <= 0) {
+      throw new Error("BlobClient requestDeadlineMs must be a positive safe integer");
+    }
+    this.requestDeadlineMs = requestDeadlineMs;
   }
   serverUrl;
   auth;
+  options;
+  requestDeadlineMs;
   /** `blobRef` -> `GET /byok/blobs/:id/url` -> fetch the presigned download URL -> text content. Always resolves fresh rather than trusting any inlined `BlobRef.url`, per docs/protocol.md §7. */
-  async resolveInstruction(blobRef) {
+  async resolveInstruction(blobRef, options = {}) {
     const base = toHttpBase(this.serverUrl);
-    const urlRes = await authedFetch(
-      new URL(byokBlobUrlPath(blobRef.blobId), base),
-      { method: "GET" },
-      this.auth
+    const urlRes = await this.#request(
+      (signal) => authedFetch(new URL(byokBlobUrlPath(blobRef.blobId), base), { method: "GET", signal }, this.auth),
+      options.signal
     );
     if (!urlRes.ok) {
-      throw new Error(`failed to resolve blob download url: HTTP ${urlRes.status} ${await safeErrorText2(urlRes)}`.trimEnd());
+      throw new Error(`failed to resolve blob download url: HTTP ${urlRes.status} ${await this.#safeErrorText(urlRes, options.signal)}`.trimEnd());
+    }
+    const { downloadUrl } = await this.#readJson(urlRes, options.signal);
+    if (typeof downloadUrl !== "string" || downloadUrl.length === 0) {
+      throw new Error("failed to resolve blob download url: response omitted downloadUrl");
     }
-    const { downloadUrl } = await urlRes.json();
-    const contentRes = await fetch(new URL(downloadUrl, base));
+    const contentRes = await this.#request((signal) => fetch(new URL(downloadUrl, base), { signal }), options.signal);
     if (!contentRes.ok) {
       throw new Error(`failed to download blob content: HTTP ${contentRes.status}`);
     }
-    const bytes = new Uint8Array(await contentRes.arrayBuffer());
+    const bytes = await this.#readBody(contentRes, options.signal);
     const observedHash = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
     if (observedHash !== blobRef.contentHash || bytes.length !== blobRef.size) {
       throw new Error(
@@ -7141,63 +7574,71 @@ var BlobClient = class {
     }
     return new TextDecoder().decode(bytes);
   }
-  /** `POST /byok/blobs` (declares size/contentType/contentHash) -> PUT the bytes to the presigned upload URL -> a `BlobRef` for `task.artifact.blobRef`. */
+  /** `POST /byok/blobs` -> PUT the bytes to the presigned URL -> finalize into a `BlobRef`. */
   async uploadArtifact(content, contentType, options = {}) {
     const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
     const contentHash2 = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
     const base = toHttpBase(this.serverUrl);
     const reservationId = options.idempotencyKey ?? `blob_${randomUUID()}`;
-    const createRes = await authedFetch(
-      new URL(BYOK_BLOBS_PATH, base),
-      {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "idempotency-key": reservationId
+    const createRes = await this.#request(
+      (signal) => authedFetch(
+        new URL(BYOK_BLOBS_PATH, base),
+        {
+          method: "POST",
+          headers: { "content-type": "application/json", "idempotency-key": reservationId },
+          body: JSON.stringify({ size: bytes.length, contentType, contentHash: contentHash2 }),
+          signal
         },
-        body: JSON.stringify({ size: bytes.length, contentType, contentHash: contentHash2 })
-      },
-      this.auth
+        this.auth
+      ),
+      options.signal
     );
     if (!createRes.ok) {
-      throw new Error(`failed to create blob: HTTP ${createRes.status} ${await safeErrorText2(createRes)}`.trimEnd());
+      throw new Error(`failed to create blob: HTTP ${createRes.status} ${await this.#safeErrorText(createRes, options.signal)}`.trimEnd());
+    }
+    const { blobId, uploadUrl } = await this.#readJson(createRes, options.signal);
+    if (typeof blobId !== "string" || blobId.length === 0 || typeof uploadUrl !== "string" || uploadUrl.length === 0) {
+      throw new Error("failed to create blob: response omitted blobId or uploadUrl");
     }
-    const { blobId, uploadUrl } = await createRes.json();
     const blobRef = { blobId, contentHash: contentHash2, size: bytes.length, contentType };
-    if (options.idempotencyKey !== void 0 && await this.#hasExactCommittedBlob(base, blobRef)) {
+    if (options.idempotencyKey !== void 0 && await this.#hasExactCommittedBlob(base, blobRef, options.signal)) {
       return blobRef;
     }
-    const putRes = await fetch(new URL(uploadUrl, base), {
-      method: "PUT",
-      headers: { "content-type": contentType },
-      body: bytes
-    });
+    const putRes = await this.#request(
+      (signal) => fetch(new URL(uploadUrl, base), {
+        method: "PUT",
+        headers: { "content-type": contentType },
+        body: bytes,
+        signal
+      }),
+      options.signal
+    );
     if (!putRes.ok) {
       throw new Error(`failed to upload blob content: HTTP ${putRes.status}`);
     }
-    await this.#finalize(base, blobId, reservationId);
+    this.#throwIfAborted(options.signal);
+    await this.#finalize(base, blobId, reservationId, options.signal);
     return blobRef;
   }
-  async #hasExactCommittedBlob(base, blobRef) {
-    const urlRes = await authedFetch(
-      new URL(byokBlobUrlPath(blobRef.blobId), base),
-      { method: "GET" },
-      this.auth
+  async #hasExactCommittedBlob(base, blobRef, signal) {
+    const urlRes = await this.#request(
+      (requestSignal) => authedFetch(new URL(byokBlobUrlPath(blobRef.blobId), base), { method: "GET", signal: requestSignal }, this.auth),
+      signal
     );
     if (urlRes.status === 404) return false;
     if (!urlRes.ok) {
-      throw new Error(`failed to read back idempotent blob: HTTP ${urlRes.status} ${await safeErrorText2(urlRes)}`.trimEnd());
+      throw new Error(`failed to read back idempotent blob: HTTP ${urlRes.status} ${await this.#safeErrorText(urlRes, signal)}`.trimEnd());
     }
-    const { downloadUrl } = await urlRes.json();
+    const { downloadUrl } = await this.#readJson(urlRes, signal);
     if (typeof downloadUrl !== "string" || downloadUrl.length === 0) {
       throw new Error("failed to read back idempotent blob: response omitted downloadUrl");
     }
-    const contentRes = await fetch(new URL(downloadUrl, base));
+    const contentRes = await this.#request((requestSignal) => fetch(new URL(downloadUrl, base), { signal: requestSignal }), signal);
     if (contentRes.status === 404) return false;
     if (!contentRes.ok) {
       throw new Error(`failed to read back idempotent blob content: HTTP ${contentRes.status}`);
     }
-    const bytes = new Uint8Array(await contentRes.arrayBuffer());
+    const bytes = await this.#readBody(contentRes, signal);
     const observedHash = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
     if (observedHash !== blobRef.contentHash || bytes.length !== blobRef.size) {
       throw new Error(
@@ -7206,18 +7647,19 @@ var BlobClient = class {
     }
     return true;
   }
-  async #finalize(base, blobId, reservationId) {
+  async #finalize(base, blobId, reservationId, signal) {
     let lastFailure;
     for (let attempt = 1; attempt <= 2; attempt += 1) {
+      this.#throwIfAborted(signal);
       let response;
       try {
-        response = await authedFetch(
-          new URL(byokBlobFinalizePath(blobId), base),
-          {
-            method: "POST",
-            headers: { "idempotency-key": reservationId }
-          },
-          this.auth
+        response = await this.#request(
+          (requestSignal) => authedFetch(
+            new URL(byokBlobFinalizePath(blobId), base),
+            { method: "POST", headers: { "idempotency-key": reservationId }, signal: requestSignal },
+            this.auth
+          ),
+          signal
         );
       } catch (error) {
         lastFailure = error;
@@ -7227,13 +7669,105 @@ var BlobClient = class {
       if (response.ok) return;
       if (response.status < 500 || attempt === 2) {
         throw new Error(
-          `failed to finalize blob: HTTP ${response.status} ${await safeErrorText2(response)}`.trimEnd()
+          `failed to finalize blob: HTTP ${response.status} ${await this.#safeErrorText(response, signal)}`.trimEnd()
         );
       }
       lastFailure = new Error(`failed to finalize blob: HTTP ${response.status}`);
     }
     throw lastFailure;
   }
+  async #readJson(res, signal) {
+    return JSON.parse(await this.#readText(res, signal));
+  }
+  async #safeErrorText(res, signal) {
+    try {
+      return await this.#readText(res, signal);
+    } catch (error) {
+      if (error instanceof BlobRequestAbortedError) throw error;
+      return "";
+    }
+  }
+  async #readText(res, signal) {
+    return new TextDecoder().decode(await this.#readBody(res, signal));
+  }
+  /**
+   * `Response.arrayBuffer()` only leaves cancellation observable through the
+   * Fetch implementation. Read the body directly so our lifecycle/deadline
+   * authority cancels the actual stream even when a fetch implementation has
+   * already resolved at headers.
+   */
+  async #readBody(res, signal) {
+    return this.#request(async (requestSignal) => {
+      if (res.body === null) return new Uint8Array();
+      const reader = res.body.getReader();
+      const cancelBody = () => {
+        void reader.cancel().catch(() => void 0);
+      };
+      requestSignal.addEventListener("abort", cancelBody, { once: true });
+      try {
+        const chunks = [];
+        let length = 0;
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          chunks.push(value);
+          length += value.byteLength;
+        }
+        const bytes = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+          bytes.set(chunk, offset);
+          offset += chunk.byteLength;
+        }
+        return bytes;
+      } finally {
+        requestSignal.removeEventListener("abort", cancelBody);
+        reader.releaseLock();
+      }
+    }, signal);
+  }
+  #throwIfAborted(signal) {
+    if (this.options.signal?.aborted || signal?.aborted) {
+      throw new BlobRequestAbortedError("cancelled");
+    }
+  }
+  async #request(request, signal) {
+    this.#throwIfAborted(signal);
+    const controller = new AbortController();
+    let abortReason = "cancelled";
+    const abort = (reason) => {
+      if (controller.signal.aborted) return;
+      abortReason = reason;
+      controller.abort();
+    };
+    const inheritedSignals = [this.options.signal, signal].filter((value) => value !== void 0);
+    const abortForCancellation = () => abort("cancelled");
+    for (const inheritedSignal of inheritedSignals) {
+      inheritedSignal.addEventListener("abort", abortForCancellation, { once: true });
+    }
+    const deadline = setTimeout(() => abort("deadline"), this.requestDeadlineMs);
+    deadline.unref?.();
+    let rejectAbort = () => {
+    };
+    const aborted = new Promise((_resolve, reject) => {
+      rejectAbort = reject;
+    });
+    const rejectOnAbort = () => rejectAbort(new BlobRequestAbortedError(abortReason));
+    controller.signal.addEventListener("abort", rejectOnAbort, { once: true });
+    try {
+      return await Promise.race([request(controller.signal), aborted]);
+    } catch (error) {
+      if (error instanceof BlobRequestAbortedError) throw error;
+      if (controller.signal.aborted) throw new BlobRequestAbortedError(abortReason);
+      throw error;
+    } finally {
+      clearTimeout(deadline);
+      controller.signal.removeEventListener("abort", rejectOnAbort);
+      for (const inheritedSignal of inheritedSignals) {
+        inheritedSignal.removeEventListener("abort", abortForCancellation);
+      }
+    }
+  }
 };
 var DEFAULT_TIMEOUT_MS2 = 2e3;
 var DARWIN_UUID_RE = /"IOPlatformUUID"\s*=\s*"([^"]+)"/u;
@@ -7480,6 +8014,7 @@ var AnotherControlServerRunningError = class extends Error {
   }
 };
 var MAX_HALF_OPEN_CONNECTIONS = 8;
+var MAX_OUTBOUND_QUEUE_BYTES = 1024 * 1024;
 function errorMessage4(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -7556,11 +8091,12 @@ async function bindControlEndpoint(server, endpoint) {
 }
 function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshakeSettled) {
   const reader = new NdjsonLineReader();
-  const activeStreams = /* @__PURE__ */ new Map();
+  const activeRequests = /* @__PURE__ */ new Map();
   let phase = "client-hello";
   let serverNonce = "";
   let destroyed = false;
   let handshakeSettled = false;
+  let disposeOutboundWriter;
   function settleHandshake() {
     if (handshakeSettled) return;
     handshakeSettled = true;
@@ -7570,8 +8106,83 @@ function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshak
     if (phase !== "ready") socket.destroy();
   }, handshakeTimeoutMs);
   handshakeTimer.unref?.();
+  function terminateConnection() {
+    if (destroyed) return;
+    destroyed = true;
+    clearTimeout(handshakeTimer);
+    settleHandshake();
+    disposeOutboundWriter?.();
+    const requests = [...activeRequests.values()];
+    activeRequests.clear();
+    for (const request of requests) {
+      if (request.kind === "stream" && !request.controller.signal.aborted) request.controller.abort();
+    }
+    if (!socket.destroyed) socket.destroy();
+  }
+  const queuedFrames = [];
+  let queuedBytes = 0;
+  let blocked = false;
+  let terminal = false;
+  let drainListening = false;
+  function disposeQueuedFrames() {
+    terminal = true;
+    blocked = false;
+    queuedFrames.length = 0;
+    queuedBytes = 0;
+    if (drainListening) {
+      socket.removeListener("drain", onDrain);
+      drainListening = false;
+    }
+  }
+  function waitForDrain() {
+    if (drainListening || terminal) return;
+    drainListening = true;
+    socket.once("drain", onDrain);
+  }
+  function writeEncodedFrame(encoded) {
+    if (terminal) return;
+    if (!socket.writable) {
+      terminateConnection();
+      return;
+    }
+    try {
+      if (!socket.write(encoded)) {
+        blocked = true;
+        waitForDrain();
+      }
+    } catch {
+      terminateConnection();
+    }
+  }
+  function onDrain() {
+    drainListening = false;
+    if (terminal) return;
+    blocked = false;
+    while (!blocked && queuedFrames.length > 0) {
+      const frame = queuedFrames.shift();
+      queuedBytes -= frame.bytes;
+      writeEncodedFrame(frame.encoded);
+    }
+  }
+  disposeOutboundWriter = disposeQueuedFrames;
   function sendFrame(frame) {
-    if (!destroyed && socket.writable) socket.write(encodeFrame(frame));
+    if (destroyed || terminal) return;
+    const encoded = encodeFrame(frame);
+    const bytes = Buffer.byteLength(encoded);
+    if (bytes > MAX_OUTBOUND_QUEUE_BYTES) {
+      terminateConnection();
+      return;
+    }
+    if (blocked) {
+      if (queuedBytes + bytes > MAX_OUTBOUND_QUEUE_BYTES) {
+        terminateConnection();
+        return;
+      }
+      queuedFrames.push({ encoded, bytes });
+      queuedBytes += bytes;
+      return;
+    }
+    writeEncodedFrame(encoded);
   }
   function handleClientHello(parsed) {
     const hello = parseClientHello(parsed);
@@ -7594,21 +8205,51 @@ function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshak
     settleHandshake();
     sendFrame({ v: 1, ready: true });
   }
+  function rejectDuplicateRequest(id) {
+    sendFrame({
+      v: 1,
+      id,
+      ok: false,
+      error: { code: "duplicate_request_id", message: `request id "${id}" is already active` }
+    });
+  }
+  function registerRequest(id, record) {
+    if (activeRequests.has(id)) {
+      rejectDuplicateRequest(id);
+      return false;
+    }
+    activeRequests.set(id, record);
+    return true;
+  }
+  function releaseRequest(id, record) {
+    if (activeRequests.get(id) !== record) return false;
+    activeRequests.delete(id);
+    return true;
+  }
   function dispatch(id, method, params) {
     const unary = methods.unary[method];
     if (unary) {
-      Promise.resolve().then(() => unary(params)).then((result) => sendFrame({ v: 1, id, ok: true, result })).catch((err) => sendFrame({ v: 1, id, ok: false, error: toControlErrorShape(err) }));
+      const record = { kind: "unary" };
+      if (!registerRequest(id, record)) return;
+      Promise.resolve().then(() => unary(params)).then((result) => {
+        if (!releaseRequest(id, record)) return;
+        sendFrame({ v: 1, id, ok: true, result });
+      }).catch((err) => {
+        if (!releaseRequest(id, record)) return;
+        sendFrame({ v: 1, id, ok: false, error: toControlErrorShape(err) });
+      });
       return;
     }
     const stream = methods.stream[method];
     if (stream) {
       const controller = new AbortController();
-      activeStreams.set(id, controller);
-      stream(params, { emit: (event) => sendFrame({ v: 1, id, event }), signal: controller.signal }).then(() => {
-        activeStreams.delete(id);
+      const record = { kind: "stream", controller };
+      if (!registerRequest(id, record)) return;
+      Promise.resolve().then(() => stream(params, { emit: (event) => sendFrame({ v: 1, id, event }), signal: controller.signal })).then(() => {
+        if (!releaseRequest(id, record)) return;
         if (!controller.signal.aborted) sendFrame({ v: 1, id, ok: true, done: true });
       }).catch((err) => {
-        activeStreams.delete(id);
+        if (!releaseRequest(id, record)) return;
         sendFrame({ v: 1, id, ok: false, error: toControlErrorShape(err) });
       });
       return;
@@ -7650,13 +8291,10 @@ function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshak
     for (const line of lines) handleLine(line);
   });
   socket.on("error", () => {
+    terminateConnection();
   });
   socket.on("close", () => {
-    destroyed = true;
-    clearTimeout(handshakeTimer);
-    settleHandshake();
-    for (const controller of activeStreams.values()) controller.abort();
-    activeStreams.clear();
+    terminateConnection();
   });
 }
 async function startControlServer(opts) {
@@ -8574,6 +9212,20 @@ function createFleetJitter(productId, deviceId) {
     delay: (domain, sequence, baseMs) => deterministicJitterMs({ seed, domain, sequence, baseMs })
   };
 }
+
+// src/daemon/replay-cursor.ts
+var ReplayCursorTooOldError = class extends Error {
+  constructor(recoverableFrom) {
+    super(
+      recoverableFrom === void 0 ? "server cannot replay the acknowledged cursor; re-pair or operator recovery is required" : `server cannot replay the acknowledged cursor; retained history starts at ${recoverableFrom}`
+    );
+    this.recoverableFrom = recoverableFrom;
+    this.name = "ReplayCursorTooOldError";
+  }
+  recoverableFrom;
+};
+
+// src/daemon/long-poll-transport.ts
 var LongPollRouteError = class extends Error {
   constructor(endpoint, status, cause) {
     super(
@@ -8589,7 +9241,7 @@ var LongPollRouteError = class extends Error {
 };
 var MAX_TRACKED_VALIDATION_FAILURE_WARNINGS = 1e3;
 var MAX_TRACKED_ROUTE_FAILURE_WARNINGS = 1e3;
-function parseLooseEventsPollResponse(raw) {
+function parseLooseEventsPollResponse(raw, requestedCursor) {
   if (typeof raw !== "object" || raw === null) {
     throw new Error("events poll response is not an object");
   }
@@ -8597,19 +9249,48 @@ function parseLooseEventsPollResponse(raw) {
   if (!Array.isArray(events)) {
     throw new Error("events poll response.events is not an array");
   }
-  if (typeof cursor !== "number" || !Number.isInteger(cursor)) {
-    throw new Error("events poll response.cursor is not an integer");
+  if (!isSafeNonnegativeInteger(cursor)) {
+    throw new Error("events poll response.cursor is not a safe nonnegative integer");
+  }
+  if (cursor < requestedCursor) {
+    throw new Error("events poll response.cursor regressed below the requested cursor");
   }
   if (capabilities !== void 0 && (!Array.isArray(capabilities) || capabilities.some((flag) => typeof flag !== "string"))) {
     throw new Error("events poll response.capabilities is not an array of strings");
   }
   return { events, cursor, capabilities: capabilities ?? [] };
 }
+function isSafeNonnegativeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function validateTrustedEventsPage(events, requestedCursor, pageCursor) {
+  let previousTaskSeq;
+  for (const raw of events) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const { type, seq } = raw;
+    if (typeof type !== "string" || !type.startsWith("task.")) continue;
+    if (!isSafeNonnegativeInteger(seq)) {
+      throw new Error("events poll task seq is not a safe nonnegative integer");
+    }
+    if (seq <= requestedCursor || seq > pageCursor) {
+      throw new Error("events poll task seq lies outside the trusted page cursor range");
+    }
+    if (previousTaskSeq !== void 0 && seq <= previousTaskSeq) {
+      throw new Error("events poll task seq is not strictly page ordered");
+    }
+    const knownTaskType = MESSAGE_TYPES.includes(type);
+    const predecessor = previousTaskSeq ?? requestedCursor;
+    if (!knownTaskType && seq !== predecessor + 1) {
+      throw new Error("events poll unknown task seq would cross an untrusted gap");
+    }
+    previousTaskSeq = seq;
+  }
+}
 function extractSkippableSeq(raw) {
   if (typeof raw !== "object" || raw === null) return void 0;
   const { type, seq } = raw;
   if (typeof type !== "string" || !type.startsWith("task.")) return void 0;
-  return typeof seq === "number" && Number.isInteger(seq) ? seq : void 0;
+  return isSafeNonnegativeInteger(seq) ? seq : void 0;
 }
 var LongPollClient = class {
   constructor(opts) {
@@ -8620,6 +9301,8 @@ var LongPollClient = class {
   }
   opts;
   running = false;
+  /** Owns exactly one active loop generation, including its held GET and retry delays. */
+  loopAbortController;
   /**
    * Finding R1: seqs this loop has already `console.warn`'d about for a
    * validation-failed (recognized-type, invalid-payload) entry — a poison
@@ -8679,16 +9362,22 @@ var LongPollClient = class {
   noteRevoked(err) {
     if (!(err instanceof DeviceRevokedError)) return false;
     this.running = false;
+    this.loopAbortController?.abort();
     this.opts.onRevoked?.();
     return true;
   }
   start() {
     if (this.running) return;
     this.running = true;
-    void this.loop();
+    const controller = new AbortController();
+    this.loopAbortController = controller;
+    void this.loop(controller.signal).finally(() => {
+      if (this.loopAbortController === controller) this.loopAbortController = void 0;
+    });
   }
   stop() {
     this.running = false;
+    this.loopAbortController?.abort();
   }
   /**
    * POST one batch of envelopes to `/byok/messages` (finding F6/protocol
@@ -8697,14 +9386,14 @@ var LongPollClient = class {
    * (`ConnectionHub.handleInbound`), so a resend of the SAME batch (same
    * envelope `id`s — the caller must never rebuild them) is deduped
    * server-side into a safe no-op rather than reprocessed (§9). Returns
-   * `true` once the server has accepted the batch.
+   * validated frozen-v1 counts only after a readable response body.
    */
   async postBatch(envelopes) {
     try {
       await this.opts.auth.getValidAccessToken();
     } catch (err) {
       this.noteRevoked(err);
-      return false;
+      return void 0;
     }
     let res;
     try {
@@ -8720,23 +9409,26 @@ var LongPollClient = class {
       );
     } catch (err) {
       if (!this.noteRevoked(err)) this.warnRouteFailure(this.messagesEndpoint, void 0, err);
-      return false;
+      return void 0;
     }
     if (!res.ok) {
       this.warnRouteFailure(this.messagesEndpoint, res.status, void 0);
-      return false;
+      return void 0;
     }
     try {
-      MessagesSendResponseSchema.parse(await res.json());
+      const response = MessagesSendResponseSchema.parse(await res.json());
+      if (response.accepted + (response.rejected ?? 0) !== envelopes.length) {
+        throw new Error("messages response counts do not match the posted batch length");
+      }
+      return response;
     } catch (err) {
       this.warnRouteFailure(this.messagesEndpoint, res.status, err);
-      return false;
+      return void 0;
     }
-    return true;
   }
-  async loop() {
+  async loop(signal) {
     let retryAttempt = 0;
-    while (this.running) {
+    while (this.running && !signal.aborted) {
       try {
         await this.opts.auth.getValidAccessToken();
         const base = toHttpBase(this.opts.serverUrl);
@@ -8745,30 +9437,40 @@ var LongPollClient = class {
         if (cursor !== void 0) url.searchParams.set("cursor", String(cursor));
         let res;
         try {
-          res = await authedFetch(url, { method: "GET" }, this.opts.auth);
+          res = await authedFetch(url, { method: "GET", signal }, this.opts.auth);
         } catch (err) {
+          if (signal.aborted) return;
           if (!(err instanceof DeviceRevokedError)) {
             this.warnRouteFailure(this.eventsEndpoint, void 0, err);
           }
           throw err;
         }
         if (!res.ok) {
+          const replayCursorTooOld = await parseReplayCursorTooOld(res);
+          if (replayCursorTooOld) {
+            this.running = false;
+            this.opts.onReplayCursorTooOld?.(replayCursorTooOld);
+            return;
+          }
           this.warnRouteFailure(this.eventsEndpoint, res.status, void 0);
-          this.opts.onServerCapabilities?.([]);
+          this.opts.onServerCapabilitiesInvalidated?.();
+          this.opts.onPollFailure?.();
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
-          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
           continue;
         }
         let parsed;
         try {
-          parsed = parseLooseEventsPollResponse(await res.json());
+          parsed = parseLooseEventsPollResponse(await res.json(), cursor ?? 0);
+          validateTrustedEventsPage(parsed.events, cursor ?? 0, parsed.cursor);
         } catch (err) {
           this.warnRouteFailure(this.eventsEndpoint, res.status, err);
           throw err;
         }
         this.opts.onServerCapabilities?.(parsed.capabilities);
         let hadValidationFailureThisBatch = false;
+        let acceptedAnyEntry = false;
         for (const raw of parsed.events) {
           let envelope;
           try {
@@ -8776,7 +9478,10 @@ var LongPollClient = class {
           } catch (err) {
             if (err instanceof UnknownMessageTypeError) {
               const skippableSeq = extractSkippableSeq(raw);
-              if (skippableSeq !== void 0) this.opts.onSkippedSeq?.(skippableSeq);
+              if (skippableSeq !== void 0) {
+                this.opts.onSkippedSeq?.(skippableSeq);
+                acceptedAnyEntry = true;
+              }
             } else {
               const failedSeq = extractSkippableSeq(raw);
               if (failedSeq !== void 0) {
@@ -8796,45 +9501,65 @@ var LongPollClient = class {
             }
             continue;
           }
-          this.opts.onEnvelope(envelope);
+          if (this.opts.onEnvelope(envelope) !== false) acceptedAnyEntry = true;
         }
         if (parsed.events.length === 0) {
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
-          await sleep(this.opts.idleDelayMs ?? 250);
-        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch) {
+          await sleep(this.opts.idleDelayMs ?? 250, signal);
+        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch || !acceptedAnyEntry && this.opts.getCursor() === cursor) {
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
-          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
         } else {
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
         }
       } catch (err) {
-        this.opts.onServerCapabilities?.([]);
+        this.opts.onServerCapabilitiesInvalidated?.();
         if (this.noteRevoked(err)) return;
-        if (!this.running) return;
+        if (!this.running || signal.aborted) return;
+        this.opts.onPollFailure?.();
         this.opts.onOperationalOutcome?.("failure");
         const baseMs = this.opts.retryDelayMs ?? 2e3;
-        await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+        await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
       }
     }
   }
 };
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-var WsUnexpectedStatusError = class extends Error {
-  constructor(status, endpoint) {
-    super(`WS upgrade rejected with HTTP ${status} (ws ${endpoint.host}${endpoint.path})`);
-    this.status = status;
-    this.endpoint = endpoint;
-    this.name = "WsUnexpectedStatusError";
+async function parseReplayCursorTooOld(res) {
+  if (res.status !== 409) return void 0;
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return void 0;
   }
-  status;
-  endpoint;
-};
-function createConnectionHelloEnvelope(opts) {
+  if (typeof body !== "object" || body === null) return void 0;
+  const { error, recoverableFrom } = body;
+  if (error !== "cursor_too_old" || typeof recoverableFrom !== "number" || !Number.isSafeInteger(recoverableFrom) || recoverableFrom < 0) {
+    return void 0;
+  }
+  return new ReplayCursorTooOldError(recoverableFrom);
+}
+function sleep(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const finish = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolve();
+    };
+    const timer = setTimeout(finish, ms);
+    signal.addEventListener("abort", finish, { once: true });
+  });
+}
+
+// src/daemon/connection-manager.ts
+function isCursorEnvelopeType(type) {
+  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
+}
+function createConnectionHelloEnvelope(opts, getCursor) {
   const configuredToolsets = opts.getConfiguredToolsets?.();
   return createEnvelope("conn.hello", {
     protocolVersions: [PROTOCOL_VERSION],
@@ -8844,222 +9569,34 @@ function createConnectionHelloEnvelope(opts) {
     clientVersion: opts.clientVersion,
     runtimes: opts.runtimes,
     configuredToolsets: configuredToolsets === void 0 ? void 0 : [...configuredToolsets],
-    cursor: opts.getCursor?.()
+    cursor: getCursor()
   });
 }
-var WsTransport = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  socket;
-  closedByUser = false;
-  autoReconnect = true;
-  acked = false;
-  everAckedThisAttempt = false;
-  reconnectAttempt = 0;
-  reconnectTimer;
-  livenessTimer;
-  lastActivity = 0;
-  lastUnexpectedStatus;
-  ackWaiters = [];
-  connect(opts = {}) {
-    this.autoReconnect = opts.auto ?? true;
-    this.closedByUser = false;
-    void this.openSocket();
-  }
-  /** Stop scheduling further reconnect attempts (any pending one is cancelled too); the current socket, if any, is left alone. Used when handing retry ownership to a slower external cadence (e.g. the long-poll fallback's periodic WS probe). */
-  stopAutoReconnect() {
-    this.autoReconnect = false;
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = void 0;
-    }
-  }
-  /** Resume normal auto-reconnect-on-close behavior (does not itself trigger a connect — only affects future closes). */
-  resumeAutoReconnect() {
-    this.autoReconnect = true;
-  }
-  get isOpen() {
-    return this.acked;
-  }
-  /**
-   * Attempt to send ONE envelope right now; returns whether it actually went
-   * out. `false` means the socket isn't currently open+acked — the caller
-   * (`ConnectionManager.drainOutbox`, Design B/finding N4) owns re-queueing
-   * and retrying later (e.g. on the next `onAcked`), since this transport no
-   * longer buffers anything itself.
-   */
-  sendNow(envelope) {
-    if (this.socket && this.socket.readyState === WebSocket.OPEN && this.acked) {
-      this.socket.send(encodeEnvelope(envelope));
-      return true;
-    }
-    return false;
-  }
-  waitForAck(timeoutMs = 1e4) {
-    if (this.acked) return Promise.resolve();
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error("Timed out waiting for conn.ack")), timeoutMs);
-      this.ackWaiters.push({
-        resolve: () => {
-          clearTimeout(timer);
-          resolve();
-        },
-        reject: (err) => {
-          clearTimeout(timer);
-          reject(err);
-        }
-      });
-    });
-  }
-  close() {
-    this.closedByUser = true;
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.socket?.close();
-  }
-  async openSocket() {
-    const url = toWsUrl(this.opts.serverUrl);
-    const endpoint = describeEndpoint("ws", url);
-    this.acked = false;
-    this.everAckedThisAttempt = false;
-    this.opts.onStateChange?.("connecting");
-    let token;
-    try {
-      token = await this.opts.getToken();
-    } catch (err) {
-      this.opts.onStateChange?.("closed");
-      this.opts.onConnectOutcome?.(false, err, endpoint);
-      if (!this.closedByUser && this.autoReconnect) this.scheduleReconnect();
-      return;
-    }
-    const socket = new WebSocket(url, {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    this.socket = socket;
-    this.lastActivity = Date.now();
-    this.startLivenessCheck(socket);
-    socket.on("open", () => {
-      const hello = createConnectionHelloEnvelope(this.opts);
-      socket.send(encodeEnvelope(hello));
-    });
-    socket.on("ping", () => {
-      this.lastActivity = Date.now();
-    });
-    socket.on("message", (data, isBinary) => {
-      this.lastActivity = Date.now();
-      const bytes = toBytes(data);
-      let envelope;
-      try {
-        envelope = decodeEnvelope(bytes);
-      } catch {
-        return;
-      }
-      if (envelope.type === "conn.ack") {
-        this.reconnectAttempt = 0;
-        this.acked = true;
-        this.everAckedThisAttempt = true;
-        this.opts.onStateChange?.("open");
-        for (const waiter of this.ackWaiters.splice(0)) waiter.resolve();
-        this.opts.onAcked?.(envelope.payload.capabilities);
-      }
-      this.opts.onEnvelope(envelope);
-    });
-    socket.on("close", () => {
-      this.socket = void 0;
-      this.stopLivenessCheck();
-      this.opts.onStateChange?.("closed");
-      const acked = this.everAckedThisAttempt;
-      const status = this.lastUnexpectedStatus;
-      this.lastUnexpectedStatus = void 0;
-      this.opts.onConnectOutcome?.(
-        acked,
-        status !== void 0 ? new WsUnexpectedStatusError(status, endpoint) : void 0,
-        endpoint
-      );
-      if (!this.closedByUser && this.autoReconnect) this.scheduleReconnect();
-    });
-    socket.on("error", () => {
-    });
-    socket.on("unexpected-response", (_req, res) => {
-      this.lastUnexpectedStatus = res.statusCode;
-      res.resume();
-      socket.terminate();
-    });
-  }
-  scheduleReconnect() {
-    const { baseMs = 1e3, maxMs = 3e4, factor = 2 } = this.opts.backoff ?? {};
-    const delay5 = Math.min(maxMs, baseMs * factor ** this.reconnectAttempt);
-    const jitter = this.opts.reconnectDelayMs?.(this.reconnectAttempt, delay5) ?? delay5;
-    this.reconnectAttempt += 1;
-    this.reconnectTimer = setTimeout(() => void this.openSocket(), jitter);
-  }
-  startLivenessCheck(socket) {
-    const { timeoutMs = 75e3, checkIntervalMs = Math.max(1e3, Math.floor(timeoutMs / 3)) } = this.opts.liveness ?? {};
-    this.livenessTimer = setInterval(() => {
-      if (Date.now() - this.lastActivity > timeoutMs) {
-        socket.terminate();
-      }
-    }, checkIntervalMs);
-    this.livenessTimer.unref?.();
-  }
-  stopLivenessCheck() {
-    if (this.livenessTimer) {
-      clearInterval(this.livenessTimer);
-      this.livenessTimer = void 0;
-    }
-  }
-};
-function toBytes(data, _isBinary) {
-  if (Buffer.isBuffer(data)) return data;
-  if (Array.isArray(data)) return Buffer.concat(data);
-  if (data instanceof ArrayBuffer) return new Uint8Array(data);
-  return Buffer.from(String(data), "utf8");
-}
-
-// src/daemon/connection-manager.ts
-function isCursorEnvelopeType(type) {
-  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
-}
+var MAX_REJECTED_OUTBOX_ENTRIES = 1e3;
 var ConnectionManager = class {
   constructor(opts) {
     this.opts = opts;
     this.fleetJitter = opts.fleetJitter ?? createFleetJitter(opts.productId, opts.deviceId);
-    this.ws = new WsTransport({
-      serverUrl: opts.serverUrl,
-      getToken: () => opts.auth.getValidAccessToken(),
-      deviceId: opts.deviceId,
-      productId: opts.productId,
-      capabilities: opts.capabilities,
-      clientVersion: opts.clientVersion,
-      runtimes: opts.runtimes,
-      getConfiguredToolsets: opts.getConfiguredToolsets,
-      getCursor: () => this.cursor,
-      onEnvelope: (envelope) => this.deliver(envelope),
-      onStateChange: (state) => {
-        if (!this.stopped && !this.revoked) this.opts.onStateChange?.(state);
-      },
-      onAcked: (capabilities) => this.onAcked(capabilities),
-      onConnectOutcome: (acked, err) => this.onWsOutcome(acked, err),
-      backoff: opts.backoff,
-      liveness: opts.liveness,
-      reconnectDelayMs: (attempt, baseMs) => this.fleetJitter.delay("reconnect", attempt, baseMs)
-    });
     this.longPoll = new LongPollClient({
       serverUrl: opts.serverUrl,
       auth: opts.auth,
-      // Design A: the query cursor for the NEXT `GET /byok/events` is the
-      // same watermark `deliver()` dedupes against (see `dedupWatermark`) —
-      // normally the eager `deliveredSeq` (so an in-flight envelope isn't
-      // re-pulled), but the durable `cursor` while `stalledAtSeq` is set, so
-      // the failed envelope (and everything after it) IS re-pulled and
-      // re-attempted.
-      getCursor: () => this.dedupWatermark(),
+      // The long-poll query cursor is also the kernel's irreversible ack.
+      // Only report the successfully processed cursor here. `deliveredSeq`
+      // remains a local dedup watermark; using it on the wire would ack an
+      // in-flight envelope before its handler settles and make a later
+      // failure impossible to redeliver.
+      getCursor: () => this.cursor,
       onEnvelope: (envelope) => this.deliver(envelope),
       onServerCapabilities: (capabilities) => {
-        if (this.mode === "long-poll") this.serverCapabilities = capabilities;
+        this.serverCapabilities = capabilities;
+        this.noteConnected();
       },
+      onServerCapabilitiesInvalidated: () => {
+        this.serverCapabilities = [];
+      },
+      onPollFailure: () => this.noteDisconnected(),
       onRevoked: () => this.enterRevoked(),
+      onReplayCursorTooOld: (error) => this.enterReplayCursorTooOld(error),
       // M4 Phase 4 (version-negotiation drill fix): a batch entry
       // LongPollClient couldn't parse into a known Envelope at all (an
       // unrecognized message type) still needs its cursor/watermark
@@ -9085,13 +9622,10 @@ var ConnectionManager = class {
   }
   opts;
   fleetJitter;
-  ws;
   longPoll;
-  mode = "ws";
-  consecutiveFailures = 0;
-  wsRetryTimer;
-  wsProbeSequence = 0;
   uploadRetryAttempt = 0;
+  started = false;
+  connected = false;
   cursor;
   /**
    * Finding F3 (at-most-once redelivery): the lowest `task.*` envelope `seq`
@@ -9113,10 +9647,9 @@ var ConnectionManager = class {
    * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
    * advances eagerly, the instant a `task.*` envelope is admitted past
    * dedup (see `deliver`/`noteDelivered`), independent of whether its
-   * handler has even started, let alone succeeded. It exists so a
-   * long-poll re-query (`LongPollClient`'s `getCursor`) doesn't re-pull an
-   * envelope that's already been delivered once and is still in flight —
-   * `handleOffer` is NOT idempotent and must never be re-pulled while a
+   * handler has even started, let alone succeeded. It exists so a repeated
+   * read at the durable cursor does not re-dispatch an envelope already in
+   * flight — `handleOffer` must not start a second adapter session while a
    * first attempt is still running. On WS this same field is written the
    * same way, but since a live WS connection only ever pushes a given `seq`
    * once, it never has an observable effect there beyond mirroring
@@ -9127,18 +9660,18 @@ var ConnectionManager = class {
   /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
   processingChain = Promise.resolve();
   /**
-   * Design B (finding N4): the ONE outbound queue both transports drain
-   * from — holds `Envelope` OBJECTS, never re-encoded/rebuilt strings, so a
+   * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
+   * never re-encoded/rebuilt strings, so a
    * resend after a failed send attempt is byte-identical to the original
    * (same `id`), which is what lets the server's per-(deviceId,id) dedup
    * (Wave 1) recognize it as a safe no-op retry rather than a second
-   * application (protocol §9). A transport switch (long-poll <-> WS) never
-   * touches this queue — see `drainOutbox` — so nothing queued while one
-   * transport was active is ever stranded when the other takes over.
+   * application (protocol §9).
    */
   outbox = [];
+  /** Terminally rejected outbound envelopes, retained as a bounded observable quarantine. */
+  rejectedOutboundEnvelopes = [];
   /**
-   * Finding F5(b): how many envelopes `drainOutbox`'s long-poll branch has
+   * Finding F5(b): how many envelopes `drainOutbox` has
    * currently spliced OUT of `this.outbox` for an in-flight (not yet
    * confirmed delivered) `postBatch` call — 0 the rest of the time. See
    * `outboxLength`'s own doc comment for why this needs to be tracked
@@ -9148,6 +9681,7 @@ var ConnectionManager = class {
   draining = false;
   stopped = false;
   revoked = false;
+  terminalError;
   settledWaiters = [];
   pendingCursorSave = Promise.resolve();
   /**
@@ -9190,38 +9724,22 @@ var ConnectionManager = class {
    */
   cancelPendingDrainRetry;
   /**
-   * The capabilities the CURRENT transport's server advertised — untyped
-   * `string[]` for forward compatibility. WS populates it from `conn.ack`;
-   * long-poll populates it from each successful events response. Empty until
-   * the active transport supplies an advertisement.
-   *
-   * Finding R2 (cross-model re-review — was P1): strictly PER-CONNECTION,
-   * not per-daemon-lifetime. Cleared to `[]` the instant the acked WS
-   * connection ends for ANY reason — an ordinary disconnect (`onWsOutcome`'s
-   * `acked` branch), `stop()`, or a transport switch to long-poll
-   * (`enterLongPoll`) — and only repopulated by a fresh advertisement from
-   * the transport that is still current.
-   * The previous version of this doc comment claimed long-poll mode simply
-   * "stays at whatever the last real WS `conn.ack` said" — that was the bug:
-   * a daemon that once learned e.g. `approval_resolved` from an earlier WS
-   * session kept believing it applied to whatever it's connected to NOW,
-   * even after a disconnect/degrade where nothing has actually confirmed
-   * that's still true (a reconnect could land on a DIFFERENT server behind a
-   * load balancer). Concretely, `TaskRunner.sendApprovalResolved` gates
-   * `task.approval_resolved` on this list — sending it to a server that
-   * doesn't actually understand it over the long-poll path would get a
-   * batch-level 400 from `MessagesSendRequestSchema` (protocol §8.2), which
-   * `drainOutbox`'s retry-the-same-batch-forever loop then head-of-line
-   * blocks EVERY envelope queued behind it on, permanently. Clearing this
-   * eagerly means that gate reliably fails closed (falls back to the
-   * pre-existing implicit-resume inference, unconditionally — see
-   * `sendApprovalResolved`'s own doc comment) the moment the connection that
-   * advertised the capability is no longer the one actually in use.
+   * The capabilities the current server response advertised — untyped
+   * `string[]` for forward compatibility. An advertisement is scoped to the
+   * current long-poll response stream and is cleared after an HTTP failure,
+   * terminal shutdown, or revocation. This keeps capability-gated outbound
+   * messages fail-closed until the current server has explicitly advertised
+   * support.
    */
   serverCapabilities = [];
   async start() {
+    if (this.terminalError) throw this.terminalError;
     this.cursor = await this.opts.cursorStore.load(this.opts.serverUrl, this.opts.deviceId);
-    this.ws.connect({ auto: true });
+    this.started = true;
+    this.opts.onStateChange?.("connecting");
+    this.longPoll.start();
+    this.outbox.unshift(createConnectionHelloEnvelope(this.opts, () => this.cursor));
+    void this.drainOutbox();
   }
   /**
    * Design B (finding N4): push onto the single shared outbox and try to
@@ -9232,17 +9750,13 @@ var ConnectionManager = class {
     this.outbox.push(envelope);
     void this.drainOutbox();
   }
+  /** Publish a fresh local configuration snapshot while this daemon is running. */
+  refreshHello() {
+    if (!this.started || this.stopped || this.revoked || this.terminalError) return;
+    this.send(createConnectionHelloEnvelope(this.opts, () => this.cursor));
+  }
   /**
-   * Design B (finding N4): drain the shared outbox through whichever
-   * transport is currently active, re-checking `this.mode` fresh on every
-   * iteration so a transport switch mid-drain is picked up immediately
-   * rather than fighting a stale decision made before the switch.
-   *
-   * WS: a synchronous, one-at-a-time `sendNow` per envelope while open+
-   * acked; stops (without dropping anything — the remainder stays queued)
-   * the moment it isn't, and is re-invoked once `onAcked` fires.
-   *
-   * Long-poll: POSTs the outbox in chunks of at most
+   * POSTs the outbox through long-poll in chunks of at most
    * `MAX_MESSAGES_PER_BATCH` (finding P1) — the server hard-caps a single
    * `/byok/messages` batch there (`MessagesSendRequestSchema`, protocol
    * §8.2) and 400s the WHOLE request if it's exceeded, which — before this
@@ -9254,43 +9768,48 @@ var ConnectionManager = class {
    * failure that SAME chunk is unshifted back (order-preserving, same
    * Envelope objects/ids — never rebuilt, so a retry is exactly the resend
    * Wave 1's server-side dedup expects) and retried after a short backoff,
-   * re-reading `this.mode` each time so a WS recovery that happens
-   * mid-retry is honored on the very next loop iteration instead of only
-   * after this attempt's backoff chain gives up.
-   *
    * Re-entrancy is guarded by `draining`: a call arriving while a drain is
    * already in progress just returns — the in-progress loop's own
-   * `while (this.outbox.length > 0)` check will pick up anything newly
-   * pushed (or left over after a mode switch) on its very next iteration.
+   * `while (this.outbox.length > 0)` check picks up anything newly pushed.
    */
   async drainOutbox() {
-    if (this.draining) return;
+    if (!this.started || this.draining) return;
     this.draining = true;
+    const isolateRejectedBatch = async (batch) => {
+      const pending = [[...batch]];
+      while (pending.length > 0) {
+        if (this.stopped || this.revoked) return pending.flat();
+        const segment = pending.shift();
+        const result = await this.longPoll.postBatch(segment);
+        if (result === void 0) return [...segment, ...pending.flat()];
+        if ((result.rejected ?? 0) === 0) continue;
+        if (segment.length === 1) {
+          this.quarantineRejectedOutbound(segment[0], "inbound_rejected");
+          continue;
+        }
+        const midpoint = Math.floor(segment.length / 2);
+        pending.unshift(segment.slice(0, midpoint), segment.slice(midpoint));
+      }
+      return void 0;
+    };
     try {
       while (this.outbox.length > 0) {
         if (this.stopped || this.revoked) return;
-        if (this.mode === "ws") {
-          if (!this.ws.isOpen) return;
-          const envelope = this.outbox[0];
-          if (!this.ws.sendNow(envelope)) return;
-          this.outbox.shift();
-          continue;
-        }
         const batch = this.outbox.splice(0, MAX_MESSAGES_PER_BATCH);
         this.inFlightBatchSize = batch.length;
-        let ok;
+        let retrySegments;
         try {
-          ok = await this.longPoll.postBatch(batch);
+          retrySegments = await isolateRejectedBatch(batch);
         } finally {
           this.inFlightBatchSize = 0;
         }
-        if (ok) {
+        if (retrySegments === void 0) {
           this.uploadRetryAttempt = 0;
           this.opts.onOperationalOutcome?.("success", "upload");
           continue;
         }
         this.opts.onOperationalOutcome?.("failure", "upload");
-        this.outbox.unshift(...batch);
+        this.outbox.unshift(...retrySegments);
         if (this.stopped || this.revoked) return;
         const baseMs = this.opts.longPollRetryDelayMs ?? 2e3;
         await this.drainRetryDelay(this.fleetJitter.delay("upload", this.uploadRetryAttempt++, baseMs));
@@ -9306,8 +9825,7 @@ var ConnectionManager = class {
    * in-flight wait immediately instead of leaving `drainOutbox` parked here
    * for up to the rest of the delay before it next checks `this.revoked` —
    * and (b) unref'd, so the timer never keeps the Node process alive by
-   * itself while nothing else (a live long-poll GET, an open WS connection)
-   * legitimately is.
+   * itself while nothing else (such as the live long-poll GET) legitimately is.
    */
   drainRetryDelay(ms) {
     return new Promise((resolve) => {
@@ -9323,45 +9841,41 @@ var ConnectionManager = class {
       };
     });
   }
-  isTransportDegraded() {
-    return this.mode === "long-poll";
-  }
   /**
-   * The capabilities the CURRENT transport's server advertised: from
-   * `conn.ack` on WS, or the latest successful `GET /byok/events` response
-   * on long-poll. Empty before either transport has supplied its current
-   * advertisement, and cleared across disconnect/switch boundaries.
+   * The capabilities the latest successful `GET /byok/events` response
+   * advertised. Empty before a successful response and after a failed one.
    */
   getServerCapabilities() {
     return this.serverCapabilities;
   }
+  getTerminalError() {
+    return this.terminalError;
+  }
   isConnected() {
-    return this.mode === "ws" && this.ws.isOpen;
+    return this.connected;
   }
   isRevoked() {
     return this.revoked;
   }
   /**
-   * Resolves once the connection has settled — either a working, acked WS
-   * connection, or the long-poll fallback taking over (protocol §8). This
-   * lets `daemon.start()` return promptly even when WS is unavailable from
-   * the very first attempt, rather than hanging until a WS `conn.ack` that
-   * may never come.
+   * Resolves after the first successful long-poll response establishes the
+   * authenticated connection.
    *
    * Rejects with {@link DeviceRevokedError} — instead of hanging until
    * `timeoutMs` — if the device turns out to be revoked while settling (or
    * already was): a cold `daemon.start()` against an already-revoked device
    * must fail fast, not surface a generic timeout (protocol §6.3).
    */
-  waitForAck(timeoutMs = 1e4) {
-    if (this.ws.isOpen || this.mode === "long-poll") return Promise.resolve();
+  waitForConnection(timeoutMs = 1e4) {
+    if (this.connected) return Promise.resolve();
+    if (this.terminalError) return Promise.reject(this.terminalError);
     if (this.revoked) return Promise.reject(new DeviceRevokedError());
     return new Promise((resolve, reject) => {
       let settle = () => {
       };
       const timer = setTimeout(() => {
         this.settledWaiters = this.settledWaiters.filter((w) => w !== settle);
-        reject(new Error("Timed out waiting for the connection to settle (WS ack or long-poll fallback)"));
+        reject(new Error("Timed out waiting for the long-poll connection to settle"));
       }, timeoutMs);
       settle = (err) => {
         clearTimeout(timer);
@@ -9372,7 +9886,7 @@ var ConnectionManager = class {
     });
   }
   /**
-   * Stops both transports and waits for every in-flight envelope handler
+   * Stops the long-poll transport and waits for every in-flight envelope handler
    * (the F3 FIFO chain) and the most recent cursor write to actually land on
    * disk — otherwise a `stop()` racing a just-processed envelope's
    * persistence could lose that cursor advance, or leave a handler running
@@ -9381,14 +9895,14 @@ var ConnectionManager = class {
    * Finding F5(b) (cross-model adversarial review): `drainTimeoutMs`, when
    * passed, bounds how long this waits for the shared outbox (`this.outbox`
    * — Design B) to actually finish draining BEFORE flipping `this.stopped`
-   * and closing the transports. Before this fix, `stop()` set `stopped`
+   * and stopping the transport. Before this fix, `stop()` set `stopped`
    * synchronously and never waited for `drainOutbox` at all: an envelope
    * `send()` had just pushed moments earlier (e.g. `TaskRunner.shutdownTask`'s
    * own `task.fail`, sent right before `create-daemon.ts`'s
    * `performControlShutdown` calls this) could still be sitting UNSENT in
    * `this.outbox` — mid long-poll retry backoff, or simply not yet picked up
    * by the fire-and-forget `drainOutbox()` `send()` kicked off — and this
-   * method would happily proceed to `stopped = true` / `ws.close()` regardless,
+   * method would happily proceed to `stopped = true` regardless,
    * after which NOTHING ever drains it again: silently lost, even though
    * `TaskRunner` believed it had been sent. `drainTimeoutMs` omitted (the
    * default) preserves the EXACT prior behavior for every other existing
@@ -9405,9 +9919,9 @@ var ConnectionManager = class {
     }
     this.stopped = true;
     this.serverCapabilities = [];
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
     this.longPoll.stop();
-    this.ws.close();
+    this.connected = false;
+    this.opts.onStateChange?.("closed");
     await this.processingChain;
     await this.pendingCursorSave;
   }
@@ -9432,6 +9946,10 @@ var ConnectionManager = class {
   outboxLength() {
     return this.outbox.length + this.inFlightBatchSize;
   }
+  /** A bounded terminal quarantine for operator inspection; these entries are never retried. */
+  rejectedOutbox() {
+    return this.rejectedOutboundEnvelopes;
+  }
   /**
    * Finding F5(b): polls {@link outboxLength} (not `this.outbox.length`
    * alone — see that method's own doc comment for why a spliced-out,
@@ -9439,15 +9957,14 @@ var ConnectionManager = class {
    * a single `drainOutbox()` promise directly — a drain in progress can
    * itself loop through multiple retry/backoff cycles (`drainRetryDelay`)
    * while the server is unreachable, and a fresh, INDEPENDENT
-   * `drainOutbox()` call can also be triggered concurrently (`send()`, a
-   * mode switch's own `void this.drainOutbox()`) — polling the one thing
+   * `drainOutbox()` call can also be triggered concurrently (`send()`) —
+   * polling the one thing
    * that actually matters (is anything still undelivered) can never go
    * stale the way capturing one specific in-flight promise reference
    * could. Kicks off one more `drainOutbox()` attempt itself first
    * (harmless no-op if one is already running — see its own re-entrancy
-   * guard) in case nothing is currently actively retrying (e.g. WS just
-   * dropped and long-poll hasn't taken over yet), so this bounded wait
-   * isn't just passively hoping something else happens to be making
+   * guard) in case nothing is currently actively retrying, so this bounded
+   * wait isn't just passively hoping something else happens to be making
    * progress.
    */
   waitForOutboxDrained(timeoutMs) {
@@ -9490,19 +10007,21 @@ var ConnectionManager = class {
   deliver(envelope) {
     const tracked = isCursorEnvelopeType(envelope.type) && typeof envelope.seq === "number";
     const watermark = this.dedupWatermark();
-    if (tracked && watermark !== void 0 && envelope.seq <= watermark) return;
+    if (tracked && watermark !== void 0 && envelope.seq <= watermark) return false;
     if (tracked) {
       const seq = envelope.seq;
-      if (this.inFlightSeqs.has(seq) || this.processedSeqs.has(seq)) return;
+      if (this.inFlightSeqs.has(seq) || this.processedSeqs.has(seq)) return false;
       this.inFlightSeqs.add(seq);
       this.noteDelivered(seq);
     }
     this.processingChain = this.processingChain.then(() => this.process(envelope, tracked));
+    return true;
   }
   /**
-   * Design A: the watermark `deliver()` dedupes inbound `task.*` envelopes
-   * against, and the same value `LongPollClient` queries the next
-   * `GET /byok/events` cursor with (see the constructor). Normally this is
+   * The local watermark `deliver()` dedupes inbound `task.*` envelopes
+   * against. It is deliberately NOT the long-poll query cursor: that query
+   * is the kernel acknowledgement and uses only the successfully processed
+   * `cursor` (see the constructor). Normally this local watermark is
    * `deliveredSeq` — which is always >= `cursor` (every envelope that
    * reaches `advanceCursor` already passed through `noteDelivered` first,
    * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
@@ -9518,11 +10037,9 @@ var ConnectionManager = class {
    * whose outcome wasn't known yet. No separate "reset deliveredSeq on
    * reconnect" step is needed for this to be correct — collapsing to
    * `cursor` exactly while stalled already produces the right answer on
-   * every redelivery path (long-poll re-query AND a WS reconnect's
-   * backlog replay alike), and NOT resetting it unconditionally on every
-   * reconnect is what lets `deliveredSeq` keep doing its job of not
-   * re-pulling/re-dispatching something already in flight across a
-   * reconnect that happens to land while a handler is still running.
+   * every long-poll retry path. NOT resetting it unconditionally on every
+   * retry lets `deliveredSeq` keep doing its job of not re-dispatching
+   * something already in flight while a handler is still running.
    */
   dedupWatermark() {
     return this.stalledAtSeq !== void 0 ? this.cursor : this.deliveredSeq ?? this.cursor;
@@ -9540,11 +10057,13 @@ var ConnectionManager = class {
       }
       await this.opts.onEnvelope(envelope);
       if (!tracked) return;
-      this.processedSeqs.add(seq);
-      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) return;
+      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) {
+        this.processedSeqs.add(seq);
+        return;
+      }
       this.stalledAtSeq = void 0;
+      await this.advanceCursor(envelope.seq);
       this.processedSeqs.clear();
-      this.advanceCursor(envelope.seq);
     } catch (err) {
       if (tracked && this.stalledAtSeq === void 0) this.stalledAtSeq = envelope.seq;
       console.error(
@@ -9558,9 +10077,8 @@ var ConnectionManager = class {
   /**
    * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
    * for a batch entry it could not parse into a known `Envelope` at all (an
-   * unrecognized message type — mirrors `ws-transport.ts`'s identical
-   * per-frame tolerance, see `long-poll-transport.ts`'s own doc comment on
-   * `parseLooseEventsPollResponse`) but which still carried a numeric,
+   * unrecognized message type (see `long-poll-transport.ts`'s own doc
+   * comment on `parseLooseEventsPollResponse`) but which still carried a numeric,
    * task-class envelope-level `seq` (the caller only invokes this for a
    * `task.`-prefixed type — see `long-poll-transport.ts`'s own
    * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
@@ -9600,7 +10118,7 @@ var ConnectionManager = class {
    * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
    * called immediately, unconditionally, regardless of `stalledAtSeq` —
    * matching `deliver()`'s own eager, unconditional call for a real
-   * envelope: its only job is "don't re-pull something already handed off,"
+   * envelope: its only job is "don't re-dispatch something already handed off,"
    * independent of outcome, and that property does not depend on FIFO
    * ordering the way the DURABLE cursor does.
    *
@@ -9620,9 +10138,18 @@ var ConnectionManager = class {
    */
   noteSkippedSeq(seq) {
     this.noteDelivered(seq);
-    this.processingChain = this.processingChain.then(() => {
+    this.processingChain = this.processingChain.then(async () => {
       if (this.stalledAtSeq === void 0 || seq === this.stalledAtSeq) {
-        this.advanceCursor(seq);
+        try {
+          await this.advanceCursor(seq);
+          if (this.stalledAtSeq === seq) this.stalledAtSeq = void 0;
+        } catch (err) {
+          if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
+          console.error(
+            `[byok/client] unknown task seq=${seq} could not durably persist its cursor; cursor left unadvanced for redelivery:`,
+            err
+          );
+        }
       }
     });
   }
@@ -9668,94 +10195,52 @@ var ConnectionManager = class {
       if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
     });
   }
-  advanceCursor(seq) {
+  async advanceCursor(seq) {
     if (this.cursor !== void 0 && seq <= this.cursor) return;
+    const save = this.pendingCursorSave.catch(() => void 0).then(() => this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, seq));
+    this.pendingCursorSave = save;
+    await save;
     this.cursor = seq;
-    this.pendingCursorSave = this.pendingCursorSave.catch(() => {
-    }).then(() => this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, seq)).catch(() => {
-    });
-  }
-  /**
-   * Fires the moment a connection attempt reaches `conn.ack` — independent
-   * of whether/when it later closes. This is the ONLY place that can
-   * reliably detect "WS is back up" while long-polling: a healthy
-   * connection stays open indefinitely, so it never reaches `onWsOutcome`
-   * (which is close-only) at all.
-   */
-  onAcked(capabilities) {
-    this.serverCapabilities = capabilities;
-    this.consecutiveFailures = 0;
-    this.notifySettled();
-    this.opts.onOperationalOutcome?.("success", "reconnect");
-    if (this.mode === "long-poll") this.exitLongPoll();
-    void this.drainOutbox();
   }
-  onWsOutcome(acked, err) {
-    if (this.stopped || this.revoked) return;
-    if (acked) this.serverCapabilities = [];
-    if (err instanceof WsUnexpectedStatusError && err.status === 401) {
-      this.opts.auth.handleUnauthorized().catch((renewErr) => {
-        if (renewErr instanceof DeviceRevokedError) this.enterRevoked();
-      });
-    }
-    if (acked) return;
-    this.opts.onOperationalOutcome?.("failure", "reconnect");
-    this.consecutiveFailures += 1;
-    if (this.mode === "ws" && this.consecutiveFailures >= (this.opts.wsFailureThreshold ?? 3)) {
-      this.enterLongPoll();
-    }
+  quarantineRejectedOutbound(envelope, reason) {
+    if (this.rejectedOutboundEnvelopes.length === MAX_REJECTED_OUTBOX_ENTRIES) this.rejectedOutboundEnvelopes.shift();
+    this.rejectedOutboundEnvelopes.push({ envelope, reason });
+    console.error(
+      `[byok/client] outbound envelope ${envelope.id} was permanently rejected (${reason}) and moved to the terminal quarantine.`
+    );
   }
   notifySettled(err) {
     for (const waiter of this.settledWaiters.splice(0)) waiter(err);
   }
-  enterLongPoll() {
-    this.mode = "long-poll";
-    this.serverCapabilities = [];
-    this.ws.stopAutoReconnect();
-    this.opts.onStateChange?.("degraded");
-    this.longPoll.start();
-    this.outbox.unshift(createConnectionHelloEnvelope({
-      deviceId: this.opts.deviceId,
-      productId: this.opts.productId,
-      capabilities: this.opts.capabilities,
-      clientVersion: this.opts.clientVersion,
-      runtimes: this.opts.runtimes,
-      getConfiguredToolsets: this.opts.getConfiguredToolsets,
-      getCursor: () => this.cursor
-    }));
+  noteConnected() {
+    if (this.connected || this.stopped || this.revoked || this.terminalError) return;
+    this.connected = true;
+    this.opts.onStateChange?.("open");
     this.notifySettled();
-    void this.drainOutbox();
-    this.scheduleWsProbe();
   }
-  exitLongPoll() {
-    if (this.wsRetryTimer) {
-      clearInterval(this.wsRetryTimer);
-      this.wsRetryTimer = void 0;
-    }
-    this.longPoll.stop();
-    this.mode = "ws";
-    this.consecutiveFailures = 0;
-    this.ws.resumeAutoReconnect();
-    void this.drainOutbox();
+  noteDisconnected() {
+    if (!this.connected || this.stopped || this.revoked || this.terminalError) return;
+    this.connected = false;
+    this.opts.onStateChange?.("connecting");
   }
-  scheduleWsProbe() {
-    const baseMs = this.opts.wsRetryIntervalMs ?? 5 * 60 * 1e3;
-    const delayMs = this.fleetJitter.delay("reconnect", this.wsProbeSequence++, baseMs);
-    const timer = setTimeout(() => {
-      this.wsRetryTimer = void 0;
-      if (this.stopped || this.revoked || this.mode !== "long-poll") return;
-      this.ws.connect({ auto: false });
-      this.scheduleWsProbe();
-    }, delayMs);
-    timer.unref?.();
-    this.wsRetryTimer = timer;
+  enterReplayCursorTooOld(error) {
+    if (this.terminalError) return;
+    this.terminalError = error;
+    this.stopped = true;
+    this.serverCapabilities = [];
+    this.longPoll.stop();
+    this.connected = false;
+    this.cancelPendingDrainRetry?.();
+    this.notifySettled(error);
+    this.opts.onStateChange?.("closed");
+    this.opts.onTerminalError?.(error);
   }
   enterRevoked() {
     if (this.revoked) return;
     this.revoked = true;
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
+    this.serverCapabilities = [];
     this.longPoll.stop();
-    this.ws.close();
+    this.connected = false;
     this.cancelPendingDrainRetry?.();
     this.opts.onStateChange?.("revoked");
     this.notifySettled(new DeviceRevokedError());
@@ -12490,21 +12975,28 @@ async function recordAuditWarning(context, kind, values) {
   }
 }
 var agentMemoryHomeQueues = /* @__PURE__ */ new Map();
-async function exclusiveAgentMemoryHome(home, fn) {
-  const previous = agentMemoryHomeQueues.get(home) ?? Promise.resolve();
+var agentMemoryProjectionTransactionQueues = /* @__PURE__ */ new Map();
+async function exclusiveAgentMemoryHomeQueue(queues2, home, fn) {
+  const previous = queues2.get(home) ?? Promise.resolve();
   let release;
   const next = new Promise((resolve) => {
     release = resolve;
   });
-  agentMemoryHomeQueues.set(home, next);
+  queues2.set(home, next);
   await previous;
   try {
     return await fn();
   } finally {
     release();
-    if (agentMemoryHomeQueues.get(home) === next) agentMemoryHomeQueues.delete(home);
+    if (queues2.get(home) === next) queues2.delete(home);
   }
 }
+async function exclusiveAgentMemoryHome(home, fn) {
+  return exclusiveAgentMemoryHomeQueue(agentMemoryHomeQueues, home, fn);
+}
+async function exclusiveAgentMemoryProjectionTransaction(home, fn) {
+  return exclusiveAgentMemoryHomeQueue(agentMemoryProjectionTransactionQueues, home, fn);
+}
 var AgentMemoryService = class {
   constructor(input) {
     this.input = input;
@@ -12808,13 +13300,16 @@ var AgentMemoryRedactedOutbox = class _AgentMemoryRedactedOutbox {
 async function snapshotAndProjectAgentMemory(input, projection) {
   if (projection?.capability !== AGENT_MEMORY_PROJECTION_CAPABILITY || !projection.grant || !projection.redactor || !projection.port) return;
   const context = taskContext(input);
-  const outbox = await AgentMemoryRedactedOutbox.open(context, projection.grant);
-  const initialReplay = await outbox.replay(projection.port);
-  if (initialReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(initialReplay);
-  const snapshot = await captureAgentMemorySnapshot(context);
-  await outbox.append(redactedBytes(snapshot, await projection.redactor.redact(snapshot)));
-  const trailingReplay = await outbox.replay(projection.port);
-  if (trailingReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(trailingReplay);
+  const { grant, redactor, port } = projection;
+  await exclusiveAgentMemoryProjectionTransaction(context.canonicalHome, async () => {
+    const outbox = await AgentMemoryRedactedOutbox.open(context, grant);
+    const initialReplay = await outbox.replay(port);
+    if (initialReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(initialReplay);
+    const snapshot = await captureAgentMemorySnapshot(context);
+    await outbox.append(redactedBytes(snapshot, await redactor.redact(snapshot)));
+    const trailingReplay = await outbox.replay(port);
+    if (trailingReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(trailingReplay);
+  });
 }
 var AGENT_MEMORY_FILESYSTEM_HELPER_PROTOCOL = 2;
 var AGENT_MEMORY_FILESYSTEM_HELPER_VERSION = "2";
@@ -13113,6 +13608,7 @@ function resultDocumentRejectionDetail(check) {
   }
 }
 var DEFAULT_MAX_TASK_OUTPUT_BYTES = 64 * 1024 * 1024;
+var DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME = 1;
 function isKnownRuntimeId(id) {
   return RuntimeIdSchema.safeParse(id).success;
 }
@@ -13222,6 +13718,7 @@ var TaskRunner = class {
   deps;
   tasks = /* @__PURE__ */ new Map();
   pendingMessageTasks = /* @__PURE__ */ new Map();
+  messageOutboxesByHome = /* @__PURE__ */ new Map();
   messageContextByToken = /* @__PURE__ */ new Map();
   messageContextByTask = /* @__PURE__ */ new Map();
   memoryContextByToken = /* @__PURE__ */ new Map();
@@ -13282,6 +13779,8 @@ var TaskRunner = class {
    * costs nothing.
    */
   inFlightOffers = /* @__PURE__ */ new Set();
+  /** Blob I/O before an offer becomes an active task still belongs to that offer's cancellation authority. */
+  inFlightBlobAborts = /* @__PURE__ */ new Map();
   /**
    * Finding P2 (Fix 2c): taskIds that have reached a terminal outcome
    * (Complete/Failed/Cancelled) this session — populated in `finish()`.
@@ -13356,6 +13855,10 @@ var TaskRunner = class {
   get maxTaskOutputBytes() {
     return this.deps.maxTaskOutputBytes ?? DEFAULT_MAX_TASK_OUTPUT_BYTES;
   }
+  /** WP0: effective per-canonical-Agent-home Attempt cap — see {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}. */
+  get maxConcurrentMutableSessionsPerAgentHome() {
+    return this.deps.maxConcurrentMutableSessionsPerAgentHome ?? DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME;
+  }
   /**
    * M4 Phase 4 (part B.3, observability): per-active-task queue watermarks
    * for the control socket's `status` result — see
@@ -13408,6 +13911,7 @@ var TaskRunner = class {
   async recoverAgentMessageOutboxes(agentsRoot) {
     if (this.deps.tenantId === void 0) throw new Error("Agent message recovery requires authenticated tenant enrollment");
     for (const outbox of await AgentMessageOutbox.recover(agentsRoot, this.deps.tenantId)) {
+      this.messageOutboxesByHome.set(outbox.homeDir, Promise.resolve(outbox));
       for (const record of outbox.retryableRecords()) {
         if (record.sessionRef === void 0) continue;
         const existing = this.recoveredMessageOutboxes.get(record.taskId);
@@ -13416,6 +13920,16 @@ var TaskRunner = class {
       }
     }
   }
+  agentMessageOutbox(homeDir) {
+    const existing = this.messageOutboxesByHome.get(homeDir);
+    if (existing !== void 0) return existing;
+    const opened = AgentMessageOutbox.open(homeDir);
+    this.messageOutboxesByHome.set(homeDir, opened);
+    void opened.catch(() => {
+      if (this.messageOutboxesByHome.get(homeDir) === opened) this.messageOutboxesByHome.delete(homeDir);
+    });
+    return opened;
+  }
   /** Retry stable recovered records after a transport handshake/re-handshake. */
   retryRecoveredAgentMessages() {
     for (const [taskId, outbox] of this.recoveredMessageOutboxes) {
@@ -13571,6 +14085,7 @@ var TaskRunner = class {
     if (active.finalizationStarted) return this.finish(active.taskId);
     if (!this.reserveSemanticTerminal(active)) return active.semanticTerminalSettled ?? false;
     active.beingTornDown = true;
+    active.blobAbort.abort();
     await this.observeGit(active, "salvage");
     const timeoutMs = this.deps.shutdownInterruptTimeoutMs ?? DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS;
     await raceSettleFirst(() => active.session.interrupt(), timeoutMs);
@@ -13717,6 +14232,8 @@ var TaskRunner = class {
       return;
     }
     this.inFlightOffers.add(taskId);
+    const blobAbort = new AbortController();
+    this.inFlightBlobAborts.set(taskId, blobAbort);
     let agentBinding;
     let agentLeaseTransferred = false;
     try {
@@ -13731,6 +14248,24 @@ var TaskRunner = class {
         decline("strict Agent-only daemon refuses legacy task offers", false);
         return;
       }
+      if (agentRef !== void 0) {
+        const limit = this.maxConcurrentMutableSessionsPerAgentHome;
+        let canonicalHome;
+        try {
+          canonicalHome = await this.deps.agentHome.layout.canonicalHomePath(agentRef);
+        } catch (error) {
+          decline(
+            `Agent home admission failed: ${errorMessage5(error)}`,
+            !(error instanceof AgentHomeResolutionError)
+          );
+          return;
+        }
+        const active2 = this.deps.agentHome.executionLeaseManager.activeAttemptCount(canonicalHome);
+        if (active2 >= limit) {
+          decline(`agent home busy: ${active2} active attempt(s)`, true);
+          return;
+        }
+      }
       const guarded = this.deps.admissionGuard?.({ taskId, payload });
       if (guarded !== void 0 && !guarded.admit) {
         decline(guarded.reason, guarded.retryable);
@@ -13875,7 +14410,7 @@ var TaskRunner = class {
       }
       if (agentRef !== void 0) {
         try {
-          agentBinding = await this.deps.agentHome.acquire(agentRef);
+          agentBinding = await this.deps.agentHome.acquireExecution(agentRef, { taskId, sessionRef });
         } catch (error) {
           decline(
             `Agent home admission failed: ${errorMessage5(error)}`,
@@ -13910,7 +14445,7 @@ var TaskRunner = class {
           }
         }
         try {
-          await this.deps.agentHome.initialize(agentBinding);
+          await this.deps.agentHome.initializeExecution(agentBinding);
         } catch (error) {
           await agentBinding.lease.release().catch(() => {
           });
@@ -13920,7 +14455,7 @@ var TaskRunner = class {
         }
         if (messageRequirement !== void 0) {
           try {
-            const outbox = await AgentMessageOutbox.open(agentBinding.resolution.canonicalHome);
+            const outbox = await this.agentMessageOutbox(agentBinding.resolution.canonicalHome);
             this.pendingMessageTasks.set(taskId, {
               taskId,
               agentRef: agentBinding.resolution.agentRef,
@@ -14039,7 +14574,7 @@ var TaskRunner = class {
       );
       let resolvedInstruction;
       try {
-        resolvedInstruction = await this.resolveInstruction(payload.instruction);
+        resolvedInstruction = await this.resolveInstruction(payload.instruction, blobAbort.signal);
         if (plainWorkspaceNeedsResolve) workspaceDir = await this.resolveWorkspaceDir(taskId, known?.workspaceDir);
       } catch (err) {
         gitLease?.release();
@@ -14152,9 +14687,29 @@ var TaskRunner = class {
         }
         return;
       }
+      if (agentBinding !== void 0) {
+        try {
+          await agentBinding.lease.bindSession(session.sessionRef);
+        } catch (error) {
+          await session.close().catch(() => {
+          });
+          await this.failClaimedAgent(
+            taskId,
+            `Agent session execution lease could not bind the runtime session: ${errorMessage5(error)}`,
+            false,
+            {
+              binding: agentBinding,
+              runtimeId: pick.descriptor.id,
+              sessionRef: session.sessionRef
+            }
+          );
+          return;
+        }
+      }
       let active;
       active = {
         taskId,
+        blobAbort,
         egressEnabled: "egressPolicy" in payload,
         adapter: pick.adapter,
         session,
@@ -14195,15 +14750,16 @@ var TaskRunner = class {
         ...terminalProjection === void 0 ? {} : { terminalProjection }
       };
       if (agentBinding !== void 0) {
+        const binding = agentBinding;
         try {
-          await this.deps.agentSessionHandoffs.record({
-            agentRef: agentBinding.resolution.agentRef,
+          await this.deps.agentHome.mutateExecution(binding, () => this.deps.agentSessionHandoffs.record({
+            agentRef: binding.resolution.agentRef,
             taskId,
             sessionRef: session.sessionRef,
             runtimeId: pick.descriptor.id,
             cwd: workspaceDir,
-            leaseId: agentBinding.lease.leaseId
-          });
+            leaseId: binding.lease.leaseId
+          }));
         } catch (error) {
           await session.close().catch(() => {
           });
@@ -14245,6 +14801,7 @@ var TaskRunner = class {
       }
       this.deps.send(createEnvelope("task.started", {}, { taskId }));
       agentLeaseTransferred = agentBinding !== void 0;
+      this.inFlightBlobAborts.delete(taskId);
       this.tasks.set(taskId, active);
       this.pendingMessageTasks.delete(taskId);
       if (active.messageOutbox !== void 0 && activatedMessageRecord !== void 0) {
@@ -14276,6 +14833,7 @@ var TaskRunner = class {
         await agentBinding.lease.release().catch(() => {
         });
       }
+      this.inFlightBlobAborts.delete(taskId);
       this.inFlightOffers.delete(taskId);
     }
   }
@@ -14427,9 +14985,9 @@ var TaskRunner = class {
     void this.closeAgentMemoryFilesystem(taskId);
   }
   /** Protocol §7: an instruction too large to inline arrives as a `blobRef` — resolve it via the blob client rather than failing closed. */
-  async resolveInstruction(instruction) {
+  async resolveInstruction(instruction, signal) {
     if (typeof instruction === "string") return instruction;
-    return this.deps.blobClient.resolveInstruction(instruction.blobRef);
+    return this.deps.blobClient.resolveInstruction(instruction.blobRef, { signal });
   }
   /** Resolve every requested logical id locally and reject missing/colliding server authority before claim. */
   resolveMcpServers(requiredToolsets) {
@@ -14661,7 +15219,9 @@ var TaskRunner = class {
       }
     }
     try {
-      const blobRef = await this.deps.blobClient.uploadArtifact(bytes, contentType);
+      const blobRef = await this.deps.blobClient.uploadArtifact(bytes, contentType, {
+        signal: active.blobAbort.signal
+      });
       this.deps.send(createEnvelope("task.artifact", { name, contentType, blobRef }, { taskId: active.taskId }));
     } catch (err) {
       this.reportArtifactError(active, name, `failed to upload artifact "${name}": ${errorMessage5(err)}`);
@@ -14676,6 +15236,7 @@ var TaskRunner = class {
     const active = this.tasks.get(taskId);
     if (!active) {
       this.setPendingCancelled(taskId, reason);
+      this.inFlightBlobAborts.get(taskId)?.abort();
       return;
     }
     if (active.finalizationStarted) {
@@ -14686,6 +15247,7 @@ var TaskRunner = class {
       await active.semanticTerminalSettled;
       return;
     }
+    active.blobAbort.abort();
     try {
       await active.session.interrupt();
     } catch {
@@ -15185,7 +15747,7 @@ var TaskRunner = class {
   async failClaimedAgent(taskId, reason, retryable, context) {
     const agentRef = context.binding.resolution.agentRef;
     const result = await this.retryAgentTerminalEvidence(
-      () => this.deps.agentSessionHandoffs.recordTaskTerminal({
+      () => this.deps.agentHome.mutateExecution(context.binding, () => this.deps.agentSessionHandoffs.recordTaskTerminal({
         agentRef,
         taskId,
         runtimeId: context.runtimeId,
@@ -15193,7 +15755,7 @@ var TaskRunner = class {
         leaseId: context.binding.lease.leaseId,
         ...context.sessionRef === void 0 ? {} : { sessionRef: context.sessionRef },
         terminalReason: reason
-      })
+      }))
     );
     if (!result.ok) {
       this.reportAgentTerminalEvidenceFailure({
@@ -16182,6 +16744,8 @@ var AgentEgressController = class {
   options;
   latest = new AgentLatestValueState();
   spools = /* @__PURE__ */ new Map();
+  spoolOpens = /* @__PURE__ */ new Map();
+  reliableAppendTail = Promise.resolve();
   latestStatus = emptyLane();
   reliableStatus = emptyLane();
   drops = [];
@@ -16236,7 +16800,8 @@ var AgentEgressController = class {
     return latest === void 0 ? [] : Object.freeze([latest]);
   }
   async appendReliable(input) {
-    if (!this.active || this.options.tenantId === void 0) {
+    const tenantId = this.options.tenantId;
+    if (!this.active || tenantId === void 0) {
       this.noteDrop("reliable", "policy_denied", input.agentRef);
       return { ok: false, reason: "policy_denied" };
     }
@@ -16251,17 +16816,21 @@ var AgentEgressController = class {
       return { ok: false, reason: "sanitizer_rejected" };
     }
     try {
-      const spool = await this.spoolFor(input.homeDir, input.agentRef);
-      const record = await spool.append({
-        agentRef: input.agentRef,
-        tenantId: this.options.tenantId,
-        policyRevision: this.options.policy.policyRevision,
-        payload,
-        sessionRef: input.sessionRef,
-        ...input.taskId === void 0 ? {} : { taskId: input.taskId },
-        ...input.eventId === void 0 ? {} : { eventId: input.eventId }
-      }, this.options.policy, this.tenantPendingBytes());
-      return { ok: true, record };
+      const spoolOpen = this.spoolFor(input.homeDir, input.agentRef);
+      return await this.withAppendTail(async () => {
+        const spool = await spoolOpen;
+        this.bindSpool(input.agentRef, spool, spoolOpen);
+        const record = await spool.append({
+          agentRef: input.agentRef,
+          tenantId,
+          policyRevision: this.options.policy.policyRevision,
+          payload,
+          sessionRef: input.sessionRef,
+          ...input.taskId === void 0 ? {} : { taskId: input.taskId },
+          ...input.eventId === void 0 ? {} : { eventId: input.eventId }
+        }, this.options.policy, this.tenantPendingBytes());
+        return { ok: true, record };
+      });
     } catch (error) {
       const reason = error instanceof AgentReliableQuotaError ? error.reason : "backpressure";
       this.noteDrop("reliable", reason, input.agentRef);
@@ -16274,21 +16843,26 @@ var AgentEgressController = class {
    * with `wireType: agent.content.receipt` before any transport attempt.
    */
   async appendContentReceipt(input) {
-    if (!this.active || this.options.tenantId === void 0) {
+    const tenantId = this.options.tenantId;
+    if (!this.active || tenantId === void 0) {
       this.noteDrop("reliable", "policy_denied", input.agentRef);
       return { ok: false, reason: "policy_denied" };
     }
     try {
-      const spool = await this.spoolFor(input.homeDir, input.agentRef);
-      const record = await spool.appendContentReceipt({
-        agentRef: input.agentRef,
-        tenantId: this.options.tenantId,
-        policyRevision: this.options.policy.policyRevision,
-        sessionRef: input.payload.sessionRef,
-        payload: input.payload,
-        ...input.taskId === void 0 ? {} : { taskId: input.taskId }
-      }, this.options.policy, this.tenantPendingBytes());
-      return { ok: true, record };
+      const spoolOpen = this.spoolFor(input.homeDir, input.agentRef);
+      return await this.withAppendTail(async () => {
+        const spool = await spoolOpen;
+        this.bindSpool(input.agentRef, spool, spoolOpen);
+        const record = await spool.appendContentReceipt({
+          agentRef: input.agentRef,
+          tenantId,
+          policyRevision: this.options.policy.policyRevision,
+          sessionRef: input.payload.sessionRef,
+          payload: input.payload,
+          ...input.taskId === void 0 ? {} : { taskId: input.taskId }
+        }, this.options.policy, this.tenantPendingBytes());
+        return { ok: true, record };
+      });
     } catch (error) {
       const reason = error instanceof AgentReliableQuotaError ? error.reason : "backpressure";
       this.noteDrop("reliable", reason, input.agentRef);
@@ -16363,20 +16937,59 @@ var AgentEgressController = class {
     }
     return this.reliableRecords();
   }
-  async spoolFor(homeDir, agentRef) {
+  spoolFor(homeDir, agentRef) {
     const key = agentKey(agentRef);
     const existing = this.spools.get(key);
-    if (existing) return existing;
-    const spool = await AgentReliableSpool.open(homeDir);
-    if (spool.records().some((record) => !sameAgent(record.agentRef, agentRef))) {
-      throw new Error("Agent-local reliable spool has a different AgentRef");
+    if (existing) {
+      if (existing.homeDir !== homeDir) throw new Error("Agent reliable spool is already bound to a different home");
+      return Promise.resolve(existing);
+    }
+    const inFlight = this.spoolOpens.get(key);
+    if (inFlight !== void 0) {
+      if (inFlight.homeDir !== homeDir) throw new Error("Agent reliable spool opening is already bound to a different home");
+      return inFlight.promise;
+    }
+    const opened = (async () => {
+      const spool = await AgentReliableSpool.open(homeDir);
+      if (spool.records().some((record) => !sameAgent(record.agentRef, agentRef))) {
+        throw new Error("Agent-local reliable spool has a different AgentRef");
+      }
+      return spool;
+    })();
+    const slot = { homeDir, promise: opened };
+    this.spoolOpens.set(key, slot);
+    void opened.catch(() => {
+      if (this.spoolOpens.get(key) === slot) this.spoolOpens.delete(key);
+    });
+    return opened;
+  }
+  bindSpool(agentRef, spool, spoolOpen) {
+    const key = agentKey(agentRef);
+    const existing = this.spools.get(key);
+    try {
+      if (existing && existing !== spool) throw new Error("multiple Agent egress spools claim the same AgentRef");
+      this.spools.set(key, spool);
+    } finally {
+      const slot = this.spoolOpens.get(key);
+      if (slot?.promise === spoolOpen) this.spoolOpens.delete(key);
     }
-    this.spools.set(key, spool);
-    return spool;
   }
   tenantPendingBytes() {
     return this.reliableRecords().reduce((total, record) => total + record.byteCount, 0);
   }
+  async withAppendTail(operation) {
+    const previous = this.reliableAppendTail;
+    let release;
+    this.reliableAppendTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    try {
+      await previous;
+      return await operation();
+    } finally {
+      release();
+    }
+  }
   noteDrop(lane, reason, agentRef, countDrop = true) {
     const laneStatus = lane === "latest-value" ? this.latestStatus : this.reliableStatus;
     if (countDrop) laneStatus.dropped += 1;
@@ -17364,7 +17977,7 @@ async function detectRuntimes(adapters) {
   }
   return runtimes;
 }
-function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
+function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies, providerProfileBindingConfigured = false) {
   const flags = [];
   if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
@@ -17376,6 +17989,9 @@ function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentO
   if (selectionAdapters.length > 0 && selectionAdapters.every((adapter) => adapter.descriptor.supportsDispatchSelection === true)) {
     flags.push("dispatch-selection");
   }
+  if (providerProfileBindingConfigured && adapters.some((adapter) => adapter.descriptor.id === "pi" && adapter.descriptor.supportsDispatchSelection)) {
+    flags.push(PROVIDER_PROFILE_BINDING_CAPABILITY);
+  }
   if (adapters.some((adapter) => adapter.descriptor.capabilities.mcpToolsets === true)) {
     flags.push("toolset-selection");
   }
@@ -17538,6 +18154,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   if (config.strictAgentOnly === true && config.agentHome === void 0) {
     throw new Error("DaemonConfig.strictAgentOnly requires DaemonConfig.agentHome");
   }
+  if (config.maxConcurrentMutableSessionsPerAgentHome !== void 0 && !(Number.isSafeInteger(config.maxConcurrentMutableSessionsPerAgentHome) && config.maxConcurrentMutableSessionsPerAgentHome > 0)) {
+    throw new Error(
+      `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome must be a positive safe integer (or omitted to use the default of ${DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}) \u2014 got ${config.maxConcurrentMutableSessionsPerAgentHome}. Raising it above 1 lets that many Attempts co-write one canonical Agent home; 0, a negative number, NaN, or a non-integer is rejected rather than silently treated as "uncapped".`
+    );
+  }
+  const agentHomeAttemptLimit = config.maxConcurrentMutableSessionsPerAgentHome ?? DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME;
   const egressPolicy = resolveAgentEgressPolicy(config.agentEgress?.policy);
   const egressBatcherOptions = egressPolicy.activity.mode === "contentful-trajectory" ? {
     ...config.progressBatch,
@@ -17648,6 +18270,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   const observer = new DaemonObserver();
   const approvalRegistry = new ApprovalRegistry();
   let connection;
+  let blobLifecycleAbort;
   let connectionState = "closed";
   let daemonStarted = false;
   let tenantRebinding = false;
@@ -17666,6 +18289,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   function buildAuthManager() {
     return new AuthManager({
       serverUrl: config.serverUrl,
+      authRequestDeadlineMs: config.authRequestDeadlineMs,
       store,
       deviceName: config.deviceName,
       machineId: config.machineId ?? (() => resolveMachineId({ productId: config.productId })),
@@ -17683,7 +18307,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       assertServerUrlAllowed(config.serverUrl, { dangerouslyAllowInsecureRemote: true });
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(
-        `[byok/client] WARNING: dangerouslyAllowInsecureRemote is set \u2014 proceeding with an insecure server URL (${config.serverUrl}). Device credentials and task data will be sent in the clear to a non-loopback host. This should never be used in a real deployment. (${reason})`
+        `[byok/client] WARNING: dangerouslyAllowInsecureRemote is set \u2014 proceeding with an insecure server URL (${formatServerUrl(config.serverUrl)}). Device credentials and task data will be sent in the clear to a non-loopback host. This should never be used in a real deployment. (${reason})`
       );
     }
   }
@@ -17843,9 +18467,10 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         await gitWorkspaceStore?.initialize();
         await gitWorkspaceStore?.reconcile();
       }
+      blobLifecycleAbort = new AbortController();
       const [runtimes, blobClient] = await Promise.all([
         detectRuntimes(adapters),
-        Promise.resolve(new BlobClient(config.serverUrl, auth))
+        Promise.resolve(new BlobClient(config.serverUrl, auth, { signal: blobLifecycleAbort.signal }))
       ]);
       observer.noteRuntimesDetected(runtimes);
       detectedRuntimeFacts = runtimes;
@@ -17855,7 +18480,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         config.strictAgentOnly === true,
         agentHomeManager?.supportsTaskFreeProjection() === true,
         config.agentEgress !== void 0,
-        agentContentReadPolicies
+        agentContentReadPolicies,
+        config.piByokLauncher !== void 0
       );
       const agentHomeProjectionCompletion = agentHomeManager?.supportsTaskFreeProjection() === true ? new AgentHomeProjectionCompletionClient({
         serverUrl: config.serverUrl,
@@ -17914,6 +18540,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         workspaceRoot: config.workspaceRoot,
         ...agentHomeManager === void 0 ? {} : { agentHome: agentHomeManager },
         ...config.strictAgentOnly === true ? { strictAgentOnly: true } : {},
+        // WP0: already validated up front — see `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome`.
+        maxConcurrentMutableSessionsPerAgentHome: agentHomeAttemptLimit,
         ...agentSessionHandoffs === void 0 ? {} : { agentSessionHandoffs },
         deviceId: record.deviceId,
         // M5: see `DaemonConfig.runtimeEnvironment`'s own doc comment above.
@@ -18198,16 +18826,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         },
         onStateChange: (state) => {
-          const wasSettled = connectionState === "open" || connectionState === "degraded";
+          const wasSettled = connectionState === "open";
           connectionState = state;
           observer.noteConnectionState(state);
-          if (!wasSettled && (state === "open" || state === "degraded")) runner?.retryRecoveredAgentMessages();
-          if (!wasSettled && (state === "open" || state === "degraded")) runPresenceDiscovery();
+          if (!wasSettled && state === "open") runner?.retryRecoveredAgentMessages();
+          if (!wasSettled && state === "open") runPresenceDiscovery();
         },
-        backoff: overrides.backoff,
-        liveness: overrides.liveness,
-        wsFailureThreshold: overrides.longPoll?.wsFailureThreshold,
-        wsRetryIntervalMs: overrides.longPoll?.wsRetryIntervalMs,
         longPollRetryDelayMs: overrides.longPoll?.retryDelayMs,
         longPollIdleDelayMs: overrides.longPoll?.idleDelayMs,
         fleetJitter,
@@ -18219,7 +18843,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         }
       });
       await connection.start();
-      await connection.waitForAck();
+      await connection.waitForConnection();
       runner.retryRecoveredAgentMessages();
       for (const record2 of agentEgress.retryableReliableRecords(connection.getServerCapabilities())) {
         dispatchReliableRecord(record2);
@@ -18274,6 +18898,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   }
   async function runShutdownSequence(reason, opts = {}) {
     shuttingDown = true;
+    blobLifecycleAbort?.abort();
+    blobLifecycleAbort = void 0;
     const errors = [];
     let mutationBarrierComplete = hostedStorageInitializationBarrierComplete;
     if (!hostedStorageInitializationBarrierComplete) {
@@ -18476,7 +19102,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       // fine.
       ...storageStatus === void 0 ? {} : { storage: storageStatus },
       operationalHealth: operationalHealth.snapshot(),
-      toolsets: toolsetRegistry.status()
+      toolsets: toolsetRegistry.status(),
+      // WP0: same counts `Daemon.status()` reports, from the same reader.
+      agentHomeExecution: agentHomeExecutionStatus()
     };
   }
   async function performControlShutdown(reason) {
@@ -18711,9 +19339,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         const minted = mintDeviceAssertion({
           record,
           // `toHttpBase` is the one place a configured serverUrl is normalized
-          // (ws:->http:, wss:->https:, path stripped), so an operator who
-          // configured the websocket spelling and one who configured the HTTP
-          // spelling of the same deployment produce the same issuer.
+          // (path stripped), so the issuer ignores an operator-provided path
+          // or query.
           issuer: new URL(toHttpBase(config.serverUrl)).origin,
           productId: config.productId,
           audience: parsed.audience,
@@ -18828,23 +19455,33 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       await binding.lease.release();
     }
   }
+  function agentHomeExecutionStatus() {
+    const summary = agentHomeManager?.executionLeaseManager.activeAttemptSummary();
+    return {
+      maxConcurrentMutableSessionsPerAgentHome: agentHomeAttemptLimit,
+      activeHomes: summary?.homes ?? 0,
+      activeAttempts: summary?.attempts ?? 0
+    };
+  }
   function status() {
     return {
       localAgentRelease,
       paired: auth.deviceId !== void 0,
       connected: connectionState === "open",
-      degraded: connection?.isTransportDegraded() ?? false,
       revoked: connection?.isRevoked() ?? auth.isRevoked(),
       deviceId: auth.deviceId,
       activeTaskCount: runner?.activeTaskCount ?? 0,
       branding: config.branding,
       operationalHealth: operationalHealth.snapshot(),
       toolsets: toolsetRegistry.status(),
-      egress: agentEgress.status()
+      egress: agentEgress.status(),
+      agentHomeExecution: agentHomeExecutionStatus()
     };
   }
   function reloadMcpToolsets(mcpToolsets, expectedRevision) {
-    return toolsetRegistry.reload(mcpToolsets, expectedRevision);
+    const receipt = toolsetRegistry.reload(mcpToolsets, expectedRevision);
+    if (daemonStarted) connection?.refreshHello();
+    return receipt;
   }
   function reportMcpToolsetObservation(toolsetId, expectedDefinitionRevision, observation) {
     toolsetRegistry.report(toolsetId, expectedDefinitionRevision, observation);
@@ -19253,7 +19890,7 @@ function createServiceLifecycle(def, opts = {}) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.11.0"
+  version: "0.13.0"
 });
 
 // src/bin/config.ts
@@ -21333,7 +21970,7 @@ async function recentAuditFacts(storeDir) {
 }
 function projectControl(control) {
   if (control.status === "offline") return { status: "offline" };
-  const transport = ["connecting", "open", "closed", "degraded", "revoked"].includes(control.transport) ? control.transport : "unavailable";
+  const transport = ["connecting", "open", "closed", "revoked"].includes(control.transport) ? control.transport : "unavailable";
   const operationalHealth = control.operationalHealth.availability === "available" ? {
     availability: "available",
     state: control.operationalHealth.state,