@makaio/framework 1.0.0-dev-1785409369816 → 1.0.0-dev-1787670071418

package/dist/{index-CLvQsL6s2.d.mts → index-BNzUyVwV.d.mts}

@@ -1,21 +1,47 @@
-import { r as ExecutionTarget } from "./schemas-N6x2z7Lf.mjs";
-import { l as Turn$1 } from "./index-gUhidukN.mjs";
-import { a as PipelineStep, o as SessionEditorAction, t as ActionCategory } from "./types-D7_kevBK.mjs";
+import { g as OwnedAdapterInstance, h as MachineScopedAdapterInstance, w as Turn$1 } from "./index-B0yMCJW8.mjs";
+import { a as PipelineStep, o as SessionEditorAction, t as ActionCategory } from "./types-BlB23n4f.mjs";
 import { z } from "zod";
 import * as _$_makaio_core0 from "@makaio/framework/core";
 import { ExtractSubjectPayload, SubjectDefinition } from "@makaio/framework/core";
 import { IMakaioBus } from "@makaio/framework/bus";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
-import { AIReasoningLevel, AdapterRuntimeOptions, BranchKind, ContextWindowState, ForkOptions, ForkTransforms, ICapabilityProvider, IMakaioSession, JsonValue, MakaioSessionAgent, MakaioSessionEvent, Message, MessageBlock, MessageInput, NativeLocalityVerdict, ReasoningLevelMap, SessionContext, SessionEventType, SessionExtensionContext, SessionLineage, SessionLineageKind, SessionMessage, SessionMessageBlock, SessionMessageOrigin, SessionSubjects, TurnIngestionMarker, TurnInitiator, TurnUsage } from "@makaio/framework/contracts";
+import { AIReasoningLevel, AdapterRuntimeOptions, AdapterSelection, AdapterSessionClaimRecord, AgentRole, BranchKind, ContextWindowState, ForkOptions, ForkTransforms, ICapabilityProvider, IMakaioSession, JsonValue, MakaioSessionAgent, MakaioSessionEvent, Message, MessageBlock, MessageInput, NativeLocalityVerdict, OwnershipTopology, ResolvedProviderContext, RuntimeInstanceRecord, SessionContext, SessionEventType, SessionExtensionContext, SessionLineage, SessionLineageKind, SessionMessage, SessionMessageBlock, SessionMessageOrigin, SessionOwnershipReclaimReason, SessionOwnershipRecoveryGuard, SessionOwnershipReserveStartServiceResult, SessionSubjects, StartAgentRequest, StartAgentResponse, TurnIngestionMarker, TurnInitiator, TurnUsage } from "@makaio/framework/contracts";
 import { BaseService } from "@makaio/framework/service-base";
 import * as _$drizzle_orm_sqlite_core0 from "drizzle-orm/sqlite-core";
 import * as _$drizzle_orm_pg_core0 from "drizzle-orm/pg-core";
 import * as _$_makaio_storage_drizzle0 from "@makaio/framework/storage/drizzle";
-import { MakaioDatabase } from "@makaio/framework/storage/drizzle";
+import { MakaioDatabase, TransactionLock } from "@makaio/framework/storage/drizzle";
 import * as _$drizzle_orm0 from "drizzle-orm";
+import { SQL } from "drizzle-orm";
 import * as _$_makaio_storage_core0 from "@makaio/framework/storage";
 
 //#region services/core/src/session/session-service.d.ts
+/**
+ * Host-supplied composition of the session service.
+ *
+ * Everything here belongs to the ownership authority, which is the one part of
+ * this service that cannot work from the bus alone: it has to know which
+ * machine it owns claims under, and how many runtimes may own claims there.
+ */
+interface MakaioSessionServiceOptions {
+  /**
+   * Machine identity the ownership authority owns claims under.
+   *
+   * Injected by the composition root — the ownership key is (machine, adapter
+   * instance, provider session), and an authority that resolved its own machine
+   * identity through the bus would make every ownership decision depend on
+   * adapter-runtime boot order. Omitted, every identity-dependent ownership
+   * operation answers `machine-identity-unavailable` and writes nothing, which
+   * is the correct behavior for a host that has no machine identity to offer.
+   */
+  machineId?: string;
+  /**
+   * How many runtime processes may own claims on this machine. Defaults to
+   * `'shared-machine'`; a host claims `'machine-exclusive'` only when it can
+   * prove no peer process hosts adapters on the same machine.
+   */
+  topology?: OwnershipTopology;
+}
 /**
  * Framework-core session service for managing makaio sessions.
  *
@@ -24,6 +50,12 @@ import * as _$_makaio_storage_core0 from "@makaio/framework/storage";
  * `session.turn.await`, `session.restartAgents`, `session.agent.added`, and
  * `session.agent.removed`.
  *
+ * It is also the **session-ownership authority**: the `session.ownership.*`
+ * operations, each of which is one durable ownership act, and the movement
+ * observer that settles every announced provider-session movement through them.
+ * That authority needs a machine identity, which the composition root injects
+ * (see {@link MakaioSessionServiceOptions}).
+ *
  * Host-specific handlers (search, update, resume, archive, purge, analytics,
  * context window, branching) are registered by the host session service which
  * depends on this service.
@@ -61,11 +93,26 @@ import * as _$_makaio_storage_core0 from "@makaio/framework/storage";
  * ```
  */
 declare class MakaioSessionService extends BaseService {
+  private readonly options;
+  private ownership;
+  /**
+   * Return the currently active ownership-authority incarnation.
+   *
+   * Read at adapter construction time rather than cached by the adapter
+   * subsystem, so reinitializing this service gives every subsequently created
+   * adapter the newly minted incarnation.
+   * @returns Active runtime-incarnation identity.
+   * @throws When the service has not initialized its authority.
+   */
+  requireOwnershipInstanceId(): string;
   /**
    * Creates a new MakaioSessionService instance.
    * @param bus - The event bus for inter-service communication
+   * @param options - Composition of the ownership authority; omitted entirely,
+   *   the service still serves every non-ownership subject and declines the
+   *   identity-dependent ownership ones.
    */
-  constructor(bus?: IMakaioBus);
+  constructor(bus?: IMakaioBus, options?: MakaioSessionServiceOptions);
   /**
    * Initialize the service.
    *
@@ -80,6 +127,34 @@ declare class MakaioSessionService extends BaseService {
    * that do not register turn storage).
    */
   protected onInit(): Promise<void>;
+  /**
+   * Retire this process only after the adapter subsystem's earlier teardown has
+   * published its aggregate evidence.
+   *
+   * Reverse dependency ordering destroys the adapter subsystem first. The
+   * authority then closes admission, drains operations already admitted, and
+   * stamps retirement only when that published aggregate proves teardown was
+   * observed.
+   */
+  protected onDestroy(): Promise<void>;
+  /**
+   * Arm the ownership reconcile behind the post-coordinator barrier.
+   *
+   * Deliberately **not** run from `onInit`. This service starts inside the
+   * extension coordinator, and adapter instances register after it — so a
+   * reconcile here would probe adapters that do not exist yet and report every
+   * live claim's instance as gone. `kernel.phase.coordinatorReady` is broadcast
+   * once the coordinator has started everything, which is the first instant at
+   * which the probe means what it says.
+   *
+   * A host that never broadcasts the phase never reconciles: there is no timer
+   * and no fallback, because a reconcile at an unknown point in boot is exactly
+   * the thing this barrier exists to prevent. Failures are logged and swallowed
+   * for the same reason orphaned-turn reconciliation is — diagnostics must
+   * never keep a session service from starting.
+   * @returns Cleanup that unsubscribes the barrier if it never fires.
+   */
+  private scheduleOwnershipReconcile;
   /**
    * Close any turns left `active` from a prior process crash.
    *
@@ -94,6 +169,285 @@ declare class MakaioSessionService extends BaseService {
   private reconcileOrphanedTurns;
 }
 //#endregion
+//#region services/core/src/session/ownership/context.d.ts
+/**
+ * What the ownership authority was composed with.
+ *
+ * The machine identity is **injected, not resolved through the bus**. Resolving
+ * it per call would make every ownership decision depend on whether the adapter
+ * runtime happened to have registered its identity handler yet — a boot-order
+ * dependency the authority cannot observe and callers cannot reason about.
+ * Composed with `undefined`, the authority declines every identity-dependent
+ * operation instead of deciding under a guess.
+ */
+interface OwnershipAuthorityContext {
+  /** Bus the authority reads and writes storage through. */
+  readonly bus: IMakaioBus;
+  /** Machine identity the authority owns claims under, or `undefined` when it has none. */
+  readonly machineId: string | undefined;
+  /** Runtime-incarnation identity stamped onto every generation this authority allocates. */
+  readonly instanceId: string;
+  /** {@inheritDoc OwnershipTopologySchema} */
+  readonly topology: OwnershipTopology;
+}
+//#endregion
+//#region services/core/src/session/ownership/authority.d.ts
+/**
+ * What the session-ownership authority is composed with.
+ *
+ * The same shape the operations receive, deliberately: what a caller composes
+ * the authority with *is* what every operation decides under, so there is no
+ * second declaration for the two to drift apart in.
+ */
+interface SessionOwnershipAuthorityDeps extends Omit<OwnershipAuthorityContext, 'instanceId'> {
+  /** Runtime-incarnation identity, or a freshly minted identity in isolated compositions. */
+  readonly instanceId?: string;
+}
+/** Private lifecycle control for the locally composed ownership authority. */
+interface OwnershipAuthorityHandle {
+  /** Identity stamped onto generations allocated by this authority. */
+  readonly instanceId: string;
+  /** Close admission, drain admitted operations, and retire on observed teardown. */
+  close(): Promise<void>;
+}
+/** Authority handlers and the private lifecycle control that owns them. */
+interface RegisteredSessionOwnershipAuthority {
+  /** Idempotent handler cleanups for the containing service. */
+  readonly cleanups: readonly (() => void)[];
+  /** Private shutdown capability; deliberately not exposed as a bus subject. */
+  readonly ownership: OwnershipAuthorityHandle;
+}
+/**
+ * Register the session-ownership authority.
+ *
+ * These five subjects are the service surface of the ownership aggregate, and
+ * each one is exactly one durable ownership act. That is the point: composed by
+ * a caller out of storage RPCs, a reservation or a movement is three
+ * transactions with windows in which a crash strands an ownership key or
+ * publishes a currency no generation owns.
+ * @param deps - Bus, machine identity, topology and optional test identity.
+ * @returns Registered cleanups and the private retirement handle.
+ */
+declare function registerSessionOwnershipAuthority(deps: SessionOwnershipAuthorityDeps): RegisteredSessionOwnershipAuthority;
+//#endregion
+//#region services/core/src/session/ownership/movement-observer.d.ts
+/**
+ * Registers the provider-session movement observer.
+ *
+ * `agent.adapterSession.moved` is an **observation**, not a write. The seam
+ * reports where an agent's provider conversation went; what that implies for
+ * durable currency — which generation may record it, whether it supersedes
+ * anything, whether the session snapshot follows — is the ownership authority's
+ * to decide, inside one transaction. This handler's whole job is to turn the
+ * announcement into a settle request and to order the settles of one agent.
+ *
+ * **No lead guard.** A member's movement is now recorded on its own agent row,
+ * and the mirror onto the session row is gated inside the settle by the stored
+ * designation. The old handler had to drop a member's movement because the only
+ * row it could write was the session's; it also had to drop every movement
+ * announced during a start, because the designation did not exist yet. Both
+ * windows close here: the agent row always exists, and the reservation
+ * designates before the first dispatch.
+ *
+ * **No change guard.** Storage answers `idempotent` for a target that is
+ * already settled, which is a decision made against the stored row rather than
+ * against a snapshot this handler read a moment earlier.
+ *
+ * **The announcement is acknowledged, not absorbed.** `bus.emit` resolves when
+ * its handlers do, and the producer's seam contract reads that resolution as
+ * "the currency write already happened" — it is what lets a producer order the
+ * dispatch that abandons the old provider session behind the write, and what
+ * lets it hold an undelivered movement for re-announcement. So this handler
+ * waits for its queued settlement and answers honestly: it resolves only when
+ * the authority actually recorded the movement, and rejects with a
+ * {@link MovementNotSettledError} otherwise. Resolving on a refusal would let
+ * the producer retire a movement no row carries.
+ *
+ * Rejecting is the seam's negative acknowledgment, not an escaping failure: the
+ * one modeled error is what the producer catches and turns into `false`, and no
+ * other error leaves this handler unclassified.
+ * @param bus - Message bus used by the session service.
+ * @returns Cleanup function.
+ */
+declare function registerAdapterSessionMovementObserver(bus: IMakaioBus): () => void;
+//#endregion
+//#region services/core/src/session/ownership/in-flight-starts.d.ts
+/**
+ * What an attempt tells a joiner about the agent it was driving.
+ *
+ * One bit, because one bit is what every attempt can state honestly and what
+ * every joiner actually needs. The three attempts this seam carries — a fresh
+ * lead start, an attach, a reserved rehydrate — end in outcomes of three
+ * different shapes, and none of them is meaningful to a joiner that ran none of
+ * that work under none of those inputs. "Is there a connector for this agent
+ * now" is meaningful to all of them.
+ */
+type StartAttemptOutcome = /** A connector for this agent is live, as far as this attempt got. */'connected'
+/**
+ * The attempt ended without building one, and said so rather than throwing.
+ *
+ * The modeled non-successes: a recovery that deferred or was refused, a start
+ * that lost its designation race. They are *resolutions*, so a joiner watching
+ * only for a rejection cannot see them.
+ */
+| 'no-connector';
+/**
+ * One agent's start attempt, as a joinable handle.
+ *
+ * `settled` resolves — or rejects — when the attempt is completely over,
+ * including every failure-cleanup step, and it carries **the attempt's own
+ * verdict**. That is what a joiner reads.
+ *
+ * It did not always: joiners used to await the promise for its timing alone and
+ * then re-read the agent row. The row cannot answer the question. Where an
+ * attempt *writes* it the row is authoritative about the row — a fresh start's
+ * pre-dispatch failure deletes it, so mapping the rejection onto "dead" would
+ * contradict the deleted-row rule for one event — but the row was never a proxy
+ * for "a connector exists", and every place that treated it as one was one
+ * interleaving away from being wrong. A recovery that rolls its claim back to
+ * the `idle` it found leaves a row that reads *usable* behind an attempt that
+ * built nothing; an `idle` row whose connector died is exactly what the liveness
+ * probe exists to catch.
+ *
+ * So the division is: the attempt's verdict says whether a connector exists, and
+ * the row says what state the agent identity is in. A joiner needs both, and
+ * infers neither from the other. Where there is no entry to join — another
+ * process, or one that died — there is no verdict to read, and the status
+ * compare-and-swap arbitrates instead.
+ */
+interface InFlightStart {
+  /** Settles when the attempt is over, carrying what it left behind. */
+  readonly settled: Promise<StartAttemptOutcome>;
+}
+/**
+ * One call's view of {@link runExclusiveStart}.
+ *
+ * The flag is what makes the seam usable by a caller that has durable work of
+ * its own to do around the dispatch. A joiner ran none of that work — the
+ * attempt it joined did, under *its* inputs — so a joiner that went on to
+ * persist its own adapter identity, or to settle the provider session *it*
+ * planned to resume, would overwrite the identity the running attempt actually
+ * established.
+ *
+ * What a joiner consumes instead is the attempt's own verdict — see
+ * {@link InFlightStart.settled} — together with the durable agent row, which
+ * says what state the identity is in but never whether a connector exists.
+ */
+interface ExclusiveStart extends InFlightStart {
+  /**
+   * `true` when this call joined an attempt that was already running, and
+   * therefore ran no callback of its own.
+   */
+  readonly joined: boolean;
+}
+/**
+ * Register a start attempt for an agent and run it, so a concurrent consumer
+ * joins the attempt instead of racing it.
+ *
+ * The entry is published **before** `attempt` runs, and therefore before the
+ * attempt's first durable write. That ordering is the whole point: there is no
+ * instant at which a `starting` agent row is visible without its entry, so a
+ * joiner never has to guess whether an attempt is in progress here.
+ *
+ * Re-entering for an agent that already has an entry returns the existing one
+ * and does **not** run `attempt` — two lifecycle attempts for one agent
+ * identity are exactly what this seam exists to prevent. The returned handle
+ * says which of the two happened, because a caller whose `attempt` carries
+ * durable work must not repeat that work against inputs the running attempt
+ * never used (see {@link ExclusiveStart.joined}).
+ * @param agentId - Agent identity the attempt belongs to; the seam's key.
+ * @param attempt - The complete attempt, answering whether it left a connector
+ *   behind, including its reservation, its
+ *   persistence, its settlement and its failure cleanup. Nothing that can leave
+ *   durable state behind may run outside it: a joiner runs none of it, and what
+ *   sits outside would then run twice, once against the wrong inputs.
+ * @returns This call's handle — the attempt it registered, or the one it joined.
+ */
+declare function runExclusiveStart(agentId: string, attempt: () => Promise<StartAttemptOutcome>): ExclusiveStart;
+/**
+ * Look up an in-flight start without creating one.
+ *
+ * A consumer that finds an entry joins it. Finding none means the attempt
+ * belongs to a process that is gone, or to a live peer — neither of which this
+ * registry can see, so the caller arbitrates through the agent row's status
+ * compare-and-swap instead.
+ * @param agentId - Agent identity to look up.
+ * @returns The entry, or `undefined` when this process is not driving a start.
+ */
+declare function peekInFlightStart(agentId: string): InFlightStart | undefined;
+//#endregion
+//#region services/core/src/session/ownership/settle-queue.d.ts
+/**
+ * Serialize one agent's movement settlements, in receipt order.
+ *
+ * `bus.emit` runs handlers concurrently across independent producer chains —
+ * payload enrichment, connector-swap completion and turn-dispatch rotation all
+ * announce without a shared lock — so two movements for one agent otherwise
+ * interleave between the authority's revision read and its transaction, and
+ * both burn their single `currency-changed` retry against each other. Chaining
+ * per agent makes settle order equal receipt order, which is the strongest
+ * ordering an observation seam can offer: it does not claim producer order,
+ * only that what this process received first is settled first.
+ *
+ * The chain is keyed per agent rather than globally because two agents' currency
+ * rows share nothing — a global queue would serialize independent work and turn
+ * one slow settle into everyone's latency.
+ * @param agentId - Agent whose settles are being ordered.
+ * @param settle - The settle to run once every settle received earlier for this
+ *   agent has finished.
+ * @returns A promise for this settle's own completion. It rejects if `settle`
+ *   rejects; the chain itself absorbs the failure so queued successors still run.
+ */
+declare function enqueueAgentSettle(agentId: string, settle: () => Promise<void>): Promise<void>;
+//#endregion
+//#region services/core/src/session/ownership/claim-token.d.ts
+/**
+ * Mint the identity of one claim generation.
+ *
+ * The single way a generation identity comes into existence, whether the
+ * authority mints it or a caller mints one to name its own settlement with.
+ * Re-using a token whose generation is *retired* is a caller bug storage cannot
+ * defend against: retired generations are not remembered, so a released token
+ * is storable again and how it interacts with later generations is undefined.
+ * Re-offering an *unused* token — what the settle retry does — is not that: a
+ * rolled-back attempt left no row behind for it to collide with.
+ * @returns An opaque, single-use claim token.
+ */
+declare function mintClaimToken(): string;
+//#endregion
+//#region services/core/src/session/ownership/owner-liveness.d.ts
+/**
+ * Judge whether a claim's owner is gone — **for diagnostics only**.
+ *
+ * Reconcile is this function's sole caller, and the verdict it produces
+ * authorizes nothing: a takeover is a predicate evaluated inside the taking
+ * transaction, over the incumbent's own agent row, and it never consults a
+ * probe or a filed verdict. Keeping the assessment out of the authorization
+ * path is what makes the authorization impossible to base on evidence that is
+ * stale, replayed, or contradicted by a concurrent writer.
+ *
+ * Reasons are tested in order of how provable they are, and the first that
+ * holds is reported:
+ *
+ * - `agent-gone` — the agent row is absent. Rare, because both claim foreign
+ *   keys cascade and normally remove the claim with its parent; kept because a
+ *   diagnostic must report what it observes, and a probe can straddle a delete.
+ * - `agent-disposed` — the agent was removed. A disposed agent can never
+ *   legitimately hold a key.
+ * - `owner-instance-retired` — storage proves the exact process that took this
+ *   generation retired itself.
+ * - `adapter-instance-gone` — no adapter answers for the claim's instance.
+ *   Admitted **only** under `machine-exclusive`: where peers may host adapters
+ *   on the same machine, an unanswered probe means "not this runtime's", never
+ *   "nobody's".
+ * @param bus - Bus used for the agent read and the adapter probe.
+ * @param topology - How many runtime processes may own claims on this machine;
+ *   the one input that decides whether the adapter probe is evidence at all.
+ * @param claim - The claim whose owner is being assessed.
+ * @returns The first reason that holds, or `null` when the owner looks alive.
+ */
+declare function assessClaimOwner(bus: IMakaioBus, topology: OwnershipTopology, claim: AdapterSessionClaimRecord): Promise<SessionOwnershipReclaimReason | null>;
+//#endregion
 //#region services/core/src/session/session-service-handlers-core.d.ts
 /**
  * Dependencies required to register the framework-core session service handlers.
@@ -105,13 +459,37 @@ declare class MakaioSessionService extends BaseService {
 interface CoreSessionServiceHandlerDeps {
   /** The event bus used for handler registration and storage dispatch. */
   bus: IMakaioBus;
+  /**
+   * Machine identity the ownership authority owns claims under.
+   *
+   * Injected by the composition root, never resolved through the bus: an
+   * ownership decision must not depend on whether the adapter runtime's
+   * identity handler happened to register first. Absent, every
+   * identity-dependent ownership operation declines instead of guessing.
+   */
+  machineId?: string;
+  /**
+   * How many runtime processes may own claims on this machine. Defaults to
+   * `'shared-machine'` — the reading no host can be wrong about.
+   */
+  topology?: OwnershipTopology;
+  /** Runtime-incarnation identity stamped onto ownership generations. */
+  instanceId?: string;
+}
+/** Core handler cleanups plus the private ownership lifecycle handle. */
+interface RegisteredCoreSessionServiceHandlers {
+  /** Cleanup callbacks for the containing service. */
+  readonly cleanups: readonly (() => void)[];
+  /** Private authority shutdown capability. */
+  readonly ownership: OwnershipAuthorityHandle;
 }
 /**
  * Registers the framework-core session service handlers:
  * `session.create`, `session.get`, `session.list`, `session.turn.await`,
  * `session.close`, `session.restartAgents`, `session.update`,
  * `session.archive`, `session.purge`,
- * `session.agent.added`, and `session.agent.removed`.
+ * `session.agent.added`, `session.agent.removed`, and the five
+ * `session.ownership.*` operations of the ownership authority.
  *
  * These handlers cover the minimal, load-bearing session contract for the
  * framework SDK. Host-specific handlers (search, resume, analytics, context
@@ -120,10 +498,10 @@ interface CoreSessionServiceHandlerDeps {
  * Persistence degrades gracefully when no storage handlers are registered:
  * `session.get` / `session.list` / `session.close` all delegate to
  * `SessionStorageSubjects.*` which may be unhandled in ephemeral mode.
- * @param deps - Bus dependency
- * @returns Array of cleanup callbacks, one per registered handler
+ * @param deps - Bus, plus the identity the ownership authority is composed with
+ * @returns Cleanup callbacks plus the private ownership lifecycle handle.
  */
-declare function registerCoreSessionServiceHandlers(deps: CoreSessionServiceHandlerDeps): Array<() => void>;
+declare function registerCoreSessionServiceHandlers(deps: CoreSessionServiceHandlerDeps): RegisteredCoreSessionServiceHandlers;
 //#endregion
 //#region services/core/src/session/session-orchestrator.d.ts
 /**
@@ -138,46 +516,7 @@ interface ISessionOrchestrator {
   /** Stop the orchestrator and clean up all subscriptions. */
   destroy(): void;
 }
-/**
- * Slim framework session orchestrator.
- *
- * Composes with `SessionTurnManager` (turn lifecycle, usage accumulation,
- * completion), `AdapterRegistry` (adapterName to adapterId mapping), and the
- * adapter-subsystem reverse lookup for canonical `adapterId` to `adapterName`
- * validation when callers select a direct adapter instance.
- *
- * Registers the core session orchestration handlers:
- * 1. Get or create session (via `getOrCreateSession`)
- * 2. Start agent if session has no agents — resolves the canonical
- *    `adapterName` from direct selections, uses `adapterId` directly when
- *    provided, otherwise resolves it via `AdapterRegistry`, resolves
- *    provider credentials when selected, then calls `AdapterSubjects.startAgent`
- * 3. Resolve target agents (via `resolveTargetAgents`)
- * 4. Verify agent liveness and build recovery context for dead agents
- *    (requestOptional `AdapterSubjects.getAgent` + `buildRecoveryContext`)
- * 5. Get or create turn (via `SessionTurnManager`)
- * 6. Generate message ID and store user message (awaited, persist-before-route)
- *    + routing records (fire-and-forget)
- * 7. Emit `session.turn.started` + `session.user_message.sent`
- * 8. Route to agents (via `routeToAgentsCore`, single shared context)
- * 9. Return result with `messageId`, `turnId`, `sessionId`
- *
- * Explicit `session.agent.attach` handlers share the same turn manager so
- * attach-time initial messages participate in the same completion lifecycle.
- *
- * Host-specific features (personas, MCP, execution targets, container spawn,
- * connector swap, CWD/model enforcement, fork context, TurnContextEnricher) are
- * handled by a host-provided orchestrator.
- * @example
- * ```typescript
- * const orchestrator = new SessionOrchestrator(MakaioBus, 'machine-id');
- *
- * const { messageId, turnId, sessionId } = await MakaioBus.request(
- *   SessionSubjects.sendMessage,
- *   { sessionId: crypto.randomUUID(), adapterName: 'openai-node', message: 'Hello!' },
- * );
- * ```
- */
+/** Coordinates session sends, recovery and turn completion. */
 declare class SessionOrchestrator implements ISessionOrchestrator {
   private readonly bus;
   private readonly turnManager;
@@ -192,22 +531,28 @@ declare class SessionOrchestrator implements ISessionOrchestrator {
    *   instance resolution).
    */
   constructor(bus: IMakaioBus | undefined, machineId: string);
+  /** Register the `session.sendMessage` RPC handler. */
+  private registerSendMessageHandler;
   /**
-   * Register the `session.sendMessage` RPC handler.
+   * Start the session's lead agent, reserved and in the order §7.1 prescribes.
    *
-   * Core flow:
-   * 1. Get or create session
-   * 2. Start agent if session has no agents (canonicalize direct selections,
-   *    resolve adapterId, resolve provider credentials, startAgent)
-   * 3. Resolve target agents
-   * 4. Verify agent liveness and build recovery context for dead agents
-   * 5. Get or create turn (via SessionTurnManager)
-   * 6. Generate message ID and store user message (awaited) + routing records (fire-and-forget)
-   * 7. Emit turn.started + user_message.sent
-   * 8. Route to agents (routeToAgentsCore, single shared context)
-   * 9. Return result with messageId, turnId, sessionId
+   * Only the adapter selection is resolved here; the reordered start itself —
+   * mint the identity, register the attempt, persist the row, reserve, dispatch,
+   * settle, transition — lives in `startLeadAgent` so this class keeps only the
+   * selection knowledge that is genuinely orchestrator-owned.
+   *
+   * A lost designation race is not an error: the session now has the winner's
+   * agent, and this send continues against it. Only a session that *still* has
+   * no agents after the re-read has nothing to send to.
+   * @param session - Session being sent to; its agents and lead are updated in place.
+   * @param sessionId - Resolved session identity.
+   * @param agentSelection - Public agent selection from the request.
+   * @param message - User message, used as canonical-model prompt context.
+   * @param sessionContext - Session context passed through to the adapter.
+   * @param leadTransition - Whether this start creates or replaces the durable lead.
+   * @returns What the adopted agents need, empty unless a race was lost.
    */
-  private registerSendMessageHandler;
+  private startLeadAgent;
   /**
    * Complete a turn by delegating to `SessionTurnManager`.
    *
@@ -221,37 +566,6 @@ declare class SessionOrchestrator implements ISessionOrchestrator {
    * Stop the orchestrator and clean up all subscriptions and composition utilities.
    */
   destroy(): void;
-  /**
-   * Resolve the adapter name for a direct adapter selection.
-   *
-   * Adapter startup and persisted identity require a stable adapter name.
-   * When the caller provides `adapterId`, the framework validates any explicit
-   * name against the adapter-subsystem reverse lookup and otherwise backfills the
-   * canonical adapter name from that subsystem-owned mapping.
-   * @param selection - Direct adapter selection
-   * @param sessionId - Session ID used in error messages
-   * @returns Resolved adapter name
-   */
-  private resolveAdapterName;
-  /**
-   * Resolve the public agent selection into the direct adapter shape required
-   * by the framework orchestrator's startup path.
-   * @param selection - Public session agent selection from the request.
-   * @param sessionId - Session ID used for context and diagnostics.
-   * @param message - User message used as canonical-model prompt context.
-   * @param sessionContext - Optional session context passed through the request.
-   * @returns Direct adapter selection for `adapter.startAgent`.
-   */
-  private resolveInitialAdapterSelection;
-  /**
-   * Resolve a framework-owned canonical-model selection to a direct adapter selection.
-   * @param selection - Canonical model selection from the session request.
-   * @param sessionId - Session ID used for context and diagnostics.
-   * @param message - User message used as canonical-model prompt context.
-   * @param sessionContext - Optional session context passed through the request.
-   * @returns Direct adapter selection with resolved adapter, provider config, and model.
-   */
-  private resolveCanonicalModelSelection;
 }
 //#endregion
 //#region services/core/src/session/adapter-registry.d.ts
@@ -276,6 +590,11 @@ declare class AdapterRegistry {
    * the new `adapterId` silently overwrites the previous mapping. This is intentional:
    * adapters that restart emit a fresh initialized event and the registry should
    * reflect the latest instance.
+   *
+   * Every initialization announcement carries the machine that hosts the exact
+   * adapter ID, so event fallback may serve only that same scope. The unscoped
+   * entry remains for legacy observers that intentionally make no ownership
+   * assertion.
    * @param bus - The event bus to listen on
    */
   constructor(bus: IMakaioBus);
@@ -294,10 +613,18 @@ declare class AdapterRegistry {
    * keeps legacy event-driven tests and observers useful, but session routing
    * must prefer the replayable request seam so a session created after adapter
    * initialization does not miss a one-time event.
+   * **Naming the machine is what makes the answer usable as an ownership key.**
+   * An instance ID is derived from `(machineId, adapterName)`, so a caller that
+   * will reserve or settle under a particular machine has to resolve for that
+   * same machine — otherwise the instance it dispatches to and the namespace it
+   * claims in come from two different identities and the key protects nothing.
+   * Omitted, the resolver derives the runtime's own, which is what a caller with
+   * no machine of its own to act for wants.
    * @param adapterName - Adapter type name (e.g., `'openai-node'`)
+   * @param machineId - Machine to resolve the instance for; omit for the runtime's own.
    * @returns Adapter runtime identifier for bus routing.
    */
-  resolveAvailable(adapterName: string): Promise<string>;
+  resolveAvailable(adapterName: string, machineId?: string): Promise<string>;
   /** Stop listening to `adapter.initialized` events and clear the registry. */
   destroy(): void;
 }
@@ -382,41 +709,148 @@ declare function resolveTargetAgents(session: IMakaioSession, targetSpec: string
  */
 declare function findTurnByAgent(activeTurns: Map<string, Turn$1>, agentId: string): Turn$1 | undefined;
 //#endregion
-//#region services/core/src/session/utils/resolution.d.ts
+//#region services/core/src/session/utils/start-reservation.d.ts
+/** Adapter identity sufficient to route every reservation to one authority. */
+type ReservationAdapterInstance = OwnedAdapterInstance & {
+  readonly ownerInstanceId: string;
+};
+/** What every start reservation names, whatever role it takes. */
+interface StartReservationIdentity {
+  /** Session the agent belongs to; verified against the agent row by the authority. */
+  readonly sessionId: string;
+  /** Agent the reservation is taken for. */
+  readonly agentId: string;
+  /** Adapter type name carried onto any claim for diagnostics. */
+  readonly adapterName: string;
+  /** Instance the dispatch addresses, and the machine its ownership acts are filed under. */
+  readonly instance: ReservationAdapterInstance;
+  /** Provider session to reserve, or `null` for a start with no key yet. */
+  readonly resumeProviderSessionId: string | null;
+  /** Caller-minted identity for the reservation generation. */
+  readonly claimToken: string;
+}
 /**
- * Resolve adapterName → adapterId for bus routing.
- * Queries the adapters table for a local enabled instance.
- * @param bus - Bus instance
- * @param adapterName - Adapter type name
- * @param machineId - Optional machine ID for deterministic local resolution
- * @returns Canonical adapter ID for bus routing
- * @throws if no enabled instance found for this adapterName
+ * The designation half, as a union rather than an optional field.
+ *
+ * A lead reservation is a compare-and-swap and must name the exact value the
+ * caller read; `null` is a legitimate observation ("the session named no lead")
+ * and therefore cannot double as "not supplied". Modelling it as one optional
+ * field would make the authority's own refusal — *`expectedLeadAgentId` is
+ * required when role is `'lead'`* — reachable from these four callers, which is
+ * exactly what a union makes impossible to write.
  */
-declare function resolveAdapterId(bus: IMakaioBus, adapterName: string, machineId?: string): Promise<string>;
+type StartReservationDesignation = {
+  /** This start designates the session's lead. */readonly role: Extract<AgentRole, 'lead'>; /** Lead the caller observed on the session row, or `null` when it named none. */
+  readonly expectedLeadAgentId: string | null;
+} | {
+  /** This start leaves the designation untouched. */readonly role: Exclude<AgentRole, 'lead'>;
+};
+/** Everything a start reservation names beyond the instance it runs against. */
+type StartReservationRequest = StartReservationIdentity & StartReservationDesignation & {
+  /** Atomic snapshot for a member recovery; absent for ordinary starts. */readonly recoveryGuard?: SessionOwnershipRecoveryGuard; /** Opaque fence for this guarded recovery attempt. */
+  readonly recoveryAttemptId?: string;
+};
+/**
+ * Take one start reservation.
+ *
+ * Issued as a **hard** request by every caller, and that is deliberate rather
+ * than incidental: a host that can dispatch a start and cannot reserve one is a
+ * broken composition, not a lightweight one, and a degrade here would make that
+ * misconfiguration indistinguishable from a supported topology. Each caller owns
+ * what a throw means for its own rollback, so no attempt is made to classify it
+ * here.
+ * @param bus - Bus the reservation is issued on.
+ * @param request - Identity, instance, role and resume target of the start being reserved for.
+ * @returns What the authority answered, verbatim.
+ */
+declare function reserveStartFor(bus: IMakaioBus, request: StartReservationRequest): Promise<SessionOwnershipReserveStartServiceResult>;
+//#endregion
+//#region services/core/src/session/recovery-plan.d.ts
 /**
- * Resolve supported reasoning levels for a model from provider definitions.
+ * Continue the agent's existing provider conversation.
  *
- * Looks up the provider config by ID, finds the provider definition it belongs to,
- * then finds the model's `supportedReasoningLevels` in the provider's `availableModels`
- * catalog.
- * @param bus - Bus instance for RPC calls
- * @param providerConfigId - Canonical provider config ID (ProviderConfigRecord.id)
- * @param model - Model identifier to look up in the provider's catalog
- * @returns Object with `supportedReasoningLevels` when found, or `undefined` when not resolvable
+ * The provider still holds the conversation, so history must **not** be
+ * injected — the model would see every prior message twice.
+ */
+interface NativeResumeRecoveryPlan {
+  readonly kind: 'native-resume';
+  /** Provider session the replacement connector resumes. */
+  readonly resumeAdapterSessionId: string;
+}
+/**
+ * Start a fresh provider session and inject the stored conversation.
+ *
+ * This is the "warm-fresh" case named in the session-locality design: the agent
+ * record survives, but its provider conversation does not — either because the
+ * provider session is unreachable (foreign machine, unsupported adapter,
+ * unconfirmed movement) or because the agent never had a confirmed one. The
+ * caller owns history injection; without it the model starts blank on a session
+ * that visibly has prior turns.
  */
-declare function resolveModelCapabilities(bus: IMakaioBus, providerConfigId: string | undefined, model: string | undefined): Promise<{
-  supportedReasoningLevels?: ReasoningLevelMap;
-} | undefined>;
+interface FreshWithHistoryRecoveryPlan {
+  readonly kind: 'fresh-with-history';
+}
 /**
- * Resolves the effective execution target for a session.
- * Priority: explicit executionTargetId → system default (local).
- * @param bus - Makaio bus instance
- * @param params - Resolution parameters from session context
- * @returns Resolved execution target
+ * How one agent regains its conversation when its connector is gone.
+ *
+ * Produced by {@link planAgentRecovery} (or taken as
+ * {@link FRESH_WITH_HISTORY_RECOVERY_PLAN} where no provider session can exist)
+ * and read back through {@link recoveryPlanResumeTarget} and
+ * {@link recoveryPlanRequiresHistory}, so the rehydrate call and the history
+ * routing cannot drift apart.
+ */
+type RecoveryPlan = NativeResumeRecoveryPlan | FreshWithHistoryRecoveryPlan;
+/**
+ * The fresh-with-history plan.
+ *
+ * Shared frozen instance: the variant carries no per-agent data, and a single
+ * instance keeps call sites from implying that it does.
  */
-declare function resolveExecutionTarget(bus: IMakaioBus, params: {
-  executionTargetId?: string;
-}): Promise<ExecutionTarget>;
+declare const FRESH_WITH_HISTORY_RECOVERY_PLAN: FreshWithHistoryRecoveryPlan;
+/**
+ * Derive the recovery plan for one agent from its locality verdict.
+ *
+ * Native resume requires both halves of the gate:
+ * - the verdict is `native` — this machine owns the provider session store, the
+ *   adapter can resume, and the resume currency is intact; and
+ * - the agent's own settled currency names a provider session.
+ *
+ * A native verdict with no resolved currency stays fresh-with-history. The
+ * verdict is computed from session-level structural signals, so borrowing
+ * another agent's provider session to satisfy it would attach two agents to one
+ * provider conversation.
+ *
+ * **The target is settled currency, not an origin column.** Callers resolve it
+ * through `resolveAgentResumeIdentity`, which follows a movement the ownership
+ * seam settled onto the agent row; the immutable `adapterSessionId` records only
+ * where the conversation started. Passing the raw column here would evaluate the
+ * verdict against the currency and then resume the pre-movement session anyway.
+ * @param verdict - Native locality verdict evaluated for this agent
+ * @param agentAdapterSessionId - Resume currency resolved for this agent, or `undefined` when nothing is resumable
+ * @returns Native-resume plan when both halves of the gate hold, fresh-with-history otherwise
+ */
+declare function planAgentRecovery(verdict: NativeLocalityVerdict, agentAdapterSessionId: string | undefined): RecoveryPlan;
+/**
+ * Resume target the plan hands to `adapter.rehydrateAgent`.
+ * @param plan - Recovery plan decided for this agent
+ * @returns Provider session to resume, or `undefined` for a fresh replacement connector
+ */
+declare function recoveryPlanResumeTarget(plan: RecoveryPlan): string | undefined;
+/**
+ * Whether the caller must inject the stored conversation alongside the rehydrate.
+ *
+ * Exactly the inverse of {@link recoveryPlanResumeTarget} being defined — stated
+ * as its own predicate so the history side reads the decision instead of
+ * re-deriving it from the absence of a resume target.
+ *
+ * Declared as a type predicate rather than left to inference: a caller that
+ * returns early on history keeps a `native-resume` plan afterwards, and that
+ * narrowing is part of what this function promises. Inferring it would make the
+ * promise depend on the checker's version rather than on the signature.
+ * @param plan - Recovery plan decided for this agent
+ * @returns `true` when the replacement connector starts without provider-side history
+ */
+declare function recoveryPlanRequiresHistory(plan: RecoveryPlan): plan is FreshWithHistoryRecoveryPlan;
 //#endregion
 //#region services/core/src/session/utils/recovery-context.d.ts
 /**
@@ -430,6 +864,19 @@ declare function resolveExecutionTarget(bus: IMakaioBus, params: {
  * @returns SessionContext with messageHistory and isFirstTurn signal
  */
 declare function buildRecoveryContext(bus: IMakaioBus, session: IMakaioSession): Promise<SessionContext>;
+/**
+ * Build the session context a recovery plan calls for.
+ *
+ * This is the history half of the recovery contract: it consumes the same
+ * {@link RecoveryPlan} the rehydrate call consumes, so a natively resumed agent
+ * can never also be handed the conversation the provider already holds, and a
+ * fresh-with-history agent can never start blank.
+ * @param bus - Bus instance
+ * @param session - Session whose conversation is projected
+ * @param plan - Recovery plan decided for the agents being recovered
+ * @returns Full-history context for a fresh-with-history plan, `undefined` for native resume
+ */
+declare function buildPlannedRecoveryContext(bus: IMakaioBus, session: IMakaioSession, plan: RecoveryPlan): Promise<SessionContext | undefined>;
 //#endregion
 //#region services/core/src/session/utils/agent-recovery.d.ts
 /**
@@ -441,14 +888,34 @@ interface RecoveryConfig {
   /** Model identifier (e.g., 'claude-sonnet-4-20250514', 'gpt-4o') */
   model?: string;
   /**
-   * Provider-native session ID to resume.
+   * Whether the replacement connector resumes the provider conversation or
+   * starts fresh and receives the stored conversation as injected history.
+   *
+   * Required, and required to be the same value the caller feeds to its history
+   * assembly (via `buildPlannedRecoveryContext`): the two halves of a
+   * recovery are only correct together. Deciding native resume here while
+   * building history there replays the conversation into a provider session that
+   * already holds it; deciding fresh here without building history there starts
+   * the model blank on a session with prior turns.
+   *
+   * Locality evaluation belongs to the caller — see `planAgentRecovery`.
+   */
+  plan: RecoveryPlan;
+  /**
+   * Machine identity every ownership act of this recovery names.
    *
-   * When set, the adapter creates the connector in native-resume mode so the
-   * provider session continues from where it left off. The caller is responsible
-   * for evaluating locality (machine identity, adapter capability, CWD match)
-   * before setting this field.
+   * A recovery reserves and settles under a machine, and addresses an adapter
+   * instance that is derived from one — so both have to come from the *same*
+   * identity or the key they build is one no other actor computes. Supplying it
+   * is therefore not an optimisation: without it the instance is resolved for
+   * this runtime's own machine (or falls back to the agent's persisted one)
+   * while the authority files the acts under its default, which is the mixed key
+   * the aggregate exists to prevent.
+   *
+   * Omitted when the caller cannot target a real machine. Such a recovery is
+   * deferred before it can dispatch a connector.
    */
-  resumeAdapterSessionId?: string;
+  machineId?: string;
 }
 /**
  * Ensure agent cwd matches desired cwd, swapping connector if needed.
@@ -492,18 +959,48 @@ declare function ensureAgentModel(bus: IMakaioBus, agent: MakaioSessionAgent, de
   changed: true;
   swapped: boolean;
 }>;
+/**
+ * What a liveness-and-recovery pass leaves its caller with.
+ *
+ * Three sets rather than two, because a recovery can now end in a third state:
+ * the agent's provider session is held by a generation this runtime does not
+ * own, so no connector was built and none may be. The helper **names** that set
+ * and decides nothing with it — it has no session, no orchestrator and no way
+ * to start anything, and what a product does without those agents differs per
+ * product.
+ */
+interface VerifiedAgents {
+  /** Agents this runtime may drive. */
+  readonly usable: MakaioSessionAgent[];
+  /** Agents recovered during this call. */
+  readonly recoveredAgentIds: Set<string>;
+  /**
+   * Agents this runtime may **not** drive: their provider session is held by a
+   * generation it does not own (I23a). Never empty-able by retrying — the
+   * caller must decide what its product does without them.
+   */
+  readonly deferredAgentIds: Set<string>;
+}
 /**
  * Verify liveness of agents and recover any that are dead.
- * Queries each agent via getAgent; if unresponsive, triggers connector swap via recoverAgent.
+ * Queries each agent via getAgent; if unresponsive, triggers a reserved
+ * rehydrate via recoverAgent.
+ *
+ * The caller's `recoveryConfig.plan` applies to every agent recovered in this
+ * batch and must be the same plan the caller feeds to its history assembly.
+ *
+ * The **adapter instance is resolved per agent**, inside the exclusive recovery
+ * attempt, and not once for the batch: a batch may span adapters, and a
+ * persisted `adapterId` goes stale across a runtime restart or failover.
+ * Resolving per agent is what keeps each rehydrate addressed to the live
+ * instance that actually owns that agent's adapter, and keeps a single
+ * unresolvable adapter from deciding the batch.
  * @param bus - Bus instance
  * @param agents - Agents to verify
- * @param recoveryConfig - Configuration for recovering dead agents
- * @returns Verified/recovered agents and set of recovered agent IDs
+ * @param recoveryConfig - Configuration for recovering dead agents, including the shared recovery plan
+ * @returns Usable agents, the ones recovered here, and the ones this runtime may not drive
  */
-declare function verifyAndRecoverAgents(bus: IMakaioBus, agents: MakaioSessionAgent[], recoveryConfig: RecoveryConfig): Promise<{
-  verifiedAgents: MakaioSessionAgent[];
-  recoveredAgentIds: Set<string>;
-}>;
+declare function verifyAndRecoverAgents(bus: IMakaioBus, agents: MakaioSessionAgent[], recoveryConfig: RecoveryConfig): Promise<VerifiedAgents>;
 /**
  * Build recovery context and apply optional additional transforms.
  * @param bus - Bus instance
@@ -514,18 +1011,45 @@ declare function verifyAndRecoverAgents(bus: IMakaioBus, agents: MakaioSessionAg
 declare function buildRecoveryContextWithPipeline(bus: IMakaioBus, session: IMakaioSession, options?: {
   pipeline?: PipelineStep[];
 }): Promise<SessionContext>;
+/** How one agent's recovery ended, for a caller that has a fallback for neither. */
+type AgentRecoveryOutcome = /** A connector is live again; the agent carries the instance it now lives on. */{
+  readonly kind: 'recovered';
+  readonly agent: MakaioSessionAgent;
+}
+/**
+ * This runtime may not drive the agent: its provider session is held by a
+ * generation it does not own. Nothing was dispatched and nothing may be.
+ */
+| {
+  readonly kind: 'deferred';
+  readonly reason: 'occupied' | 'machine-identity-unavailable';
+};
 /**
- * Recover a dead agent by triggering connector swap via the adapter.
+ * Recover a dead agent under the ownership authority.
  * The agent keeps its identity — no session mutation needed.
  *
  * Context delivery happens via the normal sendMessage path that follows
  * recovery (same handler invocation). No staging needed.
+ *
+ * Every invocation that wins the exclusive seam reads the canonical recovery
+ * snapshot and resolves its live adapter instance itself. A join can leave a
+ * different status, binding, or holder generation behind, so carrying any of
+ * those planning facts into a self-reentry would make its guarded reservation
+ * describe the attempt it joined rather than the row it is about to claim.
+ *
+ * The reserved rehydrate runs inside the in-flight-start seam, so a concurrent
+ * consumer that finds this agent mid-recovery joins the attempt instead of
+ * starting a second lifecycle for the same identity — and consumes that join
+ * through the shared seam, which classifies the row the attempt left behind
+ * rather than reading its own success into the absence of a rejection.
  * @param bus - Bus instance
- * @param deadAgent - The dead agent to recover
+ * @param deadAgent - The dead agent to recover; its `adapterId` is re-stamped to the instance the
+ *   attempt actually used
  * @param recoveryConfig - Configuration for the recovered connector
- * @returns Same agent reference — identity preserved
+ * @returns The recovered agent, or the statement that this runtime may not drive it
+ * @throws Whatever {@link failedRehydrateError} raises when the recovery failed rather than deferred
  */
-declare function recoverAgent(bus: IMakaioBus, deadAgent: MakaioSessionAgent, recoveryConfig: RecoveryConfig): Promise<MakaioSessionAgent>;
+declare function recoverAgent(bus: IMakaioBus, deadAgent: MakaioSessionAgent, recoveryConfig: RecoveryConfig): Promise<AgentRecoveryOutcome>;
 //#endregion
 //#region services/core/src/session/utils/turn-initiator.d.ts
 /**
@@ -540,6 +1064,119 @@ declare function recoverAgent(bus: IMakaioBus, deadAgent: MakaioSessionAgent, re
  */
 declare function buildTurnInitiator(source: 'extension' | 'user' | 'system' | undefined, extensionId: string | undefined): TurnInitiator;
 //#endregion
+//#region services/core/src/session/handlers/lead-start-request.d.ts
+/** Fully-owned payload supplied to a host-specific lead-start dispatcher. */
+type LeadStartDispatchRequest = StartAgentRequest & {
+  /** Framework-minted identity of this exact attempt. */readonly agentId: string; /** Runtime incarnation selected by the ownership reservation. */
+  readonly ownerInstanceId: string;
+};
+/**
+ * Host-specific transport policy for one already-reserved lead start.
+ *
+ * The callback may choose how the request reaches the selected adapter, but it
+ * does not own identity, persistence, reservation, settlement, or cleanup.
+ */
+type LeadStartDispatch = (request: LeadStartDispatchRequest) => Promise<StartAgentResponse>;
+/** Whether this start creates the first lead or replaces an existing one. */
+type LeadTransition = {
+  readonly kind: 'fresh';
+} | {
+  readonly kind: 'replace';
+};
+/** Everything a lead transition needs beyond the payload it dispatches. */
+interface LeadStartRequest {
+  /** Session the agent is started into. */
+  readonly sessionId: string;
+  /** Machine-scoped adapter runtime selected for dispatch and ownership. */
+  readonly instance: MachineScopedAdapterInstance;
+  /** Adapter type name, carried onto the agent row and any claim. */
+  readonly adapterName: string;
+  /** Provider config to stamp on the agent's runtime row once the start lands. */
+  readonly providerConfigId?: string;
+  /** Persona identity persisted before the adapter can create a connector. */
+  readonly personaId?: string;
+  /** Profile identity persisted before the adapter can create a connector. */
+  readonly profileId?: string;
+  /** Explicit lifecycle transition; never inferred from designation identity. */
+  readonly leadTransition: LeadTransition;
+  /** Lead designation the caller observed before entering the reservation. */
+  readonly expectedLeadAgentId: string | null;
+  /** Adapter payload, complete except for the attempt identity minted by this service. */
+  readonly startRequest: StartAgentRequest;
+  /** Optional host transport policy; the bus request remains the default. */
+  readonly dispatch?: LeadStartDispatch;
+}
+/** How a lead transition ended, for the caller that has a send to continue. */
+type LeadStartResult = {
+  /** The agent is live, owns its provider session and is `idle` in storage. */outcome: 'started'; /** The agent row as it now stands, for the caller's in-memory session. */
+  agent: MakaioSessionAgent;
+} | {
+  /** Another start won the designation race and this attempt left nothing behind. */outcome: 'lead-conflict'; /** Lead the session actually names, or `null` when it has none. */
+  currentLeadAgentId: string | null;
+};
+//#endregion
+//#region services/core/src/session/handlers/lead-start.d.ts
+/**
+ * Start or replace a session lead under the ownership reservation.
+ *
+ * The whole attempt runs inside the in-flight-start seam, registered *before*
+ * the agent row is written. There is therefore no instant at which a `starting`
+ * row is visible without an entry a concurrent consumer can join, which is what
+ * lets that consumer wait for this attempt instead of opening a second
+ * lifecycle for the same identity.
+ * @param bus - Bus every step is issued on.
+ * @param request - The start to run.
+ * @returns The started agent, or the designation race this start lost.
+ */
+declare function startLeadAgent(bus: IMakaioBus, request: LeadStartRequest): Promise<LeadStartResult>;
+//#endregion
+//#region services/core/src/session/session-orchestrator-selection.d.ts
+/** What resolving a fresh start's instance needs beyond the selection itself. */
+interface SelectionInstanceContext {
+  /** Adapter type name already resolved for the selection. */
+  readonly adapterName: string;
+  /** Session identity, for the refusal message. */
+  readonly sessionId: string;
+  /** This runtime's machine identity, used when it resolves the instance itself. */
+  readonly machineId: string;
+  /** Registry that resolves an adapter name to a live instance for a named machine. */
+  readonly registry: Pick<AdapterRegistry, 'resolveAvailable'>;
+}
+/**
+ * Resolve the instance a fresh lead start dispatches to, together with the
+ * machine every one of its ownership acts names.
+ *
+ * **A fresh start always has a machine, and that is what closes the last hole
+ * in the degrade matrix.** Its *reservation* is keyless and therefore cannot
+ * see the machine's absence — but its *settlement* is keyed, on the provider
+ * session the connector confirms, so an unnamed machine surfaced there as an
+ * outcome no caller on this path had a policy for. Naming the machine here
+ * removes the case by construction rather than by a new branch.
+ *
+ * Two shapes, and the asymmetry is deliberate:
+ *
+ * - **No instance named:** resolve one for this runtime's own machine, and
+ *   hand that same machine to the start. The instance ID is derived from
+ *   `(machineId, adapterName)`, so passing one identity to the resolution and
+ *   the other to the start is the mixed key; passing the same value to both is
+ *   what makes them provably agree.
+ * - **An instance named:** its machine comes from the caller, because the
+ *   derivation is one-way and this runtime must not invent one.
+ *
+ * **A selection that named one half without the other is refused before either
+ * branch runs**, by the rule {@link describeHalfNamedInstanceRefusal} states for
+ * every path that reads the pair. Refusing first is what makes the two branches
+ * above total: each one holds a pair it can honour, so neither has to decide what
+ * to do with half of one.
+ * @param bus - Bus the resolution is issued on.
+ * @param selection - Direct adapter selection this start runs from.
+ * @param context - Adapter name, session identity, this runtime's machine and its instance registry.
+ * @returns The instance and the machine, as one key.
+ * @throws A {@link SessionStartError} when an identity is incomplete or its
+ *   complete explicit triple has no matching live announcement.
+ */
+declare function resolveSelectionOwnedInstance(bus: IMakaioBus, selection: AdapterSelection, context: SelectionInstanceContext): Promise<MachineScopedAdapterInstance>;
+//#endregion
 //#region services/core/src/session/context-window/types.d.ts
 /**
  * Context window tracking types for per-session aggregation.
@@ -763,6 +1400,60 @@ declare function registerListActionsHandler(bus: IMakaioBus): () => void;
  * or contains only whitespace
  */
 declare function normalizeSelectionString(value: string | undefined): string | undefined;
+/** What a caller may know about the instance a selection named, once normalized. */
+interface NamedSelectionInstance {
+  /** Instance the selection named, or `undefined` when it named none. */
+  readonly adapterId: string | undefined;
+  /** Machine the selection named, or `undefined` when it named none. */
+  readonly machineId: string | undefined;
+}
+/** Session identity and the prefix a caller's own messages carry. */
+interface SelectionRefusalContext {
+  /** Session the selection was submitted for, for the refusal message. */
+  readonly sessionId: string;
+  /** Prefix of the caller's own error messages; include the trailing space. */
+  readonly errorPrefix: string;
+}
+/**
+ * Explain why a selection naming one half of the instance/machine pair must be
+ * refused rather than served.
+ *
+ * **One rule, every path that reads the pair.** An instance ID is a one-way hash
+ * of `(machineId, adapterName)`, so the two halves are only ever honest together:
+ *
+ * - **A machine and no instance** cannot be served, because resolving an instance
+ *   without one named derives it for the runtime doing the resolving. Honouring
+ *   the name is not what that derivation does, and ignoring it starts the agent
+ *   here while the caller believes it chose a host.
+ * - **An instance and no machine** cannot be completed, because the derivation
+ *   cannot be inverted. Filling the gap with the resolving runtime's own machine
+ *   files every ownership act under a key no other actor computes — it collides
+ *   with nothing, so it protects nothing, while the runtime that really owns the
+ *   instance claims the same provider session beside it.
+ *
+ * **Stated once, thrown by each caller in its own error form**, because the paths
+ * that read the pair do not share one: a start refuses with a typed start error, an
+ * attach with its own handler error. Returning the reason rather than throwing it
+ * is what lets the rule be one rule without making the paths converge on an error
+ * type none of them owns.
+ *
+ * **Needed as well as the selection schema**, whose two refinements forbid both
+ * shapes: payload validation returns early in production builds and in-process
+ * callers reach these paths with an unparsed selection, so the schema is a guard
+ * against *writing* such a caller while this is what an existing one meets.
+ *
+ * **No path is exempt, including the one that looked like it had a softer answer.**
+ * An attach used to serve a named instance with no machine as a locality degrade,
+ * on the grounds that a fresh-with-history conversation is still worth offering.
+ * The degraded attach still starts, and its settlement still files the confirmed
+ * provider session under the resolving runtime's machine while the dispatch
+ * addressed the named instance — so the softer answer was the mis-key, taken one
+ * step later.
+ * @param named - Normalized instance and machine the selection named
+ * @param context - Session identity and the prefix of the caller's own messages
+ * @returns The refusal, or `undefined` when the selection named both halves or neither
+ */
+declare function describeHalfNamedInstanceRefusal(named: NamedSelectionInstance, context: SelectionRefusalContext): string | undefined;
 /**
  * Resolve the canonical `adapterName` for a given deterministic `adapterId`,
  * rejecting when the caller-supplied name does not match the subsystem lookup.
@@ -977,7 +1668,20 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -998,6 +1702,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1009,6 +1714,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
   /**
    * Store or update an agent.
    *
+   * A whole-record write of a caller-held snapshot, so on an *existing* row it
+   * may not carry every column: the ownership columns and the origin provider
+   * session stay with the stored row, and a stored `disposed` status wins over
+   * the snapshot's. Disposal is the agent's removal and is terminal (see
+   * `updateStatus`); a snapshot read before it must not revive the row. On a
+   * fresh row there is nothing to protect and the caller's record is stored
+   * verbatim.
+   *
    * Subject: `storage:agent.set`
    * Type: Request (RPC)
    */
@@ -1020,7 +1733,20 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1041,6 +1767,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1079,6 +1806,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         all: "all";
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>>;
@@ -1089,7 +1817,20 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1110,6 +1851,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1134,7 +1876,20 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1155,6 +1910,7 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1164,7 +1920,15 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
     }, z.core.$strip>;
   };
   /**
-   * Update agent status.
+   * Update agent status, optionally as a compare-and-swap.
+   *
+   * **`disposed` is terminal.** A row that already carries it never transitions
+   * again, whatever `status` or `expectedStatus` the call names. Disposal is
+   * the agent's removal, and ownership authority is a predicate over the agent
+   * row: a status revived to `idle` would let a removed agent reserve and
+   * settle again. Enforcing it here — rather than asking every lifecycle writer
+   * to check first — is what makes the guarantee hold against a removal that
+   * lands mid-start or mid-rehydrate.
    *
    * Subject: `storage:agent.updateStatus`
    * Type: Request (RPC)
@@ -1175,12 +1939,21 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
       status: z.ZodEnum<{
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>;
+      expectedStatus: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        idle: "idle";
+        active: "active";
+        starting: "starting";
+        dead: "dead";
+        disposed: "disposed";
+      }>>>;
     }, z.core.$strip>;
     response: z.ZodObject<{
       success: z.ZodBoolean;
+      transitioned: z.ZodBoolean;
     }, z.core.$strip>;
   };
   /**
@@ -1201,6 +1974,11 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
   /**
    * Update runtime-mutable agent fields without full record overwrite.
    *
+   * The agent's ownership columns (currency pair, revision, fence) are
+   * deliberately not expressible here: they may only be written under a claim
+   * generation, through the `storage:sessionOwnership` seam. `adapterSessionId`
+   * below is the immutable *origin* identity, not the currency.
+   *
    * Subject: `storage:agent.updateRuntime`
    * Type: Request (RPC)
    */
@@ -1208,6 +1986,10 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
     request: z.ZodObject<{
       agentId: z.ZodString;
       adapterId: z.ZodOptional<z.ZodString>;
+      runtimeOwner: z.ZodOptional<z.ZodObject<{
+        machineId: z.ZodString;
+        instanceId: z.ZodString;
+      }, z.core.$strip>>;
       adapterSessionId: z.ZodOptional<z.ZodString>;
       cwd: z.ZodOptional<z.ZodString>;
       model: z.ZodOptional<z.ZodString>;
@@ -1300,8 +2082,8 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        adapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "adapter_session_id";
+        ownerMachineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "owner_machine_id";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
@@ -1319,8 +2101,8 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        model: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "model";
+        ownerInstanceId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "owner_instance_id";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
@@ -1338,8 +2120,8 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        cwd: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "cwd";
+        recoveryAttemptId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "recovery_attempt_id";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
@@ -1357,27 +2139,27 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        allowedDirectories: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: string;
+        adapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "adapter_session_id";
           tableName: "agents";
-          dataType: "json";
-          columnType: "SQLiteTextJson";
-          data: string[];
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: string;
           driverParam: string;
           notNull: false;
           hasDefault: false;
           isPrimaryKey: false;
           isAutoincrement: false;
           hasRuntimeDefault: false;
-          enumValues: undefined;
+          enumValues: [string, ...string[]];
           baseColumn: never;
           identity: undefined;
           generated: undefined;
         }, {}, {
-          $type: string[];
+          length: number | undefined;
         }>;
-        providerConfigId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "provider_config_id";
+        currentAdapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "current_adapter_session_id";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
@@ -1395,27 +2177,61 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        personaId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "persona_id";
+        currentAdapterSessionIdState: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "current_adapter_session_id_state";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
-          data: string;
+          data: "confirmed" | "moved" | "inherited";
           driverParam: string;
-          notNull: false;
-          hasDefault: false;
+          notNull: true;
+          hasDefault: true;
           isPrimaryKey: false;
           isAutoincrement: false;
           hasRuntimeDefault: false;
-          enumValues: [string, ...string[]];
+          enumValues: ["inherited", "moved", "confirmed"];
           baseColumn: never;
           identity: undefined;
           generated: undefined;
         }, {}, {
           length: number | undefined;
         }>;
-        profileId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "profile_id";
+        revision: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: string;
+          tableName: "agents";
+          dataType: "number";
+          columnType: "SQLiteInteger";
+          data: number;
+          driverParam: number;
+          notNull: true;
+          hasDefault: true;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: undefined;
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {}>;
+        currencyFence: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: string;
+          tableName: "agents";
+          dataType: "number";
+          columnType: "SQLiteInteger";
+          data: number;
+          driverParam: number;
+          notNull: true;
+          hasDefault: true;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: undefined;
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {}>;
+        model: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "model";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
@@ -1433,8 +2249,8 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        harnessId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "harness_id";
+        cwd: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "cwd";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
@@ -1452,27 +2268,27 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        clientId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "client_id";
+        allowedDirectories: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: string;
           tableName: "agents";
-          dataType: "string";
-          columnType: "SQLiteText";
-          data: string;
+          dataType: "json";
+          columnType: "SQLiteTextJson";
+          data: string[];
           driverParam: string;
           notNull: false;
           hasDefault: false;
           isPrimaryKey: false;
           isAutoincrement: false;
           hasRuntimeDefault: false;
-          enumValues: [string, ...string[]];
+          enumValues: undefined;
           baseColumn: never;
           identity: undefined;
           generated: undefined;
         }, {}, {
-          length: number | undefined;
+          $type: string[];
         }>;
-        compressionMode: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "compression_mode";
+        providerConfigId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "provider_config_id";
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
@@ -1490,9 +2306,104 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
         }, {}, {
           length: number | undefined;
         }>;
-        role: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-          name: "role";
-          tableName: "agents";
+        personaId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "persona_id";
+          tableName: "agents";
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: string;
+          driverParam: string;
+          notNull: false;
+          hasDefault: false;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: [string, ...string[]];
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {
+          length: number | undefined;
+        }>;
+        profileId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "profile_id";
+          tableName: "agents";
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: string;
+          driverParam: string;
+          notNull: false;
+          hasDefault: false;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: [string, ...string[]];
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {
+          length: number | undefined;
+        }>;
+        harnessId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "harness_id";
+          tableName: "agents";
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: string;
+          driverParam: string;
+          notNull: false;
+          hasDefault: false;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: [string, ...string[]];
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {
+          length: number | undefined;
+        }>;
+        clientId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "client_id";
+          tableName: "agents";
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: string;
+          driverParam: string;
+          notNull: false;
+          hasDefault: false;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: [string, ...string[]];
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {
+          length: number | undefined;
+        }>;
+        compressionMode: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "compression_mode";
+          tableName: "agents";
+          dataType: "string";
+          columnType: "SQLiteText";
+          data: string;
+          driverParam: string;
+          notNull: false;
+          hasDefault: false;
+          isPrimaryKey: false;
+          isAutoincrement: false;
+          hasRuntimeDefault: false;
+          enumValues: [string, ...string[]];
+          baseColumn: never;
+          identity: undefined;
+          generated: undefined;
+        }, {}, {
+          length: number | undefined;
+        }>;
+        role: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+          name: "role";
+          tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
           data: "lead" | "member";
@@ -1514,14 +2425,14 @@ declare const AgentStorageNamespace: _$_makaio_storage_core0.StorageNamespaceDef
           tableName: "agents";
           dataType: "string";
           columnType: "SQLiteText";
-          data: "idle" | "active" | "dead" | "disposed";
+          data: "idle" | "active" | "starting" | "dead" | "disposed";
           driverParam: string;
           notNull: true;
           hasDefault: false;
           isPrimaryKey: false;
           isAutoincrement: false;
           hasRuntimeDefault: false;
-          enumValues: ["idle", "active", "dead", "disposed"];
+          enumValues: ["starting", "idle", "active", "dead", "disposed"];
           baseColumn: never;
           identity: undefined;
           generated: undefined;
@@ -1587,7 +2498,20 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1608,6 +2532,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1619,6 +2544,14 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
   /**
    * Store or update an agent.
    *
+   * A whole-record write of a caller-held snapshot, so on an *existing* row it
+   * may not carry every column: the ownership columns and the origin provider
+   * session stay with the stored row, and a stored `disposed` status wins over
+   * the snapshot's. Disposal is the agent's removal and is terminal (see
+   * `updateStatus`); a snapshot read before it must not revive the row. On a
+   * fresh row there is nothing to protect and the caller's record is stored
+   * verbatim.
+   *
    * Subject: `storage:agent.set`
    * Type: Request (RPC)
    */
@@ -1630,7 +2563,20 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1651,6 +2597,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1689,6 +2636,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         all: "all";
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>>;
@@ -1699,7 +2647,20 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1720,6 +2681,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1744,7 +2706,20 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         adapterId: z.ZodString;
         adapterName: z.ZodString;
         sessionId: z.ZodString;
+        runtimeOwner: z.ZodOptional<z.ZodObject<{
+          machineId: z.ZodString;
+          instanceId: z.ZodString;
+        }, z.core.$strip>>;
+        recoveryAttemptId: z.ZodOptional<z.ZodString>;
         adapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionId: z.ZodOptional<z.ZodString>;
+        currentAdapterSessionIdState: z.ZodOptional<z.ZodEnum<{
+          confirmed: "confirmed";
+          moved: "moved";
+          inherited: "inherited";
+        }>>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        currencyFence: z.ZodOptional<z.ZodNumber>;
         model: z.ZodOptional<z.ZodString>;
         cwd: z.ZodOptional<z.ZodString>;
         allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1765,6 +2740,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
         status: z.ZodEnum<{
           idle: "idle";
           active: "active";
+          starting: "starting";
           dead: "dead";
           disposed: "disposed";
         }>;
@@ -1774,7 +2750,15 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
     }, z.core.$strip>;
   };
   /**
-   * Update agent status.
+   * Update agent status, optionally as a compare-and-swap.
+   *
+   * **`disposed` is terminal.** A row that already carries it never transitions
+   * again, whatever `status` or `expectedStatus` the call names. Disposal is
+   * the agent's removal, and ownership authority is a predicate over the agent
+   * row: a status revived to `idle` would let a removed agent reserve and
+   * settle again. Enforcing it here — rather than asking every lifecycle writer
+   * to check first — is what makes the guarantee hold against a removal that
+   * lands mid-start or mid-rehydrate.
    *
    * Subject: `storage:agent.updateStatus`
    * Type: Request (RPC)
@@ -1785,12 +2769,21 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
       status: z.ZodEnum<{
         idle: "idle";
         active: "active";
+        starting: "starting";
         dead: "dead";
         disposed: "disposed";
       }>;
+      expectedStatus: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        idle: "idle";
+        active: "active";
+        starting: "starting";
+        dead: "dead";
+        disposed: "disposed";
+      }>>>;
     }, z.core.$strip>;
     response: z.ZodObject<{
       success: z.ZodBoolean;
+      transitioned: z.ZodBoolean;
     }, z.core.$strip>;
   };
   /**
@@ -1811,6 +2804,11 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
   /**
    * Update runtime-mutable agent fields without full record overwrite.
    *
+   * The agent's ownership columns (currency pair, revision, fence) are
+   * deliberately not expressible here: they may only be written under a claim
+   * generation, through the `storage:sessionOwnership` seam. `adapterSessionId`
+   * below is the immutable *origin* identity, not the currency.
+   *
    * Subject: `storage:agent.updateRuntime`
    * Type: Request (RPC)
    */
@@ -1818,6 +2816,10 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
     request: z.ZodObject<{
       agentId: z.ZodString;
       adapterId: z.ZodOptional<z.ZodString>;
+      runtimeOwner: z.ZodOptional<z.ZodObject<{
+        machineId: z.ZodString;
+        instanceId: z.ZodString;
+      }, z.core.$strip>>;
       adapterSessionId: z.ZodOptional<z.ZodString>;
       cwd: z.ZodOptional<z.ZodString>;
       model: z.ZodOptional<z.ZodString>;
@@ -1830,13 +2832,50 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
   };
 }>, "storage:agent">;
 //#endregion
+//#region services/core/src/session/storage/memory-store.d.ts
+/**
+ * In-memory backing state shared by the session, agent and ownership memory handlers.
+ *
+ * Extracting the maps from their individual handler closures is what allows the
+ * ownership handler to read and mutate agent and session rows written by the other
+ * two handlers — a property that cannot be achieved with three disconnected private
+ * `Map` instances. Pass one `SessionStorageMemoryState` to all three `register*`
+ * functions to make them share the same rows.
+ */
+interface SessionStorageMemoryState {
+  /** Session rows keyed by `sessionId`. */
+  readonly sessions: Map<string, IMakaioSession>;
+  /** Agent rows keyed by `agentId`. */
+  readonly agents: Map<string, MakaioSessionAgent>;
+  /** Claim rows keyed by `claimId`. */
+  readonly claims: Map<string, AdapterSessionClaimRecord>;
+  /** Runtime-instance rows keyed by the process/machine pair. */
+  readonly runtimeInstances: Map<string, RuntimeInstanceRecord>;
+}
+/**
+ * Allocate a fresh, empty in-memory state instance.
+ *
+ * Each call returns an independent set of maps. Pass the same instance to all
+ * three memory handler registrations when they must share the same rows; pass
+ * separate instances to isolate them (the default when no state is supplied).
+ * @returns A new `SessionStorageMemoryState` with empty maps
+ */
+declare function createSessionStorageMemoryState(): SessionStorageMemoryState;
+//#endregion
 //#region services/core/src/session/storage/memory-handler.d.ts
 /**
  * Register in-memory session storage handlers.
  *
  * Suitable for development, testing, and single-instance deployments.
  * Data is lost when the process exits.
+ *
+ * Pass a shared `SessionStorageMemoryState` to make this handler operate on the
+ * same rows as `registerMemoryAgentStorage` and
+ * `registerMemorySessionOwnershipStorage`. Omit it (or pass `undefined`) to get
+ * an isolated, private store — the default, which preserves backward
+ * compatibility for callers that do not need cross-handler state sharing.
  * @param bus - The bus instance to register handlers on
+ * @param state - Shared in-memory state; defaults to a new isolated instance
  * @returns Cleanup function to unsubscribe all handlers
  * @example
  * ```typescript
@@ -1848,7 +2887,7 @@ declare const AgentStorageSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.
  * cleanup();
  * ```
  */
-declare function registerMemorySessionStorage(bus: IMakaioBus): () => void;
+declare function registerMemorySessionStorage(bus: IMakaioBus, state?: SessionStorageMemoryState): () => void;
 //#endregion
 //#region services/core/src/session/storage/drizzle-handler.d.ts
 /**
@@ -1887,10 +2926,17 @@ declare function registerDrizzleSessionStorage(bus: IMakaioBus, db: MakaioDataba
  * Register in-memory agent storage handlers.
  *
  * Suitable for development and testing. Data is lost when the process exits.
+ *
+ * Pass a shared `SessionStorageMemoryState` to make this handler operate on the
+ * same rows as `registerMemorySessionStorage` and
+ * `registerMemorySessionOwnershipStorage`. Omit it (or pass `undefined`) to get
+ * an isolated, private store — the default, which preserves backward
+ * compatibility for callers that do not need cross-handler state sharing.
  * @param bus - The bus instance to register handlers on
+ * @param state - Shared in-memory state; defaults to a new isolated instance
  * @returns Cleanup function to unsubscribe all handlers
  */
-declare function registerMemoryAgentStorage(bus: IMakaioBus): () => void;
+declare function registerMemoryAgentStorage(bus: IMakaioBus, state?: SessionStorageMemoryState): () => void;
 //#endregion
 //#region services/core/src/session/storage/schema.variants.d.ts
 /** Dialect variants for the session storage tables. */
@@ -1957,7 +3003,7 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         tableName: "sessions";
         dataType: "string";
         columnType: "SQLiteText";
-        data: "discovered" | "closed" | "active" | "archived";
+        data: "closed" | "discovered" | "active" | "archived";
         driverParam: string;
         notNull: true;
         hasDefault: false;
@@ -2123,6 +3169,44 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
+      currentAdapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id";
+        tableName: "sessions";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      currentAdapterSessionIdState: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id_state";
+        tableName: "sessions";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: "confirmed" | "moved" | "inherited";
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: ["inherited", "moved", "confirmed"];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
       adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: "adapter_id";
         tableName: "sessions";
@@ -2502,7 +3586,500 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         columnType: "SQLiteBoolean";
         data: boolean;
         driverParam: number;
-        notNull: false;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      machineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "machine_id";
+        tableName: "sessions";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+    };
+    dialect: "sqlite";
+  }>;
+  agents: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
+    name: "agents";
+    schema: undefined;
+    columns: {
+      agentId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "agent_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: true;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      adapterName: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_name";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      sessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "session_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      ownerMachineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "owner_machine_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      ownerInstanceId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "owner_instance_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      recoveryAttemptId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "recovery_attempt_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      adapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_session_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      currentAdapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      currentAdapterSessionIdState: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "current_adapter_session_id_state";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: "confirmed" | "moved" | "inherited";
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: ["inherited", "moved", "confirmed"];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      revision: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      currencyFence: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      model: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "model";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      cwd: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "cwd";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      allowedDirectories: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "json";
+        columnType: "SQLiteTextJson";
+        data: string[];
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        $type: string[];
+      }>;
+      providerConfigId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "provider_config_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      personaId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "persona_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      profileId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "profile_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      harnessId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "harness_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      clientId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "client_id";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      compressionMode: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "compression_mode";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      role: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "role";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: "lead" | "member";
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: ["lead", "member"];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      status: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "status";
+        tableName: "agents";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: "idle" | "active" | "starting" | "dead" | "disposed";
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: ["starting", "idle", "active", "dead", "disposed"];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {
+        length: number | undefined;
+      }>;
+      createdAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+      lastActivityAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "agents";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2512,16 +4089,23 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         identity: undefined;
         generated: undefined;
       }, {}, {}>;
+    };
+    dialect: "sqlite";
+  }>;
+  runtimeInstanceIncarnationCounters: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
+    name: "runtime_instance_incarnation_counters";
+    schema: undefined;
+    columns: {
       machineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: "machine_id";
-        tableName: "sessions";
+        tableName: "runtime_instance_incarnation_counters";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
-        isPrimaryKey: false;
+        isPrimaryKey: true;
         isAutoincrement: false;
         hasRuntimeDefault: false;
         enumValues: [string, ...string[]];
@@ -2531,23 +4115,40 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
+      lastAllocatedIncarnation: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "runtime_instance_incarnation_counters";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
     };
     dialect: "sqlite";
   }>;
-  agents: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
-    name: "agents";
+  runtimeInstances: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
+    name: "runtime_instances";
     schema: undefined;
     columns: {
-      agentId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "agent_id";
-        tableName: "agents";
+      instanceId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "instance_id";
+        tableName: "runtime_instances";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
         notNull: true;
         hasDefault: false;
-        isPrimaryKey: true;
+        isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
         enumValues: [string, ...string[]];
@@ -2557,9 +4158,9 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "adapter_id";
-        tableName: "agents";
+      machineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "machine_id";
+        tableName: "runtime_instances";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
@@ -2576,73 +4177,74 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      adapterName: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "adapter_name";
-        tableName: "agents";
-        dataType: "string";
-        columnType: "SQLiteText";
-        data: string;
-        driverParam: string;
+      incarnation: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "runtime_instances";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
         notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
+        enumValues: undefined;
         baseColumn: never;
         identity: undefined;
         generated: undefined;
-      }, {}, {
-        length: number | undefined;
-      }>;
-      sessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "session_id";
-        tableName: "agents";
-        dataType: "string";
-        columnType: "SQLiteText";
-        data: string;
-        driverParam: string;
+      }, {}, {}>;
+      startedAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "runtime_instances";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
         notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
+        enumValues: undefined;
         baseColumn: never;
         identity: undefined;
         generated: undefined;
-      }, {}, {
-        length: number | undefined;
-      }>;
-      adapterSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "adapter_session_id";
-        tableName: "agents";
-        dataType: "string";
-        columnType: "SQLiteText";
-        data: string;
-        driverParam: string;
+      }, {}, {}>;
+      retiredAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "runtime_instances";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
         notNull: false;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
+        enumValues: undefined;
         baseColumn: never;
         identity: undefined;
         generated: undefined;
-      }, {}, {
-        length: number | undefined;
-      }>;
-      model: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "model";
-        tableName: "agents";
+      }, {}, {}>;
+    };
+    dialect: "sqlite";
+  }>;
+  adapterSessionClaims: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
+    name: "adapter_session_claims";
+    schema: undefined;
+    columns: {
+      claimId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "claim_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
-        isPrimaryKey: false;
+        isPrimaryKey: true;
         isAutoincrement: false;
         hasRuntimeDefault: false;
         enumValues: [string, ...string[]];
@@ -2652,14 +4254,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      cwd: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "cwd";
-        tableName: "agents";
+      machineId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "machine_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2671,33 +4273,33 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      allowedDirectories: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: string;
-        tableName: "agents";
-        dataType: "json";
-        columnType: "SQLiteTextJson";
-        data: string[];
+      adapterId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_id";
+        tableName: "adapter_session_claims";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: undefined;
+        enumValues: [string, ...string[]];
         baseColumn: never;
         identity: undefined;
         generated: undefined;
       }, {}, {
-        $type: string[];
+        length: number | undefined;
       }>;
-      providerConfigId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "provider_config_id";
-        tableName: "agents";
+      adapterName: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "adapter_name";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2709,14 +4311,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      personaId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "persona_id";
-        tableName: "agents";
+      providerSessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "provider_session_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2728,14 +4330,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      profileId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "profile_id";
-        tableName: "agents";
+      sessionId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "session_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2747,14 +4349,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      harnessId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "harness_id";
-        tableName: "agents";
+      agentId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "agent_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2766,9 +4368,9 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      clientId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "client_id";
-        tableName: "agents";
+      ownerInstanceId: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "owner_instance_id";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
@@ -2785,14 +4387,14 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      compressionMode: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "compression_mode";
-        tableName: "agents";
+      claimToken: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: "claim_token";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
         data: string;
         driverParam: string;
-        notNull: false;
+        notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
@@ -2804,47 +4406,45 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
       }, {}, {
         length: number | undefined;
       }>;
-      role: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
-        name: "role";
-        tableName: "agents";
-        dataType: "string";
-        columnType: "SQLiteText";
-        data: "lead" | "member";
-        driverParam: string;
+      fence: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+        name: string;
+        tableName: "adapter_session_claims";
+        dataType: "number";
+        columnType: "SQLiteInteger";
+        data: number;
+        driverParam: number;
         notNull: true;
         hasDefault: false;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: ["lead", "member"];
+        enumValues: undefined;
         baseColumn: never;
         identity: undefined;
         generated: undefined;
-      }, {}, {
-        length: number | undefined;
-      }>;
+      }, {}, {}>;
       status: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: "status";
-        tableName: "agents";
+        tableName: "adapter_session_claims";
         dataType: "string";
         columnType: "SQLiteText";
-        data: "idle" | "active" | "dead" | "disposed";
+        data: "abandoned" | "held" | "releasing";
         driverParam: string;
         notNull: true;
-        hasDefault: false;
+        hasDefault: true;
         isPrimaryKey: false;
         isAutoincrement: false;
         hasRuntimeDefault: false;
-        enumValues: ["idle", "active", "dead", "disposed"];
+        enumValues: ["held", "releasing", "abandoned"];
         baseColumn: never;
         identity: undefined;
         generated: undefined;
       }, {}, {
         length: number | undefined;
       }>;
-      createdAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+      claimedAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: string;
-        tableName: "agents";
+        tableName: "adapter_session_claims";
         dataType: "number";
         columnType: "SQLiteInteger";
         data: number;
@@ -2859,9 +4459,9 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
         identity: undefined;
         generated: undefined;
       }, {}, {}>;
-      lastActivityAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
+      updatedAt: _$drizzle_orm_sqlite_core0.SQLiteColumn<{
         name: string;
-        tableName: "agents";
+        tableName: "adapter_session_claims";
         dataType: "number";
         columnType: "SQLiteInteger";
         data: number;
@@ -2906,6 +4506,64 @@ declare const sessionStorageSchema: _$_makaio_storage_drizzle0.DialectSchema<{
  */
 declare function registerDrizzleAgentStorage(bus: IMakaioBus, db: MakaioDatabase): () => void;
 //#endregion
+//#region services/core/src/session/storage/ownership-memory-handler.d.ts
+/**
+ * Register in-memory session ownership storage handlers.
+ *
+ * Pass a shared `SessionStorageMemoryState` to make these handlers operate on
+ * the same session and agent rows as `registerMemorySessionStorage` and
+ * `registerMemoryAgentStorage`. Omit it (or pass `undefined`) to get an isolated
+ * private store — useful only for unit tests that exercise ownership without
+ * needing real sessions or agents.
+ * @param bus - The bus instance to register handlers on
+ * @param state - Shared in-memory state; defaults to a new isolated instance
+ * @returns Cleanup function to unsubscribe all handlers
+ */
+declare function registerMemorySessionOwnershipStorage(bus: IMakaioBus, state?: SessionStorageMemoryState): () => void;
+//#endregion
+//#region services/core/src/session/storage/ownership-drizzle-handler.d.ts
+/**
+ * Register Drizzle-based session ownership storage handlers.
+ *
+ * These are the only writers of the agent currency columns, of the claim table
+ * and of the session row's lead designation. Whole-record surfaces such as
+ * `storage:agent.set` deliberately cannot express those columns, so a writer
+ * holding a pre-movement snapshot cannot resurrect an abandoned provider
+ * session.
+ * @param bus - The bus instance to register handlers on.
+ * @param db - The MakaioDatabase instance.
+ * @returns Cleanup function to unsubscribe all handlers.
+ * @example
+ * ```typescript
+ * const cleanup = registerDrizzleSessionOwnershipStorage(bus, db);
+ * // Later, when shutting down:
+ * cleanup();
+ * ```
+ */
+declare function registerDrizzleSessionOwnershipStorage(bus: IMakaioBus, db: MakaioDatabase): () => void;
+//#endregion
+//#region services/core/src/session/storage/ownership-drizzle-claim-keys.d.ts
+/** Versioned namespace for ownership-key lock identities. */
+declare const SESSION_OWNERSHIP_CLAIM_LOCK_NAMESPACE = "makaio:session-ownership:claim:v1";
+/** Claim-key fields that identify one provider-session ownership row. */
+interface OwnershipClaimKey {
+  /** Runtime machine owning the provider session store. */
+  readonly machineId: string;
+  /** Adapter runtime owning the provider session. */
+  readonly adapterId: string;
+  /** Provider-native session identifier. */
+  readonly providerSessionId: string;
+}
+/**
+ * Build the stable transaction lock for one ownership key.
+ *
+ * JSON arrays preserve field boundaries while keeping the identity independent
+ * of the storage row that currently represents this key.
+ * @param key - Provider-session ownership key.
+ * @returns Stable transaction lock used before claim-row mutation.
+ */
+declare function ownershipClaimTransactionLock(key: OwnershipClaimKey): TransactionLock;
+//#endregion
 //#region services/core/src/session/storage/fts-search-handler.d.ts
 /**
  * Registers FTS-backed `storage:session.search` handler.
@@ -3683,20 +5341,12 @@ interface IngestCompletedTurnResult {
  */
 declare function ingestCompletedTurn(bus: IMakaioBus, params: IngestCompletedTurnParams): Promise<IngestCompletedTurnResult>;
 //#endregion
-//#region services/core/src/session/observed-session-ingestion.d.ts
+//#region services/core/src/session/log-import-trigger-subjects.d.ts
 /**
- * Minimal local mirror of the log-import bus subjects this component calls.
+ * The three log-import subjects observed-session ingestion triggers.
  *
- * The log-import service package depends on this package, so importing its
- * subject definitions here would create a package cycle. Bus subjects are
- * matched by fully-qualified name and payloads are validated against the
- * schemas registered by the owning service at boot — these mirrored
- * definitions are type carriers for the fields this component reads and
- * writes, not a second source of truth. Canonical schemas live with the
- * log-import service.
- *
- * Exported for tests that stub the log-import seam; not part of the public
- * session API surface.
+ * Exported for tests that stub the log-import seam and for the owning
+ * service's conformance pin; not part of the public session API surface.
  * @internal
  */
 declare const LogImportTriggerSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubjectDefinitions<"log-import", {
@@ -3746,6 +5396,8 @@ declare const LogImportTriggerSubjects: _$_makaio_core0.BusSubjects<_$_makaio_co
     }, z.core.$strip>;
   };
 }>, "log-import">;
+//#endregion
+//#region services/core/src/session/observed-session-ingestion.d.ts
 /**
  * Check whether a stored session represents a metadata-only observed session.
  *
@@ -3779,10 +5431,15 @@ declare function isTrackingStub(session: Pick<IMakaioSession, 'isImported' | 'im
  * Bridges observed client sessions into the canonical session model.
  *
  * Responsibilities:
- * - Register observed sessions on `client.session.started` through the
- *   unified registration seam (`storage:session.importUpsert`), keyed on the
- *   importer's adapter name so hook-first registration and later transcript
- *   imports converge on the same `(source, adapterSessionId)` identity.
+ * - Register newly started observed sessions on `client.session.started`
+ *   through the unified registration seam (`storage:session.importUpsert`),
+ *   keyed on the importer's adapter name so hook-first registration and later
+ *   transcript imports converge on the same `(source, adapterSessionId)`
+ *   identity.
+ * - Rebind continued sessions (`startMode` `resume` / `compact`) through
+ *   `storage:session.rebindObserved`: a continuation refreshes runtime and
+ *   locality facts only and never registers, so it cannot rewrite the origin,
+ *   lineage, import status, creation time or content an import owns.
  * - Trigger targeted transcript imports on `client.session.turn.completed`
  *   (`log-import.importFile` when the transcript path is known, discovery
  *   fallback via `log-import.importSession` otherwise).
@@ -3901,18 +5558,85 @@ declare class ObservedSessionIngestionService {
    */
   private debugUnresolved;
   /**
-   * Register an observed session through the unified registration seam.
+   * Route an observed session start to registration or rebind.
+   *
+   * A `SessionStart` signal carries two different facts depending on its start
+   * mode, and conflating them is what let a continuation rewrite import data:
+   * - `resume` / `compact` continue an external session that already exists.
+   *   Its origin, lineage, import status, creation time and content belong to
+   *   whoever first imported it; only the runtime observing it may have moved.
+   *   These modes therefore *rebind* (see {@link rebindObservedSession}).
+   * - `fresh`, `clear`, `fork` and an absent start mode announce a session
+   *   this process is seeing begin, so they register through the unified
+   *   registration seam (see {@link registerObservedSession}).
    *
    * Skipped for managed sessions and when no importer is resolvable — a
    * session that can never receive imported content must not create a
-   * dangling stub. The registration `source` is the importer's adapter name,
-   * NOT the raw client id: the `(source, adapterSessionId)` upsert key must
-   * match what the import path writes, otherwise hook-first registration
-   * would fork the session identity and every import would create a
-   * duplicate session.
+   * dangling stub.
    * @param payload - `client.session.started` payload
    */
   private handleSessionStarted;
+  /**
+   * Rebind an already known observed session to the runtime continuing it.
+   *
+   * Refreshes runtime/locality facts only (working directory, transcript path,
+   * owning machine). A continuation carries no evidence about origin, lineage,
+   * import status or creation time, so it must not be able to write them —
+   * that is precisely what routing resume/compact through the import upsert
+   * used to do.
+   *
+   * A `'not-found'` outcome is resolved by the ingestion policy, because the
+   * skip is only correct while a transcript import is still coming:
+   * - `tracking`: skip. Fabricating a row here would stamp import provenance
+   *   and a creation time taken from the resume moment, and the
+   *   timestamp-correction clause of the import upsert only fires while
+   *   `createdAt` still equals `discoveredAt` — so the invented creation time
+   *   would survive the real transcript import forever. Skipping keeps the
+   *   session's first row the one the import path creates from the transcript,
+   *   with the real creation time and content; the turn-completed trigger
+   *   reaches that path on the very next turn without any extra state here.
+   * - `discovered`: register. Metadata-only policy makes the turn-completed
+   *   trigger decline content import for this session forever, so no import
+   *   will ever create the row and skipping would drop the session entirely.
+   *   The registration seam stamps discovered status plus metadata, and its
+   *   creation time taken from the observation is the best available — nothing
+   *   downstream will correct it.
+   * A successful rebind is also **evidence the conversation is still in use**,
+   * which a `closed` row contradicts — so it is reported to the ownership
+   * authority, which decides what the observation implies for the row (and
+   * which row: a compaction's lineage root, never a synthesized child).
+   * Reporting is this side's whole duty, and it never changes the rebind's own
+   * result.
+   * @param payload - `client.session.started` payload
+   * @param adapterSessionId - External session id of the continued session
+   * @param source - Importer adapter name (import identity of the session)
+   * @param startMode - How the provider continued the conversation
+   * @returns True when a stored session was rebound
+   */
+  private rebindObservedSession;
+  /**
+   * Build the ingestion-policy input for an observed session-start payload.
+   * @param payload - `client.session.started` payload
+   * @param adapterSessionId - External session id of the observed session
+   * @param adapterName - Importer adapter name that would own content import
+   * @returns Policy input describing the observation
+   */
+  private policyInput;
+  /**
+   * Register an observed session through the unified registration seam.
+   *
+   * The registration `source` is the importer's adapter name, NOT the raw
+   * client id: the `(source, adapterSessionId)` upsert key must match what the
+   * import path writes, otherwise hook-first registration would fork the
+   * session identity and every import would create a duplicate session.
+   * @param payload - `client.session.started` payload
+   * @param adapterSessionId - External session id of the started session
+   * @param source - Importer adapter name (import identity of the session)
+   * @param decidedImportStatus - Already evaluated ingestion-policy verdict,
+   *   passed by callers that had to consult the policy before routing here
+   * @returns True when the registration reached storage
+   */
+  private registerObservedSession;
   /**
    * Trigger a targeted transcript import for a completed observed turn.
    *
@@ -4826,7 +6550,7 @@ declare const messages: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
       tableName: "messages";
       dataType: "string";
       columnType: "SQLiteText";
-      data: "text" | "voice" | "compact";
+      data: "text" | "compact" | "voice";
       driverParam: string;
       notNull: false;
       hasDefault: false;
@@ -4872,8 +6596,8 @@ declare const MessageRoutingNamespace: _$_makaio_storage_core0.StorageNamespaceD
       agentId: z.ZodString;
       status: z.ZodEnum<{
         completed: "completed";
-        sent: "sent";
         acknowledged: "acknowledged";
+        sent: "sent";
       }>;
       timestamp: z.ZodNumber;
       error: z.ZodOptional<z.ZodString>;
@@ -4898,8 +6622,8 @@ declare const MessageRoutingNamespace: _$_makaio_storage_core0.StorageNamespaceD
         agentId: z.ZodString;
         status: z.ZodEnum<{
           completed: "completed";
-          sent: "sent";
           acknowledged: "acknowledged";
+          sent: "sent";
         }>;
         timestamp: z.ZodNumber;
         error: z.ZodOptional<z.ZodString>;
@@ -4986,7 +6710,7 @@ declare const MessageRoutingNamespace: _$_makaio_storage_core0.StorageNamespaceD
           tableName: "message_routing";
           dataType: "string";
           columnType: "SQLiteText";
-          data: "completed" | "sent" | "acknowledged";
+          data: "completed" | "acknowledged" | "sent";
           driverParam: string;
           notNull: true;
           hasDefault: false;
@@ -5057,8 +6781,8 @@ declare const MessageRoutingSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core
       agentId: z.ZodString;
       status: z.ZodEnum<{
         completed: "completed";
-        sent: "sent";
         acknowledged: "acknowledged";
+        sent: "sent";
       }>;
       timestamp: z.ZodNumber;
       error: z.ZodOptional<z.ZodString>;
@@ -5083,8 +6807,8 @@ declare const MessageRoutingSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core
         agentId: z.ZodString;
         status: z.ZodEnum<{
           completed: "completed";
-          sent: "sent";
           acknowledged: "acknowledged";
+          sent: "sent";
         }>;
         timestamp: z.ZodNumber;
         error: z.ZodOptional<z.ZodString>;
@@ -5228,7 +6952,7 @@ declare const messageRouting: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<
       tableName: "message_routing";
       dataType: "string";
       columnType: "SQLiteText";
-      data: "completed" | "sent" | "acknowledged";
+      data: "completed" | "acknowledged" | "sent";
       driverParam: string;
       notNull: true;
       hasDefault: false;
@@ -5553,6 +7277,54 @@ declare function buildSessionContext(bus: IMakaioBus, options: BuildContextOptio
  */
 declare function getFullConversation(bus: IMakaioBus, sessionId: string): Promise<ContextAssemblyResult>;
 //#endregion
+//#region services/core/src/session/session-resume-identity.d.ts
+/**
+ * The provider session a resume operation may legitimately target right now.
+ *
+ * Produced by {@link resolveSessionResumeIdentity} so that every role in a
+ * resume path — locality evaluation, live-writer detection, and the resume
+ * target handed to the adapter — reads the same value. Reading
+ * `session.adapterSessionId` directly in those roles is what let them diverge:
+ * that column is immutable origin provenance, not resume currency.
+ */
+interface SessionResumeIdentity {
+  /**
+   * Provider session ID that is valid resume currency, or `undefined` when the
+   * session has none.
+   */
+  readonly adapterSessionId: string | undefined;
+  /**
+   * Whether the provider session moved without provider confirmation.
+   *
+   * When `true`, native resume is impossible regardless of every other
+   * structural signal — there is no provider session that still holds the
+   * conversation. Callers degrade to fresh-with-history.
+   */
+  readonly movedUnconfirmed: boolean;
+}
+/**
+ * Resolve the tri-state resume currency of a session row.
+ *
+ * | `currentAdapterSessionIdState` | resume currency                         |
+ * |-------------------------------|-----------------------------------------|
+ * | `'inherited'` (or absent)     | `session.adapterSessionId` (origin)     |
+ * | `'confirmed'`                 | `session.currentAdapterSessionId`       |
+ * | `'moved'`                     | none — degrade to fresh-with-history    |
+ *
+ * **Compress children are never a resume source.** Provider-side compaction is
+ * in place — same provider session ID, same transcript — so the row that
+ * carries the provider identity is the lineage root, and the compress children
+ * the transcript importer synthesizes carry no currency at all. Passing one here
+ * therefore resolves to "nothing resumable", which is the correct answer for
+ * that row: the conversation lives on its root. A caller holding a compress
+ * child resolves the root first; this function deliberately does not, because it
+ * takes a row and not a bus, and a lineage walk hidden behind a pure projection
+ * would be a storage read no caller asked for.
+ * @param session - Session record loaded from storage
+ * @returns Resolved resume identity for this session
+ */
+declare function resolveSessionResumeIdentity(session: IMakaioSession): SessionResumeIdentity;
+//#endregion
 //#region services/core/src/session/native-locality.d.ts
 /**
  * Describes whether the session resume/fork intent is a native continuation
@@ -5608,6 +7380,19 @@ interface NativeLocalityInput {
    * Required when `session.forkPointMessageId` is set and `intent === 'fork'`.
    */
   readonly midHistoryForkSupported?: boolean;
+  /**
+   * Resume currency the caller resolved for this session.
+   *
+   * `session.adapterSessionId` is immutable origin provenance, so callers that
+   * track currency must resolve it with {@link resolveSessionResumeIdentity} and
+   * pass the result here. When present it is authoritative — including when it
+   * resolves to no usable provider session, which must never silently fall back
+   * to the origin column.
+   *
+   * Omit it to read the origin column directly. That is correct only for callers
+   * whose sessions cannot have moved their provider identity.
+   */
+  readonly resumeIdentity?: SessionResumeIdentity;
 }
 /**
  * Evaluates whether a session can use native resume or fork, or must fall back
@@ -5627,4 +7412,4 @@ interface NativeLocalityInput {
  */
 declare function evaluateNativeLocality(input: NativeLocalityInput): NativeLocalityVerdict;
 //#endregion
-export { ingestCompletedTurn as $, RecoveryConfig as $t, SelectTurn as A, registerMemorySessionStorage as At, OBSERVED_SESSION_INGESTION_POLICY_CAPABILITY_ID as B, normalizeSelectionString as Bt, MessageRoutingSubjects as C, fetchPreviewBySession as Ct, registerMemoryMessageStorage as D, registerDrizzleAgentStorage as Dt, messages as E, registerFtsSearchHandler as Et, EmbeddingIndexManager as F, SessionBridge as Ft, unregisterObservedSessionIngestionPolicyProvider as G, actionRegistry as Gt, ObservedSessionIngestionPolicyImportStatus as H, registerListActionsHandler as Ht, registerDrizzleImportCursorStorage as I, assembleForkContext as It, isPolicyDiscoveredObservedSession as J, ContextWindowTracker as Jt, LogImportTriggerSubjects as K, registerGetStatusCountsHandler as Kt, importCursors as L, FallbackRuntimeOptions as Lt, turnsDual as M, AgentStorageSubjects as Mt, registerMemoryTurnStorage as N, SessionExtensionContextImpl as Nt, registerDrizzleMessageStorage as O, registerMemoryAgentStorage as Ot, registerDrizzleTurnStorage as P, createSessionExtensionContext as Pt, IngestTurnMessage as Q, buildTurnInitiator as Qt, importCursorsDual as R, pickFallbackRuntimeOptions as Rt, MessageRoutingNamespace as S, fetchMessageCountsBySession as St, SelectMessage as T, parseForkTransforms as Tt, ObservedSessionIngestionPolicyInput as U, registerBuiltInActions as Ut, ObservedSessionIngestionPolicyDecision as V, resolveAdapterNameById as Vt, registerObservedSessionIngestionPolicyProvider as W, resetBuiltInActionsRegistration as Wt, IngestCompletedTurnParams as X, ContextWindowTrackerConfig as Xt, isTrackingStub as Y, AgentContextState as Yt, IngestCompletedTurnResult as Z, SessionContextWindowState as Zt, InsertMessageRouting as _, SessionOrchestrator as _n, mapAgentsBySession as _t, buildSessionContext as a, buildRecoveryContext as an, emitSessionTurnStarted as at, messageRoutingDual as b, SearchSessionRow as bt, kindToBranchKind as c, resolveModelCapabilities as cn, registerDrizzleSessionEventStorage as ct, registerSpawningToolCallResolver as d, resolveTargetAgents as dn, SelectSessionEvent as dt, buildRecoveryContextWithPipeline as en, EventTransform as et, registerCompressLineageResolver as f, extractTextContent as fn, sessionEvents as ft, StartTurnOptions as g, ISessionOrchestrator as gn, fetchSessionPreviewMaps as gt, MakaioSessionConfig as h, AdapterRegistry as hn, SessionPreviewMaps as ht, getFullConversation as i, verifyAndRecoverAgents as in, appendSessionLifecycleEvent as it, turns as j, AgentStorageNamespace as jt, InsertTurn as k, registerDrizzleSessionStorage as kt, toSessionLineage as l, findTurnByAgent as ln, registerMemorySessionEventStorage as lt, MakaioSession as m, TurnContextEnricher as mn, getSessionAncestorChain as mt, NativeLocalityIntent as n, ensureAgentModel as nn, SessionTurnStartedPayload as nt, BuildContextOptions as o, resolveAdapterId as on, emitSessionUserMessageSent as ot, registerParentResolver as p, normalizeToBlocks as pn, sessionEventsDual as pt, ObservedSessionIngestionService as q, registerResumeHandler as qt, evaluateNativeLocality as r, recoverAgent as rn, SessionUserMessageSentPayload as rt, ContextAssemblyResult as s, resolveExecutionTarget as sn, registerSessionLifecycleEventWriters as st, NativeLocalityInput as t, ensureAgentCwd as tn, SessionLifecycleEventArgs as tt, registerSessionDiscoveredHandler as u, getOrCreateSession as un, InsertSessionEvent as ut, SelectMessageRouting as v, registerCoreSessionServiceHandlers as vn, mapToSession as vt, InsertMessage as w, mapRowToSession as wt, registerDrizzleMessageRoutingStorage as x, fetchAgentsBySession as xt, messageRouting as y, MakaioSessionService as yn, SearchFilters as yt, IObservedSessionIngestionPolicyProvider as z, CONNECTOR_SWAP_DEFAULT_PIPELINE as zt };
+export { IngestCompletedTurnResult as $, runExclusiveStart as $n, resolveAdapterNameById as $t, registerDrizzleMessageStorage as A, FreshWithHistoryRecoveryPlan as An, SESSION_OWNERSHIP_CLAIM_LOCK_NAMESPACE as At, importCursorsDual as B, resolveTargetAgents as Bn, AgentStorageNamespace as Bt, registerDrizzleMessageRoutingStorage as C, ensureAgentCwd as Cn, fetchAgentsBySession as Ct, SelectMessage as D, buildPlannedRecoveryContext as Dn, parseForkTransforms as Dt, InsertMessage as E, verifyAndRecoverAgents as En, mapRowToSession as Et, registerMemoryTurnStorage as F, recoveryPlanResumeTarget as Fn, registerMemoryAgentStorage as Ft, ObservedSessionIngestionPolicyInput as G, ISessionOrchestrator as Gn, assembleForkContext as Gt, OBSERVED_SESSION_INGESTION_POLICY_CAPABILITY_ID as H, normalizeToBlocks as Hn, SessionExtensionContextImpl as Ht, registerDrizzleTurnStorage as I, StartReservationRequest as In, registerDrizzleSessionStorage as It, ObservedSessionIngestionService as J, assessClaimOwner as Jn, CONNECTOR_SWAP_DEFAULT_PIPELINE as Jt, registerObservedSessionIngestionPolicyProvider as K, SessionOrchestrator as Kn, FallbackRuntimeOptions as Kt, EmbeddingIndexManager as L, reserveStartFor as Ln, registerMemorySessionStorage as Lt, SelectTurn as M, RecoveryPlan as Mn, registerDrizzleSessionOwnershipStorage as Mt, turns as N, planAgentRecovery as Nn, registerMemorySessionOwnershipStorage as Nt, messages as O, buildRecoveryContext as On, registerFtsSearchHandler as Ot, turnsDual as P, recoveryPlanRequiresHistory as Pn, registerDrizzleAgentStorage as Pt, IngestCompletedTurnParams as Q, peekInFlightStart as Qn, normalizeSelectionString as Qt, registerDrizzleImportCursorStorage as R, findTurnByAgent as Rn, SessionStorageMemoryState as Rt, messageRoutingDual as S, buildRecoveryContextWithPipeline as Sn, SearchSessionRow as St, MessageRoutingSubjects as T, recoverAgent as Tn, fetchPreviewBySession as Tt, ObservedSessionIngestionPolicyDecision as U, TurnContextEnricher as Un, createSessionExtensionContext as Ut, IObservedSessionIngestionPolicyProvider as V, extractTextContent as Vn, AgentStorageSubjects as Vt, ObservedSessionIngestionPolicyImportStatus as W, AdapterRegistry as Wn, SessionBridge as Wt, isTrackingStub as X, enqueueAgentSettle as Xn, SelectionRefusalContext as Xt, isPolicyDiscoveredObservedSession as Y, mintClaimToken as Yn, NamedSelectionInstance as Yt, LogImportTriggerSubjects as Z, InFlightStart as Zn, describeHalfNamedInstanceRefusal as Zt, MakaioSessionConfig as _, LeadTransition as _n, SessionPreviewMaps as _t, resolveSessionResumeIdentity as a, registerResumeHandler as an, SessionUserMessageSentPayload as at, SelectMessageRouting as b, RecoveryConfig as bn, mapToSession as bt, BuildContextOptions as c, ContextWindowTrackerConfig as cn, emitSessionUserMessageSent as ct, toSessionLineage as d, resolveSelectionOwnedInstance as dn, registerMemorySessionEventStorage as dt, registerListActionsHandler as en, registerAdapterSessionMovementObserver as er, IngestTurnMessage as et, registerSessionDiscoveredHandler as f, startLeadAgent as fn, InsertSessionEvent as ft, MakaioSession as g, LeadStartResult as gn, getSessionAncestorChain as gt, registerParentResolver as h, LeadStartRequest as hn, sessionEventsDual as ht, SessionResumeIdentity as i, registerGetStatusCountsHandler as in, MakaioSessionServiceOptions as ir, SessionTurnStartedPayload as it, InsertTurn as j, NativeResumeRecoveryPlan as jn, ownershipClaimTransactionLock as jt, registerMemoryMessageStorage as k, FRESH_WITH_HISTORY_RECOVERY_PLAN as kn, OwnershipClaimKey as kt, ContextAssemblyResult as l, SessionContextWindowState as ln, registerSessionLifecycleEventWriters as lt, registerCompressLineageResolver as m, LeadStartDispatchRequest as mn, sessionEvents as mt, NativeLocalityIntent as n, resetBuiltInActionsRegistration as nn, registerSessionOwnershipAuthority as nr, EventTransform as nt, getFullConversation as o, ContextWindowTracker as on, appendSessionLifecycleEvent as ot, registerSpawningToolCallResolver as p, LeadStartDispatch as pn, SelectSessionEvent as pt, unregisterObservedSessionIngestionPolicyProvider as q, registerCoreSessionServiceHandlers as qn, pickFallbackRuntimeOptions as qt, evaluateNativeLocality as r, actionRegistry as rn, MakaioSessionService as rr, SessionLifecycleEventArgs as rt, buildSessionContext as s, AgentContextState as sn, emitSessionTurnStarted as st, NativeLocalityInput as t, registerBuiltInActions as tn, SessionOwnershipAuthorityDeps as tr, ingestCompletedTurn as tt, kindToBranchKind as u, SelectionInstanceContext as un, registerDrizzleSessionEventStorage as ut, StartTurnOptions as v, buildTurnInitiator as vn, fetchSessionPreviewMaps as vt, MessageRoutingNamespace as w, ensureAgentModel as wn, fetchMessageCountsBySession as wt, messageRouting as x, VerifiedAgents as xn, SearchFilters as xt, InsertMessageRouting as y, AgentRecoveryOutcome as yn, mapAgentsBySession as yt, importCursors as z, getOrCreateSession as zn, createSessionStorageMemoryState as zt };