@byok-sdk/client 0.13.0 → 0.14.0

package/dist/index.js

@@ -2,11 +2,11 @@ import { randomUUID, createHash, randomBytes, createPrivateKey, generateKeyPairS
 import { promises, mkdirSync, constants, existsSync, linkSync, fstatSync, lstatSync, unlinkSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, readFileSync, realpathSync } from 'fs';
 import * as path3 from 'path';
 import path3__default, { join, isAbsolute } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, isTaskOfferType, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, decodeEnvelope, createEnvelope, encodeEnvelope, PROTOCOL_VERSION, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, isServerToDaemonType, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
 import net2, { createServer, createConnection } from 'net';
 import * as os4 from 'os';
 import os4__default from 'os';
-import { execFile, spawn } from 'child_process';
+import { execFile, spawn, spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
 import { createInterface } from 'readline';
 import { parseDeviceAssertionEnvelope, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash as contentHash$1, TRUTH_RECORD_KINDS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, isTenantId, nonceSigningBytes, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
@@ -14,7 +14,130 @@ import { promisify } from 'util';
 import * as fs14 from 'fs/promises';
 import { createRequire } from 'module';
 
-// src/agent-home.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/adapters/win32-job-object.ts
+var win32_job_object_exports = {};
+__export(win32_job_object_exports, {
+  Win32JobObjectFailure: () => Win32JobObjectFailure,
+  assignOwnedProcessToJob: () => assignOwnedProcessToJob,
+  isWin32JobObjectFailure: () => isWin32JobObjectFailure,
+  loadBindings: () => loadBindings
+});
+function isWin32JobObjectFailure(value) {
+  return value instanceof Error && value.name === "Win32JobObjectFailure";
+}
+function isNullHandle(value) {
+  return value === null || value === void 0 || value === 0n || value === 0;
+}
+async function loadBindings() {
+  if (cachedBindings !== void 0) return cachedBindings;
+  let koffi;
+  try {
+    const imported = await import('koffi');
+    koffi = imported.default ?? imported;
+  } catch (cause) {
+    throw new Win32JobObjectFailure({
+      step: "loadKoffi",
+      reason: "win32 runtime process ownership requires the koffi optional dependency, which could not be loaded"
+    }, { cause });
+  }
+  const kernel32 = koffi.load("kernel32.dll");
+  const PVOID = koffi.pointer("void");
+  const bind = (name, result, args) => kernel32.func("__stdcall", name, result, args);
+  cachedBindings = {
+    createJobObjectW: bind("CreateJobObjectW", PVOID, [PVOID, "str16"]),
+    setInformationJobObject: bind("SetInformationJobObject", "int", [PVOID, "int", PVOID, "uint32"]),
+    openProcess: bind("OpenProcess", PVOID, ["uint32", "int", "uint32"]),
+    assignProcessToJobObject: bind("AssignProcessToJobObject", "int", [PVOID, PVOID]),
+    closeHandle: bind("CloseHandle", "int", [PVOID]),
+    getLastError: bind("GetLastError", "uint32", [])
+  };
+  return cachedBindings;
+}
+function killOnCloseLimitInformation() {
+  const information = Buffer.alloc(JOBOBJECT_EXTENDED_LIMIT_SIZE);
+  information.writeUInt32LE(JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET);
+  return information;
+}
+function daemonJob(bindings) {
+  const existing = jobsByBindings.get(bindings);
+  if (existing !== void 0) return existing;
+  const job = bindings.createJobObjectW(null, null);
+  if (isNullHandle(job)) {
+    throw new Win32JobObjectFailure({
+      step: "CreateJobObjectW",
+      reason: "win32 runtime process ownership could not create the daemon kill-on-close job object",
+      win32Code: bindings.getLastError()
+    });
+  }
+  const information = killOnCloseLimitInformation();
+  if (bindings.setInformationJobObject(job, JobObjectExtendedLimitInformation, information, information.length) === 0) {
+    const win32Code = bindings.getLastError();
+    bindings.closeHandle(job);
+    throw new Win32JobObjectFailure({
+      step: "SetInformationJobObject",
+      reason: "win32 runtime process ownership could not make the daemon job object kill-on-close",
+      win32Code
+    });
+  }
+  jobsByBindings.set(bindings, job);
+  return job;
+}
+async function assignOwnedProcessToJob(pid, options) {
+  const bindings = options?.bindings ?? await loadBindings();
+  const job = daemonJob(bindings);
+  const processHandle = bindings.openProcess(OWNED_PROCESS_ACCESS, 0, pid);
+  if (isNullHandle(processHandle)) {
+    throw new Win32JobObjectFailure({
+      step: "OpenProcess",
+      reason: `win32 runtime process ownership could not open process ${pid} for job assignment`,
+      win32Code: bindings.getLastError()
+    });
+  }
+  try {
+    if (bindings.assignProcessToJobObject(job, processHandle) === 0) {
+      throw new Win32JobObjectFailure({
+        step: "AssignProcessToJobObject",
+        reason: `win32 runtime process ownership could not assign process ${pid} to the daemon kill-on-close job object`,
+        win32Code: bindings.getLastError()
+      });
+    }
+  } finally {
+    bindings.closeHandle(processHandle);
+  }
+}
+var JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, JobObjectExtendedLimitInformation, JOBOBJECT_EXTENDED_LIMIT_SIZE, JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET, PROCESS_SET_QUOTA, PROCESS_TERMINATE, OWNED_PROCESS_ACCESS, Win32JobObjectFailure, cachedBindings, jobsByBindings;
+var init_win32_job_object = __esm({
+  "src/adapters/win32-job-object.ts"() {
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 8192;
+    JobObjectExtendedLimitInformation = 9;
+    JOBOBJECT_EXTENDED_LIMIT_SIZE = 144;
+    JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET = 16;
+    PROCESS_SET_QUOTA = 256;
+    PROCESS_TERMINATE = 1;
+    OWNED_PROCESS_ACCESS = PROCESS_SET_QUOTA | PROCESS_TERMINATE;
+    Win32JobObjectFailure = class extends Error {
+      step;
+      win32Code;
+      constructor(input, options) {
+        super(input.reason, options);
+        this.name = "Win32JobObjectFailure";
+        this.step = input.step;
+        this.win32Code = input.win32Code;
+      }
+    };
+    jobsByBindings = /* @__PURE__ */ new WeakMap();
+  }
+});
 var tmpSeq = 0;
 async function atomicWriteFile(filePath, data, options = {}) {
   const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
@@ -2378,6 +2501,9 @@ function parseTeamMessageReadParams(value) {
   if (!isRecord2(value) || !exactKeys(value, ["context", "afterSeq"]) || !contextString(value.context) || value.afterSeq !== void 0 && !safeInteger(value.afterSeq)) return void 0;
   return { context: value.context, ...value.afterSeq === void 0 ? {} : { afterSeq: value.afterSeq } };
 }
+function parseTeamNotificationSnapshotParams(value) {
+  return parseTeamMessageReadParams(value);
+}
 function parseTeamMessageAckParams(value) {
   if (!isRecord2(value) || !exactKeys(value, ["context", "throughSeq"]) || !contextString(value.context) || !safeInteger(value.throughSeq)) return void 0;
   return { context: value.context, throughSeq: value.throughSeq };
@@ -4038,6 +4164,55 @@ function withOwnedProcessTree(options) {
     ...process.platform === "win32" ? { windowsHide: true } : { detached: true }
   };
 }
+var hostExitTargets = /* @__PURE__ */ new Map();
+var hostExitHandlerInstalled = false;
+function terminateOwnedTreesForHostExit() {
+  for (const target of hostExitTargets.values()) {
+    try {
+      if (target.platform === "win32") {
+        target.spawnSyncFn("taskkill", ["/PID", String(target.pid), "/T", "/F"], {
+          stdio: "ignore",
+          windowsHide: true
+        });
+      } else {
+        target.kill(-target.pid, "SIGKILL");
+      }
+    } catch {
+    }
+  }
+  hostExitTargets.clear();
+}
+function ensureHostExitHandler() {
+  if (hostExitHandlerInstalled) return;
+  hostExitHandlerInstalled = true;
+  process.prependListener("exit", terminateOwnedTreesForHostExit);
+}
+var defaultJobObject = {
+  async assign(pid) {
+    const { assignOwnedProcessToJob: assignOwnedProcessToJob2 } = await Promise.resolve().then(() => (init_win32_job_object(), win32_job_object_exports));
+    await assignOwnedProcessToJob2(pid);
+  }
+};
+async function adoptOwnedProcessTree(options) {
+  const pid = positivePid(options.child, options.label);
+  if (pid === void 0) return;
+  const platform = options.platform ?? process.platform;
+  ensureHostExitHandler();
+  hostExitTargets.set(options.child, {
+    pid,
+    label: options.label,
+    platform,
+    kill: options.killFn ?? defaultKill,
+    spawnSyncFn: options.spawnSyncFn ?? spawnSync
+  });
+  const forget = () => {
+    hostExitTargets.delete(options.child);
+  };
+  options.child.once("close", forget);
+  options.child.once("exit", forget);
+  if (platform !== "win32") return;
+  await (options.jobObject ?? defaultJobObject).assign(pid);
+}
 function positivePid(child, label) {
   const pid = child.pid;
   if (pid === void 0) return void 0;
@@ -4249,21 +4424,8 @@ async function disposeOwnedProcessTree(options) {
 var STDERR_RING_CAPACITY = 20;
 var DIALOG_UI_METHODS = /* @__PURE__ */ new Set(["select", "confirm", "input", "editor"]);
 var PiRpcClient = class {
-  child;
-  buffer = "";
-  nextId = 1;
-  pending = /* @__PURE__ */ new Map();
-  eventQueue = new AsyncQueue();
-  closed = false;
-  exitError;
-  closedPromise;
-  resolveClosed;
-  disposalAttempt;
-  /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
-  stderrRing = [];
-  /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
-  unmappedFrameCounts = /* @__PURE__ */ new Map();
   constructor(options) {
+    this.options = options;
     const spawnFn = options.spawnFn ?? spawn;
     this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
@@ -4273,6 +4435,9 @@ var PiRpcClient = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -4284,10 +4449,37 @@ var PiRpcClient = class {
       this.onClosed(err);
     });
   }
-  /** Send a command, resolved with its correlated `response` message. */
-  send(command) {
+  options;
+  child;
+  buffer = "";
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  eventQueue = new AsyncQueue();
+  closed = false;
+  exitError;
+  closedPromise;
+  resolveClosed;
+  disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts, so it — not the exit code of the kill we ourselves requested — becomes this client's exit error. */
+  adoptionFailure;
+  /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
+  stderrRing = [];
+  /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
+  unmappedFrameCounts = /* @__PURE__ */ new Map();
+  /**
+   * Send a command, resolved with its correlated `response` message.
+   *
+   * Adoption is awaited FIRST — this is `PiAdapter.start()`'s first awaited
+   * operation, so an unbackstopped tree never receives the initial prompt and
+   * never yields a session. The wait costs one settled-promise turn once the
+   * tree is adopted; every later command sees it already resolved.
+   */
+  async send(command) {
+    await this.adopted;
     if (this.closed) {
-      return Promise.reject(this.exitError ?? new Error("pi process is closed"));
+      throw this.exitError ?? new Error("pi process is closed");
     }
     const id = command.id ?? `req-${this.nextId++}`;
     const full = { ...command, id };
@@ -4360,6 +4552,32 @@ var PiRpcClient = class {
       label: "pi"
     };
   }
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority and the failure is re-thrown, which is what makes the
+   * first `send()` — and therefore `PiAdapter.start()` — fail before any
+   * session is published. Both cleanup attempts are best-effort because the
+   * adoption failure, not a terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "pi",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+  }
   onData(chunk) {
     this.buffer += chunk;
     let newlineIndex = this.buffer.indexOf("\n");
@@ -4378,6 +4596,7 @@ var PiRpcClient = class {
     } catch {
       return;
     }
+    this.options.onFrame?.(msg);
     if (msg.type === "response" && typeof msg.id === "string" && this.pending.has(msg.id)) {
       const waiter = this.pending.get(msg.id);
       this.pending.delete(msg.id);
@@ -4385,11 +4604,20 @@ var PiRpcClient = class {
       return;
     }
     if (msg.type === "extension_ui_request" && typeof msg.id === "string" && typeof msg.method === "string") {
-      this.respondToExtensionUiRequest(msg.id, msg.method);
+      if (this.options.extensionUi?.mode === "hold") this.options.extensionUi.onRequest(msg);
+      else this.respondToExtensionUiRequest(msg.id, msg.method);
       return;
     }
     this.eventQueue.push(msg);
   }
+  /** Write an explicit host-owned response; completion is a transport receipt only. */
+  async respondExtensionUi(response) {
+    if (this.options.extensionUi?.mode !== "hold") throw new Error("Pi interactions are not host-owned");
+    await this.adopted;
+    if (this.closed) throw new Error("Pi process is closed");
+    await new Promise((resolve, reject) => this.child.stdin.write(`${JSON.stringify({ type: "extension_ui_response", ...response })}
+`, (error) => error ? reject(error) : resolve()));
+  }
   /**
    * Answer pi's extension-UI blocking protocol headlessly (rpc.md's
    * "Extension UI Protocol"). Fail-closed policy, stated explicitly because
@@ -4443,9 +4671,10 @@ var PiRpcClient = class {
   onClosed(err) {
     if (this.closed) return;
     this.closed = true;
-    this.exitError = err;
+    const terminal = this.adoptionFailure ?? err;
+    this.exitError = terminal;
     this.resolveClosed();
-    for (const [, waiter] of this.pending) waiter.reject(err);
+    for (const [, waiter] of this.pending) waiter.reject(terminal);
     this.pending.clear();
     this.eventQueue.end();
   }
@@ -4479,6 +4708,8 @@ var PROVIDER_CREDENTIAL_ENV_DENY_NAMES = [
   "TOGETHER_API_KEY",
   "BASETEN_API_KEY",
   "KIMI_API_KEY",
+  "HF_TOKEN",
+  "MOONSHOT_API_KEY",
   "MINIMAX_API_KEY",
   "MINIMAX_CN_API_KEY",
   "QWEN_TOKEN_PLAN_API_KEY",
@@ -5300,6 +5531,10 @@ var ClaudeProcessClient = class {
   closedPromise;
   resolveClosed;
   disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts, so it — not the exit code of the kill we ourselves requested — becomes this client's exit error. */
+  adoptionFailure;
   stderrRing = [];
   unmappedFrameCounts = /* @__PURE__ */ new Map();
   sessionId;
@@ -5314,6 +5549,9 @@ var ClaudeProcessClient = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -5357,9 +5595,10 @@ var ClaudeProcessClient = class {
    * same id; if the process already closed before init ever arrived,
    * every call rejects with that same exit error.
    */
-  waitForInit() {
-    if (this.sessionId !== void 0) return Promise.resolve(this.sessionId);
-    if (this.closed) return Promise.reject(this.exitError ?? new Error("claude process is closed"));
+  async waitForInit() {
+    await this.adopted;
+    if (this.sessionId !== void 0) return this.sessionId;
+    if (this.closed) throw this.exitError ?? new Error("claude process is closed");
     return new Promise((resolve, reject) => {
       this.initWaiter = { resolve, reject };
     });
@@ -5423,6 +5662,32 @@ var ClaudeProcessClient = class {
       label: "claude"
     };
   }
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority and the failure is re-thrown, which is what makes
+   * `waitForInit()` — and therefore `ClaudeAdapter.start()` — fail before any
+   * session is published. Both cleanup attempts are best-effort because the
+   * adoption failure, not a terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "claude",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+  }
   onData(chunk) {
     this.buffer += chunk;
     let newlineIndex = this.buffer.indexOf("\n");
@@ -5471,9 +5736,10 @@ var ClaudeProcessClient = class {
   onClosed(err) {
     if (this.closed) return;
     this.closed = true;
-    this.exitError = err;
+    const terminal = this.adoptionFailure ?? err;
+    this.exitError = terminal;
     this.resolveClosed();
-    this.initWaiter?.reject(err);
+    this.initWaiter?.reject(terminal);
     this.initWaiter = void 0;
     this.eventQueue.end();
   }
@@ -6340,6 +6606,19 @@ var CodexProcessRunner = class {
   closedPromise;
   resolveClosed;
   disposalAttempt;
+  /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+  adopted;
+  /** Set before the fail-closed termination starts; `buildExitError` reports it instead of the exit status of the kill we ourselves requested. */
+  adoptionFailure;
+  adoption = "pending";
+  /**
+   * Lines parsed before adoption settled. Unlike pi and claude, this runner has
+   * no first awaited operation of its own to gate on — its caller reads the
+   * FIRST event as the authoritative thread id. Holding events until the tree
+   * is backstopped is what keeps that caller from publishing a session for a
+   * tree the job object never took.
+   */
+  deferredEvents = [];
   constructor(options) {
     this.onEvent = options.onEvent;
     const spawnFn = options.spawnFn ?? spawn;
@@ -6351,6 +6630,9 @@ var CodexProcessRunner = class {
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
+    this.adopted = this.adoptOwnedTree(options);
+    this.adopted.catch(() => {
+    });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
@@ -6416,8 +6698,58 @@ var CodexProcessRunner = class {
       label: "codex"
     };
   }
-  /** Builds a descriptive error folding in the exit code/signal and the stderr tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a failed start/resume should never need separately re-running codex by hand with a raw JSONL logger to learn why. */
+  /**
+   * Backstop this tree, or tear it down. Adoption failure is a start-time
+   * precondition, not a degraded mode: the child is terminated through the one
+   * disposal authority, every parsed line is dropped instead of delivered, and
+   * the resulting close makes the caller's own `waitClosed()` race reject with
+   * the adoption failure (`buildExitError`) before a thread id is published.
+   * Both cleanup attempts are best-effort because the adoption failure, not a
+   * terminator's own complaint, is the reason to report.
+   */
+  async adoptOwnedTree(options) {
+    try {
+      await adoptOwnedProcessTree({
+        child: this.child,
+        label: "codex",
+        platform: options.platform,
+        jobObject: options.jobObject
+      });
+    } catch (cause) {
+      const failure = cause instanceof Error ? cause : new Error(String(cause));
+      this.adoptionFailure = failure;
+      this.adoption = "failed";
+      this.deferredEvents.length = 0;
+      await requestOwnedProcessTreeTermination(this.processTreeOptions()).catch(() => {
+      });
+      await disposeOwnedProcessTree(this.processTreeOptions()).catch(() => {
+      });
+      throw failure;
+    }
+    this.adoption = "adopted";
+    for (const evt of this.deferredEvents.splice(0)) this.onEvent(evt);
+  }
+  /** Arrival-order delivery, held back until the tree is backstopped (see `deferredEvents`). */
+  deliver(evt) {
+    if (this.adoption === "failed") return;
+    if (this.adoption === "pending") {
+      this.deferredEvents.push(evt);
+      return;
+    }
+    this.onEvent(evt);
+  }
+  /**
+   * Builds a descriptive error folding in the exit code/signal and the stderr
+   * tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a
+   * failed start/resume should never need separately re-running codex by hand
+   * with a raw JSONL logger to learn why.
+   *
+   * A tree this runner could not backstop is the one exception: that process
+   * exited because THIS runner killed it, so `exit code=null, signal=SIGKILL`
+   * plus an empty stderr tail would bury the only reason anyone can act on.
+   */
   buildExitError(context) {
+    if (this.adoptionFailure !== void 0) return this.adoptionFailure;
     const parts = [`${context} (exit code=${this.exitCode}, signal=${this.exitSignal})`];
     if (this.stderrRing.length > 0) {
       parts.push(`stderr: ${this.stderrRing.join(" | ")}`);
@@ -6445,7 +6777,7 @@ var CodexProcessRunner = class {
     if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
       return;
     }
-    this.onEvent(parsed);
+    this.deliver(parsed);
   }
   onStderr(chunk) {
     for (const rawLine of chunk.split("\n")) {
@@ -9478,6 +9810,28 @@ var LocalTeamWorkspace = class {
       return Object.freeze({ accepted: true, durable: true, workspaceId: state.definition.workspaceId, memberId: input.lease.memberId, seq, messageId: message.messageId, message: publicValue });
     });
   }
+  /** Metadata-only operator notification view. Never advances delivery or acknowledgement. */
+  async notificationSnapshot(input) {
+    assertLeaseShape(input?.lease);
+    if (input.afterSeq !== void 0) assertAfterSeq(input.afterSeq);
+    return this.enqueue(async () => {
+      const state = await this.resolveLease(await this.load(), input.lease);
+      const acknowledgedThroughSeq = state.receipts[input.lease.memberId].acknowledgedThroughSeq;
+      const after = Math.max(input.afterSeq ?? 0, acknowledgedThroughSeq);
+      let latestPeerSeq = null;
+      for (const message of state.messages) {
+        if (message.seq > after && message.senderMemberId !== input.lease.memberId) latestPeerSeq = message.seq;
+      }
+      return Object.freeze({
+        workspaceId: state.definition.workspaceId,
+        memberId: input.lease.memberId,
+        registryRevision: state.definition.revision,
+        expiresAt: input.lease.expiresAt,
+        acknowledgedThroughSeq,
+        latestPeerSeq
+      });
+    });
+  }
   async readMessages(input) {
     assertLeaseShape(input?.lease);
     if (input?.afterSeq !== void 0) assertAfterSeq(input.afterSeq);
@@ -9893,9 +10247,10 @@ function isSafeNonnegativeInteger(value) {
 function validateTrustedEventsPage(events, requestedCursor, pageCursor) {
   let previousTaskSeq;
   for (const raw of events) {
-    if (typeof raw !== "object" || raw === null) continue;
+    if (typeof raw !== "object" || raw === null) throw new Error("events page contains an unidentifiable message");
     const { type, seq } = raw;
-    if (typeof type !== "string" || !type.startsWith("task.")) continue;
+    if (typeof type !== "string") throw new Error("events page message has no authoritative type");
+    if (type.startsWith("conn.")) continue;
     if (!isSafeNonnegativeInteger(seq)) {
       throw new Error("events poll task seq is not a safe nonnegative integer");
     }
@@ -9913,10 +10268,10 @@ function validateTrustedEventsPage(events, requestedCursor, pageCursor) {
     previousTaskSeq = seq;
   }
 }
-function extractSkippableSeq(raw) {
+function extractExecutableSeq(raw) {
   if (typeof raw !== "object" || raw === null) return void 0;
   const { type, seq } = raw;
-  if (typeof type !== "string" || !type.startsWith("task.")) return void 0;
+  if (typeof type !== "string" || type.startsWith("conn.")) return void 0;
   return isSafeNonnegativeInteger(seq) ? seq : void 0;
 }
 var LongPollClient = class {
@@ -10103,27 +10458,14 @@ var LongPollClient = class {
           try {
             envelope = parseMessage(raw);
           } catch (err) {
-            if (err instanceof UnknownMessageTypeError) {
-              const skippableSeq = extractSkippableSeq(raw);
-              if (skippableSeq !== void 0) {
-                this.opts.onSkippedSeq?.(skippableSeq);
-                acceptedAnyEntry = true;
-              }
-            } else {
-              const failedSeq = extractSkippableSeq(raw);
-              if (failedSeq !== void 0) {
-                hadValidationFailureThisBatch = true;
-                this.opts.onValidationFailedSeq?.(failedSeq);
-                if (!this.warnedValidationFailureSeqs.has(failedSeq)) {
-                  if (this.warnedValidationFailureSeqs.size > MAX_TRACKED_VALIDATION_FAILURE_WARNINGS) {
-                    this.warnedValidationFailureSeqs.clear();
-                  }
-                  this.warnedValidationFailureSeqs.add(failedSeq);
-                  console.warn(
-                    `[byok/client] long-poll: a recognized message type at seq=${failedSeq} failed payload validation \u2014 skipped for this batch, cursor frozen so the server keeps redelivering it until a corrected version arrives:`,
-                    err
-                  );
-                }
+            const failedSeq = extractExecutableSeq(raw);
+            if (failedSeq !== void 0) {
+              hadValidationFailureThisBatch = true;
+              this.opts.onValidationFailedSeq?.(failedSeq);
+              if (!this.warnedValidationFailureSeqs.has(failedSeq)) {
+                if (this.warnedValidationFailureSeqs.size > MAX_TRACKED_VALIDATION_FAILURE_WARNINGS) this.warnedValidationFailureSeqs.clear();
+                this.warnedValidationFailureSeqs.add(failedSeq);
+                console.warn(`[byok/client] long-poll: unknown or invalid executable message at seq=${failedSeq}; cursor frozen without durable disposition`, err);
               }
             }
             continue;
@@ -10184,7 +10526,7 @@ function sleep(ms, signal) {
 
 // src/daemon/connection-manager.ts
 function isCursorEnvelopeType(type) {
-  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
+  return isServerToDaemonType(type) && !type.startsWith("conn.");
 }
 function createConnectionHelloEnvelope(opts, getCursor) {
   const configuredToolsets = opts.getConfiguredToolsets?.();
@@ -10224,16 +10566,7 @@ var ConnectionManager = class {
       onPollFailure: () => this.noteDisconnected(),
       onRevoked: () => this.enterRevoked(),
       onReplayCursorTooOld: (error) => this.enterReplayCursorTooOld(error),
-      // M4 Phase 4 (version-negotiation drill fix): a batch entry
-      // LongPollClient couldn't parse into a known Envelope at all (an
-      // unrecognized message type) still needs its cursor/watermark
-      // advanced past it, exactly like a successfully-processed envelope
-      // would — see `noteSkippedSeq`'s own doc comment.
-      onSkippedSeq: (seq) => this.noteSkippedSeq(seq),
-      // Finding R1: a batch entry LongPollClient recognized the TYPE of but
-      // whose payload failed validation — a genuine delivery failure at
-      // that seq, engaged the same way a thrown handler failure is (see
-      // `noteValidationFailure`'s own doc comment).
+      // Unknown and malformed executable work use the same ordered stall.
       onValidationFailedSeq: (seq) => this.noteValidationFailure(seq),
       // Finding P2 (Fix 2a): lets the long-poll loop distinguish "this
       // non-empty batch was a stalled backlog re-pull, no cursor progress
@@ -10375,6 +10708,7 @@ var ConnectionManager = class {
    */
   send(envelope) {
     this.outbox.push(envelope);
+    this.opts.onOutboundQueued?.(envelope);
     void this.drainOutbox();
   }
   /** Publish a fresh local configuration snapshot while this daemon is running. */
@@ -10407,12 +10741,22 @@ var ConnectionManager = class {
       while (pending.length > 0) {
         if (this.stopped || this.revoked) return pending.flat();
         const segment = pending.shift();
-        const result = await this.longPoll.postBatch(segment);
-        if (result === void 0) return [...segment, ...pending.flat()];
-        if ((result.rejected ?? 0) === 0) continue;
-        if (segment.length === 1) {
-          this.quarantineRejectedOutbound(segment[0], "inbound_rejected");
-          continue;
+        try {
+          this.opts.beforeOutboundPost?.(segment);
+          const result = await this.longPoll.postBatch(segment);
+          if (result === void 0) return [...segment, ...pending.flat()];
+          if ((result.rejected ?? 0) === 0) {
+            await this.opts.onOutboundAccepted?.(segment);
+            continue;
+          }
+          if (segment.length === 1) {
+            await this.opts.onOutboundRejected?.(segment[0]);
+            this.quarantineRejectedOutbound(segment[0], "inbound_rejected");
+            continue;
+          }
+        } catch (error) {
+          console.error("[byok/client] outbound durable disposition failed; retaining exact batch", error);
+          return [...segment, ...pending.flat()];
         }
         const midpoint = Math.floor(segment.length / 2);
         pending.unshift(segment.slice(0, midpoint), segment.slice(midpoint));
@@ -10632,6 +10976,10 @@ var ConnectionManager = class {
    *   documented idempotent (protocol §9).
    */
   deliver(envelope) {
+    if (!isServerToDaemonType(envelope.type)) {
+      if (typeof envelope.seq === "number") this.noteValidationFailure(envelope.seq);
+      return false;
+    }
     const tracked = isCursorEnvelopeType(envelope.type) && typeof envelope.seq === "number";
     const watermark = this.dedupWatermark();
     if (tracked && watermark !== void 0 && envelope.seq <= watermark) return false;
@@ -10701,122 +11049,7 @@ var ConnectionManager = class {
       if (tracked) this.inFlightSeqs.delete(seq);
     }
   }
-  /**
-   * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
-   * for a batch entry it could not parse into a known `Envelope` at all (an
-   * unrecognized message type (see `long-poll-transport.ts`'s own doc
-   * comment on `parseLooseEventsPollResponse`) but which still carried a numeric,
-   * task-class envelope-level `seq` (the caller only invokes this for a
-   * `task.`-prefixed type — see `long-poll-transport.ts`'s own
-   * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
-   * here at all, mirroring F2's "conn.* is never cursor-tracked" rule).
-   * There is no real `Envelope` to hand to a handler — a genuinely
-   * unrecognized type has nothing this build could ever act on.
-   *
-   * GATEKEEPER-CAUGHT REGRESSION (fixed here): this used to call
-   * `advanceCursor(seq)` DIRECTLY, synchronously, the instant a skip was
-   * detected in `LongPollClient.loop()`'s per-entry for-loop. That is NOT
-   * "instantaneous and race-free" the way the previous version of this
-   * comment claimed — the hazard was never the skip racing against itself,
-   * it was the skip racing AHEAD of an EARLIER real envelope in the SAME
-   * batch that is still in flight on `processingChain` (`deliver()`, above,
-   * only ever CHAINS `process()` onto that promise chain — it never awaits
-   * it before returning). Concretely, batch `[real seq1, unknown seq2]`:
-   * `deliver(seq1)` chains `process(seq1)` but returns immediately without
-   * running it; the for-loop then reaches `seq2` and (pre-fix) called
-   * `advanceCursor(2)` synchronously, BEFORE `process(seq1)` had even
-   * started, let alone failed. If `seq1`'s handler then failed,
-   * `stalledAtSeq` became 1 — but the durable cursor was already 2, so
-   * `dedupWatermark()` returned 2, and every future redelivery of seq1 was
-   * dedup-dropped as "already past the cursor" forever: permanent envelope
-   * loss, exactly the F3 bug class the whole `stalledAtSeq`/frozen-watermark
-   * mechanism exists to prevent.
-   *
-   * Fix: the cursor-advancing half is now CHAINED onto `processingChain`
-   * too, exactly like `process()`'s own post-handler bookkeeping — so it
-   * only ever runs once every earlier envelope already queued ahead of it
-   * has fully settled (success or failure), and can observe `stalledAtSeq`'s
-   * REAL, up-to-date value rather than whatever it happened to be at the
-   * instant the skip was first noticed. The guard mirrors `process()`'s own
-   * success-path guard exactly: never advance past a still-unresolved
-   * earlier failure, unless (degenerate, cannot really happen for a skip)
-   * this exact seq IS the stalled one.
-   *
-   * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
-   * called immediately, unconditionally, regardless of `stalledAtSeq` —
-   * matching `deliver()`'s own eager, unconditional call for a real
-   * envelope: its only job is "don't re-dispatch something already handed off,"
-   * independent of outcome, and that property does not depend on FIFO
-   * ordering the way the DURABLE cursor does.
-   *
-   * Deliberately NO top-level `dedupWatermark() <= seq` early-return before
-   * queuing the chained callback (an earlier draft of this fix had one, and
-   * it was itself subtly wrong): `deliveredSeq` can already reflect a seq
-   * from the FIRST time it was ever seen, while the DURABLE cursor is still
-   * behind it because a stall intervened before that seq's chained
-   * advancement ran — a pre-check keyed on `deliveredSeq` would then
-   * wrongly treat a LATER redelivery of the same seq (arriving once the
-   * stall has since cleared) as "already accounted for" and never queue
-   * another attempt, permanently stranding the cursor one seq short. Always
-   * queuing is safe and cheap: `advanceCursor`'s own `seq <= this.cursor`
-   * guard already makes a genuinely-redundant call a no-op, so there is no
-   * correctness reason to short-circuit earlier, only a (here, unnecessary)
-   * micro-optimization one.
-   */
-  noteSkippedSeq(seq) {
-    this.noteDelivered(seq);
-    this.processingChain = this.processingChain.then(async () => {
-      if (this.stalledAtSeq === void 0 || seq === this.stalledAtSeq) {
-        try {
-          await this.advanceCursor(seq);
-          if (this.stalledAtSeq === seq) this.stalledAtSeq = void 0;
-        } catch (err) {
-          if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
-          console.error(
-            `[byok/client] unknown task seq=${seq} could not durably persist its cursor; cursor left unadvanced for redelivery:`,
-            err
-          );
-        }
-      }
-    });
-  }
-  /**
-   * Finding R1 (cross-model re-review — was NOT-CLOSED against F1):
-   * `LongPollClient` calls this for a batch entry whose `type` it
-   * recognized but whose payload failed schema validation
-   * ({@link EnvelopeValidationError}) — a genuine delivery failure at that
-   * seq, unlike `noteSkippedSeq`'s forward-compat case. Deliberately mirrors
-   * `process()`'s own catch block (`if (tracked && this.stalledAtSeq ===
-   * undefined) this.stalledAtSeq = envelope.seq;`) as closely as possible:
-   * the SAME "only the lowest unresolved failure holds the stall" rule, the
-   * SAME resulting freeze of `dedupWatermark()` at the durable cursor
-   * (protocol §9 keeps this seq alive), and — because it's the SAME
-   * `stalledAtSeq` field `process()`'s own post-success guard already
-   * checks — anything ELSE delivered after this seq (same batch or a later
-   * one) is automatically held back from advancing the cursor too, with
-   * zero changes needed to `process()` itself.
-   *
-   * Chained onto `processingChain` for exactly the reason `noteSkippedSeq`
-   * documents for its own identical chaining (see that method's sibling
-   * doc comment on `LongPollClient`, "GATEKEEPER-CAUGHT REGRESSION"): an
-   * EARLIER real envelope in the SAME batch may still be in flight on that
-   * FIFO chain when this is called (`deliver()` only ever chains
-   * `process()` onto it, never awaits before returning) — mutating
-   * `stalledAtSeq` synchronously here could race ahead of that still-
-   * unresolved earlier envelope. Chaining instead guarantees this only
-   * takes effect once every earlier-queued envelope has already settled,
-   * and reads `stalledAtSeq`'s real, up-to-date value rather than whatever
-   * it happened to be the instant the failure was first noticed.
-   *
-   * No `noteDelivered` call here (contrast `noteSkippedSeq`, which does
-   * call it): a validation-failed entry never becomes a real `Envelope` and
-   * never reaches `deliver()`, so it was never "delivered" in the eager
-   * in-memory-watermark sense that field tracks — there is nothing for it
-   * to eagerly mark. Once a corrected redelivery of this exact seq DOES
-   * arrive as a real envelope, it flows through the ordinary `deliver()`
-   * path (which calls `noteDelivered` itself) and, on success, clears the
-   * stall via `process()`'s own existing logic — no special-casing needed.
-   */
+  /** Serialized with handler completion, so invalid work cannot be acked by later success. */
   noteValidationFailure(seq) {
     this.processingChain = this.processingChain.then(() => {
       if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
@@ -11203,11 +11436,12 @@ var DaemonObserver = class {
    * where those are actually reported from.
    */
   handleInboundEnvelope(envelope) {
-    if (envelope.type !== "task.offer" && envelope.type !== "task.offer_with_toolsets" && envelope.type !== "task.offer_for_agent") return;
-    const taskId = envelope.task_id;
+    if (!isTaskOfferType(envelope.type)) return;
+    const offer = envelope;
+    const taskId = offer.task_id;
     if (this.taskInfo.has(taskId)) return;
-    this.upsertTask(taskId, { state: "Offered", runtime: envelope.payload.runtime });
-    this.emit({ kind: "offered", ts: nowIso(), taskId, runtime: envelope.payload.runtime });
+    this.upsertTask(taskId, { state: "Offered", runtime: offer.payload.runtime });
+    this.emit({ kind: "offered", ts: nowIso(), taskId, runtime: offer.payload.runtime });
   }
   /**
    * Feed a raw OUTBOUND (daemon -> server) envelope — this is where every
@@ -11736,6 +11970,7 @@ CREATE INDEX IF NOT EXISTS journal_transition_task ON journal_transition (task_i
 CREATE TABLE IF NOT EXISTS journal_terminal (
   task_id       TEXT PRIMARY KEY REFERENCES journal_task (task_id),
   terminal_type TEXT NOT NULL,
+  bytes         TEXT NOT NULL,
   payload_hash  TEXT NOT NULL,
   truth_state   TEXT NOT NULL,
   attempt       INTEGER NOT NULL,
@@ -11890,6 +12125,11 @@ var SqliteLocalTaskJournal = class {
       const quarantinePath = quarantineDatabase(options.storeDir, this.#dbPath, reason, this.#clock());
       throw new JournalCorruptError(this.#dbPath, quarantinePath, reason, { cause: err });
     }
+    const terminalColumns = db.prepare("PRAGMA table_info(journal_terminal)").all();
+    if (!terminalColumns.some((column) => column.name === "bytes")) {
+      db.close();
+      throw new JournalUnavailableError("hash-only journal format cannot replay terminals; preserve/export this journal and resolve it before starting the new execution-recovery format");
+    }
     this.#db = db;
     try {
       secureJournalFilePermissions(this.#dbPath);
@@ -11979,10 +12219,13 @@ var SqliteLocalTaskJournal = class {
     }
     return this.#enqueue("appendEnvelope", () => {
       this.#fault("append:before-begin");
-      return this.#transaction(() => {
+      const committed = this.#transaction(() => {
         const existing = this.#db.prepare("SELECT receipt FROM journal_idempotency WHERE scope = ? AND key = ?").get("envelope", record3.envelopeId);
         if (existing) {
           const prior = JSON.parse(existing.receipt);
+          if (prior.bytesHash !== record3.bytesHash) throw new Error("journal envelope identity collision");
+          const priorIdentity = this.#db.prepare("SELECT tenant_id, product_id, device_id FROM journal_envelope WHERE envelope_id = ?").get(record3.envelopeId);
+          this.#assertIdentity(priorIdentity, record3.identity);
           return { ...prior, created: false };
         }
         const committedAt = this.#clock().toISOString();
@@ -12004,6 +12247,16 @@ var SqliteLocalTaskJournal = class {
         );
         this.#fault("append:after-envelope");
         if (record3.opensTask && record3.taskId !== void 0) {
+          const task = this.#db.prepare("SELECT * FROM journal_task WHERE task_id = ?").get(record3.taskId);
+          if (task) {
+            this.#assertIdentity(task, record3.identity);
+            const original = this.#db.prepare("SELECT bytes FROM journal_envelope WHERE envelope_id = ?").get(task.envelope_id);
+            const oldOffer = JSON.parse(original.bytes);
+            const newOffer = JSON.parse(record3.bytes);
+            if (oldOffer.type !== newOffer.type || JSON.stringify(oldOffer.payload) !== JSON.stringify(newOffer.payload)) {
+              throw new Error("journal task identity reused with a different execution contract");
+            }
+          }
           this.#db.prepare(
             `INSERT OR IGNORE INTO journal_task
                  (task_id, envelope_id, tenant_id, product_id, device_id, seq, local_state, created_at, updated_at)
@@ -12032,6 +12285,8 @@ var SqliteLocalTaskJournal = class {
         this.#fault("append:before-commit");
         return { ...receipt, created: true };
       });
+      this.#fault("append:after-commit");
+      return committed;
     });
   }
   recordAdmission(record3) {
@@ -12102,17 +12357,22 @@ var SqliteLocalTaskJournal = class {
    */
   recordTerminal(record3) {
     return this.#enqueue("recordTerminal", () => {
+      if (typeof record3.bytes !== "string" || journalHash(record3.bytes) !== record3.payloadHash) {
+        throw new Error("terminal bytes do not match their canonical hash");
+      }
+      if (byteLength2(record3.bytes) > this.#maxRecordBytes) {
+        throw new JournalRecordTooLargeError("terminal bytes", byteLength2(record3.bytes), this.#maxRecordBytes);
+      }
       this.#transaction(() => {
         this.#requireTask(record3.taskId, "recordTerminal");
-        const existing = this.#db.prepare("SELECT payload_hash FROM journal_terminal WHERE task_id = ?").get(record3.taskId);
-        if (existing === void 0) {
-          this.#db.prepare(
-            `INSERT INTO journal_terminal
-                 (task_id, terminal_type, payload_hash, truth_state, attempt, last_error, recorded_at, updated_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
-          ).run(
+        const existing = this.#db.prepare("SELECT * FROM journal_terminal WHERE task_id = ?").get(record3.taskId);
+        if (!existing) {
+          this.#db.prepare(`INSERT INTO journal_terminal
+            (task_id, terminal_type, bytes, payload_hash, truth_state, attempt, last_error, recorded_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
             record3.taskId,
             record3.terminalType,
+            record3.bytes,
             record3.payloadHash,
             record3.truthState,
             record3.attempt,
@@ -12121,11 +12381,98 @@ var SqliteLocalTaskJournal = class {
             record3.recordedAt
           );
           this.#db.prepare("UPDATE journal_task SET local_state = ?, updated_at = ? WHERE task_id = ?").run(`terminal:${record3.terminalType}`, record3.recordedAt, record3.taskId);
-        } else if (existing.payload_hash === record3.payloadHash) {
+        } else if (existing.payload_hash === record3.payloadHash && existing.bytes === record3.bytes && existing.truth_state !== "confirmed") {
           this.#db.prepare("UPDATE journal_terminal SET truth_state = ?, attempt = ?, last_error = ?, updated_at = ? WHERE task_id = ?").run(record3.truthState, record3.attempt, record3.lastError ?? null, record3.recordedAt, record3.taskId);
         }
+        if (record3.recovery !== void 0 && !existing) {
+          this.#db.prepare("UPDATE journal_task SET recovery_marker = ?, updated_at = ? WHERE task_id = ?").run(JSON.stringify({ ...record3.recovery, occurredAt: record3.recovery.occurredAt ?? record3.recordedAt }), record3.recordedAt, record3.taskId);
+          this.#fault("recovery:before-commit");
+        }
         this.#fault("terminal:before-commit");
       });
+      if (record3.recovery !== void 0) this.#fault("recovery:after-commit");
+      this.#fault("terminal:after-commit");
+    });
+  }
+  #assertIdentity(row, identity) {
+    if (row.tenant_id !== identity.tenantId || row.product_id !== identity.productId || row.device_id !== identity.deviceId) {
+      throw new Error("journal enrollment identity mismatch; refusing cross-enrollment execution or terminal replay");
+    }
+  }
+  #taskRow(row) {
+    if (typeof row.envelope_bytes !== "string" || journalHash(row.envelope_bytes) !== row.envelope_hash) {
+      throw new Error("durable offer bytes/hash mismatch");
+    }
+    return {
+      taskId: row.task_id,
+      envelopeId: row.envelope_id,
+      seq: Number(row.seq),
+      identity: { tenantId: row.tenant_id, productId: row.product_id, deviceId: row.device_id },
+      localState: row.recovery_marker !== null && !String(row.local_state).startsWith("terminal:") ? "interrupted" : row.local_state,
+      ...row.claimed_runtime == null ? {} : { claimedRuntime: row.claimed_runtime },
+      ...row.workspace_ref == null ? {} : { workspaceRef: row.workspace_ref },
+      updatedAt: row.updated_at,
+      envelopeBytes: row.envelope_bytes
+    };
+  }
+  readTask(taskId, identity) {
+    return this.#enqueue("readTask", () => {
+      const row = this.#db.prepare(`SELECT t.*, e.bytes AS envelope_bytes, e.bytes_hash AS envelope_hash FROM journal_task t
+        JOIN journal_envelope e ON e.envelope_id = t.envelope_id WHERE t.task_id = ?`).get(taskId);
+      if (!row) return void 0;
+      this.#assertIdentity(row, identity);
+      return this.#taskRow(row);
+    });
+  }
+  listRecoveryTasks(identity) {
+    return this.#enqueue("listRecoveryTasks", () => {
+      const rows = this.#db.prepare(`SELECT t.*, e.bytes AS envelope_bytes, e.bytes_hash AS envelope_hash FROM journal_task t
+        JOIN journal_envelope e ON e.envelope_id = t.envelope_id
+        LEFT JOIN journal_terminal term ON term.task_id = t.task_id
+        WHERE term.task_id IS NULL ORDER BY t.seq, t.task_id`).all();
+      return rows.map((row) => {
+        this.#assertIdentity(row, identity);
+        return this.#taskRow(row);
+      });
+    });
+  }
+  listPendingTerminals(identity) {
+    return this.#enqueue("listPendingTerminals", () => {
+      const rows = this.#db.prepare(`SELECT term.*, t.tenant_id, t.product_id, t.device_id FROM journal_terminal term
+        JOIN journal_task t ON t.task_id = term.task_id WHERE term.truth_state <> 'confirmed'
+        ORDER BY term.recorded_at, term.task_id`).all();
+      return rows.map((row) => {
+        this.#assertIdentity(row, identity);
+        if (typeof row.bytes !== "string" || journalHash(row.bytes) !== row.payload_hash) throw new Error("durable terminal bytes/hash mismatch");
+        return {
+          taskId: row.task_id,
+          terminalType: row.terminal_type,
+          bytes: row.bytes,
+          payloadHash: row.payload_hash,
+          truthState: row.truth_state,
+          attempt: Number(row.attempt),
+          recordedAt: row.recorded_at,
+          ...row.last_error === null ? {} : { lastError: row.last_error }
+        };
+      });
+    });
+  }
+  confirmTerminal(taskId, payloadHash) {
+    return this.#terminalDisposition(taskId, payloadHash, "confirmed");
+  }
+  rejectTerminal(taskId, payloadHash, reason) {
+    return this.#terminalDisposition(taskId, payloadHash, "failed", reason);
+  }
+  #terminalDisposition(taskId, payloadHash, state, reason) {
+    return this.#enqueue("terminalDisposition", () => {
+      this.#transaction(() => {
+        const row = this.#db.prepare("SELECT payload_hash FROM journal_terminal WHERE task_id = ?").get(taskId);
+        if (!row || row.payload_hash !== payloadHash) throw new Error("terminal acknowledgement does not match durable terminal");
+        this.#db.prepare(`UPDATE journal_terminal SET truth_state = ?, last_error = ?, updated_at = ?
+          WHERE task_id = ? AND truth_state <> 'confirmed'`).run(state, reason ?? null, this.#clock().toISOString(), taskId);
+        this.#fault("confirm:before-commit");
+      });
+      this.#fault("confirm:after-commit");
     });
   }
   /**
@@ -12142,8 +12489,9 @@ var SqliteLocalTaskJournal = class {
     return this.#enqueue("listRecoverable", () => {
       const rows = this.#db.prepare(
         `SELECT t.task_id, t.envelope_id, t.seq, t.tenant_id, t.product_id, t.device_id,
-                  t.local_state, t.claimed_runtime, t.workspace_ref, t.updated_at
+                  t.local_state, t.claimed_runtime, t.workspace_ref, t.updated_at, e.bytes AS envelope_bytes, e.bytes_hash AS envelope_hash
              FROM journal_task t
+             JOIN journal_envelope e ON e.envelope_id = t.envelope_id
              LEFT JOIN journal_terminal term ON term.task_id = t.task_id
             WHERE t.recovery_marker IS NULL
               AND term.task_id IS NULL
@@ -12165,7 +12513,8 @@ var SqliteLocalTaskJournal = class {
           localState: row.local_state,
           ...claimedRuntime === null ? {} : { claimedRuntime },
           ...workspaceRef === null ? {} : { workspaceRef },
-          updatedAt: row.updated_at
+          updatedAt: row.updated_at,
+          envelopeBytes: row.envelope_bytes
         };
       });
     });
@@ -12822,6 +13171,204 @@ function createStatfsFreeBytesProvider(dir) {
     return Number(stats.bavail) * Number(stats.bsize);
   };
 }
+var DEFAULT_MAX_INLINE_EVENT_BYTES = 64 * 1024;
+var MIN_MAX_INLINE_EVENT_BYTES = 4096;
+var MAX_UNSTORED_REASON_BYTES = 512;
+var MAX_SPILL_DESCRIPTOR_BYTES = 768;
+function byteLength3(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function utf8Width(codePoint) {
+  if (codePoint < 128) return 1;
+  if (codePoint < 2048) return 2;
+  if (codePoint < 65536) return 3;
+  return 4;
+}
+function utf8Prefix(value, maxBytes) {
+  if (maxBytes <= 0) return "";
+  let bytes = 0;
+  let index = 0;
+  while (index < value.length) {
+    const codePoint = value.codePointAt(index);
+    const width = utf8Width(codePoint);
+    if (bytes + width > maxBytes) break;
+    bytes += width;
+    index += codePoint > 65535 ? 2 : 1;
+  }
+  return value.slice(0, index);
+}
+function utf8Suffix(value, maxBytes) {
+  if (maxBytes <= 0) return "";
+  let bytes = 0;
+  let index = value.length;
+  while (index > 0) {
+    let step = 1;
+    const last = value.charCodeAt(index - 1);
+    if (last >= 56320 && last <= 57343 && index >= 2) {
+      const previous = value.charCodeAt(index - 2);
+      if (previous >= 55296 && previous <= 56319) step = 2;
+    }
+    const codePoint = value.codePointAt(index - step);
+    const width = utf8Width(codePoint);
+    if (bytes + width > maxBytes) break;
+    bytes += width;
+    index -= step;
+  }
+  return value.slice(index);
+}
+function boundReasonText(raw) {
+  const collapsed = raw.replace(/\s+/g, " ").trim();
+  const fallback = "blob upload failed with a non-descriptive error";
+  if (collapsed.length === 0) return fallback;
+  let budget = MAX_UNSTORED_REASON_BYTES;
+  for (; ; ) {
+    const reason = utf8Prefix(collapsed, budget);
+    if (reason.length === 0) return fallback;
+    const encoded = byteLength3(JSON.stringify(reason)) - 2;
+    if (encoded <= MAX_UNSTORED_REASON_BYTES) return reason;
+    budget = Math.min(Math.floor(budget * MAX_UNSTORED_REASON_BYTES / encoded), budget - 1);
+  }
+}
+function boundedUnstoredReason(error) {
+  const raw = error instanceof Error && error.message.length > 0 ? `${error.name}: ${error.message}` : String(error);
+  return boundReasonText(raw);
+}
+async function spillOversizedEvent(event, deps) {
+  if (event.type !== "tool_use" && event.type !== "tool_result") return event;
+  const serializedEvent = safeStringify(event);
+  if (serializedEvent === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${event.type} event cannot be JSON-serialized (a BigInt, a cycle, or a throwing toJSON in its payload); forwarding it unchanged and unbounded`
+    );
+    return event;
+  }
+  if (byteLength3(serializedEvent) <= deps.maxInlineBytes) return event;
+  const spillable = event;
+  const field = spillable.type === "tool_use" ? "input" : "output";
+  const value = spillable.type === "tool_use" ? spillable.input : spillable.output;
+  if (value === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event is ${byteLength3(serializedEvent)} bytes, over the ${deps.maxInlineBytes}-byte inline cap, but carries no ${field} to spill; forwarding unchanged`
+    );
+    return event;
+  }
+  const serialized = safeStringify(value);
+  if (serialized === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type}.${field} is not JSON-serializable; forwarding the event unchanged`
+    );
+    return event;
+  }
+  const totalBytes = byteLength3(serialized);
+  const skeleton = safeStringify({ ...spillable, [field]: { preview: { head: "", tail: "" } } });
+  if (skeleton === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event cannot be JSON-serialized once its ${field} is replaced by a preview; forwarding it unchanged and unbounded`
+    );
+    return event;
+  }
+  if (byteLength3(skeleton) + MAX_SPILL_DESCRIPTOR_BYTES > deps.maxInlineBytes) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event exceeds the ${deps.maxInlineBytes}-byte inline cap independently of its ${field} (${byteLength3(skeleton)} bytes without it, plus up to ${MAX_SPILL_DESCRIPTOR_BYTES} bytes of spill descriptor); forwarding unchanged`
+    );
+    return event;
+  }
+  const digest4 = createHash("sha256").update(serialized, "utf8").digest("hex");
+  let stored;
+  let storedBlobId;
+  try {
+    const blob = await deps.blobClient.uploadArtifact(serialized, "application/json", {
+      idempotencyKey: `spill_${deps.taskId}_${digest4}`,
+      ...deps.signal === void 0 ? {} : { signal: deps.signal }
+    });
+    stored = { blob };
+    storedBlobId = blob.blobId;
+  } catch (error) {
+    const unstoredReason = boundedUnstoredReason(error);
+    stored = { unstoredReason };
+    deps.log?.(
+      `task ${deps.taskId}: ${totalBytes}-byte ${spillable.type}.${field} could not be stored, only a preview will reach the wire \u2014 ${unstoredReason}`
+    );
+  }
+  const descriptorFor = (omittedBytes, half) => ({
+    field,
+    totalBytes,
+    omittedBytes,
+    contentType: "application/json",
+    ...half
+  });
+  const bound = (half) => {
+    const overheadJson = safeStringify({
+      ...spillable,
+      [field]: { preview: { head: "", tail: "" } },
+      spill: descriptorFor(totalBytes, half)
+    });
+    if (overheadJson === void 0) return void 0;
+    const overhead = byteLength3(overheadJson);
+    let headBudget = Math.max(0, Math.ceil((deps.maxInlineBytes - overhead) / 2));
+    let tailBudget = Math.max(0, Math.floor((deps.maxInlineBytes - overhead) / 2));
+    for (; ; ) {
+      const head = utf8Prefix(serialized, headBudget);
+      const tail = utf8Suffix(serialized.slice(head.length), tailBudget);
+      const retained = byteLength3(head) + byteLength3(tail);
+      const result = {
+        ...spillable,
+        [field]: { preview: { head, tail } },
+        spill: descriptorFor(totalBytes - retained, half)
+      };
+      const resultJson = safeStringify(result);
+      if (resultJson === void 0) return void 0;
+      const resultBytes = byteLength3(resultJson);
+      if (resultBytes <= deps.maxInlineBytes) return { result, resultBytes, overhead };
+      const headBytes = byteLength3(head);
+      const tailBytes = byteLength3(tail);
+      if (headBytes === 0 && tailBytes === 0) return { result, resultBytes, overhead };
+      const excess = resultBytes - deps.maxInlineBytes;
+      const dropHead = headBytes === 0 ? 0 : Math.min(headBytes, Math.max(1, Math.ceil(excess / 2)));
+      const dropTail = tailBytes === 0 ? 0 : Math.min(tailBytes, Math.max(dropHead === 0 ? 1 : 0, excess - dropHead));
+      if (dropHead === 0 && dropTail === 0) return { result, resultBytes, overhead };
+      headBudget = headBytes - dropHead;
+      tailBudget = tailBytes - dropTail;
+    }
+  };
+  let bounded2 = bound(stored);
+  if (bounded2 === void 0) {
+    deps.log?.(
+      `task ${deps.taskId}: ${spillable.type} event cannot be JSON-serialized once its ${field} is replaced by a preview and a spill descriptor; forwarding it unchanged and unbounded`
+    );
+    return event;
+  }
+  if (bounded2.resultBytes > deps.maxInlineBytes && storedBlobId !== void 0) {
+    const unstoredReason = boundReasonText(
+      `spill locator too large for maxInlineBytes: blobId ${storedBlobId.length} chars`
+    );
+    deps.log?.(
+      `task ${deps.taskId}: ${totalBytes}-byte ${spillable.type}.${field} was stored, but its spill locator does not fit the ${deps.maxInlineBytes}-byte inline cap (descriptor overhead ${bounded2.overhead} bytes); shipping the preview with unstoredReason instead \u2014 ${unstoredReason}`
+    );
+    stored = { unstoredReason };
+    storedBlobId = void 0;
+    bounded2 = bound(stored);
+    if (bounded2 === void 0) {
+      deps.log?.(
+        `task ${deps.taskId}: ${spillable.type} event cannot be JSON-serialized once its ${field} is replaced by a preview and a spill descriptor; forwarding it unchanged and unbounded`
+      );
+      return event;
+    }
+  }
+  if (bounded2.resultBytes > deps.maxInlineBytes) {
+    throw new Error(
+      `event spill failed to bound a ${spillable.type} event: replacement is ${bounded2.resultBytes} bytes against a ${deps.maxInlineBytes}-byte cap (${field} was ${totalBytes} bytes, descriptor overhead ${bounded2.overhead} bytes)`
+    );
+  }
+  return bounded2.result;
+}
 
 // src/daemon/environment.ts
 var BASE_PLATFORM_ALLOWLIST = [
@@ -14448,6 +14995,10 @@ var TaskRunner = class {
   get maxTaskOutputBytes() {
     return this.deps.maxTaskOutputBytes ?? DEFAULT_MAX_TASK_OUTPUT_BYTES;
   }
+  /** Effective per-event inline ceiling for this daemon — see `DaemonConfig.maxInlineEventBytes`. */
+  get maxInlineEventBytes() {
+    return this.deps.maxInlineEventBytes ?? DEFAULT_MAX_INLINE_EVENT_BYTES;
+  }
   /** WP0: effective per-canonical-Agent-home Attempt cap — see {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}. */
   get maxConcurrentMutableSessionsPerAgentHome() {
     return this.deps.maxConcurrentMutableSessionsPerAgentHome ?? DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME;
@@ -15128,6 +15679,7 @@ var TaskRunner = class {
         },
         forwardedEnvironmentNames: Object.freeze(Object.keys(env).sort())
       });
+      await this.deps.beforeClaim?.(taskId, manifest.descriptor.id);
       this.deps.send(
         createEnvelope(
           "task.claim",
@@ -15614,9 +16166,17 @@ var TaskRunner = class {
   }
   async pump(active) {
     try {
-      for await (const event of active.session.events) {
+      for await (let event of active.session.events) {
         if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
         if (this.tasks.get(active.taskId) !== active) return;
+        event = await spillOversizedEvent(event, {
+          maxInlineBytes: this.maxInlineEventBytes,
+          blobClient: this.deps.blobClient,
+          taskId: active.taskId,
+          signal: active.blobAbort.signal,
+          log: (message) => console.error(`[byok/client] ${message}`)
+        });
+        if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
         active.outputBytesSoFar += estimateEventBytes(event);
         if (active.outputBytesSoFar > this.maxTaskOutputBytes) {
           active.batcher.flush();
@@ -18536,6 +19096,7 @@ function delay2(ms) {
   });
 }
 function terminalKindOf(type) {
+  if (type === "task.decline") return "declined";
   if (type === "task.complete") return "complete";
   if (type === "task.fail") return "failed";
   if (type === "task.cancelled") return "cancelled";
@@ -18551,7 +19112,7 @@ function toJournalEnvelopeRecord(envelope, identity) {
     bytes,
     bytesHash: journalHash(bytes),
     receivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    opensTask: envelope.type === "task.offer" || envelope.type === "task.offer_with_toolsets" || envelope.type === "task.offer_for_agent"
+    opensTask: isTaskOfferType(envelope.type)
   };
 }
 function isRuntimeId(id) {
@@ -18740,6 +19301,11 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
     );
   }
+  if (config.maxInlineEventBytes !== void 0 && !(Number.isSafeInteger(config.maxInlineEventBytes) && config.maxInlineEventBytes >= MIN_MAX_INLINE_EVENT_BYTES)) {
+    throw new Error(
+      `DaemonConfig.maxInlineEventBytes must be a safe integer of at least ${MIN_MAX_INLINE_EVENT_BYTES} (or omitted to use the ${DEFAULT_MAX_INLINE_EVENT_BYTES}-byte default) \u2014 got ${config.maxInlineEventBytes}. A smaller cap cannot hold the spill descriptor that documents the omission, and there is no "disabled" value: an unbounded tool_use.input/tool_result.output is what this cap exists to prevent.`
+    );
+  }
   validateProgressBatcherOptions(config.progressBatch);
   if (config.agentEgress !== void 0 && config.agentHome === void 0) {
     throw new Error("DaemonConfig.agentEgress requires DaemonConfig.agentHome for the per-Agent local spool");
@@ -19034,19 +19600,31 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           `[byok/client] WARNING: permissionDefaults.workspaceRoot ("${config.permissionDefaults.workspaceRoot}") is configured, but no bundled runtime adapter (pi/claude/codex) enforces PermissionPolicy.workspaceRoot \u2014 every adapter confines a task to ctx.workspaceDir instead. This ceiling value has no enforcement effect; see docs/security.md's "Workspace confinement is a convention, not a sandbox" section.`
         );
       }
-      if (activeJournal) {
-        const recoverable = await activeJournal.listRecoverable();
-        for (const task of recoverable) {
-          await activeJournal.markRecovered(task.taskId, {
-            disposition: "interrupted",
-            reason: `daemon restarted while this task was in local state "${task.localState}"; local runtime sessions do not survive the process`
+      const journalIdentity = activeJournal ? { tenantId: record3.tenantId, productId: config.productId, deviceId: record3.deviceId } : void 0;
+      if (activeJournal && journalIdentity) {
+        const durableCursor = await cursorStore.load(config.serverUrl, record3.deviceId) ?? 0;
+        for (const task of await activeJournal.listRecoveryTasks(journalIdentity)) {
+          if (task.localState === "received" && task.seq > durableCursor) continue;
+          const offer = decodeEnvelope(task.envelopeBytes);
+          if (!isTaskOfferType(offer.type) || offer.task_id !== task.taskId) throw new Error("invalid durable recovery offer binding");
+          const payload = offer.payload;
+          const terminal = createEnvelope("task.fail", {
+            reason: "daemon_interrupted",
+            retryable: false,
+            ...payload.agentRef === void 0 ? {} : { agentRef: payload.agentRef }
+          }, { taskId: task.taskId });
+          const bytes = encodeEnvelope(terminal);
+          await activeJournal.recordTerminal({
+            taskId: task.taskId,
+            terminalType: "failed",
+            bytes,
+            payloadHash: journalHash(bytes),
+            truthState: "pending",
+            attempt: 1,
+            recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            recovery: { disposition: "interrupted", reason: "daemon_interrupted" }
           });
         }
-        if (recoverable.length > 0) {
-          console.warn(
-            `[byok/client] local journal recovery: ${recoverable.length} task(s) were interrupted by the previous shutdown and have been marked (not resumed, not deleted): ${recoverable.map((task) => task.taskId).join(", ")}`
-          );
-        }
       }
       if (activeOwnedPressureEngine) {
         await activeOwnedPressureEngine.tick();
@@ -19082,35 +19660,64 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         tenantId: record3.tenantId,
         deviceId: record3.deviceId
       }) : void 0;
-      const journalIdentity = config.hostedJournal ? { tenantId: record3.tenantId, productId: config.productId, deviceId: record3.deviceId } : void 0;
-      const sendSanitizedEnvelope = activeJournal && journalIdentity ? (envelope) => {
-        observer.handleOutboundEnvelope(envelope);
+      const sendSanitizedEnvelope = (envelope) => {
         const terminalKind = terminalKindOf(envelope.type);
-        const taskId = envelope.task_id;
-        if (terminalKind === void 0 || taskId === void 0) {
+        if (!activeJournal || !journalIdentity || terminalKind === void 0 || envelope.task_id === void 0) {
+          observer.handleOutboundEnvelope(envelope);
           connection?.send(envelope);
           return;
         }
-        const payloadHash = journalHash(encodeEnvelope(envelope));
-        journalTerminalTail = journalTerminalTail.then(
-          () => activeJournal.recordTerminal({
-            taskId,
-            terminalType: terminalKind,
-            payloadHash,
-            truthState: "pending",
-            attempt: 1,
-            recordedAt: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        ).catch((err) => {
-          console.warn(
-            `[byok/client] could not record task ${taskId}'s terminal in the local journal (sending it anyway): ${err instanceof Error ? err.message : String(err)}`
-          );
-        }).then(() => {
-          connection?.send(envelope);
+        const taskId = envelope.task_id;
+        const bytes = encodeEnvelope(envelope);
+        journalTerminalTail = journalTerminalTail.catch(() => void 0).then(async () => {
+          try {
+            await activeJournal.recordTerminal({
+              taskId,
+              terminalType: terminalKind,
+              bytes,
+              payloadHash: journalHash(bytes),
+              truthState: "pending",
+              attempt: 1,
+              recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            const terminal = (await activeJournal.listPendingTerminals(journalIdentity)).find((row) => row.taskId === taskId);
+            if (!terminal || terminal.truthState !== "pending") return;
+            const durable = decodeEnvelope(terminal.bytes);
+            overrides.executionRecoveryFault?.("terminal:before-send");
+            observer.handleOutboundEnvelope(durable);
+            connection?.send(durable);
+          } catch (error) {
+            if (!(error instanceof JournalRecordTooLargeError)) throw error;
+            if (!activeJournal || !journalIdentity) throw error;
+            const task = await activeJournal.readTask(taskId, journalIdentity);
+            if (!task) throw new Error(`missing durable task ${taskId}`);
+            const offer = decodeEnvelope(task.envelopeBytes);
+            if (!isTaskOfferType(offer.type) || offer.task_id !== taskId) throw new Error(`invalid durable offer binding for ${taskId}`);
+            const offerPayload = offer.payload;
+            const failure = createEnvelope("task.fail", {
+              reason: "terminal_result_too_large",
+              retryable: false,
+              ...offerPayload.agentRef === void 0 ? {} : { agentRef: offerPayload.agentRef }
+            }, { taskId });
+            const failureBytes = encodeEnvelope(failure);
+            await activeJournal.recordTerminal({
+              taskId,
+              terminalType: "failed",
+              bytes: failureBytes,
+              payloadHash: journalHash(failureBytes),
+              truthState: "pending",
+              attempt: 1,
+              recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            const durableFailure = (await activeJournal.listPendingTerminals(journalIdentity)).find((row) => row.taskId === taskId);
+            if (!durableFailure || durableFailure.truthState !== "pending") return;
+            const decoded = decodeEnvelope(durableFailure.bytes);
+            observer.handleOutboundEnvelope(decoded);
+            connection?.send(decoded);
+          }
+        }).catch((error) => {
+          console.error("[byok/client] terminal durability failed; execution remains unsettled", error);
         });
-      } : (envelope) => {
-        observer.handleOutboundEnvelope(envelope);
-        connection?.send(envelope);
       };
       const sendEnvelope = (candidate) => {
         if (candidate.task_id === void 0 || runner?.usesAgentEgress(candidate.task_id) !== true) {
@@ -19149,6 +19756,11 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         // before is the entire integration; `task-runner.ts` itself is
         // untouched. See `observer.ts`'s module doc comment.
         send: sendEnvelope,
+        ...activeJournal === void 0 ? {} : {
+          beforeClaim: async (taskId, runtime) => {
+            await activeJournal.recordAdmission({ taskId, admitted: true, claimedRuntime: runtime, decidedAt: (/* @__PURE__ */ new Date()).toISOString() });
+          }
+        },
         blobClient,
         batcherOptions: egressBatcherOptions,
         agentEgress,
@@ -19187,6 +19799,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         shutdownInterruptTimeoutMs: overrides.shutdown?.taskInterruptTimeoutMs,
         // M5 batch-3 (workstream 2): see DaemonConfig.maxTaskOutputBytes's own doc comment — already validated above.
         maxTaskOutputBytes: config.maxTaskOutputBytes,
+        // See DaemonConfig.maxInlineEventBytes's own doc comment — already validated above.
+        maxInlineEventBytes: config.maxInlineEventBytes,
         // additive-minor (`task.complete.document`): passed through verbatim,
         // absent when unconfigured — see `DaemonConfig.resultDocument`'s own
         // doc comment. Spread rather than assigned so an unconfigured daemon
@@ -19406,7 +20020,13 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           if (await handleAgentContentReadEnvelope(envelope)) return;
           activePressureEngine?.assertAckCriticalAllowed();
           await activeJournal.appendEnvelope(toJournalEnvelopeRecord(envelope, journalIdentity));
-          return runner?.handleEnvelope(envelope) ?? Promise.resolve();
+          if (isTaskOfferType(envelope.type) && envelope.task_id !== void 0) {
+            const task = await activeJournal.readTask(envelope.task_id, journalIdentity);
+            if (!task) throw new Error("durable offer has no execution record");
+            if (task.localState !== "received") return;
+          }
+          await runner?.handleEnvelope(envelope);
+          await journalTerminalTail;
         } : (envelope) => {
           if (tenantRebinding) {
             return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
@@ -19418,6 +20038,25 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           if (envelope.type === "agent.content.read") return handleAgentContentReadEnvelope(envelope).then(() => void 0);
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         },
+        onOutboundQueued: (envelope) => {
+          if (terminalKindOf(envelope.type) !== void 0) overrides.executionRecoveryFault?.("terminal:queued");
+        },
+        beforeOutboundPost: (envelopes) => {
+          if (envelopes.some((envelope) => terminalKindOf(envelope.type) !== void 0)) overrides.executionRecoveryFault?.("outbound:before-post");
+        },
+        onOutboundAccepted: async (envelopes) => {
+          if (!activeJournal) return;
+          for (const envelope of envelopes) {
+            if (terminalKindOf(envelope.type) === void 0 || envelope.task_id === void 0) continue;
+            overrides.executionRecoveryFault?.("outbound:after-ack");
+            await activeJournal.confirmTerminal(envelope.task_id, journalHash(encodeEnvelope(envelope)));
+          }
+        },
+        onOutboundRejected: async (envelope) => {
+          if (activeJournal && terminalKindOf(envelope.type) !== void 0 && envelope.task_id !== void 0) {
+            await activeJournal.rejectTerminal(envelope.task_id, journalHash(encodeEnvelope(envelope)), "inbound_rejected");
+          }
+        },
         onStateChange: (state) => {
           const wasSettled = connectionState === "open";
           connectionState = state;
@@ -19435,6 +20074,18 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           });
         }
       });
+      if (activeJournal && journalIdentity) {
+        for (const terminal of await activeJournal.listPendingTerminals(journalIdentity)) {
+          if (terminal.truthState !== "pending") continue;
+          const envelope = decodeEnvelope(terminal.bytes);
+          if (envelope.task_id !== terminal.taskId || terminalKindOf(envelope.type) !== terminal.terminalType) {
+            throw new Error("durable terminal execution binding mismatch");
+          }
+          overrides.executionRecoveryFault?.("terminal:before-send");
+          observer.handleOutboundEnvelope(envelope);
+          connection.send(envelope);
+        }
+      }
       await connection.start();
       await connection.waitForConnection();
       runner.retryRecoveredAgentMessages();
@@ -19822,6 +20473,11 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         if (!parsed) throw new ControlError("bad_request", "team_messages.ack requires exactly {context,throughSeq}");
         return teamWorkspaces.ackMessages({ lease: decodeTeamMemberContext(parsed.context), throughSeq: parsed.throughSeq });
       },
+      "team_notifications.snapshot": (params) => {
+        const parsed = parseTeamNotificationSnapshotParams(params);
+        if (!parsed) throw new ControlError("bad_request", "team_notifications.snapshot requires exactly {context,afterSeq?}");
+        return teamWorkspaces.notificationSnapshot({ lease: decodeTeamMemberContext(parsed.context), ...parsed.afterSeq === void 0 ? {} : { afterSeq: parsed.afterSeq } });
+      },
       "team_messages.inspect": (params) => {
         const parsed = parseTeamMessageInspectParams(params);
         if (!parsed) throw new ControlError("bad_request", "team_messages.inspect requires exactly {workspaceId,afterSeq?}");