@elpapi42/pi-fleet 0.1.0-beta.10 → 0.1.0-beta.13

package/dist/runtime.mjs

@@ -5,8 +5,191 @@ var __export = (target, all) => {
 };
 
 // src/entry/runtime.ts
+import { existsSync, readdirSync as readdirSync2, statSync } from "node:fs";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 import { pathToFileURL } from "node:url";
 
+// src/runtime/receive-pager.ts
+var ReceiveBoundaryError = class extends Error {
+  constructor(code) {
+    super("Receive cursor cannot be used.");
+    this.code = code;
+    this.name = "ReceiveBoundaryError";
+  }
+};
+var OpaqueReceiveCursorCodec = class {
+  version = 1;
+  encode(boundary) {
+    assertPosition(boundary.position);
+    assertPosition(boundary.epoch);
+    const payload = {
+      v: this.version,
+      a: boundary.agentId,
+      e: boundary.epoch,
+      p: boundary.position,
+      ...boundary.kind === "continuation" ? { k: "continuation" } : {}
+    };
+    return Buffer.from(JSON.stringify(payload)).toString("base64url");
+  }
+  decode(cursor) {
+    let value;
+    try {
+      value = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+    } catch {
+      throw new ReceiveBoundaryError("cursor_invalid");
+    }
+    if (!isCursorPayload(value)) throw new ReceiveBoundaryError("cursor_invalid");
+    return {
+      agentId: value.a,
+      epoch: value.e,
+      position: value.p,
+      kind: value.k === "continuation" ? "continuation" : "position"
+    };
+  }
+};
+var ReceiveObservationUncertainError = class extends Error {
+  constructor(lastSafeCursor, continuationCursor) {
+    super("Receive observation continuity is uncertain");
+    this.lastSafeCursor = lastSafeCursor;
+    this.continuationCursor = continuationCursor;
+    this.name = "ReceiveObservationUncertainError";
+  }
+  code = "observation_uncertain";
+};
+var ReceivePager = class {
+  constructor(store, cursors, wakeup, limits, activity = {}) {
+    this.store = store;
+    this.cursors = cursors;
+    this.wakeup = wakeup;
+    this.limits = limits;
+    this.activity = activity;
+    assertPositiveInteger(limits.maxRows, "Receive replay row limit");
+    assertPositiveInteger(limits.maxBytes, "Receive replay byte limit");
+    assertPositiveInteger(limits.maxEventBytes, "Receive semantic event limit");
+  }
+  async open(agentId, start, signal) {
+    throwIfAborted(signal);
+    const snapshot = await this.store.openReceive(agentId);
+    if (snapshot === null) throw codedError("agent_not_found", "Agent generation was not found");
+    const boundary = this.#boundary(snapshot, start);
+    const initialCursor = this.cursors.encode(boundary);
+    return {
+      cursor: initialCursor,
+      [Symbol.asyncIterator]: () => this.#events(agentId, boundary.epoch, boundary.position, signal)
+    };
+  }
+  #boundary(snapshot, start) {
+    const latest = snapshot.epochs.at(-1);
+    if (latest === void 0) throw codedError("state_corrupt", "Agent has no continuity epoch");
+    if (start.kind === "live") {
+      return {
+        agentId: snapshot.agent.agentId,
+        epoch: latest.epoch,
+        position: snapshot.highWater.eventPosition
+      };
+    }
+    if (start.kind === "start") {
+      return {
+        agentId: snapshot.agent.agentId,
+        epoch: snapshot.epochs[0]?.epoch ?? latest.epoch,
+        position: 0
+      };
+    }
+    const decoded = this.cursors.decode(start.cursor);
+    if (decoded.agentId !== snapshot.agent.agentId) {
+      throw new ReceiveBoundaryError("cursor_wrong_agent");
+    }
+    const epochIndex = snapshot.epochs.findIndex((epoch) => epoch.epoch === decoded.epoch);
+    if (epochIndex < 0) throw new ReceiveBoundaryError("cursor_expired");
+    if (decoded.position > snapshot.highWater.eventPosition) {
+      throw new ReceiveBoundaryError("cursor_invalid");
+    }
+    const selectedEpoch = snapshot.epochs[epochIndex];
+    if (selectedEpoch.state === "closed" && decoded.kind === "position" && decoded.position > selectedEpoch.lastSafeEventPosition) {
+      throw new ReceiveBoundaryError("cursor_invalid");
+    }
+    if (decoded.kind === "continuation") {
+      const previous = snapshot.epochs[epochIndex - 1];
+      if (previous === void 0 || previous.state !== "closed" || previous.reason !== "observation_uncertain" || previous.lastSafeEventPosition !== decoded.position) {
+        throw new ReceiveBoundaryError("cursor_invalid");
+      }
+    }
+    return decoded;
+  }
+  async *#events(agentId, initialEpoch, initialPosition, signal) {
+    let epoch = initialEpoch;
+    let position = initialPosition;
+    while (true) {
+      throwIfAborted(signal);
+      this.activity.onReadStart?.();
+      const page = await this.store.readEvents({
+        agentId,
+        epoch,
+        afterPosition: position,
+        limit: this.limits.maxRows,
+        maxBytes: this.limits.maxBytes,
+        maxEventBytes: this.limits.maxEventBytes
+      }).finally(() => this.activity.onReadEnd?.());
+      if (page.length > 0) {
+        for (const stored of page) {
+          const cursor = this.cursors.encode({
+            agentId,
+            epoch: stored.event.epoch,
+            position: stored.position
+          });
+          position = stored.position;
+          yield { ...stored.event, cursor };
+        }
+        continue;
+      }
+      const snapshot = await this.store.openReceive(agentId);
+      if (snapshot === null) throw codedError("agent_destroyed", "Agent was destroyed");
+      const epochIndex = snapshot.epochs.findIndex((candidate) => candidate.epoch === epoch);
+      if (epochIndex < 0) throw new ReceiveBoundaryError("cursor_expired");
+      const current = snapshot.epochs[epochIndex];
+      const next = snapshot.epochs[epochIndex + 1];
+      if (current.state === "closed" && position >= current.lastSafeEventPosition) {
+        if (current.reason === "observation_uncertain") {
+          const lastSafeCursor = this.cursors.encode({
+            agentId,
+            epoch: current.epoch,
+            position: current.lastSafeEventPosition
+          });
+          const continuationCursor = next === void 0 ? null : this.cursors.encode({
+            agentId,
+            epoch: next.epoch,
+            position: current.lastSafeEventPosition,
+            kind: "continuation"
+          });
+          throw new ReceiveObservationUncertainError(lastSafeCursor, continuationCursor);
+        }
+        if (next !== void 0) {
+          epoch = next.epoch;
+          continue;
+        }
+      }
+      await this.wakeup.waitForEvents(agentId, position, signal);
+    }
+  }
+};
+function codedError(code, message) {
+  return Object.assign(new Error(message), { code });
+}
+function isCursorPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const payload = value;
+  return payload.v === 1 && (payload.k === void 0 || payload.k === "continuation") && typeof payload.a === "string" && payload.a.length > 0 && Number.isSafeInteger(payload.e) && (payload.e ?? -1) >= 0 && Number.isSafeInteger(payload.p) && (payload.p ?? -1) >= 0;
+}
+function assertPosition(value, label = "Receive cursor position") {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be non-negative`);
+}
+function assertPositiveInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be positive`);
+}
+function throwIfAborted(signal) {
+  if (signal.aborted) throw signal.reason ?? new Error("Receive cancelled");
+}
+
 // node_modules/@sinclair/typebox/build/esm/type/guard/value.mjs
 var value_exports = {};
 __export(value_exports, {
@@ -1056,7 +1239,7 @@ function Literal(value, options) {
 }
 
 // node_modules/@sinclair/typebox/build/esm/type/boolean/boolean.mjs
-function Boolean(options) {
+function Boolean2(options) {
   return CreateType({ [Kind]: "Boolean", type: "boolean" }, options);
 }
 
@@ -1078,7 +1261,7 @@ function String2(options) {
 // node_modules/@sinclair/typebox/build/esm/type/template-literal/syntax.mjs
 function* FromUnion(syntax) {
   const trim = syntax.trim().replace(/"|'/g, "");
-  return trim === "boolean" ? yield Boolean() : trim === "number" ? yield Number2() : trim === "bigint" ? yield BigInt2() : trim === "string" ? yield String2() : yield (() => {
+  return trim === "boolean" ? yield Boolean2() : trim === "number" ? yield Number2() : trim === "bigint" ? yield BigInt2() : trim === "string" ? yield String2() : yield (() => {
     const literals = trim.split("|").map((literal) => Literal(literal.trim()));
     return literals.length === 0 ? Never() : literals.length === 1 ? literals[0] : UnionEvaluated(literals);
   })();
@@ -2694,7 +2877,7 @@ __export(type_exports3, {
   AsyncIterator: () => AsyncIterator,
   Awaited: () => Awaited,
   BigInt: () => BigInt2,
-  Boolean: () => Boolean,
+  Boolean: () => Boolean2,
   Capitalize: () => Capitalize,
   Composite: () => Composite,
   Const: () => Const,
@@ -2808,6 +2991,16 @@ var ExternalPiResolutionError = class extends Error {
     this.name = "ExternalPiResolutionError";
   }
 };
+function installationIdentity(installation) {
+  return {
+    mode: "external",
+    selectedPath: installation.selectedPath,
+    nodePath: installation.nodePath,
+    realPath: installation.realPath,
+    version: installation.version,
+    fingerprint: installation.fingerprint
+  };
+}
 async function resolveExternalPiInstallation(options = {}) {
   const env = options.env ?? process.env;
   const selectedPath = await resolveSelectedPath(env);
@@ -3058,10 +3251,10 @@ async function waitForProcessGroupExit(processGroupId, timeoutMs = 1e3) {
 }
 function readLinuxProcess(pid) {
   try {
-    const stat2 = readFileSync(`/proc/${String(pid)}/stat`, "utf8");
-    const commandEnd = stat2.lastIndexOf(")");
+    const stat3 = readFileSync(`/proc/${String(pid)}/stat`, "utf8");
+    const commandEnd = stat3.lastIndexOf(")");
     if (commandEnd < 0) return void 0;
-    const fields = stat2.slice(commandEnd + 2).trim().split(/\s+/);
+    const fields = stat3.slice(commandEnd + 2).trim().split(/\s+/);
     const state = fields[0];
     const processGroupId = Number(fields[2]);
     if (state === void 0 || !Number.isSafeInteger(processGroupId)) return void 0;
@@ -3091,8 +3284,76 @@ async function waitUntilGone(isAlive, timeoutMs) {
   return !isAlive();
 }
 
+// src/pi/rpc-record-framer.ts
+var RpcPartialRecordLimitError = class extends Error {
+  constructor(pendingBytes, limitBytes) {
+    super(`Pi RPC unterminated record exceeded ${String(limitBytes)} bytes`);
+    this.pendingBytes = pendingBytes;
+    this.limitBytes = limitBytes;
+    this.name = "RpcPartialRecordLimitError";
+  }
+};
+var RpcRecordFramer = class {
+  constructor(maxPartialRecordBytes) {
+    this.maxPartialRecordBytes = maxPartialRecordBytes;
+    if (!Number.isSafeInteger(maxPartialRecordBytes) || maxPartialRecordBytes <= 0) {
+      throw new Error("maxPartialRecordBytes must be a positive safe integer");
+    }
+  }
+  #segments = [];
+  #pendingBytes = 0;
+  #failed = false;
+  get pendingBytes() {
+    return this.#pendingBytes;
+  }
+  push(chunk) {
+    if (this.#failed) throw new Error("Pi RPC record framer has failed");
+    if (chunk.length === 0) return [];
+    const records = [];
+    let offset = 0;
+    while (offset < chunk.length) {
+      const newline = chunk.indexOf(10, offset);
+      if (newline === -1) {
+        this.#appendPartial(chunk.subarray(offset));
+        break;
+      }
+      const finalSegment = chunk.subarray(offset, newline + 1);
+      if (this.#pendingBytes === 0) {
+        records.push(Buffer.from(finalSegment));
+      } else {
+        this.#segments.push(finalSegment);
+        this.#pendingBytes += finalSegment.length;
+        records.push(Buffer.concat(this.#segments, this.#pendingBytes));
+        this.#segments.length = 0;
+        this.#pendingBytes = 0;
+      }
+      offset = newline + 1;
+    }
+    return records;
+  }
+  /** Returns, but never promotes, an interrupted trailing fragment. */
+  finish() {
+    if (this.#pendingBytes === 0) return null;
+    const trailing = Buffer.concat(this.#segments, this.#pendingBytes);
+    this.#segments.length = 0;
+    this.#pendingBytes = 0;
+    return trailing;
+  }
+  #appendPartial(segment) {
+    if (segment.length === 0) return;
+    const nextBytes = this.#pendingBytes + segment.length;
+    if (nextBytes > this.maxPartialRecordBytes) {
+      this.#failed = true;
+      throw new RpcPartialRecordLimitError(nextBytes, this.maxPartialRecordBytes);
+    }
+    this.#segments.push(Buffer.from(segment));
+    this.#pendingBytes = nextBytes;
+  }
+};
+
 // src/pi/process.ts
 var DEFAULT_MAX_STDOUT_FRAME_BYTES = 8 * 1024 * 1024;
+var DEFAULT_MAX_PARTIAL_RECORD_BYTES = 64 * 1024 * 1024;
 var PiRpcRejectedError = class extends Error {
   constructor(message) {
     super(message);
@@ -3106,6 +3367,13 @@ var PiCompactionError = class extends Error {
     this.name = "PiCompactionError";
   }
 };
+var PiResponseCommitDelayError = class extends Error {
+  code = "storage_unavailable";
+  constructor() {
+    super("Pi responded, but pi-fleet could not durably commit the response in time");
+    this.name = "PiResponseCommitDelayError";
+  }
+};
 var PiCleanupUncertainError = class extends Error {
   constructor(pid, startupError, cleanupError) {
     super(`Pi process group ${String(pid)} could not be cleaned up after startup failed`);
@@ -3115,23 +3383,57 @@ var PiCleanupUncertainError = class extends Error {
     this.name = "PiCleanupUncertainError";
   }
 };
+var PiResponseAdmission = class {
+  #state = "awaiting_response";
+  get state() {
+    return this.#state;
+  }
+  admit() {
+    if (this.#state !== "awaiting_response") {
+      throw new Error(`Cannot admit response while ${this.#state}`);
+    }
+    this.#state = "admitted_pending_commit";
+  }
+  commit() {
+    if (this.#state !== "admitted_pending_commit") {
+      throw new Error(`Cannot commit response while ${this.#state}`);
+    }
+    this.#state = "committed";
+  }
+  fail() {
+    if (this.#state === "committed") {
+      throw new Error("Cannot fail a committed response");
+    }
+    this.#state = "failed";
+  }
+};
 var PiProcess = class _PiProcess {
   #child;
   #responses = /* @__PURE__ */ new Map();
   #listeners = /* @__PURE__ */ new Set();
   #exitListeners = /* @__PURE__ */ new Set();
-  #stdoutBuffer = Buffer.alloc(0);
+  #stdoutFramer;
   #stderr = "";
   #stopping = false;
   #handledExit = false;
   #exitHandled;
   #resolveExitHandled = () => void 0;
   #maxStdoutFrameBytes;
+  #onStdoutRecord;
+  #stdoutLane = Promise.resolve();
+  #stdoutFailure = null;
   constructor(options) {
-    this.#exitHandled = new Promise((resolve2) => {
-      this.#resolveExitHandled = resolve2;
+    this.#exitHandled = new Promise((resolve3) => {
+      this.#resolveExitHandled = resolve3;
     });
     this.#maxStdoutFrameBytes = options.maxStdoutFrameBytes ?? DEFAULT_MAX_STDOUT_FRAME_BYTES;
+    this.#stdoutFramer = new RpcRecordFramer(
+      options.maxPartialRecordBytes ?? DEFAULT_MAX_PARTIAL_RECORD_BYTES
+    );
+    this.#onStdoutRecord = async (record) => {
+      if (options.onStdoutRecord !== void 0) await options.onStdoutRecord(record);
+      else options.onStdoutBytes?.(record);
+    };
     this.#child = spawn2(
       options.executable,
       [...options.argvPrefix ?? [], "--mode", "rpc", ...options.piArgv],
@@ -3144,14 +3446,18 @@ var PiProcess = class _PiProcess {
     );
     this.#child.stderr.setEncoding("utf8");
     this.#child.stdout.on("data", (chunk) => {
-      options.onStdoutBytes?.(chunk);
-      this.#consumeStdout(chunk);
+      this.#child.stdout.pause();
+      this.#stdoutLane = this.#stdoutLane.then(() => this.#consumeStdout(chunk)).catch((error) => this.#failStdout(error)).finally(() => {
+        if (this.#child.exitCode === null && this.#stdoutFailure === null) {
+          this.#child.stdout.resume();
+        }
+      });
     });
     this.#child.stderr.on("data", (chunk) => {
       this.#stderr = `${this.#stderr}${chunk}`.slice(-65536);
     });
-    this.#child.once("exit", (code, signal) => this.#handleExit(code, signal));
-    this.#child.once("error", (error) => this.#handleExit(null, null, error));
+    this.#child.once("exit", (code, signal) => void this.#handleExit(code, signal));
+    this.#child.once("error", (error) => void this.#handleExit(null, null, error));
   }
   static async start(options) {
     const process2 = new _PiProcess(options);
@@ -3190,6 +3496,9 @@ var PiProcess = class _PiProcess {
   async prompt(message) {
     await this.request({ type: "prompt", message, streamingBehavior: "steer" });
   }
+  async followUp(message) {
+    await this.request({ type: "follow_up", message });
+  }
   async compact() {
     let frame;
     try {
@@ -3216,12 +3525,23 @@ var PiProcess = class _PiProcess {
   async request(command, timeoutMs = 15e3) {
     if (this.#child.exitCode !== null) throw new Error("Pi process is not running");
     const id = randomUUID();
+    const admission = new PiResponseAdmission();
     const response = new Promise((resolveResponse, rejectResponse) => {
       const timer = setTimeout(() => {
+        if (admission.state === "admitted_pending_commit") {
+          this.#failStdout(new PiResponseCommitDelayError());
+          return;
+        }
         this.#responses.delete(id);
+        admission.fail();
         rejectResponse(new Error("Pi RPC request timed out"));
       }, timeoutMs);
-      this.#responses.set(id, { resolve: resolveResponse, reject: rejectResponse, timer });
+      this.#responses.set(id, {
+        resolve: resolveResponse,
+        reject: rejectResponse,
+        timer,
+        admission
+      });
     });
     try {
       await this.#write({ ...command, id });
@@ -3230,6 +3550,7 @@ var PiProcess = class _PiProcess {
       if (waiter !== void 0) {
         clearTimeout(waiter.timer);
         this.#responses.delete(id);
+        waiter.admission.fail();
         waiter.reject(error instanceof Error ? error : new Error("Pi RPC write failed"));
       }
     }
@@ -3266,55 +3587,68 @@ var PiProcess = class _PiProcess {
 `)) return;
     await once(this.#child.stdin, "drain");
   }
-  #consumeStdout(chunk) {
-    this.#stdoutBuffer = Buffer.concat([this.#stdoutBuffer, chunk]);
-    while (true) {
-      const newline = this.#stdoutBuffer.indexOf(10);
-      if (newline < 0) {
-        if (this.#stdoutBuffer.length > this.#maxStdoutFrameBytes) {
-          signalProcessTree(this.pid, "SIGTERM");
-        }
-        return;
-      }
-      if (newline > this.#maxStdoutFrameBytes) {
-        signalProcessTree(this.pid, "SIGTERM");
-        return;
+  async #consumeStdout(chunk) {
+    for (const record of this.#stdoutFramer.push(chunk)) {
+      const commit = this.#onStdoutRecord(record);
+      if (record.length - 1 > this.#maxStdoutFrameBytes) {
+        await commit;
+        throw new Error("Pi RPC record exceeds the configured parser limit");
       }
-      let lineBytes = this.#stdoutBuffer.subarray(0, newline);
-      this.#stdoutBuffer = this.#stdoutBuffer.subarray(newline + 1);
+      let lineBytes = record.subarray(0, record.length - 1);
       if (lineBytes.at(-1) === 13) lineBytes = lineBytes.subarray(0, -1);
-      if (lineBytes.length === 0) continue;
-      let frame;
-      try {
-        const line = new TextDecoder("utf-8", { fatal: true }).decode(lineBytes);
-        frame = JSON.parse(line);
-      } catch {
-        signalProcessTree(this.pid, "SIGTERM");
-        return;
+      let frame = null;
+      if (lineBytes.length > 0) {
+        try {
+          const line = new TextDecoder("utf-8", { fatal: true }).decode(lineBytes);
+          frame = JSON.parse(line);
+        } catch {
+          await commit;
+          throw new Error("Pi emitted a malformed RPC record");
+        }
+      }
+      const waiter = frame?.type === "response" && typeof frame.id === "string" ? this.#responses.get(frame.id) : void 0;
+      if (waiter !== void 0) waiter.admission.admit();
+      await commit;
+      if (waiter !== void 0) {
+        if (waiter.admission.state !== "admitted_pending_commit") continue;
+        waiter.admission.commit();
+        clearTimeout(waiter.timer);
+        this.#responses.delete(frame.id);
+        waiter.resolve(frame);
       }
+      if (frame === null) continue;
       if (frame.type === "extension_ui_request" && typeof frame.id === "string" && ["select", "confirm", "input", "editor"].includes(String(frame.method))) {
         void this.#write({ type: "extension_ui_response", id: frame.id, cancelled: true }).catch(
           () => void 0
         );
       }
-      if (frame.type === "response" && frame.id !== void 0) {
-        const waiter = this.#responses.get(frame.id);
-        if (waiter !== void 0) {
-          clearTimeout(waiter.timer);
-          this.#responses.delete(frame.id);
-          waiter.resolve(frame);
-        }
-      }
       for (const listener of this.#listeners) listener(frame);
     }
   }
-  #handleExit(code, signal, cause) {
+  async drainStdout() {
+    await this.#stdoutLane;
+  }
+  #failStdout(error) {
+    if (this.#stdoutFailure !== null) return;
+    this.#stdoutFailure = error instanceof Error ? error : new Error("Pi stdout persistence failed");
+    for (const waiter of this.#responses.values()) {
+      clearTimeout(waiter.timer);
+      if (waiter.admission.state !== "committed") waiter.admission.fail();
+      waiter.reject(this.#stdoutFailure);
+    }
+    this.#responses.clear();
+    signalProcessTree(this.pid, "SIGTERM");
+  }
+  async #handleExit(code, signal, cause) {
     if (this.#handledExit) return;
     this.#handledExit = true;
-    const error = this.#stopping && (code === 0 || signal === "SIGTERM") ? null : cause ?? new Error(`Pi exited unexpectedly (code=${String(code)}, signal=${String(signal)})`);
+    await this.#stdoutLane.catch(() => void 0);
+    const trailingPartial = this.#stdoutFramer.finish();
+    const error = this.#stdoutFailure ?? (trailingPartial !== null ? new Error("Pi exited with an unterminated RPC record") : this.#stopping && (code === 0 || signal === "SIGTERM") ? null : cause ?? new Error(`Pi exited unexpectedly (code=${String(code)}, signal=${String(signal)})`));
     try {
       for (const waiter of this.#responses.values()) {
         clearTimeout(waiter.timer);
+        if (waiter.admission.state !== "committed") waiter.admission.fail();
         waiter.reject(error ?? new Error("Pi stopped before responding"));
       }
       this.#responses.clear();
@@ -3342,7 +3676,7 @@ var RealPiLauncher = class {
   preflight() {
     return this.options.preflight?.() ?? Promise.resolve();
   }
-  async start(profile, restore, onSpawn, onStdoutBytes) {
+  async start(profile, restore, onSpawn, onStdoutRecord) {
     const piArgv = restore ? profile.restorePiArgv : profile.userPiArgv;
     if (piArgv === null) throw new Error("Agent has no observed Pi session to restore");
     const process2 = await PiProcess.start({
@@ -3352,8 +3686,9 @@ var RealPiLauncher = class {
       cwd: profile.cwd,
       ...this.options.env === void 0 ? {} : { env: this.options.env },
       ...this.options.maxStdoutFrameBytes === void 0 ? {} : { maxStdoutFrameBytes: this.options.maxStdoutFrameBytes },
+      ...this.options.maxPartialRecordBytes === void 0 ? {} : { maxPartialRecordBytes: this.options.maxPartialRecordBytes },
       ...onSpawn === void 0 ? {} : { onSpawn },
-      ...onStdoutBytes === void 0 ? {} : { onStdoutBytes }
+      ...onStdoutRecord === void 0 ? {} : { onStdoutRecord }
     });
     this.options.onStart?.(process2.pid);
     return process2;
@@ -3361,7 +3696,7 @@ var RealPiLauncher = class {
 };
 
 // src/pi/external-target.ts
-async function createExternalPiTarget(env, maxStdoutFrameBytes) {
+async function createExternalPiTarget(env, maxStdoutFrameBytes, maxPartialRecordBytes) {
   const selectedPath = env.PIFLEET_PI_EXECUTABLE;
   const nodePath = env.PIFLEET_PI_NODE;
   if (selectedPath === void 0 || nodePath === void 0) {
@@ -3386,6 +3721,7 @@ async function createExternalPiTarget(env, maxStdoutFrameBytes) {
     artifactId: "external-pi",
     env: externalPiExecutionEnvironment(env, initial.selectedPath, initial.nodePath),
     ...maxStdoutFrameBytes === void 0 ? {} : { maxStdoutFrameBytes },
+    ...maxPartialRecordBytes === void 0 ? {} : { maxPartialRecordBytes },
     preflight: async () => {
       let current;
       try {
@@ -3403,16 +3739,6 @@ async function createExternalPiTarget(env, maxStdoutFrameBytes) {
   });
   return { launcher, identity };
 }
-function installationIdentity(installation) {
-  return {
-    mode: "external",
-    selectedPath: installation.selectedPath,
-    nodePath: installation.nodePath,
-    realPath: installation.realPath,
-    version: installation.version,
-    fingerprint: installation.fingerprint
-  };
-}
 function unavailableTarget(selectedPath, nodePath, code) {
   const launcher = {
     artifactId: "external-pi",
@@ -3470,11 +3796,102 @@ function resolveFleetPaths(env = process.env) {
   };
 }
 
+// src/platform/shared/state-security.ts
+import { chmodSync, constants as constants2, lstatSync } from "node:fs";
+import { chmod, lstat, mkdir, open } from "node:fs/promises";
+import { dirname as dirname2, join as join3, parse, resolve as resolve2, sep } from "node:path";
+var PRIVATE_DIRECTORY_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+var GROUP_OR_OTHER_WRITE = 18;
+var STICKY_BIT = 512;
+var SAFE_ROOT_STICKY_DIRECTORIES = /* @__PURE__ */ new Set(["/tmp", "/var/tmp"]);
+async function prepareFleetPathSecurity(paths) {
+  await preparePrivateDirectory(paths.runtimeRoot);
+  if (paths.stateRoot !== paths.runtimeRoot) await preparePrivateDirectory(paths.stateRoot);
+  await preparePrivateDatabase(paths.databasePath);
+}
+async function preparePrivateDirectory(path) {
+  const absolutePath = resolve2(path);
+  await prepareDirectoryComponents(absolutePath);
+  const stats = await lstat(absolutePath);
+  assertCurrentUser(absolutePath, stats.uid);
+  await chmod(absolutePath, PRIVATE_DIRECTORY_MODE);
+}
+async function preparePrivateDatabase(path) {
+  const absolutePath = resolve2(path);
+  await preparePrivateDirectory(dirname2(absolutePath));
+  await assertPrivateRegularFileIfPresent(absolutePath);
+  await assertPrivateRegularFileIfPresent(`${absolutePath}-wal`);
+  await assertPrivateRegularFileIfPresent(`${absolutePath}-shm`);
+  const handle = await open(
+    absolutePath,
+    constants2.O_CREAT | constants2.O_APPEND | constants2.O_WRONLY | constants2.O_NOFOLLOW,
+    384
+  );
+  await handle.chmod(PRIVATE_FILE_MODE);
+  await handle.close();
+}
+async function prepareDirectoryComponents(absolutePath) {
+  const root = parse(absolutePath).root;
+  const rootStats = await lstat(root);
+  assertTrustedDirectoryAncestor(root, rootStats.uid, rootStats.mode);
+  const components = absolutePath.slice(root.length).split(sep).filter(Boolean);
+  let current = root;
+  for (const component of components) {
+    current = join3(current, component);
+    let stats = await lstat(current).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (stats === null) {
+      await mkdir(current, { mode: PRIVATE_DIRECTORY_MODE }).catch(
+        (error) => {
+          if (error.code !== "EEXIST") throw error;
+        }
+      );
+      stats = await lstat(current);
+    }
+    if (stats.isSymbolicLink()) {
+      throw new Error(`Refusing unsafe pi-fleet directory symlink ${current}`);
+    }
+    if (!stats.isDirectory()) {
+      throw new Error(`Refusing unsafe pi-fleet directory ${current}`);
+    }
+    assertTrustedDirectoryAncestor(current, stats.uid, stats.mode);
+  }
+}
+function assertTrustedDirectoryAncestor(path, ownerUid, mode, currentUid = process.getuid?.()) {
+  if (currentUid === void 0 || ownerUid === currentUid) return;
+  if (ownerUid === 0) {
+    const writable = (mode & GROUP_OR_OTHER_WRITE) !== 0;
+    if (!writable) return;
+    if ((mode & STICKY_BIT) !== 0 && SAFE_ROOT_STICKY_DIRECTORIES.has(path)) return;
+  }
+  throw new Error(`Refusing untrusted pi-fleet directory ancestor: ${path}`);
+}
+async function assertPrivateRegularFileIfPresent(path, harden = false) {
+  const stats = await lstat(path).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (stats === null) return;
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    throw new Error(`Refusing unsafe pi-fleet state file ${path}`);
+  }
+  assertCurrentUser(path, stats.uid);
+  if (harden || (stats.mode & 63) !== 0) await chmod(path, PRIVATE_FILE_MODE);
+}
+function assertCurrentUser(path, ownerUid) {
+  const uid = process.getuid?.();
+  if (uid !== void 0 && ownerUid !== uid) {
+    throw new Error(`Refusing pi-fleet path not owned by the current user: ${path}`);
+  }
+}
+
 // src/runtime/control-server.ts
-import { once as once2 } from "node:events";
-import { chmod, lstat, mkdir, unlink } from "node:fs/promises";
-import { createConnection, createServer } from "node:net";
-import { dirname as dirname2 } from "node:path";
+import { chmod as chmod2, mkdir as mkdir2, unlink } from "node:fs/promises";
+import { createServer } from "node:net";
+import { dirname as dirname3 } from "node:path";
 
 // node_modules/@sinclair/typebox/build/esm/errors/function.mjs
 function DefaultErrorFunction(error) {
@@ -6811,7 +7228,7 @@ __export(value_exports2, {
 });
 
 // src/protocol/version.ts
-var PROTOCOL_VERSION = 2;
+var PROTOCOL_VERSION = 3;
 var MAX_PROTOCOL_FRAME_BYTES = 1024 * 1024;
 
 // src/protocol/envelope.ts
@@ -6829,7 +7246,6 @@ var RequestSchema = Type.Object(
       Type.Literal("agent.receive"),
       Type.Literal("agent.status"),
       Type.Literal("agent.list"),
-      Type.Literal("agent.watch"),
       Type.Literal("agent.destroy"),
       Type.Literal("agent.compact")
     ]),
@@ -6889,6 +7305,53 @@ function writeJsonLine(socket, value) {
 `);
 }
 
+// src/protocol/semantic-segmentation.ts
+function segmentSemanticEvent(event2, precedingCursor, maxFrameBytes, maxSegments = 4096) {
+  assertPositiveInteger2(maxFrameBytes, "Semantic frame limit");
+  assertPositiveInteger2(maxSegments, "Semantic segment limit");
+  const payload = Buffer.from(JSON.stringify(event2));
+  let low = 1;
+  let high = payload.length;
+  let accepted = null;
+  while (low <= high) {
+    const chunkBytes = Math.floor((low + high) / 2);
+    const candidate = makeFrames(event2, precedingCursor, payload, chunkBytes);
+    if (candidate.every((frame) => serializedFrameBytes(frame) <= maxFrameBytes)) {
+      accepted = candidate;
+      low = chunkBytes + 1;
+    } else {
+      high = chunkBytes - 1;
+    }
+  }
+  if (accepted === null) throw new Error("Semantic frame limit is too small for metadata");
+  if (accepted.length > maxSegments) {
+    throw new Error("Semantic event requires too many segments");
+  }
+  return accepted;
+}
+function serializedFrameBytes(frame) {
+  return Buffer.byteLength(JSON.stringify(frame));
+}
+function makeFrames(event2, precedingCursor, payload, chunkBytes) {
+  const count = Math.ceil(payload.length / chunkBytes);
+  const frames = [];
+  for (let index = 0; index < count; index += 1) {
+    frames.push({
+      type: "semantic.segment",
+      eventId: event2.id,
+      precedingCursor,
+      eventCursor: event2.cursor,
+      index,
+      count,
+      data: payload.subarray(index * chunkBytes, (index + 1) * chunkBytes).toString("base64")
+    });
+  }
+  return frames;
+}
+function assertPositiveInteger2(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be positive`);
+}
+
 // src/shared/runtime-limits.ts
 var KIBIBYTE = 1024;
 var MEBIBYTE = 1024 * KIBIBYTE;
@@ -6897,16 +7360,44 @@ var DEFAULT_RUNTIME_LIMITS = Object.freeze({
   maxMessageBytes: 512 * KIBIBYTE,
   maxProtocolFrameBytes: MEBIBYTE,
   maxPiFrameBytes: 8 * MEBIBYTE,
-  maxWatchers: 128,
-  maxWatchQueuedBytes: MEBIBYTE
+  maxJournalPendingRecords: 4096,
+  maxJournalPendingBytes: 32 * MEBIBYTE,
+  maxJournalPendingBytesPerAgent: 4 * MEBIBYTE,
+  maxJournalPartialRecordBytes: 8 * MEBIBYTE,
+  maxJournalBatchRecords: 128,
+  maxJournalBatchBytes: 512 * KIBIBYTE,
+  maxJournalBatchAgeMs: 25,
+  journalCheckpointCommitInterval: 128,
+  journalReclaimPagesPerPass: 32,
+  maxOpenProjectorActivities: 1024,
+  maxReceiveStreams: 128,
+  maxReceiveReplayRows: 256,
+  maxReceiveReplayBytes: 4 * MEBIBYTE,
+  maxSemanticFrameBytes: MEBIBYTE,
+  maxSemanticSegments: 4096,
+  maxSocketWriteMs: 3e4
 });
 var ENV_KEYS = {
   maxResidentProcesses: "PIFLEET_MAX_RESIDENT_PROCESSES",
   maxMessageBytes: "PIFLEET_MAX_MESSAGE_BYTES",
   maxProtocolFrameBytes: "PIFLEET_MAX_PROTOCOL_FRAME_BYTES",
   maxPiFrameBytes: "PIFLEET_MAX_PI_FRAME_BYTES",
-  maxWatchers: "PIFLEET_MAX_WATCHERS",
-  maxWatchQueuedBytes: "PIFLEET_MAX_WATCH_QUEUED_BYTES"
+  maxJournalPendingRecords: "PIFLEET_MAX_JOURNAL_PENDING_RECORDS",
+  maxJournalPendingBytes: "PIFLEET_MAX_JOURNAL_PENDING_BYTES",
+  maxJournalPendingBytesPerAgent: "PIFLEET_MAX_JOURNAL_PENDING_BYTES_PER_AGENT",
+  maxJournalPartialRecordBytes: "PIFLEET_MAX_JOURNAL_PARTIAL_RECORD_BYTES",
+  maxJournalBatchRecords: "PIFLEET_MAX_JOURNAL_BATCH_RECORDS",
+  maxJournalBatchBytes: "PIFLEET_MAX_JOURNAL_BATCH_BYTES",
+  maxJournalBatchAgeMs: "PIFLEET_MAX_JOURNAL_BATCH_AGE_MS",
+  journalCheckpointCommitInterval: "PIFLEET_JOURNAL_CHECKPOINT_COMMIT_INTERVAL",
+  journalReclaimPagesPerPass: "PIFLEET_JOURNAL_RECLAIM_PAGES_PER_PASS",
+  maxOpenProjectorActivities: "PIFLEET_MAX_OPEN_PROJECTOR_ACTIVITIES",
+  maxReceiveStreams: "PIFLEET_MAX_RECEIVE_STREAMS",
+  maxReceiveReplayRows: "PIFLEET_MAX_RECEIVE_REPLAY_ROWS",
+  maxReceiveReplayBytes: "PIFLEET_MAX_RECEIVE_REPLAY_BYTES",
+  maxSemanticFrameBytes: "PIFLEET_MAX_SEMANTIC_FRAME_BYTES",
+  maxSemanticSegments: "PIFLEET_MAX_SEMANTIC_SEGMENTS",
+  maxSocketWriteMs: "PIFLEET_MAX_SOCKET_WRITE_MS"
 };
 function runtimeLimitsFromEnv(env = process.env) {
   return {
@@ -6914,8 +7405,22 @@ function runtimeLimitsFromEnv(env = process.env) {
     maxMessageBytes: positiveInteger(env, "maxMessageBytes"),
     maxProtocolFrameBytes: positiveInteger(env, "maxProtocolFrameBytes"),
     maxPiFrameBytes: positiveInteger(env, "maxPiFrameBytes"),
-    maxWatchers: positiveInteger(env, "maxWatchers"),
-    maxWatchQueuedBytes: positiveInteger(env, "maxWatchQueuedBytes")
+    maxJournalPendingRecords: positiveInteger(env, "maxJournalPendingRecords"),
+    maxJournalPendingBytes: positiveInteger(env, "maxJournalPendingBytes"),
+    maxJournalPendingBytesPerAgent: positiveInteger(env, "maxJournalPendingBytesPerAgent"),
+    maxJournalPartialRecordBytes: positiveInteger(env, "maxJournalPartialRecordBytes"),
+    maxJournalBatchRecords: positiveInteger(env, "maxJournalBatchRecords"),
+    maxJournalBatchBytes: positiveInteger(env, "maxJournalBatchBytes"),
+    maxJournalBatchAgeMs: positiveInteger(env, "maxJournalBatchAgeMs"),
+    journalCheckpointCommitInterval: positiveInteger(env, "journalCheckpointCommitInterval"),
+    journalReclaimPagesPerPass: positiveInteger(env, "journalReclaimPagesPerPass"),
+    maxOpenProjectorActivities: positiveInteger(env, "maxOpenProjectorActivities"),
+    maxReceiveStreams: positiveInteger(env, "maxReceiveStreams"),
+    maxReceiveReplayRows: positiveInteger(env, "maxReceiveReplayRows"),
+    maxReceiveReplayBytes: positiveInteger(env, "maxReceiveReplayBytes"),
+    maxSemanticFrameBytes: positiveInteger(env, "maxSemanticFrameBytes"),
+    maxSemanticSegments: positiveInteger(env, "maxSemanticSegments"),
+    maxSocketWriteMs: positiveInteger(env, "maxSocketWriteMs")
   };
 }
 function positiveInteger(env, key) {
@@ -6929,160 +7434,93 @@ function positiveInteger(env, key) {
   return value;
 }
 
-// src/shared/result.ts
-function ok(value) {
-  return { ok: true, value };
-}
-function err(error) {
-  return { ok: false, error };
-}
-
-// src/runtime/rpc-watch-hub.ts
-var RpcWatchError = class extends Error {
-  constructor(code, message = code) {
+// src/platform/shared/runtime-ownership.ts
+import { lstat as lstat2 } from "node:fs/promises";
+import { createConnection } from "node:net";
+var RuntimeOwnershipBlockedError = class extends Error {
+  code = "runtime_upgrade_deferred";
+  constructor(message) {
     super(message);
-    this.code = code;
-    this.name = "RpcWatchError";
+    this.name = "RuntimeOwnershipBlockedError";
   }
 };
-var RpcWatchHub = class {
-  constructor(limits) {
-    this.limits = limits;
-  }
-  #subscriptions = /* @__PURE__ */ new Map();
-  #activeIncarnations = /* @__PURE__ */ new Map();
-  subscribe(agentName, signal) {
-    if (this.#count() >= this.limits.maxWatchers) {
-      throw new RpcWatchError("watcher_capacity_exceeded");
-    }
-    const subscription = {
-      agentName,
-      signal,
-      queue: [],
-      maxQueuedBytes: this.limits.maxQueuedBytes,
-      queuedBytes: 0,
-      incarnationId: this.#activeIncarnations.get(agentName) ?? null,
-      ended: false,
-      terminalError: null,
-      wake: null,
-      onAbort: () => this.#abort(subscription)
-    };
-    signal.addEventListener("abort", subscription.onAbort, { once: true });
-    if (signal.aborted) subscription.onAbort();
-    else {
-      const subscriptions = this.#subscriptions.get(agentName) ?? /* @__PURE__ */ new Set();
-      subscriptions.add(subscription);
-      this.#subscriptions.set(agentName, subscriptions);
-    }
-    return { [Symbol.asyncIterator]: () => this.#iterator(subscription) };
-  }
-  beginIncarnation(agentName, incarnationId) {
-    this.#activeIncarnations.set(agentName, incarnationId);
-    for (const subscription of this.#subscriptions.get(agentName) ?? []) {
-      if (subscription.incarnationId === null && !subscription.ended) {
-        subscription.incarnationId = incarnationId;
-      }
-    }
-    return (bytes) => this.#publish(agentName, incarnationId, bytes);
-  }
-  endIncarnation(agentName, incarnationId, error = null) {
-    if (this.#activeIncarnations.get(agentName) === incarnationId) {
-      this.#activeIncarnations.delete(agentName);
-    }
-    for (const subscription of [...this.#subscriptions.get(agentName) ?? []]) {
-      if (subscription.incarnationId === incarnationId) this.#endAfterDrain(subscription, error);
-    }
-  }
-  closeAgent(agentName, error = null) {
-    this.#activeIncarnations.delete(agentName);
-    for (const subscription of [...this.#subscriptions.get(agentName) ?? []]) {
-      this.#endAfterDrain(subscription, error);
-    }
+async function inspectControlSocketOwnership(socketPath, probe = probeControlSocket) {
+  const stats = await lstat2(socketPath).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (stats === null) return "absent";
+  if (!stats.isSocket()) {
+    throw new RuntimeOwnershipBlockedError(
+      `Refusing to replace non-socket pi-fleet control path ${socketPath}`
+    );
   }
-  closeAll(error = null) {
-    for (const agentName of [...this.#subscriptions.keys()]) this.closeAgent(agentName, error);
+  return probe(socketPath);
+}
+async function preflightRuntimeStartup(options) {
+  const ownership = await (options.inspectOwnership ?? inspectControlSocketOwnership)(
+    options.socketPath
+  );
+  if (ownership === "responsive" || ownership === "uncertain") {
+    throw new RuntimeOwnershipBlockedError(
+      ownership === "responsive" ? `A responsive pi-fleet runtime already owns ${options.socketPath}` : `pi-fleet control socket ownership is uncertain for ${options.socketPath}`
+    );
   }
-  #publish(agentName, incarnationId, bytes) {
-    for (const subscription of [...this.#subscriptions.get(agentName) ?? []]) {
-      if (subscription.incarnationId !== incarnationId || subscription.ended) continue;
-      if (subscription.queuedBytes + bytes.byteLength > subscription.maxQueuedBytes) {
-        this.#finish(subscription, new RpcWatchError("watcher_lagged"));
-        continue;
-      }
-      subscription.queue.push(Buffer.from(bytes));
-      subscription.queuedBytes += bytes.byteLength;
-      subscription.wake?.();
-      subscription.wake = null;
+  if (options.destructive) {
+    if (options.assertOwnedProcessTreesAbsent === void 0) {
+      throw new RuntimeOwnershipBlockedError(
+        "Destructive pi-fleet startup requires proof that prior runtime and Pi process trees are absent."
+      );
     }
+    await options.assertOwnedProcessTreesAbsent();
   }
-  async *#iterator(subscription) {
-    try {
-      while (true) {
-        while (subscription.queue.length > 0) {
-          const bytes = subscription.queue.shift();
-          subscription.queuedBytes -= bytes.byteLength;
-          yield bytes;
-        }
-        if (subscription.terminalError !== null) throw subscription.terminalError;
-        if (subscription.ended) return;
-        await new Promise((resolve2) => {
-          subscription.wake = resolve2;
-        });
-      }
-    } finally {
-      this.#abort(subscription);
-    }
-  }
-  #endAfterDrain(subscription, error = null) {
-    if (subscription.ended) return;
-    subscription.ended = true;
-    subscription.terminalError = error;
-    subscription.wake?.();
-    subscription.wake = null;
-  }
-  #finish(subscription, error = null) {
-    if (subscription.ended) return;
-    subscription.ended = true;
-    subscription.terminalError = error;
-    subscription.wake?.();
-    subscription.wake = null;
-  }
-  #abort(subscription) {
-    subscription.queue.length = 0;
-    subscription.queuedBytes = 0;
-    subscription.ended = true;
-    subscription.terminalError = null;
-    this.#remove(subscription);
-    subscription.wake?.();
-    subscription.wake = null;
-  }
-  #remove(subscription) {
-    subscription.signal.removeEventListener("abort", subscription.onAbort);
-    const subscriptions = this.#subscriptions.get(subscription.agentName);
-    if (subscriptions === void 0) return;
-    subscriptions.delete(subscription);
-    if (subscriptions.size === 0) this.#subscriptions.delete(subscription.agentName);
-  }
-  #count() {
-    let count = 0;
-    for (const subscriptions of this.#subscriptions.values()) count += subscriptions.size;
-    return count;
-  }
-};
+  return ownership;
+}
+function probeControlSocket(socketPath) {
+  return new Promise((resolveProbe) => {
+    const socket = createConnection(socketPath);
+    let settled = false;
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolveProbe(result);
+    };
+    const timer = setTimeout(() => settle("uncertain"), 200);
+    socket.once("connect", () => settle("responsive"));
+    socket.once("error", (error) => {
+      settle(error.code === "ECONNREFUSED" || error.code === "ENOENT" ? "stale" : "uncertain");
+    });
+  });
+}
 
 // src/runtime/control-server.ts
 async function startControlServer(options) {
-  await mkdir(dirname2(options.socketPath), { recursive: true, mode: 448 });
+  await mkdir2(dirname3(options.socketPath), { recursive: true, mode: 448 });
   await prepareSocketPath(options.socketPath);
   const service = Promise.resolve(options.service);
-  const maxFrameBytes = options.limits?.maxProtocolFrameBytes ?? DEFAULT_RUNTIME_LIMITS.maxProtocolFrameBytes;
-  const server = createServer((socket) => handleConnection(socket, service, maxFrameBytes));
+  const limits = {
+    maxProtocolFrameBytes: options.limits?.maxProtocolFrameBytes ?? DEFAULT_RUNTIME_LIMITS.maxProtocolFrameBytes,
+    maxSemanticFrameBytes: options.limits?.maxSemanticFrameBytes ?? DEFAULT_RUNTIME_LIMITS.maxSemanticFrameBytes,
+    maxSemanticSegments: options.limits?.maxSemanticSegments ?? DEFAULT_RUNTIME_LIMITS.maxSemanticSegments,
+    maxSemanticEventBytes: options.limits?.maxPiFrameBytes ?? DEFAULT_RUNTIME_LIMITS.maxPiFrameBytes,
+    maxSocketWriteMs: options.limits?.maxSocketWriteMs ?? DEFAULT_RUNTIME_LIMITS.maxSocketWriteMs
+  };
+  const server = createServer(
+    (socket) => handleConnection(
+      socket,
+      service,
+      options.journal ?? (() => Promise.reject(new Error("Semantic receive is unavailable"))),
+      limits
+    )
+  );
   server.listen(options.socketPath);
   await new Promise((resolveListen, rejectListen) => {
     server.once("listening", resolveListen);
     server.once("error", rejectListen);
   });
-  await chmod(options.socketPath, 384);
+  await chmod2(options.socketPath, 384);
   return {
     socketPath: options.socketPath,
     async close() {
@@ -7093,7 +7531,7 @@ async function startControlServer(options) {
     }
   };
 }
-function handleConnection(socket, service, maxFrameBytes) {
+function handleConnection(socket, service, journal, limits) {
   let handled = false;
   const abort = new AbortController();
   socket.once("close", () => abort.abort());
@@ -7103,31 +7541,15 @@ function handleConnection(socket, service, maxFrameBytes) {
       if (handled) return;
       handled = true;
       stopReading();
-      void service.then((readyService) => dispatch(value, readyService, socket, abort.signal, maxFrameBytes)).catch((error) => {
-        if (socket.destroyed) return;
-        const invalidRequest = error instanceof InvalidRequestError;
-        writeJsonLine(socket, {
-          v: PROTOCOL_VERSION,
-          requestId: requestIdFrom(value),
-          ok: false,
-          error: invalidRequest ? { code: "invalid_request", message: error.message } : { code: "internal_error", message: "pi-fleet encountered an internal error." }
-        });
-        socket.end();
-      });
-    },
-    (error) => {
-      writeJsonLine(socket, {
-        v: PROTOCOL_VERSION,
-        requestId: "unknown",
-        ok: false,
-        error: { code: "invalid_request", message: error.message }
-      });
-      socket.end();
+      void service.then(
+        (readyService) => dispatch(value, readyService, journal, socket, abort.signal, limits)
+      ).catch((error) => writeConnectionError(socket, value, error));
     },
-    maxFrameBytes
+    (error) => writeConnectionError(socket, void 0, new InvalidRequestError(error.message)),
+    limits.maxProtocolFrameBytes
   );
 }
-async function dispatch(value, service, socket, connectionSignal, maxFrameBytes) {
+async function dispatch(value, service, journal, socket, connectionSignal, limits) {
   let request;
   try {
     request = parseProtocolRequest(value);
@@ -7154,86 +7576,178 @@ async function dispatch(value, service, socket, connectionSignal, maxFrameBytes)
       );
       break;
     case "agent.receive":
-      result = await receiveWithTimeout(
+      await streamReceive(
+        request.requestId,
+        asReceiveInput(request.params),
         service,
-        asNamedInput(request.params),
-        numberParam(request.params, "timeoutMs"),
-        connectionSignal
+        await journal(),
+        socket,
+        connectionSignal,
+        limits
       );
-      break;
+      return;
     case "agent.status":
       result = await service.status(asNamedInput(request.params));
       break;
     case "agent.list":
       result = await service.list();
       break;
-    case "agent.watch": {
-      const watch = await service.openWatch(asNamedInput(request.params), connectionSignal);
-      if (!watch.ok) {
-        writeJsonLine(socket, {
-          v: PROTOCOL_VERSION,
-          requestId: request.requestId,
-          stream: "error",
-          error: watch.error
-        });
-        socket.end();
-        return;
-      }
-      writeJsonLine(socket, { v: PROTOCOL_VERSION, requestId: request.requestId, stream: "ready" });
-      try {
-        const outgoingFrameLimit = Math.min(maxFrameBytes, MAX_PROTOCOL_FRAME_BYTES);
-        const maxRawChunkBytes = Math.max(1, Math.floor((outgoingFrameLimit - 1024) * 0.75));
-        for await (const chunk of watch.value) {
-          for (let offset = 0; offset < chunk.length; offset += maxRawChunkBytes) {
-            const part = chunk.subarray(offset, offset + maxRawChunkBytes);
-            const writable = writeJsonLine(socket, {
-              v: PROTOCOL_VERSION,
-              requestId: request.requestId,
-              stream: "chunk",
-              data: part.toString("base64")
-            });
-            if (!writable) await once2(socket, "drain");
-          }
-        }
-        if (!socket.destroyed) {
-          writeJsonLine(socket, {
-            v: PROTOCOL_VERSION,
-            requestId: request.requestId,
-            stream: "end"
-          });
-          socket.end();
-        }
-      } catch (error) {
-        if (!socket.destroyed) {
-          const watchError = error instanceof RpcWatchError ? { code: error.code, message: error.message } : { code: "internal_error", message: "Raw Pi RPC watch failed." };
-          writeJsonLine(socket, {
-            v: PROTOCOL_VERSION,
-            requestId: request.requestId,
-            stream: "error",
-            error: watchError
-          });
-          socket.end();
-        }
-      }
-      return;
-    }
     case "agent.destroy":
-      result = await service.destroy(asNamedInput(request.params), requireOperation(operationId));
+      result = await service.destroy(asBoundInput(request.params), requireOperation(operationId));
       break;
     case "agent.compact":
       result = await service.compact(
-        asNamedInput(request.params),
+        asBoundInput(request.params),
         requireOperation(operationId),
         requirePiIdentity(request.runtime?.pi)
       );
       break;
   }
-  writeJsonLine(
+  await writeFrame(
     socket,
-    result.ok ? { v: PROTOCOL_VERSION, requestId: request.requestId, ok: true, result: result.value } : { v: PROTOCOL_VERSION, requestId: request.requestId, ok: false, error: result.error }
+    result.ok ? { v: PROTOCOL_VERSION, requestId: request.requestId, ok: true, result: result.value } : { v: PROTOCOL_VERSION, requestId: request.requestId, ok: false, error: result.error },
+    limits.maxSocketWriteMs
   );
   socket.end();
 }
+async function streamReceive(requestId, input, service, journal, socket, connectionSignal, limits) {
+  const abort = new AbortController();
+  const onConnectionAbort = () => abort.abort(connectionSignal.reason);
+  connectionSignal.addEventListener("abort", onConnectionAbort, { once: true });
+  let lastCursor = null;
+  try {
+    const prepared = await service.prepareReceive(
+      input,
+      input.start ?? { kind: "live" },
+      input.untilIdle === true,
+      abort.signal
+    );
+    if (!prepared.ok) {
+      await writeStreamError(socket, requestId, prepared.error, limits.maxSocketWriteMs);
+      return;
+    }
+    const { stream, idle } = prepared.value;
+    await writeFrame(
+      socket,
+      {
+        v: PROTOCOL_VERSION,
+        requestId,
+        stream: "ready",
+        cursor: stream.cursor,
+        limits: {
+          maxEventBytes: limits.maxSemanticEventBytes,
+          maxSegments: limits.maxSemanticSegments
+        }
+      },
+      limits.maxSocketWriteMs,
+      limits.maxProtocolFrameBytes
+    );
+    const iterator = stream[Symbol.asyncIterator]();
+    let precedingCursor = stream.cursor;
+    lastCursor = stream.cursor;
+    let lastPosition = journal.decodeCursorPosition(stream.cursor);
+    let idleHighWater = null;
+    let pending = iterator.next();
+    while (!abort.signal.aborted) {
+      if (idle !== null && idleHighWater === null) {
+        const raced = await Promise.race([
+          pending.then((next2) => ({ kind: "event", next: next2 })),
+          idle.then((settled) => ({ kind: "idle", settled }))
+        ]);
+        if (raced.kind === "idle") {
+          if (!raced.settled.ok) {
+            await writeStreamError(socket, requestId, raced.settled.error, limits.maxSocketWriteMs);
+            return;
+          }
+          idleHighWater = raced.settled.value.idleEventPosition;
+          if (lastPosition >= idleHighWater) break;
+          continue;
+        }
+        if (raced.next.done) break;
+        const event3 = raced.next.value;
+        await writeSemanticEvent(socket, requestId, event3, precedingCursor, limits);
+        precedingCursor = event3.cursor;
+        lastCursor = event3.cursor;
+        lastPosition = journal.decodeCursorPosition(event3.cursor);
+        pending = iterator.next();
+        continue;
+      }
+      if (idleHighWater !== null && lastPosition >= idleHighWater) break;
+      const next = await pending;
+      if (next.done) break;
+      const event2 = next.value;
+      await writeSemanticEvent(socket, requestId, event2, precedingCursor, limits);
+      precedingCursor = event2.cursor;
+      lastCursor = event2.cursor;
+      lastPosition = journal.decodeCursorPosition(event2.cursor);
+      pending = iterator.next();
+    }
+    abort.abort();
+    await pending.catch(() => ({ done: true, value: void 0 }));
+    await iterator.return?.();
+    if (!socket.destroyed) {
+      await writeFrame(
+        socket,
+        { v: PROTOCOL_VERSION, requestId, stream: "end" },
+        limits.maxSocketWriteMs
+      );
+      socket.end();
+    }
+  } catch (error) {
+    if (socket.destroyed || connectionSignal.aborted) return;
+    const failure = error instanceof ReceiveObservationUncertainError ? {
+      code: error.code,
+      message: error.message,
+      details: {
+        lastSafeCursor: error.lastSafeCursor,
+        continuationCursor: error.continuationCursor
+      }
+    } : error instanceof Error && "code" in error && typeof error.code === "string" ? {
+      code: error.code,
+      message: "Receive stream failed.",
+      ...lastCursor === null ? {} : { details: { lastSafeCursor: lastCursor } }
+    } : error instanceof Error && error.message.startsWith("Semantic") ? {
+      code: "semantic_event_too_large",
+      message: "A semantic event exceeds stream limits."
+    } : { code: "internal_error", message: "Receive stream failed." };
+    await writeStreamError(socket, requestId, failure, limits.maxSocketWriteMs);
+  } finally {
+    connectionSignal.removeEventListener("abort", onConnectionAbort);
+  }
+}
+async function writeSemanticEvent(socket, requestId, event2, precedingCursor, limits) {
+  let segmentLimit = Math.max(
+    1,
+    Math.min(limits.maxSemanticFrameBytes, limits.maxProtocolFrameBytes)
+  );
+  let frames = null;
+  while (frames === null) {
+    const candidates = segmentSemanticEvent(
+      event2,
+      precedingCursor,
+      segmentLimit,
+      limits.maxSemanticSegments
+    ).map((segment) => ({
+      v: PROTOCOL_VERSION,
+      requestId,
+      stream: "semantic.segment",
+      segment
+    }));
+    if (candidates.every(
+      (frame) => Buffer.byteLength(JSON.stringify(frame)) + 1 <= limits.maxProtocolFrameBytes
+    )) {
+      frames = candidates;
+      break;
+    }
+    if (segmentLimit === 1) {
+      throw new Error("Semantic event envelope exceeds the configured protocol limit");
+    }
+    segmentLimit = Math.max(1, Math.floor(segmentLimit * 0.75));
+  }
+  for (const frame of frames) {
+    await writeFrame(socket, frame, limits.maxSocketWriteMs, limits.maxProtocolFrameBytes);
+  }
+}
 function asCreateInput(params) {
   const name = stringParam(params, "name");
   const cwd = stringParam(params, "cwd");
@@ -7248,39 +7762,63 @@ function asCreateInput(params) {
   return { name, cwd, piArgv, ...instructions === void 0 ? {} : { instructions } };
 }
 function asSendInput(params) {
-  return { name: stringParam(params, "name"), message: stringParam(params, "message") };
+  const delivery = params.delivery;
+  if (delivery !== void 0 && delivery !== "steer" && delivery !== "followUp") {
+    throw new InvalidRequestError("delivery must be steer or followUp");
+  }
+  return {
+    ...asBoundInput(params),
+    message: stringParam(params, "message"),
+    ...delivery === void 0 ? {} : { delivery }
+  };
 }
-function asNamedInput(params) {
-  return { name: stringParam(params, "name") };
+function asReceiveInput(params) {
+  const named = asBoundInput(params);
+  if (params.untilIdle !== void 0 && typeof params.untilIdle !== "boolean") {
+    throw new InvalidRequestError("untilIdle must be a boolean");
+  }
+  const start = receiveStart(params);
+  if (params.untilIdle === true && start.kind !== "live") {
+    throw new InvalidRequestError("untilIdle uses a live boundary and cannot include history");
+  }
+  return {
+    ...named,
+    start,
+    ...params.untilIdle === true ? { untilIdle: true } : {}
+  };
 }
-async function receiveWithTimeout(service, input, timeoutMs, connectionSignal) {
-  const abort = new AbortController();
-  let timedOut = false;
-  const onConnectionAbort = () => abort.abort();
-  connectionSignal.addEventListener("abort", onConnectionAbort, { once: true });
-  const timer = timeoutMs === void 0 ? void 0 : setTimeout(() => {
-    timedOut = true;
-    abort.abort();
-  }, timeoutMs);
-  try {
-    return await service.receive(input, abort.signal);
-  } catch (error) {
-    if (timedOut) {
-      return err({ code: "timeout", message: "Agent did not become idle before timeout." });
-    }
-    throw error;
-  } finally {
-    if (timer !== void 0) clearTimeout(timer);
-    connectionSignal.removeEventListener("abort", onConnectionAbort);
+function receiveStart(params) {
+  if (params.fromStart !== void 0 && typeof params.fromStart !== "boolean") {
+    throw new InvalidRequestError("fromStart must be a boolean");
+  }
+  if (params.after !== void 0 && typeof params.after !== "string") {
+    throw new InvalidRequestError("after must be a string cursor");
+  }
+  if (params.fromStart === true && params.after !== void 0) {
+    throw new InvalidRequestError("after and fromStart cannot be combined");
+  }
+  if (params.fromStart === true) return { kind: "start" };
+  if (typeof params.after === "string") {
+    return { kind: "after", cursor: params.after };
   }
+  return { kind: "live" };
 }
-function numberParam(params, key) {
-  const value = params[key];
-  if (value === void 0) return void 0;
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-    throw new InvalidRequestError(`${key} must be a non-negative number`);
+function asNamedInput(params) {
+  const expectedAgentId = params.expectedAgentId;
+  if (expectedAgentId !== void 0 && typeof expectedAgentId !== "string") {
+    throw new InvalidRequestError("expectedAgentId must be a string");
   }
-  return value;
+  return {
+    name: stringParam(params, "name"),
+    ...expectedAgentId === void 0 ? {} : { expectedAgentId }
+  };
+}
+function asBoundInput(params) {
+  const input = asNamedInput(params);
+  if (input.expectedAgentId === void 0) {
+    throw new InvalidRequestError("expectedAgentId is required for agent-scoped operations");
+  }
+  return { ...input, expectedAgentId: input.expectedAgentId };
 }
 function stringParam(params, key) {
   const value = params[key];
@@ -7297,6 +7835,56 @@ function requirePiIdentity(identity) {
     throw new InvalidRequestError("Mutation requires Pi runtime identity");
   return identity;
 }
+async function writeStreamError(socket, requestId, error, timeoutMs) {
+  if (socket.destroyed) return;
+  await writeFrame(socket, { v: PROTOCOL_VERSION, requestId, stream: "error", error }, timeoutMs);
+  socket.end();
+}
+async function writeFrame(socket, value, timeoutMs, maxBytes) {
+  if (socket.destroyed) throw new Error("Control socket is closed");
+  if (maxBytes !== void 0 && Buffer.byteLength(JSON.stringify(value)) + 1 > maxBytes) {
+    throw new Error("Control protocol frame exceeds the configured limit");
+  }
+  if (writeJsonLine(socket, value)) return;
+  await new Promise((resolve3, reject) => {
+    const cleanup = () => {
+      clearTimeout(timer);
+      socket.off("drain", onDrain);
+      socket.off("error", onError);
+      socket.off("close", onClose);
+    };
+    const onDrain = () => {
+      cleanup();
+      resolve3();
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const onClose = () => {
+      cleanup();
+      reject(new Error("Control socket closed during write"));
+    };
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(new Error("Control socket write timed out"));
+    }, timeoutMs);
+    socket.once("drain", onDrain);
+    socket.once("error", onError);
+    socket.once("close", onClose);
+  });
+}
+function writeConnectionError(socket, value, error) {
+  if (socket.destroyed) return;
+  const invalid = error instanceof InvalidRequestError;
+  writeJsonLine(socket, {
+    v: PROTOCOL_VERSION,
+    requestId: requestIdFrom(value),
+    ok: false,
+    error: invalid ? { code: "invalid_request", message: error.message } : { code: "internal_error", message: "pi-fleet encountered an internal error." }
+  });
+  socket.end();
+}
 var InvalidRequestError = class extends Error {
   name = "InvalidRequestError";
 };
@@ -7305,32 +7893,15 @@ function requestIdFrom(value) {
   return typeof value.requestId === "string" ? value.requestId : "unknown";
 }
 async function prepareSocketPath(socketPath) {
-  const stats = await lstat(socketPath).catch((error) => {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  });
-  if (stats === null) return;
-  if (!stats.isSocket()) throw new Error(`Refusing to replace non-socket path ${socketPath}`);
-  if (await canConnect(socketPath))
-    throw new Error(`A pi-fleet runtime already owns ${socketPath}`);
-  await unlink(socketPath);
-}
-async function canConnect(socketPath) {
-  return new Promise((resolveConnect) => {
-    const socket = createConnection(socketPath);
-    const timer = setTimeout(() => {
-      socket.destroy();
-      resolveConnect(false);
-    }, 200);
-    socket.once("connect", () => {
-      clearTimeout(timer);
-      socket.destroy();
-      resolveConnect(true);
-    });
-    socket.once("error", () => {
-      clearTimeout(timer);
-      resolveConnect(false);
-    });
+  const ownership = await inspectControlSocketOwnership(socketPath);
+  if (ownership === "absent") return;
+  if (ownership !== "stale") {
+    throw new RuntimeOwnershipBlockedError(
+      ownership === "responsive" ? `A responsive pi-fleet runtime already owns ${socketPath}` : `pi-fleet control socket ownership is uncertain for ${socketPath}`
+    );
+  }
+  await unlink(socketPath).catch((error) => {
+    if (error.code !== "ENOENT") throw error;
   });
 }
 async function closeServer(server) {
@@ -7341,7 +7912,56 @@ async function closeServer(server) {
 }
 
 // src/runtime/fleet-service.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+
+// src/client/contracts.ts
+var PI_FLEET_ERROR_CODES = [
+  "agent_busy",
+  "agent_destroyed",
+  "agent_destroying",
+  "agent_not_found",
+  "capacity_exceeded",
+  "cancelled",
+  "compaction_failed",
+  "compaction_uncertain",
+  "cursor_expired",
+  "cursor_invalid",
+  "cursor_wrong_agent",
+  "delivery_uncertain",
+  "destroy_incomplete",
+  "incarnation_cleanup_uncertain",
+  "internal_error",
+  "invalid_arguments",
+  "invalid_request",
+  "name_taken",
+  "nothing_to_compact",
+  "observation_uncertain",
+  "operation_conflict",
+  "operation_in_progress",
+  "pi_installation_changed",
+  "pi_not_executable",
+  "pi_not_found",
+  "pi_runtime_mismatch",
+  "pi_service_mismatch",
+  "pi_start_failed",
+  "pi_version_unavailable",
+  "pi_version_unsupported",
+  "protocol_error",
+  "protocol_incompatible",
+  "receive_resource_exhausted",
+  "runtime_interrupted",
+  "runtime_unavailable",
+  "runtime_upgrade_deferred",
+  "semantic_event_too_large",
+  "stale_agent",
+  "state_corrupt",
+  "storage_unavailable",
+  "timeout"
+];
+var piFleetErrorCodeSet = new Set(PI_FLEET_ERROR_CODES);
+function isPiFleetErrorCode(value) {
+  return typeof value === "string" && piFleetErrorCodeSet.has(value);
+}
 
 // src/pi/session-selector.ts
 var VALUE_SELECTORS = /* @__PURE__ */ new Map([
@@ -7514,15 +8134,24 @@ function observeSession(profile, session) {
   };
 }
 
+// src/shared/result.ts
+function ok(value) {
+  return { ok: true, value };
+}
+function err(error) {
+  return { ok: false, error };
+}
+
 // src/runtime/agent-coordinator.ts
 var AgentCoordinator = class {
-  constructor(store, agent, process2, incarnationId, now, onProcessExit) {
+  constructor(store, agent, process2, incarnationId, now, onProcessExit, onIdle) {
     this.store = store;
     this.agent = agent;
     this.process = process2;
     this.incarnationId = incarnationId;
     this.now = now;
     this.onProcessExit = onProcessExit;
+    this.onIdle = onIdle;
     this.#unsubscribeFrame = process2.onFrame((frame) => {
       if (frame.type === "agent_start") this.#queueEvent(() => this.#markWorking());
       if (frame.type === "agent_settled") this.#queueEvent(() => this.#markIdle());
@@ -7536,22 +8165,50 @@ var AgentCoordinator = class {
   #stopReason = null;
   #handlingFailure = false;
   #mayBeWorking = false;
+  #idleEventPosition = null;
   #unsubscribeFrame;
   #unsubscribeExit;
   get storedAgent() {
     return this.agent;
   }
-  send(message) {
+  get idleEventPosition() {
+    return this.#idleEventPosition;
+  }
+  /**
+   * Delivers caller input to Pi.
+   *
+   * Follow-up delivery means "wait until the current run finishes", which Pi only
+   * honours while a turn is active: a follow-up queued against an authoritatively
+   * idle session would wait for a turn that may never start. Idle follow-up input
+   * is therefore delivered as an ordinary prompt, matching what typing into an idle
+   * Pi session does, while active follow-up keeps its queued semantics.
+   */
+  send(message, delivery = "steer") {
     return this.#enqueue(async () => {
+      const queueFollowUp = delivery === "followUp" && await this.#isActive();
       this.#mayBeWorking = true;
       try {
-        await this.process.prompt(message);
+        if (queueFollowUp) await this.process.followUp(message);
+        else await this.process.prompt(message);
       } catch (error) {
         this.#mayBeWorking = false;
         throw error;
       }
     });
   }
+  async #isActive() {
+    if (this.#mayBeWorking) return true;
+    const state = await this.process.getState();
+    return state.isStreaming || state.isCompacting || state.pendingMessageCount !== 0;
+  }
+  reconcileState() {
+    return this.#enqueue(async () => {
+      const state = await this.process.getState();
+      this.#applyObservedState(state);
+      await this.store.putAgent(this.agent);
+      return state;
+    });
+  }
   compact() {
     return this.#enqueue(async () => {
       const state = await this.process.getState();
@@ -7580,15 +8237,21 @@ var AgentCoordinator = class {
       }
     });
   }
-  async waitForIdle(signal) {
+  async registerIdleWaiter(signal) {
     let wait = null;
     await this.#enqueue(async () => {
-      if (!this.#mayBeWorking && this.agent.summary.state === "idle") return;
       if (signal?.aborted === true) throw new Error("Receive cancelled");
+      if (!this.#mayBeWorking && this.agent.summary.state === "idle" && this.#idleEventPosition !== null) {
+        wait = Promise.resolve({
+          agent: this.agent,
+          idleEventPosition: this.#idleEventPosition
+        });
+        return;
+      }
       let resolveIdle;
       let rejectIdle;
-      const pending = new Promise((resolve2, reject) => {
-        resolveIdle = resolve2;
+      const pending = new Promise((resolve3, reject) => {
+        resolveIdle = resolve3;
         rejectIdle = reject;
       });
       void pending.catch(() => void 0);
@@ -7614,14 +8277,18 @@ var AgentCoordinator = class {
         await this.#markIdle();
       }
     });
-    if (wait !== null) await wait;
-    await this.#lane;
-    return this.agent;
+    if (wait === null) throw new Error("Idle waiter registration failed");
+    return { completion: wait };
+  }
+  async waitForIdle(signal) {
+    const registered = await this.registerIdleWaiter(signal);
+    return registered.completion;
   }
   async stop(reason) {
     this.#stopReason = reason;
     await this.store.putIncarnation({
       incarnationId: this.incarnationId,
+      agentId: this.agent.summary.id,
       agentName: this.agent.summary.name,
       pid: this.process.pid,
       state: "stopping"
@@ -7642,6 +8309,7 @@ var AgentCoordinator = class {
       await this.store.putAgent(this.agent);
       await this.store.putIncarnation({
         incarnationId: this.incarnationId,
+        agentId: this.agent.summary.id,
         agentName: this.agent.summary.name,
         pid: this.process.pid,
         state: "cleanup_uncertain"
@@ -7669,6 +8337,7 @@ var AgentCoordinator = class {
       await this.store.putAgent(this.agent);
       await this.store.putIncarnation({
         incarnationId: this.incarnationId,
+        agentId: this.agent.summary.id,
         agentName: this.agent.summary.name,
         pid: this.process.pid,
         state: "cleanup_uncertain"
@@ -7679,7 +8348,7 @@ var AgentCoordinator = class {
     }
     const wasActive = this.agent.summary.state === "working" || this.agent.summary.state === "restoring";
     const destroyed = this.#stopReason === "destroy";
-    const interrupted = error !== null && this.#stopReason === null || wasActive && this.#stopReason !== "destroy";
+    const interrupted = this.agent.summary.state === "failed" || error !== null && this.#stopReason === null || wasActive && this.#stopReason !== "destroy";
     const state = destroyed ? "destroying" : interrupted ? "failed" : "idle";
     this.agent = {
       ...this.agent,
@@ -7693,6 +8362,7 @@ var AgentCoordinator = class {
     await this.store.putAgent(this.agent);
     await this.store.putIncarnation({
       incarnationId: this.incarnationId,
+      agentId: this.agent.summary.id,
       agentName: this.agent.summary.name,
       pid: this.process.pid,
       state: "gone"
@@ -7706,6 +8376,7 @@ var AgentCoordinator = class {
   }
   async #markWorking() {
     this.#mayBeWorking = true;
+    this.#idleEventPosition = null;
     this.agent = {
       ...this.agent,
       summary: {
@@ -7718,12 +8389,11 @@ var AgentCoordinator = class {
     await this.store.putAgent(this.agent);
   }
   async #markIdle() {
-    const latestAssistantText = await this.process.getLastAssistantText();
-    this.#mayBeWorking = false;
-    this.agent = {
+    const state = await this.process.getState();
+    if (state.isStreaming || state.isCompacting || state.pendingMessageCount !== 0) return;
+    this.#applyObservedState(state);
+    const idleAgent = {
       ...this.agent,
-      latestAssistantText,
-      responseObservedAt: latestAssistantText === null ? this.agent.responseObservedAt : this.now(),
       summary: {
         ...this.agent.summary,
         state: "idle",
@@ -7731,15 +8401,50 @@ var AgentCoordinator = class {
         error: void 0
       }
     };
-    await this.store.putAgent(this.agent);
-    this.#resolveIdleWaiters();
+    try {
+      const idleEventPosition = await this.onIdle?.(idleAgent) ?? null;
+      await this.store.putAgent(idleAgent);
+      this.agent = idleAgent;
+      this.#idleEventPosition = idleEventPosition;
+      this.#mayBeWorking = false;
+      this.#resolveIdleWaiters();
+    } catch (error) {
+      const failure = error instanceof Error ? error : new Error("Idle durability failed");
+      this.agent = {
+        ...idleAgent,
+        summary: {
+          ...idleAgent.summary,
+          state: "failed",
+          error: { code: "storage_unavailable" }
+        }
+      };
+      await this.store.putAgent(this.agent).catch(() => void 0);
+      this.#rejectIdleWaiters(failure);
+      throw failure;
+    }
+  }
+  #applyObservedState(state) {
+    this.agent = {
+      ...this.agent,
+      launch: observeSession(this.agent.launch, {
+        path: state.sessionFile ?? null,
+        id: state.sessionId
+      }),
+      summary: {
+        ...this.agent.summary,
+        session: { path: state.sessionFile ?? null, id: state.sessionId }
+      }
+    };
   }
   #resolveIdleWaiters() {
     for (const waiter of this.#idleWaiters) {
       if (waiter.signal !== void 0 && waiter.onAbort !== void 0) {
         waiter.signal.removeEventListener("abort", waiter.onAbort);
       }
-      waiter.resolve();
+      waiter.resolve({
+        agent: this.agent,
+        idleEventPosition: this.#idleEventPosition ?? 0
+      });
     }
     this.#idleWaiters.clear();
   }
@@ -7784,10 +8489,9 @@ var FleetService = class {
       ...DEFAULT_RUNTIME_LIMITS,
       ...typeof options === "function" ? {} : options.limits
     };
-    this.#watchHub = new RpcWatchHub({
-      maxWatchers: this.#limits.maxWatchers,
-      maxQueuedBytes: this.#limits.maxWatchQueuedBytes
-    });
+    this.#journal = typeof options === "function" ? void 0 : options.journal;
+    this.#journalStore = typeof options === "function" ? void 0 : options.journalStore;
+    this.#onAgentDestroyed = typeof options === "function" ? () => void 0 : options.onAgentDestroyed ?? (() => void 0);
   }
   #operations = /* @__PURE__ */ new Map();
   #inflightOperations = /* @__PURE__ */ new Map();
@@ -7800,9 +8504,37 @@ var FleetService = class {
   #launcher;
   #now;
   #limits;
-  #watchHub;
+  #journal;
+  #journalStore;
+  #journalSinks = /* @__PURE__ */ new Map();
+  #onAgentDestroyed;
   #piIdentity;
+  #storageFailure = null;
   #closing = false;
+  failStorage(error) {
+    this.#storageFailure ??= error;
+    for (const coordinator of this.#coordinators.values()) {
+      void coordinator.process.stop().catch(() => void 0);
+    }
+  }
+  failAgent(agentId, error) {
+    const coordinator = [...this.#coordinators.values()].find(
+      (candidate) => candidate.storedAgent.summary.id === agentId
+    );
+    if (coordinator === void 0) return;
+    const agent = coordinator.storedAgent;
+    void this.store.putAgent({
+      ...agent,
+      summary: {
+        ...agent.summary,
+        state: "failed",
+        error: {
+          code: error.message.includes("capacity") ? "storage_unavailable" : "state_corrupt"
+        }
+      }
+    }).catch(() => void 0);
+    void coordinator.process.stop().catch(() => void 0);
+  }
   create(input, operationId, callerPiIdentity) {
     return this.#runOperation(
       operationId,
@@ -7812,8 +8544,12 @@ var FleetService = class {
     );
   }
   async #createImpl(input, operationId, callerPiIdentity) {
+    if (this.#storageFailure !== null) {
+      return err({ code: "storage_unavailable", message: "pi-fleet storage is unavailable." });
+    }
     const replay = await this.#operation(operationId, "create", input);
     if (replay !== null) return replay;
+    if (this.#closing) return this.#runtimeUnavailable();
     let profile;
     try {
       profile = createLaunchProfile({
@@ -7864,11 +8600,15 @@ var FleetService = class {
         process: { state: this.#launcher === void 0 ? "resident" : "starting" },
         session: { path: null, id: null }
       },
-      launch: profile,
-      latestAssistantText: null,
-      responseObservedAt: null
+      launch: profile
     };
-    if (!await this.store.createAgent(agent)) {
+    const pendingCreate = await this.store.getOperation(operationId);
+    if (pendingCreate === null) throw new Error("Create operation receipt is missing");
+    if (!await this.store.createAgent(agent, {
+      ...pendingCreate,
+      targetName: input.name,
+      targetAgent: { id: agent.summary.id, name: input.name }
+    })) {
       const result = err({
         code: "name_taken",
         message: `Agent ${input.name} already exists.`
@@ -7876,14 +8616,22 @@ var FleetService = class {
       await this.#remember(operationId, "create", input, result);
       return result;
     }
+    if (this.#journalStore !== void 0) {
+      await this.#journalStore.putEpoch({
+        agentId: agent.summary.id,
+        epoch: 0,
+        state: "open",
+        lastSafeEventPosition: 0,
+        openedAt: this.#now()
+      });
+    }
     await this.#recordOperationTarget(operationId, agent);
     if (this.#launcher !== void 0 && this.#reserveProcessSlot(input.name) !== "acquired") {
-      await this.store.deleteAgent(input.name);
       const result = err({
         code: "capacity_exceeded",
         message: `pi-fleet has reached its ${String(this.#limits.maxResidentProcesses)} process limit.`
       });
-      await this.#remember(operationId, "create", input, result);
+      await this.#rollbackProvisionalCreate(agent, operationId, result);
       return result;
     }
     let incarnationId = null;
@@ -7892,26 +8640,29 @@ var FleetService = class {
         incarnationId = randomUUID2();
         await this.store.putIncarnation({
           incarnationId,
+          agentId: agent.summary.id,
           agentName: input.name,
           pid: null,
           state: "starting"
         });
-        const publishStdout = this.#watchHub.beginIncarnation(input.name, incarnationId);
+        const journalSink = await this.#openJournalSink(agent, incarnationId);
         const process2 = await this.#launcher.start(
           profile,
           false,
           async (pid) => {
             await this.store.putIncarnation({
               incarnationId,
+              agentId: agent.summary.id,
               agentName: input.name,
               pid,
               state: "starting"
             });
           },
-          publishStdout
+          journalSink?.pushRecord
         );
         await this.store.putIncarnation({
           incarnationId,
+          agentId: agent.summary.id,
           agentName: input.name,
           pid: process2.pid,
           state: "live"
@@ -7921,6 +8672,7 @@ var FleetService = class {
           path: state.sessionFile ?? null,
           id: state.sessionId
         });
+        await this.#journal?.markIdle(agent.summary.id);
         agent = {
           ...agent,
           launch: observedProfile,
@@ -7939,36 +8691,47 @@ var FleetService = class {
           const ordinal = await this.store.nextSendOrdinal(input.name);
           await this.store.putSend({
             sendId,
+            agentId: agent.summary.id,
             agentName: input.name,
             ordinal,
             message: input.instructions,
+            delivery: "steer",
             state: "pending",
             acceptedAt
           });
           await this.store.putSend({
             sendId,
+            agentId: agent.summary.id,
             agentName: input.name,
             ordinal,
             message: input.instructions,
+            delivery: "steer",
             state: "dispatching",
             acceptedAt
           });
           try {
-            await this.#enqueueSend(input.name, () => coordinator.send(input.instructions));
+            await this.#enqueueSend(input.name, async () => {
+              await coordinator.send(input.instructions);
+              await coordinator.reconcileState();
+            });
             await this.store.putSend({
               sendId,
+              agentId: agent.summary.id,
               agentName: input.name,
               ordinal,
               message: input.instructions,
+              delivery: "steer",
               state: "acknowledged",
               acceptedAt
             });
           } catch (error) {
             await this.store.putSend({
               sendId,
+              agentId: agent.summary.id,
               agentName: input.name,
               ordinal,
               message: input.instructions,
+              delivery: "steer",
               state: "uncertain",
               acceptedAt
             });
@@ -7996,11 +8759,7 @@ var FleetService = class {
     } catch (error) {
       const coordinator = this.#coordinators.get(input.name);
       if (incarnationId !== null && coordinator === void 0) {
-        this.#watchHub.endIncarnation(
-          input.name,
-          incarnationId,
-          new RpcWatchError("pi_start_failed", "Pi failed to start")
-        );
+        this.#finishJournalSink(incarnationId);
       }
       const deliveryAmbiguous = (await this.store.getSend(`${operationId}:initial`))?.state === "uncertain";
       let cleanupUncertain = error instanceof PiCleanupUncertainError;
@@ -8039,34 +8798,49 @@ var FleetService = class {
         if (incarnationId !== null) {
           await this.store.putIncarnation({
             incarnationId,
+            agentId: agent.summary.id,
             agentName: input.name,
             pid: error instanceof PiCleanupUncertainError ? error.pid : null,
             state: "gone"
           });
         }
         this.#releaseProcessSlot(input.name);
-        await this.store.deleteAgent(input.name);
       }
       const code = cleanupUncertain ? "incarnation_cleanup_uncertain" : deliveryAmbiguous ? "delivery_uncertain" : "pi_start_failed";
       const result = err({
         code,
         message: code === "delivery_uncertain" ? "Pi may have accepted the initial instructions; pi-fleet will not replay them automatically." : code === "incarnation_cleanup_uncertain" ? "pi-fleet could not prove the Pi process group was removed." : "Pi failed to start."
       });
-      await this.#remember(operationId, "create", input, result);
+      if (cleanupUncertain || deliveryAmbiguous) {
+        await this.#remember(operationId, "create", input, result);
+      } else {
+        await this.#rollbackProvisionalCreate(agent, operationId, result);
+      }
       return result;
     }
   }
   send(input, operationId, callerPiIdentity) {
+    const normalizedInput = {
+      ...input,
+      delivery: input.delivery ?? "steer"
+    };
     return this.#runOperation(
       operationId,
       "send",
-      input,
-      () => this.#enqueueAgent(input.name, () => this.#sendImpl(input, operationId, callerPiIdentity))
+      normalizedInput,
+      () => this.#enqueueAgent(
+        normalizedInput.name,
+        () => this.#sendImpl(normalizedInput, operationId, callerPiIdentity)
+      )
     );
   }
   async #sendImpl(input, operationId, callerPiIdentity) {
+    if (this.#storageFailure !== null) {
+      return err({ code: "storage_unavailable", message: "pi-fleet storage is unavailable." });
+    }
     const replay = await this.#operation(operationId, "send", input);
     if (replay !== null) return replay;
+    if (this.#closing) return this.#runtimeUnavailable();
     if (this.#destroyingAgents.has(input.name)) {
       const result2 = err({
         code: "agent_destroying",
@@ -8085,6 +8859,12 @@ var FleetService = class {
     }
     const agent = await this.store.getAgent(input.name);
     if (agent === null) return this.#rememberNotFound(operationId, "send", input);
+    const staleTarget = this.#staleTarget(input.expectedAgentId, agent);
+    if (staleTarget !== null) {
+      await this.#remember(operationId, "send", input, staleTarget);
+      return staleTarget;
+    }
+    await this.#recordOperationTarget(operationId, agent);
     if (agent.summary.process.state === "cleanup_uncertain") {
       const result2 = err({
         code: "incarnation_cleanup_uncertain",
@@ -8110,9 +8890,11 @@ var FleetService = class {
       const ordinal = await this.store.nextSendOrdinal(input.name);
       await this.store.putSend({
         sendId: operationId,
+        agentId: agent.summary.id,
         agentName: input.name,
         ordinal,
         message: input.message,
+        delivery: input.delivery ?? "steer",
         state: "pending",
         acceptedAt
       });
@@ -8130,8 +8912,12 @@ var FleetService = class {
     );
   }
   async #compactImpl(input, operationId, callerPiIdentity) {
+    if (this.#storageFailure !== null) {
+      return err({ code: "storage_unavailable", message: "pi-fleet storage is unavailable." });
+    }
     const replay = await this.#operation(operationId, "compact", input);
     if (replay !== null) return replay;
+    if (this.#closing) return this.#runtimeUnavailable();
     const requestedAt = this.#now();
     let agent = await this.store.getAgent(input.name);
     if (agent === null) {
@@ -8140,6 +8926,11 @@ var FleetService = class {
         message: `Agent ${input.name} was not found.`
       });
     }
+    const staleTarget = this.#staleTarget(input.expectedAgentId, agent);
+    if (staleTarget !== null) {
+      await this.#remember(operationId, "compact", input, staleTarget);
+      return staleTarget;
+    }
     await this.#recordOperationTarget(operationId, agent);
     if (agent.summary.process.state === "cleanup_uncertain") {
       return this.#rememberCompactFailure(operationId, input, requestedAt, {
@@ -8163,6 +8954,7 @@ var FleetService = class {
     }
     await this.store.putCompact({
       compactId: operationId,
+      agentId: agent.summary.id,
       agentName: input.name,
       state: "pending",
       requestedAt
@@ -8177,6 +8969,7 @@ var FleetService = class {
       try {
         await this.store.putCompact({
           compactId: operationId,
+          agentId: agent.summary.id,
           agentName: input.name,
           state: "dispatching",
           requestedAt
@@ -8192,6 +8985,7 @@ var FleetService = class {
       }
       await this.store.putCompact({
         compactId: operationId,
+        agentId: agent.summary.id,
         agentName: input.name,
         state: "completed",
         requestedAt,
@@ -8235,6 +9029,7 @@ var FleetService = class {
       const terminalFailure = busy || preDispatch || compactionError !== null;
       await this.store.putCompact({
         compactId: operationId,
+        agentId: agent.summary.id,
         agentName: input.name,
         state: terminalFailure ? "failed" : "uncertain",
         requestedAt,
@@ -8263,26 +9058,29 @@ var FleetService = class {
     try {
       await this.store.putIncarnation({
         incarnationId,
+        agentId: agent.summary.id,
         agentName: agent.summary.name,
         pid: null,
         state: "starting"
       });
-      const publishStdout = this.#watchHub.beginIncarnation(agent.summary.name, incarnationId);
+      const journalSink = await this.#openJournalSink(restoring, incarnationId);
       process2 = await this.#launcher.start(
         restoring.launch,
         true,
         async (pid) => {
           await this.store.putIncarnation({
             incarnationId,
+            agentId: agent.summary.id,
             agentName: agent.summary.name,
             pid,
             state: "starting"
           });
         },
-        publishStdout
+        journalSink?.pushRecord
       );
       await this.store.putIncarnation({
         incarnationId,
+        agentId: agent.summary.id,
         agentName: agent.summary.name,
         pid: process2.pid,
         state: "live"
@@ -8305,11 +9103,7 @@ var FleetService = class {
       await this.store.putAgent(restored);
       return this.#attachCoordinator(restored, process2, incarnationId);
     } catch (error) {
-      this.#watchHub.endIncarnation(
-        agent.summary.name,
-        incarnationId,
-        new RpcWatchError("pi_start_failed", "Pi failed to start")
-      );
+      this.#finishJournalSink(incarnationId);
       let cleanupUncertain = error instanceof PiCleanupUncertainError;
       let pid = error instanceof PiCleanupUncertainError ? error.pid : null;
       if (process2 !== null) {
@@ -8331,6 +9125,7 @@ var FleetService = class {
       });
       await this.store.putIncarnation({
         incarnationId,
+        agentId: agent.summary.id,
         agentName: agent.summary.name,
         pid,
         state: cleanupUncertain ? "cleanup_uncertain" : "gone"
@@ -8342,11 +9137,12 @@ var FleetService = class {
   async reconcile() {
     const nonterminalCompacts = await this.store.listNonterminalCompacts();
     const nonterminalSends = await this.store.listNonterminalSends();
+    const activeIncarnations = await this.store.listActiveIncarnations();
     const activeWorkAgents = /* @__PURE__ */ new Set([
       ...nonterminalSends.map((send) => send.agentName),
       ...nonterminalCompacts.filter((compact) => compact.state === "dispatching").map((compact) => compact.agentName)
     ]);
-    for (const incarnation of await this.store.listActiveIncarnations()) {
+    for (const incarnation of activeIncarnations) {
       if (incarnation.state !== "cleanup_uncertain") continue;
       this.#processSlots.add(incarnation.agentName);
       if (incarnation.pid === null || !await waitForProcessGroupExit(incarnation.pid)) continue;
@@ -8380,7 +9176,15 @@ var FleetService = class {
       }
     }
     for (const send of nonterminalSends) {
-      const input = { name: send.agentName, message: send.message };
+      if (send.agentId === void 0) {
+        throw new Error(`Durable send ${send.sendId} is missing its agent generation`);
+      }
+      const input = {
+        name: send.agentName,
+        expectedAgentId: send.agentId,
+        message: send.message,
+        delivery: send.delivery ?? "steer"
+      };
       if (send.state === "dispatching") {
         const result2 = err({
           code: "delivery_uncertain",
@@ -8409,62 +9213,75 @@ var FleetService = class {
     }
     for (const operation of await this.store.listPendingOperations()) {
       if (operation.method === "send") continue;
-      const payload = JSON.parse(operation.fingerprint);
+      const target = operation.targetAgent;
       if (operation.method === "create") {
-        if (piExecutionFailure === null)
-          await this.create(payload, operation.operationId);
+        const agent = await this.store.getAgent(operation.targetName);
+        const hasActiveIncarnation = activeIncarnations.some(
+          (incarnation) => incarnation.agentId === target?.id
+        );
+        const startFailed = err({
+          code: "pi_start_failed",
+          message: `Creation of ${operation.targetName} stopped before Pi was safely dispatched.`
+        });
+        if (target !== void 0 && agent?.summary.id === target.id && agent.summary.state === "restoring" && !hasActiveIncarnation) {
+          await this.#rollbackProvisionalCreate(agent, operation.operationId, startFailed);
+        } else if (target !== void 0 && agent?.summary.id === target.id) {
+          const result = agent.summary.state === "idle" ? ok({
+            schemaVersion: 1,
+            type: "agent.created",
+            agent: agent.summary
+          }) : err({
+            code: publicAgentFailureCode(agent.summary.error?.code, "runtime_interrupted"),
+            message: `Creation of ${operation.targetName} did not settle successfully.`
+          });
+          await this.store.putOperation({ ...operation, state: "completed", result });
+        } else if (target === void 0 && agent === null && isCreateRequest(operation.request)) {
+          if (piExecutionFailure === null)
+            await this.create(operation.request, operation.operationId);
+        } else {
+          await this.store.putOperation({ ...operation, state: "completed", result: startFailed });
+        }
       } else if (operation.method === "destroy") {
-        await this.destroy(payload, operation.operationId);
+        if (target === void 0) {
+          await this.store.putOperation({
+            ...operation,
+            state: "completed",
+            result: this.#notFound(operation.targetName)
+          });
+        } else {
+          await this.destroy(
+            { name: target.name, expectedAgentId: target.id },
+            operation.operationId
+          );
+        }
       } else if (operation.method === "compact") {
-        if (piExecutionFailure === null)
-          await this.compact(payload, operation.operationId);
-      }
-    }
-  }
-  async receive(input, signal) {
-    const coordinator = this.#coordinators.get(input.name);
-    let agent;
-    try {
-      agent = coordinator === void 0 ? await this.store.getAgent(input.name) : await coordinator.waitForIdle(signal);
-    } catch (error) {
-      if (signal?.aborted === true) throw error;
-      if (error instanceof Error && error.message === "Agent destroyed") {
-        return err({ code: "agent_destroyed", message: `Agent ${input.name} was destroyed.` });
-      }
-      if (error instanceof Error && error.message === "Pi work was interrupted") {
-        return err({
-          code: "runtime_interrupted",
-          message: `Agent ${input.name} was interrupted before becoming idle.`
-        });
+        if (target === void 0) {
+          await this.store.putOperation({
+            ...operation,
+            state: "completed",
+            result: this.#notFound(operation.targetName)
+          });
+        } else if (piExecutionFailure === null) {
+          await this.compact(
+            { name: target.name, expectedAgentId: target.id },
+            operation.operationId
+          );
+        }
       }
-      throw error;
-    }
-    if (agent === null) return this.#notFound(input.name);
-    if (agent.summary.state === "failed") {
-      const code = agent.summary.error?.code ?? "agent_failed";
-      return err({
-        code,
-        message: `Agent ${input.name} is failed (${code}) and has no current successful response.`
-      });
-    }
-    if (agent.latestAssistantText === null || agent.responseObservedAt === null) {
-      return err({
-        code: "no_response",
-        message: `Agent ${input.name} has no assistant response.`
-      });
     }
-    return ok({
-      schemaVersion: 1,
-      type: "response",
-      agent: { id: agent.summary.id, name: agent.summary.name },
-      response: { text: agent.latestAssistantText, observedAt: agent.responseObservedAt }
-    });
   }
   async status(input) {
+    if (this.#storageFailure !== null) {
+      return err({ code: "storage_unavailable", message: "pi-fleet storage is unavailable." });
+    }
     const agent = await this.store.getAgent(input.name);
-    return agent === null ? this.#notFound(input.name) : ok({ schemaVersion: 1, type: "agent.status", agent: agent.summary });
+    if (agent === null) return this.#notFound(input.name);
+    return this.#staleTarget(input.expectedAgentId, agent) ?? ok({ schemaVersion: 1, type: "agent.status", agent: agent.summary });
   }
   async list() {
+    if (this.#storageFailure !== null) {
+      return err({ code: "storage_unavailable", message: "pi-fleet storage is unavailable." });
+    }
     const agents = await this.store.listAgents();
     return ok({
       schemaVersion: 1,
@@ -8472,29 +9289,86 @@ var FleetService = class {
       agents: agents.map((agent) => agent.summary)
     });
   }
-  openWatch(input, connectionSignal) {
-    if (this.#closing) return Promise.resolve(this.#runtimeUnavailable());
-    if (this.#destroyingAgents.has(input.name))
-      return Promise.resolve(this.#agentDestroying(input.name));
+  async waitForIdle(input, signal) {
+    const current = await this.status(input);
+    if (!current.ok || current.value.agent.state === "idle") return current;
+    if (current.value.agent.state === "failed") {
+      return err({
+        code: publicAgentFailureCode(current.value.agent.error?.code),
+        message: `Agent ${input.name} failed before reaching idle.`
+      });
+    }
+    const coordinator = this.#coordinators.get(input.name);
+    if (coordinator === void 0) {
+      return err({ code: "state_corrupt", message: `Agent ${input.name} has no active process.` });
+    }
+    try {
+      const boundary = await coordinator.waitForIdle(signal);
+      return this.#staleTarget(input.expectedAgentId, boundary.agent) ?? ok({ schemaVersion: 1, type: "agent.status", agent: boundary.agent.summary });
+    } catch (error) {
+      if (signal.aborted) throw error;
+      return err({
+        code: "runtime_interrupted",
+        message: `Agent ${input.name} was interrupted before becoming idle.`
+      });
+    }
+  }
+  prepareReceive(input, start, untilIdle, signal) {
     return this.#enqueueAgent(input.name, async () => {
       if (this.#closing) return this.#runtimeUnavailable();
-      if (this.#destroyingAgents.has(input.name)) return this.#agentDestroying(input.name);
+      if (this.#storageFailure !== null) {
+        return err({ code: "storage_unavailable", message: "pi-fleet storage is unavailable." });
+      }
+      if (this.#journal === void 0) {
+        return err({ code: "protocol_incompatible", message: "Semantic receive is unavailable." });
+      }
       const agent = await this.store.getAgent(input.name);
       if (agent === null) return this.#notFound(input.name);
-      try {
-        return ok(this.#watchHub.subscribe(input.name, connectionSignal));
-      } catch (error) {
-        if (error instanceof RpcWatchError && error.code === "watcher_capacity_exceeded") {
-          return err({
-            code: "capacity_exceeded",
-            message: `pi-fleet has reached its ${String(this.#limits.maxWatchers)} watcher limit.`
-          });
-        }
-        throw error;
+      const stale = this.#staleTarget(input.expectedAgentId, agent);
+      if (stale !== null) return stale;
+      if (agent.summary.state === "failed") {
+        return err({
+          code: publicAgentFailureCode(agent.summary.error?.code),
+          message: `Agent ${input.name} is failed.`
+        });
+      }
+      const agentId = agent.summary.id;
+      const stream = await this.#journal.openReceive(agentId, start, signal);
+      if (!untilIdle) return ok({ agentId, stream, idle: null });
+      const coordinator = this.#coordinators.get(input.name);
+      if (coordinator !== void 0) {
+        const { completion } = await coordinator.registerIdleWaiter(signal);
+        const idle = completion.then(
+          (boundary) => ok({ idleEventPosition: boundary.idleEventPosition }),
+          () => err({
+            code: "runtime_interrupted",
+            message: `Agent ${input.name} was interrupted before becoming idle.`
+          })
+        );
+        return ok({ agentId, stream, idle });
       }
+      if (agent.summary.state !== "idle") {
+        return err({
+          code: "state_corrupt",
+          message: `Agent ${input.name} has no active process.`
+        });
+      }
+      const idleEventPosition = await this.#journal.idleEventHighWater(agentId) ?? await this.#journal.markIdle(agentId);
+      return ok({
+        agentId,
+        stream,
+        idle: Promise.resolve(ok({ idleEventPosition }))
+      });
     });
   }
   destroy(input, operationId) {
+    if (this.#closing) return Promise.resolve(this.#runtimeUnavailable());
+    if (this.#storageFailure !== null) {
+      void this.#coordinators.get(input.name)?.process.stop().catch(() => void 0);
+      return Promise.resolve(
+        err({ code: "storage_unavailable", message: "pi-fleet storage is unavailable." })
+      );
+    }
     return this.#runOperation(operationId, "destroy", input, async () => {
       this.#destroyingAgents.add(input.name);
       try {
@@ -8517,6 +9391,13 @@ var FleetService = class {
     const replay = await this.#operation(operationId, "destroy", input);
     if (replay !== null) return replay;
     const stored = await this.store.getAgent(input.name);
+    if (stored !== null) {
+      const staleTarget = this.#staleTarget(input.expectedAgentId, stored);
+      if (staleTarget !== null) {
+        await this.#remember(operationId, "destroy", input, staleTarget);
+        return staleTarget;
+      }
+    }
     if (stored?.summary.process.state === "cleanup_uncertain") {
       const result2 = err({
         code: "destroy_incomplete",
@@ -8527,11 +9408,27 @@ var FleetService = class {
     }
     if (stored !== null) await this.#recordOperationTarget(operationId, stored);
     const coordinator = this.#coordinators.get(input.name);
-    if (coordinator !== void 0) await coordinator.stop("destroy");
+    if (coordinator !== void 0) {
+      try {
+        await coordinator.stop("destroy");
+      } catch {
+        const result2 = err({
+          code: "destroy_incomplete",
+          message: `pi-fleet could not prove the Pi process for ${input.name} was removed.`
+        });
+        await this.#remember(operationId, "destroy", input, result2);
+        return result2;
+      }
+    }
     this.#coordinators.delete(input.name);
-    this.#watchHub.closeAgent(input.name);
-    const agent = await this.store.deleteAgent(input.name);
+    const pending = await this.store.getOperation(operationId);
+    const agent = await this.store.deleteAgent(input.name, {
+      operationId,
+      fingerprint: pending?.fingerprint ?? JSON.stringify(input),
+      destroyedAt: this.#now()
+    });
     if (agent === null) return this.#rememberNotFound(operationId, "destroy", input);
+    this.#onAgentDestroyed(agent.summary.id);
     const result = ok({
       schemaVersion: 1,
       type: "agent.destroyed",
@@ -8546,20 +9443,37 @@ var FleetService = class {
     await coordinator.stop("idle_release");
     this.#coordinators.delete(name);
   }
-  async close() {
+  beginShutdown() {
     this.#closing = true;
+  }
+  async drainStdoutAndJournal() {
+    await Promise.all(
+      [...this.#coordinators.values()].map((coordinator) => {
+        const process2 = coordinator.process;
+        return process2.drainStdout?.() ?? Promise.resolve();
+      })
+    );
+    await this.#journal?.ingestion.drain();
+  }
+  async stopProcessTrees() {
     const stops = await Promise.allSettled(
       [...this.#coordinators.values()].map((coordinator) => coordinator.stop("runtime_shutdown"))
     );
     this.#coordinators.clear();
-    this.#watchHub.closeAll(
-      new RpcWatchError("runtime_unavailable", "pi-fleet runtime is shutting down")
-    );
+    for (const incarnationId of [...this.#journalSinks.keys()]) {
+      this.#finishJournalSink(incarnationId);
+    }
+    await this.#journal?.closeIngestion();
     const failure = stops.find(
       (result) => result.status === "rejected"
     );
     if (failure !== void 0) throw failure.reason;
   }
+  async close() {
+    this.beginShutdown();
+    await this.drainStdoutAndJournal();
+    await this.stopProcessTrees();
+  }
   async #dispatchSend(input, operationId, acceptedAt, initialAgent, ordinal) {
     let agent = initialAgent;
     let incarnationId = null;
@@ -8578,9 +9492,11 @@ var FleetService = class {
         } else if (reservation === "full") {
           await this.store.putSend({
             sendId: operationId,
+            agentId: agent.summary.id,
             agentName: input.name,
             ordinal,
             message: input.message,
+            delivery: input.delivery ?? "steer",
             state: "failed",
             acceptedAt
           });
@@ -8594,27 +9510,30 @@ var FleetService = class {
           incarnationId = randomUUID2();
           await this.store.putIncarnation({
             incarnationId,
+            agentId: agent.summary.id,
             agentName: input.name,
             pid: null,
             state: "starting"
           });
-          const publishStdout = this.#watchHub.beginIncarnation(input.name, incarnationId);
+          const journalSink = await this.#openJournalSink(agent, incarnationId);
           startingProcess = await this.#launcher.start(
             agent.launch,
             true,
             async (pid) => {
               await this.store.putIncarnation({
                 incarnationId,
+                agentId: agent.summary.id,
                 agentName: input.name,
                 pid,
                 state: "starting"
               });
             },
-            publishStdout
+            journalSink?.pushRecord
           );
           const process2 = startingProcess;
           await this.store.putIncarnation({
             incarnationId,
+            agentId: agent.summary.id,
             agentName: input.name,
             pid: process2.pid,
             state: "live"
@@ -8642,26 +9561,25 @@ var FleetService = class {
       }
       await this.store.putSend({
         sendId: operationId,
+        agentId: agent.summary.id,
         agentName: input.name,
         ordinal,
         message: input.message,
+        delivery: input.delivery ?? "steer",
         state: "dispatching",
         acceptedAt
       });
-      if (coordinator === void 0) {
-        await this.store.putAgent({
-          ...agent,
-          latestAssistantText: `Fake response to: ${input.message}`,
-          responseObservedAt: acceptedAt
-        });
-      } else {
-        await coordinator.send(input.message);
+      if (coordinator !== void 0) {
+        await coordinator.send(input.message, input.delivery ?? "steer");
+        await coordinator.reconcileState();
       }
       await this.store.putSend({
         sendId: operationId,
+        agentId: agent.summary.id,
         agentName: input.name,
         ordinal,
         message: input.message,
+        delivery: input.delivery ?? "steer",
         state: "acknowledged",
         acceptedAt
       });
@@ -8684,11 +9602,7 @@ var FleetService = class {
           }
         }
         const code = cleanupUncertain ? "incarnation_cleanup_uncertain" : "pi_start_failed";
-        this.#watchHub.endIncarnation(
-          input.name,
-          incarnationId,
-          new RpcWatchError("pi_start_failed", "Pi failed to restore")
-        );
+        this.#finishJournalSink(incarnationId);
         agent = {
           ...agent,
           summary: {
@@ -8701,15 +9615,18 @@ var FleetService = class {
         await this.store.putAgent(agent);
         await this.store.putIncarnation({
           incarnationId,
+          agentId: agent.summary.id,
           agentName: input.name,
           pid: cleanupPid,
           state: cleanupUncertain ? "cleanup_uncertain" : "gone"
         });
         await this.store.putSend({
           sendId: operationId,
+          agentId: agent.summary.id,
           agentName: input.name,
           ordinal,
           message: input.message,
+          delivery: input.delivery ?? "steer",
           state: "failed",
           acceptedAt
         });
@@ -8723,6 +9640,7 @@ var FleetService = class {
       if (incarnationId !== null && !this.#coordinators.has(input.name)) {
         await this.store.putIncarnation({
           incarnationId,
+          agentId: agent.summary.id,
           agentName: input.name,
           pid: null,
           state: "cleanup_uncertain"
@@ -8730,9 +9648,11 @@ var FleetService = class {
       }
       await this.store.putSend({
         sendId: operationId,
+        agentId: agent.summary.id,
         agentName: input.name,
         ordinal,
         message: input.message,
+        delivery: input.delivery ?? "steer",
         state: "uncertain",
         acceptedAt
       });
@@ -8758,21 +9678,46 @@ var FleetService = class {
       incarnationId,
       this.#now,
       () => {
-        const interrupted = coordinator.storedAgent.summary.state === "failed";
-        this.#watchHub.endIncarnation(
-          agent.summary.name,
-          incarnationId,
-          interrupted ? new RpcWatchError("runtime_interrupted", "Pi process was interrupted") : null
-        );
+        this.#finishJournalSink(incarnationId);
         if (this.#coordinators.get(agent.summary.name) === coordinator) {
           this.#coordinators.delete(agent.summary.name);
           this.#releaseProcessSlot(agent.summary.name);
         }
-      }
+      },
+      async (idleAgent) => await this.#journal?.markIdle(idleAgent.summary.id) ?? 0
     );
     this.#coordinators.set(agent.summary.name, coordinator);
     return coordinator;
   }
+  async #openJournalSink(agent, incarnationId) {
+    if (this.#journal === void 0 || this.#journalStore === void 0) return void 0;
+    const agentId = agent.summary.id;
+    const epochs = await this.#journalStore.getEpochs(agentId);
+    const last = epochs.at(-1);
+    const epoch = last?.state === "open" ? last.epoch : (last?.epoch ?? -1) + 1;
+    if (last?.state !== "open") {
+      await this.#journalStore.putEpoch({
+        agentId,
+        epoch,
+        state: "open",
+        lastSafeEventPosition: (await this.#journalStore.getHighWater(agentId))?.eventPosition ?? 0,
+        openedAt: this.#now()
+      });
+    }
+    const sink = await this.#journal.openIncarnation({
+      agentId,
+      incarnationId,
+      epoch
+    });
+    this.#journalSinks.set(incarnationId, sink);
+    return sink;
+  }
+  #finishJournalSink(incarnationId) {
+    const sink = this.#journalSinks.get(incarnationId);
+    if (sink === void 0) return;
+    this.#journalSinks.delete(incarnationId);
+    sink.finish();
+  }
   #enqueueAgent(name, operation) {
     return enqueueNamed(this.#agentLanes, name, operation);
   }
@@ -8794,7 +9739,7 @@ var FleetService = class {
     while (Date.now() < deadline) {
       const coordinator = this.#coordinators.get(name);
       if (coordinator !== void 0) return coordinator;
-      await new Promise((resolve2) => setTimeout(resolve2, 10));
+      await new Promise((resolve3) => setTimeout(resolve3, 10));
     }
     return this.#coordinators.get(name);
   }
@@ -8807,30 +9752,38 @@ var FleetService = class {
   #releaseProcessSlot(name) {
     this.#processSlots.delete(name);
   }
-  #agentDestroying(name) {
-    return err({ code: "agent_destroying", message: `Agent ${name} is being destroyed.` });
-  }
-  #notFound(name) {
-    return err({ code: "agent_not_found", message: `Agent ${name} was not found.` });
+  #staleTarget(expectedAgentId, agent) {
+    if (expectedAgentId === void 0 || expectedAgentId === agent.summary.id) return null;
+    return err({
+      code: "stale_agent",
+      message: `Agent ${agent.summary.name} was recreated; this operation targets an older generation.`
+    });
   }
   #runtimeUnavailable() {
     return err({ code: "runtime_unavailable", message: "pi-fleet runtime is shutting down." });
   }
-  async #rememberCompactFailure(operationId, input, requestedAt, failure) {
-    await this.store.putCompact({
-      compactId: operationId,
-      agentName: input.name,
-      state: "failed",
-      requestedAt,
-      error: failure
-    });
-    const result = err(failure);
-    await this.#remember(operationId, "compact", input, result);
-    return result;
+  #notFound(name) {
+    return err({ code: "agent_not_found", message: `Agent ${name} was not found.` });
   }
-  #piIdentityFailure(callerIdentity) {
-    if (callerIdentity === void 0 || samePiRuntimeIdentity(callerIdentity, this.#piIdentity)) {
-      return null;
+  async #rememberCompactFailure(operationId, input, requestedAt, failure) {
+    const agent = await this.store.getAgent(input.name);
+    if (agent !== null) {
+      await this.store.putCompact({
+        compactId: operationId,
+        agentId: agent.summary.id,
+        agentName: input.name,
+        state: "failed",
+        requestedAt,
+        error: failure
+      });
+    }
+    const result = err(failure);
+    await this.#remember(operationId, "compact", input, result);
+    return result;
+  }
+  #piIdentityFailure(callerIdentity) {
+    if (callerIdentity === void 0 || samePiRuntimeIdentity(callerIdentity, this.#piIdentity)) {
+      return null;
     }
     return {
       code: "pi_runtime_mismatch",
@@ -8860,7 +9813,7 @@ var FleetService = class {
     return result;
   }
   #runOperation(operationId, method, payload, operation) {
-    const fingerprint = JSON.stringify(payload);
+    const fingerprint = fingerprintPayload(payload);
     const inflight = this.#inflightOperations.get(operationId);
     if (inflight !== void 0) {
       if (inflight.method !== method || inflight.fingerprint !== fingerprint) {
@@ -8894,7 +9847,7 @@ var FleetService = class {
       result: stored.result
     } : void 0);
     if (recorded === void 0) {
-      const fingerprint = JSON.stringify(payload);
+      const fingerprint = fingerprintPayload(payload);
       if (stored !== null) {
         if (stored.method !== method || stored.fingerprint !== fingerprint) {
           return err({
@@ -8905,8 +9858,22 @@ var FleetService = class {
         const name = "name" in payload ? String(payload.name) : "";
         const agent = name.length === 0 ? null : await this.store.getAgent(name);
         if (method === "create") {
-          if (agent === null) {
-            await this.store.deleteOperation(operationId);
+          if (stored.targetAgent === void 0) {
+            if (agent === null) return null;
+            const result = err({
+              code: "name_taken",
+              message: `Agent ${name} already exists.`
+            });
+            await this.#remember(operationId, method, payload, result);
+            return result;
+          }
+          if (agent === null || agent.summary.id !== stored.targetAgent.id) {
+            const result = err({
+              code: "stale_agent",
+              message: `Creation operation ${operationId} targets an unavailable agent generation.`
+            });
+            await this.#remember(operationId, method, payload, result);
+            return result;
           } else if (agent.summary.state === "idle" || agent.summary.state === "working") {
             const result = ok({
               schemaVersion: 1,
@@ -8917,7 +9884,7 @@ var FleetService = class {
             return result;
           } else if (agent.summary.state === "failed") {
             const result = err({
-              code: agent.summary.error?.code ?? "pi_start_failed",
+              code: publicAgentFailureCode(agent.summary.error?.code, "pi_start_failed"),
               message: `Creation of ${name} did not complete safely.`
             });
             await this.#remember(operationId, method, payload, result);
@@ -8929,11 +9896,19 @@ var FleetService = class {
             });
           }
         } else if (method === "destroy") {
-          if (agent === null && stored.targetAgent !== void 0) {
+          if (stored.targetAgent === void 0) {
+            const result = this.#notFound(name);
+            await this.#remember(operationId, method, payload, result);
+            return result;
+          }
+          if (agent === null) {
             const result = ok({
               schemaVersion: 1,
               type: "agent.destroyed",
-              agent: stored.targetAgent
+              agent: {
+                id: stored.targetAgent.id,
+                name: stored.targetAgent.name || String("name" in payload ? payload.name : "")
+              }
             });
             await this.#remember(operationId, method, payload, result);
             return result;
@@ -8941,14 +9916,21 @@ var FleetService = class {
           return null;
         } else if (method === "send") {
           const send = await this.store.getSend(operationId);
+          if (stored.targetAgent === void 0) {
+            const result = this.#notFound(name);
+            await this.#remember(operationId, method, payload, result);
+            return result;
+          }
           if (send === null) {
             await this.store.deleteOperation(operationId);
             await this.store.putOperation({
               operationId,
               method,
               fingerprint,
+              targetName: String("name" in payload ? payload.name : ""),
               state: "pending",
-              result: null
+              result: null,
+              request: payload
             });
             return null;
           }
@@ -8958,6 +9940,11 @@ var FleetService = class {
           });
         } else {
           const compact = await this.store.getCompact(operationId);
+          if (stored.targetAgent === void 0) {
+            const result = this.#notFound(name);
+            await this.#remember(operationId, method, payload, result);
+            return result;
+          }
           if (compact?.state === "completed" && compact.result !== void 0) {
             const target = stored.targetAgent;
             if (target === void 0) {
@@ -9001,12 +9988,14 @@ var FleetService = class {
         operationId,
         method,
         fingerprint,
+        targetName: String("name" in payload ? payload.name : ""),
         state: "pending",
-        result: null
+        result: null,
+        request: payload
       });
       return null;
     }
-    if (recorded.method !== method || recorded.fingerprint !== JSON.stringify(payload)) {
+    if (recorded.method !== method || recorded.fingerprint !== fingerprintPayload(payload)) {
       return err({
         code: "operation_conflict",
         message: `Operation ${operationId} was already used with a different request.`
@@ -9014,26 +10003,63 @@ var FleetService = class {
     }
     return recorded.result;
   }
+  async #rollbackProvisionalCreate(agent, operationId, result) {
+    const operation = await this.store.getOperation(operationId);
+    if (operation === null || operation.method !== "create" || operation.state !== "pending" || operation.targetAgent?.id !== agent.summary.id) {
+      throw new Error("Provisional create operation receipt is missing or inconsistent");
+    }
+    await this.store.rollbackProvisionalCreate(agent.summary.name, {
+      operationId: operation.operationId,
+      method: operation.method,
+      fingerprint: operation.fingerprint,
+      state: "completed",
+      result,
+      targetName: agent.summary.name
+    });
+  }
   async #recordOperationTarget(operationId, agent) {
     const operation = await this.store.getOperation(operationId);
     if (operation === null || operation.state !== "pending") return;
     await this.store.putOperation({
       ...operation,
+      targetName: agent.summary.name,
       targetAgent: { id: agent.summary.id, name: agent.summary.name }
     });
   }
   async #remember(operationId, method, payload, result) {
-    const fingerprint = JSON.stringify(payload);
+    const fingerprint = fingerprintPayload(payload);
     this.#operations.set(operationId, { method, fingerprint, result });
+    const existing = await this.store.getOperation(operationId);
     await this.store.putOperation({
       operationId,
       method,
       fingerprint,
+      targetName: existing?.targetName ?? String("name" in payload ? payload.name : ""),
       state: "completed",
-      result
+      result,
+      ...existing?.targetAgent === void 0 ? {} : { targetAgent: existing.targetAgent }
     });
   }
 };
+function isCreateRequest(request) {
+  return typeof request === "object" && request !== null && "name" in request && typeof request.name === "string";
+}
+function publicAgentFailureCode(code, fallback = "runtime_interrupted") {
+  return isPiFleetErrorCode(code) ? code : fallback;
+}
+function fingerprintPayload(payload) {
+  const durable = { ...payload };
+  delete durable.expectedAgentId;
+  const canonical = JSON.stringify(canonicalizeFingerprintValue(durable));
+  return `sha256:${createHash2("sha256").update(canonical).digest("hex")}`;
+}
+function canonicalizeFingerprintValue(value) {
+  if (Array.isArray(value)) return value.map((item) => canonicalizeFingerprintValue(item));
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, canonicalizeFingerprintValue(item)])
+  );
+}
 function enqueueNamed(lanes, name, operation) {
   const previous = lanes.get(name) ?? Promise.resolve();
   const result = previous.then(operation, operation);
@@ -9048,38 +10074,1260 @@ function enqueueNamed(lanes, name, operation) {
   return result;
 }
 
-// src/store/worker-store.ts
+// src/runtime/journal-ingestion.ts
+var JournalIngestionScheduler = class {
+  #limits;
+  #commit;
+  #pauseAgent;
+  #resumeAgent;
+  #failAgentCallback;
+  #now;
+  #queues = /* @__PURE__ */ new Map();
+  #pendingBytesByAgent = /* @__PURE__ */ new Map();
+  #pausedAgents = /* @__PURE__ */ new Set();
+  #failedAgents = /* @__PURE__ */ new Map();
+  #pendingRecords = 0;
+  #pendingBytes = 0;
+  #roundRobinOffset = 0;
+  #timer = null;
+  #flushPromise = null;
+  #activeOldestEnqueuedAt = null;
+  #closePromise = null;
+  #closed = false;
+  constructor(options) {
+    validateLimits(options.limits);
+    this.#limits = options.limits;
+    this.#commit = options.commit;
+    this.#pauseAgent = options.pauseAgent ?? (() => void 0);
+    this.#resumeAgent = options.resumeAgent ?? (() => void 0);
+    this.#failAgentCallback = options.failAgent ?? (() => void 0);
+    this.#now = options.now ?? Date.now;
+  }
+  get pendingRecords() {
+    return this.#pendingRecords;
+  }
+  get pendingBytes() {
+    return this.#pendingBytes;
+  }
+  get oldestPendingAgeMs() {
+    let oldest = this.#activeOldestEnqueuedAt ?? Number.POSITIVE_INFINITY;
+    for (const queue of this.#queues.values()) {
+      for (const pending of queue) oldest = Math.min(oldest, pending.enqueuedAt);
+    }
+    return oldest === Number.POSITIVE_INFINITY ? 0 : Math.max(0, this.#now() - oldest);
+  }
+  get pausedAgentCount() {
+    return this.#pausedAgents.size;
+  }
+  get failedAgentCount() {
+    return this.#failedAgents.size;
+  }
+  enqueue(record) {
+    if (this.#closed) return Promise.reject(new Error("Journal ingestion is closed"));
+    const priorFailure = this.#failedAgents.get(record.agentId);
+    if (priorFailure !== void 0) return Promise.reject(priorFailure);
+    const ownedRecord = { ...record, bytes: Buffer.from(record.bytes) };
+    const agentBytes = this.#pendingBytesByAgent.get(record.agentId) ?? 0;
+    if (ownedRecord.bytes.length > this.#limits.maxPendingBytesPerAgent || agentBytes + ownedRecord.bytes.length > this.#limits.maxPendingBytesPerAgent || this.#pendingRecords + 1 > this.#limits.maxPendingRecords || this.#pendingBytes + ownedRecord.bytes.length > this.#limits.maxPendingBytes) {
+      const error = new Error("Journal ingestion capacity exceeded");
+      this.#failAgent(record.agentId, error);
+      return Promise.reject(error);
+    }
+    const completion = new Promise((resolve3, reject) => {
+      const queue = this.#queues.get(record.agentId) ?? [];
+      queue.push({ record: ownedRecord, enqueuedAt: this.#now(), resolve: resolve3, reject });
+      this.#queues.set(record.agentId, queue);
+    });
+    this.#pendingRecords += 1;
+    this.#pendingBytes += ownedRecord.bytes.length;
+    const nextAgentBytes = agentBytes + ownedRecord.bytes.length;
+    this.#pendingBytesByAgent.set(record.agentId, nextAgentBytes);
+    this.#refreshPauses();
+    this.#scheduleFlush();
+    return completion;
+  }
+  async drain() {
+    this.#clearTimer();
+    while (this.#pendingRecords > 0) {
+      await this.#flush();
+    }
+  }
+  close() {
+    if (this.#closePromise !== null) return this.#closePromise;
+    this.#closed = true;
+    this.#closePromise = this.drain();
+    return this.#closePromise;
+  }
+  #scheduleFlush() {
+    if (this.#flushPromise !== null) return;
+    if (this.#pendingRecords >= this.#limits.maxBatchRecords || this.#pendingBytes >= this.#limits.maxBatchBytes) {
+      queueMicrotask(() => void this.#flush());
+      return;
+    }
+    if (this.#timer === null) {
+      this.#timer = setTimeout(() => {
+        this.#timer = null;
+        void this.#flush();
+      }, this.#limits.maxBatchAgeMs);
+    }
+  }
+  #flush() {
+    if (this.#flushPromise !== null) return this.#flushPromise;
+    this.#clearTimer();
+    const batch = this.#takeBatch();
+    if (batch.length === 0) return Promise.resolve();
+    this.#activeOldestEnqueuedAt = Math.min(...batch.map((pending) => pending.enqueuedAt));
+    const flushing = Promise.resolve().then(() => this.#commit(batch.map((pending) => pending.record))).then(() => {
+      for (const pending of batch) this.#settle(pending, null);
+    }).catch((cause) => {
+      const error = cause instanceof Error ? cause : new Error(String(cause));
+      const agents = new Set(batch.map((pending) => pending.record.agentId));
+      for (const pending of batch) this.#settle(pending, error, false);
+      for (const agentId of agents) this.#failAgent(agentId, error);
+    }).finally(() => {
+      this.#flushPromise = null;
+      this.#activeOldestEnqueuedAt = null;
+      if (this.#pendingRecords > 0) queueMicrotask(() => void this.#flush());
+    });
+    this.#flushPromise = flushing;
+    return flushing;
+  }
+  #takeBatch() {
+    const agentIds = [...this.#queues.keys()].filter(
+      (agentId2) => (this.#queues.get(agentId2)?.length ?? 0) > 0
+    );
+    if (agentIds.length === 0) return [];
+    const index = this.#roundRobinOffset % agentIds.length;
+    const agentId = agentIds[index];
+    this.#roundRobinOffset = (index + 1) % agentIds.length;
+    const queue = this.#queues.get(agentId);
+    const batchKey = queue[0]?.record.batchKey ?? agentId;
+    const batch = [];
+    let batchBytes = 0;
+    while (batch.length < this.#limits.maxBatchRecords && queue.length > 0) {
+      const next = queue[0];
+      if ((next.record.batchKey ?? agentId) !== batchKey) break;
+      if (batch.length > 0 && batchBytes + next.record.bytes.length > this.#limits.maxBatchBytes) {
+        break;
+      }
+      queue.shift();
+      batch.push(next);
+      batchBytes += next.record.bytes.length;
+    }
+    return batch;
+  }
+  #settle(pending, error, refreshPauses = true) {
+    const { agentId, bytes } = pending.record;
+    this.#pendingRecords -= 1;
+    this.#pendingBytes -= bytes.length;
+    const agentBytes = (this.#pendingBytesByAgent.get(agentId) ?? bytes.length) - bytes.length;
+    if (agentBytes <= 0) this.#pendingBytesByAgent.delete(agentId);
+    else this.#pendingBytesByAgent.set(agentId, agentBytes);
+    if (refreshPauses) this.#refreshPauses();
+    if (error === null) pending.resolve();
+    else pending.reject(error);
+  }
+  #failAgent(agentId, error) {
+    if (this.#failedAgents.has(agentId)) return;
+    this.#failedAgents.set(agentId, error);
+    const queued = this.#queues.get(agentId) ?? [];
+    this.#queues.delete(agentId);
+    for (const pending of queued) this.#settle(pending, error);
+    this.#refreshPauses();
+    this.#failAgentCallback(agentId, error);
+  }
+  #refreshPauses() {
+    const globalHigh = this.#pendingBytes >= Math.max(1, Math.floor(this.#limits.maxPendingBytes * 0.75)) || this.#pendingRecords >= Math.max(1, Math.floor(this.#limits.maxPendingRecords * 0.75));
+    const globalLow = this.#pendingBytes <= Math.floor(this.#limits.maxPendingBytes * 0.5) && this.#pendingRecords <= Math.floor(this.#limits.maxPendingRecords * 0.5);
+    const candidates = /* @__PURE__ */ new Set([...this.#pendingBytesByAgent.keys(), ...this.#pausedAgents]);
+    for (const agentId of candidates) {
+      if (this.#failedAgents.has(agentId)) {
+        this.#pausedAgents.delete(agentId);
+        continue;
+      }
+      const agentBytes = this.#pendingBytesByAgent.get(agentId) ?? 0;
+      const agentHigh = agentBytes >= Math.max(1, Math.floor(this.#limits.maxPendingBytesPerAgent * 0.75));
+      const agentLow = agentBytes <= Math.floor(this.#limits.maxPendingBytesPerAgent * 0.5);
+      if ((globalHigh || agentHigh) && !this.#pausedAgents.has(agentId)) {
+        this.#pausedAgents.add(agentId);
+        this.#pauseAgent(agentId);
+      } else if (globalLow && agentLow && this.#pausedAgents.delete(agentId)) {
+        this.#resumeAgent(agentId);
+      }
+    }
+  }
+  #clearTimer() {
+    if (this.#timer === null) return;
+    clearTimeout(this.#timer);
+    this.#timer = null;
+  }
+};
+function validateLimits(limits) {
+  for (const [name, value] of Object.entries(limits)) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new Error(`${name} must be a positive safe integer`);
+    }
+  }
+}
+
+// src/runtime/lifecycle-projector.ts
+function initialProjectorState() {
+  return { version: 1, messageSequence: 0, finishedThinkingIndexes: [], openActivities: [] };
+}
+function projectLifecycleRecord(state, input, maxOpenActivities) {
+  if (!Number.isSafeInteger(maxOpenActivities) || maxOpenActivities <= 0) {
+    throw new Error("maxOpenActivities must be a positive safe integer");
+  }
+  const frame = asObject(input.frame);
+  if (frame === null) return { events: [], state };
+  if (frame.type === "message_update") {
+    return projectMessageUpdate(state, input, frame, maxOpenActivities);
+  }
+  if (frame.type === "message_end") return projectMessageEnd(state, input, frame);
+  if (frame.type === "tool_execution_start") {
+    return projectToolStart(state, input, frame, maxOpenActivities);
+  }
+  if (frame.type === "tool_execution_end") return projectToolEnd(state, input, frame);
+  return { events: [], state };
+}
+function projectMessageUpdate(state, input, frame, maxOpen) {
+  const update = asObject(frame.assistantMessageEvent ?? frame.event);
+  if (update === null) return { events: [], state };
+  const contentIndex = integer(update.contentIndex);
+  if (contentIndex === null) return { events: [], state };
+  if (update.type === "thinking_delta") {
+    return projectThinkingDelta(state, input, contentIndex, text(update.delta), maxOpen);
+  }
+  if (update.type === "thinking_end") {
+    return projectThinkingEnd(state, input, contentIndex, text(update.content), maxOpen);
+  }
+  if (update.type === "text_delta") {
+    return projectTextStart(state, input, text(update.delta), maxOpen);
+  }
+  if (update.type === "text_end") {
+    return projectTextStart(state, input, text(update.content), maxOpen);
+  }
+  return { events: [], state };
+}
+function projectThinkingDelta(state, input, contentIndex, delta, maxOpen) {
+  if (delta === null) return { events: [], state };
+  if (state.finishedThinkingIndexes.includes(contentIndex)) return { events: [], state };
+  const existing = findThinking(state, contentIndex);
+  if (existing !== void 0) {
+    return {
+      events: [],
+      state: replaceActivity(state, existing, { ...existing, text: existing.text + delta })
+    };
+  }
+  if (!meaningful(delta)) return { events: [], state };
+  const activityId = activityIdFor(input, `thinking:${state.messageSequence}:${contentIndex}`);
+  const activity = {
+    kind: "thinking",
+    activityId,
+    messageSequence: state.messageSequence,
+    contentIndex,
+    text: delta
+  };
+  const next = addActivity(state, activity, maxOpen);
+  return { events: [event(input, activityId, 0, "assistant.thinking.started")], state: next };
+}
+function projectThinkingEnd(state, input, contentIndex, completeText, maxOpen) {
+  if (state.finishedThinkingIndexes.includes(contentIndex)) return { events: [], state };
+  const existing = findThinking(state, contentIndex);
+  if (!meaningful(completeText)) {
+    if (existing !== void 0) {
+      throw new Error("Lifecycle projector finalized thinking contradicts its started activity");
+    }
+    return { events: [], state: markThinkingFinished(state, contentIndex, maxOpen) };
+  }
+  const activityId = existing?.activityId ?? activityIdFor(input, `thinking:${state.messageSequence}:${contentIndex}`);
+  const started = existing === void 0 ? [event(input, activityId, 0, "assistant.thinking.started")] : [];
+  const finished = event(input, activityId, started.length, "assistant.thinking.finished", {
+    text: completeText
+  });
+  return {
+    events: [...started, finished],
+    state: finishThinking(state, activityId, contentIndex, maxOpen)
+  };
+}
+function projectTextStart(state, input, content, maxOpen) {
+  if (!meaningful(content) || findMessage(state) !== void 0) return { events: [], state };
+  const activityId = activityIdFor(input, `message:${state.messageSequence}`);
+  const activity = {
+    kind: "message",
+    activityId,
+    messageSequence: state.messageSequence
+  };
+  return {
+    events: [event(input, activityId, 0, "assistant.message.started")],
+    state: addActivity(state, activity, maxOpen)
+  };
+}
+function projectMessageEnd(state, input, frame) {
+  const completeText = assistantText(frame.message ?? asObject(frame.data)?.message);
+  const existing = findMessage(state);
+  const unfinishedThinking = state.openActivities.find(
+    (activity) => activity.kind === "thinking" && activity.messageSequence === state.messageSequence
+  );
+  if (unfinishedThinking !== void 0) {
+    throw new Error("Lifecycle projector completed message omits a finished thinking activity");
+  }
+  if (existing !== void 0 && !meaningful(completeText)) {
+    throw new Error("Lifecycle projector finalized message contradicts its started activity");
+  }
+  const events = [];
+  let subposition = 0;
+  let activityId = existing?.activityId;
+  if (meaningful(completeText)) {
+    if (activityId === void 0) {
+      activityId = activityIdFor(input, `message:${state.messageSequence}`);
+      events.push(event(input, activityId, subposition++, "assistant.message.started"));
+    }
+    events.push(
+      event(input, activityId, subposition, "assistant.message.finished", { text: completeText })
+    );
+  }
+  return {
+    events,
+    state: {
+      version: 1,
+      messageSequence: state.messageSequence + 1,
+      finishedThinkingIndexes: [],
+      openActivities: state.openActivities.filter(
+        (activity) => activity.kind === "tool" || activity.messageSequence !== state.messageSequence
+      )
+    }
+  };
+}
+function projectToolStart(state, input, frame, maxOpen) {
+  const callId = text(frame.toolCallId);
+  const name = text(frame.toolName);
+  if (callId === null || name === null || findTool(state, callId) !== void 0) {
+    return { events: [], state };
+  }
+  const activityId = activityIdFor(input, `tool:${callId}`);
+  const activity = {
+    kind: "tool",
+    activityId,
+    callId,
+    name,
+    input: frame.args
+  };
+  return {
+    events: [
+      event(input, activityId, 0, "tool.execution.started", {
+        tool: { callId, name, input: frame.args }
+      })
+    ],
+    state: addActivity(state, activity, maxOpen)
+  };
+}
+function projectToolEnd(state, input, frame) {
+  const callId = text(frame.toolCallId);
+  if (callId === null) return { events: [], state };
+  const existing = findTool(state, callId);
+  if (existing === void 0) return { events: [], state };
+  return {
+    events: [
+      event(input, existing.activityId, 0, "tool.execution.finished", {
+        tool: {
+          callId,
+          name: existing.name,
+          input: existing.input,
+          output: frame.result,
+          isError: frame.isError === true
+        }
+      })
+    ],
+    state: removeActivity(state, existing.activityId)
+  };
+}
+function event(input, activityId, subposition, type, payload = {}) {
+  const id = `${input.agentId}:${input.epoch}:${input.rawPosition}:${subposition}`;
+  return {
+    id,
+    activityId,
+    agentId: input.agentId,
+    cursor: id,
+    epoch: input.epoch,
+    sourceRawPosition: input.rawPosition,
+    observedAt: input.observedAt,
+    type,
+    ...payload
+  };
+}
+function activityIdFor(input, suffix) {
+  return `${input.agentId}:${input.epoch}:${suffix}:${input.rawPosition}`;
+}
+function findThinking(state, contentIndex) {
+  return state.openActivities.find(
+    (activity) => activity.kind === "thinking" && activity.messageSequence === state.messageSequence && activity.contentIndex === contentIndex
+  );
+}
+function findMessage(state) {
+  return state.openActivities.find(
+    (activity) => activity.kind === "message" && activity.messageSequence === state.messageSequence
+  );
+}
+function findTool(state, callId) {
+  return state.openActivities.find(
+    (activity) => activity.kind === "tool" && activity.callId === callId
+  );
+}
+function addActivity(state, activity, maxOpen) {
+  if (state.openActivities.length >= maxOpen) {
+    throw new Error("Lifecycle projector open activity capacity exceeded");
+  }
+  return { ...state, openActivities: [...state.openActivities, activity] };
+}
+function replaceActivity(state, current, replacement) {
+  return {
+    ...state,
+    openActivities: state.openActivities.map(
+      (activity) => activity.activityId === current.activityId ? replacement : activity
+    )
+  };
+}
+function removeActivity(state, activityId) {
+  return {
+    ...state,
+    openActivities: state.openActivities.filter((activity) => activity.activityId !== activityId)
+  };
+}
+function finishThinking(state, activityId, contentIndex, maxTracked) {
+  return markThinkingFinished(removeActivity(state, activityId), contentIndex, maxTracked);
+}
+function markThinkingFinished(state, contentIndex, maxTracked) {
+  if (state.finishedThinkingIndexes.length >= maxTracked) {
+    throw new Error("Lifecycle projector completed thinking capacity exceeded");
+  }
+  return {
+    ...state,
+    finishedThinkingIndexes: [...state.finishedThinkingIndexes, contentIndex]
+  };
+}
+function meaningful(value) {
+  return value !== null && /\S/u.test(value);
+}
+function assistantText(value) {
+  const message = asObject(value);
+  if (message === null || message.role !== "assistant" || !Array.isArray(message.content))
+    return null;
+  return message.content.map((part) => asObject(part)).filter((part) => part?.type === "text").map((part) => text(part.text) ?? "").join("");
+}
+function asObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function text(value) {
+  return typeof value === "string" ? value : null;
+}
+function integer(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+
+// src/runtime/runtime-diagnostics.ts
+import { stat as stat2 } from "node:fs/promises";
+async function collectRuntimeJournalDiagnostics(options) {
+  const storage = await options.store.getDiagnostics();
+  const [databaseBytes, walBytes, shmBytes] = await Promise.all([
+    fileBytes(options.databasePath),
+    fileBytes(`${options.databasePath}-wal`),
+    fileBytes(`${options.databasePath}-shm`)
+  ]);
+  return {
+    files: { databaseBytes, walBytes, shmBytes },
+    retained: {
+      agentCount: storage.agentCount,
+      rawRecordCount: storage.rawRecordCount,
+      rawBytes: storage.rawBytes,
+      semanticEventCount: storage.semanticEventCount
+    },
+    retainedByAgent: storage.retainedByAgent,
+    ingestion: {
+      pendingRecords: options.ingestion.pendingRecords,
+      pendingBytes: options.ingestion.pendingBytes,
+      oldestPendingAgeMs: options.ingestion.oldestPendingAgeMs,
+      pausedAgentCount: options.ingestion.pausedAgentCount,
+      failedAgentCount: options.ingestion.failedAgentCount
+    },
+    append: {
+      state: storage.storageState,
+      lastCommitAt: storage.lastCommitAt,
+      lastDurationMs: storage.lastAppendDurationMs
+    },
+    openProjectorActivities: storage.openProjectorActivities,
+    activeReceiveStreams: options.activeReceiveStreams,
+    activeReplayReads: options.activeReplayReads,
+    checkpoint: storage.maintenance,
+    continuityGapCount: storage.continuityGapCount,
+    continuityUncertain: storage.continuityGapCount > 0
+  };
+}
+async function fileBytes(path) {
+  const value = await stat2(path).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  return value?.size ?? 0;
+}
+
+// src/runtime/journal-runtime.ts
+var JournalRuntimeComposition = class {
+  receive;
+  ingestion;
+  #framers = /* @__PURE__ */ new Map();
+  #activeIncarnationsByAgent = /* @__PURE__ */ new Map();
+  #store;
+  #limits;
+  #now;
+  #notifyEvents;
+  #cursors;
+  #activeReceiveStreams = 0;
+  #activeReplayReads = 0;
+  constructor(options) {
+    this.#store = options.store;
+    this.#limits = options.limits;
+    this.#now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+    this.#notifyEvents = options.notifyEvents ?? defaultNotifyEvents(options.wakeup);
+    this.#cursors = options.cursors;
+    this.ingestion = new JournalIngestionScheduler({
+      limits: journalIngestionLimitsFromRuntime(options.limits),
+      commit: (records) => this.#commit(records.map((record) => record.value)),
+      ...options.pauseAgent === void 0 ? {} : { pauseAgent: options.pauseAgent },
+      ...options.resumeAgent === void 0 ? {} : { resumeAgent: options.resumeAgent },
+      ...options.failAgent === void 0 ? {} : { failAgent: options.failAgent }
+    });
+    this.receive = new ReceivePager(
+      options.store,
+      options.cursors,
+      options.wakeup,
+      receivePagerLimitsFromRuntime(options.limits),
+      {
+        onReadStart: () => {
+          this.#activeReplayReads += 1;
+        },
+        onReadEnd: () => {
+          this.#activeReplayReads -= 1;
+        }
+      }
+    );
+  }
+  async openIncarnation(options) {
+    if (this.#framers.has(options.incarnationId)) {
+      throw new Error("Journal incarnation sink already exists");
+    }
+    await this.#store.beginIncarnation(
+      options.agentId,
+      options.incarnationId,
+      options.epoch,
+      initialProjectorState()
+    );
+    const framer = new RpcRecordFramer(this.#limits.maxJournalPartialRecordBytes);
+    this.#framers.set(options.incarnationId, framer);
+    this.#activeIncarnationsByAgent.set(options.agentId, {
+      incarnationId: options.incarnationId,
+      epoch: options.epoch
+    });
+    let finished = false;
+    const pushRecord = async (record) => {
+      if (finished) throw new Error("Journal incarnation sink is finished");
+      if (record.length === 0 || record.at(-1) !== 10) {
+        throw new Error("Journal incarnation sink requires a complete LF-terminated record");
+      }
+      const bytes = Buffer.from(record);
+      await this.ingestion.enqueue({
+        agentId: options.agentId,
+        batchKey: `${options.agentId}:${options.epoch}:${options.incarnationId}`,
+        bytes,
+        value: {
+          ...options,
+          observedAt: this.#now(),
+          bytes
+        }
+      });
+    };
+    return {
+      push: async (chunk) => {
+        await Promise.all(framer.push(chunk).map((record) => pushRecord(record)));
+      },
+      pushRecord,
+      finish: () => {
+        if (finished) throw new Error("Journal incarnation sink is finished");
+        finished = true;
+        this.#framers.delete(options.incarnationId);
+        const active = this.#activeIncarnationsByAgent.get(options.agentId);
+        if (active?.incarnationId === options.incarnationId) {
+          this.#activeIncarnationsByAgent.delete(options.agentId);
+        }
+        return framer.finish();
+      }
+    };
+  }
+  async openReceive(agentId, start, signal) {
+    if (this.#activeReceiveStreams >= this.#limits.maxReceiveStreams) {
+      const error = new Error("Receive stream capacity exceeded");
+      error.code = "receive_resource_exhausted";
+      throw error;
+    }
+    const stream = await this.receive.open(agentId, start, signal);
+    this.#activeReceiveStreams += 1;
+    let released = false;
+    let iteratorCreated = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      signal.removeEventListener("abort", release);
+      this.#activeReceiveStreams -= 1;
+    };
+    signal.addEventListener("abort", release, { once: true });
+    if (signal.aborted) release();
+    return {
+      cursor: stream.cursor,
+      [Symbol.asyncIterator]: () => {
+        if (iteratorCreated) throw new Error("Receive stream can only be iterated once");
+        iteratorCreated = true;
+        const iterator = stream[Symbol.asyncIterator]();
+        return {
+          next: async () => {
+            try {
+              const result = await iterator.next();
+              if (result.done) release();
+              return result;
+            } catch (error) {
+              release();
+              throw error;
+            }
+          },
+          return: async () => {
+            release();
+            return iterator.return?.() ?? { done: true, value: void 0 };
+          },
+          throw: async (error) => {
+            release();
+            if (iterator.throw !== void 0) return iterator.throw(error);
+            throw error;
+          }
+        };
+      }
+    };
+  }
+  decodeCursorPosition(cursor) {
+    return this.#cursors.decode(cursor).position;
+  }
+  async eventHighWater(agentId) {
+    return (await this.#store.getHighWater(agentId))?.eventPosition ?? 0;
+  }
+  async idleEventHighWater(agentId) {
+    return (await this.#store.getHighWater(agentId))?.idleEventPosition ?? null;
+  }
+  async markIdle(agentId) {
+    const epochs = await this.#store.getEpochs(agentId);
+    const epoch = epochs.findLast((candidate) => candidate.state === "open");
+    if (epoch === void 0) throw new Error("Agent has no open continuity epoch");
+    const idleEventPosition = await this.#store.markIdle(agentId, epoch.epoch);
+    this.#notifyEvents(agentId, idleEventPosition);
+    return idleEventPosition;
+  }
+  get activeReceiveStreams() {
+    return this.#activeReceiveStreams;
+  }
+  get activeReplayReads() {
+    return this.#activeReplayReads;
+  }
+  diagnostics(databasePath) {
+    return collectRuntimeJournalDiagnostics({
+      store: this.#store,
+      databasePath,
+      ingestion: this.ingestion,
+      activeReceiveStreams: this.#activeReceiveStreams,
+      activeReplayReads: this.#activeReplayReads
+    });
+  }
+  closeIngestion() {
+    return this.ingestion.close();
+  }
+  async #commit(candidates) {
+    const first = candidates[0];
+    if (first === void 0) return;
+    if (candidates.some(
+      (candidate) => candidate.agentId !== first.agentId || candidate.epoch !== first.epoch || candidate.incarnationId !== first.incarnationId
+    )) {
+      throw new Error("Journal ingestion batch crosses an agent, incarnation, or continuity epoch");
+    }
+    const current = await this.#store.getHighWater(first.agentId) ?? { rawPosition: 0, eventPosition: 0, idleEventPosition: null };
+    let nextState = await this.#store.getProjectorState(first.agentId, first.incarnationId, first.epoch) ?? initialProjectorState();
+    let rawPosition = current.rawPosition;
+    let eventPosition = current.eventPosition;
+    const records = [];
+    const events = [];
+    let projectionError = null;
+    for (const candidate of candidates) {
+      rawPosition += 1;
+      records.push({
+        agentId: candidate.agentId,
+        incarnationId: candidate.incarnationId,
+        position: rawPosition,
+        observedAt: candidate.observedAt,
+        bytes: candidate.bytes
+      });
+      if (projectionError !== null) continue;
+      try {
+        const result = projectLifecycleRecord(
+          nextState,
+          {
+            agentId: candidate.agentId,
+            epoch: candidate.epoch,
+            rawPosition,
+            observedAt: candidate.observedAt,
+            frame: decodeRecord(candidate.bytes)
+          },
+          this.#limits.maxOpenProjectorActivities
+        );
+        if (result.events.some(
+          (event2) => Buffer.byteLength(JSON.stringify(event2)) > this.#limits.maxPiFrameBytes
+        )) {
+          throw new Error("Semantic event exceeds the configured storage limit");
+        }
+        nextState = result.state;
+        for (const event2 of result.events) {
+          eventPosition += 1;
+          events.push({ agentId: candidate.agentId, position: eventPosition, event: event2 });
+        }
+      } catch (error) {
+        projectionError = error instanceof Error ? error : new Error(String(error));
+      }
+    }
+    const append = {
+      agentId: first.agentId,
+      incarnationId: first.incarnationId,
+      epoch: first.epoch,
+      records,
+      events,
+      projectorState: nextState,
+      highWater: {
+        rawPosition,
+        eventPosition,
+        idleEventPosition: current.idleEventPosition
+      }
+    };
+    await this.#store.append(append);
+    if (events.length > 0) this.#notifyEvents(first.agentId, eventPosition);
+    if (projectionError !== null) throw projectionError;
+  }
+};
+function journalIngestionLimitsFromRuntime(limits) {
+  return {
+    maxPendingRecords: limits.maxJournalPendingRecords,
+    maxPendingBytes: limits.maxJournalPendingBytes,
+    maxPendingBytesPerAgent: limits.maxJournalPendingBytesPerAgent,
+    maxBatchRecords: limits.maxJournalBatchRecords,
+    maxBatchBytes: limits.maxJournalBatchBytes,
+    maxBatchAgeMs: limits.maxJournalBatchAgeMs
+  };
+}
+function receivePagerLimitsFromRuntime(limits) {
+  return {
+    maxRows: limits.maxReceiveReplayRows,
+    maxBytes: limits.maxReceiveReplayBytes,
+    maxEventBytes: limits.maxPiFrameBytes
+  };
+}
+function decodeRecord(bytes) {
+  let end = bytes.length;
+  if (end === 0 || bytes[end - 1] !== 10) throw new Error("RPC record is not LF terminated");
+  end -= 1;
+  if (end > 0 && bytes[end - 1] === 13) end -= 1;
+  const text2 = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, end));
+  return JSON.parse(text2);
+}
+function defaultNotifyEvents(wakeup) {
+  const candidate = wakeup;
+  if (typeof candidate.notify !== "function") {
+    throw new Error("Journal composition requires a notifiable receive wakeup");
+  }
+  const notify = candidate.notify.bind(wakeup);
+  return (agentId, position) => notify(agentId, position);
+}
+
+// src/runtime/journal-wakeup.ts
+var JournalWakeup = class {
+  #positions = /* @__PURE__ */ new Map();
+  #waiters = /* @__PURE__ */ new Map();
+  #failures = /* @__PURE__ */ new Map();
+  #closedError = null;
+  notify(agentId, position) {
+    if (this.#closedError !== null) return;
+    this.#positions.set(agentId, Math.max(this.#positions.get(agentId) ?? 0, position));
+    const waiters = this.#waiters.get(agentId);
+    if (waiters === void 0) return;
+    for (const waiter of [...waiters]) {
+      if (position <= waiter.afterPosition) continue;
+      waiter.signal.removeEventListener("abort", waiter.onAbort);
+      waiters.delete(waiter);
+      waiter.resolve();
+    }
+    if (waiters.size === 0) this.#waiters.delete(agentId);
+  }
+  waitForEvents(agentId, afterPosition, signal) {
+    if (this.#closedError !== null) return Promise.reject(this.#closedError);
+    const failure = this.#failures.get(agentId);
+    if (failure !== void 0) return Promise.reject(failure);
+    if ((this.#positions.get(agentId) ?? 0) > afterPosition) return Promise.resolve();
+    if (signal.aborted) return Promise.reject(new Error("Receive cancelled"));
+    return new Promise((resolve3, reject) => {
+      const waiters = this.#waiters.get(agentId) ?? /* @__PURE__ */ new Set();
+      const waiter = {
+        afterPosition,
+        resolve: resolve3,
+        reject,
+        signal,
+        onAbort: () => {
+          waiters.delete(waiter);
+          if (waiters.size === 0) this.#waiters.delete(agentId);
+          reject(new Error("Receive cancelled"));
+        }
+      };
+      waiters.add(waiter);
+      this.#waiters.set(agentId, waiters);
+      signal.addEventListener("abort", waiter.onAbort, { once: true });
+      const racedFailure = this.#failures.get(agentId);
+      if (racedFailure !== void 0) {
+        signal.removeEventListener("abort", waiter.onAbort);
+        waiters.delete(waiter);
+        if (waiters.size === 0) this.#waiters.delete(agentId);
+        reject(racedFailure);
+      } else if ((this.#positions.get(agentId) ?? 0) > afterPosition) {
+        signal.removeEventListener("abort", waiter.onAbort);
+        waiters.delete(waiter);
+        if (waiters.size === 0) this.#waiters.delete(agentId);
+        resolve3();
+      }
+    });
+  }
+  failAgent(agentId, error) {
+    this.#failures.set(agentId, error);
+    const waiters = this.#waiters.get(agentId);
+    if (waiters === void 0) return;
+    for (const waiter of waiters) {
+      waiter.signal.removeEventListener("abort", waiter.onAbort);
+      waiter.reject(error);
+    }
+    this.#waiters.delete(agentId);
+  }
+  close(error = new Error("Runtime unavailable")) {
+    if (this.#closedError !== null) return;
+    this.#closedError = error;
+    for (const waiters of this.#waiters.values()) {
+      for (const waiter of waiters) {
+        waiter.signal.removeEventListener("abort", waiter.onAbort);
+        waiter.reject(error);
+      }
+    }
+    this.#waiters.clear();
+  }
+};
+
+// src/runtime/storage-health.ts
+var CleanDrainCoordinator = class {
+  constructor(steps) {
+    this.steps = steps;
+  }
+  #closing = null;
+  close() {
+    this.#closing ??= this.#run();
+    return this.#closing;
+  }
+  async #run() {
+    const steps = [
+      () => this.steps.stopAdmission(),
+      () => this.steps.drainStdoutAndJournal(),
+      () => this.steps.closeReceivers(),
+      () => this.steps.stopProcessTrees(),
+      () => this.steps.closeServer(),
+      () => this.steps.closeStore()
+    ];
+    let firstError;
+    for (const step of steps) {
+      try {
+        await step();
+      } catch (error) {
+        firstError ??= error;
+      }
+    }
+    if (firstError !== void 0) throw firstError;
+  }
+};
+
+// src/store/journal-fleet-store-adapter.ts
+var JournalFleetStoreAdapter = class {
+  constructor(journal) {
+    this.journal = journal;
+  }
+  async createAgent(agent, operation) {
+    if (operation === void 0) return this.journal.createAgent(toJournalAgent(agent));
+    return this.journal.createAgentWithOperation(
+      toJournalAgent(agent),
+      toJournalOperation(operation, agent.summary.id)
+    );
+  }
+  async getAgent(name) {
+    return fromJournalAgent(await this.journal.getAgentByName(name));
+  }
+  async listAgents() {
+    return (await this.journal.listAgents()).map((agent) => fromJournalAgent(agent));
+  }
+  putAgent(agent) {
+    return this.journal.putAgent(toJournalAgent(agent));
+  }
+  async rollbackProvisionalCreate(name, completedOperation) {
+    const existing = await this.journal.getAgentByName(name);
+    if (existing === null) return null;
+    return fromJournalAgent(
+      await this.journal.rollbackProvisionalCreate(
+        existing.agentId,
+        toJournalOperation(completedOperation, void 0)
+      )
+    );
+  }
+  async deleteAgent(name, receipt) {
+    const existing = await this.journal.getAgentByName(name);
+    if (existing === null) return null;
+    const destroyed = await this.journal.destroyAgent(existing.agentId, {
+      operationId: receipt?.operationId ?? `rollback:${existing.agentId}`,
+      agentId: existing.agentId,
+      agentName: existing.name,
+      fingerprint: receipt?.fingerprint ?? "rollback",
+      destroyedAt: receipt?.destroyedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      status: "destroyed"
+    });
+    return fromJournalAgent(destroyed);
+  }
+  async getOperation(operationId) {
+    const operation = await this.journal.getOperation(operationId);
+    if (operation !== null) return fromJournalOperation(operation);
+    const receipt = await this.journal.getDestroyReceipt(operationId);
+    if (receipt === null) return null;
+    return {
+      operationId,
+      method: "destroy",
+      fingerprint: receipt.fingerprint,
+      state: "completed",
+      result: {
+        ok: true,
+        value: {
+          schemaVersion: 1,
+          type: "agent.destroyed",
+          agent: { id: receipt.agentId, name: receipt.agentName }
+        }
+      },
+      targetName: receipt.agentName,
+      targetAgent: { id: receipt.agentId, name: receipt.agentName }
+    };
+  }
+  async putOperation(operation) {
+    if (operation.method === "destroy" && operation.state === "completed" && await this.journal.getDestroyReceipt(operation.operationId) !== null) {
+      return;
+    }
+    await this.journal.putOperation(
+      toJournalOperation(operation, operation.targetAgent?.id)
+    );
+  }
+  async listPendingOperations() {
+    return (await this.journal.listPendingOperations()).map(
+      (operation) => fromJournalOperation(operation)
+    );
+  }
+  async deleteOperation(operationId) {
+    await this.journal.deleteOperation(operationId);
+  }
+  async getSend(sendId) {
+    return fromJournalSend(
+      await this.journal.getSend(sendId),
+      await this.#agentNameForSend(sendId)
+    );
+  }
+  async nextSendOrdinal(agentName) {
+    const agent = await this.#requireAgentByName(agentName);
+    return this.journal.nextSendOrdinal(agent.agentId);
+  }
+  async putSend(send) {
+    const agent = await this.#requireAgentByName(send.agentName);
+    if (send.agentId === void 0 || agent.agentId !== send.agentId) {
+      throw new Error("Send is missing its immutable agent generation");
+    }
+    await this.journal.putSend({
+      sendId: send.sendId,
+      agentId: send.agentId,
+      ordinal: send.ordinal ?? await this.journal.nextSendOrdinal(agent.agentId),
+      message: send.message,
+      delivery: send.delivery ?? "steer",
+      state: send.state,
+      acceptedAt: send.acceptedAt
+    });
+  }
+  async listNonterminalSends() {
+    const sends = await this.journal.listNonterminalSends();
+    return Promise.all(
+      sends.map(async (send) => {
+        const agent = await this.journal.getAgentById(send.agentId);
+        if (agent === null) throw new Error("Send targets a deleted agent generation");
+        return fromJournalSend(send, agent.name);
+      })
+    );
+  }
+  async getCompact(compactId) {
+    const compact = await this.journal.getCompact(compactId);
+    if (compact === null) return null;
+    const agent = await this.journal.getAgentById(compact.agentId);
+    if (agent === null) return null;
+    return fromJournalCompact(compact, agent.name);
+  }
+  async putCompact(compact) {
+    const agent = await this.#requireAgentByName(compact.agentName);
+    if (compact.agentId === void 0 || agent.agentId !== compact.agentId) {
+      throw new Error("Compaction is missing its immutable agent generation");
+    }
+    await this.journal.putCompact({
+      compactId: compact.compactId,
+      agentId: compact.agentId,
+      state: compact.state,
+      requestedAt: compact.requestedAt,
+      ...compact.result === void 0 ? {} : { result: compact.result },
+      ...compact.error === void 0 ? {} : { error: compact.error }
+    });
+  }
+  async listNonterminalCompacts() {
+    const compacts = await this.journal.listNonterminalCompacts();
+    return Promise.all(
+      compacts.map(async (compact) => {
+        const agent = await this.journal.getAgentById(compact.agentId);
+        if (agent === null) throw new Error("Compaction targets a deleted agent generation");
+        return fromJournalCompact(compact, agent.name);
+      })
+    );
+  }
+  async putIncarnation(incarnation) {
+    const agent = await this.#requireAgentByName(incarnation.agentName);
+    if (incarnation.agentId === void 0 || agent.agentId !== incarnation.agentId) {
+      throw new Error("Incarnation is missing its immutable agent generation");
+    }
+    await this.journal.putIncarnation({
+      incarnationId: incarnation.incarnationId,
+      agentId: incarnation.agentId,
+      pid: incarnation.pid,
+      state: incarnation.state
+    });
+  }
+  async listActiveIncarnations() {
+    const incarnations = await this.journal.listActiveIncarnations();
+    return Promise.all(
+      incarnations.map(async (incarnation) => {
+        const agent = await this.journal.getAgentById(incarnation.agentId);
+        if (agent === null) throw new Error("Incarnation targets a deleted agent generation");
+        return {
+          incarnationId: incarnation.incarnationId,
+          agentId: incarnation.agentId,
+          agentName: agent.name,
+          pid: incarnation.pid,
+          state: incarnation.state
+        };
+      })
+    );
+  }
+  close() {
+    return this.journal.close();
+  }
+  async #requireAgentByName(name) {
+    const agent = await this.journal.getAgentByName(name);
+    if (agent === null) throw new Error(`Agent ${name} no longer exists`);
+    return agent;
+  }
+  async #agentNameForSend(sendId) {
+    const send = await this.journal.getSend(sendId);
+    if (send === null) return null;
+    return (await this.journal.getAgentById(send.agentId))?.name ?? null;
+  }
+};
+function toJournalAgent(agent) {
+  return {
+    agentId: agent.summary.id,
+    name: agent.summary.name,
+    summary: agent.summary,
+    launch: agent.launch
+  };
+}
+function fromJournalAgent(agent) {
+  if (agent === null) return null;
+  return {
+    summary: agent.summary,
+    launch: agent.launch
+  };
+}
+function fromJournalOperation(operation) {
+  return {
+    operationId: operation.operationId,
+    method: operation.method,
+    fingerprint: operation.fingerprint,
+    state: operation.state,
+    result: operation.result,
+    targetName: operation.targetName,
+    ...operation.agentId === null ? {} : { targetAgent: { id: operation.agentId, name: operation.targetName } },
+    ...operation.state === "pending" && operation.request !== void 0 ? { request: operation.request } : {}
+  };
+}
+function toJournalOperation(operation, targetId) {
+  return {
+    operationId: operation.operationId,
+    agentId: targetId ?? null,
+    targetName: operation.targetName ?? operation.targetAgent?.name ?? "",
+    method: operation.method,
+    fingerprint: operation.fingerprint,
+    state: operation.state,
+    result: operation.result,
+    ...operation.state === "pending" && operation.request !== void 0 ? { request: operation.request } : {}
+  };
+}
+function fromJournalSend(send, name) {
+  if (send === null || name === null) return null;
+  return {
+    sendId: send.sendId,
+    agentId: send.agentId,
+    agentName: name,
+    ordinal: send.ordinal,
+    message: send.message,
+    delivery: send.delivery,
+    state: send.state,
+    acceptedAt: send.acceptedAt
+  };
+}
+function fromJournalCompact(compact, name) {
+  return {
+    compactId: compact.compactId,
+    agentId: compact.agentId,
+    agentName: name,
+    state: compact.state,
+    requestedAt: compact.requestedAt,
+    ...compact.result === void 0 ? {} : { result: compact.result },
+    ...compact.error === void 0 ? {} : { error: compact.error }
+  };
+}
+
+// src/store/sqlite-journal-store.ts
+import { DatabaseSync } from "node:sqlite";
+var JOURNAL_SCHEMA_VERSION = 3;
+var JOURNAL_SCHEMA_CHECKSUM = "003_uuid_journal_v3";
+var LEGACY_JOURNAL_SCHEMA_CHECKSUMS = /* @__PURE__ */ new Map([
+  [1, "001_initial_v1"],
+  [2, "002_compact_v1"]
+]);
+function classifyJournalMigrationRows(rows) {
+  if (rows.length === 0) return "fresh";
+  for (const row of rows) {
+    if (!Number.isSafeInteger(row.version) || typeof row.checksum !== "string") {
+      throw new Error("pi-fleet database migration ledger is malformed");
+    }
+  }
+  if (rows.length === 1 && rows[0]?.version === JOURNAL_SCHEMA_VERSION) {
+    if (rows[0].checksum !== JOURNAL_SCHEMA_CHECKSUM) {
+      throw new Error(
+        `pi-fleet database migration ${String(JOURNAL_SCHEMA_VERSION)} checksum mismatch`
+      );
+    }
+    return "current";
+  }
+  const legacyOne = rows.length === 1 && rows[0]?.version === 1;
+  const legacyTwo = rows.length === 2 && rows[0]?.version === 1 && rows[1]?.version === 2;
+  if (legacyOne || legacyTwo) {
+    for (const row of rows) {
+      if (LEGACY_JOURNAL_SCHEMA_CHECKSUMS.get(row.version) !== row.checksum) {
+        throw new Error(`pi-fleet database migration ${String(row.version)} checksum mismatch`);
+      }
+    }
+    return "legacy";
+  }
+  const newer = rows.find((row) => row.version > JOURNAL_SCHEMA_VERSION);
+  if (newer !== void 0) {
+    throw new Error(`pi-fleet database schema ${String(newer.version)} is newer than this runtime`);
+  }
+  throw new Error("pi-fleet database migration ledger sequence is invalid");
+}
+
+// src/store/worker-journal-store.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { Worker } from "node:worker_threads";
-var WorkerFleetStore = class {
+
+// src/store/journal-worker-protocol.ts
+function isJournalWorkerResponse(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const response = value;
+  return typeof response.id === "string" && typeof response.ok === "boolean" && (response.error === void 0 || typeof response.error === "string");
+}
+
+// src/store/worker-journal-store.ts
+var WRITE_METHODS = /* @__PURE__ */ new Set([
+  "createAgent",
+  "createAgentWithOperation",
+  "rollbackProvisionalCreate",
+  "putAgent",
+  "putOperation",
+  "deleteOperation",
+  "putSend",
+  "putCompact",
+  "putIncarnation",
+  "putEpoch",
+  "beginIncarnation",
+  "append",
+  "markIdle",
+  "destroyAgent",
+  "maintain",
+  "close"
+]);
+var WorkerJournalStore = class {
   #worker;
-  #pending = /* @__PURE__ */ new Map();
+  #maxPending;
+  #onHealthFailure;
+  #writes = [];
+  #reads = [];
+  #readerIds = /* @__PURE__ */ new Set();
+  #active = null;
+  #closing = false;
   #closed = false;
+  #closePromise = null;
+  #terminationPromise = null;
   #failure = null;
-  constructor(path, workerUrl = new URL("./sqlite-worker.mjs", import.meta.url)) {
-    this.#worker = new Worker(workerUrl, { workerData: { path } });
-    this.#worker.on("message", (value) => {
-      if (!isWorkerResponse(value)) {
-        this.#fail(new Error("SQLite worker returned a malformed response"));
-        void this.#worker.terminate();
-        return;
+  constructor(path, options = {}) {
+    this.#maxPending = options.maxPending ?? DEFAULT_RUNTIME_LIMITS.maxJournalPendingRecords;
+    if (!Number.isSafeInteger(this.#maxPending) || this.#maxPending <= 0) {
+      throw new Error("Journal worker maxPending must be a positive integer");
+    }
+    this.#onHealthFailure = options.onHealthFailure;
+    this.#worker = options.worker ?? new Worker(options.workerUrl ?? new URL("./journal-sqlite-worker.mjs", import.meta.url), {
+      workerData: {
+        path,
+        checkpointCommitInterval: options.checkpointCommitInterval ?? DEFAULT_RUNTIME_LIMITS.journalCheckpointCommitInterval,
+        reclaimPagesPerPass: options.reclaimPagesPerPass ?? DEFAULT_RUNTIME_LIMITS.journalReclaimPagesPerPass
       }
-      const pending = this.#pending.get(value.id);
-      if (pending === void 0) return;
-      this.#pending.delete(value.id);
-      if (value.ok) pending.resolve(value.value);
-      else pending.reject(new Error(value.error ?? "SQLite worker failed"));
     });
+    this.#worker.on("message", (value) => this.#handleResponse(value));
     this.#worker.on("error", (error) => this.#fail(error));
     this.#worker.on("exit", (code) => {
-      if (!this.#closed) this.#fail(new Error(`SQLite worker exited unexpectedly with ${code}`));
+      if (!this.#closed) this.#fail(new Error(`Journal worker exited unexpectedly with ${code}`));
     });
   }
   createAgent(agent) {
     return this.#call("createAgent", [agent]);
   }
-  getAgent(name) {
-    return this.#call("getAgent", [name]);
+  createAgentWithOperation(agent, operation) {
+    return this.#call("createAgentWithOperation", [agent, operation]);
+  }
+  rollbackProvisionalCreate(agentId, completedOperation) {
+    return this.#call("rollbackProvisionalCreate", [agentId, completedOperation]);
+  }
+  getAgentByName(name) {
+    return this.#call("getAgentByName", [name]);
+  }
+  getAgentById(agentId) {
+    return this.#call("getAgentById", [agentId]);
   }
   listAgents() {
     return this.#call("listAgents", []);
@@ -9087,36 +11335,36 @@ var WorkerFleetStore = class {
   async putAgent(agent) {
     await this.#call("putAgent", [agent]);
   }
-  getOperation(operationId) {
-    return this.#call("getOperation", [operationId]);
-  }
   async putOperation(operation) {
     await this.#call("putOperation", [operation]);
   }
+  getOperation(operationId) {
+    return this.#call("getOperation", [operationId]);
+  }
   listPendingOperations() {
     return this.#call("listPendingOperations", []);
   }
   async deleteOperation(operationId) {
     await this.#call("deleteOperation", [operationId]);
   }
+  async putSend(send) {
+    await this.#call("putSend", [send]);
+  }
   getSend(sendId) {
     return this.#call("getSend", [sendId]);
   }
-  nextSendOrdinal(agentName) {
-    return this.#call("nextSendOrdinal", [agentName]);
-  }
-  async putSend(send) {
-    await this.#call("putSend", [send]);
+  nextSendOrdinal(agentId) {
+    return this.#call("nextSendOrdinal", [agentId]);
   }
   listNonterminalSends() {
     return this.#call("listNonterminalSends", []);
   }
-  getCompact(compactId) {
-    return this.#call("getCompact", [compactId]);
-  }
   async putCompact(compact) {
     await this.#call("putCompact", [compact]);
   }
+  getCompact(compactId) {
+    return this.#call("getCompact", [compactId]);
+  }
   listNonterminalCompacts() {
     return this.#call("listNonterminalCompacts", []);
   }
@@ -9126,94 +11374,426 @@ var WorkerFleetStore = class {
   listActiveIncarnations() {
     return this.#call("listActiveIncarnations", []);
   }
-  deleteAgent(name) {
-    return this.#call("deleteAgent", [name]);
+  async putEpoch(epoch) {
+    await this.#call("putEpoch", [epoch]);
   }
-  async close(cleanShutdown = true) {
-    if (this.#closed) return;
-    if (this.#failure === null) await this.#call("close", [cleanShutdown]);
-    this.#closed = true;
-    await this.#worker.terminate();
+  getEpochs(agentId) {
+    return this.#call("getEpochs", [agentId]);
+  }
+  async beginIncarnation(agentId, incarnationId, epoch, projectorState) {
+    await this.#call("beginIncarnation", [agentId, incarnationId, epoch, projectorState]);
+  }
+  async append(batch) {
+    const { args, transferList } = prepareAppend(batch);
+    await this.#call("append", args, { transferList });
+  }
+  openReceive(agentId) {
+    return this.#call("openReceive", [agentId]);
+  }
+  readEvents(range) {
+    return this.readEventsForReader("default", range);
   }
-  #call(method, args) {
-    if (this.#closed) return Promise.reject(new Error("pi-fleet store is closed"));
+  readEventsForReader(readerId, range) {
+    if (this.#readerIds.has(readerId)) {
+      return Promise.reject(new Error(`Reader ${readerId} already has an outstanding range read`));
+    }
+    this.#readerIds.add(readerId);
+    return this.#call("readEvents", [range], { readerId }).catch(
+      (error) => {
+        this.#readerIds.delete(readerId);
+        throw error;
+      }
+    );
+  }
+  getProjectorState(agentId, incarnationId, epoch) {
+    return this.#call("getProjectorState", [agentId, incarnationId, epoch]);
+  }
+  getHighWater(agentId) {
+    return this.#call("getHighWater", [agentId]);
+  }
+  markIdle(agentId, epoch) {
+    return this.#call("markIdle", [agentId, epoch]);
+  }
+  getRawRecords(agentId, afterPosition, limit) {
+    return this.#call("getRawRecords", [agentId, afterPosition, limit]);
+  }
+  destroyAgent(agentId, receipt) {
+    return this.#call("destroyAgent", [agentId, receipt]);
+  }
+  getDestroyReceipt(operationId) {
+    return this.#call("getDestroyReceipt", [operationId]);
+  }
+  maintain(reclaimPages) {
+    return this.#call("maintain", reclaimPages === void 0 ? [] : [reclaimPages]);
+  }
+  getDiagnostics() {
+    return this.#call("getDiagnostics", []);
+  }
+  close() {
+    if (this.#closePromise !== null) return this.#closePromise;
+    if (this.#closed) return Promise.resolve();
+    this.#closing = true;
+    this.#rejectQueued(new Error("pi-fleet journal store is closing"));
+    this.#closePromise = (async () => {
+      let closeError = null;
+      try {
+        if (this.#failure === null) await this.#enqueueClose();
+      } catch (error) {
+        closeError = error;
+      }
+      this.#closed = true;
+      try {
+        await this.#terminateWorker();
+      } catch (error) {
+        if (closeError === null) closeError = error;
+      }
+      if (closeError !== null) throw closeError;
+    })();
+    return this.#closePromise;
+  }
+  #call(method, args, options = {}) {
+    if (this.#closing || this.#closed) {
+      if (options.readerId !== void 0) this.#readerIds.delete(options.readerId);
+      return Promise.reject(
+        new Error(`pi-fleet journal store is ${this.#closed ? "closed" : "closing"}`)
+      );
+    }
     if (this.#failure !== null) return Promise.reject(this.#failure);
-    const id = randomUUID3();
-    const result = new Promise((resolveCall, rejectCall) => {
-      this.#pending.set(id, {
-        resolve: (value) => resolveCall(value),
-        reject: rejectCall
+    if (this.#pendingCount() >= this.#maxPending) {
+      if (options.readerId !== void 0) this.#readerIds.delete(options.readerId);
+      return Promise.reject(new Error("Journal worker pending capacity exceeded"));
+    }
+    return new Promise((resolve3, reject) => {
+      const call = {
+        request: { id: randomUUID3(), method, args },
+        transferList: options.transferList ?? [],
+        priority: WRITE_METHODS.has(method) ? "write" : "read",
+        ...options.readerId === void 0 ? {} : { readerId: options.readerId },
+        resolve: (value) => resolve3(value),
+        reject
+      };
+      (call.priority === "write" ? this.#writes : this.#reads).push(call);
+      this.#pump();
+    });
+  }
+  #enqueueClose() {
+    return new Promise((resolve3, reject) => {
+      this.#writes.unshift({
+        request: { id: randomUUID3(), method: "close", args: [] },
+        transferList: [],
+        priority: "write",
+        resolve: () => resolve3(),
+        reject
       });
+      this.#pump();
     });
+  }
+  #pump() {
+    if (this.#active !== null || this.#failure !== null || this.#closed) return;
+    const next = this.#writes.shift() ?? this.#reads.shift();
+    if (next === void 0) return;
+    this.#active = next;
     try {
-      this.#worker.postMessage({ id, method, args });
+      this.#worker.postMessage(next.request, next.transferList);
     } catch (error) {
-      const failure = error instanceof Error ? error : new Error("SQLite worker request failed");
-      this.#fail(failure);
+      this.#fail(error instanceof Error ? error : new Error("Journal worker request failed"));
     }
-    return result;
+  }
+  #handleResponse(value) {
+    if (!isJournalWorkerResponse(value)) {
+      this.#fail(new Error("Journal worker returned a malformed response"));
+      return;
+    }
+    const active = this.#active;
+    if (active === null || active.request.id !== value.id) {
+      this.#fail(new Error("Journal worker returned an unexpected response"));
+      return;
+    }
+    if (!value.ok && active.priority === "write") {
+      this.#fail(new Error(value.error ?? "Journal worker durability write failed"));
+      return;
+    }
+    this.#active = null;
+    if (active.readerId !== void 0) this.#readerIds.delete(active.readerId);
+    if (value.ok) active.resolve(value.value);
+    else active.reject(new Error(value.error ?? "Journal worker failed"));
+    this.#pump();
   }
   #fail(error) {
-    this.#failure ??= error;
-    for (const pending of this.#pending.values()) pending.reject(this.#failure);
-    this.#pending.clear();
+    if (this.#failure !== null) return;
+    this.#failure = error;
+    this.#onHealthFailure?.(error);
+    void this.#terminateWorker();
+    const calls = [this.#active, ...this.#writes, ...this.#reads].filter(
+      (call) => call !== null
+    );
+    this.#active = null;
+    this.#writes.length = 0;
+    this.#reads.length = 0;
+    this.#readerIds.clear();
+    for (const call of calls) call.reject(error);
+  }
+  #terminateWorker() {
+    this.#terminationPromise ??= this.#worker.terminate();
+    return this.#terminationPromise;
+  }
+  #rejectQueued(error) {
+    const queued = [...this.#writes, ...this.#reads];
+    this.#writes.length = 0;
+    this.#reads.length = 0;
+    for (const call of queued) {
+      if (call.readerId !== void 0) this.#readerIds.delete(call.readerId);
+      call.reject(error);
+    }
+  }
+  #pendingCount() {
+    return (this.#active === null ? 0 : 1) + this.#writes.length + this.#reads.length;
   }
 };
-function isWorkerResponse(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const response = value;
-  return typeof response.id === "string" && typeof response.ok === "boolean" && (response.error === void 0 || typeof response.error === "string");
+function prepareAppend(batch) {
+  const transferList = [];
+  const records = batch.records.map((record) => {
+    const bytes = Uint8Array.from(record.bytes);
+    transferList.push(bytes.buffer);
+    return { ...record, bytes };
+  });
+  return { args: [{ ...batch, records }], transferList };
 }
 
 // src/entry/runtime.ts
 async function runRuntime() {
   const paths = resolveFleetPaths();
   const limits = runtimeLimitsFromEnv();
+  await preflightRuntimeStartup({ socketPath: paths.socketPath, destructive: false });
+  await prepareFleetPathSecurity(paths);
+  const schemaState = inspectJournalSchema(paths.databasePath);
+  if (schemaState === "legacy") {
+    await preflightRuntimeStartup({
+      socketPath: paths.socketPath,
+      destructive: true,
+      assertOwnedProcessTreesAbsent: () => assertLegacyProcessTreesAbsent(paths.databasePath)
+    });
+  }
   let resolveService;
   let rejectService;
   const serviceReady = new Promise((resolveReady, rejectReady) => {
     resolveService = resolveReady;
     rejectService = rejectReady;
   });
+  const wakeup = new JournalWakeup();
+  let journal;
   const server = await startControlServer({
     socketPath: paths.socketPath,
     service: serviceReady,
+    journal: async () => {
+      if (journal === void 0) throw new Error("Journal runtime is not ready");
+      return journal;
+    },
     limits
   });
-  let store;
+  let journalStore;
   let service;
   try {
-    store = new WorkerFleetStore(paths.databasePath);
-    const piTarget = await createExternalPiTarget(process.env, limits.maxPiFrameBytes);
+    journalStore = new WorkerJournalStore(paths.databasePath, {
+      maxPending: limits.maxJournalPendingRecords,
+      checkpointCommitInterval: limits.journalCheckpointCommitInterval,
+      reclaimPagesPerPass: limits.journalReclaimPagesPerPass,
+      onHealthFailure: (error) => {
+        const failure = Object.assign(error, { code: "storage_unavailable" });
+        wakeup.close(failure);
+        service?.failStorage(failure);
+      }
+    });
+    await reconcileObservationContinuity(journalStore, (/* @__PURE__ */ new Date()).toISOString());
+    journal = new JournalRuntimeComposition({
+      store: journalStore,
+      limits,
+      cursors: new OpaqueReceiveCursorCodec(),
+      wakeup,
+      notifyEvents: (agentId, position) => wakeup.notify(agentId, position),
+      failAgent: (agentId, error) => service?.failAgent(agentId, error)
+    });
+    const store = new JournalFleetStoreAdapter(journalStore);
+    const piTarget = await createExternalPiTarget(
+      process.env,
+      limits.maxPiFrameBytes,
+      limits.maxJournalPartialRecordBytes
+    );
     service = new FleetService(store, {
       launcher: piTarget.launcher,
       piIdentity: piTarget.identity,
-      limits
+      limits,
+      journal,
+      journalStore,
+      onAgentDestroyed: (agentId) => {
+        const error = new Error("Agent destroyed");
+        error.code = "agent_destroyed";
+        wakeup.failAgent(agentId, error);
+      }
     });
     await service.reconcile();
     resolveService(service);
   } catch (error) {
     rejectService(error);
-    await server.close();
+    wakeup.close();
+    await Promise.allSettled([service?.close() ?? Promise.resolve(), server.close()]);
+    await journalStore?.close().catch(() => void 0);
     throw error;
   }
+  const unavailable = Object.assign(new Error("Runtime unavailable"), {
+    code: "runtime_unavailable"
+  });
+  const drain = new CleanDrainCoordinator({
+    stopAdmission: () => service.beginShutdown(),
+    drainStdoutAndJournal: () => service.drainStdoutAndJournal(),
+    closeReceivers: async () => wakeup.close(unavailable),
+    stopProcessTrees: () => service.stopProcessTrees(),
+    closeServer: () => server.close(),
+    closeStore: () => journalStore.close()
+  });
   await new Promise((resolveShutdown) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
       closing = true;
-      const serviceClosing = service.close();
-      const serverClosing = server.close();
-      void Promise.allSettled([serviceClosing, serverClosing]).then(() => store.close(true)).finally(resolveShutdown);
+      void drain.close().finally(resolveShutdown);
     };
     process.once("SIGTERM", shutdown);
     process.once("SIGINT", shutdown);
   });
 }
+async function reconcileObservationContinuity(store, now) {
+  for (const incarnation of await store.listActiveIncarnations()) {
+    let gone = incarnation.pid !== null && await waitForProcessGroupExit(incarnation.pid, 0);
+    const epochs = await store.getEpochs(incarnation.agentId);
+    const open2 = epochs.findLast((epoch) => epoch.state === "open");
+    if (open2 !== void 0) {
+      const highWater = await store.getHighWater(incarnation.agentId);
+      await store.putEpoch({
+        ...open2,
+        state: "closed",
+        lastSafeEventPosition: highWater?.eventPosition ?? open2.lastSafeEventPosition,
+        closedAt: now,
+        reason: "observation_uncertain"
+      });
+    }
+    if (!gone && incarnation.pid !== null) {
+      signalProcessTree(incarnation.pid, "SIGTERM");
+      gone = await waitForProcessGroupExit(incarnation.pid, 1e3);
+    }
+    if (!gone && incarnation.pid !== null) {
+      signalProcessTree(incarnation.pid, "SIGKILL");
+      gone = await waitForProcessGroupExit(incarnation.pid, 1e3);
+    }
+    await store.putIncarnation({
+      ...incarnation,
+      state: gone ? "gone" : "cleanup_uncertain"
+    });
+    const agent = await store.getAgentById(incarnation.agentId);
+    if (agent === null) continue;
+    const wasActive = agent.summary.state === "working" || agent.summary.state === "restoring";
+    await store.putAgent({
+      ...agent,
+      summary: {
+        ...agent.summary,
+        state: gone && !wasActive ? "idle" : "failed",
+        process: { state: gone ? "absent" : "cleanup_uncertain" },
+        ...!gone ? { error: { code: "incarnation_cleanup_uncertain" } } : wasActive ? { error: { code: "runtime_interrupted" } } : { error: void 0 }
+      }
+    });
+  }
+}
+function inspectJournalSchema(path) {
+  if (!existsSync(path) || statSync(path).size === 0) return "fresh";
+  let database;
+  try {
+    database = new DatabaseSync2(path, { readOnly: true });
+  } catch (error) {
+    throw new Error("pi-fleet database ownership is uncertain", { cause: error });
+  }
+  try {
+    const table = database.prepare("SELECT type FROM sqlite_master WHERE name = 'schema_migrations'").get();
+    if (table?.type !== "table") throw new Error("pi-fleet database migration ledger is missing");
+    const rows = database.prepare("SELECT version, checksum FROM schema_migrations ORDER BY version").all();
+    const state = classifyJournalMigrationRows(rows);
+    if (state === "fresh") throw new Error("pi-fleet database migration ledger is empty");
+    return state;
+  } finally {
+    database.close();
+  }
+}
+async function assertLegacyProcessTreesAbsent(path) {
+  if (!existsSync(path)) return;
+  const database = new DatabaseSync2(path, { readOnly: true });
+  let pids = [];
+  try {
+    const rows = database.prepare(
+      `SELECT json_extract(data_json, '$.pid') AS pid
+         FROM incarnations
+         WHERE state IN ('starting', 'live', 'stopping', 'cleanup_uncertain')`
+    ).all();
+    if (rows.some(
+      (row) => typeof row.pid !== "number" || !Number.isSafeInteger(row.pid) || row.pid <= 0
+    )) {
+      throw new Error("Legacy Pi process ownership is uncertain");
+    }
+    pids = rows.map((row) => row.pid);
+  } finally {
+    database.close();
+  }
+  for (const pid of pids) {
+    if (!await waitForProcessGroupExit(pid, 0)) {
+      throw new Error(`Legacy Pi process group ${String(pid)} is still present`);
+    }
+  }
+  assertNoOtherProcessHasDatabaseOpen(path);
+}
+function assertNoOtherProcessHasDatabaseOpen(path, procRoot = "/proc") {
+  if (process.platform !== "linux" || !existsSync(path)) {
+    throw new Error("Legacy runtime ownership proof is supported only on Linux");
+  }
+  const databaseIdentity = statSync(path);
+  const currentUid = process.getuid?.();
+  for (const entry of readdirSync2(procRoot)) {
+    if (!/^\d+$/.test(entry) || Number(entry) === process.pid) continue;
+    const processPath = `${procRoot}/${entry}`;
+    let owner;
+    try {
+      owner = statSync(processPath).uid;
+    } catch {
+      continue;
+    }
+    if (currentUid !== void 0 && owner !== currentUid) continue;
+    let descriptors;
+    try {
+      descriptors = readdirSync2(`${processPath}/fd`);
+    } catch (error) {
+      throw new Error(`Cannot prove legacy runtime ${entry} released pi-fleet state`, {
+        cause: error
+      });
+    }
+    for (const descriptor of descriptors) {
+      try {
+        const opened = statSync(`${processPath}/fd/${descriptor}`);
+        if (opened.dev === databaseIdentity.dev && opened.ino === databaseIdentity.ino) {
+          throw new Error(`Legacy runtime process ${entry} still owns the pi-fleet database`);
+        }
+      } catch (error) {
+        if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "EBADF")) {
+          continue;
+        }
+        throw error;
+      }
+    }
+  }
+}
 if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(process.argv[1]).href) {
   await runRuntime();
 }
 export {
+  assertNoOtherProcessHasDatabaseOpen,
+  inspectJournalSchema,
+  reconcileObservationContinuity,
   runRuntime
 };
 //# sourceMappingURL=runtime.mjs.map