@gajae-code/coding-agent 0.12.4 → 0.12.6

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -3,6 +3,7 @@ import { type RepositoryBinding } from "./repository-binding";
 import { type CriticVerdict } from "./ultragoal-receipt-freshness";
 export { CRITIC_GATE_HARD_STOP_EVENT, CRITIC_GATE_OVERRIDE_EVENT, CRITIC_VERDICT_EVENT, type CriticVerdict, computeUltragoalPlanGeneration, countTerminalCriticVerdicts, receiptRelevantGoals, TERMINAL_CRITIC_CEILING, terminalCriticCeilingReached, terminalCriticGateOverridden, } from "./ultragoal-receipt-freshness";
 export { captureUltragoalRecoverySnapshot, parseStrictTerminalTranscript, persistUltragoalRecoveryDecision, planUltragoalOwnerLossRecovery, type UltragoalOwnerLossReceipt, type UltragoalRecoveryBinding, type UltragoalRecoveryDecision, type UltragoalRecoverySnapshot, validateOwnerLossBinding, validateRawUltragoalEvidence, validateRecoveryAdmission, validateRecoveryPath, } from "./ultragoal-owner-loss-recovery";
+import { createReviewSourceDispatch, type ReviewDeliveryDisposition, type ReviewSourceCohort, type ReviewSourceLane } from "./ultragoal-review-source";
 export type UltragoalGjcGoalMode = "aggregate" | "per-story";
 export type UltragoalGoalStatus = "pending" | "active" | "complete" | "failed" | "blocked" | "review_blocked" | "superseded";
 export interface UltragoalValidationBatchMetadata extends JsonObject {
@@ -42,6 +43,7 @@ export interface UltragoalPlan {
     goals: UltragoalGoal[];
     /** Authoritative repository identity for multi-repo fail-closed spawn (#2901). */
     repositoryBinding?: RepositoryBinding;
+    reviewCohorts?: ReviewSourceCohort[];
     createdAt: string;
     updatedAt: string;
     [key: string]: unknown;
@@ -303,11 +305,12 @@ export interface UltragoalChangeSet extends JsonObject {
     paths: UltragoalChangeSetPath[];
     rawDiffStat?: string;
     rawDiff?: string;
+    captureIncomplete?: boolean;
     trusted: true;
 }
 export declare function normalizeRepoPath(value: string): string;
+export declare function normalizeChangeSetPath(value: string): string;
 export declare function categorizeComputerChangePath(value: string): UltragoalChangeCategory;
-export declare function isSettingsSchemaPath(value: string): boolean;
 export declare function normalizeSurfaceToken(value: string): string;
 export declare function surfaceFamily(value: string): SurfaceFamily;
 export declare function isLiveSurfaceFamily(family: SurfaceFamily): boolean;
@@ -374,13 +377,50 @@ export declare function addUltragoalSubgoal(input: {
     evidence: string;
     rationale: string;
 }): Promise<UltragoalPlan>;
+export declare function validateUltragoalReviewDispatch(input: {
+    cwd: string;
+    dispatchId: string;
+    cohortId: string;
+    taskId: string;
+    lane: ReviewSourceLane;
+    snapshotId: string;
+    generation: number;
+    repositoryBindingDigest: string;
+    stateRevision: number;
+    rerunCommand: string;
+    taskSourceTaskId: string;
+    createdAt: string;
+}): Promise<void>;
+export declare function freezeUltragoalReviewCohort(input: {
+    cwd: string;
+    workflow?: "ultragoal" | "ralplan";
+}): Promise<ReviewSourceCohort>;
+export declare function dispatchUltragoalReviewLane(input: {
+    cwd: string;
+    cohortId: string;
+    taskId: string;
+    lane: ReviewSourceLane;
+    rerunCommand: string;
+}): Promise<ReturnType<typeof createReviewSourceDispatch>>;
+export declare function classifyUltragoalReviewDelivery(input: {
+    cwd: string;
+    cohortId: string;
+    dispatchId: string;
+    observedDisposition: ReviewDeliveryDisposition;
+}): Promise<{
+    disposition: ReviewDeliveryDisposition;
+    deliveryId: string;
+}>;
 export declare function recordUltragoalReviewBlockers(input: {
     cwd: string;
     goalId: string;
     title: string;
     objective: string;
     evidence: string;
-}): Promise<UltragoalPlan>;
+}): Promise<{
+    plan: UltragoalPlan;
+    blockerGoalId: string;
+}>;
 export type UltragoalBlockerClassification = "human_blocked" | "resolvable";
 /**
  * Record an audited blocker triage classification in the durable ledger. Pause
@@ -422,7 +462,20 @@ interface UltragoalReviewResult extends JsonObject {
     weakContractCapApplied: boolean;
     blockerGoalIds?: string[];
 }
-import { computeCheckpointChangeSet, parseGitNameStatus, parseUnifiedDiffPaths, resolveGitBase, spawnText } from "./ultragoal-change-set";
-export { computeCheckpointChangeSet, parseGitNameStatus, parseUnifiedDiffPaths, resolveGitBase, spawnText };
+import { ciDevChangedPathRows, computeCheckpointChangeSet, mergeChangeSetPaths, parseGitNameStatus, parseGitUntrackedPaths, parseUnifiedDiffPaths, resolveGitBase, spawnText } from "./ultragoal-change-set";
+export { ciDevChangedPathRows, computeCheckpointChangeSet, mergeChangeSetPaths, parseGitNameStatus, parseGitUntrackedPaths, parseUnifiedDiffPaths, resolveGitBase, spawnText, };
+/**
+ * Typed terminal handoff thrown when {@link recordUltragoalReviewBlockers} would
+ * exceed {@link MAX_REVIEW_BLOCKER_DESCENTS} unresolved review_blocker descents
+ * off a single blocked goal (#3613). Never silently marks unresolved technical
+ * findings complete; the operator/leader must pause and escalate.
+ */
+export declare class UltragoalReviewBlockerRecursionCapError extends Error {
+    readonly code: "review_blocker_recursion_cap";
+    readonly blockedGoalId: string;
+    readonly unresolvedDescents: number;
+    readonly cap: number;
+    constructor(blockedGoalId: string, unresolvedDescents: number, cap?: number);
+}
 export declare function runUltragoalReview(cwd: string, args: readonly string[]): Promise<UltragoalReviewResult>;
 export declare function runNativeUltragoalCommand(args: string[], cwd?: string): Promise<UltragoalCommandResult>;

package/dist/types/internal-urls/registry-helpers.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Shared helpers for internal-url protocol handlers that resolve session-scoped
+ * artifact IDs.
+ */
+import { type RecoveryFsRoot } from "@gajae-code/natives";
 import type { ResolveContext } from "./types";
 /**
  * Snapshot of artifacts dirs explicitly authorized for the calling session.
@@ -9,3 +14,16 @@ import type { ResolveContext } from "./types";
  * not an authorization source.
  */
 export declare function authorizedArtifactsDirsFromContext(context?: ResolveContext): string[];
+export interface AuthorizedArtifactsRoot {
+    readonly directory: string;
+    readonly dev: bigint;
+    readonly ino: bigint;
+    readonly authority: RecoveryFsRoot;
+}
+export interface AuthorizedArtifactSnapshot {
+    bytes: Buffer;
+    size: number;
+}
+export declare function openAuthorizedArtifactsRoot(directory: string): AuthorizedArtifactsRoot;
+export declare function closeAuthorizedArtifactsRoot(root: AuthorizedArtifactsRoot): void;
+export declare function readAuthorizedArtifactFile(root: AuthorizedArtifactsRoot, filename: string, maxBytes: number): AuthorizedArtifactSnapshot | null;

package/dist/types/modes/components/gjc-bundle-settings.d.ts

@@ -19,6 +19,7 @@ export interface GjcBundleSettingsDependencies {
 export interface GjcBundleSettingsCallbacks {
     onClose: () => void;
     onBundlesChanged?: () => void;
+    onRenderRequested?: () => void;
 }
 export type GjcBundleSettingsState = "loading" | "error" | "empty" | "list" | "detail" | "unsupported-source" | "update-review" | "update-confirm" | "update-running" | "update-result" | "stale-result" | "quarantined-blocked" | "mutation-in-flight-locked";
 /** Scope-qualified, lifecycle-backed Settings UI for installed GJC bundles. */

package/dist/types/modes/components/plugin-settings.d.ts

@@ -35,6 +35,7 @@ export interface PluginDetailCallbacks {
     onFeatureChange: (feature: string, enabled: boolean) => void;
     onConfigChange: (key: string, value: unknown) => void;
     onBack: () => void;
+    onRenderRequested?: () => void;
 }
 /**
  * Shows detail settings for a single plugin:
@@ -53,6 +54,7 @@ export declare class PluginDetailComponent extends Container {
 export interface PluginSettingsCallbacks {
     onClose: () => void;
     onPluginChanged: () => void;
+    onRenderRequested?: () => void;
 }
 /**
  * Top-level plugin settings component.

package/dist/types/modes/components/settings-selector.d.ts

@@ -67,6 +67,8 @@ export interface SettingsCallbacks {
     getStatusLinePreview?: (width?: number) => string;
     /** Called when plugins change */
     onPluginsChanged?: () => void;
+    /** Called when asynchronously rebuilt settings content needs a repaint. */
+    onRenderRequested?: () => void;
     /** Called when an interactive setting cannot be committed. */
     onError?: (message: string) => void;
     /** Called when settings panel is closed */

package/dist/types/sdk/broker/broker.d.ts

@@ -23,6 +23,7 @@ export type BrokerErrorCode = "idempotency_conflict" | "terminal_uncertain" | "b
 export type BrokerCleanupIdentity = {
     dev: string;
     ino: string;
+    nlink?: string;
     size: number;
     mtimeNs: string;
     sha256: string;
@@ -51,6 +52,7 @@ export type BrokerArtifactTree = {
 };
 export type BrokerCleanupEvidence = {
     phase: "artifacts" | "transcript" | "metadata" | "lifecycle";
+    cleanupReceiptVersion?: 1;
     /** Ledger-bound deletion target; never reconstructed from a retry request. */
     sessionsRoot?: string;
     transcriptPath?: string;
@@ -59,6 +61,10 @@ export type BrokerCleanupEvidence = {
     sessionId?: string;
     artifactsIdentity?: BrokerCleanupIdentity;
     transcriptIdentity?: BrokerCleanupIdentity;
+    transcriptParentIdentity?: {
+        dev: string;
+        ino: string;
+    };
     /** Identity-bound lifecycle metadata marker retained when exact cleanup is deferred. */
     metadataIdentity?: BrokerCleanupIdentity;
     metadataPath?: string;
@@ -71,9 +77,17 @@ export type BrokerCleanupEvidence = {
     /** Append-only terminal proof for lifecycle metadata cleanup. */
     metadataCompleted?: true;
     detachedArtifactsPath?: string;
+    retainedArtifactsSuccessorPath?: string;
+    retainedArtifactsPlaceholderPath?: string;
+    retainedArtifactsUnknownPath?: string;
+    retainedArtifactsSideAuthority?: "none" | "retained";
     detachedTranscriptPath?: string;
+    retainedTranscriptSuccessorPath?: string;
+    retainedTranscriptPlaceholderPath?: string;
+    retainedTranscriptUnknownPath?: string;
     /** Durable proof that artifact cleanup completed before transcript mutation. */
     artifactsRemoved?: boolean;
+    artifactsAbsentAtAuthorization?: true;
     /** Preauthorized no-replace artifact quarantine path persisted before detach. */
     plannedArtifactsPath?: string;
     /** Identity-bound artifact tree authority persisted before broker detach and replayed exactly. */
@@ -82,6 +96,10 @@ export type BrokerCleanupEvidence = {
     plannedTranscriptPath?: string;
     /** Fully identity-bound startup-failure cleanup plan, persisted before any detach. */
     lifecycleFiles?: BrokerLifecycleCleanupFile[];
+    lifecycleParentIdentity?: {
+        dev: string;
+        ino: string;
+    };
     /** Delete metadata receipts authorize only the canonical marker/ready sibling pair. */
     lifecycleDeleteMetadata?: true;
 };

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -66,6 +66,11 @@ export interface LifecycleLedgerEntry {
     endpointGeneration?: number;
     responseDigest?: string;
     response?: unknown;
+    unresolvedCleanupResponse?: unknown;
+    unresolvedCleanupResponseDigest?: string;
+    uncertainCleanupSessionId?: string;
+    uncertainCleanupSessionIds?: string[];
+    uncertainCleanupAllSessions?: true;
     ts: number;
 }
 export type BeginResult = {
@@ -105,5 +110,13 @@ export declare class LifecycleLedger {
     begin(identity: string, requestHash: string): Promise<BeginResult>;
     transition(identity: string, state: LifecycleState, fields?: Omit<Partial<LifecycleLedgerEntry>, "identity" | "requestHash" | "state" | "ts">): Promise<LifecycleLedgerEntry>;
     assertSupportedStateVersions(): Promise<void>;
+    findCleanupPendingByDeleteTarget(target: {
+        sessionId: string;
+        sessionsRoot?: string;
+        transcriptPath: string;
+        cwd: string;
+    }, excludingIdentity: string): LifecycleLedgerEntry | undefined;
+    findCleanupPendingBySessionId(sessionId: string, excludingIdentity: string): LifecycleLedgerEntry | undefined;
+    hasUncertainCleanupForSession(sessionId: string, excludingIdentity: string): boolean;
     get(identity: string): LifecycleLedgerEntry | undefined;
 }

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -92,6 +92,7 @@ export declare function readSessionLifecycleFailureForTest(root: string, id: str
     effectMarker: string;
     incarnation: string;
 }): Promise<SdkStartupFailure | undefined>;
+export declare function canonicalDeleteLocatorPath(pathname: string): string;
 export interface LifecycleExecutionOutcome {
     response: BrokerResponse;
     durableEffects?: LifecycleDurableEffectsReceipt;

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -19,8 +19,11 @@ export type ChatDaemonAction = "stop" | "reload";
  * chat daemons after notification configuration parsing changes. Generation 15
  * applies the current notification configuration directly when starting chat
  * daemon transports. Generation 16 applies Telegram sound-policy configuration
- * through shared notification parsing. Generation 17 binds managed-session
- * replacement to exact native filesystem authority.
+ * through shared notification parsing. Generation 17 bound managed-session
+ * replacement to exact native filesystem authority; generation 18 retired that
+ * binding, generation 19 bound exact cleanup to parent/link-count authority,
+ * generation 20 refreshed retained cleanup semantics, and generation 21 hardens
+ * exact Bash process-tree ownership shared by chat daemon cleanup.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/index.d.ts

@@ -17,6 +17,7 @@
  * Enable with Settings notifications config, `GJC_NOTIFICATIONS=1` (a token is
  * generated), or `GJC_NOTIFICATIONS_TOKEN`.
  */
+import { type RunSettlementProof } from "@gajae-code/agent-core";
 import type { Tool } from "@gajae-code/ai";
 import { NotificationServer } from "@gajae-code/natives";
 import { Settings } from "../../config/settings";
@@ -33,6 +34,9 @@ import { NotificationSessionController } from "./session-control";
 import { type EnsureDaemonResult, type RegisterNotificationRootResult } from "./telegram-daemon";
 export type { IdentityControlSuccessPathInput, IdentityControlTerminalPathInput, TerminalSendOutcome, } from "./control-drain-lease";
 export { isNativeControlDrainAvailable, runIdentityControlSuccessPath, runIdentityControlTerminalPath, } from "./control-drain-lease";
+export declare function formatPromptSettlementDiagnostic(proof: Extract<RunSettlementProof, {
+    status: "unfenced";
+}>, now?: number): string;
 /** Where a `session_create` should run. Discriminated by `kind`. */
 export type SessionCreateTarget = {
     kind: "existing_path";

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -44,10 +44,14 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * 33 adds action-bound multi-select state rendering and replay-safe option
  * snapshots. Generation 34 converts non-photo image formats (including WebP)
  * into Telegram-compatible photo uploads when possible. Generation 35 adds
- * user-created topic adoption (forum-topic folder picker). Generation 36 binds
- * managed-session replacement to exact native filesystem authority.
+ * user-created topic adoption (forum-topic folder picker). Generation 36 bound
+ * managed-session replacement to exact native filesystem authority; generation
+ * 37 retires that binding (revert of #3489, which stalled POSIX artifact
+ * cleanup); generation 38 binds exact cleanup to parent and link-count authority;
+ * generation 39 hardens exact Bash process-tree ownership, settlement, and
+ * descendant cleanup authority.
  */
-export declare const DAEMON_GENERATION = 36;
+export declare const DAEMON_GENERATION = 39;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 1 covers
  * all builds published before this field existed; epoch 2 covered generation 29;

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -61,11 +61,13 @@ export interface TelegramDaemonFs {
         size?: number;
         dev?: number;
         ino?: number;
+        /** Hard-link count; required to prove a staging temp has no second name. */
+        nlink?: number;
         ctimeMs?: number;
         isDirectory?: () => boolean;
     }>;
     readEndpointFile?(path: string): Promise<NotificationEndpointFile>;
-    exactUnlink?(path: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
+    exactUnlink?(path: string, identity: NotificationEndpointFileIdentity, quarantineName?: string): Promise<NotificationExactUnlinkResult>;
 }
 export interface SpawnResult {
     pid?: number;
@@ -281,11 +283,26 @@ export declare function withNotificationRootRegistryFence(input: {
  * (#2956). Nothing previously reaped these; they accumulate in the notifications
  * directory across ownership transitions.
  */
-export declare const NOTIFICATION_LEAK_ARTIFACT_PREFIXES: readonly [".gjc-delete-daemon-transition-", ".gjc-exact-unlink-placeholder-", ".gjc-delete-notification-endpoint-"];
+export declare const NOTIFICATION_LEAK_ARTIFACT_PREFIXES: readonly [".gjc-delete-daemon-transition-", ".gjc-exact-unlink-placeholder-", ".gjc-delete-notification-endpoint-", ".gjc-delete-notification-staging-temp-"];
 /** Grace window before a leak artifact is reaped (covers in-flight unlinks). */
 export declare const NOTIFICATION_LEAK_ARTIFACT_GRACE_MS: number;
 /** True when a path is permanently gone (not a transient I/O blip). */
 export declare function isPermanentMissingPathError(error: unknown): boolean;
+/** A publication staging claim recovered from an abandoned temp's name. */
+export interface NotificationStagingTempClaim {
+    /** Published sibling this temp was staged for. */
+    destination: string;
+    /** PID of the process that staged it. */
+    pid: number;
+    /** Wall-clock ms the publisher recorded when it staged the temp. */
+    stagedAtMs: number;
+}
+/**
+ * Recover the publication claim encoded in a staging temp's name, or
+ * `undefined` when `name` is not a staging temp or its PID/timestamp fields are
+ * not usable integers. An unparseable claim is never reaped.
+ */
+export declare function parseNotificationStagingTemp(name: string): NotificationStagingTempClaim | undefined;
 export declare function isNotificationLeakArtifactName(name: string): boolean;
 /**
  * Drop permanently missing scan roots from the durable registry under the roots
@@ -302,13 +319,16 @@ export declare function pruneMissingNotificationRoots(input: {
 }>;
 /**
  * Reap retained exact-unlink / ownership-transition quarantine files older than
- * the grace window from the notifications directory.
+ * the grace window from the notifications directory, plus publication staging
+ * temps whose publisher is provably dead.
  */
 export declare function reapStaleNotificationArtifacts(input: {
     settings: Settings;
     fs?: TelegramDaemonFs;
     now?: () => number;
     graceMs?: number;
+    /** Liveness seam used to prove a staging temp's publisher is dead. */
+    pidAlive?: (pid: number) => boolean;
 }): Promise<{
     removed: string[];
     skipped: number;
@@ -322,6 +342,8 @@ export declare function healTelegramDaemonNotificationState(input: {
     fs?: TelegramDaemonFs;
     now?: () => number;
     graceMs?: number;
+    /** Liveness seam used to prove a staging temp's publisher is dead. */
+    pidAlive?: (pid: number) => boolean;
 }): Promise<{
     prunedRoots: string[];
     removedArtifacts: string[];

package/dist/types/sdk/bus/topic-registry.d.ts

@@ -92,6 +92,17 @@ export interface TopicDeleteAuthoritySnapshot {
     /** Exact fenced record, retained to restore an in-memory tombstone after a failed clear publication. */
     record?: TopicRecord;
 }
+/**
+ * Proof that a definite delete was settled in memory and still owes its durable
+ * commit. Handed back only by a settlement that actually happened, so a refused
+ * settlement structurally cannot be followed by a rollback.
+ */
+export interface TopicSettledDelete {
+    sessionId: string;
+    topicId: string;
+    /** Authority epoch proven current when the record was removed. */
+    settledEpoch: number;
+}
 export declare function emptyTopicRegistryState(): TopicRegistryState;
 /**
  * In-memory registry over a serialisable state. Topic creation is injected via
@@ -199,7 +210,14 @@ export declare class TopicRegistry {
     captureDeleteAuthority(sessionId: string): TopicDeleteAuthoritySnapshot;
     /** Restore a failed delete fence only while its exact authority mutation remains current. */
     restoreDeleteAuthority(snapshot: TopicDeleteAuthoritySnapshot): boolean;
-    /** Restore the exact delete fence after a failed compensation publication. */
+    /**
+     * Restore the exact delete fence after a failed compensation publication.
+     *
+     * Settlement rebuilds derived routes, which can make a surviving colliding
+     * record routable. Rebuild again on successful restoration so the reinstated
+     * fence re-quarantines the topic id instead of leaving inbound routing open to
+     * the collision partner despite the restored fence.
+     */
     restoreDeleteFence(snapshot: TopicDeleteAuthoritySnapshot): boolean;
     /** Fence new work before the remote delete starts, including an absent in-flight create. */
     beginDelete(sessionId: string): TopicRecord | undefined;
@@ -209,8 +227,50 @@ export declare class TopicRegistry {
     fenceAcceptedCreateForLease(sessionId: string, topicId: string, creationLeaseEpoch: number, now?: () => number, name?: string, binding?: TopicEndpointBinding): TopicRecord | undefined;
     /** Wait for a revoked create to settle before admitting a later lifecycle epoch. */
     awaitInflight(sessionId: string): Promise<void>;
-    /** Remove only after a definite remote deletion; ambiguity deliberately retains its fence. */
-    settleDelete(sessionId: string, topicId: string): boolean;
+    /**
+     * Phase 1 of settling a definite remote delete: remove the record while
+     * deliberately RETAINING its topic-id quarantine.
+     *
+     * `dispatchedAuthorityEpoch` is the authority epoch the caller held when it
+     * dispatched the remote delete. Settlement requires that epoch to still equal
+     * both the record's own authority epoch and the registry's current epoch for
+     * the session, so a held earlier delete can never settle a newer fence: if a
+     * scan or close-started delete re-fenced the same session/topic after this
+     * delete was dispatched, the stale definite result is refused and the newer
+     * `delete_pending` record plus its topic-id quarantine stay intact.
+     *
+     * An epoch outside the safe-integer range cannot identify a generation, and at
+     * `Number.MAX_SAFE_INTEGER` epoch advancement has saturated so distinct
+     * generations are no longer distinguishable. Both fail closed: settlement can
+     * no longer be proven fresh, so the fence is kept.
+     *
+     * Derived routing tables are deliberately NOT rebuilt here. Until the cleared
+     * snapshot is durably persisted the clear is not authoritative, so publishing
+     * routes now would make a colliding survivor routable (and the settled id
+     * adoptable) during the held write, and a failed persist would re-quarantine
+     * too late. Publish with {@link commitSettledDelete} once the persist
+     * succeeds, or undo with {@link rollbackSettledDelete} when it fails.
+     */
+    settleDelete(sessionId: string, topicId: string, dispatchedAuthorityEpoch: number): TopicSettledDelete | undefined;
+    /**
+     * Phase 2: publish derived routing tables once the cleared state is durable.
+     *
+     * Only here does the settled topic id lose its quarantine, so a surviving
+     * colliding record becomes routable and a settled id becomes adoptable without
+     * waiting for a daemon restart.
+     */
+    commitSettledDelete(settled: TopicSettledDelete): boolean;
+    /**
+     * Compare-and-swap undo for a settlement whose durable clear failed.
+     *
+     * Restoration applies only while the registry still holds exactly the state
+     * that this settlement produced: the settlement is still awaiting commit, the
+     * session still has no record, and the session epoch is still the settled
+     * epoch. Any mismatch means a newer generation intervened, so the restore is
+     * refused and the newer state is left untouched. A refused settlement produced
+     * no token, so it can never reach this path.
+     */
+    rollbackSettledDelete(settled: TopicSettledDelete): boolean;
     /** Remove a topic record immediately for local/test cleanup compatibility. */
     delete(sessionId: string): boolean;
     /** Serialise active records plus unpublished staged creates for atomic commit. */

package/dist/types/sdk/host/host.d.ts

@@ -1,17 +1,26 @@
 import { type EventFrame, SessionEventStream } from "./events";
-import { ReverseLeaseRuntime } from "./reverse-leases";
+import { type ProviderLease, ReverseLeaseRuntime } from "./reverse-leases";
 import type { BrokerIndexWriter, HostEndpointAdapters, SdkFrame } from "./types";
 export type SdkRequestObserver = (kind: "control" | "query", connectionId: string, frame: SdkFrame) => void;
+export interface ProviderLeaseIdentity {
+    leaseId: string;
+    connectionId: string;
+    connectionGeneration: number;
+    fence: string;
+}
+export type ProviderLeaseFence = (identity: ProviderLeaseIdentity, reason?: string) => boolean;
 export interface SessionSdkHostOptions extends HostEndpointAdapters {
     control?: (connectionId: string, frame: SdkFrame) => unknown | Promise<unknown>;
     query?: (connectionId: string, frame: SdkFrame) => unknown | Promise<unknown>;
     /** Best-effort diagnostic observation of accepted control/query frames. */
     onRequest?: SdkRequestObserver;
+    onFrameOverflow?: (connectionId: string) => void;
     /** Runs before a control response is sent; identity transitions use sendTerminal. */
     beforeControlResponse?: (connectionId: string, request: SdkFrame, response: SdkFrame, sendTerminal: () => Promise<void>) => void | Promise<void>;
     /** Runs only after a successful control response has been sent to the client. */
     afterControlResponse?: (connectionId: string, request: SdkFrame, response: SdkFrame) => void | Promise<void>;
-    installProviderDefinitions?: (capability: string, definitions: unknown) => void;
+    onProviderLeaseRegistered?: (lease: ProviderLease, connectionGeneration: number) => void;
+    installProviderDefinitions?: (capability: string, definitions: unknown, leaseId: string, connectionId: string, connectionGeneration: number) => void;
     onProviderDefinitionsRemoved?: (capability: string) => void;
     onReverseCancel?: (requestId: string, reason: "provider_disconnected" | "lease_released") => void;
     /** Best-effort capabilities mirrored from the native transport for out-of-band consumers. */
@@ -29,8 +38,20 @@ export declare class SessionSdkHost {
     get generation(): number;
     /** Current installed definitions for a live provider capability. */
     getProviderDefinitions(capability: string): unknown | undefined;
+    /** Mark a transport connection live and return its stable generation. */
+    handleConnect(connectionId: string): number;
+    /** Current generation for a transport connection, if it has been observed. */
+    connectionGeneration(connectionId: string): number;
+    isConnectionOpen(connectionId: string, generation?: number): boolean;
     /** Release reverse leases after the transport reports a WebSocket disconnect. */
     handleDisconnect(connectionId: string): void;
+    /**
+     * Fences one exact provider lease after uncertain terminal cleanup. The fence
+     * is idempotent for the same identity and never affects a newer generation.
+     */
+    quarantineProviderLease(identity: ProviderLeaseIdentity, _reason?: string): boolean;
+    /** Dispatch a frame through bounded per-connection asynchronous admission. */
+    dispatchFrame(connectionId: string, frame: SdkFrame): Promise<void>;
     /** Adds an event to the resumable event ring. Transport delivery is owned by bus wiring. */
     emitEvent(frame: SdkFrame): EventFrame;
     start(): Promise<"started" | "already">;

package/dist/types/sdk/host/reverse-leases.d.ts

@@ -3,7 +3,10 @@ export declare const REVERSE_HEARTBEAT_MS = 5000;
 export declare const REVERSE_LEASE_TTL_MS = 15000;
 export declare const REVERSE_RECLAIM_GRACE_MS = 15000;
 export declare const MAX_REVERSE_OUTSTANDING = 64;
+export declare const MAX_REVERSE_CLEANUP_OUTSTANDING = 2;
 export declare const MAX_REVERSE_PAYLOAD_BYTES: number;
+export declare const MAX_REVERSE_TERMINAL_OUTPUT_BYTES: number;
+export declare const MAX_REVERSE_TERMINAL_OUTPUT_PAYLOAD_BYTES: number;
 export declare class ReverseLeaseError extends Error {
     readonly code: "lease_unavailable" | "lease_expired" | "provider_lease_conflict" | "provider_required" | "not_lease_owner" | "payload_too_large" | "too_many_outstanding" | "unknown_request" | "idempotency_conflict";
     constructor(code: "lease_unavailable" | "lease_expired" | "provider_lease_conflict" | "provider_required" | "not_lease_owner" | "payload_too_large" | "too_many_outstanding" | "unknown_request" | "idempotency_conflict", message?: "idempotency_conflict" | "lease_expired" | "lease_unavailable" | "not_lease_owner" | "payload_too_large" | "provider_lease_conflict" | "provider_required" | "too_many_outstanding" | "unknown_request");
@@ -21,7 +24,7 @@ export interface ReverseLeaseOptions {
     now?: () => number;
     leaseTtlMs?: number;
     sendFrame: (connectionId: string, frame: SdkFrame) => void | Promise<void>;
-    installDefinitions?: (capability: string, definitions: unknown) => void;
+    installDefinitions?: (capability: string, definitions: unknown, leaseId: string, connectionId: string, connectionGeneration: number) => void;
     onCancel?: (requestId: string, reason: "provider_disconnected" | "lease_released") => void;
     onDefinitionsRemoved?: (capability: string) => void;
 }
@@ -29,15 +32,15 @@ export interface ReverseLeaseOptions {
 export declare class ReverseLeaseRuntime {
     #private;
     constructor(options: ReverseLeaseOptions);
-    registerProvider(connectionId: string, capability: string, definitions: unknown, expectedLeaseId?: string, idempotencyKey?: string): ProviderLease;
+    registerProvider(connectionId: string, capability: string, definitions: unknown, expectedLeaseId?: string, idempotencyKey?: string, connectionGeneration?: number): ProviderLease;
     heartbeat(connectionId: string, leaseId: string): ProviderLease;
     release(connectionId: string, leaseId: string, handoffTo?: string): ProviderLease;
     disconnect(connectionId: string): void;
-    request(capability: string, method: string, payload: unknown, signal?: AbortSignal): Promise<unknown>;
+    request(capability: string, method: string, payload: unknown, signal?: AbortSignal, expectedLeaseId?: string, cleanup?: boolean, expectedConnectionId?: string): Promise<unknown>;
     respond(connectionId: string, id: string, leaseId: string, result: unknown, error?: {
         code: string;
         message: string;
-    }): void;
+    }, wireEnvelope?: unknown): void;
     getLease(capability: string): ProviderLease | undefined;
     /** Installed definitions are observable only while their provider lease is live. */
     getInstalledDefinitions(capability: string): unknown | undefined;

package/dist/types/session/agent-session.d.ts

@@ -13,8 +13,9 @@
  * Modes use this class and add their own I/O layer on top.
  */
 import { type Agent, type AgentContext, type AgentEvent, type AgentLoopConfig, type AgentMessage, type AgentState, type AgentTool, type MidRunMaintenanceOutcome, type RunSettlementProof, type StablePrefixSnapshot, ThinkingLevel } from "@gajae-code/agent-core";
+import type { AttemptScope } from "@gajae-code/agent-core/attempt-scope";
 import { type CompactionResult, type EmergencyCompactionSample } from "@gajae-code/agent-core/compaction";
-import type { AssistantMessage, Effort, ImageContent, Message, MessageAttribution, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, TextContent, ToolCall, ToolChoice, Usage, UsageReport } from "@gajae-code/ai";
+import type { AssistantMessage, AttemptScopeRef, Effort, ImageContent, Message, MessageAttribution, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, TextContent, ToolCall, ToolChoice, Usage, UsageReport } from "@gajae-code/ai";
 import { type BtwTextExchange } from "./btw-contract";
 export interface ForkContextSeedMetadata {
     sourceSessionId: string;
@@ -231,7 +232,7 @@ export interface AgentSessionConfig {
     /** Tool-session factory context used to lazily attach workflow-gate-only tools. */
     workflowGateToolSession?: ToolSession;
     /** Current session pre-LLM message transform pipeline */
-    transformContext?: (messages: AgentMessage[], signal?: AbortSignal) => AgentMessage[] | Promise<AgentMessage[]>;
+    transformContext?: (messages: AgentMessage[], signal?: AbortSignal, scope?: AttemptScopeRef) => AgentMessage[] | Promise<AgentMessage[]>;
     /** Provider payload hook used by the active session request path */
     onPayload?: SimpleStreamOptions["onPayload"];
     /** Provider response hook used by the active session request path */
@@ -815,9 +816,9 @@ export declare class AgentSession {
     /** Build display context from an unpublished successor without changing active session state. @internal */
     buildPreparedDisplaySessionContext(prepared: PreparedNewSession): SessionContext;
     /** Convert session messages using the same pre-LLM pipeline as the active session. */
-    convertMessagesToLlm(messages: AgentMessage[], signal?: AbortSignal): Promise<Message[]>;
+    convertMessagesToLlm(messages: AgentMessage[], signal?: AbortSignal, scope?: AttemptScope): Promise<Message[]>;
     /** Apply session-level stream hooks to a direct side request. */
-    prepareSimpleStreamOptions(options: SimpleStreamOptions, provider?: string): SimpleStreamOptions;
+    prepareSimpleStreamOptions(options: SimpleStreamOptions, provider?: string, scope?: AttemptScope): SimpleStreamOptions;
     /** Current steering mode */
     get steeringMode(): "all" | "one-at-a-time";
     /** Current follow-up mode */

package/dist/types/session/artifacts.d.ts

@@ -16,6 +16,11 @@ export interface ManagedOutputGeneration {
 export interface ArtifactSaveOptions {
     maxBytes?: number;
 }
+export interface ArtifactSaveReceipt {
+    id: string;
+    complete: boolean;
+    omittedBytes?: number;
+}
 /**
  * Manages artifact storage for a session.
  *
@@ -68,11 +73,9 @@ export declare class ArtifactManager {
         id: string;
         path?: string;
     }>;
-    /**
-     * Save content as an artifact and return the artifact ID.
-     * Content is written to a private temporary inode, synced, and linked into
-     * the artifact directory only after the complete terminal payload exists.
-     */
+    /** Save content and return the artifact ID plus exact storage completeness evidence. */
+    saveWithReceipt(content: string, toolType: string, options?: ArtifactSaveOptions): Promise<ArtifactSaveReceipt>;
+    /** Save content as an artifact and return the artifact ID. */
     save(content: string, toolType: string, options?: ArtifactSaveOptions): Promise<string>;
     /**
      * Check if an artifact exists.

package/dist/types/session/attempt-record-store.d.ts

@@ -0,0 +1,19 @@
+import type { AttemptScope, AttemptScopeAuthority } from "@gajae-code/agent-core/attempt-scope";
+export type AttemptExecutionState = "unknown" | "clean" | "executed";
+/**
+ * Tracks whether an attempt has had an extension handler delivered to it.
+ *
+ * Records are deliberately established in two phases: allocation registers an
+ * `unknown` record, then the session marks it `clean` immediately before the
+ * first handler-capable delivery can occur. The runner changes a clean record
+ * to `executed` immediately before invoking its first handler.
+ */
+export declare class AttemptRecordStore {
+    #private;
+    constructor(authority: AttemptScopeAuthority);
+    register(scope: AttemptScope): boolean;
+    establishClean(scope: AttemptScope): boolean;
+    markExecuted(scope: AttemptScope): boolean;
+    isClean(scope: AttemptScope): boolean;
+    retire(scope: AttemptScope): boolean;
+}