@byok-sdk/client 0.12.0 → 0.14.0

package/dist/daemon/create-daemon.d.ts

@@ -1,10 +1,9 @@
 import type { AgentEgressPolicy, RuntimeId } from '@byok-sdk/protocol';
 import type { PermissionPolicy } from '@byok-sdk/protocol';
 import type { RuntimeAdapter, GitWorkspaceConfig, McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
-import { type AgentHomeProjection } from '../agent-home';
+import { type AgentHomeExecutionStatus, type AgentHomeProjection } from '../agent-home';
 import type { AgentRef } from '../agent-home';
 import { type LocalAgentReleaseIdentity } from '../release-identity';
-import type { BackoffOptions, LivenessOptions } from './ws-transport';
 import { type OperationalHealthSnapshot } from './operational-health';
 import { type DaemonEventListener, type DaemonTaskInfo, type Unsubscribe } from './observer';
 import { GitWorkspaceManager } from './git-workspace';
@@ -132,6 +131,26 @@ export interface DaemonConfig {
      * after the SDK-owned Agent home has passed construction-time preflight.
      */
     strictAgentOnly?: boolean;
+    /**
+     * WP0: how many Attempts this daemon lets execute CONCURRENTLY in one
+     * canonical Agent home, across every lane and every session. Default
+     * {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME} (1).
+     *
+     * The canonical home is every Agent session's cwd, so each concurrent
+     * Attempt in it is another writer of the same `MEMORY.md`, `notes/` and
+     * `.git`. At the default, a second offer for a home that already has an
+     * active Attempt is declined retryably before adapter preparation, the
+     * claim, or any process side effect — the busy-home contract downstream
+     * hosts already depend on.
+     *
+     * Raising it above 1 is an explicit host choice that re-enables the
+     * 0.12.0 concurrent-session behaviour, including its co-writing exposure;
+     * the SDK never falls back to it on its own. Validated up front, the same
+     * way `maxTaskOutputBytes` is: a positive safe integer, so `0`, a negative
+     * number, `NaN` and a non-integer are construction errors rather than a
+     * silently reinterpreted "unlimited".
+     */
+    maxConcurrentMutableSessionsPerAgentHome?: number;
     /**
      * Explicit Agent-local/cloud egress selection. Omission still enforces the
      * SDK metadata/status projection, but does not advertise or admit the new
@@ -257,7 +276,7 @@ export interface DaemonConfig {
     /**
      * M5: explicit escape hatch for `url.ts`'s `assertServerUrlAllowed` — see
      * that function's own doc comment for the full allow/deny rule. Default
-     * (unset/`false`): a `serverUrl` using plaintext `ws:`/`http:` is only
+     * (unset/`false`): a `serverUrl` using plaintext `http:` is only
      * accepted when its host is loopback (`localhost`/`*.localhost`,
      * `127.0.0.0/8`, `::1`); anything else over plaintext throws a typed
      * `InsecureServerUrlError` from `pair()`/`start()` below, BEFORE any
@@ -268,7 +287,7 @@ export interface DaemonConfig {
      * server) — doing so also logs a loud `console.warn` (see
      * `checkServerUrl`, this file) every time it actually changes the
      * outcome. Never overrides an unsupported scheme (anything other than
-     * `http:`/`https:`/`ws:`/`wss:`), which is refused unconditionally.
+     * `http:`/`https:`), which is refused unconditionally.
      */
     dangerouslyAllowInsecureRemote?: boolean;
     /**
@@ -288,6 +307,36 @@ export interface DaemonConfig {
      * explicitly instead to opt out of enforcement altogether.
      */
     maxTaskOutputBytes?: number;
+    /**
+     * Per-EVENT inline ceiling (default {@link DEFAULT_MAX_INLINE_EVENT_BYTES},
+     * 64 KiB) for the two `AgentEvent` fields a runtime authors freely:
+     * `tool_use.input` and `tool_result.output`. An event whose serialization
+     * exceeds this leaves `TaskRunner.pump` with that field replaced by a
+     * UTF-8-safe head/tail preview (`{ preview: { head, tail } }`) and an
+     * additive `spill` descriptor; the full JSON serialization is uploaded to
+     * the blob plane under an idempotent, content-addressed key, and
+     * `spill.blob` is where a consumer reads it back. If the upload fails the
+     * preview still ships, carrying `spill.unstoredReason` instead — omission
+     * is always described, never silent.
+     *
+     * This is a per-event bound, orthogonal to `maxTaskOutputBytes` (a
+     * whole-task total, counted AFTER spilling) and to
+     * `progressBatch.maxBatchBytes` (a per-batch wire budget).
+     *
+     * **Consumer contract:** `spill`'s presence is the only signal that the
+     * inline field is a preview. A consumer that renders `tool_result.output`
+     * without checking `spill` renders a truncation as the whole result.
+     *
+     * Must be a positive safe integer of at least
+     * {@link MIN_MAX_INLINE_EVENT_BYTES} (4096) — below that a legitimate
+     * `spill` descriptor no longer fits inside the cap it exists to enforce.
+     * Anything else (0, negative, non-integer, `NaN`,
+     * `Number.POSITIVE_INFINITY`) is a config validation error thrown
+     * synchronously from `createDaemonWithAdapters`/`createDaemon`; there is
+     * no opt-out, because "unbounded event" is exactly the state this exists
+     * to prevent.
+     */
+    maxInlineEventBytes?: number;
     /**
      * Host-owned batching policy for normalized `task.progress` events.
      * `maxBatchBytes`, when set, measures exactly the UTF-8 bytes of
@@ -475,8 +524,6 @@ export interface DaemonStatus {
     localAgentRelease: Readonly<LocalAgentReleaseIdentity>;
     paired: boolean;
     connected: boolean;
-    /** True once the connection has fallen back to long-poll (protocol §8) — transport info only (finding F6): long-poll is a full transport, so work still proceeds normally while this holds; outbound envelopes POST to /byok/messages instead of going out over WS. */
-    degraded: boolean;
     /** True once the server has revoked this device (401 on challenge/token, protocol §6.3). The only recourse is calling `pair()` again — the daemon does not keep retrying on its own. */
     revoked: boolean;
     deviceId?: string;
@@ -489,6 +536,8 @@ export interface DaemonStatus {
     toolsets: McpToolsetRegistryStatus;
     /** Content-free egress lane watermarks and typed last-drop facts. */
     egress: AgentEgressStatus;
+    /** WP0: per-canonical-Agent-home execution serialization — see {@link AgentHomeExecutionStatus}. */
+    agentHomeExecution: AgentHomeExecutionStatus;
 }
 export interface Daemon {
     /** Pairing result is intentionally credential-blind. */
@@ -538,10 +587,10 @@ export interface Daemon {
     /** M3-2a: same as {@link approve} but rejects — see that method's doc comment. */
     reject(taskId: string, reason?: string): Promise<void>;
 }
-/** Internal seam so tests can substitute stub adapters / faster backoff+batch+liveness+long-poll timing. `createDaemonWithAdapters` (which takes this) is also the real entry point for products supplying a hand-built adapter set `createDaemon` can't construct on its own — e.g. custom adapter options, or an adapter that REPLACES a bundled runtime's implementation under the same id. Honest limit: an adapter id outside `pi`/`claude`/`codex` cannot pass wire validation today — `RuntimeIdSchema` (`@byok-sdk/protocol`) is a closed `z.enum(['pi', 'claude', 'codex'])`, and `isRuntimeId` filtering below (see `detectRuntimes`) drops any detected adapter outside that set before it ever reaches a wire-visible field. A genuinely fourth/namespaced runtime id is a future protocol change, not something this seam enables today. */
+/** Internal seam so tests can substitute stub adapters / faster batch and long-poll timing. `createDaemonWithAdapters` (which takes this) is also the real entry point for products supplying a hand-built adapter set `createDaemon` can't construct on its own — e.g. custom adapter options, or an adapter that REPLACES a bundled runtime's implementation under the same id. Honest limit: an adapter id outside `pi`/`claude`/`codex` cannot pass wire validation today — `RuntimeIdSchema` (`@byok-sdk/protocol`) is a closed `z.enum(['pi', 'claude', 'codex'])`, and `isRuntimeId` filtering below (see `detectRuntimes`) drops any detected adapter outside that set before it ever reaches a wire-visible field. A genuinely fourth/namespaced runtime id is a future protocol change, not something this seam enables today. */
 export interface DaemonOverrides {
-    backoff?: BackoffOptions;
-    liveness?: LivenessOptions;
+    /** Test-only synchronous kill points; never supplied by production configuration. */
+    executionRecoveryFault?: (step: 'terminal:before-send' | 'terminal:queued' | 'outbound:before-post' | 'outbound:after-ack') => void;
     /** M4 Phase 3: overrides `TaskRunner`'s default out-of-band approval wait (`DEFAULT_APPROVAL_TIMEOUT_MS`, 10 minutes) before an unanswered `requestApproval` force-resolves as a fail-closed rejection. */
     approvalTimeoutMs?: number;
     /** Finding F5: overrides for the control-socket shutdown path's own bounded waits — see `TaskRunner.shutdownTask`'s and `ConnectionManager.stop`'s own doc comments. Both default to 5s; neither affects an ordinary (non-shutdown-RPC) `daemon.stop()` call. */
@@ -552,10 +601,6 @@ export interface DaemonOverrides {
         outboxDrainTimeoutMs?: number;
     };
     longPoll?: {
-        /** Consecutive never-acked WS connect failures before falling back to long-poll. Default 3. */
-        wsFailureThreshold?: number;
-        /** While long-polling, how often to retry establishing WS. Default 5 minutes. */
-        wsRetryIntervalMs?: number;
         /** Backoff between failed long-poll HTTP attempts. Default 2s. */
         retryDelayMs?: number;
         /** Minimum delay before the next long-poll request after an empty (no-events) response — avoids busy-looping against a server that responds instantly. Default 250ms. */

package/dist/daemon/event-spill.d.ts

@@ -0,0 +1,90 @@
+import type { AgentEvent } from '@byok-sdk/protocol';
+import type { BlobResolver } from './blob-client';
+/**
+ * Default per-event inline ceiling (64 KiB) for the two `AgentEvent` variants
+ * that carry runtime-authored payloads (`tool_use.input`,
+ * `tool_result.output`) — see `DaemonConfig.maxInlineEventBytes`
+ * (`create-daemon.ts`) for the host-facing contract.
+ *
+ * 64 KiB is the same threshold `sendArtifact` already uses to decide inline
+ * vs. blob for an artifact (`MAX_INLINE_ARTIFACT_BYTES`): one number for "a
+ * payload this daemon is willing to put on the activity wire".
+ */
+export declare const DEFAULT_MAX_INLINE_EVENT_BYTES: number;
+/**
+ * Smallest accepted `maxInlineEventBytes`. Below this a legitimate spill
+ * descriptor (`field` + byte counts + a `BlobRef` whose `blobId` is chosen by
+ * the server, plus the event's own `type`/`tool`/`toolCallId`) stops fitting
+ * inside the cap it is supposed to keep the event under, which would turn a
+ * host's configuration mistake into a per-event runtime invariant failure.
+ * Enforced up front at `DaemonConfig` validation, never here.
+ */
+export declare const MIN_MAX_INLINE_EVENT_BYTES = 4096;
+/**
+ * Worst-case JSON cost of the `,"spill":{…}` fragment when the descriptor
+ * carries an `unstoredReason` rather than a server-chosen `BlobRef`.
+ *
+ * Every part is bounded by construction, which a `BlobRef` is not — its
+ * `blobId` is an arbitrary-length server-chosen string:
+ *
+ * ```
+ *   ,"spill":                                  9
+ *   {                                          1
+ *   "field":"output",                         17   ("output" is the longer of the two)
+ *   "totalBytes":<=16 digits>,                30
+ *   "omittedBytes":<=16 digits>,              32   (never exceeds totalBytes)
+ *   "contentType":"application/json",         33   (a module constant)
+ *   "unstoredReason":                         17
+ *   "<=512 bytes of escaped reason>"         514   (MAX_UNSTORED_REASON_BYTES + 2 quotes)
+ *   }                                          1
+ *                                           ----
+ *                                            654
+ * ```
+ *
+ * Rounded up to 768 so digit-count growth cannot invalidate it. Because the
+ * event is spread first and `spill` written last, a bounded event is EXACTLY
+ * the empty-preview skeleton plus this fragment — so refusing to spill unless
+ * `skeleton + MAX_SPILL_DESCRIPTOR_BYTES <= maxInlineBytes` is what makes the
+ * final cap check unreachable rather than merely unlikely. `event-spill.test.ts`
+ * asserts this against a maximally escaping reason instead of trusting the
+ * comment.
+ */
+export declare const MAX_SPILL_DESCRIPTOR_BYTES = 768;
+export interface EventSpillDeps {
+    /** Effective inline ceiling for this daemon; already validated at the `DaemonConfig` layer. */
+    maxInlineBytes: number;
+    /** Only the upload half of `BlobResolver` is needed, so a test double stays minimal. */
+    blobClient: Pick<BlobResolver, 'uploadArtifact'>;
+    /** Scopes the upload's idempotency key to the task that produced the event. */
+    taskId: string;
+    /** Task lifecycle authority — aborting it stops the spill upload with the rest of the task's blob I/O. */
+    signal?: AbortSignal;
+    /** Diagnostic seam. Called only on a path that loses information (upload failure, or an event this policy cannot bound). */
+    log?: (message: string) => void;
+}
+/**
+ * Bound one normalized `AgentEvent` at the daemon's ingestion boundary
+ * (`TaskRunner.pump`).
+ *
+ * An event whose serialized form already fits `maxInlineBytes` is returned
+ * **as the same object reference** — the overwhelming majority of events pay
+ * exactly one `JSON.stringify` and nothing else, and no downstream identity
+ * comparison changes meaning.
+ *
+ * An oversized `tool_use` / `tool_result` has its runtime-authored field
+ * (`input` / `output`) uploaded to the blob plane in full and REPLACED inline
+ * by `{ preview: { head, tail } }`, with an additive `spill` descriptor
+ * carrying either the resulting `BlobRef` or a bounded `unstoredReason`. The
+ * replacement is *measured* against the cap, never assumed to fit: the
+ * preview budget is whatever is left after the rest of the event and the
+ * real descriptor, and it is shrunk until `JSON.stringify(result)` actually
+ * fits (JSON escaping can cost several bytes per source character, so the
+ * byte budget alone is not a bound).
+ *
+ * Storage failure is never silent and never fatal: the preview still ships,
+ * `unstoredReason` says why the omitted bytes are unreadable, and `log` is
+ * called. The runtime's own transcript still holds the content, so failing
+ * the task over a telemetry upload would trade a real result for an
+ * observability problem.
+ */
+export declare function spillOversizedEvent(event: AgentEvent, deps: EventSpillDeps): Promise<AgentEvent>;

package/dist/daemon/journal/journal.d.ts

@@ -124,18 +124,21 @@ export interface LocalTransitionRecord {
 /** Whether the cloud has confirmed the terminal this daemon produced (§12.7.3's "terminal 生成后、truth 写入前" window). */
 export type TerminalTruthState = 'pending' | 'confirmed' | 'failed';
 /**
- * A task's terminal, as it exists locally. The PAYLOAD is not stored — only
- * its hash, plus enough retry state to know whether the cloud has taken it.
+ * One immutable canonical terminal and its delivery projection. Bytes are the
+ * replay authority; the hash is checked against them, never used as a substitute.
  */
 export interface LocalTerminalRecord {
     readonly taskId: string;
-    readonly terminalType: 'complete' | 'failed' | 'cancelled';
+    readonly terminalType: 'complete' | 'failed' | 'cancelled' | 'declined';
+    readonly bytes: string;
     readonly payloadHash: string;
     readonly truthState: TerminalTruthState;
     /** How many times delivery to the cloud has been attempted. */
     readonly attempt: number;
     readonly lastError?: string;
     readonly recordedAt: string;
+    /** Committed atomically with the original interruption report. */
+    readonly recovery?: RecoveryOutcome;
 }
 /** A task the journal knows about that has no terminal and no recovery marker — i.e. one this daemon was in the middle of when it stopped. */
 export interface RecoverableTask {
@@ -147,6 +150,7 @@ export interface RecoverableTask {
     readonly claimedRuntime?: string;
     readonly workspaceRef?: string;
     readonly updatedAt: string;
+    readonly envelopeBytes: string;
 }
 /**
  * What recovery decided about a task. `interrupted` is the honest default for
@@ -262,6 +266,14 @@ export interface LocalTaskJournal {
     recordTransition(record: LocalTransitionRecord): Promise<void>;
     /** Record (or update the retry state of) a task's terminal. Idempotent by task id: a replay with the same payload hash is a no-op beyond retry bookkeeping. */
     recordTerminal(record: LocalTerminalRecord): Promise<void>;
+    /** Exact original terminal bytes, including rejected records, until acknowledged. */
+    listPendingTerminals(identity: JournalIdentity): Promise<LocalTerminalRecord[]>;
+    /** A successful authenticated transport disposition, bound to the original bytes. */
+    confirmTerminal(taskId: string, payloadHash: string): Promise<void>;
+    rejectTerminal(taskId: string, payloadHash: string, reason: string): Promise<void>;
+    /** Includes old interruption markers without reports; they must not hide pending work. */
+    listRecoveryTasks(identity: JournalIdentity): Promise<RecoverableTask[]>;
+    readTask(taskId: string, identity: JournalIdentity): Promise<RecoverableTask | undefined>;
     /** Tasks with no terminal and no recovery marker — what this daemon was in the middle of when it last stopped. */
     listRecoverable(): Promise<RecoverableTask[]>;
     /** Close out one recoverable task by writing its recovery marker. Never deletes; a marked row is on §12.7.2.1's never-auto-delete list. */

package/dist/daemon/journal/sqlite-journal.d.ts

@@ -1,4 +1,4 @@
-import { type AdmissionRecord, type CategoryUsage, type CleanableCategory, type CleanupCandidate, type CleanupResult, type CompactOptions, type CompactResult, type JournalReceipt, type LocalStorageUsage, type LocalTaskJournal, type LocalTerminalRecord, type LocalTransitionRecord, type RecoverableTask, type RecoveryOutcome, type ReceivedEnvelopeRecord, type StorageCategory } from './journal';
+import { type JournalIdentity, type AdmissionRecord, type CategoryUsage, type CleanableCategory, type CleanupCandidate, type CleanupResult, type CompactOptions, type CompactResult, type JournalReceipt, type LocalStorageUsage, type LocalTaskJournal, type LocalTerminalRecord, type LocalTransitionRecord, type RecoverableTask, type RecoveryOutcome, type ReceivedEnvelopeRecord, type StorageCategory } from './journal';
 import { JournalHandleCleanupError, type JournalOpenFaultSeam } from './sqlite-support';
 export { JournalHandleCleanupError };
 /** The single database file, per §12.7.2's "建议单库 `<storeDir>/daemon.db`". */
@@ -24,7 +24,7 @@ export declare const DEFAULT_JOURNAL_BUSY_TIMEOUT_MS = 5000;
  * (`util/secure-dir.ts`): a seam the production path never supplies, exercised
  * from any host.
  */
-export type JournalFaultStep = 'append:before-begin' | 'append:after-envelope' | 'append:after-task' | 'append:after-receipt' | 'append:before-commit' | 'admission:before-commit' | 'transition:before-commit' | 'terminal:before-commit' | 'recovery:before-commit' | 'cleanup:before-commit' | 'prune:before-commit';
+export type JournalFaultStep = 'append:before-begin' | 'append:after-envelope' | 'append:after-task' | 'append:after-receipt' | 'append:before-commit' | 'append:after-commit' | 'admission:before-commit' | 'transition:before-commit' | 'terminal:before-commit' | 'terminal:after-commit' | 'recovery:after-commit' | 'confirm:before-commit' | 'confirm:after-commit' | 'recovery:before-commit' | 'cleanup:before-commit' | 'prune:before-commit';
 export interface JournalFaultSeam {
     /** Throw to simulate a crash or IO error at exactly this step. Return normally to proceed. */
     onStep?(step: JournalFaultStep): void;
@@ -79,6 +79,11 @@ export declare class SqliteLocalTaskJournal implements LocalTaskJournal {
      * first fact stands.
      */
     recordTerminal(record: LocalTerminalRecord): Promise<void>;
+    readTask(taskId: string, identity: JournalIdentity): Promise<RecoverableTask | undefined>;
+    listRecoveryTasks(identity: JournalIdentity): Promise<RecoverableTask[]>;
+    listPendingTerminals(identity: JournalIdentity): Promise<LocalTerminalRecord[]>;
+    confirmTerminal(taskId: string, payloadHash: string): Promise<void>;
+    rejectTerminal(taskId: string, payloadHash: string, reason: string): Promise<void>;
     /**
      * What this daemon was in the middle of: a task whose offer envelope is
      * durable, that has no terminal, that was not declined, and that recovery

package/dist/daemon/long-poll-transport.d.ts

@@ -33,71 +33,24 @@ export interface LongPollClientOptions {
     serverUrl: string;
     auth: AuthManager;
     getCursor: () => number | undefined;
-    onEnvelope: (envelope: Envelope) => void;
+    /** Returns false when the envelope was a local duplicate and no handler was queued. */
+    onEnvelope: (envelope: Envelope) => boolean | void;
     /**
      * Capabilities advertised by the server that produced the current poll
      * response. Called before any envelopes from that response are delivered.
      * An older responder omitting the additive field is reported as `[]`.
      */
     onServerCapabilities?: (capabilities: string[]) => void;
+    /** Called when a failed poll invalidates the preceding response's capability snapshot. */
+    onServerCapabilitiesInvalidated?: () => void;
+    /** Called after a poll fails and before the retry delay begins. */
+    onPollFailure?: () => void;
     /** Called once the device is found to be revoked (401 surfaced through {@link AuthManager}) — the loop stops itself rather than retrying. */
     onRevoked?: () => void;
     /** Called when the server cannot replay the durable cursor supplied to this poll. */
     onReplayCursorTooOld?: (error: ReplayCursorTooOldError) => void;
-    /**
-     * M4 Phase 4 (version-negotiation drill fix), scope narrowed by finding F1:
-     * called ONLY for a batch entry that failed to parse because its `type`
-     * is entirely unrecognized (`parseMessage` throwing
-     * {@link UnknownMessageTypeError} — mirrors `ws-transport.ts`'s identical
-     * per-frame tolerance for that SPECIFIC failure) and which still carries a
-     * numeric envelope-level `seq` AND a recognizably task-class `type` (a
-     * `task.` prefix — see `extractSkippableSeq`'s own doc comment for why a
-     * `conn.*`-shaped or type-less entry is deliberately excluded, mirroring
-     * F2's "conn.* is never cursor-tracked" rule), so the caller can advance
-     * its cursor/watermark past it even though there is no real `Envelope` to
-     * hand to `onEnvelope`. Without this, a persistently-redelivered
-     * unrecognized-type entry (the real server retains and redelivers an
-     * un-acked envelope, protocol §9) would keep reappearing at the same
-     * cursor position forever.
-     *
-     * Finding F1: a RECOGNIZED type that fails schema validation
-     * ({@link EnvelopeValidationError} — e.g. a `task.offer` whose
-     * `PermissionPolicy` rejects an unknown constraint) is deliberately NOT
-     * reported here. That failure is a genuinely malformed control message,
-     * not forward-compat tolerance — forwarding its `seq` here would
-     * permanently ack a message the daemon never actually understood (the
-     * server would stop redelivering it, silently stranding whatever it was
-     * offering). The WS path never had this hazard (an unparseable WS frame
-     * has no skip-side cursor bookkeeping at all — see
-     * `ws-transport.ts` — so it simply gets redelivered later); this callback
-     * being scoped to `UnknownMessageTypeError` only is what makes long-poll
-     * match that same "no silent permanent ack" property for real. Optional
-     * only for constructor/test convenience — `ConnectionManager` always
-     * supplies it.
-     */
-    onSkippedSeq?: (seq: number) => void;
-    /**
-     * Finding R1 (cross-model re-review — the F1 fix alone was NOT-CLOSED):
-     * called for a batch entry whose `type` WAS recognized but whose payload
-     * failed schema validation ({@link EnvelopeValidationError}) — a genuine
-     * delivery failure at that specific seq, not forward-compat tolerance
-     * (contrast {@link onSkippedSeq}, which is scoped to the opposite case,
-     * an entirely unrecognized type). F1's own fix — simply not forwarding
-     * this seq to `onSkippedSeq` — turned out to be insufficient on its own:
-     * a LATER valid envelope in the same or a later batch would still
-     * silently advance the durable cursor PAST this seq once its own handler
-     * succeeded, since nothing had told `ConnectionManager` this seq needed
-     * the same stall treatment a thrown handler failure already gets — an
-     * INDIRECT permanent ack, one hop removed from the exact bug F1 set out
-     * to fix. `ConnectionManager` (`noteValidationFailure`) engages
-     * `stalledAtSeq` for this seq the same way `process()`'s own catch block
-     * does for a real thrown handler — freezing `dedupWatermark()` at the
-     * durable cursor (so the server's retain-and-redeliver semantics,
-     * protocol §9, keep this seq alive) and, via that SAME existing
-     * machinery, holding back the cursor for anything else delivered after it
-     * in the same batch too, exactly as a real handler failure already would.
-     * Optional only for constructor/test convenience — `ConnectionManager`
-     * always supplies it.
+    /** Unknown or malformed executable messages have no durable disposition.
+     * Freeze their sequence; a later valid message must not acknowledge them.
      */
     onValidationFailedSeq?: (seq: number) => void;
     /**
@@ -114,7 +67,7 @@ export interface LongPollClientOptions {
      * `ConnectionManager` always supplies it.
      */
     isStalled?: () => boolean;
-    /** Backoff between failed poll attempts (network/HTTP errors), AND between cycles that made no cursor progress while stalled (finding P2/Fix 2a — see {@link isStalled}). The reference server holds each successful, non-stalled request open ~50s itself (protocol §8), so this only matters when a request errors outright or is stalled. Default 2s. */
+    /** Backoff between failed poll attempts (network/HTTP errors), stalled cycles, and duplicate-only cycles that made no cursor progress. The reference server holds a genuinely idle request open ~50s itself (protocol §8). Default 2s. */
     retryDelayMs?: number;
     /** Deterministic delay authority for automatic failed/stalled cycles. */
     retryDelayForAttempt?: (attempt: number, baseDelayMs: number) => number;
@@ -128,24 +81,29 @@ export interface LongPollClientOptions {
      */
     idleDelayMs?: number;
 }
+/** A fully-read frozen-v1 count acknowledgement for the batch that was posted. */
+export interface MessageBatchPostResult {
+    readonly accepted: number;
+    readonly rejected?: number;
+}
 /**
- * Protocol §8 long-poll fallback: `GET /byok/events?cursor=N` in a loop,
- * used while WS connectivity is unavailable (see `ConnectionManager`), plus
- * `POST /byok/messages` for the daemon's own outbound envelopes while in
- * this mode (finding F6 — long-poll is a full transport, not receive-only:
- * see docs/protocol.md §8).
+ * Protocol §8 long-poll transport: `GET /byok/events?cursor=N` in a loop,
+ * plus `POST /byok/messages` for the daemon's own outbound envelopes
+ * (finding F6 — long-poll is a full transport, not receive-only: see
+ * docs/protocol.md §8).
  *
- * Design B (finding N4): this is a stateless drainer, symmetric with
- * `WsTransport.sendNow` — it holds no outbound queue of its own.
- * `ConnectionManager` owns the single shared outbox both transports drain
- * from (so a transport switch never strands a queued envelope);
- * `postBatch` is a single POST attempt, reporting back whether the server
- * accepted it. All retry/backoff policy (and re-checking which transport is
- * currently active) lives in the caller (`ConnectionManager.drainOutbox`).
+ * Design B (finding N4): this is a stateless drainer; it holds no outbound
+ * queue of its own. `ConnectionManager` owns the single shared outbox;
+ * `postBatch` is a single POST attempt, reporting only frozen-v1 accepted and
+ * rejected counts after its response body has been read and validated. All
+ * retry/backoff and rejection isolation policy lives in the caller
+ * (`ConnectionManager.drainOutbox`).
  */
 export declare class LongPollClient {
     private readonly opts;
     private running;
+    /** Owns exactly one active loop generation, including its held GET and retry delays. */
+    private loopAbortController;
     /**
      * Finding R1: seqs this loop has already `console.warn`'d about for a
      * validation-failed (recognized-type, invalid-payload) entry — a poison
@@ -204,8 +162,8 @@ export declare class LongPollClient {
      * (`ConnectionHub.handleInbound`), so a resend of the SAME batch (same
      * envelope `id`s — the caller must never rebuild them) is deduped
      * server-side into a safe no-op rather than reprocessed (§9). Returns
-     * `true` once the server has accepted the batch.
+     * validated frozen-v1 counts only after a readable response body.
      */
-    postBatch(envelopes: Envelope[]): Promise<boolean>;
+    postBatch(envelopes: Envelope[]): Promise<MessageBatchPostResult | undefined>;
     private loop;
 }

package/dist/daemon/observer.d.ts

@@ -1,5 +1,5 @@
 import { type AgentEvent, type BlobRef, type Envelope, type RuntimeInfo, type TaskState } from '@byok-sdk/protocol';
-import type { ConnectionState } from './ws-transport';
+import type { ConnectionState } from './connection-manager';
 /**
  * M3-2a: local observability for the daemon — the seam a CLI (M3-2b) drives a
  * live task feed, a task list, and approve/reject/unpair from, all LOCALLY

package/dist/daemon/task-runner.d.ts

@@ -177,6 +177,15 @@ export type ResultDocumentExtractor = (finalOutput: string, task: ResultDocument
  * opt-out pin.
  */
 export declare const DEFAULT_MAX_TASK_OUTPUT_BYTES: number;
+/**
+ * WP0: default number of Attempts allowed to execute concurrently in one
+ * canonical Agent home. One — the canonical home is every Agent session's
+ * cwd, so a second concurrent Attempt is a second writer of the same
+ * `MEMORY.md`, `notes/` and `.git`. Raising it is an explicit host choice
+ * (`DaemonConfig.maxConcurrentMutableSessionsPerAgentHome`) that re-enables
+ * the 0.12.0 co-writing exposure; there is no implicit fallback to it.
+ */
+export declare const DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME = 1;
 export interface TaskRunnerDeps {
     adapters: RuntimeAdapter[];
     runtimeAllowlist?: string[];
@@ -204,6 +213,13 @@ export interface TaskRunnerDeps {
     agentHome?: AgentHomeManager;
     /** Local authority: legacy offers are declined after journal/dedup/cancel precedence. */
     strictAgentOnly?: boolean;
+    /**
+     * WP0: how many Attempts may execute concurrently in ONE canonical Agent
+     * home — see `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome`'s own
+     * doc comment (`create-daemon.ts`) for the validated contract. Unset
+     * defaults to {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}.
+     */
+    maxConcurrentMutableSessionsPerAgentHome?: number;
     /** Exact host-selected policy accepted by `task.offer_for_agent_with_egress`. */
     agentEgressPolicy?: Readonly<AgentEgressPolicy>;
     /** Always-present projection/sanitizer consumer; it defaults to metadata-only. */
@@ -212,6 +228,8 @@ export interface TaskRunnerDeps {
     agentSessionHandoffs?: AgentSessionHandoffStore;
     deviceId: string;
     send: (envelope: Envelope) => void;
+    /** Fsync the execution commitment before claim/runtime side effects. */
+    beforeClaim?: (taskId: string, runtime: string) => Promise<void>;
     blobClient: BlobResolver;
     batcherOptions?: ProgressBatcherOptions;
     /**
@@ -314,6 +332,15 @@ export interface TaskRunnerDeps {
      * interface (`shutdownInterruptTimeoutMs`, `approvalTimeoutMs`).
      */
     maxTaskOutputBytes?: number;
+    /**
+     * Per-event inline ceiling for `tool_use.input` / `tool_result.output` —
+     * see `DaemonConfig.maxInlineEventBytes` (`create-daemon.ts`) for the full
+     * contract and {@link DEFAULT_MAX_INLINE_EVENT_BYTES} for the default.
+     * Validated (positive safe integer, at least
+     * `MIN_MAX_INLINE_EVENT_BYTES`) at the `DaemonConfig` layer, not here —
+     * this seam trusts its caller, same as `maxTaskOutputBytes` above.
+     */
+    maxInlineEventBytes?: number;
     /**
      * M4 (additive-minor, `task.approval_resolved`): the capabilities advertised
      * by the CURRENT transport's server (`conn.ack` on WS, the latest successful
@@ -553,6 +580,10 @@ export declare class TaskRunner {
     usesAgentEgress(taskId: string): boolean;
     /** M5 batch-3 (workstream 2): effective `maxTaskOutputBytes` cap for this daemon — see {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}'s own doc comment. */
     private get maxTaskOutputBytes();
+    /** Effective per-event inline ceiling for this daemon — see `DaemonConfig.maxInlineEventBytes`. */
+    private get maxInlineEventBytes();
+    /** WP0: effective per-canonical-Agent-home Attempt cap — see {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}. */
+    private get maxConcurrentMutableSessionsPerAgentHome();
     /**
      * M4 Phase 4 (part B.3, observability): per-active-task queue watermarks
      * for the control socket's `status` result — see

package/dist/daemon/team-workspace.d.ts

@@ -191,6 +191,15 @@ export declare class LocalTeamWorkspace {
         expiresAt: string;
     }>>;
     postMessage(input: TeamPostMessageInput): Promise<TeamMessageAcceptedReceipt>;
+    /** Metadata-only operator notification view. Never advances delivery or acknowledgement. */
+    notificationSnapshot(input: TeamReadMessagesInput): Promise<{
+        workspaceId: string;
+        memberId: string;
+        registryRevision: TeamWorkspaceRevision;
+        expiresAt: string;
+        acknowledgedThroughSeq: number;
+        latestPeerSeq: number | null;
+    }>;
     readMessages(input: TeamReadMessagesInput): Promise<TeamReadMessagesResult>;
     ackMessages(input: TeamAckMessagesInput): Promise<TeamAckReceipt>;
     private resolveLease;

package/dist/daemon/url.d.ts

@@ -1,7 +1,5 @@
-/** Normalize a configured `serverUrl` (http/https/ws/wss, any path) to an http(s) base with no path/query. */
+/** Normalize a configured HTTP(S) `serverUrl` (any path) to a base with no path/query. */
 export declare function toHttpBase(serverUrl: string): string;
-/** Derive the `/byok/ws` WebSocket URL from a configured `serverUrl`. */
-export declare function toWsUrl(serverUrl: string): string;
 /**
  * Which route a transport diagnostic is about, in the only two fields that
  * are safe to keep: the host (with port) and the path.
@@ -15,7 +13,7 @@ export declare function toWsUrl(serverUrl: string): string;
  * by formatting a raw URL of its own.
  */
 export interface TransportEndpoint {
-    readonly transport: 'ws' | 'long-poll';
+    readonly transport: 'long-poll';
     /** `URL.host` — hostname plus port when non-default. Never userinfo. */
     readonly host: string;
     /** `URL.pathname` — no query, no fragment. */
@@ -43,7 +41,7 @@ export declare class InsecureServerUrlError extends Error {
 }
 export interface AssertServerUrlAllowedOptions {
     /**
-     * Explicit escape hatch: when `true`, a `http:`/`ws:` `serverUrl` whose
+     * Explicit escape hatch: when `true`, an `http:` `serverUrl` whose
      * host is NOT loopback is allowed through instead of throwing. Does
      * nothing for an unsupported scheme (see {@link assertServerUrlAllowed}'s
      * own doc comment) — that rejection is unconditional. Threaded from
@@ -57,25 +55,25 @@ export interface AssertServerUrlAllowedOptions {
 }
 /**
  * M5: transport-security gate for a configured `serverUrl` — refuses
- * plaintext (`ws:`/`http:`) transport to any non-loopback host, so a device
+ * plaintext (`http:`) transport to any non-loopback host, so a device
  * can never be talked into pairing with (and sending its pairing code /
  * device credentials to) a remote host in the clear. Call this ONCE at each
  * real entry point a raw, operator-supplied `serverUrl` first enters the
  * client (`create-daemon.ts`'s `pair()`/`start()`) rather than inside
- * `toHttpBase`/`toWsUrl` themselves: ws-transport, the long-poll fallback,
- * and blob-client all read `serverUrl` from that SAME `DaemonConfig`, never
+ * `toHttpBase` itself: long-poll and blob-client both read `serverUrl` from
+ * that same `DaemonConfig`, never
  * an independently-supplied URL of their own, so those two call sites are
  * already the single common path every one of them goes through.
  *
  * Rules, checked in order:
- *  - `https:`/`wss:` — always allowed, any host (TLS is the actual
+ *  - `https:` — always allowed, any host (TLS is the actual
  *    plaintext-network defense; this gate has nothing further to add there).
- *  - `http:`/`ws:` — allowed only when the hostname is loopback: exactly
+ *  - `http:` — allowed only when the hostname is loopback: exactly
  *    `localhost` or any `*.localhost` subdomain, an IPv4 literal in
  *    `127.0.0.0/8`, or the IPv6 loopback `::1` — see {@link isLoopbackHostname}.
- *  - `http:`/`ws:` to any other host — refused with a clear, typed
+ *  - `http:` to any other host — refused with a clear, typed
  *    {@link InsecureServerUrlError} naming the redacted scheme/host/path and the fix
- *    (use `wss:`/`https:`, or pass `dangerouslyAllowInsecureRemote: true` if
+ *    (use `https:`, or pass `dangerouslyAllowInsecureRemote: true` if
  *    this is a deliberate, understood exception) — UNLESS
  *    `opts.dangerouslyAllowInsecureRemote` is `true`.
  *  - Any other scheme (or a `serverUrl` that fails to parse as a URL at

package/dist/diagnostics/support-bundle.d.ts

@@ -28,7 +28,7 @@ export interface SupportBundle {
         status: 'online';
         pid: number;
         uptimeMs: number;
-        transport: 'connecting' | 'open' | 'closed' | 'degraded' | 'revoked' | 'unavailable';
+        transport: 'connecting' | 'open' | 'closed' | 'revoked' | 'unavailable';
         activeTaskCount: number;
         pendingApprovalCount: number;
         operationalHealth: {

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AgentRef } from './agent-home';
 export { AgentHomeError, AgentRefValidationError, AgentHomeResolutionError, AgentHomeCollisionError, AgentHomeBusyError, AgentHomeLeaseCorruptError, AgentHomeLayout, AgentHomeLeaseManager, AgentHomeManager, createAgentHomeProjection, createAgentHomeProjectionConsumer, AGENT_HOME_PROJECTION_STATE_FILE, stableAgentHomeOwnerId, validateAgentRef, } from './agent-home';
 export { AgentSessionHandoffStore, AgentSessionHandoffStoreError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, } from './daemon/agent-session-handoff-store';
 export type { AgentSessionHandoff, AgentSessionHandoffMatch, AgentTaskTerminalEvidence, AgentTaskTerminalMatch, AgentTerminalCause, } from './daemon/agent-session-handoff-store';
-export type { AgentHomeResolution, AgentHomeProjection, AgentHomeProjectionInput, AgentHomeProjectionApplyInput, AgentHomeProjectionFunction, AgentHomeProjectionApplyFunction, AgentHomeLease, AgentHomeBinding, AgentHomeExecutionLease, AgentHomeExecutionBinding, } from './agent-home';
+export type { AgentHomeResolution, AgentHomeProjection, AgentHomeProjectionInput, AgentHomeProjectionApplyInput, AgentHomeProjectionFunction, AgentHomeProjectionApplyFunction, AgentHomeLease, AgentHomeBinding, AgentHomeExecutionLease, AgentHomeExecutionBinding, AgentHomeExecutionStatus, } from './agent-home';
 export { localStateRelocation, LocalStateRelocationError, LocalStateRelocationBusyError, LocalStateRelocationIntegrityError, } from './local-state-relocation';
 export type { LocalStateRelocationInput, LocalStateRelocationLease, } from './local-state-relocation';
 export { PolicyUnsupportedError, SteerUnsupportedError, freezeRuntimeAdapterDescriptor, sealRuntimeOperationManifest } from './types';
@@ -61,7 +61,7 @@ export { SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME,
 export type { InstallSkillPacksOptions, InstalledSkillPack, ProjectedSkillPack, SkillPackInstallErrorCode, SkillPackInstallResult, SkillPackLock, } from './daemon/skill-pack-installer';
 export { TruthMemoryClient, TruthMemoryClientError } from './daemon/truth-memory-client';
 export type { LocalMemoryFilter, MemorySelector, TruthManifestQueryInput, TruthManifestRecord, TruthMemoryClientErrorCode, TruthMemoryClientOptions, TruthMemoryMetric, TruthSnapshotCandidateInput, TruthSnapshotWriteInput, TruthTerminalWriteInput, TruthWriteBody, TruthWriteResult, VerifiedTruthRecord, } from './daemon/truth-memory-client';
-export type { ConnectionState } from './daemon/ws-transport';
+export type { ConnectionState } from './daemon/connection-manager';
 export { ReplayCursorTooOldError } from './daemon/replay-cursor';
 export { BlobClient, BlobRequestAbortedError } from './daemon/blob-client';
 export type { BlobClientOptions, BlobRequestAbortReason, BlobRequestOptions, BlobResolver } from './daemon/blob-client';