@byok-sdk/client 0.12.0 → 0.13.0

package/dist/bin/byok-agent.js

@@ -3,7 +3,7 @@ import { randomUUID, createHash, randomBytes, timingSafeEqual, createHmac, creat
 import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, existsSync, realpathSync, mkdirSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
 import * as path3 from 'path';
 import path3__default, { isAbsolute, join } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, TERMINAL_PROJECTION_SELECTION_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
 import net, { createServer, createConnection } from 'net';
 import * as os from 'os';
 import os__default from 'os';
@@ -13,7 +13,6 @@ import 'readline';
 import { isTenantId, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, nonceSigningBytes, CapabilityDeclarationSchema, hasCapability, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
 import { promisify } from 'util';
 import * as fs13 from 'fs/promises';
-import { WebSocket } from 'ws';
 import { createRequire } from 'module';
 import { createInterface } from 'readline/promises';
 
@@ -445,6 +444,23 @@ async function resolveExistingAncestor(inputPath) {
     }
   }
 }
+async function canonicalPath(inputPath) {
+  const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
+  return path3__default.resolve(canonical2, ...tail);
+}
+async function assertRealDirectoryIfPresent(target) {
+  let stat;
+  try {
+    stat = await promises.lstat(target);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return;
+    throw error;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new AgentHomeResolutionError(`Agent home path component is not a real directory: ${target}`);
+  }
+}
 async function materializeDirectory(inputPath) {
   const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
   let cursor = canonical2;
@@ -539,6 +555,39 @@ var AgentHomeLayout = class {
       await gate.release();
     }
   }
+  /**
+   * Pure canonical-home derivation for read-only callers, such as the
+   * pre-admission single-writer count. It validates the AgentRef and joins
+   * exactly the same `<hostStorageRoot>/agents/<agentId>` segments
+   * {@link AgentHomeLayout.resolve} would, canonicalizing only the components
+   * that already exist.
+   *
+   * It deliberately creates no directory, takes no cross-process mutation
+   * gate and records no Agent binding, so an offer the host vetoes after the
+   * count leaves nothing behind on disk. `resolve()` stays the only path that
+   * may materialize a home or bind it to an Agent identity.
+   *
+   * An `agents` root or `agents/<agentId>` leaf that already exists but is a
+   * symlink (or any non-directory) is rejected here with the same error class
+   * and message `resolve()` raises for it, so an in-root `two -> one` link
+   * fails closed instead of silently keying the count of `one`. A leaf that
+   * does not exist yet is not an error: this derivation runs before the home
+   * is materialized. A home canonicalizing outside the `agents` root stays
+   * rejected as before.
+   */
+  async canonicalHomePath(agentRefInput) {
+    const agentRef = validateAgentRef(agentRefInput);
+    const hostStorageRoot = this.canonicalRoot ?? await canonicalPath(this.hostStorageRootInput);
+    const agentsRoot = path3__default.join(hostStorageRoot, AGENT_HOME_DIRECTORY);
+    await assertRealDirectoryIfPresent(agentsRoot);
+    const lexicalHome = path3__default.join(agentsRoot, agentRef.agentId);
+    await assertRealDirectoryIfPresent(lexicalHome);
+    const canonicalHome = await canonicalPath(lexicalHome);
+    if (canonicalHome === agentsRoot || !isWithin(agentsRoot, canonicalHome)) {
+      throw new AgentHomeResolutionError(`Agent home resolves outside the Agent home root: ${canonicalHome}`);
+    }
+    return canonicalHome;
+  }
   /**
    * Prove the canonical root is materializable and writable before the daemon
    * advertises Agent-home capability. No Agent identity or persistent Agent
@@ -855,6 +904,44 @@ var AgentHomeExecutionLeaseManager = class _AgentHomeExecutionLeaseManager {
       });
     });
   }
+  /**
+   * WP0: Attempts currently holding an execution lease on this exact
+   * canonical home, across every lane and every session. This is the number
+   * the daemon's admission gate reads before any side effect — see
+   * `TaskRunner.handleOffer`'s per-home busy gate.
+   *
+   * Derived from the one lease registry above rather than a second tally, so
+   * it inherits the lease lifecycle exactly: an entry appears at `acquire()`,
+   * survives `bindSession()` (which rekeys in place), and disappears only at
+   * `release()`, which the task runner calls after the attempt is terminal
+   * AND `Session.close()` resolved. A failed disposal never reaches
+   * `release()`, so the slot stays held — fail closed, the same posture as
+   * `runtime-disposal-failed`. Crash residue needs nothing extra here: a
+   * restarted daemon starts with an empty registry and reclaims the on-disk
+   * marker only under the same stable owner identity (`openLeaseMarker`).
+   *
+   * Counted regardless of which lease manager owns the group: the invariant
+   * being protected is the filesystem path (`MEMORY.md`, `notes/`, `.git`),
+   * not the owner identity.
+   */
+  activeAttemptCount(canonicalHome) {
+    return _AgentHomeExecutionLeaseManager.groups.get(canonicalHome)?.leasesByKey.size ?? 0;
+  }
+  /**
+   * Counts-only readback for daemon/control status. Scoped to this manager's
+   * own leases, so the number describes this daemon rather than every home
+   * any manager in the process happens to hold. Never exposes a home path.
+   */
+  activeAttemptSummary() {
+    let homes = 0;
+    let attempts = 0;
+    for (const group of _AgentHomeExecutionLeaseManager.groups.values()) {
+      if (group.manager !== this.manager) continue;
+      homes += 1;
+      attempts += group.leasesByKey.size;
+    }
+    return { homes, attempts };
+  }
   async mutate(binding, operation) {
     return this.exclusive(binding.resolution.canonicalHome, async () => {
       const group = _AgentHomeExecutionLeaseManager.groups.get(binding.resolution.canonicalHome);
@@ -1818,13 +1905,22 @@ function freezeRuntimeAdapterDescriptor(descriptor) {
   });
 }
 function sealRuntimeOperationManifest(manifest) {
+  const dispatchSelection = manifest.dispatchSelection === void 0 ? void 0 : manifest.dispatchSelection.lane === "byok-profile" ? Object.freeze({
+    ...manifest.dispatchSelection,
+    providerProfile: Object.freeze({
+      ...manifest.dispatchSelection.providerProfile,
+      requiredCapabilities: Object.freeze([
+        ...manifest.dispatchSelection.providerProfile.requiredCapabilities
+      ])
+    })
+  }) : Object.freeze({ ...manifest.dispatchSelection });
   return Object.freeze({
     taskId: manifest.taskId,
     runtimeId: manifest.runtimeId,
     descriptor: freezeRuntimeAdapterDescriptor(manifest.descriptor),
     policy: frozenPolicy(manifest.policy),
     requiredToolsetIds: Object.freeze([...manifest.requiredToolsetIds]),
-    ...manifest.dispatchSelection === void 0 ? {} : { dispatchSelection: Object.freeze({ ...manifest.dispatchSelection }) },
+    ...dispatchSelection === void 0 ? {} : { dispatchSelection },
     ...manifest.sessionRef === void 0 ? {} : { sessionRef: manifest.sessionRef },
     ...manifest.agentRef === void 0 ? {} : { agentRef: Object.freeze({ agentId: manifest.agentRef.agentId, profileRevision: manifest.agentRef.profileRevision }) },
     cwd: manifest.cwd ?? manifest.workspace.workspaceDir,
@@ -3852,7 +3948,11 @@ function validatePiByokLauncherConfig(launcher) {
     "--macos-keychain-path",
     "--secret-service-prefix",
     "--provider",
-    "--model"
+    "--model",
+    "--profile-revision",
+    "--profile-hash",
+    "--required-capabilities",
+    "--validate-only"
   ]);
   const conflicting = launcher.args?.find((arg) => reserved.has(arg));
   if (conflicting !== void 0) {
@@ -3914,11 +4014,17 @@ var PiAdapter = class {
     const bin = this.resolveBin();
     const extensions = (this.options.resolveExtensions ?? resolvePiExtensions)();
     const selection = input.offer.dispatchSelection;
-    const pinnedSelection = selection === void 0 ? void 0 : Object.freeze({ ...selection });
+    const pinnedSelection = selection === void 0 ? void 0 : selection.lane === "byok-profile" ? Object.freeze({
+      ...selection,
+      providerProfile: Object.freeze({
+        ...selection.providerProfile,
+        requiredCapabilities: Object.freeze([...selection.providerProfile.requiredCapabilities])
+      })
+    }) : Object.freeze({ ...selection });
     let command = bin.command;
     let launcherArgs;
     if (pinnedSelection !== void 0) {
-      if (pinnedSelection.lane !== "byok" || pinnedSelection.runtimeId !== "pi") {
+      if (pinnedSelection.lane !== "byok" && pinnedSelection.lane !== "byok-profile" || pinnedSelection.runtimeId !== "pi") {
         return { kind: "reject", reason: `pi adapter cannot execute ${pinnedSelection.lane} selection for runtime ${pinnedSelection.runtimeId}`, retryable: false };
       }
       const launcher = this.options.byokLauncher;
@@ -3926,6 +4032,21 @@ var PiAdapter = class {
         return { kind: "reject", reason: "pi BYOK selection requires a configured credential-custody launcher", retryable: false };
       }
       command = launcher.command;
+      const providerProfile = pinnedSelection.lane === "byok-profile" ? pinnedSelection.providerProfile : void 0;
+      if (providerProfile !== void 0) {
+        try {
+          await (this.options.validateProviderProfileBinding ?? validateProviderProfileBindingWithLauncher)(
+            providerProfile,
+            launcher
+          );
+        } catch (error) {
+          return {
+            kind: "reject",
+            reason: `provider profile admission failed: ${errorMessage2(error)}`,
+            retryable: false
+          };
+        }
+      }
       launcherArgs = [
         ...launcher.args ?? [],
         "--pi-bin",
@@ -3937,9 +4058,19 @@ var PiAdapter = class {
         ...launcher.macosKeychainPath !== void 0 ? ["--macos-keychain-path", launcher.macosKeychainPath] : [],
         ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
         "--provider",
-        pinnedSelection.providerId,
+        providerProfile?.profileRef ?? (pinnedSelection.lane === "byok" ? pinnedSelection.providerId : ""),
         "--model",
-        pinnedSelection.modelId
+        providerProfile?.modelId ?? (pinnedSelection.lane === "byok" ? pinnedSelection.modelId : ""),
+        ...providerProfile === void 0 ? [] : [
+          "--profile-revision",
+          providerProfile.profileRevision,
+          "--profile-hash",
+          providerProfile.profileHash,
+          "--required-capabilities",
+          JSON.stringify(providerProfile.requiredCapabilities),
+          "--validate-only",
+          "false"
+        ]
       ];
     }
     return {
@@ -4082,8 +4213,42 @@ var PiAdapter = class {
     return (this.options.resolveBin ?? resolvePiBin)();
   }
 };
+async function validateProviderProfileBindingWithLauncher(binding, launcher) {
+  await execFileAsync(launcher.command, [
+    ...launcher.args ?? [],
+    "--pi-bin",
+    process.execPath,
+    "--profile-db",
+    launcher.profileDbPath,
+    "--session-dir",
+    launcher.sessionDir,
+    "--provider",
+    binding.profileRef,
+    "--model",
+    binding.modelId,
+    "--profile-revision",
+    binding.profileRevision,
+    "--profile-hash",
+    binding.profileHash,
+    "--required-capabilities",
+    JSON.stringify(binding.requiredCapabilities),
+    "--validate-only",
+    "true",
+    ...launcher.macosKeychainPath !== void 0 ? ["--macos-keychain-path", launcher.macosKeychainPath] : [],
+    ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : []
+  ], { timeout: DETECT_TIMEOUT_MS });
+}
 function sameDispatchSelection(left, right) {
   if (left === void 0 || right === void 0) return left === right;
+  if (left.lane === "byok-profile" || right.lane === "byok-profile") {
+    if (left.lane !== "byok-profile" || right.lane !== "byok-profile") return false;
+    if (left.runtimeId !== right.runtimeId) return false;
+    const leftProfile = left.providerProfile;
+    const rightProfile = right.providerProfile;
+    return leftProfile.profileRef === rightProfile.profileRef && leftProfile.profileRevision === rightProfile.profileRevision && leftProfile.profileHash === rightProfile.profileHash && leftProfile.modelId === rightProfile.modelId && leftProfile.requiredCapabilities.length === rightProfile.requiredCapabilities.length && leftProfile.requiredCapabilities.every(
+      (capability, index) => capability === rightProfile.requiredCapabilities[index]
+    );
+  }
   return left.lane === right.lane && left.runtimeId === right.runtimeId && left.providerId === right.providerId && left.modelId === right.modelId;
 }
 async function resolveAuthoritativeSessionId(rpc) {
@@ -6976,19 +7141,14 @@ function signNonce(privateKey, nonce) {
   const signature = sign(null, nonceSigningBytes(nonce), privateKey);
   return signature.toString("base64url");
 }
+
+// src/daemon/url.ts
 function toHttpBase(serverUrl) {
   const url = new URL(serverUrl);
-  if (url.protocol === "ws:") url.protocol = "http:";
-  else if (url.protocol === "wss:") url.protocol = "https:";
   url.pathname = "/";
   url.search = "";
   return url.toString();
 }
-function toWsUrl(serverUrl) {
-  const url = new URL(BYOK_WS_PATH, toHttpBase(serverUrl));
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  return url.toString();
-}
 function describeEndpoint(transport, url) {
   const parsed = typeof url === "string" ? new URL(url) : url;
   return { transport, host: parsed.host, path: parsed.pathname };
@@ -7021,17 +7181,15 @@ function assertServerUrlAllowed(rawUrl, opts = {}) {
   const endpoint = formatServerUrl(url);
   switch (url.protocol) {
     case "https:":
-    case "wss:":
       return;
     case "http:":
-    case "ws:":
       if (opts.dangerouslyAllowInsecureRemote || isLoopbackHostname(url.hostname)) return;
       throw new InsecureServerUrlError(
-        `refusing to connect to "${endpoint}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use wss:/https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
+        `refusing to connect to "${endpoint}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
       );
     default:
       throw new InsecureServerUrlError(
-        `refusing to connect to "${endpoint}" \u2014 unsupported scheme "${url.protocol}" (expected http:, https:, ws:, or wss:).`
+        `refusing to connect to "${endpoint}" \u2014 unsupported scheme "${url.protocol}" (expected http: or https:).`
       );
   }
 }
@@ -9083,7 +9241,7 @@ var LongPollRouteError = class extends Error {
 };
 var MAX_TRACKED_VALIDATION_FAILURE_WARNINGS = 1e3;
 var MAX_TRACKED_ROUTE_FAILURE_WARNINGS = 1e3;
-function parseLooseEventsPollResponse(raw) {
+function parseLooseEventsPollResponse(raw, requestedCursor) {
   if (typeof raw !== "object" || raw === null) {
     throw new Error("events poll response is not an object");
   }
@@ -9091,19 +9249,48 @@ function parseLooseEventsPollResponse(raw) {
   if (!Array.isArray(events)) {
     throw new Error("events poll response.events is not an array");
   }
-  if (typeof cursor !== "number" || !Number.isInteger(cursor)) {
-    throw new Error("events poll response.cursor is not an integer");
+  if (!isSafeNonnegativeInteger(cursor)) {
+    throw new Error("events poll response.cursor is not a safe nonnegative integer");
+  }
+  if (cursor < requestedCursor) {
+    throw new Error("events poll response.cursor regressed below the requested cursor");
   }
   if (capabilities !== void 0 && (!Array.isArray(capabilities) || capabilities.some((flag) => typeof flag !== "string"))) {
     throw new Error("events poll response.capabilities is not an array of strings");
   }
   return { events, cursor, capabilities: capabilities ?? [] };
 }
+function isSafeNonnegativeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function validateTrustedEventsPage(events, requestedCursor, pageCursor) {
+  let previousTaskSeq;
+  for (const raw of events) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const { type, seq } = raw;
+    if (typeof type !== "string" || !type.startsWith("task.")) continue;
+    if (!isSafeNonnegativeInteger(seq)) {
+      throw new Error("events poll task seq is not a safe nonnegative integer");
+    }
+    if (seq <= requestedCursor || seq > pageCursor) {
+      throw new Error("events poll task seq lies outside the trusted page cursor range");
+    }
+    if (previousTaskSeq !== void 0 && seq <= previousTaskSeq) {
+      throw new Error("events poll task seq is not strictly page ordered");
+    }
+    const knownTaskType = MESSAGE_TYPES.includes(type);
+    const predecessor = previousTaskSeq ?? requestedCursor;
+    if (!knownTaskType && seq !== predecessor + 1) {
+      throw new Error("events poll unknown task seq would cross an untrusted gap");
+    }
+    previousTaskSeq = seq;
+  }
+}
 function extractSkippableSeq(raw) {
   if (typeof raw !== "object" || raw === null) return void 0;
   const { type, seq } = raw;
   if (typeof type !== "string" || !type.startsWith("task.")) return void 0;
-  return typeof seq === "number" && Number.isInteger(seq) ? seq : void 0;
+  return isSafeNonnegativeInteger(seq) ? seq : void 0;
 }
 var LongPollClient = class {
   constructor(opts) {
@@ -9114,6 +9301,8 @@ var LongPollClient = class {
   }
   opts;
   running = false;
+  /** Owns exactly one active loop generation, including its held GET and retry delays. */
+  loopAbortController;
   /**
    * Finding R1: seqs this loop has already `console.warn`'d about for a
    * validation-failed (recognized-type, invalid-payload) entry — a poison
@@ -9173,16 +9362,22 @@ var LongPollClient = class {
   noteRevoked(err) {
     if (!(err instanceof DeviceRevokedError)) return false;
     this.running = false;
+    this.loopAbortController?.abort();
     this.opts.onRevoked?.();
     return true;
   }
   start() {
     if (this.running) return;
     this.running = true;
-    void this.loop();
+    const controller = new AbortController();
+    this.loopAbortController = controller;
+    void this.loop(controller.signal).finally(() => {
+      if (this.loopAbortController === controller) this.loopAbortController = void 0;
+    });
   }
   stop() {
     this.running = false;
+    this.loopAbortController?.abort();
   }
   /**
    * POST one batch of envelopes to `/byok/messages` (finding F6/protocol
@@ -9191,14 +9386,14 @@ var LongPollClient = class {
    * (`ConnectionHub.handleInbound`), so a resend of the SAME batch (same
    * envelope `id`s — the caller must never rebuild them) is deduped
    * server-side into a safe no-op rather than reprocessed (§9). Returns
-   * `true` once the server has accepted the batch.
+   * validated frozen-v1 counts only after a readable response body.
    */
   async postBatch(envelopes) {
     try {
       await this.opts.auth.getValidAccessToken();
     } catch (err) {
       this.noteRevoked(err);
-      return false;
+      return void 0;
     }
     let res;
     try {
@@ -9214,23 +9409,26 @@ var LongPollClient = class {
       );
     } catch (err) {
       if (!this.noteRevoked(err)) this.warnRouteFailure(this.messagesEndpoint, void 0, err);
-      return false;
+      return void 0;
     }
     if (!res.ok) {
       this.warnRouteFailure(this.messagesEndpoint, res.status, void 0);
-      return false;
+      return void 0;
     }
     try {
-      MessagesSendResponseSchema.parse(await res.json());
+      const response = MessagesSendResponseSchema.parse(await res.json());
+      if (response.accepted + (response.rejected ?? 0) !== envelopes.length) {
+        throw new Error("messages response counts do not match the posted batch length");
+      }
+      return response;
     } catch (err) {
       this.warnRouteFailure(this.messagesEndpoint, res.status, err);
-      return false;
+      return void 0;
     }
-    return true;
   }
-  async loop() {
+  async loop(signal) {
     let retryAttempt = 0;
-    while (this.running) {
+    while (this.running && !signal.aborted) {
       try {
         await this.opts.auth.getValidAccessToken();
         const base = toHttpBase(this.opts.serverUrl);
@@ -9239,8 +9437,9 @@ var LongPollClient = class {
         if (cursor !== void 0) url.searchParams.set("cursor", String(cursor));
         let res;
         try {
-          res = await authedFetch(url, { method: "GET" }, this.opts.auth);
+          res = await authedFetch(url, { method: "GET", signal }, this.opts.auth);
         } catch (err) {
+          if (signal.aborted) return;
           if (!(err instanceof DeviceRevokedError)) {
             this.warnRouteFailure(this.eventsEndpoint, void 0, err);
           }
@@ -9254,21 +9453,24 @@ var LongPollClient = class {
             return;
           }
           this.warnRouteFailure(this.eventsEndpoint, res.status, void 0);
-          this.opts.onServerCapabilities?.([]);
+          this.opts.onServerCapabilitiesInvalidated?.();
+          this.opts.onPollFailure?.();
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
-          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
           continue;
         }
         let parsed;
         try {
-          parsed = parseLooseEventsPollResponse(await res.json());
+          parsed = parseLooseEventsPollResponse(await res.json(), cursor ?? 0);
+          validateTrustedEventsPage(parsed.events, cursor ?? 0, parsed.cursor);
         } catch (err) {
           this.warnRouteFailure(this.eventsEndpoint, res.status, err);
           throw err;
         }
         this.opts.onServerCapabilities?.(parsed.capabilities);
         let hadValidationFailureThisBatch = false;
+        let acceptedAnyEntry = false;
         for (const raw of parsed.events) {
           let envelope;
           try {
@@ -9276,7 +9478,10 @@ var LongPollClient = class {
           } catch (err) {
             if (err instanceof UnknownMessageTypeError) {
               const skippableSeq = extractSkippableSeq(raw);
-              if (skippableSeq !== void 0) this.opts.onSkippedSeq?.(skippableSeq);
+              if (skippableSeq !== void 0) {
+                this.opts.onSkippedSeq?.(skippableSeq);
+                acceptedAnyEntry = true;
+              }
             } else {
               const failedSeq = extractSkippableSeq(raw);
               if (failedSeq !== void 0) {
@@ -9296,27 +9501,28 @@ var LongPollClient = class {
             }
             continue;
           }
-          this.opts.onEnvelope(envelope);
+          if (this.opts.onEnvelope(envelope) !== false) acceptedAnyEntry = true;
         }
         if (parsed.events.length === 0) {
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
-          await sleep(this.opts.idleDelayMs ?? 250);
-        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch) {
+          await sleep(this.opts.idleDelayMs ?? 250, signal);
+        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch || !acceptedAnyEntry && this.opts.getCursor() === cursor) {
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
-          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
         } else {
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
         }
       } catch (err) {
-        this.opts.onServerCapabilities?.([]);
+        this.opts.onServerCapabilitiesInvalidated?.();
         if (this.noteRevoked(err)) return;
-        if (!this.running) return;
+        if (!this.running || signal.aborted) return;
+        this.opts.onPollFailure?.();
         this.opts.onOperationalOutcome?.("failure");
         const baseMs = this.opts.retryDelayMs ?? 2e3;
-        await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+        await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
       }
     }
   }
@@ -9336,20 +9542,24 @@ async function parseReplayCursorTooOld(res) {
   }
   return new ReplayCursorTooOldError(recoverableFrom);
 }
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const finish = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolve();
+    };
+    const timer = setTimeout(finish, ms);
+    signal.addEventListener("abort", finish, { once: true });
+  });
 }
-var WsUnexpectedStatusError = class extends Error {
-  constructor(status, endpoint) {
-    super(`WS upgrade rejected with HTTP ${status} (ws ${endpoint.host}${endpoint.path})`);
-    this.status = status;
-    this.endpoint = endpoint;
-    this.name = "WsUnexpectedStatusError";
-  }
-  status;
-  endpoint;
-};
-function createConnectionHelloEnvelope(opts) {
+
+// src/daemon/connection-manager.ts
+function isCursorEnvelopeType(type) {
+  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
+}
+function createConnectionHelloEnvelope(opts, getCursor) {
   const configuredToolsets = opts.getConfiguredToolsets?.();
   return createEnvelope("conn.hello", {
     protocolVersions: [PROTOCOL_VERSION],
@@ -9359,222 +9569,32 @@ function createConnectionHelloEnvelope(opts) {
     clientVersion: opts.clientVersion,
     runtimes: opts.runtimes,
     configuredToolsets: configuredToolsets === void 0 ? void 0 : [...configuredToolsets],
-    cursor: opts.getCursor?.()
+    cursor: getCursor()
   });
 }
-var WsTransport = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  socket;
-  closedByUser = false;
-  autoReconnect = true;
-  acked = false;
-  everAckedThisAttempt = false;
-  reconnectAttempt = 0;
-  reconnectTimer;
-  livenessTimer;
-  lastActivity = 0;
-  lastUnexpectedStatus;
-  ackWaiters = [];
-  connect(opts = {}) {
-    this.autoReconnect = opts.auto ?? true;
-    this.closedByUser = false;
-    void this.openSocket();
-  }
-  /** Stop scheduling further reconnect attempts (any pending one is cancelled too); the current socket, if any, is left alone. Used when handing retry ownership to a slower external cadence (e.g. the long-poll fallback's periodic WS probe). */
-  stopAutoReconnect() {
-    this.autoReconnect = false;
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = void 0;
-    }
-  }
-  /** Resume normal auto-reconnect-on-close behavior (does not itself trigger a connect — only affects future closes). */
-  resumeAutoReconnect() {
-    this.autoReconnect = true;
-  }
-  get isOpen() {
-    return this.acked;
-  }
-  /**
-   * Attempt to send ONE envelope right now; returns whether it actually went
-   * out. `false` means the socket isn't currently open+acked — the caller
-   * (`ConnectionManager.drainOutbox`, Design B/finding N4) owns re-queueing
-   * and retrying later (e.g. on the next `onAcked`), since this transport no
-   * longer buffers anything itself.
-   */
-  sendNow(envelope) {
-    if (this.socket && this.socket.readyState === WebSocket.OPEN && this.acked) {
-      this.socket.send(encodeEnvelope(envelope));
-      return true;
-    }
-    return false;
-  }
-  waitForAck(timeoutMs = 1e4) {
-    if (this.acked) return Promise.resolve();
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error("Timed out waiting for conn.ack")), timeoutMs);
-      this.ackWaiters.push({
-        resolve: () => {
-          clearTimeout(timer);
-          resolve();
-        },
-        reject: (err) => {
-          clearTimeout(timer);
-          reject(err);
-        }
-      });
-    });
-  }
-  close() {
-    this.closedByUser = true;
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.socket?.close();
-  }
-  async openSocket() {
-    const url = toWsUrl(this.opts.serverUrl);
-    const endpoint = describeEndpoint("ws", url);
-    this.acked = false;
-    this.everAckedThisAttempt = false;
-    this.opts.onStateChange?.("connecting");
-    let token;
-    try {
-      token = await this.opts.getToken();
-    } catch (err) {
-      this.opts.onStateChange?.("closed");
-      this.opts.onConnectOutcome?.(false, err, endpoint);
-      if (!this.closedByUser && this.autoReconnect) this.scheduleReconnect();
-      return;
-    }
-    const socket = new WebSocket(url, {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    this.socket = socket;
-    this.lastActivity = Date.now();
-    this.startLivenessCheck(socket);
-    socket.on("open", () => {
-      const hello = createConnectionHelloEnvelope(this.opts);
-      socket.send(encodeEnvelope(hello));
-    });
-    socket.on("ping", () => {
-      this.lastActivity = Date.now();
-    });
-    socket.on("message", (data, isBinary) => {
-      this.lastActivity = Date.now();
-      const bytes = toBytes(data);
-      let envelope;
-      try {
-        envelope = decodeEnvelope(bytes);
-      } catch {
-        return;
-      }
-      if (envelope.type === "conn.ack") {
-        this.reconnectAttempt = 0;
-        this.acked = true;
-        this.everAckedThisAttempt = true;
-        this.opts.onStateChange?.("open");
-        for (const waiter of this.ackWaiters.splice(0)) waiter.resolve();
-        this.opts.onAcked?.(envelope.payload.capabilities);
-      }
-      this.opts.onEnvelope(envelope);
-    });
-    socket.on("close", (code, reason) => {
-      this.socket = void 0;
-      this.stopLivenessCheck();
-      this.opts.onStateChange?.("closed");
-      const acked = this.everAckedThisAttempt;
-      const status = this.lastUnexpectedStatus;
-      this.lastUnexpectedStatus = void 0;
-      const replayCursorTooOld = code === 1008 && reason.toString("utf8") === "cursor_too_old" ? new ReplayCursorTooOldError() : void 0;
-      this.opts.onConnectOutcome?.(
-        acked,
-        replayCursorTooOld ?? (status !== void 0 ? new WsUnexpectedStatusError(status, endpoint) : void 0),
-        endpoint
-      );
-      if (!this.closedByUser && this.autoReconnect) this.scheduleReconnect();
-    });
-    socket.on("error", () => {
-    });
-    socket.on("unexpected-response", (_req, res) => {
-      this.lastUnexpectedStatus = res.statusCode;
-      res.resume();
-      socket.terminate();
-    });
-  }
-  scheduleReconnect() {
-    const { baseMs = 1e3, maxMs = 3e4, factor = 2 } = this.opts.backoff ?? {};
-    const delay5 = Math.min(maxMs, baseMs * factor ** this.reconnectAttempt);
-    const jitter = this.opts.reconnectDelayMs?.(this.reconnectAttempt, delay5) ?? delay5;
-    this.reconnectAttempt += 1;
-    this.reconnectTimer = setTimeout(() => void this.openSocket(), jitter);
-  }
-  startLivenessCheck(socket) {
-    const { timeoutMs = 75e3, checkIntervalMs = Math.max(1e3, Math.floor(timeoutMs / 3)) } = this.opts.liveness ?? {};
-    this.livenessTimer = setInterval(() => {
-      if (Date.now() - this.lastActivity > timeoutMs) {
-        socket.terminate();
-      }
-    }, checkIntervalMs);
-    this.livenessTimer.unref?.();
-  }
-  stopLivenessCheck() {
-    if (this.livenessTimer) {
-      clearInterval(this.livenessTimer);
-      this.livenessTimer = void 0;
-    }
-  }
-};
-function toBytes(data, _isBinary) {
-  if (Buffer.isBuffer(data)) return data;
-  if (Array.isArray(data)) return Buffer.concat(data);
-  if (data instanceof ArrayBuffer) return new Uint8Array(data);
-  return Buffer.from(String(data), "utf8");
-}
-
-// src/daemon/connection-manager.ts
-function isCursorEnvelopeType(type) {
-  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
-}
+var MAX_REJECTED_OUTBOX_ENTRIES = 1e3;
 var ConnectionManager = class {
   constructor(opts) {
     this.opts = opts;
     this.fleetJitter = opts.fleetJitter ?? createFleetJitter(opts.productId, opts.deviceId);
-    this.ws = new WsTransport({
-      serverUrl: opts.serverUrl,
-      getToken: () => opts.auth.getValidAccessToken(),
-      deviceId: opts.deviceId,
-      productId: opts.productId,
-      capabilities: opts.capabilities,
-      clientVersion: opts.clientVersion,
-      runtimes: opts.runtimes,
-      getConfiguredToolsets: opts.getConfiguredToolsets,
-      getCursor: () => this.cursor,
-      onEnvelope: (envelope) => this.deliver(envelope),
-      onStateChange: (state) => {
-        if (!this.stopped && !this.revoked) this.opts.onStateChange?.(state);
-      },
-      onAcked: (capabilities) => this.onAcked(capabilities),
-      onConnectOutcome: (acked, err) => this.onWsOutcome(acked, err),
-      backoff: opts.backoff,
-      liveness: opts.liveness,
-      reconnectDelayMs: (attempt, baseMs) => this.fleetJitter.delay("reconnect", attempt, baseMs)
-    });
     this.longPoll = new LongPollClient({
       serverUrl: opts.serverUrl,
       auth: opts.auth,
-      // Design A: the query cursor for the NEXT `GET /byok/events` is the
-      // same watermark `deliver()` dedupes against (see `dedupWatermark`) —
-      // normally the eager `deliveredSeq` (so an in-flight envelope isn't
-      // re-pulled), but the durable `cursor` while `stalledAtSeq` is set, so
-      // the failed envelope (and everything after it) IS re-pulled and
-      // re-attempted.
-      getCursor: () => this.dedupWatermark(),
+      // The long-poll query cursor is also the kernel's irreversible ack.
+      // Only report the successfully processed cursor here. `deliveredSeq`
+      // remains a local dedup watermark; using it on the wire would ack an
+      // in-flight envelope before its handler settles and make a later
+      // failure impossible to redeliver.
+      getCursor: () => this.cursor,
       onEnvelope: (envelope) => this.deliver(envelope),
       onServerCapabilities: (capabilities) => {
-        if (this.mode === "long-poll") this.serverCapabilities = capabilities;
+        this.serverCapabilities = capabilities;
+        this.noteConnected();
       },
+      onServerCapabilitiesInvalidated: () => {
+        this.serverCapabilities = [];
+      },
+      onPollFailure: () => this.noteDisconnected(),
       onRevoked: () => this.enterRevoked(),
       onReplayCursorTooOld: (error) => this.enterReplayCursorTooOld(error),
       // M4 Phase 4 (version-negotiation drill fix): a batch entry
@@ -9602,13 +9622,10 @@ var ConnectionManager = class {
   }
   opts;
   fleetJitter;
-  ws;
   longPoll;
-  mode = "ws";
-  consecutiveFailures = 0;
-  wsRetryTimer;
-  wsProbeSequence = 0;
   uploadRetryAttempt = 0;
+  started = false;
+  connected = false;
   cursor;
   /**
    * Finding F3 (at-most-once redelivery): the lowest `task.*` envelope `seq`
@@ -9630,10 +9647,9 @@ var ConnectionManager = class {
    * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
    * advances eagerly, the instant a `task.*` envelope is admitted past
    * dedup (see `deliver`/`noteDelivered`), independent of whether its
-   * handler has even started, let alone succeeded. It exists so a
-   * long-poll re-query (`LongPollClient`'s `getCursor`) doesn't re-pull an
-   * envelope that's already been delivered once and is still in flight —
-   * `handleOffer` is NOT idempotent and must never be re-pulled while a
+   * handler has even started, let alone succeeded. It exists so a repeated
+   * read at the durable cursor does not re-dispatch an envelope already in
+   * flight — `handleOffer` must not start a second adapter session while a
    * first attempt is still running. On WS this same field is written the
    * same way, but since a live WS connection only ever pushes a given `seq`
    * once, it never has an observable effect there beyond mirroring
@@ -9644,18 +9660,18 @@ var ConnectionManager = class {
   /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
   processingChain = Promise.resolve();
   /**
-   * Design B (finding N4): the ONE outbound queue both transports drain
-   * from — holds `Envelope` OBJECTS, never re-encoded/rebuilt strings, so a
+   * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
+   * never re-encoded/rebuilt strings, so a
    * resend after a failed send attempt is byte-identical to the original
    * (same `id`), which is what lets the server's per-(deviceId,id) dedup
    * (Wave 1) recognize it as a safe no-op retry rather than a second
-   * application (protocol §9). A transport switch (long-poll <-> WS) never
-   * touches this queue — see `drainOutbox` — so nothing queued while one
-   * transport was active is ever stranded when the other takes over.
+   * application (protocol §9).
    */
   outbox = [];
+  /** Terminally rejected outbound envelopes, retained as a bounded observable quarantine. */
+  rejectedOutboundEnvelopes = [];
   /**
-   * Finding F5(b): how many envelopes `drainOutbox`'s long-poll branch has
+   * Finding F5(b): how many envelopes `drainOutbox` has
    * currently spliced OUT of `this.outbox` for an in-flight (not yet
    * confirmed delivered) `postBatch` call — 0 the rest of the time. See
    * `outboxLength`'s own doc comment for why this needs to be tracked
@@ -9708,39 +9724,22 @@ var ConnectionManager = class {
    */
   cancelPendingDrainRetry;
   /**
-   * The capabilities the CURRENT transport's server advertised — untyped
-   * `string[]` for forward compatibility. WS populates it from `conn.ack`;
-   * long-poll populates it from each successful events response. Empty until
-   * the active transport supplies an advertisement.
-   *
-   * Finding R2 (cross-model re-review — was P1): strictly PER-CONNECTION,
-   * not per-daemon-lifetime. Cleared to `[]` the instant the acked WS
-   * connection ends for ANY reason — an ordinary disconnect (`onWsOutcome`'s
-   * `acked` branch), `stop()`, or a transport switch to long-poll
-   * (`enterLongPoll`) — and only repopulated by a fresh advertisement from
-   * the transport that is still current.
-   * The previous version of this doc comment claimed long-poll mode simply
-   * "stays at whatever the last real WS `conn.ack` said" — that was the bug:
-   * a daemon that once learned e.g. `approval_resolved` from an earlier WS
-   * session kept believing it applied to whatever it's connected to NOW,
-   * even after a disconnect/degrade where nothing has actually confirmed
-   * that's still true (a reconnect could land on a DIFFERENT server behind a
-   * load balancer). Concretely, `TaskRunner.sendApprovalResolved` gates
-   * `task.approval_resolved` on this list — sending it to a server that
-   * doesn't actually understand it over the long-poll path would get a
-   * batch-level 400 from `MessagesSendRequestSchema` (protocol §8.2), which
-   * `drainOutbox`'s retry-the-same-batch-forever loop then head-of-line
-   * blocks EVERY envelope queued behind it on, permanently. Clearing this
-   * eagerly means that gate reliably fails closed (falls back to the
-   * pre-existing implicit-resume inference, unconditionally — see
-   * `sendApprovalResolved`'s own doc comment) the moment the connection that
-   * advertised the capability is no longer the one actually in use.
+   * The capabilities the current server response advertised — untyped
+   * `string[]` for forward compatibility. An advertisement is scoped to the
+   * current long-poll response stream and is cleared after an HTTP failure,
+   * terminal shutdown, or revocation. This keeps capability-gated outbound
+   * messages fail-closed until the current server has explicitly advertised
+   * support.
    */
   serverCapabilities = [];
   async start() {
     if (this.terminalError) throw this.terminalError;
     this.cursor = await this.opts.cursorStore.load(this.opts.serverUrl, this.opts.deviceId);
-    this.ws.connect({ auto: true });
+    this.started = true;
+    this.opts.onStateChange?.("connecting");
+    this.longPoll.start();
+    this.outbox.unshift(createConnectionHelloEnvelope(this.opts, () => this.cursor));
+    void this.drainOutbox();
   }
   /**
    * Design B (finding N4): push onto the single shared outbox and try to
@@ -9751,17 +9750,13 @@ var ConnectionManager = class {
     this.outbox.push(envelope);
     void this.drainOutbox();
   }
+  /** Publish a fresh local configuration snapshot while this daemon is running. */
+  refreshHello() {
+    if (!this.started || this.stopped || this.revoked || this.terminalError) return;
+    this.send(createConnectionHelloEnvelope(this.opts, () => this.cursor));
+  }
   /**
-   * Design B (finding N4): drain the shared outbox through whichever
-   * transport is currently active, re-checking `this.mode` fresh on every
-   * iteration so a transport switch mid-drain is picked up immediately
-   * rather than fighting a stale decision made before the switch.
-   *
-   * WS: a synchronous, one-at-a-time `sendNow` per envelope while open+
-   * acked; stops (without dropping anything — the remainder stays queued)
-   * the moment it isn't, and is re-invoked once `onAcked` fires.
-   *
-   * Long-poll: POSTs the outbox in chunks of at most
+   * POSTs the outbox through long-poll in chunks of at most
    * `MAX_MESSAGES_PER_BATCH` (finding P1) — the server hard-caps a single
    * `/byok/messages` batch there (`MessagesSendRequestSchema`, protocol
    * §8.2) and 400s the WHOLE request if it's exceeded, which — before this
@@ -9773,43 +9768,48 @@ var ConnectionManager = class {
    * failure that SAME chunk is unshifted back (order-preserving, same
    * Envelope objects/ids — never rebuilt, so a retry is exactly the resend
    * Wave 1's server-side dedup expects) and retried after a short backoff,
-   * re-reading `this.mode` each time so a WS recovery that happens
-   * mid-retry is honored on the very next loop iteration instead of only
-   * after this attempt's backoff chain gives up.
-   *
    * Re-entrancy is guarded by `draining`: a call arriving while a drain is
    * already in progress just returns — the in-progress loop's own
-   * `while (this.outbox.length > 0)` check will pick up anything newly
-   * pushed (or left over after a mode switch) on its very next iteration.
+   * `while (this.outbox.length > 0)` check picks up anything newly pushed.
    */
   async drainOutbox() {
-    if (this.draining) return;
+    if (!this.started || this.draining) return;
     this.draining = true;
+    const isolateRejectedBatch = async (batch) => {
+      const pending = [[...batch]];
+      while (pending.length > 0) {
+        if (this.stopped || this.revoked) return pending.flat();
+        const segment = pending.shift();
+        const result = await this.longPoll.postBatch(segment);
+        if (result === void 0) return [...segment, ...pending.flat()];
+        if ((result.rejected ?? 0) === 0) continue;
+        if (segment.length === 1) {
+          this.quarantineRejectedOutbound(segment[0], "inbound_rejected");
+          continue;
+        }
+        const midpoint = Math.floor(segment.length / 2);
+        pending.unshift(segment.slice(0, midpoint), segment.slice(midpoint));
+      }
+      return void 0;
+    };
     try {
       while (this.outbox.length > 0) {
         if (this.stopped || this.revoked) return;
-        if (this.mode === "ws") {
-          if (!this.ws.isOpen) return;
-          const envelope = this.outbox[0];
-          if (!this.ws.sendNow(envelope)) return;
-          this.outbox.shift();
-          continue;
-        }
         const batch = this.outbox.splice(0, MAX_MESSAGES_PER_BATCH);
         this.inFlightBatchSize = batch.length;
-        let ok;
+        let retrySegments;
         try {
-          ok = await this.longPoll.postBatch(batch);
+          retrySegments = await isolateRejectedBatch(batch);
         } finally {
           this.inFlightBatchSize = 0;
         }
-        if (ok) {
+        if (retrySegments === void 0) {
           this.uploadRetryAttempt = 0;
           this.opts.onOperationalOutcome?.("success", "upload");
           continue;
         }
         this.opts.onOperationalOutcome?.("failure", "upload");
-        this.outbox.unshift(...batch);
+        this.outbox.unshift(...retrySegments);
         if (this.stopped || this.revoked) return;
         const baseMs = this.opts.longPollRetryDelayMs ?? 2e3;
         await this.drainRetryDelay(this.fleetJitter.delay("upload", this.uploadRetryAttempt++, baseMs));
@@ -9825,8 +9825,7 @@ var ConnectionManager = class {
    * in-flight wait immediately instead of leaving `drainOutbox` parked here
    * for up to the rest of the delay before it next checks `this.revoked` —
    * and (b) unref'd, so the timer never keeps the Node process alive by
-   * itself while nothing else (a live long-poll GET, an open WS connection)
-   * legitimately is.
+   * itself while nothing else (such as the live long-poll GET) legitimately is.
    */
   drainRetryDelay(ms) {
     return new Promise((resolve) => {
@@ -9842,14 +9841,9 @@ var ConnectionManager = class {
       };
     });
   }
-  isTransportDegraded() {
-    return this.mode === "long-poll";
-  }
   /**
-   * The capabilities the CURRENT transport's server advertised: from
-   * `conn.ack` on WS, or the latest successful `GET /byok/events` response
-   * on long-poll. Empty before either transport has supplied its current
-   * advertisement, and cleared across disconnect/switch boundaries.
+   * The capabilities the latest successful `GET /byok/events` response
+   * advertised. Empty before a successful response and after a failed one.
    */
   getServerCapabilities() {
     return this.serverCapabilities;
@@ -9857,29 +9851,23 @@ var ConnectionManager = class {
   getTerminalError() {
     return this.terminalError;
   }
-  getMode() {
-    return this.mode;
-  }
   isConnected() {
-    return this.mode === "ws" && this.ws.isOpen;
+    return this.connected;
   }
   isRevoked() {
     return this.revoked;
   }
   /**
-   * Resolves once the connection has settled — either a working, acked WS
-   * connection, or the long-poll fallback taking over (protocol §8). This
-   * lets `daemon.start()` return promptly even when WS is unavailable from
-   * the very first attempt, rather than hanging until a WS `conn.ack` that
-   * may never come.
+   * Resolves after the first successful long-poll response establishes the
+   * authenticated connection.
    *
    * Rejects with {@link DeviceRevokedError} — instead of hanging until
    * `timeoutMs` — if the device turns out to be revoked while settling (or
    * already was): a cold `daemon.start()` against an already-revoked device
    * must fail fast, not surface a generic timeout (protocol §6.3).
    */
-  waitForAck(timeoutMs = 1e4) {
-    if (this.ws.isOpen || this.mode === "long-poll") return Promise.resolve();
+  waitForConnection(timeoutMs = 1e4) {
+    if (this.connected) return Promise.resolve();
     if (this.terminalError) return Promise.reject(this.terminalError);
     if (this.revoked) return Promise.reject(new DeviceRevokedError());
     return new Promise((resolve, reject) => {
@@ -9887,7 +9875,7 @@ var ConnectionManager = class {
       };
       const timer = setTimeout(() => {
         this.settledWaiters = this.settledWaiters.filter((w) => w !== settle);
-        reject(new Error("Timed out waiting for the connection to settle (WS ack or long-poll fallback)"));
+        reject(new Error("Timed out waiting for the long-poll connection to settle"));
       }, timeoutMs);
       settle = (err) => {
         clearTimeout(timer);
@@ -9898,7 +9886,7 @@ var ConnectionManager = class {
     });
   }
   /**
-   * Stops both transports and waits for every in-flight envelope handler
+   * Stops the long-poll transport and waits for every in-flight envelope handler
    * (the F3 FIFO chain) and the most recent cursor write to actually land on
    * disk — otherwise a `stop()` racing a just-processed envelope's
    * persistence could lose that cursor advance, or leave a handler running
@@ -9907,14 +9895,14 @@ var ConnectionManager = class {
    * Finding F5(b) (cross-model adversarial review): `drainTimeoutMs`, when
    * passed, bounds how long this waits for the shared outbox (`this.outbox`
    * — Design B) to actually finish draining BEFORE flipping `this.stopped`
-   * and closing the transports. Before this fix, `stop()` set `stopped`
+   * and stopping the transport. Before this fix, `stop()` set `stopped`
    * synchronously and never waited for `drainOutbox` at all: an envelope
    * `send()` had just pushed moments earlier (e.g. `TaskRunner.shutdownTask`'s
    * own `task.fail`, sent right before `create-daemon.ts`'s
    * `performControlShutdown` calls this) could still be sitting UNSENT in
    * `this.outbox` — mid long-poll retry backoff, or simply not yet picked up
    * by the fire-and-forget `drainOutbox()` `send()` kicked off — and this
-   * method would happily proceed to `stopped = true` / `ws.close()` regardless,
+   * method would happily proceed to `stopped = true` regardless,
    * after which NOTHING ever drains it again: silently lost, even though
    * `TaskRunner` believed it had been sent. `drainTimeoutMs` omitted (the
    * default) preserves the EXACT prior behavior for every other existing
@@ -9931,9 +9919,9 @@ var ConnectionManager = class {
     }
     this.stopped = true;
     this.serverCapabilities = [];
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
     this.longPoll.stop();
-    this.ws.close();
+    this.connected = false;
+    this.opts.onStateChange?.("closed");
     await this.processingChain;
     await this.pendingCursorSave;
   }
@@ -9958,6 +9946,10 @@ var ConnectionManager = class {
   outboxLength() {
     return this.outbox.length + this.inFlightBatchSize;
   }
+  /** A bounded terminal quarantine for operator inspection; these entries are never retried. */
+  rejectedOutbox() {
+    return this.rejectedOutboundEnvelopes;
+  }
   /**
    * Finding F5(b): polls {@link outboxLength} (not `this.outbox.length`
    * alone — see that method's own doc comment for why a spliced-out,
@@ -9965,15 +9957,14 @@ var ConnectionManager = class {
    * a single `drainOutbox()` promise directly — a drain in progress can
    * itself loop through multiple retry/backoff cycles (`drainRetryDelay`)
    * while the server is unreachable, and a fresh, INDEPENDENT
-   * `drainOutbox()` call can also be triggered concurrently (`send()`, a
-   * mode switch's own `void this.drainOutbox()`) — polling the one thing
+   * `drainOutbox()` call can also be triggered concurrently (`send()`) —
+   * polling the one thing
    * that actually matters (is anything still undelivered) can never go
    * stale the way capturing one specific in-flight promise reference
    * could. Kicks off one more `drainOutbox()` attempt itself first
    * (harmless no-op if one is already running — see its own re-entrancy
-   * guard) in case nothing is currently actively retrying (e.g. WS just
-   * dropped and long-poll hasn't taken over yet), so this bounded wait
-   * isn't just passively hoping something else happens to be making
+   * guard) in case nothing is currently actively retrying, so this bounded
+   * wait isn't just passively hoping something else happens to be making
    * progress.
    */
   waitForOutboxDrained(timeoutMs) {
@@ -10016,19 +10007,21 @@ var ConnectionManager = class {
   deliver(envelope) {
     const tracked = isCursorEnvelopeType(envelope.type) && typeof envelope.seq === "number";
     const watermark = this.dedupWatermark();
-    if (tracked && watermark !== void 0 && envelope.seq <= watermark) return;
+    if (tracked && watermark !== void 0 && envelope.seq <= watermark) return false;
     if (tracked) {
       const seq = envelope.seq;
-      if (this.inFlightSeqs.has(seq) || this.processedSeqs.has(seq)) return;
+      if (this.inFlightSeqs.has(seq) || this.processedSeqs.has(seq)) return false;
       this.inFlightSeqs.add(seq);
       this.noteDelivered(seq);
     }
     this.processingChain = this.processingChain.then(() => this.process(envelope, tracked));
+    return true;
   }
   /**
-   * Design A: the watermark `deliver()` dedupes inbound `task.*` envelopes
-   * against, and the same value `LongPollClient` queries the next
-   * `GET /byok/events` cursor with (see the constructor). Normally this is
+   * The local watermark `deliver()` dedupes inbound `task.*` envelopes
+   * against. It is deliberately NOT the long-poll query cursor: that query
+   * is the kernel acknowledgement and uses only the successfully processed
+   * `cursor` (see the constructor). Normally this local watermark is
    * `deliveredSeq` — which is always >= `cursor` (every envelope that
    * reaches `advanceCursor` already passed through `noteDelivered` first,
    * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
@@ -10044,11 +10037,9 @@ var ConnectionManager = class {
    * whose outcome wasn't known yet. No separate "reset deliveredSeq on
    * reconnect" step is needed for this to be correct — collapsing to
    * `cursor` exactly while stalled already produces the right answer on
-   * every redelivery path (long-poll re-query AND a WS reconnect's
-   * backlog replay alike), and NOT resetting it unconditionally on every
-   * reconnect is what lets `deliveredSeq` keep doing its job of not
-   * re-pulling/re-dispatching something already in flight across a
-   * reconnect that happens to land while a handler is still running.
+   * every long-poll retry path. NOT resetting it unconditionally on every
+   * retry lets `deliveredSeq` keep doing its job of not re-dispatching
+   * something already in flight while a handler is still running.
    */
   dedupWatermark() {
     return this.stalledAtSeq !== void 0 ? this.cursor : this.deliveredSeq ?? this.cursor;
@@ -10066,11 +10057,13 @@ var ConnectionManager = class {
       }
       await this.opts.onEnvelope(envelope);
       if (!tracked) return;
-      this.processedSeqs.add(seq);
-      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) return;
+      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) {
+        this.processedSeqs.add(seq);
+        return;
+      }
       this.stalledAtSeq = void 0;
+      await this.advanceCursor(envelope.seq);
       this.processedSeqs.clear();
-      this.advanceCursor(envelope.seq);
     } catch (err) {
       if (tracked && this.stalledAtSeq === void 0) this.stalledAtSeq = envelope.seq;
       console.error(
@@ -10084,9 +10077,8 @@ var ConnectionManager = class {
   /**
    * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
    * for a batch entry it could not parse into a known `Envelope` at all (an
-   * unrecognized message type — mirrors `ws-transport.ts`'s identical
-   * per-frame tolerance, see `long-poll-transport.ts`'s own doc comment on
-   * `parseLooseEventsPollResponse`) but which still carried a numeric,
+   * unrecognized message type (see `long-poll-transport.ts`'s own doc
+   * comment on `parseLooseEventsPollResponse`) but which still carried a numeric,
    * task-class envelope-level `seq` (the caller only invokes this for a
    * `task.`-prefixed type — see `long-poll-transport.ts`'s own
    * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
@@ -10126,7 +10118,7 @@ var ConnectionManager = class {
    * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
    * called immediately, unconditionally, regardless of `stalledAtSeq` —
    * matching `deliver()`'s own eager, unconditional call for a real
-   * envelope: its only job is "don't re-pull something already handed off,"
+   * envelope: its only job is "don't re-dispatch something already handed off,"
    * independent of outcome, and that property does not depend on FIFO
    * ordering the way the DURABLE cursor does.
    *
@@ -10146,9 +10138,18 @@ var ConnectionManager = class {
    */
   noteSkippedSeq(seq) {
     this.noteDelivered(seq);
-    this.processingChain = this.processingChain.then(() => {
+    this.processingChain = this.processingChain.then(async () => {
       if (this.stalledAtSeq === void 0 || seq === this.stalledAtSeq) {
-        this.advanceCursor(seq);
+        try {
+          await this.advanceCursor(seq);
+          if (this.stalledAtSeq === seq) this.stalledAtSeq = void 0;
+        } catch (err) {
+          if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
+          console.error(
+            `[byok/client] unknown task seq=${seq} could not durably persist its cursor; cursor left unadvanced for redelivery:`,
+            err
+          );
+        }
       }
     });
   }
@@ -10194,113 +10195,52 @@ var ConnectionManager = class {
       if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
     });
   }
-  advanceCursor(seq) {
+  async advanceCursor(seq) {
     if (this.cursor !== void 0 && seq <= this.cursor) return;
+    const save = this.pendingCursorSave.catch(() => void 0).then(() => this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, seq));
+    this.pendingCursorSave = save;
+    await save;
     this.cursor = seq;
-    this.pendingCursorSave = this.pendingCursorSave.catch(() => {
-    }).then(() => this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, seq)).catch(() => {
-    });
-  }
-  /**
-   * Fires the moment a connection attempt reaches `conn.ack` — independent
-   * of whether/when it later closes. This is the ONLY place that can
-   * reliably detect "WS is back up" while long-polling: a healthy
-   * connection stays open indefinitely, so it never reaches `onWsOutcome`
-   * (which is close-only) at all.
-   */
-  onAcked(capabilities) {
-    if (this.terminalError) return;
-    this.serverCapabilities = capabilities;
-    this.consecutiveFailures = 0;
-    this.notifySettled();
-    this.opts.onOperationalOutcome?.("success", "reconnect");
-    if (this.mode === "long-poll") this.exitLongPoll();
-    void this.drainOutbox();
   }
-  onWsOutcome(acked, err) {
-    if (err instanceof ReplayCursorTooOldError) {
-      this.enterReplayCursorTooOld(err);
-      return;
-    }
-    if (this.stopped || this.revoked) return;
-    if (acked) this.serverCapabilities = [];
-    if (err instanceof WsUnexpectedStatusError && err.status === 401) {
-      this.opts.auth.handleUnauthorized().catch((renewErr) => {
-        if (renewErr instanceof DeviceRevokedError) this.enterRevoked();
-      });
-    }
-    if (acked) return;
-    this.opts.onOperationalOutcome?.("failure", "reconnect");
-    this.consecutiveFailures += 1;
-    if (this.mode === "ws" && this.consecutiveFailures >= (this.opts.wsFailureThreshold ?? 3)) {
-      this.enterLongPoll();
-    }
+  quarantineRejectedOutbound(envelope, reason) {
+    if (this.rejectedOutboundEnvelopes.length === MAX_REJECTED_OUTBOX_ENTRIES) this.rejectedOutboundEnvelopes.shift();
+    this.rejectedOutboundEnvelopes.push({ envelope, reason });
+    console.error(
+      `[byok/client] outbound envelope ${envelope.id} was permanently rejected (${reason}) and moved to the terminal quarantine.`
+    );
   }
   notifySettled(err) {
     for (const waiter of this.settledWaiters.splice(0)) waiter(err);
   }
-  enterLongPoll() {
-    this.mode = "long-poll";
-    this.serverCapabilities = [];
-    this.ws.stopAutoReconnect();
-    this.opts.onStateChange?.("degraded");
-    this.longPoll.start();
-    this.outbox.unshift(createConnectionHelloEnvelope({
-      deviceId: this.opts.deviceId,
-      productId: this.opts.productId,
-      capabilities: this.opts.capabilities,
-      clientVersion: this.opts.clientVersion,
-      runtimes: this.opts.runtimes,
-      getConfiguredToolsets: this.opts.getConfiguredToolsets,
-      getCursor: () => this.cursor
-    }));
+  noteConnected() {
+    if (this.connected || this.stopped || this.revoked || this.terminalError) return;
+    this.connected = true;
+    this.opts.onStateChange?.("open");
     this.notifySettled();
-    void this.drainOutbox();
-    this.scheduleWsProbe();
+  }
+  noteDisconnected() {
+    if (!this.connected || this.stopped || this.revoked || this.terminalError) return;
+    this.connected = false;
+    this.opts.onStateChange?.("connecting");
   }
   enterReplayCursorTooOld(error) {
     if (this.terminalError) return;
     this.terminalError = error;
     this.stopped = true;
     this.serverCapabilities = [];
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
     this.longPoll.stop();
-    this.ws.stopAutoReconnect();
-    this.ws.close();
+    this.connected = false;
     this.cancelPendingDrainRetry?.();
     this.notifySettled(error);
     this.opts.onStateChange?.("closed");
     this.opts.onTerminalError?.(error);
   }
-  exitLongPoll() {
-    if (this.wsRetryTimer) {
-      clearInterval(this.wsRetryTimer);
-      this.wsRetryTimer = void 0;
-    }
-    this.longPoll.stop();
-    this.mode = "ws";
-    this.consecutiveFailures = 0;
-    this.ws.resumeAutoReconnect();
-    void this.drainOutbox();
-  }
-  scheduleWsProbe() {
-    const baseMs = this.opts.wsRetryIntervalMs ?? 5 * 60 * 1e3;
-    const delayMs = this.fleetJitter.delay("reconnect", this.wsProbeSequence++, baseMs);
-    const timer = setTimeout(() => {
-      this.wsRetryTimer = void 0;
-      if (this.stopped || this.revoked || this.mode !== "long-poll") return;
-      this.ws.connect({ auto: false });
-      this.scheduleWsProbe();
-    }, delayMs);
-    timer.unref?.();
-    this.wsRetryTimer = timer;
-  }
   enterRevoked() {
     if (this.revoked) return;
     this.revoked = true;
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
+    this.serverCapabilities = [];
     this.longPoll.stop();
-    this.ws.close();
+    this.connected = false;
     this.cancelPendingDrainRetry?.();
     this.opts.onStateChange?.("revoked");
     this.notifySettled(new DeviceRevokedError());
@@ -13668,6 +13608,7 @@ function resultDocumentRejectionDetail(check) {
   }
 }
 var DEFAULT_MAX_TASK_OUTPUT_BYTES = 64 * 1024 * 1024;
+var DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME = 1;
 function isKnownRuntimeId(id) {
   return RuntimeIdSchema.safeParse(id).success;
 }
@@ -13914,6 +13855,10 @@ var TaskRunner = class {
   get maxTaskOutputBytes() {
     return this.deps.maxTaskOutputBytes ?? DEFAULT_MAX_TASK_OUTPUT_BYTES;
   }
+  /** WP0: effective per-canonical-Agent-home Attempt cap — see {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}. */
+  get maxConcurrentMutableSessionsPerAgentHome() {
+    return this.deps.maxConcurrentMutableSessionsPerAgentHome ?? DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME;
+  }
   /**
    * M4 Phase 4 (part B.3, observability): per-active-task queue watermarks
    * for the control socket's `status` result — see
@@ -14303,6 +14248,24 @@ var TaskRunner = class {
         decline("strict Agent-only daemon refuses legacy task offers", false);
         return;
       }
+      if (agentRef !== void 0) {
+        const limit = this.maxConcurrentMutableSessionsPerAgentHome;
+        let canonicalHome;
+        try {
+          canonicalHome = await this.deps.agentHome.layout.canonicalHomePath(agentRef);
+        } catch (error) {
+          decline(
+            `Agent home admission failed: ${errorMessage5(error)}`,
+            !(error instanceof AgentHomeResolutionError)
+          );
+          return;
+        }
+        const active2 = this.deps.agentHome.executionLeaseManager.activeAttemptCount(canonicalHome);
+        if (active2 >= limit) {
+          decline(`agent home busy: ${active2} active attempt(s)`, true);
+          return;
+        }
+      }
       const guarded = this.deps.admissionGuard?.({ taskId, payload });
       if (guarded !== void 0 && !guarded.admit) {
         decline(guarded.reason, guarded.retryable);
@@ -18014,7 +17977,7 @@ async function detectRuntimes(adapters) {
   }
   return runtimes;
 }
-function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
+function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies, providerProfileBindingConfigured = false) {
   const flags = [];
   if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
@@ -18026,6 +17989,9 @@ function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentO
   if (selectionAdapters.length > 0 && selectionAdapters.every((adapter) => adapter.descriptor.supportsDispatchSelection === true)) {
     flags.push("dispatch-selection");
   }
+  if (providerProfileBindingConfigured && adapters.some((adapter) => adapter.descriptor.id === "pi" && adapter.descriptor.supportsDispatchSelection)) {
+    flags.push(PROVIDER_PROFILE_BINDING_CAPABILITY);
+  }
   if (adapters.some((adapter) => adapter.descriptor.capabilities.mcpToolsets === true)) {
     flags.push("toolset-selection");
   }
@@ -18188,6 +18154,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   if (config.strictAgentOnly === true && config.agentHome === void 0) {
     throw new Error("DaemonConfig.strictAgentOnly requires DaemonConfig.agentHome");
   }
+  if (config.maxConcurrentMutableSessionsPerAgentHome !== void 0 && !(Number.isSafeInteger(config.maxConcurrentMutableSessionsPerAgentHome) && config.maxConcurrentMutableSessionsPerAgentHome > 0)) {
+    throw new Error(
+      `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome must be a positive safe integer (or omitted to use the default of ${DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}) \u2014 got ${config.maxConcurrentMutableSessionsPerAgentHome}. Raising it above 1 lets that many Attempts co-write one canonical Agent home; 0, a negative number, NaN, or a non-integer is rejected rather than silently treated as "uncapped".`
+    );
+  }
+  const agentHomeAttemptLimit = config.maxConcurrentMutableSessionsPerAgentHome ?? DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME;
   const egressPolicy = resolveAgentEgressPolicy(config.agentEgress?.policy);
   const egressBatcherOptions = egressPolicy.activity.mode === "contentful-trajectory" ? {
     ...config.progressBatch,
@@ -18508,7 +18480,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         config.strictAgentOnly === true,
         agentHomeManager?.supportsTaskFreeProjection() === true,
         config.agentEgress !== void 0,
-        agentContentReadPolicies
+        agentContentReadPolicies,
+        config.piByokLauncher !== void 0
       );
       const agentHomeProjectionCompletion = agentHomeManager?.supportsTaskFreeProjection() === true ? new AgentHomeProjectionCompletionClient({
         serverUrl: config.serverUrl,
@@ -18567,6 +18540,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         workspaceRoot: config.workspaceRoot,
         ...agentHomeManager === void 0 ? {} : { agentHome: agentHomeManager },
         ...config.strictAgentOnly === true ? { strictAgentOnly: true } : {},
+        // WP0: already validated up front — see `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome`.
+        maxConcurrentMutableSessionsPerAgentHome: agentHomeAttemptLimit,
         ...agentSessionHandoffs === void 0 ? {} : { agentSessionHandoffs },
         deviceId: record.deviceId,
         // M5: see `DaemonConfig.runtimeEnvironment`'s own doc comment above.
@@ -18851,16 +18826,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         },
         onStateChange: (state) => {
-          const wasSettled = connectionState === "open" || connectionState === "degraded";
+          const wasSettled = connectionState === "open";
           connectionState = state;
           observer.noteConnectionState(state);
-          if (!wasSettled && (state === "open" || state === "degraded")) runner?.retryRecoveredAgentMessages();
-          if (!wasSettled && (state === "open" || state === "degraded")) runPresenceDiscovery();
+          if (!wasSettled && state === "open") runner?.retryRecoveredAgentMessages();
+          if (!wasSettled && state === "open") runPresenceDiscovery();
         },
-        backoff: overrides.backoff,
-        liveness: overrides.liveness,
-        wsFailureThreshold: overrides.longPoll?.wsFailureThreshold,
-        wsRetryIntervalMs: overrides.longPoll?.wsRetryIntervalMs,
         longPollRetryDelayMs: overrides.longPoll?.retryDelayMs,
         longPollIdleDelayMs: overrides.longPoll?.idleDelayMs,
         fleetJitter,
@@ -18872,7 +18843,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         }
       });
       await connection.start();
-      await connection.waitForAck();
+      await connection.waitForConnection();
       runner.retryRecoveredAgentMessages();
       for (const record2 of agentEgress.retryableReliableRecords(connection.getServerCapabilities())) {
         dispatchReliableRecord(record2);
@@ -19131,7 +19102,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       // fine.
       ...storageStatus === void 0 ? {} : { storage: storageStatus },
       operationalHealth: operationalHealth.snapshot(),
-      toolsets: toolsetRegistry.status()
+      toolsets: toolsetRegistry.status(),
+      // WP0: same counts `Daemon.status()` reports, from the same reader.
+      agentHomeExecution: agentHomeExecutionStatus()
     };
   }
   async function performControlShutdown(reason) {
@@ -19366,9 +19339,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         const minted = mintDeviceAssertion({
           record,
           // `toHttpBase` is the one place a configured serverUrl is normalized
-          // (ws:->http:, wss:->https:, path stripped), so an operator who
-          // configured the websocket spelling and one who configured the HTTP
-          // spelling of the same deployment produce the same issuer.
+          // (path stripped), so the issuer ignores an operator-provided path
+          // or query.
           issuer: new URL(toHttpBase(config.serverUrl)).origin,
           productId: config.productId,
           audience: parsed.audience,
@@ -19483,23 +19455,33 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       await binding.lease.release();
     }
   }
+  function agentHomeExecutionStatus() {
+    const summary = agentHomeManager?.executionLeaseManager.activeAttemptSummary();
+    return {
+      maxConcurrentMutableSessionsPerAgentHome: agentHomeAttemptLimit,
+      activeHomes: summary?.homes ?? 0,
+      activeAttempts: summary?.attempts ?? 0
+    };
+  }
   function status() {
     return {
       localAgentRelease,
       paired: auth.deviceId !== void 0,
       connected: connectionState === "open",
-      degraded: connection?.isTransportDegraded() ?? false,
       revoked: connection?.isRevoked() ?? auth.isRevoked(),
       deviceId: auth.deviceId,
       activeTaskCount: runner?.activeTaskCount ?? 0,
       branding: config.branding,
       operationalHealth: operationalHealth.snapshot(),
       toolsets: toolsetRegistry.status(),
-      egress: agentEgress.status()
+      egress: agentEgress.status(),
+      agentHomeExecution: agentHomeExecutionStatus()
     };
   }
   function reloadMcpToolsets(mcpToolsets, expectedRevision) {
-    return toolsetRegistry.reload(mcpToolsets, expectedRevision);
+    const receipt = toolsetRegistry.reload(mcpToolsets, expectedRevision);
+    if (daemonStarted) connection?.refreshHello();
+    return receipt;
   }
   function reportMcpToolsetObservation(toolsetId, expectedDefinitionRevision, observation) {
     toolsetRegistry.report(toolsetId, expectedDefinitionRevision, observation);
@@ -19908,7 +19890,7 @@ function createServiceLifecycle(def, opts = {}) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.12.0"
+  version: "0.13.0"
 });
 
 // src/bin/config.ts
@@ -21988,7 +21970,7 @@ async function recentAuditFacts(storeDir) {
 }
 function projectControl(control) {
   if (control.status === "offline") return { status: "offline" };
-  const transport = ["connecting", "open", "closed", "degraded", "revoked"].includes(control.transport) ? control.transport : "unavailable";
+  const transport = ["connecting", "open", "closed", "revoked"].includes(control.transport) ? control.transport : "unavailable";
   const operationalHealth = control.operationalHealth.availability === "available" ? {
     availability: "available",
     state: control.operationalHealth.state,