@platless/axom-cli 0.1.0 → 0.3.13

package/dist/workstation/agentSessions.js

@@ -1,9 +1,18 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { AGENT_WIRE_AUTH_URL_VERSION, AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION, AGENT_WIRE_ORPHAN_OFFER_VERSION, AGENT_WIRE_SESSION_AUTH_METHODS_VERSION, AGENT_WIRE_SESSION_LOST_VERSION, AGENT_WIRE_VERSION, outboundAgentFrameRejection, outboundFailureReply, } from './protocol/agent.js';
+import { createHash, randomUUID } from 'node:crypto';
+import { AGENT_WIRE_AUTH_URL_VERSION, AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION, AGENT_WIRE_SCOPED_ORIGIN_VERSION, AGENT_WIRE_ORPHAN_OFFER_VERSION, AGENT_WIRE_SESSION_AUTH_METHODS_VERSION, AGENT_WIRE_SESSION_LOST_VERSION, AGENT_WIRE_SESSION_STATE_VERSION, AGENT_WIRE_VERSION, AGENT_WIRE_DELEGATION_MCP_VERSION, AGENT_WIRE_DELEGATION_RENEW_VERSION, AGENT_WIRE_PROVIDER_TASK_VERSION, AGENT_WIRE_RUNTIME_PROFILE_VERSION, outboundAgentFrameRejection, outboundFailureReply, } from './protocol/agent.js';
 import { DEFAULT_JOURNAL_MAX_BYTES, SessionJournal } from './journal.js';
 import { AGENT_PROBE_TIMEOUT_MS, AgentRefusedSessionError } from './acp/acpAgents.js';
 import { validateWireEvent } from './acp/validate.js';
+import { reportsActivity, supportsAsyncTaskStop } from './acp/activityReporting.js';
+import { activityIsBusy } from './acp/activityBusy.js';
+import { buildSessionMcpServers } from './acp/delegationMcp.js';
+function delegationLeaseId(lease) {
+    return createHash('sha256').update(JSON.stringify([
+        lease.url, lease.headers, lease.bindingId,
+    ])).digest('hex');
+}
 /**
  * 从线上收来的验证预算的绝对上限。
  *
@@ -71,6 +80,20 @@ function promptBlocks(frame) {
         : [];
     return [...text, ...images];
 }
+/**
+ * Narrows `agent_elicitation_answer.action` to the three literals this daemon itself ever sends.
+ *
+ * `AGENT_FRAME_SHAPES` only validates `action` as *a* string — ACP's own `CreateElicitationResponse`
+ * has a fourth, open `action: string` arm for an agent's own custom/future actions, so the wire
+ * layer cannot reject an arbitrary string as malformed. But this daemon is the only sender of this
+ * frame, and the server only ever offers the user accept/decline/cancel, so anything else reaching
+ * `handleFrame` is a platform bug, not a legitimate custom action — and a bare `as
+ * CreateElicitationResponse['action']` cast at the call site would launder it through unchecked,
+ * reaching the agent as a value ACP itself still accepts as protocol-valid.
+ */
+function isKnownElicitationAction(action) {
+    return action === 'accept' || action === 'decline' || action === 'cancel';
+}
 /**
  * The server's applied-through watermark on an open frame, sanitized. Absent means "nothing yet".
  *
@@ -94,6 +117,15 @@ function errorMessage(err) {
  * arrive as one giant frame; the last batch of a stream is whatever remains below this size.
  */
 export const BACKFILL_BATCH_SIZE = 64;
+/**
+ * 一条会话自报 `running` 之后多久没有任何新推送，就值得在日志里点名。
+ *
+ * **这不是超时，不会清任何状态**——裁决 A 说 vendor 报 running 就是 running，发明一个
+ * 到点就翻成 idle 的定时器正是它禁止的猜测。这条只是把「我们完全信任了一个已经沉默 30 分钟
+ * 的信源」这件事摆到排查者面前。取 30 分钟是因为比任何正常回合都长，又短到一次排查会话里
+ * 看得见。
+ */
+export const STALE_ACTIVITY_WARN_MS = 30 * 60 * 1000;
 /**
  * Defensively turns the wire query of `agent_list_native` / `agent_verify` / `agent_authenticate`
  * — one shape, because all three ask the same thing of an agent that has no session yet: where to
@@ -265,7 +297,10 @@ export class AgentSessionManager {
      * honest failure it produces today.
      */
     async resumeOfferSessions() {
-        const live = this.liveInventory();
+        // `true`: this is the once-per-connection offer, the one place `activityRaw` is allowed to
+        // ride — see {@link liveInventory}'s parameter doc for why {@link heartbeatInventory} must pass
+        // `false` at its own call site instead.
+        const live = this.liveInventory(true);
         if (this.serverAgentWire < AGENT_WIRE_ORPHAN_OFFER_VERSION)
             return live;
         // Every ref this daemon still has a handle on, not merely the ones it would report as live:
@@ -327,8 +362,17 @@ export class AgentSessionManager {
      * here, and lands in exactly the same server-side branch as a journal left by a previous daemon
      * life -- which is the point: "the agent is gone" is one fact with one handling, not a special
      * case per way of getting there.
+     *
+     * @param includeActivity Whether to carry each session's {@link LiveSession.lastActivityRaw}
+     * along as `activityRaw`. **Must be `false` from {@link heartbeatInventory} and `true` from
+     * {@link resumeOfferSessions}, never the other way round** — `activityRaw` is an unbounded vendor
+     * blob, and `AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION`'s own doc comment already ruled that kind of
+     * cost off the heartbeat ("ten seconds of overhead forever is worth skipping"). Threading this as
+     * a required parameter at the one shared call site — rather than, say, a field this method reads
+     * off `this` — is what makes "never on a heartbeat" a fact about the call site instead of a fact
+     * someone has to remember to keep true.
      */
-    liveInventory() {
+    liveInventory(includeActivity) {
         return [...this.sessions.values()]
             .filter((session) => !session.closed)
             .map((session) => {
@@ -338,6 +382,9 @@ export class AgentSessionManager {
                 journalMaxSeq: session.journal.lastSeq,
                 agentAlive: liveness.agentAlive,
                 turnRunning: liveness.turnRunning,
+                ...(includeActivity && session.lastActivityRaw !== undefined
+                    ? { activityRaw: session.lastActivityRaw }
+                    : {}),
             };
         });
     }
@@ -363,7 +410,8 @@ export class AgentSessionManager {
     heartbeatInventory() {
         if (this.serverAgentWire < AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION)
             return undefined;
-        const sessions = this.liveInventory();
+        // `false`: activityRaw must stay absent on every heartbeat — see `liveInventory`'s own doc.
+        const sessions = this.liveInventory(false);
         return sessions.length > 0 ? sessions : undefined;
     }
     /**
@@ -463,6 +511,30 @@ export class AgentSessionManager {
     }
     async handleFrame(frame) {
         switch (frame.t) {
+            case 'agent_delegation_renew': {
+                if (this.serverAgentWire < AGENT_WIRE_DELEGATION_RENEW_VERSION)
+                    return;
+                const live = this.liveSession(frame.sessionRef);
+                const now = Date.now();
+                if (!live || live.closed || !live.session.liveness.agentAlive || live.session.liveness.turnRunning ||
+                    activityIsBusy(live.lastActivityRaw) || live.delegationRefreshPending ||
+                    live.nativeSessionId !== frame.nativeSessionId || live.delegationInstanceId !== frame.instanceId ||
+                    live.delegationBindingId !== frame.bindingId || !frame.bindingId ||
+                    !Number.isSafeInteger(frame.renewalRevision) || frame.renewalRevision < 1 ||
+                    !Number.isSafeInteger(frame.expiresAtEpochMs) || frame.expiresAtEpochMs <= now ||
+                    frame.expiresAtEpochMs > now + 330_000 || frame.renewalRevision < (live.delegationRenewalRevision ?? 0) ||
+                    frame.expiresAtEpochMs < (live.delegationExpiresAtEpochMs ?? 0) ||
+                    (frame.renewalRevision === live.delegationRenewalRevision && frame.expiresAtEpochMs !== live.delegationExpiresAtEpochMs)) {
+                    this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: false, error: 'The original managed instance cannot renew' });
+                    return;
+                }
+                live.delegationExpiresAtEpochMs = frame.expiresAtEpochMs;
+                live.delegationRenewalRevision = frame.renewalRevision;
+                this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: true,
+                    nativeSessionId: live.nativeSessionId, instanceId: live.delegationInstanceId, bindingId: live.delegationBindingId,
+                    renewalRevision: live.delegationRenewalRevision, expiresAtEpochMs: live.delegationExpiresAtEpochMs });
+                return;
+            }
             case 'agent_open': {
                 const admission = this.reserveOpen(frame.id, frame.sessionRef);
                 if (admission === 'rejected')
@@ -480,7 +552,7 @@ export class AgentSessionManager {
                 const live = this.routableSession(frame.sessionRef, 'prompt');
                 if (!live)
                     return;
-                if (this.tasks && !this.tasks.agentTurnStarted(frame.sessionRef)) {
+                if (this.tasks && !this.tasks.tryAdmitTurn(frame.sessionRef)) {
                     // No `authMethods` here, deliberately, even though this is a failed turn on a session
                     // whose agent we have certainly connected to: the prompt never reached that agent, so
                     // nothing about credentials is being reported. This frame is built here rather than in
@@ -489,10 +561,19 @@ export class AgentSessionManager {
                     this.record(live, (seq) => ({
                         t: 'agent_turn_done', sessionRef: frame.sessionRef, seq, status: 'failed',
                         error: 'Workstation is not accepting new work',
+                        platformTurnId: frame.platformTurnId,
                     }));
                     return;
                 }
-                live.session.prompt(promptBlocks(frame));
+                try {
+                    live.session.prompt(promptBlocks(frame), frame.platformTurnId);
+                }
+                catch (error) {
+                    this.record(live, (seq) => ({
+                        t: 'agent_turn_done', sessionRef: frame.sessionRef, seq, status: 'failed',
+                        error: error instanceof Error ? error.message : String(error), platformTurnId: frame.platformTurnId,
+                    }));
+                }
                 return;
             }
             case 'agent_answer': {
@@ -500,6 +581,28 @@ export class AgentSessionManager {
                 live?.session.answer(frame.requestId, frame.outcome);
                 return;
             }
+            case 'agent_elicitation_answer': {
+                const live = this.routableSession(frame.sessionRef, 'elicitationAnswer');
+                if (!live)
+                    return;
+                if (!isKnownElicitationAction(frame.action)) {
+                    // `AGENT_FRAME_SHAPES` only validates `action` as *a* string (ACP's own action union has
+                    // an open `string` arm for agent-authored custom actions), but this daemon is the only
+                    // sender of this frame and the server only ever offers the user accept/decline/cancel —
+                    // so anything else reaching here is a platform bug (a typo, a stale enum), not a
+                    // legitimate custom action. Declining rather than forwarding it verbatim keeps the agent
+                    // from being handed a value ACP itself would still accept as "protocol-valid" — the exact
+                    // shape `isString`-only validation cannot catch on its own.
+                    console.warn(`[agent] agent_elicitation_answer for '${frame.sessionRef}' carried an unrecognised action '${frame.action}'; declining instead of forwarding it`);
+                    live.session.answerElicitation(frame.requestId, { action: 'decline' });
+                    return;
+                }
+                live.session.answerElicitation(frame.requestId, {
+                    action: frame.action,
+                    ...(frame.content ? { content: frame.content } : {}),
+                });
+                return;
+            }
             case 'agent_interrupt': {
                 const live = this.routableSession(frame.sessionRef, 'interrupt');
                 if (!live)
@@ -513,16 +616,101 @@ export class AgentSessionManager {
                 return;
             }
             /**
-             * A steer rides a turn that is **already** running, so it is deliberately not bracketed by
-             * `tasks.agentTurnStarted` / `agentTurnFinished` the way `agent_prompt` is: the agent still
-             * answers exactly one `session/prompt` and still sends exactly one `agent_turn_done`, so
-             * there is no second completion to close a second bracket with.
+             * Stop **one** background task, leaving the running turn alone — ACP's
+             * `_session/async_task/stop`. The server sends this instead of marking its JOB row cancelled
+             * behind the agent's back, which is what it used to do: the row went terminal, the task kept
+             * running, and the UI said "stopped" while the truth was "still running".
+             *
+             * Doesn't touch `busy()`'s inputs, for the reason `agent_steer` documents at length: this is
+             * not a turn, so it must not push {@link AcpSession.inFlightTurns} — `busy()` is sampled live
+             * off that array and the agent's reported activity (2026-09-21 rewrite, no accumulator to
+             * leak any more), and `stopAsyncTask()` deliberately does none of that bookkeeping, same as
+             * `steer()` (see `AcpSession.stopAsyncTask`'s own doc).
+             *
+             * **No reply frame, so a failure can only be logged** — and that is by design for the ordinary
+             * case, not an omission (see `agent_async_task_stop`'s own doc in `protocol/agent.ts`): the
+             * question the server is waiting on is not "did the request arrive" but "did the task actually
+             * stop", and only the agent's own next `async_task_state_update` for this
+             * `(sessionRef, asyncTaskId)` answers it. That update travels the ordinary event stream and
+             * settles the JOB there.
+             *
+             * ## Known gap: a refusal here is invisible to the server
+             *
+             * A `Method not found` from an agent that advertised a name we have a collector for but does
+             * not implement `_session/async_task/stop` lands in this catch and goes no further. The server
+             * recorded a "Stop requested" note on that JOB and will now wait for a terminal update that is
+             * never coming; nothing on that side says why.
+             *
+             * **Narrow today, and deliberately not papered over.** The server only sends this frame to a
+             * session whose `agent_opened` explicitly reported `supportsAsyncTaskStop`, from the
+             * certified `InitializeResponse.agentInfo.name` compatibility map — and both adapters
+             * implement the method (verified: `acp-agent.js@0.79.0:165`,
+             * `codex-acp@1.12.0 dist/index.js:31608`). So the gap opens only if one of them drops the
+             * method in a future version, or a third-party agent adopts one of those names.
+             *
+             * **Why it is not closed here**: the only honest thing to report is "the stop request was
+             * refused; the task is still running", and this daemon has no channel that can carry it. The
+             * frame has no reply; synthesizing an `async_task_state_update` would invent a terminal state
+             * the agent never reported, which is the exact lie this whole path was built to remove; and a
+             * new event name or a reply frame is a wire-contract change that belongs in a reviewed task,
+             * not in a fix applied to one. Tracked as a Task 8 acceptance item. Until then this log line
+             * is the only evidence, so it names the consequence rather than just the error.
+             */
+            case 'agent_async_task_stop': {
+                const live = this.routableSession(frame.sessionRef, 'async_task_stop');
+                if (!live)
+                    return;
+                try {
+                    if (!live.nativeSessionId || !supportsAsyncTaskStop(live.session.agentInfo?.name) || !frame.asyncTaskId.trim()) {
+                        throw new Error('No certified task-stop route and exact target for this session');
+                    }
+                    await live.session.stopAsyncTask(frame.asyncTaskId);
+                }
+                catch (err) {
+                    console.error(`[agent] stopping background task ${frame.asyncTaskId} failed for ${frame.sessionRef}: ` +
+                        `${errorMessage(err)} -- the task is still running and the server will keep waiting ` +
+                        'for a terminal update it will never receive');
+                }
+                return;
+            }
+            case 'agent_provider_task_stop': {
+                if (this.serverAgentWire < AGENT_WIRE_PROVIDER_TASK_VERSION) {
+                    this.emit({ t: 'agent_provider_task_stopped', id: frame.id, state: 'rejected', error: 'Provider task control requires a newer server' });
+                    return;
+                }
+                const live = this.routableSession(frame.sessionRef, 'provider_task_stop');
+                if (!live || !live.session.providerTaskAdapterSelected || !live.session.providerTaskStop ||
+                    live.nativeSessionId !== frame.rootSessionId ||
+                    live.session.runtimeDiagnostics?.profile?.runtimeGeneration !== frame.runtimeGeneration) {
+                    this.emit({ t: 'agent_provider_task_stopped', id: frame.id, state: 'rejected', error: 'Provider task identity is not live and trusted' });
+                    return;
+                }
+                try {
+                    const state = await live.session.providerTaskStop(frame.taskId, frame.requestId);
+                    this.emit({ t: 'agent_provider_task_stopped', id: frame.id, state });
+                }
+                catch (err) {
+                    this.emit({ t: 'agent_provider_task_stopped', id: frame.id, state: 'unknown', error: errorMessage(err) });
+                }
+                return;
+            }
+            /**
+             * A steer rides a turn that is **already** running, so it must not push
+             * {@link AcpSession.inFlightTurns} the way `agent_prompt` does: `steer()` sends exactly one
+             * extension request and gets exactly one reply, not a second `agent_turn_done`, so there is
+             * no second completion to pop a second entry with.
              *
-             * The leak that would open is not hypothetical. The server steers whenever **it** believes a
-             * turn is running, and the agent is free to disagree and answer `promptRequired` — a steer on
-             * an idle session. Nothing will ever send a `turn_done` for that one, so the sessionRef would
-             * sit in `TaskRegistry`'s agent-task set forever and `canUpdate()` would be false for the rest
-             * of this daemon's life. Same shape as the hung-prompt leak `readLoopDead` exists for.
+             * That distinction used to matter for a leak that was not hypothetical, and still explains why
+             * `steer()` pushes nothing today. The server steers whenever **it** believes a turn is
+             * running, and the agent is free to disagree and answer `promptRequired` — a steer on an idle
+             * session. Under the old bracketed `TaskRegistry.agentTasks` (removed 2026-09-21), nothing
+             * would ever send a `turn_done` to close that bracket, so the sessionRef sat there forever and
+             * `canUpdate()` stayed `false` for the rest of the daemon's life — the same shape as the
+             * hung-prompt leak `readLoopDead` exists for. `busy()` is sampled live today, off
+             * {@link AcpSession.turnRunning} and the agent's own reported activity, with no set to leave a
+             * ref in — but that safety is a property of `busy()`'s inputs, not of this call site, so
+             * `steer()` still deliberately pushes nothing to {@link AcpSession.inFlightTurns} (see its own
+             * doc): an idle-session steer must not be mistaken for the start of a turn.
              *
              * Every exit answers. The server is holding the steered message in its own queue table
              * (`session_message_queue`) while this request is in flight — the message is not on the
@@ -559,10 +747,12 @@ export class AgentSessionManager {
             /**
              * Set one session config option, round-tripping ACP `session/set_config_option`. Same shape
              * as `agent_steer` immediately above, and for the same reason: this is a real round trip the
-             * server is blocked waiting on, not a turn, so it is not bracketed by
-             * `tasks.agentTurnStarted` / `agentTurnFinished` — there is no second completion to close a
-             * second bracket with, and a bracket opened here would never close, leaking the ref for the
-             * life of the daemon.
+             * server is blocked waiting on, not a turn, so it must not push
+             * {@link AcpSession.inFlightTurns} — there is no second `agent_turn_done` to pop it with, and
+             * `busy()` is sampled live off that array plus the agent's own reported activity (2026-09-21
+             * rewrite: no accumulator here any more), so a push with nothing to pop it would pin a session
+             * "busy" for the life of the daemon exactly the way the old bracketed `TaskRegistry.agentTasks`
+             * used to leak.
              *
              * Every exit answers: a session that is not routable, an agent that throws (its own refusal,
              * or `Method not found` from one that never advertised the method), all send
@@ -575,11 +765,16 @@ export class AgentSessionManager {
                     this.emit({ t: 'agent_config_option_set', id: frame.id, ok: false, error: `no live session '${frame.sessionRef}'` });
                     return;
                 }
+                const startedAt = performance.now();
+                const operation = `request=${frame.id} session=${frame.sessionRef} config=${frame.configId}`;
+                console.info(`${new Date().toISOString()} [agent/config] applying ${operation}`);
                 try {
                     const configOptions = await live.session.setConfigOption(frame.configId, frame.value);
+                    console.info(`${new Date().toISOString()} [agent/config] confirmed ${operation} elapsedMs=${Math.round(performance.now() - startedAt)}`);
                     this.emit({ t: 'agent_config_option_set', id: frame.id, ok: true, configOptions });
                 }
                 catch (err) {
+                    console.warn(`${new Date().toISOString()} [agent/config] failed ${operation} elapsedMs=${Math.round(performance.now() - startedAt)}: ${errorMessage(err)}`);
                     // Includes the agent's own refusal ("Invalid value…", "Unknown config option…") and a
                     // `Method not found` from an agent without the method — both are the server's to show.
                     this.emit({ t: 'agent_config_option_set', id: frame.id, ok: false, error: errorMessage(err) });
@@ -596,7 +791,13 @@ export class AgentSessionManager {
                 if (!live)
                     return;
                 this.touch(live);
-                await this.enqueue(live, () => live.journal.truncateThrough(frame.throughSeq));
+                await this.enqueue(live, async () => {
+                    if (live.scopedReplayBlocked || this.blockIncompatibleJournal(live))
+                        return;
+                    await live.journal.truncateThrough(frame.throughSeq);
+                    if (frame.throughSeq >= live.highestScopedJournalSeq)
+                        live.highestScopedJournalSeq = 0;
+                });
                 return;
             }
             case 'agent_list_native':
@@ -606,6 +807,13 @@ export class AgentSessionManager {
                 }
                 await this.onListNative(frame);
                 return;
+            case 'agent_delete_native':
+                if (this.tasks && !this.tasks.accepting) {
+                    this.emit({ t: 'agent_native_deleted', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
+                    return;
+                }
+                await this.onDeleteNative(frame);
+                return;
             // Both of these spawn an agent subprocess, exactly as `agent_list_native` does, so they answer
             // a draining workstation the same way rather than starting work it is trying to finish.
             case 'agent_verify':
@@ -632,10 +840,39 @@ export class AgentSessionManager {
                 await this.onInstall(frame);
                 return;
             default:
-                // Not an agent frame (or an outbound-only one) — the daemon routes those elsewhere.
+                this.warnUnhandledFrame(frame);
                 return;
         }
     }
+    /** Frame types already reported as having no case on this daemon; see {@link warnUnhandledFrame}. */
+    warnedUnhandledFrameTypes = new Set();
+    /**
+     * Say once, per frame type, that a frame reached this dispatcher and nothing acted on it.
+     *
+     * **This used to be a bare `return` with a comment.** That silence is the exact half of the wire
+     * this side had no alarm for: `agent_async_task_stop` is the first server->client request frame
+     * whose only consumer is the `switch` above, so a version of this daemon that shipped the sending
+     * half without the receiving one would have dropped every stop request with no type error, no log
+     * line and no timeout — "shipped inert", and invisible. The Kotlin twin
+     * (`AgentChannelSession.warnUnhandledFrame`) has been loud here since the `ec341b8e4` incident,
+     * where three reply frames were dropped before their handler and three features were inert on
+     * every workstation from the day they shipped; this is the same alarm on the other end.
+     *
+     * Deduplicated by type rather than logged per frame, exactly as the Kotlin twin does it: the
+     * diagnosis is "this type has no case", and repeating it per frame would bury it.
+     *
+     * One benign arrival is possible and is deliberately **not** exempted: a `heartbeat_ack` for a seq
+     * the channel no longer has outstanding slips past `connectEncryptedChannel`'s ack filter and
+     * lands here. That costs one line for the life of the process, and an exemption list would be a
+     * second, parallel statement of which frames this daemon handles — precisely the hand-maintained
+     * copy `AGENT_FRAME_SHAPES`'s own doc exists to avoid.
+     */
+    warnUnhandledFrame(frame) {
+        if (this.warnedUnhandledFrameTypes.has(frame.t))
+            return;
+        this.warnedUnhandledFrameTypes.add(frame.t);
+        console.warn(`[agent] no case for an inbound '${frame.t}'; it reached this daemon and nothing consumed it`);
+    }
     /**
      * Classifies an open before its first await. A live or already-opening ref is continuation
      * traffic, so graceful drain lets it replay/piggyback without acquiring (and later releasing)
@@ -823,6 +1060,21 @@ export class AgentSessionManager {
      * daemon's side of the divergence; the notice heals the server's.
      */
     async sweepIdle(ttlMs, now) {
+        // Observation, not a decision: a session the agent still claims is `running` is never swept
+        // for that alone (ruling A forbids inventing a timeout that overrides the vendor), but one
+        // that has gone this long without another push is worth naming in the log so whoever is
+        // debugging a stuck workstation can see it instead of just trusting a RUNNING that never moves.
+        for (const live of this.sessions.values()) {
+            if (!live.staleActivityWarned &&
+                activityIsBusy(live.lastActivityRaw) &&
+                live.lastActivityAtMs !== undefined &&
+                now - live.lastActivityAtMs > STALE_ACTIVITY_WARN_MS) {
+                live.staleActivityWarned = true;
+                console.warn(`[acp:${live.agentId} agent:${live.agentKey}] session ${live.sessionRef} has reported \`running\` ` +
+                    `for ${Math.round((now - live.lastActivityAtMs) / 60000)} minutes with no further push; ` +
+                    'the platform is reporting it as RUNNING because that is what the agent said.');
+            }
+        }
         const idle = [...this.sessions.values()].filter((live) => now - live.lastActivityAt >= ttlMs);
         // Snapshot first: retire() mutates `sessions`, and it awaits.
         for (const live of idle) {
@@ -835,28 +1087,77 @@ export class AgentSessionManager {
         return idle.map((live) => live.sessionRef);
     }
     async onOpen(frame) {
-        // Reconnect / duplicate open: reuse the live session as-is and replay what the server
-        // still misses.
+        if (frame.delegationMcp && (this.serverAgentWire < AGENT_WIRE_DELEGATION_MCP_VERSION ||
+            (frame.delegationMcp.bindingId && this.serverAgentWire < AGENT_WIRE_DELEGATION_RENEW_VERSION))) {
+            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation requires a newer server' });
+            return;
+        }
+        if (frame.delegationMcp) {
+            try {
+                buildSessionMcpServers([], frame.delegationMcp);
+            }
+            catch {
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Delegation MCP configuration is unavailable' });
+                return;
+            }
+        }
+        // Rotation is server-driven. A busy reconnect replays the original process's journal.
         const existing = this.liveSession(frame.sessionRef);
+        let openFrame = frame;
+        let retireForRefresh;
         if (existing) {
-            // Reusing a live session: neither the process nor the native session moved.
-            await this.resumeAndReply(existing, frame, false);
-            // The session already exists, so any history it has was already streamed under whichever
-            // open first established it (or never will be, if that open didn't ask for it) — replaying it
-            // again here would duplicate what the platform already holds. But if THIS frame asked for
-            // backfill, the server is waiting on exactly one `agent_backfill_done` for THIS open's id:
-            // silence is not "no", it is a wait that never resolves. Answer it without replaying.
-            this.replyNoReplayNeeded(frame);
-            return;
+            if (existing.delegationExpiresAtEpochMs && !frame.delegationMcp) {
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation lease is required' });
+                return;
+            }
+            if (frame.delegationMcp && frame.nativeSessionId && frame.nativeSessionId !== existing.nativeSessionId) {
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation cannot reload the original session' });
+                return;
+            }
+            const refresh = !!frame.delegationMcp &&
+                (existing.delegationLeaseId !== delegationLeaseId(frame.delegationMcp) || existing.delegationRefreshPending === true);
+            if (refresh) {
+                if (!existing.nativeSessionId || (frame.nativeSessionId && frame.nativeSessionId !== existing.nativeSessionId)) {
+                    this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation cannot reload the original session' });
+                    return;
+                }
+                if (existing.session.liveness.turnRunning || activityIsBusy(existing.lastActivityRaw)) {
+                    existing.delegationRefreshPending = true;
+                    if (!await this.resumeAndReply(existing, frame, false))
+                        return;
+                    this.replyNoReplayNeeded(frame);
+                    return;
+                }
+                openFrame = { ...frame, nativeSessionId: existing.nativeSessionId, requireSessionLoad: true };
+                retireForRefresh = existing;
+            }
+            else {
+                // Reusing a live session: neither the process nor the native session moved.
+                if (!await this.resumeAndReply(existing, frame, false))
+                    return;
+                // The session already exists, so any history it has was already streamed under whichever
+                // open first established it (or never will be, if that open didn't ask for it) — replaying it
+                // again here would duplicate what the platform already holds. But if THIS frame asked for
+                // backfill, the server is waiting on exactly one `agent_backfill_done` for THIS open's id:
+                // silence is not "no", it is a wait that never resolves. Answer it without replaying.
+                this.replyNoReplayNeeded(frame);
+                return;
+            }
         }
         const inFlight = this.opening.get(frame.sessionRef);
         if (inFlight) {
             // Piggyback on the attempt already running, and report its real failure — not a generic one.
             const { live, error, agentRefused } = await inFlight;
             if (live) {
+                if (!!frame.delegationMcp !== !!live.delegationExpiresAtEpochMs ||
+                    (frame.delegationMcp && live.delegationLeaseId !== delegationLeaseId(frame.delegationMcp))) {
+                    this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation lease does not match the live session' });
+                    return;
+                }
                 // Piggybacking on the attempt already running: a non-null `live` means that attempt was a
                 // real open (`session/load` or `session/new`), which this frame is reporting secondhand.
-                await this.resumeAndReply(live, frame, true);
+                if (!await this.resumeAndReply(live, frame, true))
+                    return;
                 // Same reasoning as the reconnect branch above: whichever frame actually drove openSession
                 // already streamed this session's history (if it asked to); this frame is a second, racing
                 // open of the same ref and must not trigger a second replay — but still owes its own
@@ -876,8 +1177,14 @@ export class AgentSessionManager {
             }
             return;
         }
-        const attempt = this.openSession(frame)
-            .catch((err) => ({ live: null, error: errorMessage(err) }));
+        const attempt = (async () => {
+            if (retireForRefresh)
+                await this.retire(retireForRefresh, 'keep');
+            return this.openSession(openFrame);
+        })()
+            .catch((err) => ({
+            live: null, error: openFrame.delegationMcp ? 'Managed delegation session could not open' : errorMessage(err),
+        }));
         this.opening.set(frame.sessionRef, attempt);
         let outcome;
         try {
@@ -900,7 +1207,8 @@ export class AgentSessionManager {
         // resolving from the finally, and microtasks always drain before the next inbound frame.
         if (outcome.live) {
             // openSession returned successfully, having just done session/load or session/new.
-            await this.resumeAndReply(outcome.live, frame, true);
+            if (!await this.resumeAndReply(outcome.live, frame, true))
+                return;
             // Only the direct-attempt path: the existing-session and in-flight-piggyback branches above
             // return before reaching here, so a racing duplicate `agent_open` (or a reconnect of an
             // already-open ref) can never trigger a second replay of the same history.
@@ -975,6 +1283,9 @@ export class AgentSessionManager {
             // legitimately rely on `this`, and a bare local `const backfill = session.backfill` would call
             // it unbound.
             for await (const event of session.backfill()) {
+                if (event.acpSessionId !== undefined && this.serverAgentWire < AGENT_WIRE_SCOPED_ORIGIN_VERSION) {
+                    throw new Error(`Scoped backfill requires agent wire ${AGENT_WIRE_SCOPED_ORIGIN_VERSION}; native origin cannot be discarded`);
+                }
                 batch.push(event);
                 count += 1;
                 if (batch.length >= BACKFILL_BATCH_SIZE) {
@@ -1015,8 +1326,16 @@ export class AgentSessionManager {
         const resumeFrom = resumeFromSeqOf(frame);
         // On the session's own queue so an agent event produced mid-replay is sent after it, not into
         // the middle of it.
+        let incompatible = false;
         await this.enqueue(live, async () => {
+            if (live.closed)
+                return;
+            incompatible = this.blockIncompatibleJournal(live);
+            if (incompatible)
+                return;
             const entries = await live.journal.entriesAfter(resumeFrom);
+            if (live.closed)
+                return;
             if (this.hasGap(live, entries, resumeFrom)) {
                 this.emit({
                     t: 'agent_event',
@@ -1033,7 +1352,19 @@ export class AgentSessionManager {
             // de-duplication does the deciding.
             for (const entry of entries)
                 this.emit(entry.frame);
+            live.scopedReplayBlocked = false;
         });
+        if (incompatible) {
+            const error = `Scoped journal replay requires agent wire ${AGENT_WIRE_SCOPED_ORIGIN_VERSION}; retained history was not delivered or acknowledged`;
+            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error });
+            if (frame.backfill)
+                this.emit({ t: 'agent_backfill_done', id: frame.id, ok: false, count: 0, error });
+            return false;
+        }
+        if (live.closed) {
+            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'session was closed while opening' });
+            return false;
+        }
         this.emit({
             t: 'agent_opened',
             id: frame.id,
@@ -1044,6 +1375,12 @@ export class AgentSessionManager {
             // Emitted only when true, the same `supportsSteering` convention as below: absent is the
             // field's only "no", and it is also what an older peer sends.
             ...(reloaded ? { reloaded: true } : {}),
+            ...(live.delegationExpiresAtEpochMs ? { delegationExpiresAtEpochMs: live.delegationExpiresAtEpochMs } : {}),
+            ...(live.delegationRefreshPending ? { delegationRefreshPending: true } : {}),
+            ...(this.serverAgentWire >= AGENT_WIRE_DELEGATION_RENEW_VERSION && live.delegationInstanceId ? {
+                delegationInstanceId: live.delegationInstanceId, delegationBindingId: live.delegationBindingId,
+                delegationRenewalRevision: live.delegationRenewalRevision,
+            } : {}),
             // The server learns this here and nowhere else. It used to be published only on the roster in
             // the `agent_hello` handshake, which is a snapshot taken *before* any agent was connected to —
             // and the capability can only be observed on a live `initialize`, whose record
@@ -1078,6 +1415,7 @@ export class AgentSessionManager {
             // ruling R1: `agent_opened` is assembled from `live.session.*`, not from the roster, so a
             // field added to `BridgeInfo` would have no reader here).
             ...(live.session.agentInfo ? { agentInfo: live.session.agentInfo } : {}),
+            ...(live.session.runtimeDiagnostics ? { runtimeDiagnostics: live.session.runtimeDiagnostics } : {}),
             // ACP `PromptCapabilities.image`, learned at the same `initialize` and for the same
             // session-not-roster reason as `supportsSteering` above: `true`-or-absent is this field's
             // whole vocabulary, so an agent that said nothing (or a peer too old to answer) reads the
@@ -1094,7 +1432,22 @@ export class AgentSessionManager {
             // would report the pre-change values to the server after every config change. See
             // {@link AcpAgentSession.configOptions} for what that costs.
             configOptions: live.session.configOptions,
+            // Whether this daemon wired up an activity-state collector for this session's agent (design
+            // §5.3) — decided from the same `agentInfo.name` just read above, never from whether a push
+            // has actually arrived: those are different facts (see the field's own doc in
+            // `protocol/agent.ts`). No version floor: an additive key on a frame the peer already decodes
+            // with `ignoreUnknownKeys`, the same `supportsSteering`/`reloaded` shape, not the
+            // new-discriminator shape `agent_session_state` itself is.
+            ...(reportsActivity(live.session.agentInfo?.name) ? { reportsActivity: true } : {}),
+            ...(live.nativeSessionId && supportsAsyncTaskStop(live.session.agentInfo?.name)
+                ? { supportsAsyncTaskStop: true } : {}),
+            // This session's activity-state snapshot as of right now, resent here because
+            // `agent_session_state` is never journaled and a reopen would otherwise have nothing to
+            // recover it from — see `LiveSession.lastActivityRaw`'s own doc. Absent when nothing has ever
+            // arrived (including "no collector for this agent"), never a synthesized default.
+            ...(live.lastActivityRaw !== undefined ? { activityRaw: live.lastActivityRaw } : {}),
         });
+        return true;
     }
     /**
      * Whether the overflow drop actually took something the server still needs. `droppedOldest` alone
@@ -1132,8 +1485,16 @@ export class AgentSessionManager {
         // init() only reads — the file appears on the first append — so an open that fails here leaves
         // nothing behind.
         const journal = new SessionJournal(this.sessionsDir, frame.sessionRef, this.maxJournalBytes);
+        let highestScopedJournalSeq = 0;
         try {
             await journal.init(resumeFromSeqOf(frame));
+            // Recovery is the only full scan needed for compatibility. Appends and ACKs below maintain
+            // the high watermark incrementally, including while a v17 connection is offline.
+            for (const entry of await journal.entriesAfter(0)) {
+                if (entry.frame.t === 'agent_event' && entry.frame.acpSessionId != null) {
+                    highestScopedJournalSeq = Math.max(highestScopedJournalSeq, entry.seq);
+                }
+            }
         }
         catch (err) {
             return { live: null, error: `journal init failed: ${errorMessage(err)}` };
@@ -1149,6 +1510,7 @@ export class AgentSessionManager {
         let nativeSessionId;
         try {
             const result = await this.agents.open({
+                openRequestId: frame.id,
                 // `frame.bridge` is the registry agent id now — the wire field keeps its name because Plan A
                 // renames nothing (Global Constraint 3); ruling R2 replaced what it *means*.
                 agentId: frame.bridge,
@@ -1158,12 +1520,18 @@ export class AgentSessionManager {
                 ...(frame.command ? { command: frame.command } : {}),
                 args: frame.args ?? [],
                 ...(frame.nativeSessionId ? { nativeSessionId: frame.nativeSessionId } : {}),
+                ...(frame.requireSessionLoad ? { requireSessionLoad: true } : {}),
+                ...(frame.delegationMcp ? { delegationMcp: frame.delegationMcp } : {}),
                 // Retaining a whole adopted history costs memory for the session's lifetime, so it is only
                 // kept when this open is the one that will stream it back.
                 backfill: frame.backfill === true,
             });
             session = result.session;
             nativeSessionId = result.nativeSessionId;
+            if (frame.delegationMcp && !nativeSessionId) {
+                await session.close();
+                return { live: null, error: 'Managed delegation requires a native session ID' };
+            }
         }
         catch (err) {
             // `open` throws on both sides of the agent's `initialize` — nothing to launch and a spawn
@@ -1172,7 +1540,7 @@ export class AgentSessionManager {
             // on `session/new` arrives as; see {@link OpenOutcome.agentRefused}.
             return {
                 live: null,
-                error: errorMessage(err),
+                error: frame.delegationMcp ? 'Managed delegation session could not open' : errorMessage(err),
                 // The code comes off the marker, not off `errorMessage(err)` above: the wrapper captured it
                 // from the original rejection at the moment that object still existed.
                 ...(err instanceof AgentRefusedSessionError
@@ -1217,15 +1585,38 @@ export class AgentSessionManager {
             agentKey: frame.agentKey,
             session,
             nativeSessionId,
+            ...(frame.delegationMcp ? { delegationExpiresAtEpochMs: frame.delegationMcp.expiresAtEpochMs } : {}),
+            ...(frame.delegationMcp ? { delegationLeaseId: delegationLeaseId(frame.delegationMcp) } : {}),
+            ...(frame.delegationMcp?.bindingId ? { delegationBindingId: frame.delegationMcp.bindingId,
+                delegationInstanceId: randomUUID(), delegationRenewalRevision: 0 } : {}),
             journal,
             writes: Promise.resolve(),
+            scopedReplayBlocked: false,
+            highestScopedJournalSeq,
             closed: false,
             lastActivityAt: Date.now(),
         };
         this.sessions.set(frame.sessionRef, live);
-        this.tasks?.registerAgentSession(frame.sessionRef, () => this.retire(live, 'destroy'));
+        this.tasks?.registerAgentSession(frame.sessionRef, () => this.retire(live, 'destroy'), 
+        // 两个层级量取或：本进程发出的提示词是否在途（agent 自己也许在续跑一个我们没发起的回合，
+        // 那一种由第二项回答），以及 agent 自报的状态。两者都不累积，所以没有可泄漏的状态。
+        () => live.session.liveness.turnRunning || activityIsBusy(live.lastActivityRaw));
         session.onEvent((e) => this.onAgentEvent(live, e));
         session.onTurnDone((r) => this.onAgentTurnDone(live, r));
+        session.onActivity((raw) => this.onAgentActivity(live, raw));
+        session.onRuntimeDiagnostics?.((diagnostics) => {
+            if (live.closed || this.sessions.get(live.sessionRef) !== live ||
+                this.serverAgentWire < AGENT_WIRE_RUNTIME_PROFILE_VERSION)
+                return;
+            this.emit({ t: 'agent_runtime_profile', sessionRef: live.sessionRef, diagnostics });
+        });
+        session.onProviderTaskEvent?.((event) => {
+            if (live.closed || this.sessions.get(live.sessionRef) !== live || this.serverAgentWire < AGENT_WIRE_PROVIDER_TASK_VERSION ||
+                !live.session.providerTaskAdapterSelected || event.rootSessionId !== live.nativeSessionId ||
+                event.runtimeGeneration !== live.session.runtimeDiagnostics?.profile?.runtimeGeneration)
+                return;
+            this.emit({ t: 'agent_provider_task_event', sessionRef: live.sessionRef, ...event });
+        });
         return { live };
     }
     /**
@@ -1268,6 +1659,25 @@ export class AgentSessionManager {
             this.emit({ t: 'agent_native_sessions', id: frame.id, ok: false, error: errorMessage(err) });
         }
     }
+    /**
+     * Answers `agent_delete_native`: `session/delete` per id over a throwaway connection, like
+     * {@link onListNative}. Per-id outcomes ride in `results` (`ok:true`); `ok:false` means the
+     * deletion could not be attempted at all (no launchable agent, bad query). Never throws.
+     */
+    async onDeleteNative(frame) {
+        const spec = sanitizeNativeSessionQuery(frame.bridge, frame.query);
+        if (!spec) {
+            this.emit({ t: 'agent_native_deleted', id: frame.id, ok: false, error: 'native session query is missing cwd' });
+            return;
+        }
+        try {
+            const results = await this.agents.deleteNativeSessions(spec, frame.nativeSessionIds);
+            this.emit({ t: 'agent_native_deleted', id: frame.id, ok: true, results });
+        }
+        catch (err) {
+            this.emit({ t: 'agent_native_deleted', id: frame.id, ok: false, error: errorMessage(err) });
+        }
+    }
     /**
      * Answers `agent_verify` by actually starting the agent and seeing what it says — the only way the
      * roster's auth fields can be populated for an agent no session has ever run (see
@@ -1443,11 +1853,11 @@ export class AgentSessionManager {
     onAgentEvent(live, e) {
         if (live.closed)
             return;
-        // An agent can resume an existing native turn after a client restart, so an inbound prompt is
-        // not the only reliable start marker. These are the two wire events that represent work which
-        // may still require user action or native execution; turn_done below releases the mark.
-        if (e.eventName === 'tool_call' || e.eventName === 'permission_request')
-            this.tasks?.agentTurnStarted(live.sessionRef);
+        // 这里曾经有一行：`tool_call` / `permission_request` 就登记一次「这条会话在忙」。它是在
+        // 没有 vendor 状态信号的年代用来猜「agent 是不是在续跑一个本进程没发起的回合」的启发式，
+        // 而它开的口子只有 `turn_done` 能关——任何一条没有配套 `turn_done` 的事件都会把这个 ref
+        // 永久钉成忙碌。那个猜测现在有了真信号（`lastActivityRaw`，见本类的注册点），所以这一行
+        // 不是被删掉了事，是被它当初代理的那个事实取代了。
         // Before the contract check: an agent emitting even non-conforming events is a live process,
         // and the idle sweep is about liveness, not correctness.
         this.touch(live);
@@ -1461,6 +1871,17 @@ export class AgentSessionManager {
                 `${rejection.reason}${rejection.detail ? ` (${rejection.detail})` : ''}`);
             return;
         }
+        if (e.acpSessionId !== undefined && this.serverAgentWire < AGENT_WIRE_SCOPED_ORIGIN_VERSION) {
+            if (e.eventName === 'permission_request' && typeof e.payload.requestId === 'string') {
+                const options = e.payload.options;
+                let cancelled = '__axom_undeliverable_permission__';
+                while (options.some((option) => option.optionId === cancelled))
+                    cancelled += '_';
+                live.session.answer(e.payload.requestId, cancelled);
+            }
+            console.warn(`[acp:${live.agentId}] scoped live event '${e.eventName}' for '${e.acpSessionId}' disabled: requires agent wire ${AGENT_WIRE_SCOPED_ORIGIN_VERSION}`);
+            return;
+        }
         this.record(live, (seq) => ({
             t: 'agent_event',
             sessionRef: live.sessionRef,
@@ -1473,10 +1894,55 @@ export class AgentSessionManager {
             ...(e.acpSessionId ? { acpSessionId: e.acpSessionId } : {}),
         }));
     }
+    /**
+     * `session.onActivity`'s handler: one agent-reported activity-state push. Deliberately not
+     * routed through {@link record} — an activity push is a level, not an edge (the
+     * `agent_session_state` frame's own doc comment in `protocol/agent.ts`), so it must never be
+     * journaled and must never advance {@link SessionJournal}'s seq the way `onAgentEvent`'s
+     * `agent_event`s do.
+     *
+     * `live.lastActivityRaw` is updated **before** the version check, unconditionally: it feeds
+     * `agent_opened.activityRaw` and `AgentResumeSessionWire.activityRaw`, neither of which is gated
+     * on {@link AGENT_WIRE_SESSION_STATE_VERSION} (they are additive keys on frames the peer already
+     * decodes, the `supportsSteering`/`reloaded` shape — see those fields' own doc comments), so the
+     * cache has to be current even for a peer too old to receive the push itself.
+     *
+     * The push itself **is** gated, and the check has to live here — the client side of the
+     * compatibility matrix `AGENT_WIRE_SESSION_STATE_VERSION`'s own doc comment describes as the
+     * dangerous direction: a v15 client talking to a v14 server. `agent_session_state` is a new
+     * discriminator, not an additive key, so an unrecognised one throws inside `AgentCodec.decode` on
+     * the server and gets charged to `FailSession` — and this frame exists to be sent over and over,
+     * so a run of them on an unupgraded server would close the whole agent channel. Below the floor
+     * the push is silently dropped rather than queued or converted to anything else: a level nobody
+     * downstream can read is no worse than one that was never collected.
+     */
+    onAgentActivity(live, raw) {
+        if (live.closed)
+            return;
+        live.lastActivityRaw = raw;
+        live.lastActivityAtMs = Date.now();
+        live.staleActivityWarned = false;
+        // 采样式判据没有「变空闲」事件；一次状态推送正是它可能翻转的时刻，喊一声让
+        // waitForIdle 重新判一次。漏喊只会推迟到下次判定，多喊无害。
+        this.tasks?.sessionBusyChanged();
+        if (this.serverAgentWire < AGENT_WIRE_SESSION_STATE_VERSION)
+            return;
+        this.emit({
+            t: 'agent_session_state',
+            sessionRef: live.sessionRef,
+            vendor: live.session.agentInfo?.name ?? '',
+            raw,
+        });
+    }
     onAgentTurnDone(live, r) {
         if (live.closed)
             return;
-        this.tasks?.agentTurnFinished(live.sessionRef);
+        // `agentTurnFinished` used to clear this ref's bracket entry here. There is no entry to clear
+        // any more — busy is sampled straight off `live.session.liveness.turnRunning` (already false
+        // by the time this fires; see `AcpSession.turnRunning`'s own doc) — but a session that was the
+        // registry's *only* busy one may have just gone idle, and sampling has no event of its own to
+        // announce that, so this is where the registry is told to look again.
+        this.tasks?.sessionBusyChanged();
         this.touch(live);
         if (r.nativeSessionId)
             live.nativeSessionId = r.nativeSessionId;
@@ -1485,6 +1951,8 @@ export class AgentSessionManager {
             sessionRef: live.sessionRef,
             seq,
             status: r.status,
+            platformTurnId: r.platformTurnId,
+            executionEnded: r.executionEnded,
             stopReason: r.stopReason,
             nativeSessionId: r.nativeSessionId ?? null,
             error: r.error ?? null,
@@ -1516,6 +1984,9 @@ export class AgentSessionManager {
         const seq = live.journal.nextSeq();
         const frame = build(seq);
         void this.enqueue(live, async () => {
+            if (frame.t === 'agent_event' && frame.acpSessionId != null) {
+                live.highestScopedJournalSeq = Math.max(live.highestScopedJournalSeq, seq);
+            }
             try {
                 await live.journal.append({ seq, frame });
             }
@@ -1524,9 +1995,26 @@ export class AgentSessionManager {
                 // will not survive a reconnect.
                 console.error(`[agent] journal append failed for ${live.sessionRef}: ${errorMessage(err)}`);
             }
+            // Keep subsequent root/turn frames durable but withheld too: sending a higher sequence
+            // would let the old peer ACK past the child event it could not interpret.
+            if (live.scopedReplayBlocked || this.blockIncompatibleJournal(live))
+                return;
             this.emit(frame);
         });
     }
+    /** Must run on the session queue, before replay, delivery or ACK truncation. */
+    blockIncompatibleJournal(live) {
+        if (this.serverAgentWire >= AGENT_WIRE_SCOPED_ORIGIN_VERSION)
+            return false;
+        if (live.scopedReplayBlocked)
+            return true;
+        // Conservatively retain this requirement through journal overflow: only a compatible ACK
+        // proves the peer has applied (or explicitly accepted a gap through) that scoped sequence.
+        const incompatible = live.highestScopedJournalSeq > 0;
+        if (incompatible)
+            live.scopedReplayBlocked = true;
+        return incompatible;
+    }
     /** Appends `op` to the session's serialized queue. The returned promise never rejects. */
     enqueue(live, op) {
         const next = live.writes.then(op).catch((err) => {