@deepseek-ai/dsh-session 0.1.2-rc.1 → 0.1.5-alpha.1

package/lib/invariant.js

@@ -50,8 +50,8 @@ function validateEvent(trace, event, fail) {
 			openStep = null;
 			nextStep += 1;
 			break;
-		case "assistant/chunk":
-			requireOpenStep(trace, "assistant/chunk", event.data.turn, event.data.step, fail);
+		case "assistant/attempt":
+			requireOpenStep(trace, "assistant/attempt", event.data.turn, event.data.step, fail);
 			break;
 		case "assistant/message":
 			requireOpenStep(trace, "assistant/message", event.data.turn, event.data.step, fail);
@@ -78,6 +78,9 @@ function validateEvent(trace, event, fail) {
 			};
 			break;
 		}
+		case "system/message":
+			requireOpenStep(trace, "system/message", event.data.turn, event.data.step, fail);
+			break;
 		case "user/message": break;
 		case "session/end-seed": break;
 		case "request/header":

package/lib/types/index.d.ts

@@ -10,15 +10,13 @@ import type { Scoped } from '@deepseek-ai/dsh-scope';
 import type { Message } from '@deepseek-ai/dsh-llm';
 import { SessionLogOffset, SessionSeq } from './types.ts';
 import type { TypertLookup } from '@deepseek-ai/dsh-typert-protocol';
-import type { CreateSessionOptions, EpochHeader, PrepareSessionOptions, RequestContext, SessionEvent, SessionEventMap, SessionEventType, SessionHeader, SessionId, SurfaceIntent, SurfaceEventType } from './types.ts';
+import type { CreateSessionOptions, EpochHeader, PrepareSessionOptions, RequestContext, SessionEvent, SessionEventMap, SessionEventType, SessionHeader, SessionId, SessionSeedEventState, SurfaceIntent, SurfaceEventType } from './types.ts';
 import type { SessionSurface } from './surface.ts';
 export * from './types.ts';
 export { SessionPreparation } from './preparation.ts';
 export type { SessionPreparationOptions } from './preparation.ts';
-export type { AssistantMessage, ToolResultMessage, UserMessage } from '@deepseek-ai/dsh-llm';
+export type { AssistantMessage, SystemMessage, ToolResultMessage, UserMessage } from '@deepseek-ai/dsh-llm';
 export { interruptedTurnClosers, TOOL_NOT_STARTED, TOOL_OUTCOME_UNKNOWN } from './repair.ts';
-export { decodeStorageRecord, packChunkRuns } from './chunk-rows.ts';
-export type { ChunkRow, StorageRecord } from './chunk-rows.ts';
 export type { SessionSurface, SurfaceFoldReplacement, SurfaceFoldResult } from './surface.ts';
 export { deriveEventMessage, foldSurface, isAppendSurfaceEvent, isReplacementSurfaceEvent, isSurfaceEvent, isSurfaceEligibleType } from './surface.ts';
 export { canonicalHeader, foldRequestHeader, headerEquals } from './request-header.ts';
@@ -85,6 +83,7 @@ declare module '@deepseek-ai/dsh-typert-protocol' {
  * Use {@link snapshotSessionEvent} when exclusive ownership is not guaranteed.
  * @param event - exclusively owned event imported across a trusted boundary.
  * @returns the same event object with a validated, deeply frozen message.
+ * @throws when event-local surface metadata, request-header fields, or message invariants are invalid; history relations are not checked.
  */
 export declare function adoptSessionEvent<T extends SessionEvent>(event: T): T;
 /**
@@ -124,9 +123,10 @@ export declare class Session {
      * The first seq appended IN THIS PROCESS: the length of the constructor
      * seed (0 without one). Events with smaller seq values entered through
      * construction — replay, fork, or resume — and were never published on the
-     * `session/event` firehose (constructor seeds do not emit), so consumers
-     * that replay the log as a publication substitute (telemetry adoption)
-     * start here. Distinct from {@link inheritedEventCount}, the DURABLE
+     * `session/event` firehose (constructor seeds do not emit). This offset marks
+     * the constructor-input boundary for lifecycle ownership and persistence
+     * adoption; consumers that need complete canonical history still start at
+     * seq 0. Distinct from {@link inheritedEventCount}, the DURABLE
      * fork-lineage cut: a resumed session's constructor seed is its full stored
      * log, while the inherited count keeps the original fork value — this field is the
      * in-process construction fact.
@@ -154,16 +154,19 @@ export declare class Session {
      */
     static create(id: SessionId, seed?: readonly SessionEvent[], header?: SessionHeader, inheritedEventCount?: SessionLogOffset): Session;
     /**
-     * Restore a detached session by taking ownership of fresh persistence values.
-     * The storage format, event envelopes, sequence continuity, surface transitions,
-     * and header fields are validated before the restored objects are frozen.
+     * Restore a detached session by adopting an independently owned or deeply frozen seed.
+     * Runtime-required event fields, event envelopes, sequence continuity, surface
+     * transitions, and header fields are validated without copying or freezing events.
+     * Embedded Assistant streams remain opaque until a stream consumer or storage
+     * verifier reads them.
      * @param id - restored session identity.
-     * @param seed - fresh detached events whose ownership is transferred.
-     * @param header - fresh detached metadata whose ownership is transferred.
+     * @param seed - independently owned or deeply frozen events.
+     * @param header - independently owned storage metadata.
      * @param inheritedEventCount - exact fork-inherited prefix length decoded from storage.
+     * @param eventState - aliasing state carried from the operation that produced the seed.
      * @returns a restored detached session.
      */
-    static fromRestore(id: SessionId, seed: readonly SessionEvent[], header: SessionHeader, inheritedEventCount: SessionLogOffset): Session;
+    static fromRestore(id: SessionId, seed: readonly SessionEvent[], header: SessionHeader, inheritedEventCount: SessionLogOffset, eventState: SessionSeedEventState): Session;
     private constructor();
     /** Cached immutable full snapshot of the private append-only log. */
     private eventsSnapshot;
@@ -212,7 +215,8 @@ export declare class Session {
      *   declare how it joins the surface, the sole source of derived model
      *   history) and
      *   rejected by the compiler for non-surface types like `turn/start` or
-     *   `assistant/chunk`.
+     *   `assistant/attempt`. Assistant messages embed their exact provider
+     *   stream and cannot cite top-level source events.
      * @returns the logged event — its assigned `seq`/`time` plus the SNAPSHOT of
      *   `data` that entered the log, so reading `event.data` back sees the logged
      *   value, never the caller's still-mutable input.
@@ -220,6 +224,7 @@ export declare class Session {
      *   (BigInt, function, symbol, undefined, negative zero, non-finite number,
      *   circular reference, sparse array, or an exotic object such as
      *   Map/Set/Date/class instance), or when the candidate violates the
+     *   request-header empty-field or tool-error consistency rules, or the
      *   canonical surface contract (marker shape and eligibility, unique
      *   earlier source-event references, positional replacement validity, and complete
      *   shadowed-node coverage). One iterative pass reads, validates, and
@@ -230,7 +235,7 @@ export declare class Session {
      *   append reentered while this acceptance/publication boundary is open also
      *   rejects before the log changes.
      */
-    append<T extends SessionEventType>(type: T, data: SessionEventMap[T], ...opts: T extends SurfaceEventType ? [opts: SurfaceIntent] : []): SessionEvent<T>;
+    append<T extends SessionEventType>(type: T, data: SessionEventMap[T], ...opts: T extends SurfaceEventType ? [opts: SurfaceIntent<T>] : []): SessionEvent<T>;
     /** Cached fold of the request-header events — see {@link requestHeader}. */
     private headerFold;
     /** Log position (events consumed) the header fold has reached. */
@@ -305,8 +310,9 @@ export declare class SessionForkError extends Error {
 /**
  * In-memory session store (`ctx.sessions`).
  *
- * Persistence is intentionally not implemented here — persistence plugins
- * subscribe to `session/event` and flush on `session/flush` / dispose.
+ * Persistence is intentionally not implemented here — the agent lifecycle
+ * attaches a session-log writer to each published session's write handle;
+ * a session published outside that lifecycle persists nothing.
  */
 export declare class SessionStore extends Service {
     private store;
@@ -345,10 +351,9 @@ export declare class SessionStore extends Service {
      *
      * @param id - the session id; omitted, the store mints `session-<n>`.
      * @param options - seed events and/or creation metadata for the header. With
-     *   `seedSource: 'persistence'`, metadata and events must be fresh detached
-     *   graphs whose ownership transfers to this call: they are validated and
-     *   frozen in place through {@link Session.fromRestore}, so the caller must
-     *   retain no mutable aliases.
+     *   `eventState`, every seed event is either independently owned or any
+     *   shared value is deeply frozen; {@link Session.fromRestore} validates and
+     *   adopts those values without copying or freezing them.
      * @returns the constructed session, NOT yet in the store.
      * @throws if a session with `id` already exists, metadata is not a plain
      *   lossless-JSON record with valid scalar fields, or `meta.cwd` is a

package/lib/types/index.js

@@ -8,15 +8,14 @@
 import { Service } from '@deepseek-ai/cordis';
 import { isAbsolute } from 'node:path';
 import { brandString } from '@deepseek-ai/dsh-brand';
-import { deepFreeze, snapshotJsonValue } from '@deepseek-ai/dsh-util-values';
+import { assertNever, deepFreeze, snapshotJsonValue } from '@deepseek-ai/dsh-util-values';
 import { scopeOf, scopeTarget } from '@deepseek-ai/dsh-scope';
 import { SESSION_FORMAT_VERSION, SessionLogOffset, SessionSeq } from "./types.js";
-import { deriveEventMessage, SurfaceManager } from "./surface.js";
+import { deriveEventMessage, SurfaceManager, validateSessionEventData, validateSurfaceMetadata } from "./surface.js";
 import { foldRequestHeader } from "./request-header.js";
 export * from "./types.js";
 export { SessionPreparation } from "./preparation.js";
 export { interruptedTurnClosers, TOOL_NOT_STARTED, TOOL_OUTCOME_UNKNOWN } from "./repair.js";
-export { decodeStorageRecord, packChunkRuns } from "./chunk-rows.js";
 export { deriveEventMessage, foldSurface, isAppendSurfaceEvent, isReplacementSurfaceEvent, isSurfaceEvent, isSurfaceEligibleType } from "./surface.js";
 export { canonicalHeader, foldRequestHeader, headerEquals } from "./request-header.js";
 export { KNOWN_SESSION_EVENT_TYPES } from "./known-event-types.js";
@@ -92,13 +91,17 @@ function snapshotSessionHeader(id, source) {
  * Use {@link snapshotSessionEvent} when exclusive ownership is not guaranteed.
  * @param event - exclusively owned event imported across a trusted boundary.
  * @returns the same event object with a validated, deeply frozen message.
+ * @throws when event-local surface metadata, request-header fields, or message invariants are invalid; history relations are not checked.
  */
 export function adoptSessionEvent(event) {
+    validateSessionEventData(event, `session event at seq ${event.seq}`);
+    validateSurfaceMetadata(event);
     assertMessageEventShape(event, `session event at seq ${event.seq}`);
     switch (event.type) {
         case 'user/message':
             deepFreeze(event.data);
             break;
+        case 'system/message':
         case 'assistant/message':
         case 'tool/result':
             deepFreeze(event.data.message);
@@ -117,28 +120,12 @@ export function adoptSessionEvent(event) {
 export function snapshotSessionEvent(event) {
     return adoptSessionEvent(structuredClone(event));
 }
-/** Deep-freeze one acyclic JSON tree without consuming the JavaScript call stack. */
-function freezeRestoredObject(value) {
-    const pending = [value];
-    while (pending.length > 0) {
-        // The non-empty check proves an object remains to visit.
-        // oxlint-disable-next-line typescript/no-non-null-assertion
-        const current = pending.pop();
-        Object.freeze(current);
-        for (const key in current) {
-            const child = current[key];
-            if (child !== null && typeof child === 'object')
-                pending.push(child);
-        }
-    }
-    return value;
-}
 /** Validate the fixed event envelope after one-pass JSON materialization. */
 function assertSessionEventEnvelope(value, index) {
-    const event = value;
-    if (event['type'] === 'request/header-delta') {
-        throw new Error(`seed event at index ${index} uses unsupported legacy request/header-delta format`);
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`seed event at index ${index} has an invalid event envelope`);
     }
+    const event = value;
     for (const key in event) {
         switch (key) {
             case 'type':
@@ -163,9 +150,12 @@ function assertSessionEventEnvelope(value, index) {
         || (event['ignorable'] !== undefined && event['ignorable'] !== true)) {
         throw new Error(`seed event at index ${index} has an invalid event envelope`);
     }
+    validateSessionEventData(event, `seed ${type} at index ${index}`);
     switch (type) {
         case 'request/header':
+        case 'system/message':
         case 'user/message':
+        case 'assistant/attempt':
         case 'assistant/message':
         case 'tool/result':
             assertCurrentLlmShape(event, index);
@@ -179,11 +169,8 @@ function assertCurrentLlmShape(event, index) {
         ? data
         : undefined;
     if (event['type'] === 'request/header') {
-        const header = record?.['header'];
-        const headerRecord = typeof header === 'object' && header !== null && !Array.isArray(header)
-            ? header
-            : undefined;
-        const config = headerRecord?.['config'];
+        const headerRecord = record?.['header'];
+        const config = headerRecord['config'];
         if (!hasProviderModel(config))
             throw new Error(`seed request/header at index ${index} lacks provider/model`);
         const configRecord = config;
@@ -192,13 +179,36 @@ function assertCurrentLlmShape(event, index) {
             && (typeof reasoningEffort !== 'string' || reasoningEffort.length === 0)) {
             throw new Error(`seed request/header at index ${index} has an invalid reasoningEffort`);
         }
-        assertAdapterDefaults(headerRecord?.['adapterDefaults'], configRecord, index);
+        assertAdapterDefaults(headerRecord['adapterDefaults'], configRecord, index);
+        const reason = record?.['reason'];
+        if (reason !== 'initial' && reason !== 'resume' && reason !== 'change' && reason !== 'series') {
+            throw new Error(`seed request/header at index ${index} has an invalid reason`);
+        }
+        if (record?.['startsSeries'] !== undefined && record['startsSeries'] !== true) {
+            throw new Error(`seed request/header at index ${index} has an invalid startsSeries marker`);
+        }
     }
     const type = event['type'];
-    if (type !== 'user/message' && type !== 'assistant/message'
-        && type !== 'tool/result')
+    if (type === 'assistant/attempt') {
+        assertAssistantSettlementShape(record, type, index);
+        return;
+    }
+    if (!isMessageEventType(type))
         return;
     assertMessageEventShape(event, `seed ${type} at index ${index}`);
+    if (type === 'assistant/message') {
+        assertAssistantSettlementShape(record, type, index);
+    }
+}
+/** Validate fields used directly by restored Session lifecycle logic without replaying the embedded stream. */
+function assertAssistantSettlementShape(data, type, index) {
+    const turn = data?.['turn'];
+    const step = data?.['step'];
+    if (typeof turn !== 'number' || !Number.isSafeInteger(turn) || turn < 0 || Object.is(turn, -0)
+        || typeof step !== 'number' || !Number.isSafeInteger(step) || step < 0 || Object.is(step, -0)
+        || !Array.isArray(data?.['stream'])) {
+        throw new Error(`seed ${type} at index ${index} has invalid settlement fields`);
+    }
 }
 const allowedAdapterKeys = new Set(['reasoningEffort', 'maxTokens']);
 /** Validate adapter-default markers imported from a durable request header. */
@@ -216,11 +226,21 @@ function assertAdapterDefaults(value, config, index) {
         throw new Error(`seed request/header at index ${index} has invalid adapterDefaults`);
     }
 }
+/** The four surface event types whose payload carries an identified message. */
+function isMessageEventType(type) {
+    return type === 'system/message' || type === 'user/message'
+        || type === 'assistant/message' || type === 'tool/result';
+}
+const MESSAGE_ROLE_BY_TYPE = {
+    'system/message': 'system',
+    'user/message': 'user',
+    'assistant/message': 'assistant',
+    'tool/result': 'user',
+};
 /** Validate only the event-specific invariants needed to safely replay a message. */
 function assertMessageEventShape(event, subject) {
     const type = event['type'];
-    if (type !== 'user/message' && type !== 'assistant/message'
-        && type !== 'tool/result')
+    if (!isMessageEventType(type))
         return;
     const data = event['data'];
     const record = typeof data === 'object' && data !== null
@@ -233,7 +253,7 @@ function assertMessageEventShape(event, subject) {
         throw new Error(`${subject} lacks an identified message`);
     }
     const messageRecord = message;
-    const expectedRole = type === 'assistant/message' ? 'assistant' : 'user';
+    const expectedRole = MESSAGE_ROLE_BY_TYPE[type];
     if (messageRecord['role'] !== expectedRole) {
         throw new Error(`${subject} message must have role "${expectedRole}"`);
     }
@@ -247,6 +267,13 @@ function assertMessageEventShape(event, subject) {
         throw new Error(`${subject} message has invalid content`);
     }
     const sourceRecord = source;
+    if (type === 'system/message') {
+        if (sourceRecord['kind'] !== 'plugin' || typeof sourceRecord['plugin'] !== 'string'
+            || sourceRecord['plugin'] === '') {
+            throw new Error(`${subject} message must have plugin source`);
+        }
+        return;
+    }
     if (type === 'assistant/message') {
         if (sourceRecord['kind'] !== 'model' || !hasProviderModel(sourceRecord)) {
             throw new Error(`${subject} message must have model source`);
@@ -279,17 +306,6 @@ function hasProviderModel(value) {
     return typeof pair['provider'] === 'string' && pair['provider'].length > 0
         && typeof pair['model'] === 'string' && pair['model'].length > 0;
 }
-/** Reject request-header vocabulary removed with the legacy delta codec. */
-function assertSupportedRequestHeader(type, data, location) {
-    if (type === 'request/header-delta') {
-        throw new Error(`${location} uses unsupported legacy request/header-delta format`);
-    }
-    if (type === 'request/header'
-        && data !== null && typeof data === 'object' && !Array.isArray(data)
-        && data['reason'] === 'fallback') {
-        throw new Error(`${location} uses unsupported legacy request/header reason "fallback"`);
-    }
-}
 /** Resolve one listener snapshot, including Cordis's internal dispatch checks. */
 function collectSessionCallbacks(ctx, args) {
     return [...ctx.events.dispatch('emit', args)];
@@ -345,9 +361,10 @@ export class Session {
      * The first seq appended IN THIS PROCESS: the length of the constructor
      * seed (0 without one). Events with smaller seq values entered through
      * construction — replay, fork, or resume — and were never published on the
-     * `session/event` firehose (constructor seeds do not emit), so consumers
-     * that replay the log as a publication substitute (telemetry adoption)
-     * start here. Distinct from {@link inheritedEventCount}, the DURABLE
+     * `session/event` firehose (constructor seeds do not emit). This offset marks
+     * the constructor-input boundary for lifecycle ownership and persistence
+     * adoption; consumers that need complete canonical history still start at
+     * seq 0. Distinct from {@link inheritedEventCount}, the DURABLE
      * fork-lineage cut: a resumed session's constructor seed is its full stored
      * log, while the inherited count keeps the original fork value — this field is the
      * in-process construction fact.
@@ -377,22 +394,23 @@ export class Session {
         return new Session(id, seed, header, 'snapshot', inheritedEventCount);
     }
     /**
-     * Restore a detached session by taking ownership of fresh persistence values.
-     * The storage format, event envelopes, sequence continuity, surface transitions,
-     * and header fields are validated before the restored objects are frozen.
+     * Restore a detached session by adopting an independently owned or deeply frozen seed.
+     * Runtime-required event fields, event envelopes, sequence continuity, surface
+     * transitions, and header fields are validated without copying or freezing events.
+     * Embedded Assistant streams remain opaque until a stream consumer or storage
+     * verifier reads them.
      * @param id - restored session identity.
-     * @param seed - fresh detached events whose ownership is transferred.
-     * @param header - fresh detached metadata whose ownership is transferred.
+     * @param seed - independently owned or deeply frozen events.
+     * @param header - independently owned storage metadata.
      * @param inheritedEventCount - exact fork-inherited prefix length decoded from storage.
+     * @param eventState - aliasing state carried from the operation that produced the seed.
      * @returns a restored detached session.
      */
-    static fromRestore(id, seed, header, inheritedEventCount) {
-        return new Session(id, seed, header, 'restore', inheritedEventCount);
+    static fromRestore(id, seed, header, inheritedEventCount, eventState) {
+        return new Session(id, seed, header, eventState, inheritedEventCount);
     }
     constructor(id, seed, header, mode = 'snapshot', suppliedInheritedEventCount) {
-        const restoredHeader = mode === 'restore'
-            ? validateRestoredSessionHeader(id, header)
-            : undefined;
+        const restoredHeader = mode === 'snapshot' ? undefined : validateRestoredSessionHeader(id, header);
         if (seed !== undefined) {
             // Validate the seed to the SAME invariants `append` enforces, so a
             // replay/fork (`ctx.sessions.create(id, { seed })`) cannot construct a
@@ -404,12 +422,11 @@ export class Session {
             for (const [index, source] of seed.entries()) {
                 // The seed is a persistence/replay boundary: validate and detach the
                 // complete event in one lossless-JSON pass.
-                const snapshot = mode === 'restore' ? source : snapshotJsonValue(source);
+                const snapshot = mode === 'snapshot' ? snapshotJsonValue(source) : source;
                 if (snapshot === undefined) {
                     throw new Error(`seed event at index ${index} is not losslessly JSON-serializable`);
                 }
                 assertSessionEventEnvelope(snapshot, index);
-                assertSupportedRequestHeader(snapshot.type, snapshot.data, `seed event at index ${index}`);
                 if (snapshot.seq !== index) {
                     throw new Error(`seed event at index ${index} has seq ${snapshot.seq} (expected ${index}); seed must be contiguous from 0`);
                 }
@@ -422,7 +439,7 @@ export class Session {
                 catch (error) {
                     throw new Error(`invalid seed event at index ${index}: ${error instanceof Error ? error.message : 'invalid surface metadata'}`);
                 }
-                this.log.push(mode === 'restore' ? freezeRestoredObject(snapshot) : deepFreeze(snapshot));
+                this.log.push(mode === 'snapshot' ? deepFreeze(snapshot) : snapshot);
             }
         }
         this.firstLiveSeq = SessionLogOffset(this.log.length);
@@ -440,12 +457,17 @@ export class Session {
         if (inheritedEventCount > this.log.length) {
             throw new Error('session inherited event count exceeds its event log');
         }
+        if (mode === 'snapshot' && this.header.isSeeded && inheritedEventCount !== this.log.length) {
+            throw new Error('seeded session constructor seed must equal its inherited prefix');
+        }
         this.inheritedEventCount = inheritedEventCount;
-        // Appended here so the marker is already in `events` when a backend
-        // captures the creation seed: no load-time write. Re-marking is skipped
-        // because a cold session is resumed on first touch, so repeatedly opening
-        // one must not grow its log per open.
-        if (seed !== undefined && this.log.at(-1)?.type !== 'session/end-seed') {
+        // A fresh seeded child always owns one tagged marker at its inherited cut,
+        // even when the copied prefix already ends in an ancestor marker. Restore
+        // retains that durable marker and appends only the ordinary resume marker.
+        if (seed !== undefined && mode === 'snapshot' && this.header.isSeeded) {
+            this.append('session/end-seed', { inherited: true });
+        }
+        else if (seed !== undefined && this.log.at(-1)?.type !== 'session/end-seed') {
             this.append('session/end-seed', {});
         }
     }
@@ -510,7 +532,8 @@ export class Session {
      *   declare how it joins the surface, the sole source of derived model
      *   history) and
      *   rejected by the compiler for non-surface types like `turn/start` or
-     *   `assistant/chunk`.
+     *   `assistant/attempt`. Assistant messages embed their exact provider
+     *   stream and cannot cite top-level source events.
      * @returns the logged event — its assigned `seq`/`time` plus the SNAPSHOT of
      *   `data` that entered the log, so reading `event.data` back sees the logged
      *   value, never the caller's still-mutable input.
@@ -518,6 +541,7 @@ export class Session {
      *   (BigInt, function, symbol, undefined, negative zero, non-finite number,
      *   circular reference, sparse array, or an exotic object such as
      *   Map/Set/Date/class instance), or when the candidate violates the
+     *   request-header empty-field or tool-error consistency rules, or the
      *   canonical surface contract (marker shape and eligibility, unique
      *   earlier source-event references, positional replacement validity, and complete
      *   shadowed-node coverage). One iterative pass reads, validates, and
@@ -538,7 +562,6 @@ export class Session {
         if (dataSnapshot === undefined) {
             throw new Error(`session event "${type}" carries non-JSON-serializable data`);
         }
-        assertSupportedRequestHeader(type, dataSnapshot, `session event "${type}"`);
         const surfaceMetadataSnapshot = snapshotJsonValue(surfaceMetadata);
         if (surfaceMetadataSnapshot === undefined) {
             throw new Error(`session event "${type}" carries non-JSON-serializable surface metadata`);
@@ -554,6 +577,7 @@ export class Session {
             data: dataSnapshot,
             ...surfaceMetadataSnapshot,
         });
+        validateSessionEventData(event, `session event "${type}" at seq ${event.seq}`);
         this.surfaceManager.validateNext(event);
         if (entry !== undefined)
             entry.appending = true;
@@ -688,8 +712,9 @@ export class SessionForkError extends Error {
 /**
  * In-memory session store (`ctx.sessions`).
  *
- * Persistence is intentionally not implemented here — persistence plugins
- * subscribe to `session/event` and flush on `session/flush` / dispose.
+ * Persistence is intentionally not implemented here — the agent lifecycle
+ * attaches a session-log writer to each published session's write handle;
+ * a session published outside that lifecycle persists nothing.
  */
 export class SessionStore extends Service {
     store = new Map();
@@ -750,10 +775,9 @@ export class SessionStore extends Service {
      *
      * @param id - the session id; omitted, the store mints `session-<n>`.
      * @param options - seed events and/or creation metadata for the header. With
-     *   `seedSource: 'persistence'`, metadata and events must be fresh detached
-     *   graphs whose ownership transfers to this call: they are validated and
-     *   frozen in place through {@link Session.fromRestore}, so the caller must
-     *   retain no mutable aliases.
+     *   `eventState`, every seed event is either independently owned or any
+     *   shared value is deeply frozen; {@link Session.fromRestore} validates and
+     *   adopts those values without copying or freezing them.
      * @returns the constructed session, NOT yet in the store.
      * @throws if a session with `id` already exists, metadata is not a plain
      *   lossless-JSON record with valid scalar fields, or `meta.cwd` is a
@@ -771,8 +795,18 @@ export class SessionStore extends Service {
         }
         if (this.store.has(sessionId))
             throw new Error(`session "${sessionId}" already exists`);
-        if (options?.seedSource === 'persistence') {
-            return Session.fromRestore(sessionId, options.seed, options.meta, options.inheritedEventCount);
+        if (options !== undefined) {
+            const { eventState } = options;
+            switch (eventState) {
+                case 'detached':
+                case 'shared-frozen':
+                    return Session.fromRestore(sessionId, options.seed, options.meta, options.inheritedEventCount, eventState);
+                case undefined:
+                    break;
+                /* v8 ignore next -- closed-union exhaustiveness guard */
+                default:
+                    assertNever(eventState, 'SessionStore.prepare event state');
+            }
         }
         const seed = options?.seed;
         const meta = options?.meta;

package/lib/types/invariant.js

@@ -72,8 +72,8 @@ function validateEvent(trace, event, fail) {
             nextStep += 1;
             break;
         }
-        case 'assistant/chunk': {
-            requireOpenStep(trace, 'assistant/chunk', event.data.turn, event.data.step, fail);
+        case 'assistant/attempt': {
+            requireOpenStep(trace, 'assistant/attempt', event.data.turn, event.data.step, fail);
             break;
         }
         case 'assistant/message': {
@@ -103,6 +103,10 @@ function validateEvent(trace, event, fail) {
             pendingCalls = { kind: 'delete', callId };
             break;
         }
+        case 'system/message': {
+            requireOpenStep(trace, 'system/message', event.data.turn, event.data.step, fail);
+            break;
+        }
         case 'user/message':
             break;
         case 'session/end-seed':

package/lib/types/known-event-types.js

@@ -24,7 +24,7 @@ export const KNOWN_SESSION_EVENT_TYPES = new Set([
     'approval/asked',
     'approval/decided',
     'approval/policy',
-    'assistant/chunk',
+    'assistant/attempt',
     'assistant/message',
     'command/done',
     'command/run',
@@ -32,6 +32,8 @@ export const KNOWN_SESSION_EVENT_TYPES = new Set([
     'compaction/prune',
     'compaction/start',
     'compaction/summary',
+    'feedback/message-delete',
+    'feedback/message-put',
     'feedback/record',
     'goal/change',
     'hook/invoked',
@@ -53,6 +55,7 @@ export const KNOWN_SESSION_EVENT_TYPES = new Set([
     'step/start',
     'subagent/descriptor',
     'subagent/model-selection-policy',
+    'system/message',
     'team/member',
     'team/message/delivered',
     'team/message/queued',
@@ -63,8 +66,8 @@ export const KNOWN_SESSION_EVENT_TYPES = new Set([
     'tool-workflow/run-end',
     'tool-workflow/run-start',
     'tool/call',
-    'tool/code-dispatch',
-    'tool/code-dispatch-start',
+    'tool/ptc-dispatch',
+    'tool/ptc-dispatch-start',
     'tool/result',
     'turn/end',
     'turn/start',

package/lib/types/request-header.d.ts

@@ -8,9 +8,9 @@
  */
 import type { EpochHeader, SessionEvent } from './types.ts';
 /**
- * Normalize a header to canonical form: an empty system prompt and empty tool
- * list become absent fields, matching how requests are built. Logging, folding,
- * and comparison use this one representation.
+ * Normalize a header to canonical form: an empty tool list becomes an absent
+ * field, matching how requests are built. Logging, folding, and comparison use
+ * this one representation.
  * @param header - the header to normalize (not mutated).
  * @returns the canonical header.
  */
@@ -19,7 +19,7 @@ export declare function canonicalHeader(header: EpochHeader): EpochHeader;
  * Field-wise equality over canonical headers. Tool schemas compare in order.
  * @param a - one canonical header.
  * @param b - the other.
- * @returns whether config, system, and tools all match.
+ * @returns whether config, adapter defaults, and tools all match.
  */
 export declare function headerEquals(a: EpochHeader, b: EpochHeader): boolean;
 /**

package/lib/types/request-header.js

@@ -8,9 +8,9 @@
  */
 import { callConfigEquals } from '@deepseek-ai/dsh-llm';
 /**
- * Normalize a header to canonical form: an empty system prompt and empty tool
- * list become absent fields, matching how requests are built. Logging, folding,
- * and comparison use this one representation.
+ * Normalize a header to canonical form: an empty tool list becomes an absent
+ * field, matching how requests are built. Logging, folding, and comparison use
+ * this one representation.
  * @param header - the header to normalize (not mutated).
  * @returns the canonical header.
  */
@@ -21,7 +21,6 @@ export function canonicalHeader(header) {
         ...adapterDefaults?.reasoningEffort === true || adapterDefaults?.maxTokens === true
             ? { adapterDefaults }
             : {},
-        ...header.system !== undefined && header.system.length > 0 ? { system: header.system } : {},
         ...header.tools !== undefined && header.tools.length > 0 ? { tools: header.tools } : {},
     };
 }
@@ -33,13 +32,12 @@ function sameSchema(a, b) {
  * Field-wise equality over canonical headers. Tool schemas compare in order.
  * @param a - one canonical header.
  * @param b - the other.
- * @returns whether config, system, and tools all match.
+ * @returns whether config, adapter defaults, and tools all match.
  */
 export function headerEquals(a, b) {
     if (!callConfigEquals(a.config, b.config)
         || a.adapterDefaults?.reasoningEffort !== b.adapterDefaults?.reasoningEffort
-        || a.adapterDefaults?.maxTokens !== b.adapterDefaults?.maxTokens
-        || a.system !== b.system)
+        || a.adapterDefaults?.maxTokens !== b.adapterDefaults?.maxTokens)
         return false;
     const at = a.tools ?? [];
     const bt = b.tools ?? [];