@byok-sdk/client 0.12.0 → 0.14.0

package/dist/index.js

@@ -2,20 +2,142 @@ import { randomUUID, createHash, randomBytes, createPrivateKey, generateKeyPairS
 import { promises, mkdirSync, constants, existsSync, linkSync, fstatSync, lstatSync, unlinkSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, readFileSync, realpathSync } from 'fs';
 import * as path3 from 'path';
 import path3__default, { join, isAbsolute } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, isTaskOfferType, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, decodeEnvelope, createEnvelope, encodeEnvelope, PROTOCOL_VERSION, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, isServerToDaemonType, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
 import net2, { createServer, createConnection } from 'net';
 import * as os4 from 'os';
 import os4__default from 'os';
-import { execFile, spawn } from 'child_process';
+import { execFile, spawn, spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
 import { createInterface } from 'readline';
 import { parseDeviceAssertionEnvelope, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash as contentHash$1, TRUTH_RECORD_KINDS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, isTenantId, nonceSigningBytes, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
 import { promisify } from 'util';
 import * as fs14 from 'fs/promises';
-import { WebSocket } from 'ws';
 import { createRequire } from 'module';
 
-// src/agent-home.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/adapters/win32-job-object.ts
+var win32_job_object_exports = {};
+__export(win32_job_object_exports, {
+  Win32JobObjectFailure: () => Win32JobObjectFailure,
+  assignOwnedProcessToJob: () => assignOwnedProcessToJob,
+  isWin32JobObjectFailure: () => isWin32JobObjectFailure,
+  loadBindings: () => loadBindings
+});
+function isWin32JobObjectFailure(value) {
+  return value instanceof Error && value.name === "Win32JobObjectFailure";
+}
+function isNullHandle(value) {
+  return value === null || value === void 0 || value === 0n || value === 0;
+}
+async function loadBindings() {
+  if (cachedBindings !== void 0) return cachedBindings;
+  let koffi;
+  try {
+    const imported = await import('koffi');
+    koffi = imported.default ?? imported;
+  } catch (cause) {
+    throw new Win32JobObjectFailure({
+      step: "loadKoffi",
+      reason: "win32 runtime process ownership requires the koffi optional dependency, which could not be loaded"
+    }, { cause });
+  }
+  const kernel32 = koffi.load("kernel32.dll");
+  const PVOID = koffi.pointer("void");
+  const bind = (name, result, args) => kernel32.func("__stdcall", name, result, args);
+  cachedBindings = {
+    createJobObjectW: bind("CreateJobObjectW", PVOID, [PVOID, "str16"]),
+    setInformationJobObject: bind("SetInformationJobObject", "int", [PVOID, "int", PVOID, "uint32"]),
+    openProcess: bind("OpenProcess", PVOID, ["uint32", "int", "uint32"]),
+    assignProcessToJobObject: bind("AssignProcessToJobObject", "int", [PVOID, PVOID]),
+    closeHandle: bind("CloseHandle", "int", [PVOID]),
+    getLastError: bind("GetLastError", "uint32", [])
+  };
+  return cachedBindings;
+}
+function killOnCloseLimitInformation() {
+  const information = Buffer.alloc(JOBOBJECT_EXTENDED_LIMIT_SIZE);
+  information.writeUInt32LE(JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET);
+  return information;
+}
+function daemonJob(bindings) {
+  const existing = jobsByBindings.get(bindings);
+  if (existing !== void 0) return existing;
+  const job = bindings.createJobObjectW(null, null);
+  if (isNullHandle(job)) {
+    throw new Win32JobObjectFailure({
+      step: "CreateJobObjectW",
+      reason: "win32 runtime process ownership could not create the daemon kill-on-close job object",
+      win32Code: bindings.getLastError()
+    });
+  }
+  const information = killOnCloseLimitInformation();
+  if (bindings.setInformationJobObject(job, JobObjectExtendedLimitInformation, information, information.length) === 0) {
+    const win32Code = bindings.getLastError();
+    bindings.closeHandle(job);
+    throw new Win32JobObjectFailure({
+      step: "SetInformationJobObject",
+      reason: "win32 runtime process ownership could not make the daemon job object kill-on-close",
+      win32Code
+    });
+  }
+  jobsByBindings.set(bindings, job);
+  return job;
+}
+async function assignOwnedProcessToJob(pid, options) {
+  const bindings = options?.bindings ?? await loadBindings();
+  const job = daemonJob(bindings);
+  const processHandle = bindings.openProcess(OWNED_PROCESS_ACCESS, 0, pid);
+  if (isNullHandle(processHandle)) {
+    throw new Win32JobObjectFailure({
+      step: "OpenProcess",
+      reason: `win32 runtime process ownership could not open process ${pid} for job assignment`,
+      win32Code: bindings.getLastError()
+    });
+  }
+  try {
+    if (bindings.assignProcessToJobObject(job, processHandle) === 0) {
+      throw new Win32JobObjectFailure({
+        step: "AssignProcessToJobObject",
+        reason: `win32 runtime process ownership could not assign process ${pid} to the daemon kill-on-close job object`,
+        win32Code: bindings.getLastError()
+      });
+    }
+  } finally {
+    bindings.closeHandle(processHandle);
+  }
+}
+var JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, JobObjectExtendedLimitInformation, JOBOBJECT_EXTENDED_LIMIT_SIZE, JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET, PROCESS_SET_QUOTA, PROCESS_TERMINATE, OWNED_PROCESS_ACCESS, Win32JobObjectFailure, cachedBindings, jobsByBindings;
+var init_win32_job_object = __esm({
+  "src/adapters/win32-job-object.ts"() {
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 8192;
+    JobObjectExtendedLimitInformation = 9;
+    JOBOBJECT_EXTENDED_LIMIT_SIZE = 144;
+    JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET = 16;
+    PROCESS_SET_QUOTA = 256;
+    PROCESS_TERMINATE = 1;
+    OWNED_PROCESS_ACCESS = PROCESS_SET_QUOTA | PROCESS_TERMINATE;
+    Win32JobObjectFailure = class extends Error {
+      step;
+      win32Code;
+      constructor(input, options) {
+        super(input.reason, options);
+        this.name = "Win32JobObjectFailure";
+        this.step = input.step;
+        this.win32Code = input.win32Code;
+      }
+    };
+    jobsByBindings = /* @__PURE__ */ new WeakMap();
+  }
+});
 var tmpSeq = 0;
 async function atomicWriteFile(filePath, data, options = {}) {
   const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
@@ -423,6 +545,23 @@ async function resolveExistingAncestor(inputPath) {
     }
   }
 }
+async function canonicalPath(inputPath) {
+  const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
+  return path3__default.resolve(canonical2, ...tail);
+}
+async function assertRealDirectoryIfPresent(target) {
+  let stat;
+  try {
+    stat = await promises.lstat(target);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return;
+    throw error;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new AgentHomeResolutionError(`Agent home path component is not a real directory: ${target}`);
+  }
+}
 async function materializeDirectory(inputPath) {
   const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
   let cursor = canonical2;
@@ -517,6 +656,39 @@ var AgentHomeLayout = class {
       await gate.release();
     }
   }
+  /**
+   * Pure canonical-home derivation for read-only callers, such as the
+   * pre-admission single-writer count. It validates the AgentRef and joins
+   * exactly the same `<hostStorageRoot>/agents/<agentId>` segments
+   * {@link AgentHomeLayout.resolve} would, canonicalizing only the components
+   * that already exist.
+   *
+   * It deliberately creates no directory, takes no cross-process mutation
+   * gate and records no Agent binding, so an offer the host vetoes after the
+   * count leaves nothing behind on disk. `resolve()` stays the only path that
+   * may materialize a home or bind it to an Agent identity.
+   *
+   * An `agents` root or `agents/<agentId>` leaf that already exists but is a
+   * symlink (or any non-directory) is rejected here with the same error class
+   * and message `resolve()` raises for it, so an in-root `two -> one` link
+   * fails closed instead of silently keying the count of `one`. A leaf that
+   * does not exist yet is not an error: this derivation runs before the home
+   * is materialized. A home canonicalizing outside the `agents` root stays
+   * rejected as before.
+   */
+  async canonicalHomePath(agentRefInput) {
+    const agentRef = validateAgentRef(agentRefInput);
+    const hostStorageRoot = this.canonicalRoot ?? await canonicalPath(this.hostStorageRootInput);
+    const agentsRoot = path3__default.join(hostStorageRoot, AGENT_HOME_DIRECTORY);
+    await assertRealDirectoryIfPresent(agentsRoot);
+    const lexicalHome = path3__default.join(agentsRoot, agentRef.agentId);
+    await assertRealDirectoryIfPresent(lexicalHome);
+    const canonicalHome = await canonicalPath(lexicalHome);
+    if (canonicalHome === agentsRoot || !isWithin(agentsRoot, canonicalHome)) {
+      throw new AgentHomeResolutionError(`Agent home resolves outside the Agent home root: ${canonicalHome}`);
+    }
+    return canonicalHome;
+  }
   /**
    * Prove the canonical root is materializable and writable before the daemon
    * advertises Agent-home capability. No Agent identity or persistent Agent
@@ -833,6 +1005,44 @@ var AgentHomeExecutionLeaseManager = class _AgentHomeExecutionLeaseManager {
       });
     });
   }
+  /**
+   * WP0: Attempts currently holding an execution lease on this exact
+   * canonical home, across every lane and every session. This is the number
+   * the daemon's admission gate reads before any side effect — see
+   * `TaskRunner.handleOffer`'s per-home busy gate.
+   *
+   * Derived from the one lease registry above rather than a second tally, so
+   * it inherits the lease lifecycle exactly: an entry appears at `acquire()`,
+   * survives `bindSession()` (which rekeys in place), and disappears only at
+   * `release()`, which the task runner calls after the attempt is terminal
+   * AND `Session.close()` resolved. A failed disposal never reaches
+   * `release()`, so the slot stays held — fail closed, the same posture as
+   * `runtime-disposal-failed`. Crash residue needs nothing extra here: a
+   * restarted daemon starts with an empty registry and reclaims the on-disk
+   * marker only under the same stable owner identity (`openLeaseMarker`).
+   *
+   * Counted regardless of which lease manager owns the group: the invariant
+   * being protected is the filesystem path (`MEMORY.md`, `notes/`, `.git`),
+   * not the owner identity.
+   */
+  activeAttemptCount(canonicalHome) {
+    return _AgentHomeExecutionLeaseManager.groups.get(canonicalHome)?.leasesByKey.size ?? 0;
+  }
+  /**
+   * Counts-only readback for daemon/control status. Scoped to this manager's
+   * own leases, so the number describes this daemon rather than every home
+   * any manager in the process happens to hold. Never exposes a home path.
+   */
+  activeAttemptSummary() {
+    let homes = 0;
+    let attempts = 0;
+    for (const group of _AgentHomeExecutionLeaseManager.groups.values()) {
+      if (group.manager !== this.manager) continue;
+      homes += 1;
+      attempts += group.leasesByKey.size;
+    }
+    return { homes, attempts };
+  }
   async mutate(binding, operation) {
     return this.exclusive(binding.resolution.canonicalHome, async () => {
       const group = _AgentHomeExecutionLeaseManager.groups.get(binding.resolution.canonicalHome);
@@ -2036,13 +2246,22 @@ function freezeRuntimeAdapterDescriptor(descriptor) {
   });
 }
 function sealRuntimeOperationManifest(manifest) {
+  const dispatchSelection = manifest.dispatchSelection === void 0 ? void 0 : manifest.dispatchSelection.lane === "byok-profile" ? Object.freeze({
+    ...manifest.dispatchSelection,
+    providerProfile: Object.freeze({
+      ...manifest.dispatchSelection.providerProfile,
+      requiredCapabilities: Object.freeze([
+        ...manifest.dispatchSelection.providerProfile.requiredCapabilities
+      ])
+    })
+  }) : Object.freeze({ ...manifest.dispatchSelection });
   return Object.freeze({
     taskId: manifest.taskId,
     runtimeId: manifest.runtimeId,
     descriptor: freezeRuntimeAdapterDescriptor(manifest.descriptor),
     policy: frozenPolicy(manifest.policy),
     requiredToolsetIds: Object.freeze([...manifest.requiredToolsetIds]),
-    ...manifest.dispatchSelection === void 0 ? {} : { dispatchSelection: Object.freeze({ ...manifest.dispatchSelection }) },
+    ...dispatchSelection === void 0 ? {} : { dispatchSelection },
     ...manifest.sessionRef === void 0 ? {} : { sessionRef: manifest.sessionRef },
     ...manifest.agentRef === void 0 ? {} : { agentRef: Object.freeze({ agentId: manifest.agentRef.agentId, profileRevision: manifest.agentRef.profileRevision }) },
     cwd: manifest.cwd ?? manifest.workspace.workspaceDir,
@@ -2282,6 +2501,9 @@ function parseTeamMessageReadParams(value) {
   if (!isRecord2(value) || !exactKeys(value, ["context", "afterSeq"]) || !contextString(value.context) || value.afterSeq !== void 0 && !safeInteger(value.afterSeq)) return void 0;
   return { context: value.context, ...value.afterSeq === void 0 ? {} : { afterSeq: value.afterSeq } };
 }
+function parseTeamNotificationSnapshotParams(value) {
+  return parseTeamMessageReadParams(value);
+}
 function parseTeamMessageAckParams(value) {
   if (!isRecord2(value) || !exactKeys(value, ["context", "throughSeq"]) || !contextString(value.context) || !safeInteger(value.throughSeq)) return void 0;
   return { context: value.context, throughSeq: value.throughSeq };
@@ -3942,6 +4164,55 @@ function withOwnedProcessTree(options) {
     ...process.platform === "win32" ? { windowsHide: true } : { detached: true }
   };
 }
+var hostExitTargets = /* @__PURE__ */ new Map();
+var hostExitHandlerInstalled = false;
+function terminateOwnedTreesForHostExit() {
+  for (const target of hostExitTargets.values()) {
+    try {
+      if (target.platform === "win32") {
+        target.spawnSyncFn("taskkill", ["/PID", String(target.pid), "/T", "/F"], {
+          stdio: "ignore",
+          windowsHide: true
+        });
+      } else {
+        target.kill(-target.pid, "SIGKILL");
+      }
+    } catch {
+    }
+  }
+  hostExitTargets.clear();
+}
+function ensureHostExitHandler() {
+  if (hostExitHandlerInstalled) return;
+  hostExitHandlerInstalled = true;
+  process.prependListener("exit", terminateOwnedTreesForHostExit);
+}
+var defaultJobObject = {
+  async assign(pid) {
+    const { assignOwnedProcessToJob: assignOwnedProcessToJob2 } = await Promise.resolve().then(() => (init_win32_job_object(), win32_job_object_exports));
+    await assignOwnedProcessToJob2(pid);
+  }
+};
+async function adoptOwnedProcessTree(options) {
+  const pid = positivePid(options.child, options.label);
+  if (pid === void 0) return;
+  const platform = options.platform ?? process.platform;
+  ensureHostExitHandler();
+  hostExitTargets.set(options.child, {
+    pid,
+    label: options.label,
+    platform,
+    kill: options.killFn ?? defaultKill,
+    spawnSyncFn: options.spawnSyncFn ?? spawnSync
+  });
+  const forget = () => {
+    hostExitTargets.delete(options.child);
+  };
+  options.child.once("close", forget);
+  options.child.once("exit", forget);
+  if (platform !== "win32") return;
+  await (options.jobObject ?? defaultJobObject).assign(pid);
+}
 function positivePid(child, label) {
   const pid = child.pid;
   if (pid === void 0) return void 0;
@@ -4153,21 +4424,8 @@ async function disposeOwnedProcessTree(options) {
 var STDERR_RING_CAPACITY = 20;
 var DIALOG_UI_METHODS = /* @__PURE__ */ new Set(["select", "confirm", "input", "editor"]);
 var PiRpcClient = class {
-  child;
-  buffer = "";
-  nextId = 1;
-  pending = /* @__PURE__ */ new Map();
-  eventQueue = new AsyncQueue();
-  closed = false;
-  exitError;
-  closedPromise;
-  resolveClosed;
-  disposalAttempt;
-  /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
-  stderrRing = [];
-  /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
-  unmappedFrameCounts = /* @__PURE__ */ new Map();
   constructor(options) {
+    this.options = options;
     const spawnFn = options.spawnFn ?? spawn;
     this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
@@ -4177,6 +4435,9 @@ var PiRpcClient = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -4188,10 +4449,37 @@ var PiRpcClient = class {
       this.onClosed(err);
     });
   }
-  /** Send a command, resolved with its correlated `response` message. */
-  send(command) {
+  options;
+  child;
+  buffer = "";
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  eventQueue = new AsyncQueue();
+  closed = false;
+  exitError;
+  closedPromise;
+  resolveClosed;
+  disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts, so it — not the exit code of the kill we ourselves requested — becomes this client's exit error. */
+  adoptionFailure;
+  /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
+  stderrRing = [];
+  /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
+  unmappedFrameCounts = /* @__PURE__ */ new Map();
+  /**
+   * Send a command, resolved with its correlated `response` message.
+   *
+   * Adoption is awaited FIRST — this is `PiAdapter.start()`'s first awaited
+   * operation, so an unbackstopped tree never receives the initial prompt and
+   * never yields a session. The wait costs one settled-promise turn once the
+   * tree is adopted; every later command sees it already resolved.
+   */
+  async send(command) {
+    await this.adopted;
     if (this.closed) {
-      return Promise.reject(this.exitError ?? new Error("pi process is closed"));
+      throw this.exitError ?? new Error("pi process is closed");
     }
     const id = command.id ?? `req-${this.nextId++}`;
     const full = { ...command, id };
@@ -4264,6 +4552,32 @@ var PiRpcClient = class {
       label: "pi"
     };
   }
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority and the failure is re-thrown, which is what makes the
+   * first `send()` — and therefore `PiAdapter.start()` — fail before any
+   * session is published. Both cleanup attempts are best-effort because the
+   * adoption failure, not a terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "pi",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+  }
   onData(chunk) {
     this.buffer += chunk;
     let newlineIndex = this.buffer.indexOf("\n");
@@ -4282,6 +4596,7 @@ var PiRpcClient = class {
     } catch {
       return;
     }
+    this.options.onFrame?.(msg);
     if (msg.type === "response" && typeof msg.id === "string" && this.pending.has(msg.id)) {
       const waiter = this.pending.get(msg.id);
       this.pending.delete(msg.id);
@@ -4289,11 +4604,20 @@ var PiRpcClient = class {
       return;
     }
     if (msg.type === "extension_ui_request" && typeof msg.id === "string" && typeof msg.method === "string") {
-      this.respondToExtensionUiRequest(msg.id, msg.method);
+      if (this.options.extensionUi?.mode === "hold") this.options.extensionUi.onRequest(msg);
+      else this.respondToExtensionUiRequest(msg.id, msg.method);
       return;
     }
     this.eventQueue.push(msg);
   }
+  /** Write an explicit host-owned response; completion is a transport receipt only. */
+  async respondExtensionUi(response) {
+    if (this.options.extensionUi?.mode !== "hold") throw new Error("Pi interactions are not host-owned");
+    await this.adopted;
+    if (this.closed) throw new Error("Pi process is closed");
+    await new Promise((resolve, reject) => this.child.stdin.write(`${JSON.stringify({ type: "extension_ui_response", ...response })}
+`, (error) => error ? reject(error) : resolve()));
+  }
   /**
    * Answer pi's extension-UI blocking protocol headlessly (rpc.md's
    * "Extension UI Protocol"). Fail-closed policy, stated explicitly because
@@ -4347,9 +4671,10 @@ var PiRpcClient = class {
   onClosed(err) {
     if (this.closed) return;
     this.closed = true;
-    this.exitError = err;
+    const terminal = this.adoptionFailure ?? err;
+    this.exitError = terminal;
     this.resolveClosed();
-    for (const [, waiter] of this.pending) waiter.reject(err);
+    for (const [, waiter] of this.pending) waiter.reject(terminal);
     this.pending.clear();
     this.eventQueue.end();
   }
@@ -4383,6 +4708,8 @@ var PROVIDER_CREDENTIAL_ENV_DENY_NAMES = [
   "TOGETHER_API_KEY",
   "BASETEN_API_KEY",
   "KIMI_API_KEY",
+  "HF_TOKEN",
+  "MOONSHOT_API_KEY",
   "MINIMAX_API_KEY",
   "MINIMAX_CN_API_KEY",
   "QWEN_TOKEN_PLAN_API_KEY",
@@ -4464,7 +4791,11 @@ function validatePiByokLauncherConfig(launcher) {
     "--macos-keychain-path",
     "--secret-service-prefix",
     "--provider",
-    "--model"
+    "--model",
+    "--profile-revision",
+    "--profile-hash",
+    "--required-capabilities",
+    "--validate-only"
   ]);
   const conflicting = launcher.args?.find((arg) => reserved.has(arg));
   if (conflicting !== void 0) {
@@ -4526,11 +4857,17 @@ var PiAdapter = class {
     const bin = this.resolveBin();
     const extensions = (this.options.resolveExtensions ?? resolvePiExtensions)();
     const selection = input.offer.dispatchSelection;
-    const pinnedSelection = selection === void 0 ? void 0 : Object.freeze({ ...selection });
+    const pinnedSelection = selection === void 0 ? void 0 : selection.lane === "byok-profile" ? Object.freeze({
+      ...selection,
+      providerProfile: Object.freeze({
+        ...selection.providerProfile,
+        requiredCapabilities: Object.freeze([...selection.providerProfile.requiredCapabilities])
+      })
+    }) : Object.freeze({ ...selection });
     let command = bin.command;
     let launcherArgs;
     if (pinnedSelection !== void 0) {
-      if (pinnedSelection.lane !== "byok" || pinnedSelection.runtimeId !== "pi") {
+      if (pinnedSelection.lane !== "byok" && pinnedSelection.lane !== "byok-profile" || pinnedSelection.runtimeId !== "pi") {
         return { kind: "reject", reason: `pi adapter cannot execute ${pinnedSelection.lane} selection for runtime ${pinnedSelection.runtimeId}`, retryable: false };
       }
       const launcher = this.options.byokLauncher;
@@ -4538,6 +4875,21 @@ var PiAdapter = class {
         return { kind: "reject", reason: "pi BYOK selection requires a configured credential-custody launcher", retryable: false };
       }
       command = launcher.command;
+      const providerProfile = pinnedSelection.lane === "byok-profile" ? pinnedSelection.providerProfile : void 0;
+      if (providerProfile !== void 0) {
+        try {
+          await (this.options.validateProviderProfileBinding ?? validateProviderProfileBindingWithLauncher)(
+            providerProfile,
+            launcher
+          );
+        } catch (error) {
+          return {
+            kind: "reject",
+            reason: `provider profile admission failed: ${errorMessage3(error)}`,
+            retryable: false
+          };
+        }
+      }
       launcherArgs = [
         ...launcher.args ?? [],
         "--pi-bin",
@@ -4549,9 +4901,19 @@ var PiAdapter = class {
         ...launcher.macosKeychainPath !== void 0 ? ["--macos-keychain-path", launcher.macosKeychainPath] : [],
         ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
         "--provider",
-        pinnedSelection.providerId,
+        providerProfile?.profileRef ?? (pinnedSelection.lane === "byok" ? pinnedSelection.providerId : ""),
         "--model",
-        pinnedSelection.modelId
+        providerProfile?.modelId ?? (pinnedSelection.lane === "byok" ? pinnedSelection.modelId : ""),
+        ...providerProfile === void 0 ? [] : [
+          "--profile-revision",
+          providerProfile.profileRevision,
+          "--profile-hash",
+          providerProfile.profileHash,
+          "--required-capabilities",
+          JSON.stringify(providerProfile.requiredCapabilities),
+          "--validate-only",
+          "false"
+        ]
       ];
     }
     return {
@@ -4694,8 +5056,42 @@ var PiAdapter = class {
     return (this.options.resolveBin ?? resolvePiBin)();
   }
 };
+async function validateProviderProfileBindingWithLauncher(binding, launcher) {
+  await execFileAsync(launcher.command, [
+    ...launcher.args ?? [],
+    "--pi-bin",
+    process.execPath,
+    "--profile-db",
+    launcher.profileDbPath,
+    "--session-dir",
+    launcher.sessionDir,
+    "--provider",
+    binding.profileRef,
+    "--model",
+    binding.modelId,
+    "--profile-revision",
+    binding.profileRevision,
+    "--profile-hash",
+    binding.profileHash,
+    "--required-capabilities",
+    JSON.stringify(binding.requiredCapabilities),
+    "--validate-only",
+    "true",
+    ...launcher.macosKeychainPath !== void 0 ? ["--macos-keychain-path", launcher.macosKeychainPath] : [],
+    ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : []
+  ], { timeout: DETECT_TIMEOUT_MS });
+}
 function sameDispatchSelection(left, right) {
   if (left === void 0 || right === void 0) return left === right;
+  if (left.lane === "byok-profile" || right.lane === "byok-profile") {
+    if (left.lane !== "byok-profile" || right.lane !== "byok-profile") return false;
+    if (left.runtimeId !== right.runtimeId) return false;
+    const leftProfile = left.providerProfile;
+    const rightProfile = right.providerProfile;
+    return leftProfile.profileRef === rightProfile.profileRef && leftProfile.profileRevision === rightProfile.profileRevision && leftProfile.profileHash === rightProfile.profileHash && leftProfile.modelId === rightProfile.modelId && leftProfile.requiredCapabilities.length === rightProfile.requiredCapabilities.length && leftProfile.requiredCapabilities.every(
+      (capability, index) => capability === rightProfile.requiredCapabilities[index]
+    );
+  }
   return left.lane === right.lane && left.runtimeId === right.runtimeId && left.providerId === right.providerId && left.modelId === right.modelId;
 }
 async function resolveAuthoritativeSessionId(rpc) {
@@ -5135,6 +5531,10 @@ var ClaudeProcessClient = class {
   closedPromise;
   resolveClosed;
   disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts, so it — not the exit code of the kill we ourselves requested — becomes this client's exit error. */
+  adoptionFailure;
   stderrRing = [];
   unmappedFrameCounts = /* @__PURE__ */ new Map();
   sessionId;
@@ -5149,6 +5549,9 @@ var ClaudeProcessClient = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -5192,9 +5595,10 @@ var ClaudeProcessClient = class {
    * same id; if the process already closed before init ever arrived,
    * every call rejects with that same exit error.
    */
-  waitForInit() {
-    if (this.sessionId !== void 0) return Promise.resolve(this.sessionId);
-    if (this.closed) return Promise.reject(this.exitError ?? new Error("claude process is closed"));
+  async waitForInit() {
+    await this.adopted;
+    if (this.sessionId !== void 0) return this.sessionId;
+    if (this.closed) throw this.exitError ?? new Error("claude process is closed");
     return new Promise((resolve, reject) => {
       this.initWaiter = { resolve, reject };
     });
@@ -5258,6 +5662,32 @@ var ClaudeProcessClient = class {
       label: "claude"
     };
   }
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority and the failure is re-thrown, which is what makes
+   * `waitForInit()` — and therefore `ClaudeAdapter.start()` — fail before any
+   * session is published. Both cleanup attempts are best-effort because the
+   * adoption failure, not a terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "claude",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+  }
   onData(chunk) {
     this.buffer += chunk;
     let newlineIndex = this.buffer.indexOf("\n");
@@ -5306,9 +5736,10 @@ var ClaudeProcessClient = class {
   onClosed(err) {
     if (this.closed) return;
     this.closed = true;
-    this.exitError = err;
+    const terminal = this.adoptionFailure ?? err;
+    this.exitError = terminal;
     this.resolveClosed();
-    this.initWaiter?.reject(err);
+    this.initWaiter?.reject(terminal);
     this.initWaiter = void 0;
     this.eventQueue.end();
   }
@@ -6175,6 +6606,19 @@ var CodexProcessRunner = class {
   closedPromise;
   resolveClosed;
   disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts; `buildExitError` reports it instead of the exit status of the kill we ourselves requested. */
+  adoptionFailure;
+  adoption = "pending";
+  /**
+   * Lines parsed before adoption settled. Unlike pi and claude, this runner has
+   * no first awaited operation of its own to gate on — its caller reads the
+   * FIRST event as the authoritative thread id. Holding events until the tree
+   * is backstopped is what keeps that caller from publishing a session for a
+   * tree the job object never took.
+   */
+  deferredEvents = [];
   constructor(options) {
     this.onEvent = options.onEvent;
     const spawnFn = options.spawnFn ?? spawn;
@@ -6186,6 +6630,9 @@ var CodexProcessRunner = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -6251,8 +6698,58 @@ var CodexProcessRunner = class {
       label: "codex"
     };
   }
-  /** Builds a descriptive error folding in the exit code/signal and the stderr tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a failed start/resume should never need separately re-running codex by hand with a raw JSONL logger to learn why. */
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority, every parsed line is dropped instead of delivered, and
+   * the resulting close makes the caller's own `waitClosed()` race reject with
+   * the adoption failure (`buildExitError`) before a thread id is published.
+   * Both cleanup attempts are best-effort because the adoption failure, not a
+   * terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "codex",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      this.adoption = "failed";
+      this.deferredEvents.length = 0;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+    this.adoption = "adopted";
+    for (const evt of this.deferredEvents.splice(0)) this.onEvent(evt);
+  }
+  /** Arrival-order delivery, held back until the tree is backstopped (see `deferredEvents`). */
+  deliver(evt) {
+    if (this.adoption === "failed") return;
+    if (this.adoption === "pending") {
+      this.deferredEvents.push(evt);
+      return;
+    }
+    this.onEvent(evt);
+  }
+  /**
+   * Builds a descriptive error folding in the exit code/signal and the stderr
+   * tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a
+   * failed start/resume should never need separately re-running codex by hand
+   * with a raw JSONL logger to learn why.
+   *
+   * A tree this runner could not backstop is the one exception: that process
+   * exited because THIS runner killed it, so `exit code=null, signal=SIGKILL`
+   * plus an empty stderr tail would bury the only reason anyone can act on.
+   */
   buildExitError(context) {
+    if (this.adoptionFailure !== void 0) return this.adoptionFailure;
     const parts = [`${context} (exit code=${this.exitCode}, signal=${this.exitSignal})`];
     if (this.stderrRing.length > 0) {
       parts.push(`stderr: ${this.stderrRing.join(" | ")}`);
@@ -6280,7 +6777,7 @@ var CodexProcessRunner = class {
     if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
       return;
     }
-    this.onEvent(parsed);
+    this.deliver(parsed);
   }
   onStderr(chunk) {
     for (const rawLine of chunk.split("\n")) {
@@ -7603,19 +8100,14 @@ function signNonce(privateKey, nonce) {
   const signature = sign(null, nonceSigningBytes(nonce), privateKey);
   return signature.toString("base64url");
 }
+
+// src/daemon/url.ts
 function toHttpBase(serverUrl) {
   const url = new URL(serverUrl);
-  if (url.protocol === "ws:") url.protocol = "http:";
-  else if (url.protocol === "wss:") url.protocol = "https:";
   url.pathname = "/";
   url.search = "";
   return url.toString();
 }
-function toWsUrl(serverUrl) {
-  const url = new URL(BYOK_WS_PATH, toHttpBase(serverUrl));
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  return url.toString();
-}
 function describeEndpoint(transport, url) {
   const parsed = typeof url === "string" ? new URL(url) : url;
   return { transport, host: parsed.host, path: parsed.pathname };
@@ -7648,17 +8140,15 @@ function assertServerUrlAllowed(rawUrl, opts = {}) {
   const endpoint = formatServerUrl(url);
   switch (url.protocol) {
     case "https:":
-    case "wss:":
       return;
     case "http:":
-    case "ws:":
       if (opts.dangerouslyAllowInsecureRemote || isLoopbackHostname(url.hostname)) return;
       throw new InsecureServerUrlError(
-        `refusing to connect to "${endpoint}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use wss:/https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
+        `refusing to connect to "${endpoint}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
       );
     default:
       throw new InsecureServerUrlError(
-        `refusing to connect to "${endpoint}" \u2014 unsupported scheme "${url.protocol}" (expected http:, https:, ws:, or wss:).`
+        `refusing to connect to "${endpoint}" \u2014 unsupported scheme "${url.protocol}" (expected http: or https:).`
       );
   }
 }
@@ -9320,6 +9810,28 @@ var LocalTeamWorkspace = class {
       return Object.freeze({ accepted: true, durable: true, workspaceId: state.definition.workspaceId, memberId: input.lease.memberId, seq, messageId: message.messageId, message: publicValue });
     });
   }
+  /** Metadata-only operator notification view. Never advances delivery or acknowledgement. */
+  async notificationSnapshot(input) {
+    assertLeaseShape(input?.lease);
+    if (input.afterSeq !== void 0) assertAfterSeq(input.afterSeq);
+    return this.enqueue(async () => {
+      const state = await this.resolveLease(await this.load(), input.lease);
+      const acknowledgedThroughSeq = state.receipts[input.lease.memberId].acknowledgedThroughSeq;
+      const after = Math.max(input.afterSeq ?? 0, acknowledgedThroughSeq);
+      let latestPeerSeq = null;
+      for (const message of state.messages) {
+        if (message.seq > after && message.senderMemberId !== input.lease.memberId) latestPeerSeq = message.seq;
+      }
+      return Object.freeze({
+        workspaceId: state.definition.workspaceId,
+        memberId: input.lease.memberId,
+        registryRevision: state.definition.revision,
+        expiresAt: input.lease.expiresAt,
+        acknowledgedThroughSeq,
+        latestPeerSeq
+      });
+    });
+  }
   async readMessages(input) {
     assertLeaseShape(input?.lease);
     if (input?.afterSeq !== void 0) assertAfterSeq(input.afterSeq);
@@ -9710,7 +10222,7 @@ var LongPollRouteError = class extends Error {
 };
 var MAX_TRACKED_VALIDATION_FAILURE_WARNINGS = 1e3;
 var MAX_TRACKED_ROUTE_FAILURE_WARNINGS = 1e3;
-function parseLooseEventsPollResponse(raw) {
+function parseLooseEventsPollResponse(raw, requestedCursor) {
   if (typeof raw !== "object" || raw === null) {
     throw new Error("events poll response is not an object");
   }
@@ -9718,19 +10230,49 @@ function parseLooseEventsPollResponse(raw) {
   if (!Array.isArray(events)) {
     throw new Error("events poll response.events is not an array");
   }
-  if (typeof cursor !== "number" || !Number.isInteger(cursor)) {
-    throw new Error("events poll response.cursor is not an integer");
+  if (!isSafeNonnegativeInteger(cursor)) {
+    throw new Error("events poll response.cursor is not a safe nonnegative integer");
+  }
+  if (cursor < requestedCursor) {
+    throw new Error("events poll response.cursor regressed below the requested cursor");
   }
   if (capabilities !== void 0 && (!Array.isArray(capabilities) || capabilities.some((flag) => typeof flag !== "string"))) {
     throw new Error("events poll response.capabilities is not an array of strings");
   }
   return { events, cursor, capabilities: capabilities ?? [] };
 }
-function extractSkippableSeq(raw) {
+function isSafeNonnegativeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function validateTrustedEventsPage(events, requestedCursor, pageCursor) {
+  let previousTaskSeq;
+  for (const raw of events) {
+    if (typeof raw !== "object" || raw === null) throw new Error("events page contains an unidentifiable message");
+    const { type, seq } = raw;
+    if (typeof type !== "string") throw new Error("events page message has no authoritative type");
+    if (type.startsWith("conn.")) continue;
+    if (!isSafeNonnegativeInteger(seq)) {
+      throw new Error("events poll task seq is not a safe nonnegative integer");
+    }
+    if (seq <= requestedCursor || seq > pageCursor) {
+      throw new Error("events poll task seq lies outside the trusted page cursor range");
+    }
+    if (previousTaskSeq !== void 0 && seq <= previousTaskSeq) {
+      throw new Error("events poll task seq is not strictly page ordered");
+    }
+    const knownTaskType = MESSAGE_TYPES.includes(type);
+    const predecessor = previousTaskSeq ?? requestedCursor;
+    if (!knownTaskType && seq !== predecessor + 1) {
+      throw new Error("events poll unknown task seq would cross an untrusted gap");
+    }
+    previousTaskSeq = seq;
+  }
+}
+function extractExecutableSeq(raw) {
   if (typeof raw !== "object" || raw === null) return void 0;
   const { type, seq } = raw;
-  if (typeof type !== "string" || !type.startsWith("task.")) return void 0;
-  return typeof seq === "number" && Number.isInteger(seq) ? seq : void 0;
+  if (typeof type !== "string" || type.startsWith("conn.")) return void 0;
+  return isSafeNonnegativeInteger(seq) ? seq : void 0;
 }
 var LongPollClient = class {
   constructor(opts) {
@@ -9741,6 +10283,8 @@ var LongPollClient = class {
   }
   opts;
   running = false;
+  /** Owns exactly one active loop generation, including its held GET and retry delays. */
+  loopAbortController;
   /**
    * Finding R1: seqs this loop has already `console.warn`'d about for a
    * validation-failed (recognized-type, invalid-payload) entry — a poison
@@ -9800,16 +10344,22 @@ var LongPollClient = class {
   noteRevoked(err) {
     if (!(err instanceof DeviceRevokedError)) return false;
     this.running = false;
+    this.loopAbortController?.abort();
     this.opts.onRevoked?.();
     return true;
   }
   start() {
     if (this.running) return;
     this.running = true;
-    void this.loop();
+    const controller = new AbortController();
+    this.loopAbortController = controller;
+    void this.loop(controller.signal).finally(() => {
+      if (this.loopAbortController === controller) this.loopAbortController = void 0;
+    });
   }
   stop() {
     this.running = false;
+    this.loopAbortController?.abort();
   }
   /**
    * POST one batch of envelopes to `/byok/messages` (finding F6/protocol
@@ -9818,14 +10368,14 @@ var LongPollClient = class {
    * (`ConnectionHub.handleInbound`), so a resend of the SAME batch (same
    * envelope `id`s — the caller must never rebuild them) is deduped
    * server-side into a safe no-op rather than reprocessed (§9). Returns
-   * `true` once the server has accepted the batch.
+   * validated frozen-v1 counts only after a readable response body.
    */
   async postBatch(envelopes) {
     try {
       await this.opts.auth.getValidAccessToken();
     } catch (err) {
       this.noteRevoked(err);
-      return false;
+      return void 0;
     }
     let res;
     try {
@@ -9841,23 +10391,26 @@ var LongPollClient = class {
       );
     } catch (err) {
       if (!this.noteRevoked(err)) this.warnRouteFailure(this.messagesEndpoint, void 0, err);
-      return false;
+      return void 0;
     }
     if (!res.ok) {
       this.warnRouteFailure(this.messagesEndpoint, res.status, void 0);
-      return false;
+      return void 0;
     }
     try {
-      MessagesSendResponseSchema.parse(await res.json());
+      const response = MessagesSendResponseSchema.parse(await res.json());
+      if (response.accepted + (response.rejected ?? 0) !== envelopes.length) {
+        throw new Error("messages response counts do not match the posted batch length");
+      }
+      return response;
     } catch (err) {
       this.warnRouteFailure(this.messagesEndpoint, res.status, err);
-      return false;
+      return void 0;
     }
-    return true;
   }
-  async loop() {
+  async loop(signal) {
     let retryAttempt = 0;
-    while (this.running) {
+    while (this.running && !signal.aborted) {
       try {
         await this.opts.auth.getValidAccessToken();
         const base = toHttpBase(this.opts.serverUrl);
@@ -9866,8 +10419,9 @@ var LongPollClient = class {
         if (cursor !== void 0) url.searchParams.set("cursor", String(cursor));
         let res;
         try {
-          res = await authedFetch(url, { method: "GET" }, this.opts.auth);
+          res = await authedFetch(url, { method: "GET", signal }, this.opts.auth);
         } catch (err) {
+          if (signal.aborted) return;
           if (!(err instanceof DeviceRevokedError)) {
             this.warnRouteFailure(this.eventsEndpoint, void 0, err);
           }
@@ -9881,69 +10435,63 @@ var LongPollClient = class {
             return;
           }
           this.warnRouteFailure(this.eventsEndpoint, res.status, void 0);
-          this.opts.onServerCapabilities?.([]);
+          this.opts.onServerCapabilitiesInvalidated?.();
+          this.opts.onPollFailure?.();
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
-          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
           continue;
         }
         let parsed;
         try {
-          parsed = parseLooseEventsPollResponse(await res.json());
+          parsed = parseLooseEventsPollResponse(await res.json(), cursor ?? 0);
+          validateTrustedEventsPage(parsed.events, cursor ?? 0, parsed.cursor);
         } catch (err) {
           this.warnRouteFailure(this.eventsEndpoint, res.status, err);
           throw err;
         }
         this.opts.onServerCapabilities?.(parsed.capabilities);
         let hadValidationFailureThisBatch = false;
+        let acceptedAnyEntry = false;
         for (const raw of parsed.events) {
           let envelope;
           try {
             envelope = parseMessage(raw);
           } catch (err) {
-            if (err instanceof UnknownMessageTypeError) {
-              const skippableSeq = extractSkippableSeq(raw);
-              if (skippableSeq !== void 0) this.opts.onSkippedSeq?.(skippableSeq);
-            } else {
-              const failedSeq = extractSkippableSeq(raw);
-              if (failedSeq !== void 0) {
-                hadValidationFailureThisBatch = true;
-                this.opts.onValidationFailedSeq?.(failedSeq);
-                if (!this.warnedValidationFailureSeqs.has(failedSeq)) {
-                  if (this.warnedValidationFailureSeqs.size > MAX_TRACKED_VALIDATION_FAILURE_WARNINGS) {
-                    this.warnedValidationFailureSeqs.clear();
-                  }
-                  this.warnedValidationFailureSeqs.add(failedSeq);
-                  console.warn(
-                    `[byok/client] long-poll: a recognized message type at seq=${failedSeq} failed payload validation \u2014 skipped for this batch, cursor frozen so the server keeps redelivering it until a corrected version arrives:`,
-                    err
-                  );
-                }
+            const failedSeq = extractExecutableSeq(raw);
+            if (failedSeq !== void 0) {
+              hadValidationFailureThisBatch = true;
+              this.opts.onValidationFailedSeq?.(failedSeq);
+              if (!this.warnedValidationFailureSeqs.has(failedSeq)) {
+                if (this.warnedValidationFailureSeqs.size > MAX_TRACKED_VALIDATION_FAILURE_WARNINGS) this.warnedValidationFailureSeqs.clear();
+                this.warnedValidationFailureSeqs.add(failedSeq);
+                console.warn(`[byok/client] long-poll: unknown or invalid executable message at seq=${failedSeq}; cursor frozen without durable disposition`, err);
               }
             }
             continue;
           }
-          this.opts.onEnvelope(envelope);
+          if (this.opts.onEnvelope(envelope) !== false) acceptedAnyEntry = true;
         }
         if (parsed.events.length === 0) {
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
-          await sleep(this.opts.idleDelayMs ?? 250);
-        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch) {
+          await sleep(this.opts.idleDelayMs ?? 250, signal);
+        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch || !acceptedAnyEntry && this.opts.getCursor() === cursor) {
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
-          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+          await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
         } else {
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
         }
       } catch (err) {
-        this.opts.onServerCapabilities?.([]);
+        this.opts.onServerCapabilitiesInvalidated?.();
         if (this.noteRevoked(err)) return;
-        if (!this.running) return;
+        if (!this.running || signal.aborted) return;
+        this.opts.onPollFailure?.();
         this.opts.onOperationalOutcome?.("failure");
         const baseMs = this.opts.retryDelayMs ?? 2e3;
-        await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs);
+        await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
       }
     }
   }
@@ -9963,20 +10511,24 @@ async function parseReplayCursorTooOld(res) {
   }
   return new ReplayCursorTooOldError(recoverableFrom);
 }
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const finish = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolve();
+    };
+    const timer = setTimeout(finish, ms);
+    signal.addEventListener("abort", finish, { once: true });
+  });
 }
-var WsUnexpectedStatusError = class extends Error {
-  constructor(status, endpoint) {
-    super(`WS upgrade rejected with HTTP ${status} (ws ${endpoint.host}${endpoint.path})`);
-    this.status = status;
-    this.endpoint = endpoint;
-    this.name = "WsUnexpectedStatusError";
-  }
-  status;
-  endpoint;
-};
-function createConnectionHelloEnvelope(opts) {
+
+// src/daemon/connection-manager.ts
+function isCursorEnvelopeType(type) {
+  return isServerToDaemonType(type) && !type.startsWith("conn.");
+}
+function createConnectionHelloEnvelope(opts, getCursor) {
   const configuredToolsets = opts.getConfiguredToolsets?.();
   return createEnvelope("conn.hello", {
     protocolVersions: [PROTOCOL_VERSION],
@@ -9986,234 +10538,35 @@ function createConnectionHelloEnvelope(opts) {
     clientVersion: opts.clientVersion,
     runtimes: opts.runtimes,
     configuredToolsets: configuredToolsets === void 0 ? void 0 : [...configuredToolsets],
-    cursor: opts.getCursor?.()
+    cursor: getCursor()
   });
 }
-var WsTransport = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  socket;
-  closedByUser = false;
-  autoReconnect = true;
-  acked = false;
-  everAckedThisAttempt = false;
-  reconnectAttempt = 0;
-  reconnectTimer;
-  livenessTimer;
-  lastActivity = 0;
-  lastUnexpectedStatus;
-  ackWaiters = [];
-  connect(opts = {}) {
-    this.autoReconnect = opts.auto ?? true;
-    this.closedByUser = false;
-    void this.openSocket();
-  }
-  /** Stop scheduling further reconnect attempts (any pending one is cancelled too); the current socket, if any, is left alone. Used when handing retry ownership to a slower external cadence (e.g. the long-poll fallback's periodic WS probe). */
-  stopAutoReconnect() {
-    this.autoReconnect = false;
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = void 0;
-    }
-  }
-  /** Resume normal auto-reconnect-on-close behavior (does not itself trigger a connect — only affects future closes). */
-  resumeAutoReconnect() {
-    this.autoReconnect = true;
-  }
-  get isOpen() {
-    return this.acked;
-  }
-  /**
-   * Attempt to send ONE envelope right now; returns whether it actually went
-   * out. `false` means the socket isn't currently open+acked — the caller
-   * (`ConnectionManager.drainOutbox`, Design B/finding N4) owns re-queueing
-   * and retrying later (e.g. on the next `onAcked`), since this transport no
-   * longer buffers anything itself.
-   */
-  sendNow(envelope) {
-    if (this.socket && this.socket.readyState === WebSocket.OPEN && this.acked) {
-      this.socket.send(encodeEnvelope(envelope));
-      return true;
-    }
-    return false;
-  }
-  waitForAck(timeoutMs = 1e4) {
-    if (this.acked) return Promise.resolve();
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error("Timed out waiting for conn.ack")), timeoutMs);
-      this.ackWaiters.push({
-        resolve: () => {
-          clearTimeout(timer);
-          resolve();
-        },
-        reject: (err) => {
-          clearTimeout(timer);
-          reject(err);
-        }
-      });
-    });
-  }
-  close() {
-    this.closedByUser = true;
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.socket?.close();
-  }
-  async openSocket() {
-    const url = toWsUrl(this.opts.serverUrl);
-    const endpoint = describeEndpoint("ws", url);
-    this.acked = false;
-    this.everAckedThisAttempt = false;
-    this.opts.onStateChange?.("connecting");
-    let token;
-    try {
-      token = await this.opts.getToken();
-    } catch (err) {
-      this.opts.onStateChange?.("closed");
-      this.opts.onConnectOutcome?.(false, err, endpoint);
-      if (!this.closedByUser && this.autoReconnect) this.scheduleReconnect();
-      return;
-    }
-    const socket = new WebSocket(url, {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    this.socket = socket;
-    this.lastActivity = Date.now();
-    this.startLivenessCheck(socket);
-    socket.on("open", () => {
-      const hello = createConnectionHelloEnvelope(this.opts);
-      socket.send(encodeEnvelope(hello));
-    });
-    socket.on("ping", () => {
-      this.lastActivity = Date.now();
-    });
-    socket.on("message", (data, isBinary) => {
-      this.lastActivity = Date.now();
-      const bytes = toBytes(data);
-      let envelope;
-      try {
-        envelope = decodeEnvelope(bytes);
-      } catch {
-        return;
-      }
-      if (envelope.type === "conn.ack") {
-        this.reconnectAttempt = 0;
-        this.acked = true;
-        this.everAckedThisAttempt = true;
-        this.opts.onStateChange?.("open");
-        for (const waiter of this.ackWaiters.splice(0)) waiter.resolve();
-        this.opts.onAcked?.(envelope.payload.capabilities);
-      }
-      this.opts.onEnvelope(envelope);
-    });
-    socket.on("close", (code, reason) => {
-      this.socket = void 0;
-      this.stopLivenessCheck();
-      this.opts.onStateChange?.("closed");
-      const acked = this.everAckedThisAttempt;
-      const status = this.lastUnexpectedStatus;
-      this.lastUnexpectedStatus = void 0;
-      const replayCursorTooOld = code === 1008 && reason.toString("utf8") === "cursor_too_old" ? new ReplayCursorTooOldError() : void 0;
-      this.opts.onConnectOutcome?.(
-        acked,
-        replayCursorTooOld ?? (status !== void 0 ? new WsUnexpectedStatusError(status, endpoint) : void 0),
-        endpoint
-      );
-      if (!this.closedByUser && this.autoReconnect) this.scheduleReconnect();
-    });
-    socket.on("error", () => {
-    });
-    socket.on("unexpected-response", (_req, res) => {
-      this.lastUnexpectedStatus = res.statusCode;
-      res.resume();
-      socket.terminate();
-    });
-  }
-  scheduleReconnect() {
-    const { baseMs = 1e3, maxMs = 3e4, factor = 2 } = this.opts.backoff ?? {};
-    const delay3 = Math.min(maxMs, baseMs * factor ** this.reconnectAttempt);
-    const jitter = this.opts.reconnectDelayMs?.(this.reconnectAttempt, delay3) ?? delay3;
-    this.reconnectAttempt += 1;
-    this.reconnectTimer = setTimeout(() => void this.openSocket(), jitter);
-  }
-  startLivenessCheck(socket) {
-    const { timeoutMs = 75e3, checkIntervalMs = Math.max(1e3, Math.floor(timeoutMs / 3)) } = this.opts.liveness ?? {};
-    this.livenessTimer = setInterval(() => {
-      if (Date.now() - this.lastActivity > timeoutMs) {
-        socket.terminate();
-      }
-    }, checkIntervalMs);
-    this.livenessTimer.unref?.();
-  }
-  stopLivenessCheck() {
-    if (this.livenessTimer) {
-      clearInterval(this.livenessTimer);
-      this.livenessTimer = void 0;
-    }
-  }
-};
-function toBytes(data, _isBinary) {
-  if (Buffer.isBuffer(data)) return data;
-  if (Array.isArray(data)) return Buffer.concat(data);
-  if (data instanceof ArrayBuffer) return new Uint8Array(data);
-  return Buffer.from(String(data), "utf8");
-}
-
-// src/daemon/connection-manager.ts
-function isCursorEnvelopeType(type) {
-  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
-}
+var MAX_REJECTED_OUTBOX_ENTRIES = 1e3;
 var ConnectionManager = class {
   constructor(opts) {
     this.opts = opts;
     this.fleetJitter = opts.fleetJitter ?? createFleetJitter(opts.productId, opts.deviceId);
-    this.ws = new WsTransport({
-      serverUrl: opts.serverUrl,
-      getToken: () => opts.auth.getValidAccessToken(),
-      deviceId: opts.deviceId,
-      productId: opts.productId,
-      capabilities: opts.capabilities,
-      clientVersion: opts.clientVersion,
-      runtimes: opts.runtimes,
-      getConfiguredToolsets: opts.getConfiguredToolsets,
-      getCursor: () => this.cursor,
-      onEnvelope: (envelope) => this.deliver(envelope),
-      onStateChange: (state) => {
-        if (!this.stopped && !this.revoked) this.opts.onStateChange?.(state);
-      },
-      onAcked: (capabilities) => this.onAcked(capabilities),
-      onConnectOutcome: (acked, err) => this.onWsOutcome(acked, err),
-      backoff: opts.backoff,
-      liveness: opts.liveness,
-      reconnectDelayMs: (attempt, baseMs) => this.fleetJitter.delay("reconnect", attempt, baseMs)
-    });
     this.longPoll = new LongPollClient({
       serverUrl: opts.serverUrl,
       auth: opts.auth,
-      // Design A: the query cursor for the NEXT `GET /byok/events` is the
-      // same watermark `deliver()` dedupes against (see `dedupWatermark`) —
-      // normally the eager `deliveredSeq` (so an in-flight envelope isn't
-      // re-pulled), but the durable `cursor` while `stalledAtSeq` is set, so
-      // the failed envelope (and everything after it) IS re-pulled and
-      // re-attempted.
-      getCursor: () => this.dedupWatermark(),
+      // The long-poll query cursor is also the kernel's irreversible ack.
+      // Only report the successfully processed cursor here. `deliveredSeq`
+      // remains a local dedup watermark; using it on the wire would ack an
+      // in-flight envelope before its handler settles and make a later
+      // failure impossible to redeliver.
+      getCursor: () => this.cursor,
       onEnvelope: (envelope) => this.deliver(envelope),
       onServerCapabilities: (capabilities) => {
-        if (this.mode === "long-poll") this.serverCapabilities = capabilities;
+        this.serverCapabilities = capabilities;
+        this.noteConnected();
+      },
+      onServerCapabilitiesInvalidated: () => {
+        this.serverCapabilities = [];
       },
+      onPollFailure: () => this.noteDisconnected(),
       onRevoked: () => this.enterRevoked(),
       onReplayCursorTooOld: (error) => this.enterReplayCursorTooOld(error),
-      // M4 Phase 4 (version-negotiation drill fix): a batch entry
-      // LongPollClient couldn't parse into a known Envelope at all (an
-      // unrecognized message type) still needs its cursor/watermark
-      // advanced past it, exactly like a successfully-processed envelope
-      // would — see `noteSkippedSeq`'s own doc comment.
-      onSkippedSeq: (seq) => this.noteSkippedSeq(seq),
-      // Finding R1: a batch entry LongPollClient recognized the TYPE of but
-      // whose payload failed validation — a genuine delivery failure at
-      // that seq, engaged the same way a thrown handler failure is (see
-      // `noteValidationFailure`'s own doc comment).
+      // Unknown and malformed executable work use the same ordered stall.
       onValidationFailedSeq: (seq) => this.noteValidationFailure(seq),
       // Finding P2 (Fix 2a): lets the long-poll loop distinguish "this
       // non-empty batch was a stalled backlog re-pull, no cursor progress
@@ -10229,13 +10582,10 @@ var ConnectionManager = class {
   }
   opts;
   fleetJitter;
-  ws;
   longPoll;
-  mode = "ws";
-  consecutiveFailures = 0;
-  wsRetryTimer;
-  wsProbeSequence = 0;
   uploadRetryAttempt = 0;
+  started = false;
+  connected = false;
   cursor;
   /**
    * Finding F3 (at-most-once redelivery): the lowest `task.*` envelope `seq`
@@ -10257,10 +10607,9 @@ var ConnectionManager = class {
    * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
    * advances eagerly, the instant a `task.*` envelope is admitted past
    * dedup (see `deliver`/`noteDelivered`), independent of whether its
-   * handler has even started, let alone succeeded. It exists so a
-   * long-poll re-query (`LongPollClient`'s `getCursor`) doesn't re-pull an
-   * envelope that's already been delivered once and is still in flight —
-   * `handleOffer` is NOT idempotent and must never be re-pulled while a
+   * handler has even started, let alone succeeded. It exists so a repeated
+   * read at the durable cursor does not re-dispatch an envelope already in
+   * flight — `handleOffer` must not start a second adapter session while a
    * first attempt is still running. On WS this same field is written the
    * same way, but since a live WS connection only ever pushes a given `seq`
    * once, it never has an observable effect there beyond mirroring
@@ -10271,18 +10620,18 @@ var ConnectionManager = class {
   /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
   processingChain = Promise.resolve();
   /**
-   * Design B (finding N4): the ONE outbound queue both transports drain
-   * from — holds `Envelope` OBJECTS, never re-encoded/rebuilt strings, so a
+   * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
+   * never re-encoded/rebuilt strings, so a
    * resend after a failed send attempt is byte-identical to the original
    * (same `id`), which is what lets the server's per-(deviceId,id) dedup
    * (Wave 1) recognize it as a safe no-op retry rather than a second
-   * application (protocol §9). A transport switch (long-poll <-> WS) never
-   * touches this queue — see `drainOutbox` — so nothing queued while one
-   * transport was active is ever stranded when the other takes over.
+   * application (protocol §9).
    */
   outbox = [];
+  /** Terminally rejected outbound envelopes, retained as a bounded observable quarantine. */
+  rejectedOutboundEnvelopes = [];
   /**
-   * Finding F5(b): how many envelopes `drainOutbox`'s long-poll branch has
+   * Finding F5(b): how many envelopes `drainOutbox` has
    * currently spliced OUT of `this.outbox` for an in-flight (not yet
    * confirmed delivered) `postBatch` call — 0 the rest of the time. See
    * `outboxLength`'s own doc comment for why this needs to be tracked
@@ -10335,39 +10684,22 @@ var ConnectionManager = class {
    */
   cancelPendingDrainRetry;
   /**
-   * The capabilities the CURRENT transport's server advertised — untyped
-   * `string[]` for forward compatibility. WS populates it from `conn.ack`;
-   * long-poll populates it from each successful events response. Empty until
-   * the active transport supplies an advertisement.
-   *
-   * Finding R2 (cross-model re-review — was P1): strictly PER-CONNECTION,
-   * not per-daemon-lifetime. Cleared to `[]` the instant the acked WS
-   * connection ends for ANY reason — an ordinary disconnect (`onWsOutcome`'s
-   * `acked` branch), `stop()`, or a transport switch to long-poll
-   * (`enterLongPoll`) — and only repopulated by a fresh advertisement from
-   * the transport that is still current.
-   * The previous version of this doc comment claimed long-poll mode simply
-   * "stays at whatever the last real WS `conn.ack` said" — that was the bug:
-   * a daemon that once learned e.g. `approval_resolved` from an earlier WS
-   * session kept believing it applied to whatever it's connected to NOW,
-   * even after a disconnect/degrade where nothing has actually confirmed
-   * that's still true (a reconnect could land on a DIFFERENT server behind a
-   * load balancer). Concretely, `TaskRunner.sendApprovalResolved` gates
-   * `task.approval_resolved` on this list — sending it to a server that
-   * doesn't actually understand it over the long-poll path would get a
-   * batch-level 400 from `MessagesSendRequestSchema` (protocol §8.2), which
-   * `drainOutbox`'s retry-the-same-batch-forever loop then head-of-line
-   * blocks EVERY envelope queued behind it on, permanently. Clearing this
-   * eagerly means that gate reliably fails closed (falls back to the
-   * pre-existing implicit-resume inference, unconditionally — see
-   * `sendApprovalResolved`'s own doc comment) the moment the connection that
-   * advertised the capability is no longer the one actually in use.
+   * The capabilities the current server response advertised — untyped
+   * `string[]` for forward compatibility. An advertisement is scoped to the
+   * current long-poll response stream and is cleared after an HTTP failure,
+   * terminal shutdown, or revocation. This keeps capability-gated outbound
+   * messages fail-closed until the current server has explicitly advertised
+   * support.
    */
   serverCapabilities = [];
   async start() {
     if (this.terminalError) throw this.terminalError;
     this.cursor = await this.opts.cursorStore.load(this.opts.serverUrl, this.opts.deviceId);
-    this.ws.connect({ auto: true });
+    this.started = true;
+    this.opts.onStateChange?.("connecting");
+    this.longPoll.start();
+    this.outbox.unshift(createConnectionHelloEnvelope(this.opts, () => this.cursor));
+    void this.drainOutbox();
   }
   /**
    * Design B (finding N4): push onto the single shared outbox and try to
@@ -10376,19 +10708,16 @@ var ConnectionManager = class {
    */
   send(envelope) {
     this.outbox.push(envelope);
+    this.opts.onOutboundQueued?.(envelope);
     void this.drainOutbox();
   }
+  /** Publish a fresh local configuration snapshot while this daemon is running. */
+  refreshHello() {
+    if (!this.started || this.stopped || this.revoked || this.terminalError) return;
+    this.send(createConnectionHelloEnvelope(this.opts, () => this.cursor));
+  }
   /**
-   * Design B (finding N4): drain the shared outbox through whichever
-   * transport is currently active, re-checking `this.mode` fresh on every
-   * iteration so a transport switch mid-drain is picked up immediately
-   * rather than fighting a stale decision made before the switch.
-   *
-   * WS: a synchronous, one-at-a-time `sendNow` per envelope while open+
-   * acked; stops (without dropping anything — the remainder stays queued)
-   * the moment it isn't, and is re-invoked once `onAcked` fires.
-   *
-   * Long-poll: POSTs the outbox in chunks of at most
+   * POSTs the outbox through long-poll in chunks of at most
    * `MAX_MESSAGES_PER_BATCH` (finding P1) — the server hard-caps a single
    * `/byok/messages` batch there (`MessagesSendRequestSchema`, protocol
    * §8.2) and 400s the WHOLE request if it's exceeded, which — before this
@@ -10400,43 +10729,58 @@ var ConnectionManager = class {
    * failure that SAME chunk is unshifted back (order-preserving, same
    * Envelope objects/ids — never rebuilt, so a retry is exactly the resend
    * Wave 1's server-side dedup expects) and retried after a short backoff,
-   * re-reading `this.mode` each time so a WS recovery that happens
-   * mid-retry is honored on the very next loop iteration instead of only
-   * after this attempt's backoff chain gives up.
-   *
    * Re-entrancy is guarded by `draining`: a call arriving while a drain is
    * already in progress just returns — the in-progress loop's own
-   * `while (this.outbox.length > 0)` check will pick up anything newly
-   * pushed (or left over after a mode switch) on its very next iteration.
+   * `while (this.outbox.length > 0)` check picks up anything newly pushed.
    */
   async drainOutbox() {
-    if (this.draining) return;
+    if (!this.started || this.draining) return;
     this.draining = true;
+    const isolateRejectedBatch = async (batch) => {
+      const pending = [[...batch]];
+      while (pending.length > 0) {
+        if (this.stopped || this.revoked) return pending.flat();
+        const segment = pending.shift();
+        try {
+          this.opts.beforeOutboundPost?.(segment);
+          const result = await this.longPoll.postBatch(segment);
+          if (result === void 0) return [...segment, ...pending.flat()];
+          if ((result.rejected ?? 0) === 0) {
+            await this.opts.onOutboundAccepted?.(segment);
+            continue;
+          }
+          if (segment.length === 1) {
+            await this.opts.onOutboundRejected?.(segment[0]);
+            this.quarantineRejectedOutbound(segment[0], "inbound_rejected");
+            continue;
+          }
+        } catch (error) {
+          console.error("[byok/client] outbound durable disposition failed; retaining exact batch", error);
+          return [...segment, ...pending.flat()];
+        }
+        const midpoint = Math.floor(segment.length / 2);
+        pending.unshift(segment.slice(0, midpoint), segment.slice(midpoint));
+      }
+      return void 0;
+    };
     try {
       while (this.outbox.length > 0) {
         if (this.stopped || this.revoked) return;
-        if (this.mode === "ws") {
-          if (!this.ws.isOpen) return;
-          const envelope = this.outbox[0];
-          if (!this.ws.sendNow(envelope)) return;
-          this.outbox.shift();
-          continue;
-        }
         const batch = this.outbox.splice(0, MAX_MESSAGES_PER_BATCH);
         this.inFlightBatchSize = batch.length;
-        let ok;
+        let retrySegments;
         try {
-          ok = await this.longPoll.postBatch(batch);
+          retrySegments = await isolateRejectedBatch(batch);
         } finally {
           this.inFlightBatchSize = 0;
         }
-        if (ok) {
+        if (retrySegments === void 0) {
           this.uploadRetryAttempt = 0;
           this.opts.onOperationalOutcome?.("success", "upload");
           continue;
         }
         this.opts.onOperationalOutcome?.("failure", "upload");
-        this.outbox.unshift(...batch);
+        this.outbox.unshift(...retrySegments);
         if (this.stopped || this.revoked) return;
         const baseMs = this.opts.longPollRetryDelayMs ?? 2e3;
         await this.drainRetryDelay(this.fleetJitter.delay("upload", this.uploadRetryAttempt++, baseMs));
@@ -10452,8 +10796,7 @@ var ConnectionManager = class {
    * in-flight wait immediately instead of leaving `drainOutbox` parked here
    * for up to the rest of the delay before it next checks `this.revoked` —
    * and (b) unref'd, so the timer never keeps the Node process alive by
-   * itself while nothing else (a live long-poll GET, an open WS connection)
-   * legitimately is.
+   * itself while nothing else (such as the live long-poll GET) legitimately is.
    */
   drainRetryDelay(ms) {
     return new Promise((resolve) => {
@@ -10469,14 +10812,9 @@ var ConnectionManager = class {
       };
     });
   }
-  isTransportDegraded() {
-    return this.mode === "long-poll";
-  }
   /**
-   * The capabilities the CURRENT transport's server advertised: from
-   * `conn.ack` on WS, or the latest successful `GET /byok/events` response
-   * on long-poll. Empty before either transport has supplied its current
-   * advertisement, and cleared across disconnect/switch boundaries.
+   * The capabilities the latest successful `GET /byok/events` response
+   * advertised. Empty before a successful response and after a failed one.
    */
   getServerCapabilities() {
     return this.serverCapabilities;
@@ -10484,29 +10822,23 @@ var ConnectionManager = class {
   getTerminalError() {
     return this.terminalError;
   }
-  getMode() {
-    return this.mode;
-  }
   isConnected() {
-    return this.mode === "ws" && this.ws.isOpen;
+    return this.connected;
   }
   isRevoked() {
     return this.revoked;
   }
   /**
-   * Resolves once the connection has settled — either a working, acked WS
-   * connection, or the long-poll fallback taking over (protocol §8). This
-   * lets `daemon.start()` return promptly even when WS is unavailable from
-   * the very first attempt, rather than hanging until a WS `conn.ack` that
-   * may never come.
+   * Resolves after the first successful long-poll response establishes the
+   * authenticated connection.
    *
    * Rejects with {@link DeviceRevokedError} — instead of hanging until
    * `timeoutMs` — if the device turns out to be revoked while settling (or
    * already was): a cold `daemon.start()` against an already-revoked device
    * must fail fast, not surface a generic timeout (protocol §6.3).
    */
-  waitForAck(timeoutMs = 1e4) {
-    if (this.ws.isOpen || this.mode === "long-poll") return Promise.resolve();
+  waitForConnection(timeoutMs = 1e4) {
+    if (this.connected) return Promise.resolve();
     if (this.terminalError) return Promise.reject(this.terminalError);
     if (this.revoked) return Promise.reject(new DeviceRevokedError());
     return new Promise((resolve, reject) => {
@@ -10514,7 +10846,7 @@ var ConnectionManager = class {
       };
       const timer = setTimeout(() => {
         this.settledWaiters = this.settledWaiters.filter((w) => w !== settle);
-        reject(new Error("Timed out waiting for the connection to settle (WS ack or long-poll fallback)"));
+        reject(new Error("Timed out waiting for the long-poll connection to settle"));
       }, timeoutMs);
       settle = (err) => {
         clearTimeout(timer);
@@ -10525,7 +10857,7 @@ var ConnectionManager = class {
     });
   }
   /**
-   * Stops both transports and waits for every in-flight envelope handler
+   * Stops the long-poll transport and waits for every in-flight envelope handler
    * (the F3 FIFO chain) and the most recent cursor write to actually land on
    * disk — otherwise a `stop()` racing a just-processed envelope's
    * persistence could lose that cursor advance, or leave a handler running
@@ -10534,14 +10866,14 @@ var ConnectionManager = class {
    * Finding F5(b) (cross-model adversarial review): `drainTimeoutMs`, when
    * passed, bounds how long this waits for the shared outbox (`this.outbox`
    * — Design B) to actually finish draining BEFORE flipping `this.stopped`
-   * and closing the transports. Before this fix, `stop()` set `stopped`
+   * and stopping the transport. Before this fix, `stop()` set `stopped`
    * synchronously and never waited for `drainOutbox` at all: an envelope
    * `send()` had just pushed moments earlier (e.g. `TaskRunner.shutdownTask`'s
    * own `task.fail`, sent right before `create-daemon.ts`'s
    * `performControlShutdown` calls this) could still be sitting UNSENT in
    * `this.outbox` — mid long-poll retry backoff, or simply not yet picked up
    * by the fire-and-forget `drainOutbox()` `send()` kicked off — and this
-   * method would happily proceed to `stopped = true` / `ws.close()` regardless,
+   * method would happily proceed to `stopped = true` regardless,
    * after which NOTHING ever drains it again: silently lost, even though
    * `TaskRunner` believed it had been sent. `drainTimeoutMs` omitted (the
    * default) preserves the EXACT prior behavior for every other existing
@@ -10558,9 +10890,9 @@ var ConnectionManager = class {
     }
     this.stopped = true;
     this.serverCapabilities = [];
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
     this.longPoll.stop();
-    this.ws.close();
+    this.connected = false;
+    this.opts.onStateChange?.("closed");
     await this.processingChain;
     await this.pendingCursorSave;
   }
@@ -10585,6 +10917,10 @@ var ConnectionManager = class {
   outboxLength() {
     return this.outbox.length + this.inFlightBatchSize;
   }
+  /** A bounded terminal quarantine for operator inspection; these entries are never retried. */
+  rejectedOutbox() {
+    return this.rejectedOutboundEnvelopes;
+  }
   /**
    * Finding F5(b): polls {@link outboxLength} (not `this.outbox.length`
    * alone — see that method's own doc comment for why a spliced-out,
@@ -10592,15 +10928,14 @@ var ConnectionManager = class {
    * a single `drainOutbox()` promise directly — a drain in progress can
    * itself loop through multiple retry/backoff cycles (`drainRetryDelay`)
    * while the server is unreachable, and a fresh, INDEPENDENT
-   * `drainOutbox()` call can also be triggered concurrently (`send()`, a
-   * mode switch's own `void this.drainOutbox()`) — polling the one thing
+   * `drainOutbox()` call can also be triggered concurrently (`send()`) —
+   * polling the one thing
    * that actually matters (is anything still undelivered) can never go
    * stale the way capturing one specific in-flight promise reference
    * could. Kicks off one more `drainOutbox()` attempt itself first
    * (harmless no-op if one is already running — see its own re-entrancy
-   * guard) in case nothing is currently actively retrying (e.g. WS just
-   * dropped and long-poll hasn't taken over yet), so this bounded wait
-   * isn't just passively hoping something else happens to be making
+   * guard) in case nothing is currently actively retrying, so this bounded
+   * wait isn't just passively hoping something else happens to be making
    * progress.
    */
   waitForOutboxDrained(timeoutMs) {
@@ -10641,21 +10976,27 @@ var ConnectionManager = class {
    *   documented idempotent (protocol §9).
    */
   deliver(envelope) {
+    if (!isServerToDaemonType(envelope.type)) {
+      if (typeof envelope.seq === "number") this.noteValidationFailure(envelope.seq);
+      return false;
+    }
     const tracked = isCursorEnvelopeType(envelope.type) && typeof envelope.seq === "number";
     const watermark = this.dedupWatermark();
-    if (tracked && watermark !== void 0 && envelope.seq <= watermark) return;
+    if (tracked && watermark !== void 0 && envelope.seq <= watermark) return false;
     if (tracked) {
       const seq = envelope.seq;
-      if (this.inFlightSeqs.has(seq) || this.processedSeqs.has(seq)) return;
+      if (this.inFlightSeqs.has(seq) || this.processedSeqs.has(seq)) return false;
       this.inFlightSeqs.add(seq);
       this.noteDelivered(seq);
     }
     this.processingChain = this.processingChain.then(() => this.process(envelope, tracked));
+    return true;
   }
   /**
-   * Design A: the watermark `deliver()` dedupes inbound `task.*` envelopes
-   * against, and the same value `LongPollClient` queries the next
-   * `GET /byok/events` cursor with (see the constructor). Normally this is
+   * The local watermark `deliver()` dedupes inbound `task.*` envelopes
+   * against. It is deliberately NOT the long-poll query cursor: that query
+   * is the kernel acknowledgement and uses only the successfully processed
+   * `cursor` (see the constructor). Normally this local watermark is
    * `deliveredSeq` — which is always >= `cursor` (every envelope that
    * reaches `advanceCursor` already passed through `noteDelivered` first,
    * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
@@ -10671,11 +11012,9 @@ var ConnectionManager = class {
    * whose outcome wasn't known yet. No separate "reset deliveredSeq on
    * reconnect" step is needed for this to be correct — collapsing to
    * `cursor` exactly while stalled already produces the right answer on
-   * every redelivery path (long-poll re-query AND a WS reconnect's
-   * backlog replay alike), and NOT resetting it unconditionally on every
-   * reconnect is what lets `deliveredSeq` keep doing its job of not
-   * re-pulling/re-dispatching something already in flight across a
-   * reconnect that happens to land while a handler is still running.
+   * every long-poll retry path. NOT resetting it unconditionally on every
+   * retry lets `deliveredSeq` keep doing its job of not re-dispatching
+   * something already in flight while a handler is still running.
    */
   dedupWatermark() {
     return this.stalledAtSeq !== void 0 ? this.cursor : this.deliveredSeq ?? this.cursor;
@@ -10693,11 +11032,13 @@ var ConnectionManager = class {
       }
       await this.opts.onEnvelope(envelope);
       if (!tracked) return;
-      this.processedSeqs.add(seq);
-      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) return;
+      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) {
+        this.processedSeqs.add(seq);
+        return;
+      }
       this.stalledAtSeq = void 0;
+      await this.advanceCursor(envelope.seq);
       this.processedSeqs.clear();
-      this.advanceCursor(envelope.seq);
     } catch (err) {
       if (tracked && this.stalledAtSeq === void 0) this.stalledAtSeq = envelope.seq;
       console.error(
@@ -10708,226 +11049,58 @@ var ConnectionManager = class {
       if (tracked) this.inFlightSeqs.delete(seq);
     }
   }
-  /**
-   * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
-   * for a batch entry it could not parse into a known `Envelope` at all (an
-   * unrecognized message type — mirrors `ws-transport.ts`'s identical
-   * per-frame tolerance, see `long-poll-transport.ts`'s own doc comment on
-   * `parseLooseEventsPollResponse`) but which still carried a numeric,
-   * task-class envelope-level `seq` (the caller only invokes this for a
-   * `task.`-prefixed type — see `long-poll-transport.ts`'s own
-   * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
-   * here at all, mirroring F2's "conn.* is never cursor-tracked" rule).
-   * There is no real `Envelope` to hand to a handler — a genuinely
-   * unrecognized type has nothing this build could ever act on.
-   *
-   * GATEKEEPER-CAUGHT REGRESSION (fixed here): this used to call
-   * `advanceCursor(seq)` DIRECTLY, synchronously, the instant a skip was
-   * detected in `LongPollClient.loop()`'s per-entry for-loop. That is NOT
-   * "instantaneous and race-free" the way the previous version of this
-   * comment claimed — the hazard was never the skip racing against itself,
-   * it was the skip racing AHEAD of an EARLIER real envelope in the SAME
-   * batch that is still in flight on `processingChain` (`deliver()`, above,
-   * only ever CHAINS `process()` onto that promise chain — it never awaits
-   * it before returning). Concretely, batch `[real seq1, unknown seq2]`:
-   * `deliver(seq1)` chains `process(seq1)` but returns immediately without
-   * running it; the for-loop then reaches `seq2` and (pre-fix) called
-   * `advanceCursor(2)` synchronously, BEFORE `process(seq1)` had even
-   * started, let alone failed. If `seq1`'s handler then failed,
-   * `stalledAtSeq` became 1 — but the durable cursor was already 2, so
-   * `dedupWatermark()` returned 2, and every future redelivery of seq1 was
-   * dedup-dropped as "already past the cursor" forever: permanent envelope
-   * loss, exactly the F3 bug class the whole `stalledAtSeq`/frozen-watermark
-   * mechanism exists to prevent.
-   *
-   * Fix: the cursor-advancing half is now CHAINED onto `processingChain`
-   * too, exactly like `process()`'s own post-handler bookkeeping — so it
-   * only ever runs once every earlier envelope already queued ahead of it
-   * has fully settled (success or failure), and can observe `stalledAtSeq`'s
-   * REAL, up-to-date value rather than whatever it happened to be at the
-   * instant the skip was first noticed. The guard mirrors `process()`'s own
-   * success-path guard exactly: never advance past a still-unresolved
-   * earlier failure, unless (degenerate, cannot really happen for a skip)
-   * this exact seq IS the stalled one.
-   *
-   * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
-   * called immediately, unconditionally, regardless of `stalledAtSeq` —
-   * matching `deliver()`'s own eager, unconditional call for a real
-   * envelope: its only job is "don't re-pull something already handed off,"
-   * independent of outcome, and that property does not depend on FIFO
-   * ordering the way the DURABLE cursor does.
-   *
-   * Deliberately NO top-level `dedupWatermark() <= seq` early-return before
-   * queuing the chained callback (an earlier draft of this fix had one, and
-   * it was itself subtly wrong): `deliveredSeq` can already reflect a seq
-   * from the FIRST time it was ever seen, while the DURABLE cursor is still
-   * behind it because a stall intervened before that seq's chained
-   * advancement ran — a pre-check keyed on `deliveredSeq` would then
-   * wrongly treat a LATER redelivery of the same seq (arriving once the
-   * stall has since cleared) as "already accounted for" and never queue
-   * another attempt, permanently stranding the cursor one seq short. Always
-   * queuing is safe and cheap: `advanceCursor`'s own `seq <= this.cursor`
-   * guard already makes a genuinely-redundant call a no-op, so there is no
-   * correctness reason to short-circuit earlier, only a (here, unnecessary)
-   * micro-optimization one.
-   */
-  noteSkippedSeq(seq) {
-    this.noteDelivered(seq);
-    this.processingChain = this.processingChain.then(() => {
-      if (this.stalledAtSeq === void 0 || seq === this.stalledAtSeq) {
-        this.advanceCursor(seq);
-      }
-    });
-  }
-  /**
-   * Finding R1 (cross-model re-review — was NOT-CLOSED against F1):
-   * `LongPollClient` calls this for a batch entry whose `type` it
-   * recognized but whose payload failed schema validation
-   * ({@link EnvelopeValidationError}) — a genuine delivery failure at that
-   * seq, unlike `noteSkippedSeq`'s forward-compat case. Deliberately mirrors
-   * `process()`'s own catch block (`if (tracked && this.stalledAtSeq ===
-   * undefined) this.stalledAtSeq = envelope.seq;`) as closely as possible:
-   * the SAME "only the lowest unresolved failure holds the stall" rule, the
-   * SAME resulting freeze of `dedupWatermark()` at the durable cursor
-   * (protocol §9 keeps this seq alive), and — because it's the SAME
-   * `stalledAtSeq` field `process()`'s own post-success guard already
-   * checks — anything ELSE delivered after this seq (same batch or a later
-   * one) is automatically held back from advancing the cursor too, with
-   * zero changes needed to `process()` itself.
-   *
-   * Chained onto `processingChain` for exactly the reason `noteSkippedSeq`
-   * documents for its own identical chaining (see that method's sibling
-   * doc comment on `LongPollClient`, "GATEKEEPER-CAUGHT REGRESSION"): an
-   * EARLIER real envelope in the SAME batch may still be in flight on that
-   * FIFO chain when this is called (`deliver()` only ever chains
-   * `process()` onto it, never awaits before returning) — mutating
-   * `stalledAtSeq` synchronously here could race ahead of that still-
-   * unresolved earlier envelope. Chaining instead guarantees this only
-   * takes effect once every earlier-queued envelope has already settled,
-   * and reads `stalledAtSeq`'s real, up-to-date value rather than whatever
-   * it happened to be the instant the failure was first noticed.
-   *
-   * No `noteDelivered` call here (contrast `noteSkippedSeq`, which does
-   * call it): a validation-failed entry never becomes a real `Envelope` and
-   * never reaches `deliver()`, so it was never "delivered" in the eager
-   * in-memory-watermark sense that field tracks — there is nothing for it
-   * to eagerly mark. Once a corrected redelivery of this exact seq DOES
-   * arrive as a real envelope, it flows through the ordinary `deliver()`
-   * path (which calls `noteDelivered` itself) and, on success, clears the
-   * stall via `process()`'s own existing logic — no special-casing needed.
-   */
+  /** Serialized with handler completion, so invalid work cannot be acked by later success. */
   noteValidationFailure(seq) {
     this.processingChain = this.processingChain.then(() => {
       if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
     });
   }
-  advanceCursor(seq) {
+  async advanceCursor(seq) {
     if (this.cursor !== void 0 && seq <= this.cursor) return;
+    const save = this.pendingCursorSave.catch(() => void 0).then(() => this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, seq));
+    this.pendingCursorSave = save;
+    await save;
     this.cursor = seq;
-    this.pendingCursorSave = this.pendingCursorSave.catch(() => {
-    }).then(() => this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, seq)).catch(() => {
-    });
-  }
-  /**
-   * Fires the moment a connection attempt reaches `conn.ack` — independent
-   * of whether/when it later closes. This is the ONLY place that can
-   * reliably detect "WS is back up" while long-polling: a healthy
-   * connection stays open indefinitely, so it never reaches `onWsOutcome`
-   * (which is close-only) at all.
-   */
-  onAcked(capabilities) {
-    if (this.terminalError) return;
-    this.serverCapabilities = capabilities;
-    this.consecutiveFailures = 0;
-    this.notifySettled();
-    this.opts.onOperationalOutcome?.("success", "reconnect");
-    if (this.mode === "long-poll") this.exitLongPoll();
-    void this.drainOutbox();
   }
-  onWsOutcome(acked, err) {
-    if (err instanceof ReplayCursorTooOldError) {
-      this.enterReplayCursorTooOld(err);
-      return;
-    }
-    if (this.stopped || this.revoked) return;
-    if (acked) this.serverCapabilities = [];
-    if (err instanceof WsUnexpectedStatusError && err.status === 401) {
-      this.opts.auth.handleUnauthorized().catch((renewErr) => {
-        if (renewErr instanceof DeviceRevokedError) this.enterRevoked();
-      });
-    }
-    if (acked) return;
-    this.opts.onOperationalOutcome?.("failure", "reconnect");
-    this.consecutiveFailures += 1;
-    if (this.mode === "ws" && this.consecutiveFailures >= (this.opts.wsFailureThreshold ?? 3)) {
-      this.enterLongPoll();
-    }
+  quarantineRejectedOutbound(envelope, reason) {
+    if (this.rejectedOutboundEnvelopes.length === MAX_REJECTED_OUTBOX_ENTRIES) this.rejectedOutboundEnvelopes.shift();
+    this.rejectedOutboundEnvelopes.push({ envelope, reason });
+    console.error(
+      `[byok/client] outbound envelope ${envelope.id} was permanently rejected (${reason}) and moved to the terminal quarantine.`
+    );
   }
   notifySettled(err) {
     for (const waiter of this.settledWaiters.splice(0)) waiter(err);
   }
-  enterLongPoll() {
-    this.mode = "long-poll";
-    this.serverCapabilities = [];
-    this.ws.stopAutoReconnect();
-    this.opts.onStateChange?.("degraded");
-    this.longPoll.start();
-    this.outbox.unshift(createConnectionHelloEnvelope({
-      deviceId: this.opts.deviceId,
-      productId: this.opts.productId,
-      capabilities: this.opts.capabilities,
-      clientVersion: this.opts.clientVersion,
-      runtimes: this.opts.runtimes,
-      getConfiguredToolsets: this.opts.getConfiguredToolsets,
-      getCursor: () => this.cursor
-    }));
+  noteConnected() {
+    if (this.connected || this.stopped || this.revoked || this.terminalError) return;
+    this.connected = true;
+    this.opts.onStateChange?.("open");
     this.notifySettled();
-    void this.drainOutbox();
-    this.scheduleWsProbe();
+  }
+  noteDisconnected() {
+    if (!this.connected || this.stopped || this.revoked || this.terminalError) return;
+    this.connected = false;
+    this.opts.onStateChange?.("connecting");
   }
   enterReplayCursorTooOld(error) {
     if (this.terminalError) return;
     this.terminalError = error;
     this.stopped = true;
     this.serverCapabilities = [];
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
     this.longPoll.stop();
-    this.ws.stopAutoReconnect();
-    this.ws.close();
+    this.connected = false;
     this.cancelPendingDrainRetry?.();
     this.notifySettled(error);
     this.opts.onStateChange?.("closed");
     this.opts.onTerminalError?.(error);
   }
-  exitLongPoll() {
-    if (this.wsRetryTimer) {
-      clearInterval(this.wsRetryTimer);
-      this.wsRetryTimer = void 0;
-    }
-    this.longPoll.stop();
-    this.mode = "ws";
-    this.consecutiveFailures = 0;
-    this.ws.resumeAutoReconnect();
-    void this.drainOutbox();
-  }
-  scheduleWsProbe() {
-    const baseMs = this.opts.wsRetryIntervalMs ?? 5 * 60 * 1e3;
-    const delayMs = this.fleetJitter.delay("reconnect", this.wsProbeSequence++, baseMs);
-    const timer = setTimeout(() => {
-      this.wsRetryTimer = void 0;
-      if (this.stopped || this.revoked || this.mode !== "long-poll") return;
-      this.ws.connect({ auto: false });
-      this.scheduleWsProbe();
-    }, delayMs);
-    timer.unref?.();
-    this.wsRetryTimer = timer;
-  }
   enterRevoked() {
     if (this.revoked) return;
     this.revoked = true;
-    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
+    this.serverCapabilities = [];
     this.longPoll.stop();
-    this.ws.close();
+    this.connected = false;
     this.cancelPendingDrainRetry?.();
     this.opts.onStateChange?.("revoked");
     this.notifySettled(new DeviceRevokedError());
@@ -11263,11 +11436,12 @@ var DaemonObserver = class {
    * where those are actually reported from.
    */
   handleInboundEnvelope(envelope) {
-    if (envelope.type !== "task.offer" && envelope.type !== "task.offer_with_toolsets" && envelope.type !== "task.offer_for_agent") return;
-    const taskId = envelope.task_id;
+    if (!isTaskOfferType(envelope.type)) return;
+    const offer = envelope;
+    const taskId = offer.task_id;
     if (this.taskInfo.has(taskId)) return;
-    this.upsertTask(taskId, { state: "Offered", runtime: envelope.payload.runtime });
-    this.emit({ kind: "offered", ts: nowIso(), taskId, runtime: envelope.payload.runtime });
+    this.upsertTask(taskId, { state: "Offered", runtime: offer.payload.runtime });
+    this.emit({ kind: "offered", ts: nowIso(), taskId, runtime: offer.payload.runtime });
   }
   /**
    * Feed a raw OUTBOUND (daemon -> server) envelope — this is where every
@@ -11796,6 +11970,7 @@ CREATE INDEX IF NOT EXISTS journal_transition_task ON journal_transition (task_i
 CREATE TABLE IF NOT EXISTS journal_terminal (
   task_id       TEXT PRIMARY KEY REFERENCES journal_task (task_id),
   terminal_type TEXT NOT NULL,
+  bytes         TEXT NOT NULL,
   payload_hash  TEXT NOT NULL,
   truth_state   TEXT NOT NULL,
   attempt       INTEGER NOT NULL,
@@ -11950,6 +12125,11 @@ var SqliteLocalTaskJournal = class {
       const quarantinePath = quarantineDatabase(options.storeDir, this.#dbPath, reason, this.#clock());
       throw new JournalCorruptError(this.#dbPath, quarantinePath, reason, { cause: err });
     }
+    const terminalColumns = db.prepare("PRAGMA table_info(journal_terminal)").all();
+    if (!terminalColumns.some((column) => column.name === "bytes")) {
+      db.close();
+      throw new JournalUnavailableError("hash-only journal format cannot replay terminals; preserve/export this journal and resolve it before starting the new execution-recovery format");
+    }
     this.#db = db;
     try {
       secureJournalFilePermissions(this.#dbPath);
@@ -12039,10 +12219,13 @@ var SqliteLocalTaskJournal = class {
     }
     return this.#enqueue("appendEnvelope", () => {
       this.#fault("append:before-begin");
-      return this.#transaction(() => {
+      const committed = this.#transaction(() => {
         const existing = this.#db.prepare("SELECT receipt FROM journal_idempotency WHERE scope = ? AND key = ?").get("envelope", record3.envelopeId);
         if (existing) {
           const prior = JSON.parse(existing.receipt);
+          if (prior.bytesHash !== record3.bytesHash) throw new Error("journal envelope identity collision");
+          const priorIdentity = this.#db.prepare("SELECT tenant_id, product_id, device_id FROM journal_envelope WHERE envelope_id = ?").get(record3.envelopeId);
+          this.#assertIdentity(priorIdentity, record3.identity);
           return { ...prior, created: false };
         }
         const committedAt = this.#clock().toISOString();
@@ -12064,6 +12247,16 @@ var SqliteLocalTaskJournal = class {
         );
         this.#fault("append:after-envelope");
         if (record3.opensTask && record3.taskId !== void 0) {
+          const task = this.#db.prepare("SELECT * FROM journal_task WHERE task_id = ?").get(record3.taskId);
+          if (task) {
+            this.#assertIdentity(task, record3.identity);
+            const original = this.#db.prepare("SELECT bytes FROM journal_envelope WHERE envelope_id = ?").get(task.envelope_id);
+            const oldOffer = JSON.parse(original.bytes);
+            const newOffer = JSON.parse(record3.bytes);
+            if (oldOffer.type !== newOffer.type || JSON.stringify(oldOffer.payload) !== JSON.stringify(newOffer.payload)) {
+              throw new Error("journal task identity reused with a different execution contract");
+            }
+          }
           this.#db.prepare(
             `INSERT OR IGNORE INTO journal_task
                  (task_id, envelope_id, tenant_id, product_id, device_id, seq, local_state, created_at, updated_at)
@@ -12092,6 +12285,8 @@ var SqliteLocalTaskJournal = class {
         this.#fault("append:before-commit");
         return { ...receipt, created: true };
       });
+      this.#fault("append:after-commit");
+      return committed;
     });
   }
   recordAdmission(record3) {
@@ -12162,17 +12357,22 @@ var SqliteLocalTaskJournal = class {
    */
   recordTerminal(record3) {
     return this.#enqueue("recordTerminal", () => {
+      if (typeof record3.bytes !== "string" || journalHash(record3.bytes) !== record3.payloadHash) {
+        throw new Error("terminal bytes do not match their canonical hash");
+      }
+      if (byteLength2(record3.bytes) > this.#maxRecordBytes) {
+        throw new JournalRecordTooLargeError("terminal bytes", byteLength2(record3.bytes), this.#maxRecordBytes);
+      }
       this.#transaction(() => {
         this.#requireTask(record3.taskId, "recordTerminal");
-        const existing = this.#db.prepare("SELECT payload_hash FROM journal_terminal WHERE task_id = ?").get(record3.taskId);
-        if (existing === void 0) {
-          this.#db.prepare(
-            `INSERT INTO journal_terminal
-                 (task_id, terminal_type, payload_hash, truth_state, attempt, last_error, recorded_at, updated_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
-          ).run(
+        const existing = this.#db.prepare("SELECT * FROM journal_terminal WHERE task_id = ?").get(record3.taskId);
+        if (!existing) {
+          this.#db.prepare(`INSERT INTO journal_terminal
+            (task_id, terminal_type, bytes, payload_hash, truth_state, attempt, last_error, recorded_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
             record3.taskId,
             record3.terminalType,
+            record3.bytes,
             record3.payloadHash,
             record3.truthState,
             record3.attempt,
@@ -12181,11 +12381,98 @@ var SqliteLocalTaskJournal = class {
             record3.recordedAt
           );
           this.#db.prepare("UPDATE journal_task SET local_state = ?, updated_at = ? WHERE task_id = ?").run(`terminal:${record3.terminalType}`, record3.recordedAt, record3.taskId);
-        } else if (existing.payload_hash === record3.payloadHash) {
+        } else if (existing.payload_hash === record3.payloadHash && existing.bytes === record3.bytes && existing.truth_state !== "confirmed") {
           this.#db.prepare("UPDATE journal_terminal SET truth_state = ?, attempt = ?, last_error = ?, updated_at = ? WHERE task_id = ?").run(record3.truthState, record3.attempt, record3.lastError ?? null, record3.recordedAt, record3.taskId);
         }
+        if (record3.recovery !== void 0 && !existing) {
+          this.#db.prepare("UPDATE journal_task SET recovery_marker = ?, updated_at = ? WHERE task_id = ?").run(JSON.stringify({ ...record3.recovery, occurredAt: record3.recovery.occurredAt ?? record3.recordedAt }), record3.recordedAt, record3.taskId);
+          this.#fault("recovery:before-commit");
+        }
         this.#fault("terminal:before-commit");
       });
+      if (record3.recovery !== void 0) this.#fault("recovery:after-commit");
+      this.#fault("terminal:after-commit");
+    });
+  }
+  #assertIdentity(row, identity) {
+    if (row.tenant_id !== identity.tenantId || row.product_id !== identity.productId || row.device_id !== identity.deviceId) {
+      throw new Error("journal enrollment identity mismatch; refusing cross-enrollment execution or terminal replay");
+    }
+  }
+  #taskRow(row) {
+    if (typeof row.envelope_bytes !== "string" || journalHash(row.envelope_bytes) !== row.envelope_hash) {
+      throw new Error("durable offer bytes/hash mismatch");
+    }
+    return {
+      taskId: row.task_id,
+      envelopeId: row.envelope_id,
+      seq: Number(row.seq),
+      identity: { tenantId: row.tenant_id, productId: row.product_id, deviceId: row.device_id },
+      localState: row.recovery_marker !== null && !String(row.local_state).startsWith("terminal:") ? "interrupted" : row.local_state,
+      ...row.claimed_runtime == null ? {} : { claimedRuntime: row.claimed_runtime },
+      ...row.workspace_ref == null ? {} : { workspaceRef: row.workspace_ref },
+      updatedAt: row.updated_at,
+      envelopeBytes: row.envelope_bytes
+    };
+  }
+  readTask(taskId, identity) {
+    return this.#enqueue("readTask", () => {
+      const row = this.#db.prepare(`SELECT t.*, e.bytes AS envelope_bytes, e.bytes_hash AS envelope_hash FROM journal_task t
+        JOIN journal_envelope e ON e.envelope_id = t.envelope_id WHERE t.task_id = ?`).get(taskId);
+      if (!row) return void 0;
+      this.#assertIdentity(row, identity);
+      return this.#taskRow(row);
+    });
+  }
+  listRecoveryTasks(identity) {
+    return this.#enqueue("listRecoveryTasks", () => {
+      const rows = this.#db.prepare(`SELECT t.*, e.bytes AS envelope_bytes, e.bytes_hash AS envelope_hash FROM journal_task t
+        JOIN journal_envelope e ON e.envelope_id = t.envelope_id
+        LEFT JOIN journal_terminal term ON term.task_id = t.task_id
+        WHERE term.task_id IS NULL ORDER BY t.seq, t.task_id`).all();
+      return rows.map((row) => {
+        this.#assertIdentity(row, identity);
+        return this.#taskRow(row);
+      });
+    });
+  }
+  listPendingTerminals(identity) {
+    return this.#enqueue("listPendingTerminals", () => {
+      const rows = this.#db.prepare(`SELECT term.*, t.tenant_id, t.product_id, t.device_id FROM journal_terminal term
+        JOIN journal_task t ON t.task_id = term.task_id WHERE term.truth_state <> 'confirmed'
+        ORDER BY term.recorded_at, term.task_id`).all();
+      return rows.map((row) => {
+        this.#assertIdentity(row, identity);
+        if (typeof row.bytes !== "string" || journalHash(row.bytes) !== row.payload_hash) throw new Error("durable terminal bytes/hash mismatch");
+        return {
+          taskId: row.task_id,
+          terminalType: row.terminal_type,
+          bytes: row.bytes,
+          payloadHash: row.payload_hash,
+          truthState: row.truth_state,
+          attempt: Number(row.attempt),
+          recordedAt: row.recorded_at,
+          ...row.last_error === null ? {} : { lastError: row.last_error }
+        };
+      });
+    });
+  }
+  confirmTerminal(taskId, payloadHash) {
+    return this.#terminalDisposition(taskId, payloadHash, "confirmed");
+  }
+  rejectTerminal(taskId, payloadHash, reason) {
+    return this.#terminalDisposition(taskId, payloadHash, "failed", reason);
+  }
+  #terminalDisposition(taskId, payloadHash, state, reason) {
+    return this.#enqueue("terminalDisposition", () => {
+      this.#transaction(() => {
+        const row = this.#db.prepare("SELECT payload_hash FROM journal_terminal WHERE task_id = ?").get(taskId);
+        if (!row || row.payload_hash !== payloadHash) throw new Error("terminal acknowledgement does not match durable terminal");
+        this.#db.prepare(`UPDATE journal_terminal SET truth_state = ?, last_error = ?, updated_at = ?
+          WHERE task_id = ? AND truth_state <> 'confirmed'`).run(state, reason ?? null, this.#clock().toISOString(), taskId);
+        this.#fault("confirm:before-commit");
+      });
+      this.#fault("confirm:after-commit");
     });
   }
   /**
@@ -12202,8 +12489,9 @@ var SqliteLocalTaskJournal = class {
     return this.#enqueue("listRecoverable", () => {
       const rows = this.#db.prepare(
         `SELECT t.task_id, t.envelope_id, t.seq, t.tenant_id, t.product_id, t.device_id,
-                  t.local_state, t.claimed_runtime, t.workspace_ref, t.updated_at
+                  t.local_state, t.claimed_runtime, t.workspace_ref, t.updated_at, e.bytes AS envelope_bytes, e.bytes_hash AS envelope_hash
              FROM journal_task t
+             JOIN journal_envelope e ON e.envelope_id = t.envelope_id
              LEFT JOIN journal_terminal term ON term.task_id = t.task_id
             WHERE t.recovery_marker IS NULL
               AND term.task_id IS NULL
@@ -12225,7 +12513,8 @@ var SqliteLocalTaskJournal = class {
           localState: row.local_state,
           ...claimedRuntime === null ? {} : { claimedRuntime },
           ...workspaceRef === null ? {} : { workspaceRef },
-          updatedAt: row.updated_at
+          updatedAt: row.updated_at,
+          envelopeBytes: row.envelope_bytes
         };
       });
     });
@@ -12882,6 +13171,204 @@ function createStatfsFreeBytesProvider(dir) {
     return Number(stats.bavail) * Number(stats.bsize);
   };
 }
+var DEFAULT_MAX_INLINE_EVENT_BYTES = 64 * 1024;
+var MIN_MAX_INLINE_EVENT_BYTES = 4096;
+var MAX_UNSTORED_REASON_BYTES = 512;
+var MAX_SPILL_DESCRIPTOR_BYTES = 768;
+function byteLength3(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function utf8Width(codePoint) {
+  if (codePoint < 128) return 1;
+  if (codePoint < 2048) return 2;
+  if (codePoint < 65536) return 3;
+  return 4;
+}
+function utf8Prefix(value, maxBytes) {
+  if (maxBytes <= 0) return "";
+  let bytes = 0;
+  let index = 0;
+  while (index < value.length) {
+    const codePoint = value.codePointAt(index);
+    const width = utf8Width(codePoint);
+    if (bytes + width > maxBytes) break;
+    bytes += width;
+    index += codePoint > 65535 ? 2 : 1;
+  }
+  return value.slice(0, index);
+}
+function utf8Suffix(value, maxBytes) {
+  if (maxBytes <= 0) return "";
+  let bytes = 0;
+  let index = value.length;
+  while (index > 0) {
+    let step = 1;
+    const last = value.charCodeAt(index - 1);
+    if (last >= 56320 && last <= 57343 && index >= 2) {
+      const previous = value.charCodeAt(index - 2);
+      if (previous >= 55296 && previous <= 56319) step = 2;
+    }
+    const codePoint = value.codePointAt(index - step);
+    const width = utf8Width(codePoint);
+    if (bytes + width > maxBytes) break;
+    bytes += width;
+    index -= step;
+  }
+  return value.slice(index);
+}
+function boundReasonText(raw) {
+  const collapsed = raw.replace(/\s+/g, " ").trim();
+  const fallback = "blob upload failed with a non-descriptive error";
+  if (collapsed.length === 0) return fallback;
+  let budget = MAX_UNSTORED_REASON_BYTES;
+  for (; ; ) {
+    const reason = utf8Prefix(collapsed, budget);
+    if (reason.length === 0) return fallback;
+    const encoded = byteLength3(JSON.stringify(reason)) - 2;
+    if (encoded <= MAX_UNSTORED_REASON_BYTES) return reason;
+    budget = Math.min(Math.floor(budget * MAX_UNSTORED_REASON_BYTES / encoded), budget - 1);
+  }
+}
+function boundedUnstoredReason(error) {
+  const raw = error instanceof Error && error.message.length > 0 ? `${error.name}: ${error.message}` : String(error);
+  return boundReasonText(raw);
+}
+async function spillOversizedEvent(event, deps) {
+  if (event.type !== "tool_use" && event.type !== "tool_result") return event;
+  const serializedEvent = safeStringify(event);
+  if (serializedEvent === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${event.type} event cannot be JSON-serialized (a BigInt, a cycle, or a throwing toJSON in its payload); forwarding it unchanged and unbounded`
+    );
+    return event;
+  }
+  if (byteLength3(serializedEvent) <= deps.maxInlineBytes) return event;
+  const spillable = event;
+  const field = spillable.type === "tool_use" ? "input" : "output";
+  const value = spillable.type === "tool_use" ? spillable.input : spillable.output;
+  if (value === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event is ${byteLength3(serializedEvent)} bytes, over the ${deps.maxInlineBytes}-byte inline cap, but carries no ${field} to spill; forwarding unchanged`
+    );
+    return event;
+  }
+  const serialized = safeStringify(value);
+  if (serialized === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type}.${field} is not JSON-serializable; forwarding the event unchanged`
+    );
+    return event;
+  }
+  const totalBytes = byteLength3(serialized);
+  const skeleton = safeStringify({ ...spillable, [field]: { preview: { head: "", tail: "" } } });
+  if (skeleton === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event cannot be JSON-serialized once its ${field} is replaced by a preview; forwarding it unchanged and unbounded`
+    );
+    return event;
+  }
+  if (byteLength3(skeleton) + MAX_SPILL_DESCRIPTOR_BYTES > deps.maxInlineBytes) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event exceeds the ${deps.maxInlineBytes}-byte inline cap independently of its ${field} (${byteLength3(skeleton)} bytes without it, plus up to ${MAX_SPILL_DESCRIPTOR_BYTES} bytes of spill descriptor); forwarding unchanged`
+    );
+    return event;
+  }
+  const digest4 = createHash("sha256").update(serialized, "utf8").digest("hex");
+  let stored;
+  let storedBlobId;
+  try {
+    const blob = await deps.blobClient.uploadArtifact(serialized, "application/json", {
+      idempotencyKey: `spill_${deps.taskId}_${digest4}`,
+      ...deps.signal === void 0 ? {} : { signal: deps.signal }
+    });
+    stored = { blob };
+    storedBlobId = blob.blobId;
+  } catch (error) {
+    const unstoredReason = boundedUnstoredReason(error);
+    stored = { unstoredReason };
+    deps.log?.(
+      `task ${deps.taskId}: ${totalBytes}-byte ${spillable.type}.${field} could not be stored, only a preview will reach the wire \u2014 ${unstoredReason}`
+    );
+  }
+  const descriptorFor = (omittedBytes, half) => ({
+    field,
+    totalBytes,
+    omittedBytes,
+    contentType: "application/json",
+    ...half
+  });
+  const bound = (half) => {
+    const overheadJson = safeStringify({
+      ...spillable,
+      [field]: { preview: { head: "", tail: "" } },
+      spill: descriptorFor(totalBytes, half)
+    });
+    if (overheadJson === void 0) return void 0;
+    const overhead = byteLength3(overheadJson);
+    let headBudget = Math.max(0, Math.ceil((deps.maxInlineBytes - overhead) / 2));
+    let tailBudget = Math.max(0, Math.floor((deps.maxInlineBytes - overhead) / 2));
+    for (; ; ) {
+      const head = utf8Prefix(serialized, headBudget);
+      const tail = utf8Suffix(serialized.slice(head.length), tailBudget);
+      const retained = byteLength3(head) + byteLength3(tail);
+      const result = {
+        ...spillable,
+        [field]: { preview: { head, tail } },
+        spill: descriptorFor(totalBytes - retained, half)
+      };
+      const resultJson = safeStringify(result);
+      if (resultJson === void 0) return void 0;
+      const resultBytes = byteLength3(resultJson);
+      if (resultBytes <= deps.maxInlineBytes) return { result, resultBytes, overhead };
+      const headBytes = byteLength3(head);
+      const tailBytes = byteLength3(tail);
+      if (headBytes === 0 && tailBytes === 0) return { result, resultBytes, overhead };
+      const excess = resultBytes - deps.maxInlineBytes;
+      const dropHead = headBytes === 0 ? 0 : Math.min(headBytes, Math.max(1, Math.ceil(excess / 2)));
+      const dropTail = tailBytes === 0 ? 0 : Math.min(tailBytes, Math.max(dropHead === 0 ? 1 : 0, excess - dropHead));
+      if (dropHead === 0 && dropTail === 0) return { result, resultBytes, overhead };
+      headBudget = headBytes - dropHead;
+      tailBudget = tailBytes - dropTail;
+    }
+  };
+  let bounded2 = bound(stored);
+  if (bounded2 === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event cannot be JSON-serialized once its ${field} is replaced by a preview and a spill descriptor; forwarding it unchanged and unbounded`
+    );
+    return event;
+  }
+  if (bounded2.resultBytes > deps.maxInlineBytes && storedBlobId !== void 0) {
+    const unstoredReason = boundReasonText(
+      `spill locator too large for maxInlineBytes: blobId ${storedBlobId.length} chars`
+    );
+    deps.log?.(
+      `task ${deps.taskId}: ${totalBytes}-byte ${spillable.type}.${field} was stored, but its spill locator does not fit the ${deps.maxInlineBytes}-byte inline cap (descriptor overhead ${bounded2.overhead} bytes); shipping the preview with unstoredReason instead \u2014 ${unstoredReason}`
+    );
+    stored = { unstoredReason };
+    storedBlobId = void 0;
+    bounded2 = bound(stored);
+    if (bounded2 === void 0) {
+      deps.log?.(
+        `task ${deps.taskId}: ${spillable.type} event cannot be JSON-serialized once its ${field} is replaced by a preview and a spill descriptor; forwarding it unchanged and unbounded`
+      );
+      return event;
+    }
+  }
+  if (bounded2.resultBytes > deps.maxInlineBytes) {
+    throw new Error(
+      `event spill failed to bound a ${spillable.type} event: replacement is ${bounded2.resultBytes} bytes against a ${deps.maxInlineBytes}-byte cap (${field} was ${totalBytes} bytes, descriptor overhead ${bounded2.overhead} bytes)`
+    );
+  }
+  return bounded2.result;
+}
 
 // src/daemon/environment.ts
 var BASE_PLATFORM_ALLOWLIST = [
@@ -14261,6 +14748,7 @@ function resultDocumentRejectionDetail(check) {
   }
 }
 var DEFAULT_MAX_TASK_OUTPUT_BYTES = 64 * 1024 * 1024;
+var DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME = 1;
 function isKnownRuntimeId(id) {
   return RuntimeIdSchema.safeParse(id).success;
 }
@@ -14507,6 +14995,14 @@ var TaskRunner = class {
   get maxTaskOutputBytes() {
     return this.deps.maxTaskOutputBytes ?? DEFAULT_MAX_TASK_OUTPUT_BYTES;
   }
+  /** Effective per-event inline ceiling for this daemon — see `DaemonConfig.maxInlineEventBytes`. */
+  get maxInlineEventBytes() {
+    return this.deps.maxInlineEventBytes ?? DEFAULT_MAX_INLINE_EVENT_BYTES;
+  }
+  /** WP0: effective per-canonical-Agent-home Attempt cap — see {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}. */
+  get maxConcurrentMutableSessionsPerAgentHome() {
+    return this.deps.maxConcurrentMutableSessionsPerAgentHome ?? DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME;
+  }
   /**
    * M4 Phase 4 (part B.3, observability): per-active-task queue watermarks
    * for the control socket's `status` result — see
@@ -14896,6 +15392,24 @@ var TaskRunner = class {
         decline("strict Agent-only daemon refuses legacy task offers", false);
         return;
       }
+      if (agentRef !== void 0) {
+        const limit = this.maxConcurrentMutableSessionsPerAgentHome;
+        let canonicalHome;
+        try {
+          canonicalHome = await this.deps.agentHome.layout.canonicalHomePath(agentRef);
+        } catch (error) {
+          decline(
+            `Agent home admission failed: ${errorMessage6(error)}`,
+            !(error instanceof AgentHomeResolutionError)
+          );
+          return;
+        }
+        const active2 = this.deps.agentHome.executionLeaseManager.activeAttemptCount(canonicalHome);
+        if (active2 >= limit) {
+          decline(`agent home busy: ${active2} active attempt(s)`, true);
+          return;
+        }
+      }
       const guarded = this.deps.admissionGuard?.({ taskId, payload });
       if (guarded !== void 0 && !guarded.admit) {
         decline(guarded.reason, guarded.retryable);
@@ -15165,6 +15679,7 @@ var TaskRunner = class {
         },
         forwardedEnvironmentNames: Object.freeze(Object.keys(env).sort())
       });
+      await this.deps.beforeClaim?.(taskId, manifest.descriptor.id);
       this.deps.send(
         createEnvelope(
           "task.claim",
@@ -15651,9 +16166,17 @@ var TaskRunner = class {
   }
   async pump(active) {
     try {
-      for await (const event of active.session.events) {
+      for await (let event of active.session.events) {
         if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
         if (this.tasks.get(active.taskId) !== active) return;
+        event = await spillOversizedEvent(event, {
+          maxInlineBytes: this.maxInlineEventBytes,
+          blobClient: this.deps.blobClient,
+          taskId: active.taskId,
+          signal: active.blobAbort.signal,
+          log: (message) => console.error(`[byok/client] ${message}`)
+        });
+        if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
         active.outputBytesSoFar += estimateEventBytes(event);
         if (active.outputBytesSoFar > this.maxTaskOutputBytes) {
           active.batcher.flush();
@@ -18573,6 +19096,7 @@ function delay2(ms) {
   });
 }
 function terminalKindOf(type) {
+  if (type === "task.decline") return "declined";
   if (type === "task.complete") return "complete";
   if (type === "task.fail") return "failed";
   if (type === "task.cancelled") return "cancelled";
@@ -18588,7 +19112,7 @@ function toJournalEnvelopeRecord(envelope, identity) {
     bytes,
     bytesHash: journalHash(bytes),
     receivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    opensTask: envelope.type === "task.offer" || envelope.type === "task.offer_with_toolsets" || envelope.type === "task.offer_for_agent"
+    opensTask: isTaskOfferType(envelope.type)
   };
 }
 function isRuntimeId(id) {
@@ -18607,7 +19131,7 @@ async function detectRuntimes(adapters) {
   }
   return runtimes;
 }
-function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
+function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies, providerProfileBindingConfigured = false) {
   const flags = [];
   if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
@@ -18619,6 +19143,9 @@ function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentO
   if (selectionAdapters.length > 0 && selectionAdapters.every((adapter) => adapter.descriptor.supportsDispatchSelection === true)) {
     flags.push("dispatch-selection");
   }
+  if (providerProfileBindingConfigured && adapters.some((adapter) => adapter.descriptor.id === "pi" && adapter.descriptor.supportsDispatchSelection)) {
+    flags.push(PROVIDER_PROFILE_BINDING_CAPABILITY);
+  }
   if (adapters.some((adapter) => adapter.descriptor.capabilities.mcpToolsets === true)) {
     flags.push("toolset-selection");
   }
@@ -18774,6 +19301,11 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
     );
   }
+  if (config.maxInlineEventBytes !== void 0 && !(Number.isSafeInteger(config.maxInlineEventBytes) && config.maxInlineEventBytes >= MIN_MAX_INLINE_EVENT_BYTES)) {
+    throw new Error(
+      `DaemonConfig.maxInlineEventBytes must be a safe integer of at least ${MIN_MAX_INLINE_EVENT_BYTES} (or omitted to use the ${DEFAULT_MAX_INLINE_EVENT_BYTES}-byte default) \u2014 got ${config.maxInlineEventBytes}. A smaller cap cannot hold the spill descriptor that documents the omission, and there is no "disabled" value: an unbounded tool_use.input/tool_result.output is what this cap exists to prevent.`
+    );
+  }
   validateProgressBatcherOptions(config.progressBatch);
   if (config.agentEgress !== void 0 && config.agentHome === void 0) {
     throw new Error("DaemonConfig.agentEgress requires DaemonConfig.agentHome for the per-Agent local spool");
@@ -18781,6 +19313,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   if (config.strictAgentOnly === true && config.agentHome === void 0) {
     throw new Error("DaemonConfig.strictAgentOnly requires DaemonConfig.agentHome");
   }
+  if (config.maxConcurrentMutableSessionsPerAgentHome !== void 0 && !(Number.isSafeInteger(config.maxConcurrentMutableSessionsPerAgentHome) && config.maxConcurrentMutableSessionsPerAgentHome > 0)) {
+    throw new Error(
+      `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome must be a positive safe integer (or omitted to use the default of ${DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}) \u2014 got ${config.maxConcurrentMutableSessionsPerAgentHome}. Raising it above 1 lets that many Attempts co-write one canonical Agent home; 0, a negative number, NaN, or a non-integer is rejected rather than silently treated as "uncapped".`
+    );
+  }
+  const agentHomeAttemptLimit = config.maxConcurrentMutableSessionsPerAgentHome ?? DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME;
   const egressPolicy = resolveAgentEgressPolicy(config.agentEgress?.policy);
   const egressBatcherOptions = egressPolicy.activity.mode === "contentful-trajectory" ? {
     ...config.progressBatch,
@@ -19062,19 +19600,31 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           `[byok/client] WARNING: permissionDefaults.workspaceRoot ("${config.permissionDefaults.workspaceRoot}") is configured, but no bundled runtime adapter (pi/claude/codex) enforces PermissionPolicy.workspaceRoot \u2014 every adapter confines a task to ctx.workspaceDir instead. This ceiling value has no enforcement effect; see docs/security.md's "Workspace confinement is a convention, not a sandbox" section.`
         );
       }
-      if (activeJournal) {
-        const recoverable = await activeJournal.listRecoverable();
-        for (const task of recoverable) {
-          await activeJournal.markRecovered(task.taskId, {
-            disposition: "interrupted",
-            reason: `daemon restarted while this task was in local state "${task.localState}"; local runtime sessions do not survive the process`
+      const journalIdentity = activeJournal ? { tenantId: record3.tenantId, productId: config.productId, deviceId: record3.deviceId } : void 0;
+      if (activeJournal && journalIdentity) {
+        const durableCursor = await cursorStore.load(config.serverUrl, record3.deviceId) ?? 0;
+        for (const task of await activeJournal.listRecoveryTasks(journalIdentity)) {
+          if (task.localState === "received" && task.seq > durableCursor) continue;
+          const offer = decodeEnvelope(task.envelopeBytes);
+          if (!isTaskOfferType(offer.type) || offer.task_id !== task.taskId) throw new Error("invalid durable recovery offer binding");
+          const payload = offer.payload;
+          const terminal = createEnvelope("task.fail", {
+            reason: "daemon_interrupted",
+            retryable: false,
+            ...payload.agentRef === void 0 ? {} : { agentRef: payload.agentRef }
+          }, { taskId: task.taskId });
+          const bytes = encodeEnvelope(terminal);
+          await activeJournal.recordTerminal({
+            taskId: task.taskId,
+            terminalType: "failed",
+            bytes,
+            payloadHash: journalHash(bytes),
+            truthState: "pending",
+            attempt: 1,
+            recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            recovery: { disposition: "interrupted", reason: "daemon_interrupted" }
           });
         }
-        if (recoverable.length > 0) {
-          console.warn(
-            `[byok/client] local journal recovery: ${recoverable.length} task(s) were interrupted by the previous shutdown and have been marked (not resumed, not deleted): ${recoverable.map((task) => task.taskId).join(", ")}`
-          );
-        }
       }
       if (activeOwnedPressureEngine) {
         await activeOwnedPressureEngine.tick();
@@ -19101,7 +19651,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         config.strictAgentOnly === true,
         agentHomeManager?.supportsTaskFreeProjection() === true,
         config.agentEgress !== void 0,
-        agentContentReadPolicies
+        agentContentReadPolicies,
+        config.piByokLauncher !== void 0
       );
       const agentHomeProjectionCompletion = agentHomeManager?.supportsTaskFreeProjection() === true ? new AgentHomeProjectionCompletionClient({
         serverUrl: config.serverUrl,
@@ -19109,35 +19660,64 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         tenantId: record3.tenantId,
         deviceId: record3.deviceId
       }) : void 0;
-      const journalIdentity = config.hostedJournal ? { tenantId: record3.tenantId, productId: config.productId, deviceId: record3.deviceId } : void 0;
-      const sendSanitizedEnvelope = activeJournal && journalIdentity ? (envelope) => {
-        observer.handleOutboundEnvelope(envelope);
+      const sendSanitizedEnvelope = (envelope) => {
         const terminalKind = terminalKindOf(envelope.type);
-        const taskId = envelope.task_id;
-        if (terminalKind === void 0 || taskId === void 0) {
+        if (!activeJournal || !journalIdentity || terminalKind === void 0 || envelope.task_id === void 0) {
+          observer.handleOutboundEnvelope(envelope);
           connection?.send(envelope);
           return;
         }
-        const payloadHash = journalHash(encodeEnvelope(envelope));
-        journalTerminalTail = journalTerminalTail.then(
-          () => activeJournal.recordTerminal({
-            taskId,
-            terminalType: terminalKind,
-            payloadHash,
-            truthState: "pending",
-            attempt: 1,
-            recordedAt: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        ).catch((err) => {
-          console.warn(
-            `[byok/client] could not record task ${taskId}'s terminal in the local journal (sending it anyway): ${err instanceof Error ? err.message : String(err)}`
-          );
-        }).then(() => {
-          connection?.send(envelope);
+        const taskId = envelope.task_id;
+        const bytes = encodeEnvelope(envelope);
+        journalTerminalTail = journalTerminalTail.catch(() => void 0).then(async () => {
+          try {
+            await activeJournal.recordTerminal({
+              taskId,
+              terminalType: terminalKind,
+              bytes,
+              payloadHash: journalHash(bytes),
+              truthState: "pending",
+              attempt: 1,
+              recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            const terminal = (await activeJournal.listPendingTerminals(journalIdentity)).find((row) => row.taskId === taskId);
+            if (!terminal || terminal.truthState !== "pending") return;
+            const durable = decodeEnvelope(terminal.bytes);
+            overrides.executionRecoveryFault?.("terminal:before-send");
+            observer.handleOutboundEnvelope(durable);
+            connection?.send(durable);
+          } catch (error) {
+            if (!(error instanceof JournalRecordTooLargeError)) throw error;
+            if (!activeJournal || !journalIdentity) throw error;
+            const task = await activeJournal.readTask(taskId, journalIdentity);
+            if (!task) throw new Error(`missing durable task ${taskId}`);
+            const offer = decodeEnvelope(task.envelopeBytes);
+            if (!isTaskOfferType(offer.type) || offer.task_id !== taskId) throw new Error(`invalid durable offer binding for ${taskId}`);
+            const offerPayload = offer.payload;
+            const failure = createEnvelope("task.fail", {
+              reason: "terminal_result_too_large",
+              retryable: false,
+              ...offerPayload.agentRef === void 0 ? {} : { agentRef: offerPayload.agentRef }
+            }, { taskId });
+            const failureBytes = encodeEnvelope(failure);
+            await activeJournal.recordTerminal({
+              taskId,
+              terminalType: "failed",
+              bytes: failureBytes,
+              payloadHash: journalHash(failureBytes),
+              truthState: "pending",
+              attempt: 1,
+              recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            const durableFailure = (await activeJournal.listPendingTerminals(journalIdentity)).find((row) => row.taskId === taskId);
+            if (!durableFailure || durableFailure.truthState !== "pending") return;
+            const decoded = decodeEnvelope(durableFailure.bytes);
+            observer.handleOutboundEnvelope(decoded);
+            connection?.send(decoded);
+          }
+        }).catch((error) => {
+          console.error("[byok/client] terminal durability failed; execution remains unsettled", error);
         });
-      } : (envelope) => {
-        observer.handleOutboundEnvelope(envelope);
-        connection?.send(envelope);
       };
       const sendEnvelope = (candidate) => {
         if (candidate.task_id === void 0 || runner?.usesAgentEgress(candidate.task_id) !== true) {
@@ -19160,6 +19740,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         workspaceRoot: config.workspaceRoot,
         ...agentHomeManager === void 0 ? {} : { agentHome: agentHomeManager },
         ...config.strictAgentOnly === true ? { strictAgentOnly: true } : {},
+        // WP0: already validated up front — see `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome`.
+        maxConcurrentMutableSessionsPerAgentHome: agentHomeAttemptLimit,
         ...agentSessionHandoffs === void 0 ? {} : { agentSessionHandoffs },
         deviceId: record3.deviceId,
         // M5: see `DaemonConfig.runtimeEnvironment`'s own doc comment above.
@@ -19174,6 +19756,11 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         // before is the entire integration; `task-runner.ts` itself is
         // untouched. See `observer.ts`'s module doc comment.
         send: sendEnvelope,
+        ...activeJournal === void 0 ? {} : {
+          beforeClaim: async (taskId, runtime) => {
+            await activeJournal.recordAdmission({ taskId, admitted: true, claimedRuntime: runtime, decidedAt: (/* @__PURE__ */ new Date()).toISOString() });
+          }
+        },
         blobClient,
         batcherOptions: egressBatcherOptions,
         agentEgress,
@@ -19212,6 +19799,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         shutdownInterruptTimeoutMs: overrides.shutdown?.taskInterruptTimeoutMs,
         // M5 batch-3 (workstream 2): see DaemonConfig.maxTaskOutputBytes's own doc comment — already validated above.
         maxTaskOutputBytes: config.maxTaskOutputBytes,
+        // See DaemonConfig.maxInlineEventBytes's own doc comment — already validated above.
+        maxInlineEventBytes: config.maxInlineEventBytes,
         // additive-minor (`task.complete.document`): passed through verbatim,
         // absent when unconfigured — see `DaemonConfig.resultDocument`'s own
         // doc comment. Spread rather than assigned so an unconfigured daemon
@@ -19431,7 +20020,13 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           if (await handleAgentContentReadEnvelope(envelope)) return;
           activePressureEngine?.assertAckCriticalAllowed();
           await activeJournal.appendEnvelope(toJournalEnvelopeRecord(envelope, journalIdentity));
-          return runner?.handleEnvelope(envelope) ?? Promise.resolve();
+          if (isTaskOfferType(envelope.type) && envelope.task_id !== void 0) {
+            const task = await activeJournal.readTask(envelope.task_id, journalIdentity);
+            if (!task) throw new Error("durable offer has no execution record");
+            if (task.localState !== "received") return;
+          }
+          await runner?.handleEnvelope(envelope);
+          await journalTerminalTail;
         } : (envelope) => {
           if (tenantRebinding) {
             return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
@@ -19443,17 +20038,32 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           if (envelope.type === "agent.content.read") return handleAgentContentReadEnvelope(envelope).then(() => void 0);
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         },
+        onOutboundQueued: (envelope) => {
+          if (terminalKindOf(envelope.type) !== void 0) overrides.executionRecoveryFault?.("terminal:queued");
+        },
+        beforeOutboundPost: (envelopes) => {
+          if (envelopes.some((envelope) => terminalKindOf(envelope.type) !== void 0)) overrides.executionRecoveryFault?.("outbound:before-post");
+        },
+        onOutboundAccepted: async (envelopes) => {
+          if (!activeJournal) return;
+          for (const envelope of envelopes) {
+            if (terminalKindOf(envelope.type) === void 0 || envelope.task_id === void 0) continue;
+            overrides.executionRecoveryFault?.("outbound:after-ack");
+            await activeJournal.confirmTerminal(envelope.task_id, journalHash(encodeEnvelope(envelope)));
+          }
+        },
+        onOutboundRejected: async (envelope) => {
+          if (activeJournal && terminalKindOf(envelope.type) !== void 0 && envelope.task_id !== void 0) {
+            await activeJournal.rejectTerminal(envelope.task_id, journalHash(encodeEnvelope(envelope)), "inbound_rejected");
+          }
+        },
         onStateChange: (state) => {
-          const wasSettled = connectionState === "open" || connectionState === "degraded";
+          const wasSettled = connectionState === "open";
           connectionState = state;
           observer.noteConnectionState(state);
-          if (!wasSettled && (state === "open" || state === "degraded")) runner?.retryRecoveredAgentMessages();
-          if (!wasSettled && (state === "open" || state === "degraded")) runPresenceDiscovery();
+          if (!wasSettled && state === "open") runner?.retryRecoveredAgentMessages();
+          if (!wasSettled && state === "open") runPresenceDiscovery();
         },
-        backoff: overrides.backoff,
-        liveness: overrides.liveness,
-        wsFailureThreshold: overrides.longPoll?.wsFailureThreshold,
-        wsRetryIntervalMs: overrides.longPoll?.wsRetryIntervalMs,
         longPollRetryDelayMs: overrides.longPoll?.retryDelayMs,
         longPollIdleDelayMs: overrides.longPoll?.idleDelayMs,
         fleetJitter,
@@ -19464,8 +20074,20 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           });
         }
       });
+      if (activeJournal && journalIdentity) {
+        for (const terminal of await activeJournal.listPendingTerminals(journalIdentity)) {
+          if (terminal.truthState !== "pending") continue;
+          const envelope = decodeEnvelope(terminal.bytes);
+          if (envelope.task_id !== terminal.taskId || terminalKindOf(envelope.type) !== terminal.terminalType) {
+            throw new Error("durable terminal execution binding mismatch");
+          }
+          overrides.executionRecoveryFault?.("terminal:before-send");
+          observer.handleOutboundEnvelope(envelope);
+          connection.send(envelope);
+        }
+      }
       await connection.start();
-      await connection.waitForAck();
+      await connection.waitForConnection();
       runner.retryRecoveredAgentMessages();
       for (const record4 of agentEgress.retryableReliableRecords(connection.getServerCapabilities())) {
         dispatchReliableRecord(record4);
@@ -19724,7 +20346,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       // fine.
       ...storageStatus === void 0 ? {} : { storage: storageStatus },
       operationalHealth: operationalHealth.snapshot(),
-      toolsets: toolsetRegistry.status()
+      toolsets: toolsetRegistry.status(),
+      // WP0: same counts `Daemon.status()` reports, from the same reader.
+      agentHomeExecution: agentHomeExecutionStatus()
     };
   }
   async function performControlShutdown(reason) {
@@ -19849,6 +20473,11 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         if (!parsed) throw new ControlError("bad_request", "team_messages.ack requires exactly {context,throughSeq}");
         return teamWorkspaces.ackMessages({ lease: decodeTeamMemberContext(parsed.context), throughSeq: parsed.throughSeq });
       },
+      "team_notifications.snapshot": (params) => {
+        const parsed = parseTeamNotificationSnapshotParams(params);
+        if (!parsed) throw new ControlError("bad_request", "team_notifications.snapshot requires exactly {context,afterSeq?}");
+        return teamWorkspaces.notificationSnapshot({ lease: decodeTeamMemberContext(parsed.context), ...parsed.afterSeq === void 0 ? {} : { afterSeq: parsed.afterSeq } });
+      },
       "team_messages.inspect": (params) => {
         const parsed = parseTeamMessageInspectParams(params);
         if (!parsed) throw new ControlError("bad_request", "team_messages.inspect requires exactly {workspaceId,afterSeq?}");
@@ -19959,9 +20588,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         const minted = mintDeviceAssertion({
           record: record3,
           // `toHttpBase` is the one place a configured serverUrl is normalized
-          // (ws:->http:, wss:->https:, path stripped), so an operator who
-          // configured the websocket spelling and one who configured the HTTP
-          // spelling of the same deployment produce the same issuer.
+          // (path stripped), so the issuer ignores an operator-provided path
+          // or query.
           issuer: new URL(toHttpBase(config.serverUrl)).origin,
           productId: config.productId,
           audience: parsed.audience,
@@ -20076,23 +20704,33 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       await binding.lease.release();
     }
   }
+  function agentHomeExecutionStatus() {
+    const summary = agentHomeManager?.executionLeaseManager.activeAttemptSummary();
+    return {
+      maxConcurrentMutableSessionsPerAgentHome: agentHomeAttemptLimit,
+      activeHomes: summary?.homes ?? 0,
+      activeAttempts: summary?.attempts ?? 0
+    };
+  }
   function status() {
     return {
       localAgentRelease,
       paired: auth.deviceId !== void 0,
       connected: connectionState === "open",
-      degraded: connection?.isTransportDegraded() ?? false,
       revoked: connection?.isRevoked() ?? auth.isRevoked(),
       deviceId: auth.deviceId,
       activeTaskCount: runner?.activeTaskCount ?? 0,
       branding: config.branding,
       operationalHealth: operationalHealth.snapshot(),
       toolsets: toolsetRegistry.status(),
-      egress: agentEgress.status()
+      egress: agentEgress.status(),
+      agentHomeExecution: agentHomeExecutionStatus()
     };
   }
   function reloadMcpToolsets(mcpToolsets, expectedRevision) {
-    return toolsetRegistry.reload(mcpToolsets, expectedRevision);
+    const receipt = toolsetRegistry.reload(mcpToolsets, expectedRevision);
+    if (daemonStarted) connection?.refreshHello();
+    return receipt;
   }
   function reportMcpToolsetObservation(toolsetId, expectedDefinitionRevision, observation) {
     toolsetRegistry.report(toolsetId, expectedDefinitionRevision, observation);