@byok-sdk/client 0.13.0 → 0.15.0

package/dist/daemon/create-daemon.d.ts

@@ -307,6 +307,43 @@ export interface DaemonConfig {
      * explicitly instead to opt out of enforcement altogether.
      */
     maxTaskOutputBytes?: number;
+    /** Legacy artifact bytes only: default 16 MiB/file and 64 MiB/task, independent of event output limits. */
+    artifactLimits?: {
+        maxFileBytes: number;
+        maxTaskBytes: number;
+    };
+    /** Admission and startup deadline, including pure detect/prepare waits; unresolved process owners remain quarantined. Default 30 seconds. */
+    startupTimeoutMs?: number;
+    /**
+     * Per-EVENT inline ceiling (default {@link DEFAULT_MAX_INLINE_EVENT_BYTES},
+     * 64 KiB) for the two `AgentEvent` fields a runtime authors freely:
+     * `tool_use.input` and `tool_result.output`. An event whose serialization
+     * exceeds this leaves `TaskRunner.pump` with that field replaced by a
+     * UTF-8-safe head/tail preview (`{ preview: { head, tail } }`) and an
+     * additive `spill` descriptor; the full JSON serialization is uploaded to
+     * the blob plane under an idempotent, content-addressed key, and
+     * `spill.blob` is where a consumer reads it back. If the upload fails the
+     * preview still ships, carrying `spill.unstoredReason` instead — omission
+     * is always described, never silent.
+     *
+     * This is a per-event bound, orthogonal to `maxTaskOutputBytes` (a
+     * whole-task total, counted AFTER spilling) and to
+     * `progressBatch.maxBatchBytes` (a per-batch wire budget).
+     *
+     * **Consumer contract:** `spill`'s presence is the only signal that the
+     * inline field is a preview. A consumer that renders `tool_result.output`
+     * without checking `spill` renders a truncation as the whole result.
+     *
+     * Must be a positive safe integer of at least
+     * {@link MIN_MAX_INLINE_EVENT_BYTES} (4096) — below that a legitimate
+     * `spill` descriptor no longer fits inside the cap it exists to enforce.
+     * Anything else (0, negative, non-integer, `NaN`,
+     * `Number.POSITIVE_INFINITY`) is a config validation error thrown
+     * synchronously from `createDaemonWithAdapters`/`createDaemon`; there is
+     * no opt-out, because "unbounded event" is exactly the state this exists
+     * to prevent.
+     */
+    maxInlineEventBytes?: number;
     /**
      * Host-owned batching policy for normalized `task.progress` events.
      * `maxBatchBytes`, when set, measures exactly the UTF-8 bytes of
@@ -498,6 +535,8 @@ export interface DaemonStatus {
     revoked: boolean;
     deviceId?: string;
     activeTaskCount: number;
+    /** Exact terminal results retained for journal retry; nonzero requires recovery. */
+    pendingTerminalCommits: number;
     /** Passthrough of `DaemonConfig.branding` — `undefined` when the product configured none. See `DaemonBranding`. */
     branding?: DaemonBranding;
     /** Local lifecycle/retry budget, separate from transport fallback state. */
@@ -557,8 +596,11 @@ export interface Daemon {
     /** M3-2a: same as {@link approve} but rejects — see that method's doc comment. */
     reject(taskId: string, reason?: string): Promise<void>;
 }
-/** Internal seam so tests can substitute stub adapters / faster batch and long-poll timing. `createDaemonWithAdapters` (which takes this) is also the real entry point for products supplying a hand-built adapter set `createDaemon` can't construct on its own — e.g. custom adapter options, or an adapter that REPLACES a bundled runtime's implementation under the same id. Honest limit: an adapter id outside `pi`/`claude`/`codex` cannot pass wire validation today — `RuntimeIdSchema` (`@byok-sdk/protocol`) is a closed `z.enum(['pi', 'claude', 'codex'])`, and `isRuntimeId` filtering below (see `detectRuntimes`) drops any detected adapter outside that set before it ever reaches a wire-visible field. A genuinely fourth/namespaced runtime id is a future protocol change, not something this seam enables today. */
+/** Custom adapter composition. Available custom descriptors are published through
+ * the capability-gated harness inventory; built-in RuntimeId remains closed. */
 export interface DaemonOverrides {
+    /** Test-only synchronous kill points; never supplied by production configuration. */
+    executionRecoveryFault?: (step: 'terminal:before-send' | 'terminal:queued' | 'outbound:before-post' | 'outbound:after-ack') => void;
     /** M4 Phase 3: overrides `TaskRunner`'s default out-of-band approval wait (`DEFAULT_APPROVAL_TIMEOUT_MS`, 10 minutes) before an unanswered `requestApproval` force-resolves as a fail-closed rejection. */
     approvalTimeoutMs?: number;
     /** Finding F5: overrides for the control-socket shutdown path's own bounded waits — see `TaskRunner.shutdownTask`'s and `ConnectionManager.stop`'s own doc comments. Both default to 5s; neither affects an ordinary (non-shutdown-RPC) `daemon.stop()` call. */

package/dist/daemon/event-spill.d.ts

@@ -0,0 +1,90 @@
+import type { AgentEvent } from '@byok-sdk/protocol';
+import type { BlobResolver } from './blob-client';
+/**
+ * Default per-event inline ceiling (64 KiB) for the two `AgentEvent` variants
+ * that carry runtime-authored payloads (`tool_use.input`,
+ * `tool_result.output`) — see `DaemonConfig.maxInlineEventBytes`
+ * (`create-daemon.ts`) for the host-facing contract.
+ *
+ * 64 KiB is the same threshold `sendArtifact` already uses to decide inline
+ * vs. blob for an artifact (`MAX_INLINE_ARTIFACT_BYTES`): one number for "a
+ * payload this daemon is willing to put on the activity wire".
+ */
+export declare const DEFAULT_MAX_INLINE_EVENT_BYTES: number;
+/**
+ * Smallest accepted `maxInlineEventBytes`. Below this a legitimate spill
+ * descriptor (`field` + byte counts + a `BlobRef` whose `blobId` is chosen by
+ * the server, plus the event's own `type`/`tool`/`toolCallId`) stops fitting
+ * inside the cap it is supposed to keep the event under, which would turn a
+ * host's configuration mistake into a per-event runtime invariant failure.
+ * Enforced up front at `DaemonConfig` validation, never here.
+ */
+export declare const MIN_MAX_INLINE_EVENT_BYTES = 4096;
+/**
+ * Worst-case JSON cost of the `,"spill":{…}` fragment when the descriptor
+ * carries an `unstoredReason` rather than a server-chosen `BlobRef`.
+ *
+ * Every part is bounded by construction, which a `BlobRef` is not — its
+ * `blobId` is an arbitrary-length server-chosen string:
+ *
+ * ```
+ *   ,"spill":                                  9
+ *   {                                          1
+ *   "field":"output",                         17   ("output" is the longer of the two)
+ *   "totalBytes":<=16 digits>,                30
+ *   "omittedBytes":<=16 digits>,              32   (never exceeds totalBytes)
+ *   "contentType":"application/json",         33   (a module constant)
+ *   "unstoredReason":                         17
+ *   "<=512 bytes of escaped reason>"         514   (MAX_UNSTORED_REASON_BYTES + 2 quotes)
+ *   }                                          1
+ *                                           ----
+ *                                            654
+ * ```
+ *
+ * Rounded up to 768 so digit-count growth cannot invalidate it. Because the
+ * event is spread first and `spill` written last, a bounded event is EXACTLY
+ * the empty-preview skeleton plus this fragment — so refusing to spill unless
+ * `skeleton + MAX_SPILL_DESCRIPTOR_BYTES <= maxInlineBytes` is what makes the
+ * final cap check unreachable rather than merely unlikely. `event-spill.test.ts`
+ * asserts this against a maximally escaping reason instead of trusting the
+ * comment.
+ */
+export declare const MAX_SPILL_DESCRIPTOR_BYTES = 768;
+export interface EventSpillDeps {
+    /** Effective inline ceiling for this daemon; already validated at the `DaemonConfig` layer. */
+    maxInlineBytes: number;
+    /** Only the upload half of `BlobResolver` is needed, so a test double stays minimal. */
+    blobClient: Pick<BlobResolver, 'uploadArtifact'>;
+    /** Scopes the upload's idempotency key to the task that produced the event. */
+    taskId: string;
+    /** Task lifecycle authority — aborting it stops the spill upload with the rest of the task's blob I/O. */
+    signal?: AbortSignal;
+    /** Diagnostic seam. Called only on a path that loses information (upload failure, or an event this policy cannot bound). */
+    log?: (message: string) => void;
+}
+/**
+ * Bound one normalized `AgentEvent` at the daemon's ingestion boundary
+ * (`TaskRunner.pump`).
+ *
+ * An event whose serialized form already fits `maxInlineBytes` is returned
+ * **as the same object reference** — the overwhelming majority of events pay
+ * exactly one `JSON.stringify` and nothing else, and no downstream identity
+ * comparison changes meaning.
+ *
+ * An oversized `tool_use` / `tool_result` has its runtime-authored field
+ * (`input` / `output`) uploaded to the blob plane in full and REPLACED inline
+ * by `{ preview: { head, tail } }`, with an additive `spill` descriptor
+ * carrying either the resulting `BlobRef` or a bounded `unstoredReason`. The
+ * replacement is *measured* against the cap, never assumed to fit: the
+ * preview budget is whatever is left after the rest of the event and the
+ * real descriptor, and it is shrunk until `JSON.stringify(result)` actually
+ * fits (JSON escaping can cost several bytes per source character, so the
+ * byte budget alone is not a bound).
+ *
+ * Storage failure is never silent and never fatal: the preview still ships,
+ * `unstoredReason` says why the omitted bytes are unreadable, and `log` is
+ * called. The runtime's own transcript still holds the content, so failing
+ * the task over a telemetry upload would trade a real result for an
+ * observability problem.
+ */
+export declare function spillOversizedEvent(event: AgentEvent, deps: EventSpillDeps): Promise<AgentEvent>;

package/dist/daemon/journal/journal.d.ts

@@ -124,18 +124,21 @@ export interface LocalTransitionRecord {
 /** Whether the cloud has confirmed the terminal this daemon produced (§12.7.3's "terminal 生成后、truth 写入前" window). */
 export type TerminalTruthState = 'pending' | 'confirmed' | 'failed';
 /**
- * A task's terminal, as it exists locally. The PAYLOAD is not stored — only
- * its hash, plus enough retry state to know whether the cloud has taken it.
+ * One immutable canonical terminal and its delivery projection. Bytes are the
+ * replay authority; the hash is checked against them, never used as a substitute.
  */
 export interface LocalTerminalRecord {
     readonly taskId: string;
-    readonly terminalType: 'complete' | 'failed' | 'cancelled';
+    readonly terminalType: 'complete' | 'failed' | 'cancelled' | 'declined';
+    readonly bytes: string;
     readonly payloadHash: string;
     readonly truthState: TerminalTruthState;
     /** How many times delivery to the cloud has been attempted. */
     readonly attempt: number;
     readonly lastError?: string;
     readonly recordedAt: string;
+    /** Committed atomically with the original interruption report. */
+    readonly recovery?: RecoveryOutcome;
 }
 /** A task the journal knows about that has no terminal and no recovery marker — i.e. one this daemon was in the middle of when it stopped. */
 export interface RecoverableTask {
@@ -147,6 +150,7 @@ export interface RecoverableTask {
     readonly claimedRuntime?: string;
     readonly workspaceRef?: string;
     readonly updatedAt: string;
+    readonly envelopeBytes: string;
 }
 /**
  * What recovery decided about a task. `interrupted` is the honest default for
@@ -262,6 +266,14 @@ export interface LocalTaskJournal {
     recordTransition(record: LocalTransitionRecord): Promise<void>;
     /** Record (or update the retry state of) a task's terminal. Idempotent by task id: a replay with the same payload hash is a no-op beyond retry bookkeeping. */
     recordTerminal(record: LocalTerminalRecord): Promise<void>;
+    /** Exact original terminal bytes, including rejected records, until acknowledged. */
+    listPendingTerminals(identity: JournalIdentity): Promise<LocalTerminalRecord[]>;
+    /** A successful authenticated transport disposition, bound to the original bytes. */
+    confirmTerminal(taskId: string, payloadHash: string): Promise<void>;
+    rejectTerminal(taskId: string, payloadHash: string, reason: string): Promise<void>;
+    /** Includes old interruption markers without reports; they must not hide pending work. */
+    listRecoveryTasks(identity: JournalIdentity): Promise<RecoverableTask[]>;
+    readTask(taskId: string, identity: JournalIdentity): Promise<RecoverableTask | undefined>;
     /** Tasks with no terminal and no recovery marker — what this daemon was in the middle of when it last stopped. */
     listRecoverable(): Promise<RecoverableTask[]>;
     /** Close out one recoverable task by writing its recovery marker. Never deletes; a marked row is on §12.7.2.1's never-auto-delete list. */

package/dist/daemon/journal/sqlite-journal.d.ts

@@ -1,4 +1,4 @@
-import { type AdmissionRecord, type CategoryUsage, type CleanableCategory, type CleanupCandidate, type CleanupResult, type CompactOptions, type CompactResult, type JournalReceipt, type LocalStorageUsage, type LocalTaskJournal, type LocalTerminalRecord, type LocalTransitionRecord, type RecoverableTask, type RecoveryOutcome, type ReceivedEnvelopeRecord, type StorageCategory } from './journal';
+import { type JournalIdentity, type AdmissionRecord, type CategoryUsage, type CleanableCategory, type CleanupCandidate, type CleanupResult, type CompactOptions, type CompactResult, type JournalReceipt, type LocalStorageUsage, type LocalTaskJournal, type LocalTerminalRecord, type LocalTransitionRecord, type RecoverableTask, type RecoveryOutcome, type ReceivedEnvelopeRecord, type StorageCategory } from './journal';
 import { JournalHandleCleanupError, type JournalOpenFaultSeam } from './sqlite-support';
 export { JournalHandleCleanupError };
 /** The single database file, per §12.7.2's "建议单库 `<storeDir>/daemon.db`". */
@@ -24,7 +24,7 @@ export declare const DEFAULT_JOURNAL_BUSY_TIMEOUT_MS = 5000;
  * (`util/secure-dir.ts`): a seam the production path never supplies, exercised
  * from any host.
  */
-export type JournalFaultStep = 'append:before-begin' | 'append:after-envelope' | 'append:after-task' | 'append:after-receipt' | 'append:before-commit' | 'admission:before-commit' | 'transition:before-commit' | 'terminal:before-commit' | 'recovery:before-commit' | 'cleanup:before-commit' | 'prune:before-commit';
+export type JournalFaultStep = 'append:before-begin' | 'append:after-envelope' | 'append:after-task' | 'append:after-receipt' | 'append:before-commit' | 'append:after-commit' | 'admission:before-commit' | 'transition:before-commit' | 'terminal:before-commit' | 'terminal:after-commit' | 'recovery:after-commit' | 'confirm:before-commit' | 'confirm:after-commit' | 'recovery:before-commit' | 'cleanup:before-commit' | 'prune:before-commit';
 export interface JournalFaultSeam {
     /** Throw to simulate a crash or IO error at exactly this step. Return normally to proceed. */
     onStep?(step: JournalFaultStep): void;
@@ -79,6 +79,11 @@ export declare class SqliteLocalTaskJournal implements LocalTaskJournal {
      * first fact stands.
      */
     recordTerminal(record: LocalTerminalRecord): Promise<void>;
+    readTask(taskId: string, identity: JournalIdentity): Promise<RecoverableTask | undefined>;
+    listRecoveryTasks(identity: JournalIdentity): Promise<RecoverableTask[]>;
+    listPendingTerminals(identity: JournalIdentity): Promise<LocalTerminalRecord[]>;
+    confirmTerminal(taskId: string, payloadHash: string): Promise<void>;
+    rejectTerminal(taskId: string, payloadHash: string, reason: string): Promise<void>;
     /**
      * What this daemon was in the middle of: a task whose offer envelope is
      * durable, that has no terminal, that was not declined, and that recovery

package/dist/daemon/long-poll-transport.d.ts

@@ -49,56 +49,8 @@ export interface LongPollClientOptions {
     onRevoked?: () => void;
     /** Called when the server cannot replay the durable cursor supplied to this poll. */
     onReplayCursorTooOld?: (error: ReplayCursorTooOldError) => void;
-    /**
-     * M4 Phase 4 (version-negotiation drill fix), scope narrowed by finding F1:
-     * called ONLY for a batch entry that failed to parse because its `type`
-     * is entirely unrecognized (`parseMessage` throwing
-     * {@link UnknownMessageTypeError}) and which still carries a
-     * numeric envelope-level `seq` AND a recognizably task-class `type` (a
-     * `task.` prefix — see `extractSkippableSeq`'s own doc comment for why a
-     * `conn.*`-shaped or type-less entry is deliberately excluded, mirroring
-     * F2's "conn.* is never cursor-tracked" rule), so the caller can advance
-     * its cursor/watermark past it even though there is no real `Envelope` to
-     * hand to `onEnvelope`. Without this, a persistently-redelivered
-     * unrecognized-type entry (the real server retains and redelivers an
-     * un-acked envelope, protocol §9) would keep reappearing at the same
-     * cursor position forever.
-     *
-     * Finding F1: a RECOGNIZED type that fails schema validation
-     * ({@link EnvelopeValidationError} — e.g. a `task.offer` whose
-     * `PermissionPolicy` rejects an unknown constraint) is deliberately NOT
-     * reported here. That failure is a genuinely malformed control message,
-     * not forward-compat tolerance — forwarding its `seq` here would
-     * permanently ack a message the daemon never actually understood (the
-     * server would stop redelivering it, silently stranding whatever it was
-     * offering). This callback being scoped to `UnknownMessageTypeError` only
-     * preserves the no-silent-permanent-ack property. Optional
-     * only for constructor/test convenience — `ConnectionManager` always
-     * supplies it.
-     */
-    onSkippedSeq?: (seq: number) => void;
-    /**
-     * Finding R1 (cross-model re-review — the F1 fix alone was NOT-CLOSED):
-     * called for a batch entry whose `type` WAS recognized but whose payload
-     * failed schema validation ({@link EnvelopeValidationError}) — a genuine
-     * delivery failure at that specific seq, not forward-compat tolerance
-     * (contrast {@link onSkippedSeq}, which is scoped to the opposite case,
-     * an entirely unrecognized type). F1's own fix — simply not forwarding
-     * this seq to `onSkippedSeq` — turned out to be insufficient on its own:
-     * a LATER valid envelope in the same or a later batch would still
-     * silently advance the durable cursor PAST this seq once its own handler
-     * succeeded, since nothing had told `ConnectionManager` this seq needed
-     * the same stall treatment a thrown handler failure already gets — an
-     * INDIRECT permanent ack, one hop removed from the exact bug F1 set out
-     * to fix. `ConnectionManager` (`noteValidationFailure`) engages
-     * `stalledAtSeq` for this seq the same way `process()`'s own catch block
-     * does for a real thrown handler — freezing `dedupWatermark()` at the
-     * durable cursor (so the server's retain-and-redeliver semantics,
-     * protocol §9, keep this seq alive) and, via that SAME existing
-     * machinery, holding back the cursor for anything else delivered after it
-     * in the same batch too, exactly as a real handler failure already would.
-     * Optional only for constructor/test convenience — `ConnectionManager`
-     * always supplies it.
+    /** Unknown or malformed executable messages have no durable disposition.
+     * Freeze their sequence; a later valid message must not acknowledge them.
      */
     onValidationFailedSeq?: (seq: number) => void;
     /**

package/dist/daemon/runtime-start.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeOperationStartInput, Session } from '../types';
+/** A deadline withdraws admission; it never invents a quiescence receipt. */
+export declare function startOwnedRuntime(start: (input: RuntimeOperationStartInput) => Promise<Session>, input: RuntimeOperationStartInput, signal: AbortSignal, timeoutMs: number): Promise<Session>;

package/dist/daemon/store.d.ts

@@ -72,6 +72,8 @@ export declare class DeviceStore {
      * identifiable until the synchronous pathname check and unlink complete.
      */
     remove(): Promise<DeviceMetadata | undefined>;
+    /** Rebuild only the non-secret projection, while the caller owns the store lease. */
+    reconcileMetadata(authority: DeviceMetadata): Promise<boolean>;
     save(record: DeviceMetadata): Promise<void>;
     private openBounded;
 }

package/dist/daemon/task-runner.d.ts

@@ -228,6 +228,9 @@ export interface TaskRunnerDeps {
     agentSessionHandoffs?: AgentSessionHandoffStore;
     deviceId: string;
     send: (envelope: Envelope) => void;
+    awaitTerminalCommit?: (taskId: string) => Promise<void>;
+    /** Fsync the execution commitment before claim/runtime side effects. */
+    beforeClaim?: (taskId: string, runtime: string) => Promise<void>;
     blobClient: BlobResolver;
     batcherOptions?: ProgressBatcherOptions;
     /**
@@ -321,6 +324,7 @@ export interface TaskRunnerDeps {
     onApprovalDispatched?: (taskId: string, approvalId: string) => void;
     /** Overrides the bounded soft-interrupt window before authoritative `Session.close()` disposal begins. */
     shutdownInterruptTimeoutMs?: number;
+    startupTimeoutMs?: number;
     /**
      * M5 batch-3 (workstream 2): overrides {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}
      * — see that constant's own doc comment and `DaemonConfig.maxTaskOutputBytes`
@@ -330,6 +334,19 @@ export interface TaskRunnerDeps {
      * interface (`shutdownInterruptTimeoutMs`, `approvalTimeoutMs`).
      */
     maxTaskOutputBytes?: number;
+    artifactLimits?: {
+        maxFileBytes: number;
+        maxTaskBytes: number;
+    };
+    /**
+     * Per-event inline ceiling for `tool_use.input` / `tool_result.output` —
+     * see `DaemonConfig.maxInlineEventBytes` (`create-daemon.ts`) for the full
+     * contract and {@link DEFAULT_MAX_INLINE_EVENT_BYTES} for the default.
+     * Validated (positive safe integer, at least
+     * `MIN_MAX_INLINE_EVENT_BYTES`) at the `DaemonConfig` layer, not here —
+     * this seam trusts its caller, same as `maxTaskOutputBytes` above.
+     */
+    maxInlineEventBytes?: number;
     /**
      * M4 (additive-minor, `task.approval_resolved`): the capabilities advertised
      * by the CURRENT transport's server (`conn.ack` on WS, the latest successful
@@ -569,6 +586,8 @@ export declare class TaskRunner {
     usesAgentEgress(taskId: string): boolean;
     /** M5 batch-3 (workstream 2): effective `maxTaskOutputBytes` cap for this daemon — see {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}'s own doc comment. */
     private get maxTaskOutputBytes();
+    /** Effective per-event inline ceiling for this daemon — see `DaemonConfig.maxInlineEventBytes`. */
+    private get maxInlineEventBytes();
     /** WP0: effective per-canonical-Agent-home Attempt cap — see {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}. */
     private get maxConcurrentMutableSessionsPerAgentHome();
     /**
@@ -614,8 +633,13 @@ export declare class TaskRunner {
     /** Restore activated, unaccepted message drafts before transport admission on daemon restart. */
     recoverAgentMessageOutboxes(agentsRoot: string): Promise<void>;
     private agentMessageOutbox;
+    /** A recovery terminal must not close first-message admission before this durable draft has a disposition. */
+    hasPendingRecoveredAgentMessage(taskId: string): boolean;
     /** Retry stable recovered records after a transport handshake/re-handshake. */
     retryRecoveredAgentMessages(): void;
+    private canPublishAgentMessage;
+    /** All authors and startup use the same queue-time and post-I/O authority check. */
+    private activateAgentMessage;
     private sendAgentMessageRecord;
     private handleAgentMessageDisposition;
     /** M4 Phase 2: stop claiming any FUTURE `task.offer` — see `stoppingOffers`'s own doc comment. Idempotent. */
@@ -657,6 +681,14 @@ export declare class TaskRunner {
      * ahead of this method — see `daemon-control-socket.test.ts`'s dedicated
      * regression test for the exact scenario.
      */
+    /** Startup resources have an owner even before a Session can become active. */
+    private startupRetryTimer;
+    private readonly claimedHarnesses;
+    private readonly homeReservations;
+    private readonly startupOwners;
+    private readonly startupDisposals;
+    private disposeStartupOwner;
+    private disposeStartupOwnerOnce;
     shutdownActiveTasks(reason: string): Promise<void>;
     /**
      * M5 batch-3 (workstream 2): the ONE shared per-task teardown sequence —
@@ -688,6 +720,7 @@ export declare class TaskRunner {
      * a genuine protocol bug, not a benign race — mirrors `pump()`'s own
      * identity-check guard for the same class of race.
      */
+    private interruptBounded;
     private teardownActiveTask;
     /** Graceful-shutdown caller of {@link teardownActiveTask} — see `shutdownActiveTasks`'s own doc comment. `retryable: true`: nothing about the task/policy itself was ever at fault, only this device's own availability right now. */
     private shutdownTask;
@@ -1138,7 +1171,10 @@ export declare class TaskRunner {
     private persistAgentTerminalEvidence;
     private retryAgentTerminalEvidence;
     private reportAgentTerminalEvidenceFailure;
+    retryTerminalFinalization(taskId: string): Promise<void>;
+    private readonly finalizationAttempts;
     private finish;
+    private finishOnce;
     private reserveSemanticTerminal;
     /** M3-B: bounded insert for `finishedTaskIds` — see its class-level doc comment and `MAX_TRACKED_TASK_IDS`. Evicts the oldest (first-inserted) entry once over cap, same idiom as `ConnectionHub.checkAndRecordDuplicate` (packages/server/src/hub.ts). */
     private addFinishedTaskId;

package/dist/daemon/team-workspace.d.ts

@@ -191,6 +191,15 @@ export declare class LocalTeamWorkspace {
         expiresAt: string;
     }>>;
     postMessage(input: TeamPostMessageInput): Promise<TeamMessageAcceptedReceipt>;
+    /** Metadata-only operator notification view. Never advances delivery or acknowledgement. */
+    notificationSnapshot(input: TeamReadMessagesInput): Promise<{
+        workspaceId: string;
+        memberId: string;
+        registryRevision: TeamWorkspaceRevision;
+        expiresAt: string;
+        acknowledgedThroughSeq: number;
+        latestPeerSeq: number | null;
+    }>;
     readMessages(input: TeamReadMessagesInput): Promise<TeamReadMessagesResult>;
     ackMessages(input: TeamAckMessagesInput): Promise<TeamAckReceipt>;
     private resolveLease;

package/dist/daemon/terminal-commit-queue.d.ts

@@ -0,0 +1,21 @@
+/** Volatile ownership of exact terminal bytes until the journal accepts them.
+ * The journal remains the sole durable authority. Failed receipts stay rejected;
+ * only the internal scheduling tail recovers so another task can make progress.
+ */
+export declare class TerminalCommitQueue {
+    private readonly committed;
+    private readonly pending;
+    private tail;
+    private timer;
+    private stopped;
+    constructor(committed: (taskId: string) => void);
+    get pendingCount(): number;
+    hasPending(taskId: string): boolean;
+    enqueue(taskId: string, commit: () => Promise<void>): void;
+    receipt(taskId: string): Promise<void>;
+    retry(taskId: string): Promise<void>;
+    resume(): void;
+    stop(): Promise<void>;
+    private attempt;
+    private armRetry;
+}

package/dist/daemon/terminal-identity.d.ts

@@ -0,0 +1,6 @@
+import { type AgentRef } from '@byok-sdk/protocol';
+/** Project sealed execution facts, never the offer's requested harness. */
+export declare function terminalIdentity(runtimeId: string | undefined, agentRef?: AgentRef): {
+    harnessId?: string;
+    agentRef?: AgentRef;
+};

package/dist/diagnostics/device-doctor.d.ts

@@ -0,0 +1,46 @@
+import type { DaemonConfig } from '../daemon/create-daemon';
+import type { RuntimeAdapter } from '../types';
+import type { DiagnosticsSnapshot } from './types';
+export type { DiagnosticsSnapshot, DiagnosticCheck, DiagnosticStatus } from './types';
+export interface DiagnoseDeviceOptions {
+    /** The same adapters used by an embedded host; omitted uses bundled adapters. */
+    adapters?: RuntimeAdapter[];
+    runtimeProbeTimeoutMs?: number;
+}
+/** Read-only device observation; does not read OS credentials or prove Agent readiness. */
+export declare function diagnoseDevice(config: DaemonConfig, options?: DiagnoseDeviceOptions): Promise<DiagnosticsSnapshot>;
+export interface RepairDeviceEnrollmentMetadataInput {
+    confirmed: true;
+    /** Obtain both from the host's authorized enrollment target, never from a guessed default. */
+    expectedDeviceId: string;
+    expectedTenantId: string;
+}
+export interface DeviceMetadataRepairResult {
+    action: 'restore-enrollment-metadata';
+    scope: 'device';
+    /** Metadata readback only; does not imply renewed credentials or a running daemon. */
+    status: 'repaired' | 'not-needed';
+}
+declare const MESSAGES: {
+    readonly 'confirmation-required': 'Explicit confirmation is required for enrollment metadata repair.';
+    readonly 'invalid-target': 'An explicit expected tenant and device are required.';
+    readonly 'daemon-running': 'Stop the daemon before enrollment metadata repair.';
+    readonly 'store-busy': 'The store is owned by another operation; enrollment metadata repair refused.';
+    readonly 'authority-unavailable': 'The OS enrollment authority could not be read.';
+    readonly 'authority-missing': 'No complete OS enrollment exists; use explicit authenticated pairing.';
+    readonly 'target-mismatch': 'The OS enrollment does not match the expected tenant and device.';
+    readonly 'projection-unavailable': 'The enrollment metadata could not be read safely; repair refused.';
+    readonly 'repair-failed': 'Enrollment metadata repair did not complete; inspect the state before retrying.';
+};
+export type DeviceMetadataRepairErrorCode = keyof typeof MESSAGES;
+/** Closed diagnostics only: no OS stderr, local paths, authority bytes or nested cause. */
+export declare class DeviceMetadataRepairError extends Error {
+    readonly code: DeviceMetadataRepairErrorCode;
+    constructor(code: DeviceMetadataRepairErrorCode);
+}
+/**
+ * Explicitly restore missing/valid-stale device.json from its existing OS authority.
+ * Does not instantiate AuthManager, renew credentials, pair, or start a runtime.
+ * Ordinary doctor remains credential-blind; only this confirmed action opens the OS store.
+ */
+export declare function repairDeviceEnrollmentMetadata(config: DaemonConfig, input: RepairDeviceEnrollmentMetadataInput): Promise<DeviceMetadataRepairResult>;

package/dist/diagnostics/diagnostics.d.ts

@@ -1,90 +1,13 @@
+import type { DiagnosticsSnapshot } from './types';
 import type { DaemonConfig, RuntimeAdapter } from '../index';
 import { connectControlClient } from '../bin/control-client';
-import type { ControlStatusResult } from '../daemon/control-protocol';
-import { type OperationalHealthFileInspection, OPERATIONAL_HEALTH_FILENAME } from '../daemon/operational-health';
+import { OPERATIONAL_HEALTH_FILENAME } from '../daemon/operational-health';
 export declare const MAX_QUARANTINE_ENTRIES = 100;
 export declare const MAX_QUARANTINE_SCAN_ENTRIES: number;
 export declare const MAX_QUARANTINE_READ_BYTES: number;
 export declare const MAX_DEVICE_RECORD_BYTES: number;
 export declare const MAX_JOURNAL_COPY_BYTES: number;
-export type DiagnosticStatus = 'pass' | 'warn' | 'fail';
-export interface DiagnosticCheck {
-    id: 'config' | 'device' | 'runtimes' | 'control' | 'health' | 'journal' | 'workspace' | 'quarantine';
-    status: DiagnosticStatus;
-    summary: string;
-}
-export interface DiagnosticsSnapshot {
-    version: 1;
-    generatedAt: string;
-    product: {
-        nameHash: string;
-        idHash: string;
-    };
-    system: {
-        node: string;
-        platform: NodeJS.Platform;
-        arch: string;
-        sqliteAvailable: boolean;
-    };
-    config: {
-        serverProtocol: 'http' | 'https' | 'ws' | 'wss' | 'invalid' | 'unsupported';
-        customStoreDir: boolean;
-        hostedJournal: boolean;
-        runtimeAllowlistCount?: number;
-    };
-    device: {
-        status: 'paired' | 'unpaired' | 'unavailable';
-        deviceIdHash?: string;
-    };
-    runtimes: Array<{
-        idHash: string;
-        present: boolean;
-        versionPresent: boolean;
-        authPresent?: boolean;
-        steer: boolean;
-        resume: boolean;
-        permissionModeCount: number;
-    }>;
-    control: {
-        status: 'offline';
-        reason: string;
-    } | {
-        status: 'online';
-        pid: number;
-        uptimeMs: number;
-        transport: string;
-        activeTaskCount: number;
-        pendingApprovalCount: number;
-        operationalHealth: ControlStatusResult['operationalHealth'];
-        storage?: ControlStatusResult['storage'];
-    };
-    health: OperationalHealthFileInspection;
-    journal: {
-        status: 'missing' | 'present' | 'corrupt' | 'unavailable';
-        sizeBytes?: number;
-        walBytes?: number;
-        integrity?: 'ok' | 'not-checked';
-        reason?: string;
-    };
-    workspace: {
-        status: 'available' | 'missing' | 'unavailable';
-        writable?: boolean;
-        reason?: string;
-    };
-    quarantine: {
-        status: 'available' | 'missing' | 'unavailable';
-        count: number;
-        scannedCount: number;
-        truncated: boolean;
-        entries: Array<{
-            nameHash: string;
-            sizeBytes: number;
-            modifiedAt: string;
-        }>;
-        reason?: string;
-    };
-    checks: DiagnosticCheck[];
-}
+export type { DiagnosticStatus, DiagnosticCheck, DiagnosticsSnapshot } from './types';
 export interface CollectDiagnosticsOptions {
     clock?: () => Date;
     adapters?: RuntimeAdapter[];