@makaio/framework 1.0.0-dev-1785409369816 → 1.0.0-dev-1786014320559

package/dist/{index-CLvQsL6s2.d.mts → index-CqQYgsbB.d.mts}

@@ -1,12 +1,11 @@
-import { r as ExecutionTarget } from "./schemas-N6x2z7Lf.mjs";
-import { l as Turn$1 } from "./index-gUhidukN.mjs";
-import { a as PipelineStep, o as SessionEditorAction, t as ActionCategory } from "./types-D7_kevBK.mjs";
+import { C as Turn$1, g as OwnedAdapterInstance, h as MachineScopedAdapterInstance } from "./index-DI7-tIL3.mjs";
+import { a as PipelineStep, o as SessionEditorAction, t as ActionCategory } from "./types-xCdGghb2.mjs";
 import { z } from "zod";
 import * as _$_makaio_core0 from "@makaio/framework/core";
 import { ExtractSubjectPayload, SubjectDefinition } from "@makaio/framework/core";
 import { IMakaioBus } from "@makaio/framework/bus";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
-import { AIReasoningLevel, AdapterRuntimeOptions, BranchKind, ContextWindowState, ForkOptions, ForkTransforms, ICapabilityProvider, IMakaioSession, JsonValue, MakaioSessionAgent, MakaioSessionEvent, Message, MessageBlock, MessageInput, NativeLocalityVerdict, ReasoningLevelMap, SessionContext, SessionEventType, SessionExtensionContext, SessionLineage, SessionLineageKind, SessionMessage, SessionMessageBlock, SessionMessageOrigin, SessionSubjects, TurnIngestionMarker, TurnInitiator, TurnUsage } from "@makaio/framework/contracts";
+import { AIReasoningLevel, AdapterRuntimeOptions, AdapterSelection, AdapterSessionClaimRecord, AgentRole, BranchKind, ContextWindowState, ForkOptions, ForkTransforms, ICapabilityProvider, IMakaioSession, JsonValue, MakaioSessionAgent, MakaioSessionEvent, Message, MessageBlock, MessageInput, NativeLocalityVerdict, OwnershipTopology, ResolvedProviderContext, SessionContext, SessionEventType, SessionExtensionContext, SessionLineage, SessionLineageKind, SessionMessage, SessionMessageBlock, SessionMessageOrigin, SessionOwnershipReclaimReason, SessionOwnershipReserveStartServiceResult, SessionSubjects, TurnIngestionMarker, TurnInitiator, TurnUsage } from "@makaio/framework/contracts";
 import { BaseService } from "@makaio/framework/service-base";
 import * as _$drizzle_orm_sqlite_core0 from "drizzle-orm/sqlite-core";
 import * as _$drizzle_orm_pg_core0 from "drizzle-orm/pg-core";
@@ -16,6 +15,32 @@ import * as _$drizzle_orm0 from "drizzle-orm";
 import * as _$_makaio_storage_core0 from "@makaio/framework/storage";
 
 //#region services/core/src/session/session-service.d.ts
+/**
+ * Host-supplied composition of the session service.
+ *
+ * Everything here belongs to the ownership authority, which is the one part of
+ * this service that cannot work from the bus alone: it has to know which
+ * machine it owns claims under, and how many runtimes may own claims there.
+ */
+interface MakaioSessionServiceOptions {
+  /**
+   * Machine identity the ownership authority owns claims under.
+   *
+   * Injected by the composition root — the ownership key is (machine, adapter
+   * instance, provider session), and an authority that resolved its own machine
+   * identity through the bus would make every ownership decision depend on
+   * adapter-runtime boot order. Omitted, every identity-dependent ownership
+   * operation answers `machine-identity-unavailable` and writes nothing, which
+   * is the correct behavior for a host that has no machine identity to offer.
+   */
+  machineId?: string;
+  /**
+   * How many runtime processes may own claims on this machine. Defaults to
+   * `'shared-machine'`; a host claims `'machine-exclusive'` only when it can
+   * prove no peer process hosts adapters on the same machine.
+   */
+  topology?: OwnershipTopology;
+}
 /**
  * Framework-core session service for managing makaio sessions.
  *
@@ -24,6 +49,12 @@ import * as _$_makaio_storage_core0 from "@makaio/framework/storage";
  * `session.turn.await`, `session.restartAgents`, `session.agent.added`, and
  * `session.agent.removed`.
  *
+ * It is also the **session-ownership authority**: the `session.ownership.*`
+ * operations, each of which is one durable ownership act, and the movement
+ * observer that settles every announced provider-session movement through them.
+ * That authority needs a machine identity, which the composition root injects
+ * (see {@link MakaioSessionServiceOptions}).
+ *
  * Host-specific handlers (search, update, resume, archive, purge, analytics,
  * context window, branching) are registered by the host session service which
  * depends on this service.
@@ -61,11 +92,15 @@ import * as _$_makaio_storage_core0 from "@makaio/framework/storage";
  * ```
  */
 declare class MakaioSessionService extends BaseService {
+  private readonly options;
   /**
    * Creates a new MakaioSessionService instance.
    * @param bus - The event bus for inter-service communication
+   * @param options - Composition of the ownership authority; omitted entirely,
+   *   the service still serves every non-ownership subject and declines the
+   *   identity-dependent ownership ones.
    */
-  constructor(bus?: IMakaioBus);
+  constructor(bus?: IMakaioBus, options?: MakaioSessionServiceOptions);
   /**
    * Initialize the service.
    *
@@ -80,6 +115,24 @@ declare class MakaioSessionService extends BaseService {
    * that do not register turn storage).
    */
   protected onInit(): Promise<void>;
+  /**
+   * Arm the ownership reconcile behind the post-coordinator barrier.
+   *
+   * Deliberately **not** run from `onInit`. This service starts inside the
+   * extension coordinator, and adapter instances register after it — so a
+   * reconcile here would probe adapters that do not exist yet and report every
+   * live claim's instance as gone. `kernel.phase.coordinatorReady` is broadcast
+   * once the coordinator has started everything, which is the first instant at
+   * which the probe means what it says.
+   *
+   * A host that never broadcasts the phase never reconciles: there is no timer
+   * and no fallback, because a reconcile at an unknown point in boot is exactly
+   * the thing this barrier exists to prevent. Failures are logged and swallowed
+   * for the same reason orphaned-turn reconciliation is — diagnostics must
+   * never keep a session service from starting.
+   * @returns Cleanup that unsubscribes the barrier if it never fires.
+   */
+  private scheduleOwnershipReconcile;
   /**
    * Close any turns left `active` from a prior process crash.
    *
@@ -94,6 +147,264 @@ declare class MakaioSessionService extends BaseService {
   private reconcileOrphanedTurns;
 }
 //#endregion
+//#region services/core/src/session/ownership/context.d.ts
+/**
+ * What the ownership authority was composed with.
+ *
+ * The machine identity is **injected, not resolved through the bus**. Resolving
+ * it per call would make every ownership decision depend on whether the adapter
+ * runtime happened to have registered its identity handler yet — a boot-order
+ * dependency the authority cannot observe and callers cannot reason about.
+ * Composed with `undefined`, the authority declines every identity-dependent
+ * operation instead of deciding under a guess.
+ */
+interface OwnershipAuthorityContext {
+  /** Bus the authority reads and writes storage through. */
+  readonly bus: IMakaioBus;
+  /** Machine identity the authority owns claims under, or `undefined` when it has none. */
+  readonly machineId: string | undefined;
+  /** {@inheritDoc OwnershipTopologySchema} */
+  readonly topology: OwnershipTopology;
+}
+//#endregion
+//#region services/core/src/session/ownership/authority.d.ts
+/**
+ * What the session-ownership authority is composed with.
+ *
+ * The same shape the operations receive, deliberately: what a caller composes
+ * the authority with *is* what every operation decides under, so there is no
+ * second declaration for the two to drift apart in.
+ */
+type SessionOwnershipAuthorityDeps = OwnershipAuthorityContext;
+/**
+ * Register the session-ownership authority.
+ *
+ * These five subjects are the service surface of the ownership aggregate, and
+ * each one is exactly one durable ownership act. That is the point: composed by
+ * a caller out of storage RPCs, a reservation or a movement is three
+ * transactions with windows in which a crash strands an ownership key or
+ * publishes a currency no generation owns.
+ * @param context - Bus, machine identity and topology to compose the authority with.
+ * @returns Cleanup function unregistering every handler.
+ */
+declare function registerSessionOwnershipAuthority(context: SessionOwnershipAuthorityDeps): () => void;
+//#endregion
+//#region services/core/src/session/ownership/movement-observer.d.ts
+/**
+ * Registers the provider-session movement observer.
+ *
+ * `agent.adapterSession.moved` is an **observation**, not a write. The seam
+ * reports where an agent's provider conversation went; what that implies for
+ * durable currency — which generation may record it, whether it supersedes
+ * anything, whether the session snapshot follows — is the ownership authority's
+ * to decide, inside one transaction. This handler's whole job is to turn the
+ * announcement into a settle request and to order the settles of one agent.
+ *
+ * **No lead guard.** A member's movement is now recorded on its own agent row,
+ * and the mirror onto the session row is gated inside the settle by the stored
+ * designation. The old handler had to drop a member's movement because the only
+ * row it could write was the session's; it also had to drop every movement
+ * announced during a start, because the designation did not exist yet. Both
+ * windows close here: the agent row always exists, and the reservation
+ * designates before the first dispatch.
+ *
+ * **No change guard.** Storage answers `idempotent` for a target that is
+ * already settled, which is a decision made against the stored row rather than
+ * against a snapshot this handler read a moment earlier.
+ *
+ * **The announcement is acknowledged, not absorbed.** `bus.emit` resolves when
+ * its handlers do, and the producer's seam contract reads that resolution as
+ * "the currency write already happened" — it is what lets a producer order the
+ * dispatch that abandons the old provider session behind the write, and what
+ * lets it hold an undelivered movement for re-announcement. So this handler
+ * waits for its queued settlement and answers honestly: it resolves only when
+ * the authority actually recorded the movement, and rejects with a
+ * {@link MovementNotSettledError} otherwise. Resolving on a refusal would let
+ * the producer retire a movement no row carries.
+ *
+ * Rejecting is the seam's negative acknowledgment, not an escaping failure: the
+ * one modeled error is what the producer catches and turns into `false`, and no
+ * other error leaves this handler unclassified.
+ * @param bus - Message bus used by the session service.
+ * @returns Cleanup function.
+ */
+declare function registerAdapterSessionMovementObserver(bus: IMakaioBus): () => void;
+//#endregion
+//#region services/core/src/session/ownership/in-flight-starts.d.ts
+/**
+ * What an attempt tells a joiner about the agent it was driving.
+ *
+ * One bit, because one bit is what every attempt can state honestly and what
+ * every joiner actually needs. The three attempts this seam carries — a fresh
+ * lead start, an attach, a reserved rehydrate — end in outcomes of three
+ * different shapes, and none of them is meaningful to a joiner that ran none of
+ * that work under none of those inputs. "Is there a connector for this agent
+ * now" is meaningful to all of them.
+ */
+type StartAttemptOutcome = /** A connector for this agent is live, as far as this attempt got. */'connected'
+/**
+ * The attempt ended without building one, and said so rather than throwing.
+ *
+ * The modeled non-successes: a recovery that deferred or was refused, a start
+ * that lost its designation race. They are *resolutions*, so a joiner watching
+ * only for a rejection cannot see them.
+ */
+| 'no-connector';
+/**
+ * One agent's start attempt, as a joinable handle.
+ *
+ * `settled` resolves — or rejects — when the attempt is completely over,
+ * including every failure-cleanup step, and it carries **the attempt's own
+ * verdict**. That is what a joiner reads.
+ *
+ * It did not always: joiners used to await the promise for its timing alone and
+ * then re-read the agent row. The row cannot answer the question. Where an
+ * attempt *writes* it the row is authoritative about the row — a fresh start's
+ * pre-dispatch failure deletes it, so mapping the rejection onto "dead" would
+ * contradict the deleted-row rule for one event — but the row was never a proxy
+ * for "a connector exists", and every place that treated it as one was one
+ * interleaving away from being wrong. A recovery that rolls its claim back to
+ * the `idle` it found leaves a row that reads *usable* behind an attempt that
+ * built nothing; an `idle` row whose connector died is exactly what the liveness
+ * probe exists to catch.
+ *
+ * So the division is: the attempt's verdict says whether a connector exists, and
+ * the row says what state the agent identity is in. A joiner needs both, and
+ * infers neither from the other. Where there is no entry to join — another
+ * process, or one that died — there is no verdict to read, and the status
+ * compare-and-swap arbitrates instead.
+ */
+interface InFlightStart {
+  /** Settles when the attempt is over, carrying what it left behind. */
+  readonly settled: Promise<StartAttemptOutcome>;
+}
+/**
+ * One call's view of {@link runExclusiveStart}.
+ *
+ * The flag is what makes the seam usable by a caller that has durable work of
+ * its own to do around the dispatch. A joiner ran none of that work — the
+ * attempt it joined did, under *its* inputs — so a joiner that went on to
+ * persist its own adapter identity, or to settle the provider session *it*
+ * planned to resume, would overwrite the identity the running attempt actually
+ * established.
+ *
+ * What a joiner consumes instead is the attempt's own verdict — see
+ * {@link InFlightStart.settled} — together with the durable agent row, which
+ * says what state the identity is in but never whether a connector exists.
+ */
+interface ExclusiveStart extends InFlightStart {
+  /**
+   * `true` when this call joined an attempt that was already running, and
+   * therefore ran no callback of its own.
+   */
+  readonly joined: boolean;
+}
+/**
+ * Register a start attempt for an agent and run it, so a concurrent consumer
+ * joins the attempt instead of racing it.
+ *
+ * The entry is published **before** `attempt` runs, and therefore before the
+ * attempt's first durable write. That ordering is the whole point: there is no
+ * instant at which a `starting` agent row is visible without its entry, so a
+ * joiner never has to guess whether an attempt is in progress here.
+ *
+ * Re-entering for an agent that already has an entry returns the existing one
+ * and does **not** run `attempt` — two lifecycle attempts for one agent
+ * identity are exactly what this seam exists to prevent. The returned handle
+ * says which of the two happened, because a caller whose `attempt` carries
+ * durable work must not repeat that work against inputs the running attempt
+ * never used (see {@link ExclusiveStart.joined}).
+ * @param agentId - Agent identity the attempt belongs to; the seam's key.
+ * @param attempt - The complete attempt, answering whether it left a connector
+ *   behind, including its reservation, its
+ *   persistence, its settlement and its failure cleanup. Nothing that can leave
+ *   durable state behind may run outside it: a joiner runs none of it, and what
+ *   sits outside would then run twice, once against the wrong inputs.
+ * @returns This call's handle — the attempt it registered, or the one it joined.
+ */
+declare function runExclusiveStart(agentId: string, attempt: () => Promise<StartAttemptOutcome>): ExclusiveStart;
+/**
+ * Look up an in-flight start without creating one.
+ *
+ * A consumer that finds an entry joins it. Finding none means the attempt
+ * belongs to a process that is gone, or to a live peer — neither of which this
+ * registry can see, so the caller arbitrates through the agent row's status
+ * compare-and-swap instead.
+ * @param agentId - Agent identity to look up.
+ * @returns The entry, or `undefined` when this process is not driving a start.
+ */
+declare function peekInFlightStart(agentId: string): InFlightStart | undefined;
+//#endregion
+//#region services/core/src/session/ownership/settle-queue.d.ts
+/**
+ * Serialize one agent's movement settlements, in receipt order.
+ *
+ * `bus.emit` runs handlers concurrently across independent producer chains —
+ * payload enrichment, connector-swap completion and turn-dispatch rotation all
+ * announce without a shared lock — so two movements for one agent otherwise
+ * interleave between the authority's revision read and its transaction, and
+ * both burn their single `currency-changed` retry against each other. Chaining
+ * per agent makes settle order equal receipt order, which is the strongest
+ * ordering an observation seam can offer: it does not claim producer order,
+ * only that what this process received first is settled first.
+ *
+ * The chain is keyed per agent rather than globally because two agents' currency
+ * rows share nothing — a global queue would serialize independent work and turn
+ * one slow settle into everyone's latency.
+ * @param agentId - Agent whose settles are being ordered.
+ * @param settle - The settle to run once every settle received earlier for this
+ *   agent has finished.
+ * @returns A promise for this settle's own completion. It rejects if `settle`
+ *   rejects; the chain itself absorbs the failure so queued successors still run.
+ */
+declare function enqueueAgentSettle(agentId: string, settle: () => Promise<void>): Promise<void>;
+//#endregion
+//#region services/core/src/session/ownership/claim-token.d.ts
+/**
+ * Mint the identity of one claim generation.
+ *
+ * The single way a generation identity comes into existence, whether the
+ * authority mints it or a caller mints one to name its own settlement with.
+ * Re-using a token whose generation is *retired* is a caller bug storage cannot
+ * defend against: retired generations are not remembered, so a released token
+ * is storable again and how it interacts with later generations is undefined.
+ * Re-offering an *unused* token — what the settle retry does — is not that: a
+ * rolled-back attempt left no row behind for it to collide with.
+ * @returns An opaque, single-use claim token.
+ */
+declare function mintClaimToken(): string;
+//#endregion
+//#region services/core/src/session/ownership/owner-liveness.d.ts
+/**
+ * Judge whether a claim's owner is gone — **for diagnostics only**.
+ *
+ * Reconcile is this function's sole caller, and the verdict it produces
+ * authorizes nothing: a takeover is a predicate evaluated inside the taking
+ * transaction, over the incumbent's own agent row, and it never consults a
+ * probe or a filed verdict. Keeping the assessment out of the authorization
+ * path is what makes the authorization impossible to base on evidence that is
+ * stale, replayed, or contradicted by a concurrent writer.
+ *
+ * Reasons are tested in order of how provable they are, and the first that
+ * holds is reported:
+ *
+ * - `agent-gone` — the agent row is absent. Rare, because both claim foreign
+ *   keys cascade and normally remove the claim with its parent; kept because a
+ *   diagnostic must report what it observes, and a probe can straddle a delete.
+ * - `agent-disposed` — the agent was removed. A disposed agent can never
+ *   legitimately hold a key.
+ * - `adapter-instance-gone` — no adapter answers for the claim's instance.
+ *   Admitted **only** under `machine-exclusive`: where peers may host adapters
+ *   on the same machine, an unanswered probe means "not this runtime's", never
+ *   "nobody's".
+ * @param bus - Bus used for the agent read and the adapter probe.
+ * @param topology - How many runtime processes may own claims on this machine;
+ *   the one input that decides whether the adapter probe is evidence at all.
+ * @param claim - The claim whose owner is being assessed.
+ * @returns The first reason that holds, or `null` when the owner looks alive.
+ */
+declare function assessClaimOwner(bus: IMakaioBus, topology: OwnershipTopology, claim: AdapterSessionClaimRecord): Promise<SessionOwnershipReclaimReason | null>;
+//#endregion
 //#region services/core/src/session/session-service-handlers-core.d.ts
 /**
  * Dependencies required to register the framework-core session service handlers.
@@ -105,13 +416,28 @@ declare class MakaioSessionService extends BaseService {
 interface CoreSessionServiceHandlerDeps {
   /** The event bus used for handler registration and storage dispatch. */
   bus: IMakaioBus;
+  /**
+   * Machine identity the ownership authority owns claims under.
+   *
+   * Injected by the composition root, never resolved through the bus: an
+   * ownership decision must not depend on whether the adapter runtime's
+   * identity handler happened to register first. Absent, every
+   * identity-dependent ownership operation declines instead of guessing.
+   */
+  machineId?: string;
+  /**
+   * How many runtime processes may own claims on this machine. Defaults to
+   * `'shared-machine'` — the reading no host can be wrong about.
+   */
+  topology?: OwnershipTopology;
 }
 /**
  * Registers the framework-core session service handlers:
  * `session.create`, `session.get`, `session.list`, `session.turn.await`,
  * `session.close`, `session.restartAgents`, `session.update`,
  * `session.archive`, `session.purge`,
- * `session.agent.added`, and `session.agent.removed`.
+ * `session.agent.added`, `session.agent.removed`, and the five
+ * `session.ownership.*` operations of the ownership authority.
  *
  * These handlers cover the minimal, load-bearing session contract for the
  * framework SDK. Host-specific handlers (search, resume, analytics, context
@@ -120,7 +446,7 @@ interface CoreSessionServiceHandlerDeps {
  * Persistence degrades gracefully when no storage handlers are registered:
  * `session.get` / `session.list` / `session.close` all delegate to
  * `SessionStorageSubjects.*` which may be unhandled in ephemeral mode.
- * @param deps - Bus dependency
+ * @param deps - Bus, plus the identity the ownership authority is composed with
  * @returns Array of cleanup callbacks, one per registered handler
  */
 declare function registerCoreSessionServiceHandlers(deps: CoreSessionServiceHandlerDeps): Array<() => void>;
@@ -148,16 +474,22 @@ interface ISessionOrchestrator {
  *
  * Registers the core session orchestration handlers:
  * 1. Get or create session (via `getOrCreateSession`)
- * 2. Start agent if session has no agents — resolves the canonical
+ * 2. Resolve any start the session has in flight (via `resolveInFlightStarts`),
+ *    before anything probes an agent or concludes the session has none
+ * 2b. Refuse a send that stated targets (named ids or `'all'`) against a session
+ *    that has none — before the start below, so a refused send leaves no agent
+ *    and no reservation; only the default send may bootstrap a session
+ * 3. Start the lead agent if the session has no agents — resolves the canonical
  *    `adapterName` from direct selections, uses `adapterId` directly when
- *    provided, otherwise resolves it via `AdapterRegistry`, resolves
- *    provider credentials when selected, then calls `AdapterSubjects.startAgent`
- * 3. Resolve target agents (via `resolveTargetAgents`)
- * 4. Verify agent liveness and build recovery context for dead agents
- *    (requestOptional `AdapterSubjects.getAgent` + `buildRecoveryContext`)
- * 5. Get or create turn (via `SessionTurnManager`)
- * 6. Generate message ID and store user message (awaited, persist-before-route)
- *    + routing records (fire-and-forget)
+ *    provided, otherwise resolves it via `AdapterRegistry`, resolves provider
+ *    credentials when selected, then runs the reserved start (via
+ *    `startLeadAgent`)
+ * 4. Resolve target agents (via `resolveTargetAgents`)
+ * 5. Verify agent liveness and recover dead agents under one recovery plan
+ *    (requestOptional `AdapterSubjects.getAgent` + `buildPlannedRecoveryContext`)
+ * 6. Get or create turn (via `SessionTurnManager`), generate the message ID and
+ *    store the user message (awaited, persist-before-route) + routing records
+ *    (fire-and-forget)
  * 7. Emit `session.turn.started` + `session.user_message.sent`
  * 8. Route to agents (via `routeToAgentsCore`, single shared context)
  * 9. Return result with `messageId`, `turnId`, `sessionId`
@@ -197,17 +529,98 @@ declare class SessionOrchestrator implements ISessionOrchestrator {
    *
    * Core flow:
    * 1. Get or create session
-   * 2. Start agent if session has no agents (canonicalize direct selections,
-   *    resolve adapterId, resolve provider credentials, startAgent)
-   * 3. Resolve target agents
-   * 4. Verify agent liveness and build recovery context for dead agents
-   * 5. Get or create turn (via SessionTurnManager)
-   * 6. Generate message ID and store user message (awaited) + routing records (fire-and-forget)
+   * 2. Join or arbitrate every start the session has in flight
+   * 2b. Refuse a target-stating send (named ids or `'all'`) against a session
+   *    with no agents, before the bootstrap can leave state behind a send that
+   *    cannot deliver
+   * 3. Start the lead agent if the session has no agents (canonicalize direct
+   *    selections, resolve adapterId, resolve provider credentials, reserved start)
+   * 4. Resolve target agents
+   * 5. Verify agent liveness and recover dead agents under one recovery plan
+   * 6. Get or create turn (via SessionTurnManager), generate the message ID and
+   *    store the user message (awaited) + routing records (fire-and-forget)
    * 7. Emit turn.started + user_message.sent
    * 8. Route to agents (routeToAgentsCore, single shared context)
    * 9. Return result with messageId, turnId, sessionId
    */
   private registerSendMessageHandler;
+  /**
+   * Probe this send's targets and recover the ones that are gone.
+   *
+   * **An agent whose in-flight start this send consumed *locally* needs no
+   * probe; one it merely out-raced does.** The distinction is the evidence
+   * behind the verdict. A locally joined attempt reported what it built, and
+   * this process ran it. A won compare-and-swap reports only that this caller
+   * wrote a status first: the attempt it outran belongs to a process this
+   * runtime cannot see, and writing `dead` does not make the agent dead. Wave 3
+   * cannot ask whether that process is alive (OQ-B, Wave 4) — but it can ask
+   * whether a *connector* answers, which is what the probe already does for
+   * every other target and the only instrument here that carries evidence
+   * across processes. Skipping it there was the send believing its own status
+   * write, and it is what let a second lifecycle open beside a live one.
+   *
+   * The framework orchestrator evaluates no locality, so it can make only one
+   * honest recovery decision: the replacement connector starts fresh and the
+   * stored conversation is injected. Holding it as a plan keeps the history
+   * assembly and the rehydrate reading one decision — a host that later resumes
+   * natively here changes that value alone and both sides follow.
+   *
+   * Each recovery is reserved and runs inside the in-flight-start seam, which
+   * the entry-point inventory requires of every service-owned path that can
+   * reach a lifecycle call for an *existing* agent identity: two concurrent
+   * sends onto one dead agent would otherwise dispatch two rehydrates, and the
+   * second would race the first's connector.
+   * @param session - Session being sent to.
+   * @param targetAgents - Targets this send materialised.
+   * @param recovering - Agents whose in-flight start this send already claimed.
+   * @param arbitrated - Of those, the ones claimed by compare-and-swap against another process.
+   * @returns The injected history, when any agent needed it, and the agents this runtime may not drive.
+   */
+  private recoverDeadTargets;
+  /**
+   * Re-resolve a send's targets around agents this runtime may not drive.
+   *
+   * The three send forms degrade differently, and the difference is deliberate:
+   *
+   * - **lead-default** — a deferred lead is always *total*, because target
+   *   resolution raises for a session whose named lead it cannot resolve, so
+   *   there is no state in which the default send proceeds with "the other
+   *   usable agents". The session re-enters the fresh-start branch and gains a
+   *   **new** lead agent, which the stored conversation is injected into. That
+   *   is what fresh-with-history means once the old agent is owned elsewhere: a
+   *   fresh *agent*, not a second connector bolted onto one this runtime does
+   *   not own.
+   * - **`'all'`** — deliver to the usable ones; a broadcast with no recipient
+   *   is not a delivery and fails.
+   * - **an explicit array** — deliver to the usable ones; a caller that named
+   *   its agents gets a failure rather than a substitute, because substituting
+   *   would answer a question nobody asked.
+   * @param context - The send's identity, target spec and start inputs.
+   * @param targetAgents - Targets as this send materialised them.
+   * @param deferredAgentIds - Agents held by a generation this runtime does not own.
+   * @returns The surviving targets, and what a replacement start left for the caller to finish.
+   * @throws A {@link SessionStartError} when every target deferred and no fresh start applies.
+   */
+  private retargetAfterDeferral;
+  /**
+   * Start the session's lead agent, reserved and in the order §7.1 prescribes.
+   *
+   * Only the adapter selection is resolved here; the reordered start itself —
+   * mint the identity, register the attempt, persist the row, reserve, dispatch,
+   * settle, transition — lives in `startLeadAgent` so this class keeps only the
+   * selection knowledge that is genuinely orchestrator-owned.
+   *
+   * A lost designation race is not an error: the session now has the winner's
+   * agent, and this send continues against it. Only a session that *still* has
+   * no agents after the re-read has nothing to send to.
+   * @param session - Session being sent to; its agents and lead are updated in place.
+   * @param sessionId - Resolved session identity.
+   * @param agentSelection - Public agent selection from the request.
+   * @param message - User message, used as canonical-model prompt context.
+   * @param sessionContext - Session context passed through to the adapter.
+   * @returns What the adopted agents need, empty unless a race was lost.
+   */
+  private startLeadAgent;
   /**
    * Complete a turn by delegating to `SessionTurnManager`.
    *
@@ -221,37 +634,6 @@ declare class SessionOrchestrator implements ISessionOrchestrator {
    * Stop the orchestrator and clean up all subscriptions and composition utilities.
    */
   destroy(): void;
-  /**
-   * Resolve the adapter name for a direct adapter selection.
-   *
-   * Adapter startup and persisted identity require a stable adapter name.
-   * When the caller provides `adapterId`, the framework validates any explicit
-   * name against the adapter-subsystem reverse lookup and otherwise backfills the
-   * canonical adapter name from that subsystem-owned mapping.
-   * @param selection - Direct adapter selection
-   * @param sessionId - Session ID used in error messages
-   * @returns Resolved adapter name
-   */
-  private resolveAdapterName;
-  /**
-   * Resolve the public agent selection into the direct adapter shape required
-   * by the framework orchestrator's startup path.
-   * @param selection - Public session agent selection from the request.
-   * @param sessionId - Session ID used for context and diagnostics.
-   * @param message - User message used as canonical-model prompt context.
-   * @param sessionContext - Optional session context passed through the request.
-   * @returns Direct adapter selection for `adapter.startAgent`.
-   */
-  private resolveInitialAdapterSelection;
-  /**
-   * Resolve a framework-owned canonical-model selection to a direct adapter selection.
-   * @param selection - Canonical model selection from the session request.
-   * @param sessionId - Session ID used for context and diagnostics.
-   * @param message - User message used as canonical-model prompt context.
-   * @param sessionContext - Optional session context passed through the request.
-   * @returns Direct adapter selection with resolved adapter, provider config, and model.
-   */
-  private resolveCanonicalModelSelection;
 }
 //#endregion
 //#region services/core/src/session/adapter-registry.d.ts
@@ -276,6 +658,13 @@ declare class AdapterRegistry {
    * the new `adapterId` silently overwrites the previous mapping. This is intentional:
    * adapters that restart emit a fresh initialized event and the registry should
    * reflect the latest instance.
+   *
+   * **The event names no machine**, and the bus can span hosts, so an instance
+   * learned this way is *unattributed*: it says an adapter of this name exists
+   * somewhere reachable, not that it belongs to any particular machine. It is
+   * therefore cached in the unscoped scope only, and a lookup that named a
+   * machine is never served from it — answering one would be a guess about the
+   * very identity the caller was careful enough to name.
    * @param bus - The event bus to listen on
    */
   constructor(bus: IMakaioBus);
@@ -294,10 +683,18 @@ declare class AdapterRegistry {
    * keeps legacy event-driven tests and observers useful, but session routing
    * must prefer the replayable request seam so a session created after adapter
    * initialization does not miss a one-time event.
+   * **Naming the machine is what makes the answer usable as an ownership key.**
+   * An instance ID is derived from `(machineId, adapterName)`, so a caller that
+   * will reserve or settle under a particular machine has to resolve for that
+   * same machine — otherwise the instance it dispatches to and the namespace it
+   * claims in come from two different identities and the key protects nothing.
+   * Omitted, the resolver derives the runtime's own, which is what a caller with
+   * no machine of its own to act for wants.
    * @param adapterName - Adapter type name (e.g., `'openai-node'`)
+   * @param machineId - Machine to resolve the instance for; omit for the runtime's own.
    * @returns Adapter runtime identifier for bus routing.
    */
-  resolveAvailable(adapterName: string): Promise<string>;
+  resolveAvailable(adapterName: string, machineId?: string): Promise<string>;
   /** Stop listening to `adapter.initialized` events and clear the registry. */
   destroy(): void;
 }
@@ -382,41 +779,139 @@ declare function resolveTargetAgents(session: IMakaioSession, targetSpec: string
  */
 declare function findTurnByAgent(activeTurns: Map<string, Turn$1>, agentId: string): Turn$1 | undefined;
 //#endregion
-//#region services/core/src/session/utils/resolution.d.ts
+//#region services/core/src/session/utils/start-reservation.d.ts
+/** What every start reservation names, whatever role it takes. */
+interface StartReservationIdentity {
+  /** Session the agent belongs to; verified against the agent row by the authority. */
+  readonly sessionId: string;
+  /** Agent the reservation is taken for. */
+  readonly agentId: string;
+  /** Adapter type name carried onto any claim for diagnostics. */
+  readonly adapterName: string;
+  /** Instance the dispatch addresses, and the machine its ownership acts are filed under. */
+  readonly instance: OwnedAdapterInstance;
+  /** Provider session to reserve, or `null` for a start with no key yet. */
+  readonly resumeProviderSessionId: string | null;
+}
 /**
- * Resolve adapterName → adapterId for bus routing.
- * Queries the adapters table for a local enabled instance.
- * @param bus - Bus instance
- * @param adapterName - Adapter type name
- * @param machineId - Optional machine ID for deterministic local resolution
- * @returns Canonical adapter ID for bus routing
- * @throws if no enabled instance found for this adapterName
+ * The designation half, as a union rather than an optional field.
+ *
+ * A lead reservation is a compare-and-swap and must name the exact value the
+ * caller read; `null` is a legitimate observation ("the session named no lead")
+ * and therefore cannot double as "not supplied". Modelling it as one optional
+ * field would make the authority's own refusal — *`expectedLeadAgentId` is
+ * required when role is `'lead'`* — reachable from these four callers, which is
+ * exactly what a union makes impossible to write.
+ */
+type StartReservationDesignation = {
+  /** This start designates the session's lead. */readonly role: Extract<AgentRole, 'lead'>; /** Lead the caller observed on the session row, or `null` when it named none. */
+  readonly expectedLeadAgentId: string | null;
+} | {
+  /** This start leaves the designation untouched. */readonly role: Exclude<AgentRole, 'lead'>;
+};
+/** Everything a start reservation names beyond the instance it runs against. */
+type StartReservationRequest = StartReservationIdentity & StartReservationDesignation;
+/**
+ * Take one start reservation.
+ *
+ * Issued as a **hard** request by every caller, and that is deliberate rather
+ * than incidental: a host that can dispatch a start and cannot reserve one is a
+ * broken composition, not a lightweight one, and a degrade here would make that
+ * misconfiguration indistinguishable from a supported topology. Each caller owns
+ * what a throw means for its own rollback, so no attempt is made to classify it
+ * here.
+ * @param bus - Bus the reservation is issued on.
+ * @param request - Identity, instance, role and resume target of the start being reserved for.
+ * @returns What the authority answered, verbatim.
  */
-declare function resolveAdapterId(bus: IMakaioBus, adapterName: string, machineId?: string): Promise<string>;
+declare function reserveStartFor(bus: IMakaioBus, request: StartReservationRequest): Promise<SessionOwnershipReserveStartServiceResult>;
+//#endregion
+//#region services/core/src/session/recovery-plan.d.ts
 /**
- * Resolve supported reasoning levels for a model from provider definitions.
+ * Continue the agent's existing provider conversation.
  *
- * Looks up the provider config by ID, finds the provider definition it belongs to,
- * then finds the model's `supportedReasoningLevels` in the provider's `availableModels`
- * catalog.
- * @param bus - Bus instance for RPC calls
- * @param providerConfigId - Canonical provider config ID (ProviderConfigRecord.id)
- * @param model - Model identifier to look up in the provider's catalog
- * @returns Object with `supportedReasoningLevels` when found, or `undefined` when not resolvable
+ * The provider still holds the conversation, so history must **not** be
+ * injected — the model would see every prior message twice.
  */
-declare function resolveModelCapabilities(bus: IMakaioBus, providerConfigId: string | undefined, model: string | undefined): Promise<{
-  supportedReasoningLevels?: ReasoningLevelMap;
-} | undefined>;
+interface NativeResumeRecoveryPlan {
+  readonly kind: 'native-resume';
+  /** Provider session the replacement connector resumes. */
+  readonly resumeAdapterSessionId: string;
+}
 /**
- * Resolves the effective execution target for a session.
- * Priority: explicit executionTargetId → system default (local).
- * @param bus - Makaio bus instance
- * @param params - Resolution parameters from session context
- * @returns Resolved execution target
+ * Start a fresh provider session and inject the stored conversation.
+ *
+ * This is the "warm-fresh" case named in the session-locality design: the agent
+ * record survives, but its provider conversation does not — either because the
+ * provider session is unreachable (foreign machine, unsupported adapter,
+ * unconfirmed movement) or because the agent never had a confirmed one. The
+ * caller owns history injection; without it the model starts blank on a session
+ * that visibly has prior turns.
  */
-declare function resolveExecutionTarget(bus: IMakaioBus, params: {
-  executionTargetId?: string;
-}): Promise<ExecutionTarget>;
+interface FreshWithHistoryRecoveryPlan {
+  readonly kind: 'fresh-with-history';
+}
+/**
+ * How one agent regains its conversation when its connector is gone.
+ *
+ * Produced by {@link planAgentRecovery} (or taken as
+ * {@link FRESH_WITH_HISTORY_RECOVERY_PLAN} where no provider session can exist)
+ * and read back through {@link recoveryPlanResumeTarget} and
+ * {@link recoveryPlanRequiresHistory}, so the rehydrate call and the history
+ * routing cannot drift apart.
+ */
+type RecoveryPlan = NativeResumeRecoveryPlan | FreshWithHistoryRecoveryPlan;
+/**
+ * The fresh-with-history plan.
+ *
+ * Shared frozen instance: the variant carries no per-agent data, and a single
+ * instance keeps call sites from implying that it does.
+ */
+declare const FRESH_WITH_HISTORY_RECOVERY_PLAN: FreshWithHistoryRecoveryPlan;
+/**
+ * Derive the recovery plan for one agent from its locality verdict.
+ *
+ * Native resume requires both halves of the gate:
+ * - the verdict is `native` — this machine owns the provider session store, the
+ *   adapter can resume, and the resume currency is intact; and
+ * - the agent's own settled currency names a provider session.
+ *
+ * A native verdict with no resolved currency stays fresh-with-history. The
+ * verdict is computed from session-level structural signals, so borrowing
+ * another agent's provider session to satisfy it would attach two agents to one
+ * provider conversation.
+ *
+ * **The target is settled currency, not an origin column.** Callers resolve it
+ * through `resolveAgentResumeIdentity`, which follows a movement the ownership
+ * seam settled onto the agent row; the immutable `adapterSessionId` records only
+ * where the conversation started. Passing the raw column here would evaluate the
+ * verdict against the currency and then resume the pre-movement session anyway.
+ * @param verdict - Native locality verdict evaluated for this agent
+ * @param agentAdapterSessionId - Resume currency resolved for this agent, or `undefined` when nothing is resumable
+ * @returns Native-resume plan when both halves of the gate hold, fresh-with-history otherwise
+ */
+declare function planAgentRecovery(verdict: NativeLocalityVerdict, agentAdapterSessionId: string | undefined): RecoveryPlan;
+/**
+ * Resume target the plan hands to `adapter.rehydrateAgent`.
+ * @param plan - Recovery plan decided for this agent
+ * @returns Provider session to resume, or `undefined` for a fresh replacement connector
+ */
+declare function recoveryPlanResumeTarget(plan: RecoveryPlan): string | undefined;
+/**
+ * Whether the caller must inject the stored conversation alongside the rehydrate.
+ *
+ * Exactly the inverse of {@link recoveryPlanResumeTarget} being defined — stated
+ * as its own predicate so the history side reads the decision instead of
+ * re-deriving it from the absence of a resume target.
+ *
+ * Declared as a type predicate rather than left to inference: a caller that
+ * returns early on history keeps a `native-resume` plan afterwards, and that
+ * narrowing is part of what this function promises. Inferring it would make the
+ * promise depend on the checker's version rather than on the signature.
+ * @param plan - Recovery plan decided for this agent
+ * @returns `true` when the replacement connector starts without provider-side history
+ */
+declare function recoveryPlanRequiresHistory(plan: RecoveryPlan): plan is FreshWithHistoryRecoveryPlan;
 //#endregion
 //#region services/core/src/session/utils/recovery-context.d.ts
 /**
@@ -430,6 +925,19 @@ declare function resolveExecutionTarget(bus: IMakaioBus, params: {
  * @returns SessionContext with messageHistory and isFirstTurn signal
  */
 declare function buildRecoveryContext(bus: IMakaioBus, session: IMakaioSession): Promise<SessionContext>;
+/**
+ * Build the session context a recovery plan calls for.
+ *
+ * This is the history half of the recovery contract: it consumes the same
+ * {@link RecoveryPlan} the rehydrate call consumes, so a natively resumed agent
+ * can never also be handed the conversation the provider already holds, and a
+ * fresh-with-history agent can never start blank.
+ * @param bus - Bus instance
+ * @param session - Session whose conversation is projected
+ * @param plan - Recovery plan decided for the agents being recovered
+ * @returns Full-history context for a fresh-with-history plan, `undefined` for native resume
+ */
+declare function buildPlannedRecoveryContext(bus: IMakaioBus, session: IMakaioSession, plan: RecoveryPlan): Promise<SessionContext | undefined>;
 //#endregion
 //#region services/core/src/session/utils/agent-recovery.d.ts
 /**
@@ -441,14 +949,35 @@ interface RecoveryConfig {
   /** Model identifier (e.g., 'claude-sonnet-4-20250514', 'gpt-4o') */
   model?: string;
   /**
-   * Provider-native session ID to resume.
+   * Whether the replacement connector resumes the provider conversation or
+   * starts fresh and receives the stored conversation as injected history.
+   *
+   * Required, and required to be the same value the caller feeds to its history
+   * assembly (via `buildPlannedRecoveryContext`): the two halves of a
+   * recovery are only correct together. Deciding native resume here while
+   * building history there replays the conversation into a provider session that
+   * already holds it; deciding fresh here without building history there starts
+   * the model blank on a session with prior turns.
+   *
+   * Locality evaluation belongs to the caller — see `planAgentRecovery`.
+   */
+  plan: RecoveryPlan;
+  /**
+   * Machine identity every ownership act of this recovery names.
+   *
+   * A recovery reserves and settles under a machine, and addresses an adapter
+   * instance that is derived from one — so both have to come from the *same*
+   * identity or the key they build is one no other actor computes. Supplying it
+   * is therefore not an optimisation: without it the instance is resolved for
+   * this runtime's own machine (or falls back to the agent's persisted one)
+   * while the authority files the acts under its default, which is the mixed key
+   * the aggregate exists to prevent.
    *
-   * When set, the adapter creates the connector in native-resume mode so the
-   * provider session continues from where it left off. The caller is responsible
-   * for evaluating locality (machine identity, adapter capability, CWD match)
-   * before setting this field.
+   * Omitted only by a caller that genuinely has no machine identity — a headless
+   * host, a test composition — where every act is unscoped and consistent for
+   * that reason.
    */
-  resumeAdapterSessionId?: string;
+  machineId?: string;
 }
 /**
  * Ensure agent cwd matches desired cwd, swapping connector if needed.
@@ -492,18 +1021,47 @@ declare function ensureAgentModel(bus: IMakaioBus, agent: MakaioSessionAgent, de
   changed: true;
   swapped: boolean;
 }>;
+/**
+ * What a liveness-and-recovery pass leaves its caller with.
+ *
+ * Three sets rather than two, because a recovery can now end in a third state:
+ * the agent's provider session is held by a generation this runtime does not
+ * own, so no connector was built and none may be. The helper **names** that set
+ * and decides nothing with it — it has no session, no orchestrator and no way
+ * to start anything, and what a product does without those agents differs per
+ * product.
+ */
+interface VerifiedAgents {
+  /** Agents this runtime may drive. */
+  readonly usable: MakaioSessionAgent[];
+  /** Agents recovered during this call. */
+  readonly recoveredAgentIds: Set<string>;
+  /**
+   * Agents this runtime may **not** drive: their provider session is held by a
+   * generation it does not own (I23a). Never empty-able by retrying — the
+   * caller must decide what its product does without them.
+   */
+  readonly deferredAgentIds: Set<string>;
+}
 /**
  * Verify liveness of agents and recover any that are dead.
- * Queries each agent via getAgent; if unresponsive, triggers connector swap via recoverAgent.
+ * Queries each agent via getAgent; if unresponsive, triggers a reserved
+ * rehydrate via recoverAgent.
+ *
+ * The caller's `recoveryConfig.plan` applies to every agent recovered in this
+ * batch and must be the same plan the caller feeds to its history assembly.
+ *
+ * The **adapter instance is resolved per agent**, inside the loop, and not once
+ * for the batch: a batch may span adapters, and a persisted `adapterId` goes
+ * stale across a runtime restart or failover. Resolving per agent is what keeps
+ * each rehydrate addressed to the live instance that actually owns that agent's
+ * adapter, and keeps a single unresolvable adapter from deciding the batch.
  * @param bus - Bus instance
  * @param agents - Agents to verify
- * @param recoveryConfig - Configuration for recovering dead agents
- * @returns Verified/recovered agents and set of recovered agent IDs
+ * @param recoveryConfig - Configuration for recovering dead agents, including the shared recovery plan
+ * @returns Usable agents, the ones recovered here, and the ones this runtime may not drive
  */
-declare function verifyAndRecoverAgents(bus: IMakaioBus, agents: MakaioSessionAgent[], recoveryConfig: RecoveryConfig): Promise<{
-  verifiedAgents: MakaioSessionAgent[];
-  recoveredAgentIds: Set<string>;
-}>;
+declare function verifyAndRecoverAgents(bus: IMakaioBus, agents: MakaioSessionAgent[], recoveryConfig: RecoveryConfig): Promise<VerifiedAgents>;
 /**
  * Build recovery context and apply optional additional transforms.
  * @param bus - Bus instance
@@ -514,18 +1072,51 @@ declare function verifyAndRecoverAgents(bus: IMakaioBus, agents: MakaioSessionAg
 declare function buildRecoveryContextWithPipeline(bus: IMakaioBus, session: IMakaioSession, options?: {
   pipeline?: PipelineStep[];
 }): Promise<SessionContext>;
+/** How one agent's recovery ended, for a caller that has a fallback for neither. */
+type AgentRecoveryOutcome = /** A connector is live again; the agent carries the instance it now lives on. */{
+  readonly kind: 'recovered';
+  readonly agent: MakaioSessionAgent;
+}
 /**
- * Recover a dead agent by triggering connector swap via the adapter.
+ * This runtime may not drive the agent: its provider session is held by a
+ * generation it does not own. Nothing was dispatched and nothing may be.
+ */
+| {
+  readonly kind: 'deferred';
+  readonly reason: 'occupied' | 'machine-identity-unavailable';
+};
+/**
+ * Recover a dead agent under the ownership authority.
  * The agent keeps its identity — no session mutation needed.
  *
  * Context delivery happens via the normal sendMessage path that follows
  * recovery (same handler invocation). No staging needed.
+ *
+ * **The instance is an input, never resolved here — and it arrives with its
+ * machine.** The ownership key is `(machine, adapter instance, provider session)`,
+ * so the reservation this makes has to name the very instance the rehydrate is
+ * dispatched to, in the namespace of the machine that instance was derived for.
+ * Resolving internally would put the reservation and the dispatch in two
+ * different namespaces whenever the persisted ID went stale; taking the machine
+ * as a *second*, independent input would let a caller supply two halves that
+ * were never one key. The resolver hands out both together or neither, and this
+ * signature only accepts it that way.
+ *
+ * The reserved rehydrate runs inside the in-flight-start seam, so a concurrent
+ * consumer that finds this agent mid-recovery joins the attempt instead of
+ * starting a second lifecycle for the same identity — and consumes that join
+ * through the shared seam, which classifies the row the attempt left behind
+ * rather than reading its own success into the absence of a rejection.
  * @param bus - Bus instance
- * @param deadAgent - The dead agent to recover
+ * @param deadAgent - The dead agent to recover; its `adapterId` is re-stamped to the instance the
+ *   attempt actually used
  * @param recoveryConfig - Configuration for the recovered connector
- * @returns Same agent reference — identity preserved
+ * @param instance - Live instance to rehydrate into and the machine its ownership acts name, resolved
+ *   by the caller for THIS agent
+ * @returns The recovered agent, or the statement that this runtime may not drive it
+ * @throws Whatever {@link failedRehydrateError} raises when the recovery failed rather than deferred
  */
-declare function recoverAgent(bus: IMakaioBus, deadAgent: MakaioSessionAgent, recoveryConfig: RecoveryConfig): Promise<MakaioSessionAgent>;
+declare function recoverAgent(bus: IMakaioBus, deadAgent: MakaioSessionAgent, recoveryConfig: RecoveryConfig, instance: OwnedAdapterInstance): Promise<AgentRecoveryOutcome>;
 //#endregion
 //#region services/core/src/session/utils/turn-initiator.d.ts
 /**
@@ -540,6 +1131,53 @@ declare function recoverAgent(bus: IMakaioBus, deadAgent: MakaioSessionAgent, re
  */
 declare function buildTurnInitiator(source: 'extension' | 'user' | 'system' | undefined, extensionId: string | undefined): TurnInitiator;
 //#endregion
+//#region services/core/src/session/session-orchestrator-selection.d.ts
+/** What resolving a fresh start's instance needs beyond the selection itself. */
+interface SelectionInstanceContext {
+  /** Adapter type name already resolved for the selection. */
+  readonly adapterName: string;
+  /** Session identity, for the refusal message. */
+  readonly sessionId: string;
+  /** This runtime's machine identity, used when it resolves the instance itself. */
+  readonly machineId: string;
+  /** Registry that resolves an adapter name to a live instance for a named machine. */
+  readonly registry: Pick<AdapterRegistry, 'resolveAvailable'>;
+}
+/**
+ * Resolve the instance a fresh lead start dispatches to, together with the
+ * machine every one of its ownership acts names.
+ *
+ * **A fresh start always has a machine, and that is what closes the last hole
+ * in the degrade matrix.** Its *reservation* is keyless and therefore cannot
+ * see the machine's absence — but its *settlement* is keyed, on the provider
+ * session the connector confirms, so an unnamed machine surfaced there as an
+ * outcome no caller on this path had a policy for. Naming the machine here
+ * removes the case by construction rather than by a new branch.
+ *
+ * Two shapes, and the asymmetry is deliberate:
+ *
+ * - **No instance named:** resolve one for this runtime's own machine, and
+ *   hand that same machine to the start. The instance ID is derived from
+ *   `(machineId, adapterName)`, so passing one identity to the resolution and
+ *   the other to the start is the mixed key; passing the same value to both is
+ *   what makes them provably agree.
+ * - **An instance named:** its machine comes from the caller, because the
+ *   derivation is one-way and this runtime must not invent one.
+ *
+ * **A selection that named one half without the other is refused before either
+ * branch runs**, by the rule {@link describeHalfNamedInstanceRefusal} states for
+ * every path that reads the pair. Refusing first is what makes the two branches
+ * above total: each one holds a pair it can honour, so neither has to decide what
+ * to do with half of one.
+ * @param bus - Bus the resolution is issued on.
+ * @param selection - Direct adapter selection this start runs from.
+ * @param context - Adapter name, session identity, this runtime's machine and its instance registry.
+ * @returns The instance and the machine, as one key.
+ * @throws A {@link SessionStartError} when a named instance carries no machine, or
+ *   a named machine carries no instance.
+ */
+declare function resolveSelectionOwnedInstance(bus: IMakaioBus, selection: AdapterSelection, context: SelectionInstanceContext): Promise<MachineScopedAdapterInstance>;
+//#endregion
 //#region services/core/src/session/context-window/types.d.ts
 /**
  * Context window tracking types for per-session aggregation.
@@ -763,6 +1401,60 @@ declare function registerListActionsHandler(bus: IMakaioBus): () => void;
  * or contains only whitespace
  */
 declare function normalizeSelectionString(value: string | undefined): string | undefined;
+/** What a caller may know about the instance a selection named, once normalized. */
+interface NamedSelectionInstance {
+  /** Instance the selection named, or `undefined` when it named none. */
+  readonly adapterId: string | undefined;
+  /** Machine the selection named, or `undefined` when it named none. */
+  readonly machineId: string | undefined;
+}
+/** Session identity and the prefix a caller's own messages carry. */
+interface SelectionRefusalContext {
+  /** Session the selection was submitted for, for the refusal message. */
+  readonly sessionId: string;
+  /** Prefix of the caller's own error messages; include the trailing space. */
+  readonly errorPrefix: string;
+}
+/**
+ * Explain why a selection naming one half of the instance/machine pair must be
+ * refused rather than served.
+ *
+ * **One rule, every path that reads the pair.** An instance ID is a one-way hash
+ * of `(machineId, adapterName)`, so the two halves are only ever honest together:
+ *
+ * - **A machine and no instance** cannot be served, because resolving an instance
+ *   without one named derives it for the runtime doing the resolving. Honouring
+ *   the name is not what that derivation does, and ignoring it starts the agent
+ *   here while the caller believes it chose a host.
+ * - **An instance and no machine** cannot be completed, because the derivation
+ *   cannot be inverted. Filling the gap with the resolving runtime's own machine
+ *   files every ownership act under a key no other actor computes — it collides
+ *   with nothing, so it protects nothing, while the runtime that really owns the
+ *   instance claims the same provider session beside it.
+ *
+ * **Stated once, thrown by each caller in its own error form**, because the paths
+ * that read the pair do not share one: a start refuses with a typed start error, an
+ * attach with its own handler error. Returning the reason rather than throwing it
+ * is what lets the rule be one rule without making the paths converge on an error
+ * type none of them owns.
+ *
+ * **Needed as well as the selection schema**, whose two refinements forbid both
+ * shapes: payload validation returns early in production builds and in-process
+ * callers reach these paths with an unparsed selection, so the schema is a guard
+ * against *writing* such a caller while this is what an existing one meets.
+ *
+ * **No path is exempt, including the one that looked like it had a softer answer.**
+ * An attach used to serve a named instance with no machine as a locality degrade,
+ * on the grounds that a fresh-with-history conversation is still worth offering.
+ * The degraded attach still starts, and its settlement still files the confirmed
+ * provider session under the resolving runtime's machine while the dispatch
+ * addressed the named instance — so the softer answer was the mis-key, taken one
+ * step later.
+ * @param named - Normalized instance and machine the selection named
+ * @param context - Session identity and the prefix of the caller's own messages
+ * @returns The refusal, or `undefined` when the selection named both halves or neither
+ */
+declare function describeHalfNamedInstanceRefusal(named: NamedSelectionInstance, context: SelectionRefusalContext): string | undefined;
 /**
  * Resolve the canonical `adapterName` for a given deterministic `adapterId`,
  * rejecting when the caller-supplied name does not match the subsystem lookup.
@@ -978,6 +1670,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -998,6 +1698,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1009,6 +1710,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
   /**
    * Store or update an agent.
    *
+   * A whole-record write of a caller-held snapshot, so on an *existing* row it
+   * may not carry every column: the ownership columns and the origin provider
+   * session stay with the stored row, and a stored `disposed` status wins over
+   * the snapshot's. Disposal is the agent's removal and is terminal (see
+   * `updateStatus`); a snapshot read before it must not revive the row. On a
+   * fresh row there is nothing to protect and the caller's record is stored
+   * verbatim.
+   *
    * Subject: `storage:agent.set`
    * Type: Request (RPC)
    */
@@ -1021,6 +1730,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1041,6 +1758,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1079,6 +1797,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         all: "all";
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>>;
@@ -1090,6 +1809,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1110,6 +1837,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1135,6 +1863,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1155,6 +1891,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1164,7 +1901,15 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
     }, z.core.$strip>;
   };
   /**
-   * Update agent status.
+   * Update agent status, optionally as a compare-and-swap.
+   *
+   * **`disposed` is terminal.** A row that already carries it never transitions
+   * again, whatever `status` or `expectedStatus` the call names. Disposal is
+   * the agent's removal, and ownership authority is a predicate over the agent
+   * row: a status revived to `idle` would let a removed agent reserve and
+   * settle again. Enforcing it here — rather than asking every lifecycle writer
+   * to check first — is what makes the guarantee hold against a removal that
+   * lands mid-start or mid-rehydrate.
    *
    * Subject: `storage:agent.updateStatus`
    * Type: Request (RPC)
@@ -1175,12 +1920,21 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
       status: z.ZodEnum<{
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>;
+      expectedStatus: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        idle: "idle";
+        active: "active";
+        starting: "starting";
+        dead: "dead";
+        disposed: "disposed";
+      }>>>;
     }, z.core.$strip>;
     response: z.ZodObject<{
       success: z.ZodBoolean;
+      transitioned: z.ZodBoolean;
     }, z.core.$strip>;
   };
   /**
@@ -1201,6 +1955,11 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
   /**
    * Update runtime-mutable agent fields without full record overwrite.
    *
+   * The agent's ownership columns (currency pair, revision, fence) are
+   * deliberately not expressible here: they may only be written under a claim
+   * generation, through the `storage:sessionOwnership` seam. `adapterSessionId`
+   * below is the immutable *origin* identity, not the currency.
+   *
    * Subject: `storage:agent.updateRuntime`
    * Type: Request (RPC)
    */
@@ -1319,6 +2078,78 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
+        currentAdapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "current_adapter_session_id";
+          tableName: "agents";
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: string;
+          driverParam: string;
+          notNull: false;
+          hasDefault: false;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: [string, ...string[]];
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {
+          length: number | undefined;
+        }>;
+        currentAdapterSessionIdState: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "current_adapter_session_id_state";
+          tableName: "agents";
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: "confirmed" | "moved" | "inherited";
+          driverParam: string;
+          notNull: true;
+          hasDefault: true;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: ["inherited", "moved", "confirmed"];
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {
+          length: number | undefined;
+        }>;
+        revision: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: string;
+          tableName: "agents";
+          dataType: "number";
+          columnType: "SQLiteInteger";
+          data: number;
+          driverParam: number;
+          notNull: true;
+          hasDefault: true;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: undefined;
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {}>;
+        currencyFence: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: string;
+          tableName: "agents";
+          dataType: "number";
+          columnType: "SQLiteInteger";
+          data: number;
+          driverParam: number;
+          notNull: true;
+          hasDefault: true;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: undefined;
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {}>;
         model: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
           name: "model";
           tableName: "agents";
@@ -1514,14 +2345,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
-          data: "idle" | "active" | "dead" | "disposed";
+          data: "idle" | "active" | "starting" | "dead" | "disposed";
           driverParam: string;
           notNull: true;
           hasDefault: false;
           isPrimaryKey: false;
           isAutoincrement: false;
           hasRuntimeDefault: false;
-          enumValues: ["idle", "active", "dead", "disposed"];
+          enumValues: ["starting", "idle", "active", "dead", "disposed"];
           baseColumn: never;
           identity: undefined;
           generated: undefined;
@@ -1588,6 +2419,14 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1608,6 +2447,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1619,6 +2459,14 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
   /**
    * Store or update an agent.
    *
+   * A whole-record write of a caller-held snapshot, so on an *existing* row it
+   * may not carry every column: the ownership columns and the origin provider
+   * session stay with the stored row, and a stored `disposed` status wins over
+   * the snapshot's. Disposal is the agent's removal and is terminal (see
+   * `updateStatus`); a snapshot read before it must not revive the row. On a
+   * fresh row there is nothing to protect and the caller's record is stored
+   * verbatim.
+   *
    * Subject: `storage:agent.set`
    * Type: Request (RPC)
    */
@@ -1631,6 +2479,14 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1651,6 +2507,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1689,6 +2546,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         all: "all";
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>>;
@@ -1700,6 +2558,14 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1720,6 +2586,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1745,6 +2612,14 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterName: z.ZodString;
         sessionId: z.ZodString;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1765,6 +2640,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1774,7 +2650,15 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
     }, z.core.$strip>;
   };
   /**
-   * Update agent status.
+   * Update agent status, optionally as a compare-and-swap.
+   *
+   * **`disposed` is terminal.** A row that already carries it never transitions
+   * again, whatever `status` or `expectedStatus` the call names. Disposal is
+   * the agent's removal, and ownership authority is a predicate over the agent
+   * row: a status revived to `idle` would let a removed agent reserve and
+   * settle again. Enforcing it here — rather than asking every lifecycle writer
+   * to check first — is what makes the guarantee hold against a removal that
+   * lands mid-start or mid-rehydrate.
    *
    * Subject: `storage:agent.updateStatus`
    * Type: Request (RPC)
@@ -1785,12 +2669,21 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
       status: z.ZodEnum<{
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>;
+      expectedStatus: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        idle: "idle";
+        active: "active";
+        starting: "starting";
+        dead: "dead";
+        disposed: "disposed";
+      }>>>;
     }, z.core.$strip>;
     response: z.ZodObject<{
       success: z.ZodBoolean;
+      transitioned: z.ZodBoolean;
     }, z.core.$strip>;
   };
   /**
@@ -1811,6 +2704,11 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
   /**
    * Update runtime-mutable agent fields without full record overwrite.
    *
+   * The agent's ownership columns (currency pair, revision, fence) are
+   * deliberately not expressible here: they may only be written under a claim
+   * generation, through the `storage:sessionOwnership` seam. `adapterSessionId`
+   * below is the immutable *origin* identity, not the currency.
+   *
    * Subject: `storage:agent.updateRuntime`
    * Type: Request (RPC)
    */
@@ -1830,13 +2728,48 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
   };
 }>, "storage:agent">;
 //#endregion
+//#region services/core/src/session/storage/memory-store.d.ts
+/**
+ * In-memory backing state shared by the session, agent and ownership memory handlers.
+ *
+ * Extracting the maps from their individual handler closures is what allows the
+ * ownership handler to read and mutate agent and session rows written by the other
+ * two handlers — a property that cannot be achieved with three disconnected private
+ * `Map` instances. Pass one `SessionStorageMemoryState` to all three `register*`
+ * functions to make them share the same rows.
+ */
+interface SessionStorageMemoryState {
+  /** Session rows keyed by `sessionId`. */
+  readonly sessions: Map<string, IMakaioSession>;
+  /** Agent rows keyed by `agentId`. */
+  readonly agents: Map<string, MakaioSessionAgent>;
+  /** Claim rows keyed by `claimId`. */
+  readonly claims: Map<string, AdapterSessionClaimRecord>;
+}
+/**
+ * Allocate a fresh, empty in-memory state instance.
+ *
+ * Each call returns an independent set of maps. Pass the same instance to all
+ * three memory handler registrations when they must share the same rows; pass
+ * separate instances to isolate them (the default when no state is supplied).
+ * @returns A new `SessionStorageMemoryState` with empty maps
+ */
+declare function createSessionStorageMemoryState(): SessionStorageMemoryState;
+//#endregion
 //#region services/core/src/session/storage/memory-handler.d.ts
 /**
  * Register in-memory session storage handlers.
  *
  * Suitable for development, testing, and single-instance deployments.
  * Data is lost when the process exits.
+ *
+ * Pass a shared `SessionStorageMemoryState` to make this handler operate on the
+ * same rows as `registerMemoryAgentStorage` and
+ * `registerMemorySessionOwnershipStorage`. Omit it (or pass `undefined`) to get
+ * an isolated, private store — the default, which preserves backward
+ * compatibility for callers that do not need cross-handler state sharing.
  * @param bus - The bus instance to register handlers on
+ * @param state - Shared in-memory state; defaults to a new isolated instance
  * @returns Cleanup function to unsubscribe all handlers
  * @example
  * ```typescript
@@ -1848,7 +2781,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
  * cleanup();
  * ```
  */
-declare function registerMemorySessionStorage(bus: IMakaioBus): () => void;
+declare function registerMemorySessionStorage(bus: IMakaioBus, state?: SessionStorageMemoryState): () => void;
 //#endregion
 //#region services/core/src/session/storage/drizzle-handler.d.ts
 /**
@@ -1887,10 +2820,17 @@ declare function registerDrizzleSessionStorage(bus: IMakaioBus, db: MakaioDataba
  * Register in-memory agent storage handlers.
  *
  * Suitable for development and testing. Data is lost when the process exits.
+ *
+ * Pass a shared `SessionStorageMemoryState` to make this handler operate on the
+ * same rows as `registerMemorySessionStorage` and
+ * `registerMemorySessionOwnershipStorage`. Omit it (or pass `undefined`) to get
+ * an isolated, private store — the default, which preserves backward
+ * compatibility for callers that do not need cross-handler state sharing.
  * @param bus - The bus instance to register handlers on
+ * @param state - Shared in-memory state; defaults to a new isolated instance
  * @returns Cleanup function to unsubscribe all handlers
  */
-declare function registerMemoryAgentStorage(bus: IMakaioBus): () => void;
+declare function registerMemoryAgentStorage(bus: IMakaioBus, state?: SessionStorageMemoryState): () => void;
 //#endregion
 //#region services/core/src/session/storage/schema.variants.d.ts
 /** Dialect variants for the session storage tables. */
@@ -1957,7 +2897,7 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         tableName: "sessions";
         dataType: "string";
         columnType: "SQLiteText";
-        data: "discovered" | "closed" | "active" | "archived";
+        data: "closed" | "discovered" | "active" | "archived";
         driverParam: string;
         notNull: true;
         hasDefault: false;
@@ -2123,6 +3063,44 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
+      currentAdapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id";
+        tableName: "sessions";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      currentAdapterSessionIdState: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id_state";
+        tableName: "sessions";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: "confirmed" | "moved" | "inherited";
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: ["inherited", "moved", "confirmed"];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
       adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: "adapter_id";
         tableName: "sessions";
@@ -2481,27 +3459,275 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         tableName: "sessions";
         dataType: "string";
         columnType: "SQLiteText";
-        data: "discovered" | "imported" | "tracking";
+        data: "discovered" | "imported" | "tracking";
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: ["discovered", "imported", "tracking"];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      isSidechain: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "sessions";
+        dataType: "boolean";
+        columnType: "SQLiteBoolean";
+        data: boolean;
+        driverParam: number;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      machineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "machine_id";
+        tableName: "sessions";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+    };
+    dialect: "sqlite";
+  }>;
+  agents: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
+    name: "agents";
+    schema: undefined;
+    columns: {
+      agentId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "agent_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: true;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      adapterName: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_name";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      sessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "session_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      adapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_session_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      currentAdapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      currentAdapterSessionIdState: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id_state";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: "confirmed" | "moved" | "inherited";
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: ["inherited", "moved", "confirmed"];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      revision: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      currencyFence: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      model: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "model";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      cwd: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "cwd";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
         driverParam: string;
         notNull: false;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: ["discovered", "imported", "tracking"];
+        enumValues: [string, ...string[]];
         baseColumn: never;
         identity: undefined;
         generated: undefined;
       }, {}, {
         length: number | undefined;
       }>;
-      isSidechain: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+      allowedDirectories: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: string;
-        tableName: "sessions";
-        dataType: "boolean";
-        columnType: "SQLiteBoolean";
-        data: boolean;
-        driverParam: number;
+        tableName: "agents";
+        dataType: "json";
+        columnType: "SQLiteTextJson";
+        data: string[];
+        driverParam: string;
         notNull: false;
         hasDefault: false;
         isPrimaryKey: false;
@@ -2511,10 +3737,12 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         baseColumn: never;
         identity: undefined;
         generated: undefined;
-      }, {}, {}>;
-      machineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "machine_id";
-        tableName: "sessions";
+      }, {}, {
+        $type: string[];
+      }>;
+      providerConfigId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "provider_config_id";
+        tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
@@ -2531,23 +3759,16 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-    };
-    dialect: "sqlite";
-  }>;
-  agents: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
-    name: "agents";
-    schema: undefined;
-    columns: {
-      agentId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "agent_id";
+      personaId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "persona_id";
         tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: true;
+        notNull: false;
         hasDefault: false;
-        isPrimaryKey: true;
+        isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
         enumValues: [string, ...string[]];
@@ -2557,14 +3778,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "adapter_id";
+      profileId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "profile_id";
         tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: true;
+        notNull: false;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2576,14 +3797,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      adapterName: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "adapter_name";
+      harnessId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "harness_id";
         tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: true;
+        notNull: false;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2595,14 +3816,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      sessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "session_id";
+      clientId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "client_id";
         tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: true;
+        notNull: false;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2614,8 +3835,8 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      adapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "adapter_session_id";
+      compressionMode: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "compression_mode";
         tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
@@ -2633,52 +3854,69 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      model: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "model";
+      role: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "role";
         tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
-        data: string;
+        data: "lead" | "member";
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
+        enumValues: ["lead", "member"];
         baseColumn: never;
         identity: undefined;
         generated: undefined;
       }, {}, {
         length: number | undefined;
       }>;
-      cwd: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "cwd";
+      status: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "status";
         tableName: "agents";
         dataType: "string";
         columnType: "SQLiteText";
-        data: string;
+        data: "idle" | "active" | "starting" | "dead" | "disposed";
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
+        enumValues: ["starting", "idle", "active", "dead", "disposed"];
         baseColumn: never;
         identity: undefined;
         generated: undefined;
       }, {}, {
         length: number | undefined;
       }>;
-      allowedDirectories: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+      createdAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: string;
         tableName: "agents";
-        dataType: "json";
-        columnType: "SQLiteTextJson";
-        data: string[];
-        driverParam: string;
-        notNull: false;
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      lastActivityAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2687,17 +3925,41 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         baseColumn: never;
         identity: undefined;
         generated: undefined;
+      }, {}, {}>;
+    };
+    dialect: "sqlite";
+  }>;
+  adapterSessionClaims: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
+    name: "adapter_session_claims";
+    schema: undefined;
+    columns: {
+      claimId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "claim_id";
+        tableName: "adapter_session_claims";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: true;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
       }, {}, {
-        $type: string[];
+        length: number | undefined;
       }>;
-      providerConfigId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "provider_config_id";
-        tableName: "agents";
+      machineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "machine_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2709,14 +3971,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      personaId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "persona_id";
-        tableName: "agents";
+      adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2728,14 +3990,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      profileId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "profile_id";
-        tableName: "agents";
+      adapterName: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_name";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2747,14 +4009,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      harnessId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "harness_id";
-        tableName: "agents";
+      providerSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "provider_session_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2766,14 +4028,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      clientId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "client_id";
-        tableName: "agents";
+      sessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "session_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2785,14 +4047,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      compressionMode: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "compression_mode";
-        tableName: "agents";
+      agentId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "agent_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2804,47 +4066,64 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      role: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "role";
-        tableName: "agents";
+      claimToken: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "claim_token";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
-        data: "lead" | "member";
+        data: string;
         driverParam: string;
         notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: ["lead", "member"];
+        enumValues: [string, ...string[]];
         baseColumn: never;
         identity: undefined;
         generated: undefined;
       }, {}, {
         length: number | undefined;
       }>;
+      fence: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "adapter_session_claims";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
       status: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: "status";
-        tableName: "agents";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
-        data: "idle" | "active" | "dead" | "disposed";
+        data: "abandoned" | "held" | "releasing";
         driverParam: string;
         notNull: true;
-        hasDefault: false;
+        hasDefault: true;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: ["idle", "active", "dead", "disposed"];
+        enumValues: ["held", "releasing", "abandoned"];
         baseColumn: never;
         identity: undefined;
         generated: undefined;
       }, {}, {
         length: number | undefined;
       }>;
-      createdAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+      claimedAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: string;
-        tableName: "agents";
+        tableName: "adapter_session_claims";
         dataType: "number";
         columnType: "SQLiteInteger";
         data: number;
@@ -2859,9 +4138,9 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         identity: undefined;
         generated: undefined;
       }, {}, {}>;
-      lastActivityAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+      updatedAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: string;
-        tableName: "agents";
+        tableName: "adapter_session_claims";
         dataType: "number";
         columnType: "SQLiteInteger";
         data: number;
@@ -2906,6 +4185,42 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
  */
 declare function registerDrizzleAgentStorage(bus: IMakaioBus, db: MakaioDatabase): () => void;
 //#endregion
+//#region services/core/src/session/storage/ownership-memory-handler.d.ts
+/**
+ * Register in-memory session ownership storage handlers.
+ *
+ * Pass a shared `SessionStorageMemoryState` to make these handlers operate on
+ * the same session and agent rows as `registerMemorySessionStorage` and
+ * `registerMemoryAgentStorage`. Omit it (or pass `undefined`) to get an isolated
+ * private store — useful only for unit tests that exercise ownership without
+ * needing real sessions or agents.
+ * @param bus - The bus instance to register handlers on
+ * @param state - Shared in-memory state; defaults to a new isolated instance
+ * @returns Cleanup function to unsubscribe all handlers
+ */
+declare function registerMemorySessionOwnershipStorage(bus: IMakaioBus, state?: SessionStorageMemoryState): () => void;
+//#endregion
+//#region services/core/src/session/storage/ownership-drizzle-handler.d.ts
+/**
+ * Register Drizzle-based session ownership storage handlers.
+ *
+ * These are the only writers of the agent currency columns, of the claim table
+ * and of the session row's lead designation. Whole-record surfaces such as
+ * `storage:agent.set` deliberately cannot express those columns, so a writer
+ * holding a pre-movement snapshot cannot resurrect an abandoned provider
+ * session.
+ * @param bus - The bus instance to register handlers on.
+ * @param db - The MakaioDatabase instance.
+ * @returns Cleanup function to unsubscribe all handlers.
+ * @example
+ * ```typescript
+ * const cleanup = registerDrizzleSessionOwnershipStorage(bus, db);
+ * // Later, when shutting down:
+ * cleanup();
+ * ```
+ */
+declare function registerDrizzleSessionOwnershipStorage(bus: IMakaioBus, db: MakaioDatabase): () => void;
+//#endregion
 //#region services/core/src/session/storage/fts-search-handler.d.ts
 /**
  * Registers FTS-backed `storage:session.search` handler.
@@ -3683,20 +4998,12 @@ interface IngestCompletedTurnResult {
  */
 declare function ingestCompletedTurn(bus: IMakaioBus, params: IngestCompletedTurnParams): Promise<IngestCompletedTurnResult>;
 //#endregion
-//#region services/core/src/session/observed-session-ingestion.d.ts
+//#region services/core/src/session/log-import-trigger-subjects.d.ts
 /**
- * Minimal local mirror of the log-import bus subjects this component calls.
+ * The three log-import subjects observed-session ingestion triggers.
  *
- * The log-import service package depends on this package, so importing its
- * subject definitions here would create a package cycle. Bus subjects are
- * matched by fully-qualified name and payloads are validated against the
- * schemas registered by the owning service at boot — these mirrored
- * definitions are type carriers for the fields this component reads and
- * writes, not a second source of truth. Canonical schemas live with the
- * log-import service.
- *
- * Exported for tests that stub the log-import seam; not part of the public
- * session API surface.
+ * Exported for tests that stub the log-import seam and for the owning
+ * service's conformance pin; not part of the public session API surface.
  * @internal
  */
 declare const LogImportTriggerSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubjectDefinitions<"log-import", {
@@ -3746,6 +5053,8 @@ declare const LogImportTriggerSubjects: _$_makaio_core0.BusSubjects<_$_makaio_co
     }, z.core.$strip>;
   };
 }>, "log-import">;
+//#endregion
+//#region services/core/src/session/observed-session-ingestion.d.ts
 /**
  * Check whether a stored session represents a metadata-only observed session.
  *
@@ -3779,10 +5088,15 @@ declare function isTrackingStub(session: Pick<IMakaioSession, 'isImported' | 'im
  * Bridges observed client sessions into the canonical session model.
  *
  * Responsibilities:
- * - Register observed sessions on `client.session.started` through the
- *   unified registration seam (`storage:session.importUpsert`), keyed on the
- *   importer's adapter name so hook-first registration and later transcript
- *   imports converge on the same `(source, adapterSessionId)` identity.
+ * - Register newly started observed sessions on `client.session.started`
+ *   through the unified registration seam (`storage:session.importUpsert`),
+ *   keyed on the importer's adapter name so hook-first registration and later
+ *   transcript imports converge on the same `(source, adapterSessionId)`
+ *   identity.
+ * - Rebind continued sessions (`startMode` `resume` / `compact`) through
+ *   `storage:session.rebindObserved`: a continuation refreshes runtime and
+ *   locality facts only and never registers, so it cannot rewrite the origin,
+ *   lineage, import status, creation time or content an import owns.
  * - Trigger targeted transcript imports on `client.session.turn.completed`
  *   (`log-import.importFile` when the transcript path is known, discovery
  *   fallback via `log-import.importSession` otherwise).
@@ -3901,18 +5215,85 @@ declare class ObservedSessionIngestionService {
    */
   private debugUnresolved;
   /**
-   * Register an observed session through the unified registration seam.
+   * Route an observed session start to registration or rebind.
+   *
+   * A `SessionStart` signal carries two different facts depending on its start
+   * mode, and conflating them is what let a continuation rewrite import data:
+   * - `resume` / `compact` continue an external session that already exists.
+   *   Its origin, lineage, import status, creation time and content belong to
+   *   whoever first imported it; only the runtime observing it may have moved.
+   *   These modes therefore *rebind* (see {@link rebindObservedSession}).
+   * - `fresh`, `clear`, `fork` and an absent start mode announce a session
+   *   this process is seeing begin, so they register through the unified
+   *   registration seam (see {@link registerObservedSession}).
    *
    * Skipped for managed sessions and when no importer is resolvable — a
    * session that can never receive imported content must not create a
-   * dangling stub. The registration `source` is the importer's adapter name,
-   * NOT the raw client id: the `(source, adapterSessionId)` upsert key must
-   * match what the import path writes, otherwise hook-first registration
-   * would fork the session identity and every import would create a
-   * duplicate session.
+   * dangling stub.
    * @param payload - `client.session.started` payload
    */
   private handleSessionStarted;
+  /**
+   * Rebind an already known observed session to the runtime continuing it.
+   *
+   * Refreshes runtime/locality facts only (working directory, transcript path,
+   * owning machine). A continuation carries no evidence about origin, lineage,
+   * import status or creation time, so it must not be able to write them —
+   * that is precisely what routing resume/compact through the import upsert
+   * used to do.
+   *
+   * A `'not-found'` outcome is resolved by the ingestion policy, because the
+   * skip is only correct while a transcript import is still coming:
+   * - `tracking`: skip. Fabricating a row here would stamp import provenance
+   *   and a creation time taken from the resume moment, and the
+   *   timestamp-correction clause of the import upsert only fires while
+   *   `createdAt` still equals `discoveredAt` — so the invented creation time
+   *   would survive the real transcript import forever. Skipping keeps the
+   *   session's first row the one the import path creates from the transcript,
+   *   with the real creation time and content; the turn-completed trigger
+   *   reaches that path on the very next turn without any extra state here.
+   * - `discovered`: register. Metadata-only policy makes the turn-completed
+   *   trigger decline content import for this session forever, so no import
+   *   will ever create the row and skipping would drop the session entirely.
+   *   The registration seam stamps discovered status plus metadata, and its
+   *   creation time taken from the observation is the best available — nothing
+   *   downstream will correct it.
+   * A successful rebind is also **evidence the conversation is still in use**,
+   * which a `closed` row contradicts — so it is reported to the ownership
+   * authority, which decides what the observation implies for the row (and
+   * which row: a compaction's lineage root, never a synthesized child).
+   * Reporting is this side's whole duty, and it never changes the rebind's own
+   * result.
+   * @param payload - `client.session.started` payload
+   * @param adapterSessionId - External session id of the continued session
+   * @param source - Importer adapter name (import identity of the session)
+   * @param startMode - How the provider continued the conversation
+   * @returns True when a stored session was rebound
+   */
+  private rebindObservedSession;
+  /**
+   * Build the ingestion-policy input for an observed session-start payload.
+   * @param payload - `client.session.started` payload
+   * @param adapterSessionId - External session id of the observed session
+   * @param adapterName - Importer adapter name that would own content import
+   * @returns Policy input describing the observation
+   */
+  private policyInput;
+  /**
+   * Register an observed session through the unified registration seam.
+   *
+   * The registration `source` is the importer's adapter name, NOT the raw
+   * client id: the `(source, adapterSessionId)` upsert key must match what the
+   * import path writes, otherwise hook-first registration would fork the
+   * session identity and every import would create a duplicate session.
+   * @param payload - `client.session.started` payload
+   * @param adapterSessionId - External session id of the started session
+   * @param source - Importer adapter name (import identity of the session)
+   * @param decidedImportStatus - Already evaluated ingestion-policy verdict,
+   *   passed by callers that had to consult the policy before routing here
+   * @returns True when the registration reached storage
+   */
+  private registerObservedSession;
   /**
    * Trigger a targeted transcript import for a completed observed turn.
    *
@@ -4826,7 +6207,7 @@ declare const messages: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
       tableName: "messages";
       dataType: "string";
       columnType: "SQLiteText";
-      data: "text" | "voice" | "compact";
+      data: "text" | "compact" | "voice";
       driverParam: string;
       notNull: false;
       hasDefault: false;
@@ -5553,6 +6934,54 @@ declare function buildSessionContext(bus: IMakaioBus, options: BuildContextOptio
  */
 declare function getFullConversation(bus: IMakaioBus, sessionId: string): Promise<ContextAssemblyResult>;
 //#endregion
+//#region services/core/src/session/session-resume-identity.d.ts
+/**
+ * The provider session a resume operation may legitimately target right now.
+ *
+ * Produced by {@link resolveSessionResumeIdentity} so that every role in a
+ * resume path — locality evaluation, live-writer detection, and the resume
+ * target handed to the adapter — reads the same value. Reading
+ * `session.adapterSessionId` directly in those roles is what let them diverge:
+ * that column is immutable origin provenance, not resume currency.
+ */
+interface SessionResumeIdentity {
+  /**
+   * Provider session ID that is valid resume currency, or `undefined` when the
+   * session has none.
+   */
+  readonly adapterSessionId: string | undefined;
+  /**
+   * Whether the provider session moved without provider confirmation.
+   *
+   * When `true`, native resume is impossible regardless of every other
+   * structural signal — there is no provider session that still holds the
+   * conversation. Callers degrade to fresh-with-history.
+   */
+  readonly movedUnconfirmed: boolean;
+}
+/**
+ * Resolve the tri-state resume currency of a session row.
+ *
+ * | `currentAdapterSessionIdState` | resume currency                         |
+ * |-------------------------------|-----------------------------------------|
+ * | `'inherited'` (or absent)     | `session.adapterSessionId` (origin)     |
+ * | `'confirmed'`                 | `session.currentAdapterSessionId`       |
+ * | `'moved'`                     | none — degrade to fresh-with-history    |
+ *
+ * **Compress children are never a resume source.** Provider-side compaction is
+ * in place — same provider session ID, same transcript — so the row that
+ * carries the provider identity is the lineage root, and the compress children
+ * the transcript importer synthesizes carry no currency at all. Passing one here
+ * therefore resolves to "nothing resumable", which is the correct answer for
+ * that row: the conversation lives on its root. A caller holding a compress
+ * child resolves the root first; this function deliberately does not, because it
+ * takes a row and not a bus, and a lineage walk hidden behind a pure projection
+ * would be a storage read no caller asked for.
+ * @param session - Session record loaded from storage
+ * @returns Resolved resume identity for this session
+ */
+declare function resolveSessionResumeIdentity(session: IMakaioSession): SessionResumeIdentity;
+//#endregion
 //#region services/core/src/session/native-locality.d.ts
 /**
  * Describes whether the session resume/fork intent is a native continuation
@@ -5608,6 +7037,19 @@ interface NativeLocalityInput {
    * Required when `session.forkPointMessageId` is set and `intent === 'fork'`.
    */
   readonly midHistoryForkSupported?: boolean;
+  /**
+   * Resume currency the caller resolved for this session.
+   *
+   * `session.adapterSessionId` is immutable origin provenance, so callers that
+   * track currency must resolve it with {@link resolveSessionResumeIdentity} and
+   * pass the result here. When present it is authoritative — including when it
+   * resolves to no usable provider session, which must never silently fall back
+   * to the origin column.
+   *
+   * Omit it to read the origin column directly. That is correct only for callers
+   * whose sessions cannot have moved their provider identity.
+   */
+  readonly resumeIdentity?: SessionResumeIdentity;
 }
 /**
  * Evaluates whether a session can use native resume or fork, or must fall back
@@ -5627,4 +7069,4 @@ interface NativeLocalityInput {
  */
 declare function evaluateNativeLocality(input: NativeLocalityInput): NativeLocalityVerdict;
 //#endregion
-export { ingestCompletedTurn as $, RecoveryConfig as $t, SelectTurn as A, registerMemorySessionStorage as At, OBSERVED_SESSION_INGESTION_POLICY_CAPABILITY_ID as B, normalizeSelectionString as Bt, MessageRoutingSubjects as C, fetchPreviewBySession as Ct, registerMemoryMessageStorage as D, registerDrizzleAgentStorage as Dt, messages as E, registerFtsSearchHandler as Et, EmbeddingIndexManager as F, SessionBridge as Ft, unregisterObservedSessionIngestionPolicyProvider as G, actionRegistry as Gt, ObservedSessionIngestionPolicyImportStatus as H, registerListActionsHandler as Ht, registerDrizzleImportCursorStorage as I, assembleForkContext as It, isPolicyDiscoveredObservedSession as J, ContextWindowTracker as Jt, LogImportTriggerSubjects as K, registerGetStatusCountsHandler as Kt, importCursors as L, FallbackRuntimeOptions as Lt, turnsDual as M, AgentStorageSubjects as Mt, registerMemoryTurnStorage as N, SessionExtensionContextImpl as Nt, registerDrizzleMessageStorage as O, registerMemoryAgentStorage as Ot, registerDrizzleTurnStorage as P, createSessionExtensionContext as Pt, IngestTurnMessage as Q, buildTurnInitiator as Qt, importCursorsDual as R, pickFallbackRuntimeOptions as Rt, MessageRoutingNamespace as S, fetchMessageCountsBySession as St, SelectMessage as T, parseForkTransforms as Tt, ObservedSessionIngestionPolicyInput as U, registerBuiltInActions as Ut, ObservedSessionIngestionPolicyDecision as V, resolveAdapterNameById as Vt, registerObservedSessionIngestionPolicyProvider as W, resetBuiltInActionsRegistration as Wt, IngestCompletedTurnParams as X, ContextWindowTrackerConfig as Xt, isTrackingStub as Y, AgentContextState as Yt, IngestCompletedTurnResult as Z, SessionContextWindowState as Zt, InsertMessageRouting as _, SessionOrchestrator as _n, mapAgentsBySession as _t, buildSessionContext as a, buildRecoveryContext as an, emitSessionTurnStarted as at, messageRoutingDual as b, SearchSessionRow as bt, kindToBranchKind as c, resolveModelCapabilities as cn, registerDrizzleSessionEventStorage as ct, registerSpawningToolCallResolver as d, resolveTargetAgents as dn, SelectSessionEvent as dt, buildRecoveryContextWithPipeline as en, EventTransform as et, registerCompressLineageResolver as f, extractTextContent as fn, sessionEvents as ft, StartTurnOptions as g, ISessionOrchestrator as gn, fetchSessionPreviewMaps as gt, MakaioSessionConfig as h, AdapterRegistry as hn, SessionPreviewMaps as ht, getFullConversation as i, verifyAndRecoverAgents as in, appendSessionLifecycleEvent as it, turns as j, AgentStorageNamespace as jt, InsertTurn as k, registerDrizzleSessionStorage as kt, toSessionLineage as l, findTurnByAgent as ln, registerMemorySessionEventStorage as lt, MakaioSession as m, TurnContextEnricher as mn, getSessionAncestorChain as mt, NativeLocalityIntent as n, ensureAgentModel as nn, SessionTurnStartedPayload as nt, BuildContextOptions as o, resolveAdapterId as on, emitSessionUserMessageSent as ot, registerParentResolver as p, normalizeToBlocks as pn, sessionEventsDual as pt, ObservedSessionIngestionService as q, registerResumeHandler as qt, evaluateNativeLocality as r, recoverAgent as rn, SessionUserMessageSentPayload as rt, ContextAssemblyResult as s, resolveExecutionTarget as sn, registerSessionLifecycleEventWriters as st, NativeLocalityInput as t, ensureAgentCwd as tn, SessionLifecycleEventArgs as tt, registerSessionDiscoveredHandler as u, getOrCreateSession as un, InsertSessionEvent as ut, SelectMessageRouting as v, registerCoreSessionServiceHandlers as vn, mapToSession as vt, InsertMessage as w, mapRowToSession as wt, registerDrizzleMessageRoutingStorage as x, fetchAgentsBySession as xt, messageRouting as y, MakaioSessionService as yn, SearchFilters as yt, IObservedSessionIngestionPolicyProvider as z, CONNECTOR_SWAP_DEFAULT_PIPELINE as zt };
+export { IngestCompletedTurnResult as $, resetBuiltInActionsRegistration as $t, registerDrizzleMessageStorage as A, getOrCreateSession as An, registerMemorySessionOwnershipStorage as At, importCursorsDual as B, mintClaimToken as Bn, createSessionExtensionContext as Bt, registerDrizzleMessageRoutingStorage as C, RecoveryPlan as Cn, fetchAgentsBySession as Ct, SelectMessage as D, StartReservationRequest as Dn, parseForkTransforms as Dt, InsertMessage as E, recoveryPlanResumeTarget as En, mapRowToSession as Et, registerMemoryTurnStorage as F, AdapterRegistry as Fn, SessionStorageMemoryState as Ft, ObservedSessionIngestionPolicyInput as G, registerAdapterSessionMovementObserver as Gn, CONNECTOR_SWAP_DEFAULT_PIPELINE as Gt, OBSERVED_SESSION_INGESTION_POLICY_CAPABILITY_ID as H, InFlightStart as Hn, assembleForkContext as Ht, registerDrizzleTurnStorage as I, ISessionOrchestrator as In, createSessionStorageMemoryState as It, ObservedSessionIngestionService as J, MakaioSessionService as Jn, describeHalfNamedInstanceRefusal as Jt, registerObservedSessionIngestionPolicyProvider as K, SessionOwnershipAuthorityDeps as Kn, NamedSelectionInstance as Kt, EmbeddingIndexManager as L, SessionOrchestrator as Ln, AgentStorageNamespace as Lt, SelectTurn as M, extractTextContent as Mn, registerMemoryAgentStorage as Mt, turns as N, normalizeToBlocks as Nn, registerDrizzleSessionStorage as Nt, messages as O, reserveStartFor as On, registerFtsSearchHandler as Ot, turnsDual as P, TurnContextEnricher as Pn, registerMemorySessionStorage as Pt, IngestCompletedTurnParams as Q, registerBuiltInActions as Qt, registerDrizzleImportCursorStorage as R, registerCoreSessionServiceHandlers as Rn, AgentStorageSubjects as Rt, messageRoutingDual as S, NativeResumeRecoveryPlan as Sn, SearchSessionRow as St, MessageRoutingSubjects as T, recoveryPlanRequiresHistory as Tn, fetchPreviewBySession as Tt, ObservedSessionIngestionPolicyDecision as U, peekInFlightStart as Un, FallbackRuntimeOptions as Ut, IObservedSessionIngestionPolicyProvider as V, enqueueAgentSettle as Vn, SessionBridge as Vt, ObservedSessionIngestionPolicyImportStatus as W, runExclusiveStart as Wn, pickFallbackRuntimeOptions as Wt, isTrackingStub as X, resolveAdapterNameById as Xt, isPolicyDiscoveredObservedSession as Y, MakaioSessionServiceOptions as Yn, normalizeSelectionString as Yt, LogImportTriggerSubjects as Z, registerListActionsHandler as Zt, MakaioSessionConfig as _, verifyAndRecoverAgents as _n, SessionPreviewMaps as _t, resolveSessionResumeIdentity as a, ContextWindowTrackerConfig as an, SessionUserMessageSentPayload as at, SelectMessageRouting as b, FRESH_WITH_HISTORY_RECOVERY_PLAN as bn, mapToSession as bt, BuildContextOptions as c, resolveSelectionOwnedInstance as cn, emitSessionUserMessageSent as ct, toSessionLineage as d, RecoveryConfig as dn, registerMemorySessionEventStorage as dt, actionRegistry as en, IngestTurnMessage as et, registerSessionDiscoveredHandler as f, VerifiedAgents as fn, InsertSessionEvent as ft, MakaioSession as g, recoverAgent as gn, getSessionAncestorChain as gt, registerParentResolver as h, ensureAgentModel as hn, sessionEventsDual as ht, SessionResumeIdentity as i, AgentContextState as in, SessionTurnStartedPayload as it, InsertTurn as j, resolveTargetAgents as jn, registerDrizzleAgentStorage as jt, registerMemoryMessageStorage as k, findTurnByAgent as kn, registerDrizzleSessionOwnershipStorage as kt, ContextAssemblyResult as l, buildTurnInitiator as ln, registerSessionLifecycleEventWriters as lt, registerCompressLineageResolver as m, ensureAgentCwd as mn, sessionEvents as mt, NativeLocalityIntent as n, registerResumeHandler as nn, EventTransform as nt, getFullConversation as o, SessionContextWindowState as on, appendSessionLifecycleEvent as ot, registerSpawningToolCallResolver as p, buildRecoveryContextWithPipeline as pn, SelectSessionEvent as pt, unregisterObservedSessionIngestionPolicyProvider as q, registerSessionOwnershipAuthority as qn, SelectionRefusalContext as qt, evaluateNativeLocality as r, ContextWindowTracker as rn, SessionLifecycleEventArgs as rt, buildSessionContext as s, SelectionInstanceContext as sn, emitSessionTurnStarted as st, NativeLocalityInput as t, registerGetStatusCountsHandler as tn, ingestCompletedTurn as tt, kindToBranchKind as u, AgentRecoveryOutcome as un, registerDrizzleSessionEventStorage as ut, StartTurnOptions as v, buildPlannedRecoveryContext as vn, fetchSessionPreviewMaps as vt, MessageRoutingNamespace as w, planAgentRecovery as wn, fetchMessageCountsBySession as wt, messageRouting as x, FreshWithHistoryRecoveryPlan as xn, SearchFilters as xt, InsertMessageRouting as y, buildRecoveryContext as yn, mapAgentsBySession as yt, importCursors as z, assessClaimOwner as zn, SessionExtensionContextImpl as zt };