@platless/axom-cli 0.1.0 → 0.5.9

package/dist/workstation/agentSessions.js

@@ -1,9 +1,21 @@
-import fs from 'node:fs/promises';
 import path from 'node:path';
-import { AGENT_WIRE_AUTH_URL_VERSION, AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION, AGENT_WIRE_ORPHAN_OFFER_VERSION, AGENT_WIRE_SESSION_AUTH_METHODS_VERSION, AGENT_WIRE_SESSION_LOST_VERSION, AGENT_WIRE_VERSION, outboundAgentFrameRejection, outboundFailureReply, } from './protocol/agent.js';
-import { DEFAULT_JOURNAL_MAX_BYTES, SessionJournal } from './journal.js';
-import { AGENT_PROBE_TIMEOUT_MS, AgentRefusedSessionError } from './acp/acpAgents.js';
-import { validateWireEvent } from './acp/validate.js';
+import { createHash, randomUUID } from 'node:crypto';
+import { AGENT_WIRE_AUTH_URL_VERSION, AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION, AGENT_WIRE_SCOPED_ORIGIN_VERSION, AGENT_WIRE_ORPHAN_OFFER_VERSION, AGENT_WIRE_SESSION_AUTH_METHODS_VERSION, AGENT_WIRE_SESSION_LOST_VERSION, AGENT_WIRE_VERSION, AGENT_WIRE_DELEGATION_MCP_VERSION, AGENT_WIRE_DELEGATION_RENEW_VERSION, AGENT_WIRE_PROVIDER_TASK_VERSION, AGENT_WIRE_REOPEN_REQUEST_VERSION, AGENT_WIRE_RELATION_ACK_VERSION, outboundAgentFrameRejection, outboundFailureReply, } from './protocol/agent.js';
+import { listLegacyJournalRefs, readLegacyJournal, removeLegacyJournal } from './journal.js';
+import { SESSION_WINDOW_BYTES, SESSION_WINDOW_EVENTS } from './acp/outbox.js';
+import { SocketGate } from './agentFlow.js';
+import { AGENT_PROBE_TIMEOUT_MS, AgentRefusedSessionError, LOCAL_SESSION_UNMOVABLE } from './acp/acpAgents.js';
+import { AdapterStillInstallingError } from './acp/builds/model.js';
+import { projectFrame } from './acp/processor/projection.js';
+import { reportsActivity, supportsAsyncTaskStop } from './acp/activityReporting.js';
+import { activityIsBusy } from './acp/activityBusy.js';
+import { buildSessionMcpServers } from './acp/delegationMcp.js';
+import { ADAPTER_LOST_REOPEN_ATTEMPTS, plainSwitchBlocker, REOPEN_REQUEST_RETRY_MS, switchBlockers, SWITCH_QUIET_MS } from './acp/switching.js';
+function delegationLeaseId(lease) {
+    return createHash('sha256').update(JSON.stringify([
+        lease.url, lease.headers, lease.bindingId,
+    ])).digest('hex');
+}
 /**
  * 从线上收来的验证预算的绝对上限。
  *
@@ -71,6 +83,20 @@ function promptBlocks(frame) {
         : [];
     return [...text, ...images];
 }
+/**
+ * Narrows `agent_elicitation_answer.action` to the three literals this daemon itself ever sends.
+ *
+ * `AGENT_FRAME_SHAPES` only validates `action` as *a* string — ACP's own `CreateElicitationResponse`
+ * has a fourth, open `action: string` arm for an agent's own custom/future actions, so the wire
+ * layer cannot reject an arbitrary string as malformed. But this daemon is the only sender of this
+ * frame, and the server only ever offers the user accept/decline/cancel, so anything else reaching
+ * `handleFrame` is a platform bug, not a legitimate custom action — and a bare `as
+ * CreateElicitationResponse['action']` cast at the call site would launder it through unchecked,
+ * reaching the agent as a value ACP itself still accepts as protocol-valid.
+ */
+function isKnownElicitationAction(action) {
+    return action === 'accept' || action === 'decline' || action === 'cancel';
+}
 /**
  * The server's applied-through watermark on an open frame, sanitized. Absent means "nothing yet".
  *
@@ -86,14 +112,96 @@ function resumeFromSeqOf(frame) {
     const seq = Math.trunc(frame.resumeFromSeq ?? 0);
     return Number.isFinite(seq) ? Math.max(0, seq) : 0;
 }
+/**
+ * What `agent_open` asks of {@link AcpAgents.open} (and of a switch, which needs the same fresh spawn environment — spec §6.3).
+ *
+ * `env` is an OVERLAY merged onto process.env when the agent is spawned (see AcpOpenSpec.env), so it is built from frame-supplied
+ * values only. The single exception is PATH: when pathPrepend is set the whole variable is resolved here — prepends first, then the
+ * frame's PATH or, failing that, the daemon's — so the launcher uses spec.env.PATH verbatim instead of re-deriving it.
+ */
+function openSpecOf(frame) {
+    const env = { ...(frame.env ?? {}) };
+    const pathPrepend = frame.pathPrepend ?? [];
+    if (pathPrepend.length > 0) {
+        env.PATH = [...pathPrepend, env.PATH ?? process.env.PATH ?? ''].filter(Boolean).join(path.delimiter);
+    }
+    return {
+        openRequestId: frame.id,
+        sessionRef: frame.sessionRef,
+        agentKey: frame.agentKey,
+        ...(frame.delegationMcp ? { delegation: {
+                leaseId: delegationLeaseId(frame.delegationMcp),
+                ...(frame.delegationMcp.bindingId ? { bindingId: frame.delegationMcp.bindingId, instanceId: randomUUID() } : {}),
+            } } : {}),
+        // `frame.bridge` is the registry agent id now — the wire field keeps its name because Plan A
+        // renames nothing (Global Constraint 3); ruling R2 replaced what it *means*.
+        agentId: frame.bridge,
+        cwd: frame.cwd,
+        env,
+        agentEnv: frame.agentEnv ?? {},
+        ...(frame.command ? { command: frame.command } : {}),
+        args: frame.args ?? [],
+        ...(frame.nativeSessionId ? { nativeSessionId: frame.nativeSessionId } : {}),
+        ...(frame.requireSessionLoad ? { requireSessionLoad: true } : {}),
+        ...(frame.delegationMcp ? { delegationMcp: frame.delegationMcp } : {}),
+        // Retaining a whole adopted history costs memory for the session's lifetime, so it is only
+        // kept when this open is the one that will stream it back.
+        backfill: frame.backfill === true,
+    };
+}
+/** A recorded frame as the processor makes it: the projection adds `sessionRef` (right after `t`) when it is sent. */
+function withoutSessionRef(frame) {
+    const { sessionRef: _ref, ...rest } = frame;
+    return rest;
+}
+/** How an adapter exited, for the daemon log and the crash-limit refusal: code or signal, and the last stderr line. */
+function exitWords(exit) {
+    const status = exit.signal ? `signal ${exit.signal}` : exit.code !== null ? `exit code ${exit.code}` : 'no exit status';
+    const lastLine = exit.stderrTail.trim().split('\n').at(-1)?.trim().slice(0, 200);
+    return lastLine ? `${status}; stderr: ${lastLine}` : status;
+}
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
+/**
+ * The reply text of an open that failed. A managed (delegation) open hides the cause behind one fixed sentence — except when
+ * the adapter is still being installed: that one is actionable ("try again shortly") and carries nothing about the lease (15c).
+ */
+function openFailureText(frame, err) {
+    return frame.delegationMcp && !(err instanceof AdapterStillInstallingError) ? 'Managed delegation session could not open' : errorMessage(err);
+}
 /**
  * Batch size for `agent_backfill_events`. Kept modest so a session with a long history does not
  * arrive as one giant frame; the last batch of a stream is whatever remains below this size.
  */
 export const BACKFILL_BATCH_SIZE = 64;
+/**
+ * How long the reconnect offer waits for the start-time adoption (Task 21, spec §5.5.2: rebuild before the agent channel is
+ * answered). Sessions still being rebuilt after it are offered without `turnRunning` — never as missing, which would end their turns.
+ */
+export const ADOPTION_OFFER_WAIT_MS = 10_000;
+/**
+ * Own exits of a ref's adapter (no keeper-acp reason: it crashed, or was killed outside Axom) in a row, with no turn completing in
+ * between, past which a respawn is no longer made at once (spec §11 "single adapter crash": `session/load` recovers it — but an
+ * adapter that dies on every respawn must not be respawned for ever). From the limit on, an `agent_open` that would respawn it is
+ * refused with the reason until {@link ADAPTER_CRASH_BACKOFF_MS} has passed since the last exit, doubling per exit past the limit up
+ * to {@link ADAPTER_CRASH_BACKOFF_MAX_MS}. A completed turn, or {@link ADAPTER_CRASH_FORGET_MS} without an exit, starts the count over.
+ */
+export const ADAPTER_CRASH_LIMIT = 3;
+export const ADAPTER_CRASH_BACKOFF_MS = 30_000;
+export const ADAPTER_CRASH_BACKOFF_MAX_MS = 10 * 60_000;
+export const ADAPTER_CRASH_FORGET_MS = 30 * 60_000;
+/** At most one daemon-log line per ref per this period for refused respawns. */
+const ADAPTER_CRASH_WARN_EVERY_MS = 60_000;
+/**
+ * 一条会话自报 `running` 之后多久没有任何新推送，就值得在日志里点名。
+ *
+ * **这不是超时，不会清任何状态**——裁决 A 说 vendor 报 running 就是 running，发明一个
+ * 到点就翻成 idle 的定时器正是它禁止的猜测。这条只是把「我们完全信任了一个已经沉默 30 分钟
+ * 的信源」这件事摆到排查者面前。取 30 分钟是因为比任何正常回合都长，又短到一次排查会话里
+ * 看得见。
+ */
+export const STALE_ACTIVITY_WARN_MS = 30 * 60 * 1000;
 /**
  * Defensively turns the wire query of `agent_list_native` / `agent_verify` / `agent_authenticate`
  * — one shape, because all three ask the same thing of an agent that has no session yet: where to
@@ -122,19 +230,6 @@ function sanitizeNativeSessionQuery(agentId, query) {
         args: query.args ?? [],
     };
 }
-/**
- * Name an event for a diagnostic without trusting it: on a payload hostile enough that even
- * `eventName` throws (the validator's 'event not inspectable' case), the log line itself must
- * still come out.
- */
-function wireEventName(e) {
-    try {
-        return String(e?.eventName);
-    }
-    catch {
-        return '<uninspectable>';
-    }
-}
 /**
  * Owns the workstation's live external-agent sessions and translates between the tunnel's
  * `agent_*` frames and the ACP client.
@@ -143,14 +238,17 @@ function wireEventName(e) {
  * (and the subprocesses behind them) must survive a dropped websocket. The send binding is swapped
  * per connection via {@link bindSend} / {@link closeAll}.
  *
- * Delivery is at-least-once, not best-effort: every outbound event is journaled before it is sent
- * ({@link SessionJournal}), so a send that goes nowhere — socket down, or the daemon restarted
- * entirely — is replayed when the server re-opens the ref with its `resumeFromSeq` watermark.
+ * Delivery is at-least-once, not best-effort: every outbound event is recorded in the session's outbox (the transport's outbox
+ * stream, Task 20 — it replaced the daemon journal) before it is sent, so a send that goes nowhere — socket down, or the daemon
+ * restarted entirely — is resent when the server re-opens the ref with its `resumeFromSeq` watermark.
+ *
+ * Sending is flow-controlled (spec §5.6): a session's numbered frames go out from its outbox while fewer than
+ * {@link SESSION_WINDOW_EVENTS} events / {@link SESSION_WINDOW_BYTES} bytes are unacknowledged on the connection and the socket
+ * gate is open ({@link SocketGate}); sessions take turns. Control frames are written at once ({@link emit}).
  */
 export class AgentSessionManager {
     agents;
     journalDir;
-    maxJournalBytes;
     tasks;
     sessions = new Map();
     /** In-flight opens, keyed by sessionRef, so two racing agent_open frames cannot spawn two agents. */
@@ -161,21 +259,19 @@ export class AgentSessionManager {
      * fails its pending open with ok:false and will never adopt the result). Without this, the native
      * agent that finishes spawning afterwards is orphaned: alive, registered, and unknown to the
      * server. {@link openSession} closes and discards any session whose ref is tombstoned, and uses
-     * the recorded {@link AbandonReason} to decide whether the journal dies with it.
+     * the recorded {@link AbandonReason} to decide whether its outbox dies with it.
      */
     closedDuringOpen = new Map();
     /**
-     * Refs whose journal is still being torn down, and the promise that says when it is gone.
+     * Refs whose session is still being torn down (adapter stopped, outbox flushed and kept or released), and the promise that says
+     * when it is done.
      *
      * A close and the reopen of the same ref are two independent inbound frames — the daemon does not
      * serialize `handleFrame` (see daemon.ts's `ws.on('message', async …)`) — and `onClose` returns the
-     * ref to the "openable" state the moment it drops out of `sessions`, while the actual `destroy()`
-     * is still queued behind that session's pending writes. Letting the reopen build a second
-     * {@link SessionJournal} on the same path in that window is a data-loss race in both directions:
-     * the old `destroy()` can land after the new journal's first append and delete it, or the new
-     * `init()` can read a file the old `destroy()` then removes, leaving the new journal with a stale
-     * size and a seq counter recovered from bytes that no longer exist. The two instances also share a
-     * `.tmp` path, so a rewrite in one can be pulled out from under the other.
+     * ref to the "openable" state the moment it drops out of `sessions`, while the actual teardown is
+     * still running. The reopen spawns under the same transport key: letting it start in that window
+     * would race the old release against the new session's outbox (deleting it under it) or read the
+     * outbox back while the old session's last appends are still landing.
      *
      * {@link openSession} waits on this before constructing anything.
      */
@@ -218,33 +314,110 @@ export class AgentSessionManager {
      * running for a card nobody will ever see.
      */
     loginsInFlight = new Set();
+    /** The socket gate of the bound connection (spec §5.6). */
+    gate = new SocketGate();
+    /** Bumped per bound connection: a session's window counts what was sent on this one. */
+    epoch = 0;
+    /** Round-robin start for the sender. */
+    turn = 0;
+    pumping = false;
+    pumpAgain = false;
+    /** The one-time migration of the legacy daemon journal ({@link migrateLegacyJournals}). */
+    legacyMigration;
+    /** The start-time adoption of keeper-acp sessions ({@link adoptSessions}): resolves once they are all registered (or given up). */
+    adoption;
+    /** A retry of the adoption in flight ({@link adoptLate}): resolves once what it found is tracked in {@link adopting}. */
+    lateAdoption;
+    /** Refs found running in keeper-acp and still being rebuilt: what the offer reports for them, and when they are done. */
+    adopting = new Map();
+    /**
+     * Refs this daemon detached (spec §5.5.5): the session now belongs to the next daemon. A frame for one is dropped quietly — telling
+     * the server the session is lost would end the turn the next daemon continues.
+     */
+    detached = new Set();
+    /**
+     * Refs being switched (spec §6.3, Task 24) and the promise that says when the switch (and its `agent_opened`) is done: every other
+     * inbound frame of the ref is parked behind it and delivered in order afterwards — to the session that then holds the ref.
+     */
+    switching = new Map();
+    /** When a reopen was last requested for a ref, and for what (a switch, or an adapter keeper-acp lost): not asked again too soon. */
+    reopenRequests = new Map();
+    /** The quiet period a session must keep before it is switched (spec §14; a test seam). */
+    switchQuietMs = SWITCH_QUIET_MS;
+    /** Own adapter exits per ref ({@link ADAPTER_CRASH_LIMIT}): how many in a row, the last one's time and words. */
+    adapterCrashes = new Map();
+    /** {@link ADAPTER_CRASH_BACKOFF_MS} (a test seam). */
+    adapterCrashBackoffMs = ADAPTER_CRASH_BACKOFF_MS;
+    /** `agent_open`s being handled per ref, from admission to their reply: a lost notice waits for them ({@link flushAdapterLost}). */
+    openHandling = new Map();
     constructor(
     /** The one ACP client every external agent runs through; keyed per call by registry agent id. */
     agents, send, 
-    /** Root for per-session journals; they live under `<journalDir>/sessions`. */
+    /** `<configDir>/agents`: the legacy journals (`sessions/<ref>.jsonl`) an older CLI left are migrated from here, once. */
     journalDir, 
-    /** Per-session journal cap. Beyond it the oldest half is dropped and the server told about the hole. */
-    maxJournalBytes = DEFAULT_JOURNAL_MAX_BYTES, 
     /** Shared update admission and force-cancellation authority, when this daemon supports updates. */
     tasks) {
         this.agents = agents;
         this.journalDir = journalDir;
-        this.maxJournalBytes = maxJournalBytes;
         this.tasks = tasks;
         this.send = send;
     }
-    /** Where journals live: `<journalDir>/sessions/<sessionRef>.jsonl`. */
+    /** Where an older CLI's journals live: `<journalDir>/sessions/<sessionRef>.jsonl` (read-only legacy, `journal.ts`). */
     get sessionsDir() {
         return path.join(this.journalDir, 'sessions');
     }
+    /**
+     * The daemon journal an older CLI kept (`agents/sessions/<ref>.jsonl`) becomes, once, a local outbox under the same ref
+     * (`AcpAgents.importLegacyOutbox`): from then on it is offered as an orphan and resent on a reopen exactly as the journal was,
+     * and released like any other outbox. Each file is deleted once its outbox exists; a file that fails stays for the next start.
+     * Runs once per process (the resume offer and every open wait for it).
+     */
+    migrateLegacyJournals() {
+        this.legacyMigration ??= (async () => {
+            const importOutbox = this.agents.importLegacyOutbox?.bind(this.agents);
+            if (!importOutbox)
+                return;
+            let refs;
+            try {
+                refs = await listLegacyJournalRefs(this.sessionsDir);
+            }
+            catch (error) {
+                console.warn(`[agent] listing legacy journals failed: ${errorMessage(error)}`);
+                return;
+            }
+            for (const sessionRef of refs) {
+                try {
+                    const entries = await readLegacyJournal(this.sessionsDir, sessionRef);
+                    const imported = await importOutbox(sessionRef, entries.map((entry) => ({
+                        seq: entry.seq,
+                        ...(entry.src ? { src: entry.src } : {}),
+                        // The outbox keeps the processor's frame; the projection adds `sessionRef` when it is sent.
+                        frame: withoutSessionRef(entry.frame),
+                    })));
+                    if (imported === false) {
+                        // A local outbox already holds this ref (an import that already happened, or a fallback session's own): it wins, and
+                        // the file's frames are not merged into it.
+                        console.warn(`[agent] legacy journal of ${sessionRef} not imported: a local outbox for it already exists; deleting the journal`);
+                    }
+                    await removeLegacyJournal(this.sessionsDir, sessionRef);
+                    if (imported !== false)
+                        console.info(`[agent] migrated the legacy journal of ${sessionRef} (${entries.length} unacknowledged frame(s)) to its outbox`);
+                }
+                catch (error) {
+                    console.warn(`[agent] migrating the legacy journal of ${sessionRef} failed (kept for the next start): ${errorMessage(error)}`);
+                }
+            }
+        })();
+        return this.legacyMigration;
+    }
     /** Number of daemon-owned external-agent sessions, for the management heartbeat projection. */
     activeSessionCount() {
         return [...this.sessions.values()].filter((session) => !session.closed).length;
     }
-    /** Snapshot advertised once after an agent-channel reconnect; the server remains replay authority. */
     /**
-     * The reconnect inventory: the sessions this daemon holds, plus the journals a previous daemon
-     * life left on disk.
+     * The reconnect inventory: the sessions this daemon holds, plus the outboxes earlier lives left in the transports (Task 20: what
+     * `acp.list` and the local fallback list that no live session holds — a previous daemon's keeper-acp sessions, swept or degraded
+     * sessions, local outboxes, migrated legacy journals).
      *
      * **The orphan half is what makes recovery automatic.** A journal whose agent is gone -- the
      * daemon restarted, or the machine rebooted -- is not in {@link sessions}, so before this it
@@ -254,9 +427,7 @@ export class AgentSessionManager {
      *
      * **Orphans carry `journalMaxSeq: 0`, and that is not a placeholder for a number worth reading.**
      * The server drives an orphan off `agentAlive` and its own live-turn ledger, never off a watermark
-     * comparison, so nothing reads the field. Filling it honestly would mean a `SessionJournal.init`
-     * per file -- each one reads the whole file, up to 64 MB -- on every agent-channel reconnect, to
-     * produce a number that is then discarded.
+     * comparison, so nothing reads the field.
      *
      * **Gated on {@link AGENT_WIRE_ORPHAN_OFFER_VERSION}, and that gate is load-bearing** in a way the
      * heartbeat-inventory floor is not: this widens the meaning of an existing list whose absence the
@@ -265,14 +436,22 @@ export class AgentSessionManager {
      * honest failure it produces today.
      */
     async resumeOfferSessions() {
-        const live = this.liveInventory();
+        // `true`: this is the once-per-connection offer, the one place `activityRaw` is allowed to
+        // ride — see {@link liveInventory}'s parameter doc for why {@link heartbeatInventory} must pass
+        // `false` at its own call site instead.
+        // Spec §5.5.2: every session keeper-acp kept is in the offer (a missing one has its turn ended) — rebuilt ones with their
+        // liveness, ones still rebuilding without `turnRunning`.
+        await this.adoptionSettled(ADOPTION_OFFER_WAIT_MS);
+        await this.adoptLate();
+        const live = [...this.liveInventory(true), ...this.adoptingInventory()];
         if (this.serverAgentWire < AGENT_WIRE_ORPHAN_OFFER_VERSION)
             return live;
         // Every ref this daemon still has a handle on, not merely the ones it would report as live:
         // a ref that is mid-open, mid-retire, or closed-but-not-yet-forgotten is one we are still the
         // owner of, and announcing it as abandoned invites a reopen against a session we hold.
-        const held = new Set([...this.sessions.keys(), ...this.opening.keys(), ...this.retiring.keys()]);
-        const orphans = await this.orphanedJournalRefs(held);
+        await this.migrateLegacyJournals();
+        const held = new Set([...this.sessions.keys(), ...this.opening.keys(), ...this.retiring.keys(), ...this.adopting.keys()]);
+        const orphans = await this.orphanedRefs(held);
         // `turnRunning: false` is an observation here, not a default: an orphan has no agent process at
         // all, so there is nothing that could be running on it.
         return [
@@ -281,42 +460,20 @@ export class AgentSessionManager {
         ];
     }
     /**
-     * Journal files on disk whose ref this daemon holds no handle for.
-     *
-     * Reads names only -- never contents. A directory that does not exist is the ordinary state of a
-     * daemon that has never opened a session, so it is not a warning; anything else is, but it still
-     * degrades to "offer what we hold" rather than failing the whole offer, because losing the live
-     * half of the inventory would be a far bigger regression than missing the orphan half.
+     * Transport sessions no live session holds (`AcpAgents.leftoverSessions`). A failure degrades to "offer what we hold" rather
+     * than failing the whole offer: losing the live half of the inventory would be a far bigger regression than missing the orphan
+     * half.
      */
-    async orphanedJournalRefs(held) {
-        let names;
+    async orphanedRefs(held) {
+        let keys;
         try {
-            names = await fs.readdir(this.sessionsDir);
+            keys = (await this.agents.leftoverSessions?.()) ?? [];
         }
         catch (error) {
-            if (error?.code !== 'ENOENT') {
-                console.warn(`[agent] listing journals for the resume offer failed: ${errorMessage(error)}`);
-            }
+            console.warn(`[agent] listing leftover sessions for the resume offer failed: ${errorMessage(error)}`);
             return [];
         }
-        const refs = [];
-        for (const name of names) {
-            if (!name.endsWith('.jsonl'))
-                continue;
-            let ref;
-            try {
-                ref = decodeURIComponent(name.slice(0, -'.jsonl'.length));
-            }
-            catch {
-                // Not a name this daemon wrote (`encodeURIComponent` never emits a malformed escape), so
-                // there is no ref behind it to offer.
-                continue;
-            }
-            if (!held.has(ref))
-                refs.push(ref);
-        }
-        // readdir order is filesystem-defined; the offer should not be.
-        return refs.sort();
+        return keys.filter((ref) => !held.has(ref)).sort();
     }
     /**
      * The live half, shared with the heartbeat -- which must stay synchronous and touch no disk.
@@ -327,20 +484,59 @@ export class AgentSessionManager {
      * here, and lands in exactly the same server-side branch as a journal left by a previous daemon
      * life -- which is the point: "the agent is gone" is one fact with one handling, not a special
      * case per way of getting there.
+     *
+     * @param includeActivity Whether to carry each session's {@link AcpAgentSession.activityRaw}
+     * along as `activityRaw`. **Must be `false` from {@link heartbeatInventory} and `true` from
+     * {@link resumeOfferSessions}, never the other way round** — `activityRaw` is an unbounded vendor
+     * blob, and `AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION`'s own doc comment already ruled that kind of
+     * cost off the heartbeat ("ten seconds of overhead forever is worth skipping"). Threading this as
+     * a required parameter at the one shared call site — rather than, say, a field this method reads
+     * off `this` — is what makes "never on a heartbeat" a fact about the call site instead of a fact
+     * someone has to remember to keep true.
      */
-    liveInventory() {
+    liveInventory(includeActivity) {
         return [...this.sessions.values()]
             .filter((session) => !session.closed)
             .map((session) => {
             const liveness = session.session.liveness;
             return {
                 sessionRef: session.sessionRef,
-                journalMaxSeq: session.journal.lastSeq,
-                agentAlive: liveness.agentAlive,
+                // The processor's head seq (spec §5.5.2): everything this session numbered, or its outbox held. A server below
+                // AGENT_WIRE_SCOPED_ORIGIN_VERSION never gets the scoped frames the processor numbered (they are withheld, a seq gap),
+                // so its watermark can never reach the head seq: it is told what the outbox recorded instead, or it would reopen the
+                // ref on every inventory.
+                journalMaxSeq: this.serverAgentWire < AGENT_WIRE_SCOPED_ORIGIN_VERSION ? session.session.outbox.lastSeq : session.session.headSeq,
+                // A ref being switched (Task 24) is idle by construction and alive on one process or the other.
+                agentAlive: liveness.agentAlive || this.switching.has(session.sessionRef),
                 turnRunning: liveness.turnRunning,
+                ...(includeActivity && session.session.activityRaw !== undefined
+                    ? { activityRaw: session.session.activityRaw }
+                    : {}),
+                // Task 22 (spec §5.5.4): a durable session's agent blocked on cards — the server reopens the ref when it already
+                // answered one of them (the answer this daemon may have lost is resent off that open). Only to a server that reads it.
+                ...(this.serverAgentWire >= AGENT_WIRE_REOPEN_REQUEST_VERSION && session.session.durable &&
+                    (session.session.pendingRequestIds?.length ?? 0) > 0
+                    ? { pendingRequestIds: [...session.session.pendingRequestIds] }
+                    : {}),
             };
         });
     }
+    /**
+     * Ask the server for `agent_open{requireSessionLoad:true}` on a live session (spec §6.3, `agent_reopen_request`): an idle
+     * session with a pending switch needs the spawn secrets only an open carries. Sent only to a server at
+     * {@link AGENT_WIRE_REOPEN_REQUEST_VERSION} — an older one cannot decode the frame, and eight undecodable frames in a row close
+     * the agent channel (spec §10: there the switch waits for the session's natural reopen). Returns whether it was sent: `false`
+     * for an older or unbound server and for a ref this daemon does not hold. The caller (Task 24) decides when.
+     */
+    requestReopen(sessionRef, reason) {
+        if (this.send === null || this.serverAgentWire < AGENT_WIRE_REOPEN_REQUEST_VERSION)
+            return false;
+        const live = this.sessions.get(sessionRef);
+        if (!live || live.closed)
+            return false;
+        this.emit({ t: 'agent_reopen_request', sessionRef, reason });
+        return true;
+    }
     /**
      * The same inventory, for the heartbeat that goes out every ten seconds.
      *
@@ -363,7 +559,8 @@ export class AgentSessionManager {
     heartbeatInventory() {
         if (this.serverAgentWire < AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION)
             return undefined;
-        const sessions = this.liveInventory();
+        // `false`: activityRaw must stay absent on every heartbeat — see `liveInventory`'s own doc.
+        const sessions = [...this.liveInventory(false), ...this.adoptingInventory()];
         return sessions.length > 0 ? sessions : undefined;
     }
     /**
@@ -371,7 +568,7 @@ export class AgentSessionManager {
      * the server advertised on this connection — the version is per-connection, so it is rebound with
      * the sender rather than set once.
      */
-    bindSend(send, serverAgentWire = AGENT_WIRE_VERSION) {
+    bindSend(send, serverAgentWire = AGENT_WIRE_VERSION, bufferedAmount) {
         if (this.mutedDrops > 0) {
             const seconds = this.mutedSinceMs === null ? '?' : ((Date.now() - this.mutedSinceMs) / 1000).toFixed(1);
             console.warn(`[agent] sender rebound after ${seconds}s unbound; ${this.mutedDrops} frame(s) were dropped while muted`);
@@ -380,21 +577,37 @@ export class AgentSessionManager {
         this.mutedSinceMs = null;
         this.send = send;
         this.serverAgentWire = serverAgentWire;
+        // A new connection: its own window and socket. What was sent on the previous one waits for the server's reopen to say how far
+        // it got; what was never sent goes out now.
+        this.epoch += 1;
+        for (const live of this.sessions.values())
+            live.session.outbox.connectionChanged();
+        this.gate.rebind(bufferedAmount);
         // Before any inbound frame on this connection can be answered: a sweep notice that arrived here
         // after the server had already re-opened its ref would invalidate a healthy generation.
         this.flushSwept();
+        this.pump();
+        // Account observations are outside the session journal. Replay the cached state on reconnect
+        // so a server restart does not depend on the provider sending another quota notification.
+        if (this.serverAgentWire >= 27)
+            for (const live of this.sessions.values()) {
+                if (!live.closed && live.session.accountLimits)
+                    this.emit({ t: 'agent_account_update', agentKey: live.agentKey, snapshot: live.session.accountLimits });
+            }
+        for (const ref of [...this.sessions.keys()])
+            this.flushAdapterLost(ref);
     }
     /**
      * Called when the websocket drops. Despite the name, this does **not** close agent sessions — the
      * agent subprocesses keep running so a reconnect can resume them. What it does is unbind the
      * sender, tombstone in-flight opens, and end in-flight *logins*.
      *
-     * Events produced while unbound are journaled and their `send` is a no-op; the server gets them
-     * back when it re-opens the ref with a `resumeFromSeq`.
+     * Events produced while unbound are recorded in their session's outbox and wait there; the server gets them when the sender is
+     * rebound, and again when it re-opens the ref with a `resumeFromSeq`.
      *
      * A login is the one piece of work here that cannot survive the drop, which is why it is the one
      * thing this really does end: its URL reaches the reader only as `agent_auth_url`, and that frame
-     * is not journaled the way session events are, so one emitted while unbound is gone rather than
+     * is not recorded the way session events are, so one emitted while unbound is gone rather than
      * replayed — leaving an agent subprocess held open, for up to `AGENT_LOGIN_CEILING_MS`, for a card
      * nobody will ever see. See {@link loginsInFlight}, and the comment at the abort itself for why it
      * is scoped to the teardown that actually unbinds.
@@ -402,7 +615,7 @@ export class AgentSessionManager {
      * In-flight opens are the other exception: the server fails its pending open with ok:false on
      * disconnect, so a session that finishes spawning after this point would be orphaned. Those refs
      * are tombstoned and the resulting bridge session is closed on arrival — but as `disconnected`,
-     * which keeps the journal: the server is coming back for it.
+     * which keeps the outbox: the server is coming back for it.
      */
     closeAll(boundSender) {
         // Unbinding is scoped to the connection that did the binding. The sender is one shared slot on
@@ -423,6 +636,8 @@ export class AgentSessionManager {
         // registered, and unknown to the server.
         if (boundSender === undefined || this.send === boundSender) {
             this.send = null;
+            this.epoch += 1;
+            this.gate.rebind(undefined);
             // Logins are the exception to "sessions keep running" — see {@link loginsInFlight}. Scoped to
             // the teardown that actually unbinds, unlike the tombstoning below: if a newer connection has
             // already rebound, this login's frames still have somewhere to go and killing it would be
@@ -433,13 +648,13 @@ export class AgentSessionManager {
                 login.abort();
         }
         for (const sessionRef of this.opening.keys()) {
-            // Never downgrade an explicit close into a disconnect: that would strand the journal.
+            // Never downgrade an explicit close into a disconnect: that would strand the outbox.
             if (!this.closedDuringOpen.has(sessionRef))
                 this.closedDuringOpen.set(sessionRef, 'disconnected');
         }
     }
     /**
-     * Awaits every queued journal write and the send behind it. Used by tests, and available to a
+     * Awaits every queued outbox write and the send behind it. Used by tests, and available to a
      * shutdown path that wants events on disk before the process exits.
      *
      * Bounded on purpose. A session that is actively streaming keeps appending to its own chain, so
@@ -452,27 +667,200 @@ export class AgentSessionManager {
         for (let round = 0; round < maxRounds; round += 1) {
             let progressed = false;
             for (const live of [...this.sessions.values()]) {
-                const chain = live.writes;
-                await chain;
-                if (live.writes !== chain)
+                const before = live.session.outbox.pending.length + live.session.outbox.lastSeq;
+                await live.session.outbox.flush();
+                if (live.session.outbox.pending.length + live.session.outbox.lastSeq !== before)
                     progressed = true;
             }
+            await new Promise((resolve) => setImmediate(resolve));
             if (!progressed)
                 return;
         }
     }
+    /**
+     * The daemon's start (Task 21, spec §5.5): adopt the sessions keeper-acp still runs from a previous daemon. Each is registered as
+     * a live session once rebuilt (frames it produces from then on are recorded and sent as any session's); until then the offer and
+     * the heartbeat report it without `turnRunning`, and frames for its ref wait for it. A session that cannot be continued is dropped
+     * (its adapter stopped, its outbox offered as an orphan). Once per manager; never rejects.
+     */
+    adoptSessions() {
+        this.adoption ??= (async () => {
+            const adopt = this.agents.adoptKeeperSessions?.bind(this.agents);
+            if (!adopt)
+                return;
+            let found;
+            try {
+                found = await adopt();
+            }
+            catch (error) {
+                console.warn(`[agent] adopting keeper-acp sessions failed: ${errorMessage(error)}`);
+                return;
+            }
+            await Promise.all(this.trackAdoptions(found));
+        })();
+        return this.adoption;
+    }
+    /** Registers each found session once rebuilt; until then it is `adopting` (offered without `turnRunning`, its frames wait). */
+    trackAdoptions(found) {
+        const done = [];
+        for (const candidate of found) {
+            if (this.sessions.has(candidate.sessionRef) || this.adopting.has(candidate.sessionRef))
+                continue;
+            const settled = candidate.session.then((session) => {
+                if (session)
+                    this.registerAdopted(candidate, session);
+            }, (error) => {
+                console.warn(`[agent] adopting ${candidate.sessionRef} failed: ${errorMessage(error)}`);
+            }).finally(() => { this.adopting.delete(candidate.sessionRef); });
+            this.adopting.set(candidate.sessionRef, { journalMaxSeq: candidate.journalMaxSeq, agentAlive: candidate.agentAlive !== false, done: settled });
+            done.push(settled);
+        }
+        return done;
+    }
+    /**
+     * Final review finding 3: a keeper-acp generation the start-time adoption could not list (it did not answer in time) is listed
+     * again — before a frame is handled, before the reconnect offer and on every switch poll — and what it holds is adopted like
+     * any start-time adoption, so its sessions are never offered as orphans nor reopened into a new spawn. Resolves once what the
+     * retry found is tracked (not rebuilt). Never rejects.
+     */
+    adoptLate() {
+        const retry = this.agents.retryKeeperAdoption?.bind(this.agents);
+        if (!retry || !this.adoption || !this.agents.keeperAdoptionPending?.())
+            return Promise.resolve();
+        this.lateAdoption ??= (async () => {
+            await this.adoption?.catch(() => undefined);
+            let found;
+            try {
+                found = await retry();
+            }
+            catch (error) {
+                console.warn(`[agent] retrying the keeper-acp adoption failed: ${errorMessage(error)}`);
+                return;
+            }
+            if (found.length > 0)
+                console.info(`[agent] adopted ${found.length} keeper-acp session(s) late: ${found.map((f) => f.sessionRef).join(', ')}`);
+            void Promise.all(this.trackAdoptions(found));
+        })().finally(() => { this.lateAdoption = undefined; });
+        return this.lateAdoption;
+    }
+    /** An adopted session joins like an opened one; the server reopens it (or not) from the offer. */
+    registerAdopted(candidate, session) {
+        if (this.sessions.has(candidate.sessionRef)) {
+            // Cannot happen (opens of an adopting ref wait for it); never hold two sessions under one ref.
+            void session.detach?.();
+            return;
+        }
+        let highestScopedJournalSeq = 0;
+        for (const item of session.outbox.pending) {
+            if (item.frame.t === 'agent_event' && item.frame.acpSessionId != null)
+                highestScopedJournalSeq = Math.max(highestScopedJournalSeq, item.seq);
+        }
+        const live = {
+            sessionRef: candidate.sessionRef, adopted: true, agentId: candidate.agentId, agentKey: candidate.agentKey, session,
+            nativeSessionId: session.nativeSessionId ?? null,
+            scopedReplayBlocked: false, highestScopedJournalSeq, unwatch: () => { }, replays: Promise.resolve(), closed: false,
+            lastActivityAt: Date.now(),
+        };
+        this.register(live);
+        console.info(`[acp:${live.agentId} agent:${live.agentKey}] adopted session ${live.sessionRef} from keeper-acp`);
+    }
+    /** Waits (bounded) for the start-time adoption; what is still rebuilding afterwards is reported as such. */
+    async adoptionSettled(timeoutMs) {
+        if (!this.adoption)
+            return;
+        let timer;
+        await Promise.race([this.adoption, new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); })]);
+        clearTimeout(timer);
+    }
+    /** Refs still being rebuilt, as inventory entries: alive, their outbox's head seq, and no `turnRunning` (not observed yet). */
+    adoptingInventory() {
+        return [...this.adopting.entries()].filter(([ref]) => !this.sessions.has(ref))
+            .map(([sessionRef, { journalMaxSeq, agentAlive }]) => ({ sessionRef, journalMaxSeq, agentAlive }));
+    }
+    /**
+     * The daemon is going away (SIGTERM, spec §5.5.5): every durable (keeper-hosted) session is detached — head checkpoint, adapter
+     * untouched, no failed turn — and the others cut a head checkpoint (their adapters end with the daemon, their outboxes are kept).
+     * Bounded by `timeoutMs`.
+     */
+    async detachAll(timeoutMs = 2_000) {
+        // Sessions still being adopted are not in `sessions` and are skipped. Harmless: an adoption writes no checkpoint of its own and
+        // holds nothing the next daemon cannot rebuild the same way (the adapter runs on in keeper-acp, the logs are durable); if one
+        // registers after this, the transports are closed right behind it and its loop stops quietly (`KeeperClosedError`).
+        const work = [...this.sessions.values()].map((live) => (live.session.durable && live.session.detach
+            ? this.retire(live, 'detach')
+            : live.session.checkpoint?.())?.catch((err) => {
+            console.warn(`[agent] leaving ${live.sessionRef} to the next daemon failed: ${errorMessage(err)}`);
+        }));
+        let timer;
+        await Promise.race([Promise.all(work), new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); })]);
+        clearTimeout(timer);
+    }
     async handleFrame(frame) {
+        // A frame for a ref keeper-acp still runs from a previous daemon waits until that session is rebuilt (Task 21): answering
+        // it "unknown session" would end a turn that is going on.
+        const frameRef = 'sessionRef' in frame && typeof frame.sessionRef === 'string' ? frame.sessionRef : undefined;
+        // A generation the adoption could not list yet may hold this ref (final review finding 3): listed again first (synchronous check).
+        if (frameRef !== undefined && !this.liveSession(frameRef) && this.agents.keeperAdoptionPending?.())
+            await this.adoptLate();
+        const adoptingRef = frameRef !== undefined ? this.adopting.get(frameRef) : undefined;
+        if (adoptingRef)
+            await adoptingRef.done;
+        // Parked while the ref is switched (spec §6.3 step 1): delivered, in arrival order, to whichever session holds it afterwards.
+        for (let parked = frameRef !== undefined ? this.switching.get(frameRef) : undefined; parked; parked = this.switching.get(frameRef))
+            await parked;
         switch (frame.t) {
+            case 'agent_delegation_renew': {
+                if (this.serverAgentWire < AGENT_WIRE_DELEGATION_RENEW_VERSION)
+                    return;
+                const live = this.liveSession(frame.sessionRef);
+                const now = Date.now();
+                // Delegation's non-secret fields are processor state (Task 19): the checks read it, an accepted renewal is a note.
+                const delegation = live?.session.delegation ?? undefined;
+                if (!live || !delegation || live.closed || !live.session.liveness.agentAlive || live.session.liveness.turnRunning ||
+                    activityIsBusy(live.session.activityRaw) || delegation.refreshPending ||
+                    live.nativeSessionId !== frame.nativeSessionId || delegation.instanceId !== frame.instanceId ||
+                    delegation.bindingId !== frame.bindingId || !frame.bindingId ||
+                    !Number.isSafeInteger(frame.renewalRevision) || frame.renewalRevision < 1 ||
+                    !Number.isSafeInteger(frame.expiresAtEpochMs) || frame.expiresAtEpochMs <= now ||
+                    frame.expiresAtEpochMs > now + 330_000 || frame.renewalRevision < (delegation.renewalRevision ?? 0) ||
+                    frame.expiresAtEpochMs < delegation.expiresAtEpochMs ||
+                    (frame.renewalRevision === delegation.renewalRevision && frame.expiresAtEpochMs !== delegation.expiresAtEpochMs)) {
+                    this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: false, error: 'The original managed instance cannot renew' });
+                    return;
+                }
+                try {
+                    await live.session.note({ type: 'agent_delegation_renewed', expiresAtEpochMs: frame.expiresAtEpochMs, renewalRevision: frame.renewalRevision });
+                }
+                catch (err) {
+                    this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: false, error: errorMessage(err) });
+                    return;
+                }
+                const renewed = live.session.delegation ?? delegation;
+                this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: true,
+                    nativeSessionId: live.nativeSessionId, instanceId: renewed.instanceId, bindingId: renewed.bindingId,
+                    renewalRevision: renewed.renewalRevision, expiresAtEpochMs: renewed.expiresAtEpochMs });
+                return;
+            }
             case 'agent_open': {
                 const admission = this.reserveOpen(frame.id, frame.sessionRef);
                 if (admission === 'rejected')
                     return;
+                const ref = frame.sessionRef;
+                this.openHandling.set(ref, (this.openHandling.get(ref) ?? 0) + 1);
                 try {
                     await this.onOpen(frame);
                 }
                 finally {
                     if (admission === 'reserved')
-                        this.tasks?.agentOpenFinished(frame.sessionRef);
+                        this.tasks?.agentOpenFinished(ref);
+                    const left = (this.openHandling.get(ref) ?? 1) - 1;
+                    if (left > 0)
+                        this.openHandling.set(ref, left);
+                    else
+                        this.openHandling.delete(ref);
+                    // An adapter that exited while this open was handled (a respawn that died right after its load) is reported after the
+                    // reply: reported before it, the server would void the generation it is establishing.
+                    this.flushAdapterLost(ref);
                 }
                 return;
             }
@@ -480,19 +868,15 @@ export class AgentSessionManager {
                 const live = this.routableSession(frame.sessionRef, 'prompt');
                 if (!live)
                     return;
-                if (this.tasks && !this.tasks.agentTurnStarted(frame.sessionRef)) {
-                    // No `authMethods` here, deliberately, even though this is a failed turn on a session
-                    // whose agent we have certainly connected to: the prompt never reached that agent, so
-                    // nothing about credentials is being reported. This frame is built here rather than in
-                    // `onAgentTurnDone`, so it never passes the {@link TurnResult.agentRefused} gate — the
-                    // omission is structural, not a line someone has to remember.
-                    this.record(live, (seq) => ({
-                        t: 'agent_turn_done', sessionRef: frame.sessionRef, seq, status: 'failed',
-                        error: 'Workstation is not accepting new work',
-                    }));
+                if (this.tasks && !this.tasks.tryAdmitTurn(frame.sessionRef)) {
+                    // The refusal is the daemon's decision, so it is a note (`agent_prompt{admitted:false}`) and the processor ends the
+                    // turn `failed` with the same words (`ADMISSION_REFUSED`), numbered in the session's own sequence (spec §5.4). No
+                    // `authMethods`: the processor's short frame carries no `agentRefused`, so the projection adds none — the prompt
+                    // never reached the agent.
+                    live.session.refusePrompt(frame.platformTurnId);
                     return;
                 }
-                live.session.prompt(promptBlocks(frame));
+                live.session.prompt(promptBlocks(frame), frame.platformTurnId);
                 return;
             }
             case 'agent_answer': {
@@ -500,6 +884,28 @@ export class AgentSessionManager {
                 live?.session.answer(frame.requestId, frame.outcome);
                 return;
             }
+            case 'agent_elicitation_answer': {
+                const live = this.routableSession(frame.sessionRef, 'elicitationAnswer');
+                if (!live)
+                    return;
+                if (!isKnownElicitationAction(frame.action)) {
+                    // `AGENT_FRAME_SHAPES` only validates `action` as *a* string (ACP's own action union has
+                    // an open `string` arm for agent-authored custom actions), but this daemon is the only
+                    // sender of this frame and the server only ever offers the user accept/decline/cancel —
+                    // so anything else reaching here is a platform bug (a typo, a stale enum), not a
+                    // legitimate custom action. Declining rather than forwarding it verbatim keeps the agent
+                    // from being handed a value ACP itself would still accept as "protocol-valid" — the exact
+                    // shape `isString`-only validation cannot catch on its own.
+                    console.warn(`[agent] agent_elicitation_answer for '${frame.sessionRef}' carried an unrecognised action '${frame.action}'; declining instead of forwarding it`);
+                    live.session.answerElicitation(frame.requestId, { action: 'decline' });
+                    return;
+                }
+                live.session.answerElicitation(frame.requestId, {
+                    action: frame.action,
+                    ...(frame.content ? { content: frame.content } : {}),
+                });
+                return;
+            }
             case 'agent_interrupt': {
                 const live = this.routableSession(frame.sessionRef, 'interrupt');
                 if (!live)
@@ -513,16 +919,92 @@ export class AgentSessionManager {
                 return;
             }
             /**
-             * A steer rides a turn that is **already** running, so it is deliberately not bracketed by
-             * `tasks.agentTurnStarted` / `agentTurnFinished` the way `agent_prompt` is: the agent still
-             * answers exactly one `session/prompt` and still sends exactly one `agent_turn_done`, so
-             * there is no second completion to close a second bracket with.
+             * Stop **one** background task, leaving the running turn alone — ACP's
+             * `_session/async_task/stop`. The server sends this instead of marking its JOB row cancelled
+             * behind the agent's back, which is what it used to do: the row went terminal, the task kept
+             * running, and the UI said "stopped" while the truth was "still running".
+             *
+             * Doesn't touch `busy()`'s inputs, for the reason `agent_steer` documents at length: this is
+             * not a turn, so it must not push {@link AcpSession.inFlightTurns} — `busy()` is sampled live
+             * off that array and the agent's reported activity (2026-09-21 rewrite, no accumulator to
+             * leak any more), and `stopAsyncTask()` deliberately does none of that bookkeeping, same as
+             * `steer()` (see `AcpSession.stopAsyncTask`'s own doc).
+             *
+             * **No reply frame, so a failure can only be logged** — and that is by design for the ordinary
+             * case, not an omission (see `agent_async_task_stop`'s own doc in `protocol/agent.ts`): the
+             * question the server is waiting on is not "did the request arrive" but "did the task actually
+             * stop", and only the agent's own next `async_task_state_update` for this
+             * `(sessionRef, asyncTaskId)` answers it. That update travels the ordinary event stream and
+             * settles the JOB there.
+             *
+             * ## Known gap: a refusal here is invisible to the server
+             *
+             * A `Method not found` from an agent that advertised a name we have a collector for but does
+             * not implement `_session/async_task/stop` lands in this catch and goes no further. The server
+             * recorded a "Stop requested" note on that JOB and will now wait for a terminal update that is
+             * never coming; nothing on that side says why.
+             *
+             * **Narrow today, and deliberately not papered over.** The server only sends this frame to a
+             * session whose `agent_opened` explicitly reported `supportsAsyncTaskStop`, from the
+             * certified `InitializeResponse.agentInfo.name` compatibility map — and both adapters
+             * implement the method (verified: `acp-agent.js@0.79.0:165`,
+             * `codex-acp@1.12.0 dist/index.js:31608`). So the gap opens only if one of them drops the
+             * method in a future version, or a third-party agent adopts one of those names.
+             *
+             * **Why it is not closed here**: the only honest thing to report is "the stop request was
+             * refused; the task is still running", and this daemon has no channel that can carry it. The
+             * frame has no reply; synthesizing an `async_task_state_update` would invent a terminal state
+             * the agent never reported, which is the exact lie this whole path was built to remove; and a
+             * new event name or a reply frame is a wire-contract change that belongs in a reviewed task,
+             * not in a fix applied to one. Tracked as a Task 8 acceptance item. Until then this log line
+             * is the only evidence, so it names the consequence rather than just the error.
+             */
+            case 'agent_async_task_stop': {
+                const live = this.routableSession(frame.sessionRef, 'async_task_stop');
+                if (!live)
+                    return;
+                try {
+                    if (!live.nativeSessionId || !supportsAsyncTaskStop(live.session.agentInfo?.name) || !frame.asyncTaskId.trim()) {
+                        throw new Error('No certified task-stop route and exact target for this session');
+                    }
+                    await live.session.stopAsyncTask(frame.asyncTaskId);
+                }
+                catch (err) {
+                    console.error(`[agent] stopping background task ${frame.asyncTaskId} failed for ${frame.sessionRef}: ` +
+                        `${errorMessage(err)} -- the task is still running and the server will keep waiting ` +
+                        'for a terminal update it will never receive');
+                }
+                return;
+            }
+            case 'agent_provider_task_stop': {
+                if (this.serverAgentWire < AGENT_WIRE_PROVIDER_TASK_VERSION) {
+                    this.emit({ t: 'agent_provider_task_stopped', id: frame.id, state: 'rejected', error: 'Provider task control requires a newer server' });
+                    return;
+                }
+                // No session selects a provider-task adapter (none ever did: the old path's `providerTaskAdapterSelected` had no
+                // producer that set it, and it went with that path in Task 29), so no task identity is ever live and trusted. The
+                // wire answer is unchanged, and so is the routing (an unknown ref is still reported lost).
+                this.routableSession(frame.sessionRef, 'provider_task_stop');
+                this.emit({ t: 'agent_provider_task_stopped', id: frame.id, state: 'rejected', error: 'Provider task identity is not live and trusted' });
+                return;
+            }
+            /**
+             * A steer rides a turn that is **already** running, so it must not push
+             * {@link AcpSession.inFlightTurns} the way `agent_prompt` does: `steer()` sends exactly one
+             * extension request and gets exactly one reply, not a second `agent_turn_done`, so there is
+             * no second completion to pop a second entry with.
              *
-             * The leak that would open is not hypothetical. The server steers whenever **it** believes a
-             * turn is running, and the agent is free to disagree and answer `promptRequired` — a steer on
-             * an idle session. Nothing will ever send a `turn_done` for that one, so the sessionRef would
-             * sit in `TaskRegistry`'s agent-task set forever and `canUpdate()` would be false for the rest
-             * of this daemon's life. Same shape as the hung-prompt leak `readLoopDead` exists for.
+             * That distinction used to matter for a leak that was not hypothetical, and still explains why
+             * `steer()` pushes nothing today. The server steers whenever **it** believes a turn is
+             * running, and the agent is free to disagree and answer `promptRequired` — a steer on an idle
+             * session. Under the old bracketed `TaskRegistry.agentTasks` (removed 2026-09-21), nothing
+             * would ever send a `turn_done` to close that bracket, so the sessionRef sat there forever and
+             * `canUpdate()` stayed `false` for the rest of the daemon's life — the same shape as the
+             * hung-prompt leak `readLoopDead` exists for. `busy()` is sampled live today, off
+             * {@link AcpSession.turnRunning} and the agent's own reported activity, with no set to leave a
+             * ref in — but that safety is a property of `busy()`'s inputs, not of this call site, so
+             * `steer()` still deliberately pushes nothing to {@link AcpSession.inFlightTurns} (see its own
+             * doc): an idle-session steer must not be mistaken for the start of a turn.
              *
              * Every exit answers. The server is holding the steered message in its own queue table
              * (`session_message_queue`) while this request is in flight — the message is not on the
@@ -545,7 +1027,7 @@ export class AgentSessionManager {
                         // — see {@link promptBlocks}. `frame.priority` is passed through untouched, `undefined`
                         // included: absent means the server named no timing, and inventing one here would be
                         // this daemon deciding something the server deliberately left unsaid.
-                        outcome: await live.session.steer(promptBlocks(frame), frame.priority),
+                        outcome: await live.session.steer(promptBlocks(frame), frame.priority, frame.id),
                     });
                 }
                 catch (err) {
@@ -559,10 +1041,12 @@ export class AgentSessionManager {
             /**
              * Set one session config option, round-tripping ACP `session/set_config_option`. Same shape
              * as `agent_steer` immediately above, and for the same reason: this is a real round trip the
-             * server is blocked waiting on, not a turn, so it is not bracketed by
-             * `tasks.agentTurnStarted` / `agentTurnFinished` — there is no second completion to close a
-             * second bracket with, and a bracket opened here would never close, leaking the ref for the
-             * life of the daemon.
+             * server is blocked waiting on, not a turn, so it must not push
+             * {@link AcpSession.inFlightTurns} — there is no second `agent_turn_done` to pop it with, and
+             * `busy()` is sampled live off that array plus the agent's own reported activity (2026-09-21
+             * rewrite: no accumulator here any more), so a push with nothing to pop it would pin a session
+             * "busy" for the life of the daemon exactly the way the old bracketed `TaskRegistry.agentTasks`
+             * used to leak.
              *
              * Every exit answers: a session that is not routable, an agent that throws (its own refusal,
              * or `Method not found` from one that never advertised the method), all send
@@ -575,11 +1059,16 @@ export class AgentSessionManager {
                     this.emit({ t: 'agent_config_option_set', id: frame.id, ok: false, error: `no live session '${frame.sessionRef}'` });
                     return;
                 }
+                const startedAt = performance.now();
+                const operation = `request=${frame.id} session=${frame.sessionRef} config=${frame.configId}`;
+                console.info(`${new Date().toISOString()} [agent/config] applying ${operation}`);
                 try {
-                    const configOptions = await live.session.setConfigOption(frame.configId, frame.value);
+                    const configOptions = await live.session.setConfigOption(frame.configId, frame.value, frame.id);
+                    console.info(`${new Date().toISOString()} [agent/config] confirmed ${operation} elapsedMs=${Math.round(performance.now() - startedAt)}`);
                     this.emit({ t: 'agent_config_option_set', id: frame.id, ok: true, configOptions });
                 }
                 catch (err) {
+                    console.warn(`${new Date().toISOString()} [agent/config] failed ${operation} elapsedMs=${Math.round(performance.now() - startedAt)}: ${errorMessage(err)}`);
                     // Includes the agent's own refusal ("Invalid value…", "Unknown config option…") and a
                     // `Method not found` from an agent without the method — both are the server's to show.
                     this.emit({ t: 'agent_config_option_set', id: frame.id, ok: false, error: errorMessage(err) });
@@ -596,7 +1085,7 @@ export class AgentSessionManager {
                 if (!live)
                     return;
                 this.touch(live);
-                await this.enqueue(live, () => live.journal.truncateThrough(frame.throughSeq));
+                await this.acknowledge(live, frame.throughSeq);
                 return;
             }
             case 'agent_list_native':
@@ -606,8 +1095,37 @@ export class AgentSessionManager {
                 }
                 await this.onListNative(frame);
                 return;
+            case 'agent_delete_native':
+                if (this.tasks && !this.tasks.accepting) {
+                    this.emit({ t: 'agent_native_deleted', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
+                    return;
+                }
+                await this.onDeleteNative(frame);
+                return;
             // Both of these spawn an agent subprocess, exactly as `agent_list_native` does, so they answer
             // a draining workstation the same way rather than starting work it is trying to finish.
+            case 'agent_account_read': {
+                if (this.tasks && !this.tasks.accepting) {
+                    this.emit({ t: 'agent_account_read_result', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
+                    return;
+                }
+                try {
+                    // A keeper session may predate the extension even after its current adapter build was upgraded.
+                    const spec = sanitizeNativeSessionQuery(frame.bridge, frame.query);
+                    if (!spec)
+                        throw new Error('No workspace is available');
+                    const minimumVersion = await this.agents.minimumAccountLimitsVersion?.(spec) ?? 2;
+                    const live = [...this.sessions.values()].find(live => live.agentKey === frame.agentKey && !live.closed && live.session.liveness.agentAlive && live.session.supportsAccountLimits === true && (live.session.accountLimitsVersion ?? 2) >= minimumVersion);
+                    if (!live?.session.readAccountLimits && !this.agents.readAccountLimits)
+                        throw new Error('Account usage is unsupported');
+                    const snapshot = live?.session.readAccountLimits ? await live.session.readAccountLimits(frame.id) : await this.agents.readAccountLimits(spec);
+                    this.emit({ t: 'agent_account_read_result', id: frame.id, ok: true, snapshot });
+                }
+                catch {
+                    this.emit({ t: 'agent_account_read_result', id: frame.id, ok: false, error: 'Failed to fetch usage' });
+                }
+                return;
+            }
             case 'agent_verify':
                 if (this.tasks && !this.tasks.accepting) {
                     this.emit({ t: 'agent_verified', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
@@ -631,32 +1149,150 @@ export class AgentSessionManager {
                 }
                 await this.onInstall(frame);
                 return;
+            // "Move idle sessions" (Task 25): a move spawns adapters, so a draining workstation refuses it like an install.
+            case 'agent_switch_idle':
+                if (this.tasks && !this.tasks.accepting) {
+                    this.emit({ t: 'agent_switch_idle_result', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
+                    return;
+                }
+                await this.onSwitchIdle(frame);
+                return;
             default:
-                // Not an agent frame (or an outbound-only one) — the daemon routes those elsewhere.
+                this.warnUnhandledFrame(frame);
                 return;
         }
     }
+    /** Frame types already reported as having no case on this daemon; see {@link warnUnhandledFrame}. */
+    warnedUnhandledFrameTypes = new Set();
+    /**
+     * Say once, per frame type, that a frame reached this dispatcher and nothing acted on it.
+     *
+     * **This used to be a bare `return` with a comment.** That silence is the exact half of the wire
+     * this side had no alarm for: `agent_async_task_stop` is the first server->client request frame
+     * whose only consumer is the `switch` above, so a version of this daemon that shipped the sending
+     * half without the receiving one would have dropped every stop request with no type error, no log
+     * line and no timeout — "shipped inert", and invisible. The Kotlin twin
+     * (`AgentChannelSession.warnUnhandledFrame`) has been loud here since the `ec341b8e4` incident,
+     * where three reply frames were dropped before their handler and three features were inert on
+     * every workstation from the day they shipped; this is the same alarm on the other end.
+     *
+     * Deduplicated by type rather than logged per frame, exactly as the Kotlin twin does it: the
+     * diagnosis is "this type has no case", and repeating it per frame would bury it.
+     *
+     * One benign arrival is possible and is deliberately **not** exempted: a `heartbeat_ack` for a seq
+     * the channel no longer has outstanding slips past `connectEncryptedChannel`'s ack filter and
+     * lands here. That costs one line for the life of the process, and an exemption list would be a
+     * second, parallel statement of which frames this daemon handles — precisely the hand-maintained
+     * copy `AGENT_FRAME_SHAPES`'s own doc exists to avoid.
+     */
+    warnUnhandledFrame(frame) {
+        if (this.warnedUnhandledFrameTypes.has(frame.t))
+            return;
+        this.warnedUnhandledFrameTypes.add(frame.t);
+        console.warn(`[agent] no case for an inbound '${frame.t}'; it reached this daemon and nothing consumed it`);
+    }
     /**
      * Classifies an open before its first await. A live or already-opening ref is continuation
      * traffic, so graceful drain lets it replay/piggyback without acquiring (and later releasing)
      * another reservation. Force-stop is different: it is destructive shutdown and rejects every
-     * open, including reconnects. A ref absent from both maps is genuinely new work and still needs
+     * open, including reconnects — except a reconnect of a live keeper-hosted session, which the force
+     * stop leaves attached. A ref absent from both maps is genuinely new work and still needs
      * the ordinary TaskRegistry admission reservation.
      */
     reserveOpen(openId, sessionRef) {
         if (!this.tasks)
             return 'continuation';
+        const live = this.liveSession(sessionRef);
+        // A keeper-hosted session whose adapter is gone is respawned by this open: new work, not a continuation — it takes a reservation,
+        // and a draining workstation refuses it like any open (spec §8.2; fix round 1, minor 9).
+        const respawn = live !== undefined && this.needsRespawn(live);
         if (this.tasks.isForceStopping()) {
+            // A keeper-hosted session a force update left attached (TaskRegistry.stopAll) is still reopened as a continuation — a reconnect
+            // during the download must not cut it off; anything else is refused.
+            if (live && !respawn && this.tasks.isDurableSession(sessionRef))
+                return 'continuation';
             this.emit({ t: 'agent_opened', id: openId, ok: false, error: 'Workstation is not accepting new work' });
             return 'rejected';
         }
-        if (this.liveSession(sessionRef) || this.opening.has(sessionRef))
+        if ((live && !respawn) || this.opening.has(sessionRef) || this.adopting.has(sessionRef))
             return 'continuation';
         if (this.tasks.tryReserveAgentOpen(sessionRef))
             return 'reserved';
         this.emit({ t: 'agent_opened', id: openId, ok: false, error: 'Workstation is not accepting new work' });
         return 'rejected';
     }
+    /**
+     * A session whose adapter is gone: an `agent_open` of it spawns and loads anew (Task 21) — keeper-hosted or adopted, and also a
+     * local-fallback session whose adapter exited (it would otherwise be "reused" dead).
+     */
+    needsRespawn(live) {
+        const exited = live.session.adapterExit !== undefined;
+        return (live.adopted === true || live.session.durable === true || exited) && !live.session.liveness.agentAlive;
+    }
+    /**
+     * The adapter of `live` exited under its loop, and its frames (a failed `turn_done` for an open turn) are recorded. Unless this
+     * daemon stopped it (`terminated`: a close, a switch, a retire), the session cannot take another prompt: the server is told it is
+     * lost (`agent_session_lost{sweep}` — the poison contract's recovery, spec §11 "single adapter crash"), so its next prompt opens
+     * first, and that `agent_open` respawns the adapter and loads the native session ({@link needsRespawn}). The session stays held
+     * (reported `agentAlive:false`) until then. An exit of its own also counts towards {@link ADAPTER_CRASH_LIMIT}.
+     */
+    onAdapterExited(live, exit) {
+        const ref = live.sessionRef;
+        if (exit.reason === 'terminated')
+            return;
+        if (live.closed || this.sessions.get(ref) !== live || this.detached.has(ref))
+            return;
+        const how = exitWords(exit);
+        if (exit.reason === undefined) {
+            const now = Date.now();
+            const last = this.adapterCrashes.get(ref);
+            const count = last && now - last.lastAt < ADAPTER_CRASH_FORGET_MS ? last.count + 1 : 1;
+            this.adapterCrashes.set(ref, { count, lastAt: now, detail: how });
+        }
+        console.warn(`[acp:${live.agentId} agent:${live.agentKey}] the adapter of session ${ref} exited ` +
+            `(${exit.reason ?? 'on its own'}; ${how})${exit.busy ? ' while a turn or card was open' : ''}; its next open respawns it`);
+        // Everything the exit produced (the failed `turn_done`) is in the outbox by now: the notice waits until it has been sent.
+        live.adapterLost = { spawnId: exit.spawnId, reason: exit.reason, busy: exit.busy, notified: false, throughSeq: live.session.outbox.lastSeq };
+        this.flushAdapterLost(ref);
+    }
+    /**
+     * Sends the lost notice of the session holding `ref` ({@link onAdapterExited}) once it cannot overtake anything: no open, switch
+     * or retire of the ref under way (the open's own reply goes first), and every frame the exit produced (`throughSeq`: its failed
+     * `turn_done`) already sent **on this connection** — the outbox pump holds frames behind the session window and the socket gate,
+     * while this notice is sent directly. Overtaken, the server would end the turn itself, drop the `turn_done` unacknowledged, and
+     * the reopen's replay of it would end the NEXT turn. Re-checked whenever the pump sends for the ref, after an open, and after a
+     * rebind. Not queued while unbound ({@link sweptWhileUnsent}): a new connection leaves the server's delivery unwired anyway, and
+     * entries sent on an earlier one are held until its reopen — which respawns the adapter and retires this session.
+     */
+    flushAdapterLost(ref) {
+        const live = this.liveSession(ref);
+        const lost = live?.adapterLost;
+        if (!live || !lost || lost.notified || this.send === null)
+            return;
+        if (this.opening.has(ref) || this.openHandling.has(ref) || this.switching.has(ref) || this.retiring.has(ref))
+            return;
+        if (live.session.liveness.agentAlive)
+            return;
+        if (live.session.outbox.pending.some((item) => item.seq <= lost.throughSeq && item.sentOn !== this.epoch))
+            return;
+        lost.notified = true;
+        this.reportSessionLost(ref, AgentSessionManager.SWEEP_LOST_ACTION);
+    }
+    /**
+     * Why an open of `ref` may not respawn its adapter now ({@link ADAPTER_CRASH_LIMIT}), or `undefined`. The text is what the user's
+     * failed message shows.
+     */
+    adapterCrashHold(ref, now) {
+        const crashes = this.adapterCrashes.get(ref);
+        if (!crashes || crashes.count < ADAPTER_CRASH_LIMIT || now - crashes.lastAt >= ADAPTER_CRASH_FORGET_MS)
+            return undefined;
+        const backoff = Math.min(this.adapterCrashBackoffMs * 2 ** (crashes.count - ADAPTER_CRASH_LIMIT), ADAPTER_CRASH_BACKOFF_MAX_MS);
+        const wait = crashes.lastAt + backoff - now;
+        if (wait <= 0)
+            return undefined;
+        return `The agent's adapter process exited on its own ${crashes.count} times in a row (last: ${crashes.detail}); ` +
+            `it is not started again for another ${Math.ceil(wait / 1000)} s.`;
+    }
     /**
      * Everything a failure frame says about a refusal **the agent itself** produced: the sign-in table
      * it advertised, and the JSON-RPC code it answered with.
@@ -715,7 +1351,12 @@ export class AgentSessionManager {
      */
     routableSession(sessionRef, action) {
         const live = this.liveSession(sessionRef);
-        if (!live) {
+        if (!live && this.detached.has(sessionRef)) {
+            // Left to the next daemon (spec §5.5.5): it continues the session, so it is not lost. An answer dropped here is resent by the
+            // server off the next `agent_opened.pendingRequestIds`.
+            console.warn(`[agent] dropped ${action} for '${sessionRef}': the session was handed to the next daemon`);
+        }
+        else if (!live) {
             console.warn(`[agent] dropped ${action} for unknown session '${sessionRef}'`);
             this.reportSessionLost(sessionRef, action);
         }
@@ -805,24 +1446,38 @@ export class AgentSessionManager {
      * `now` is a parameter rather than a clock read so the sweep is deterministic under test.
      * The teardown is deliberately the same one `agent_close` performs ({@link retire}) — a swept
      * session must leave nothing behind that a later frame could resurrect — with one deliberate
-     * exception: **the journal survives**.
+     * exception: **the outbox survives**.
      *
      * That exception is the difference between `agent_close` and this sweep. `agent_close` is the
-     * server saying "I am done with this ref", so its journal can never be asked for again. A sweep is
+     * server saying "I am done with this ref", so its outbox can never be asked for again. A sweep is
      * unilateral: the server has not asked for anything and may well re-open the ref with a
-     * `resumeFromSeq` the moment it next hears from the user. The sweep also fires precisely when a
-     * journal is most likely to be holding undelivered output — the workstation was offline past the
-     * TTL (a laptop shut overnight), so a turn that finished while the socket was down is journaled
-     * and unsent. Destroying it there loses that turn outright, and `droppedOldest` is per-instance so
-     * not even a transport-gap card would mark the hole. The same distinction already exists one layer
+     * `resumeFromSeq` the moment it next hears from the user. The sweep also fires precisely when an
+     * outbox is most likely to be holding undelivered output — the workstation was offline past the
+     * TTL (a laptop shut overnight), so a turn that finished while the socket was down is recorded
+     * and unsent. Destroying it there loses that turn outright. The same distinction already exists one layer
      * up as {@link AbandonReason}; a sweep is `disconnected`-shaped, not `closed`-shaped. Kill the
-     * process, keep the file.
+     * process, keep the outbox (the transport session; its next open reuses it).
      *
      * Each sweep also reports itself to the server ({@link notifySwept}) so its stale session state is
      * retired before the next user message runs into it, rather than after — the sweep heals the
      * daemon's side of the divergence; the notice heals the server's.
      */
     async sweepIdle(ttlMs, now) {
+        // Observation, not a decision: a session the agent still claims is `running` is never swept
+        // for that alone (ruling A forbids inventing a timeout that overrides the vendor), but one
+        // that has gone this long without another push is worth naming in the log so whoever is
+        // debugging a stuck workstation can see it instead of just trusting a RUNNING that never moves.
+        for (const live of this.sessions.values()) {
+            if (!live.staleActivityWarned &&
+                activityIsBusy(live.session.activityRaw) &&
+                live.lastActivityAtMs !== undefined &&
+                now - live.lastActivityAtMs > STALE_ACTIVITY_WARN_MS) {
+                live.staleActivityWarned = true;
+                console.warn(`[acp:${live.agentId} agent:${live.agentKey}] session ${live.sessionRef} has reported \`running\` ` +
+                    `for ${Math.round((now - live.lastActivityAtMs) / 60000)} minutes with no further push; ` +
+                    'the platform is reporting it as RUNNING because that is what the agent said.');
+            }
+        }
         const idle = [...this.sessions.values()].filter((live) => now - live.lastActivityAt >= ttlMs);
         // Snapshot first: retire() mutates `sessions`, and it awaits.
         for (const live of idle) {
@@ -835,28 +1490,115 @@ export class AgentSessionManager {
         return idle.map((live) => live.sessionRef);
     }
     async onOpen(frame) {
-        // Reconnect / duplicate open: reuse the live session as-is and replay what the server
-        // still misses.
-        const existing = this.liveSession(frame.sessionRef);
-        if (existing) {
-            // Reusing a live session: neither the process nor the native session moved.
-            await this.resumeAndReply(existing, frame, false);
-            // The session already exists, so any history it has was already streamed under whichever
-            // open first established it (or never will be, if that open didn't ask for it) — replaying it
-            // again here would duplicate what the platform already holds. But if THIS frame asked for
-            // backfill, the server is waiting on exactly one `agent_backfill_done` for THIS open's id:
-            // silence is not "no", it is a wait that never resolves. Answer it without replaying.
-            this.replyNoReplayNeeded(frame);
+        if (frame.delegationMcp && (this.serverAgentWire < AGENT_WIRE_DELEGATION_MCP_VERSION ||
+            (frame.delegationMcp.bindingId && this.serverAgentWire < AGENT_WIRE_DELEGATION_RENEW_VERSION))) {
+            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation requires a newer server' });
             return;
         }
+        if (frame.delegationMcp) {
+            try {
+                buildSessionMcpServers([], frame.delegationMcp);
+            }
+            catch {
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Delegation MCP configuration is unavailable' });
+                return;
+            }
+        }
+        // Rotation is server-driven. A busy reconnect resends the original process's outbox.
+        let existing = this.liveSession(frame.sessionRef);
+        // An open that would spawn the ref's adapter anew after it kept exiting on its own waits out the backoff (no crash loop).
+        if (existing && this.needsRespawn(existing) && !this.opening.has(frame.sessionRef)) {
+            const held = this.adapterCrashHold(frame.sessionRef, Date.now());
+            if (held) {
+                // Rate-limited: the server's heartbeat may retry the open every ten seconds for the whole backoff.
+                const now = Date.now();
+                const crashes = this.adapterCrashes.get(frame.sessionRef);
+                if (crashes && now - (crashes.warnedAt ?? -Infinity) >= ADAPTER_CRASH_WARN_EVERY_MS) {
+                    crashes.warnedAt = now;
+                    console.warn(`[agent] ${frame.sessionRef}: not respawning its adapter: ${held}`);
+                }
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: held });
+                if (frame.backfill)
+                    this.emit({ t: 'agent_backfill_done', id: frame.id, ok: false, count: 0, error: held });
+                return;
+            }
+        }
+        let openFrame = frame;
+        let retireForRefresh;
+        if (existing && this.needsRespawn(existing)) {
+            // A keeper-hosted session whose adapter is gone (it exited, or keeper-acp restarted and recovered it as `keeper_lost` — its
+            // tail was folded and recorded): the reopen starts a new spawn in the same transport session and loads the native one, as
+            // for any session left behind (Task 21).
+            retireForRefresh = existing;
+            existing = undefined;
+        }
+        if (existing) {
+            const delegation = existing.session.delegation ?? undefined;
+            if (delegation && !frame.delegationMcp) {
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation lease is required' });
+                return;
+            }
+            if (frame.delegationMcp && frame.nativeSessionId && frame.nativeSessionId !== existing.nativeSessionId) {
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation cannot reload the original session' });
+                return;
+            }
+            const refresh = !!frame.delegationMcp &&
+                (delegation?.leaseId !== delegationLeaseId(frame.delegationMcp) || delegation?.refreshPending === true);
+            if (refresh) {
+                if (!existing.nativeSessionId || (frame.nativeSessionId && frame.nativeSessionId !== existing.nativeSessionId)) {
+                    this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation cannot reload the original session' });
+                    return;
+                }
+                if (existing.session.liveness.turnRunning || activityIsBusy(existing.session.activityRaw)) {
+                    if (!delegation?.refreshPending) {
+                        try {
+                            await existing.session.note({ type: 'agent_delegation_refresh_pending' });
+                        }
+                        catch (err) {
+                            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: errorMessage(err) });
+                            return;
+                        }
+                    }
+                    if (!await this.resumeAndReply(existing, frame, false))
+                        return;
+                    this.replyNoReplayNeeded(frame);
+                    return;
+                }
+                openFrame = { ...frame, nativeSessionId: existing.nativeSessionId, requireSessionLoad: true };
+                retireForRefresh = existing;
+            }
+            else {
+                // Spec §6.3: a session with a switch pending (a persistent intent: another adapter build, or off an older keeper-acp
+                // generation) moves at this open — the only moment its spawn secrets are at hand — when it is strictly idle.
+                if (await this.switchAtOpen(existing, frame))
+                    return;
+                // Reusing a live session: neither the process nor the native session moved.
+                if (!await this.resumeAndReply(existing, frame, false))
+                    return;
+                // The session already exists, so any history it has was already streamed under whichever
+                // open first established it (or never will be, if that open didn't ask for it) — replaying it
+                // again here would duplicate what the platform already holds. But if THIS frame asked for
+                // backfill, the server is waiting on exactly one `agent_backfill_done` for THIS open's id:
+                // silence is not "no", it is a wait that never resolves. Answer it without replaying.
+                this.replyNoReplayNeeded(frame);
+                return;
+            }
+        }
         const inFlight = this.opening.get(frame.sessionRef);
         if (inFlight) {
             // Piggyback on the attempt already running, and report its real failure — not a generic one.
             const { live, error, agentRefused } = await inFlight;
             if (live) {
+                const delegation = live.session.delegation ?? undefined;
+                if (!!frame.delegationMcp !== !!delegation ||
+                    (frame.delegationMcp && delegation?.leaseId !== delegationLeaseId(frame.delegationMcp))) {
+                    this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation lease does not match the live session' });
+                    return;
+                }
                 // Piggybacking on the attempt already running: a non-null `live` means that attempt was a
                 // real open (`session/load` or `session/new`), which this frame is reporting secondhand.
-                await this.resumeAndReply(live, frame, true);
+                if (!await this.resumeAndReply(live, frame, true))
+                    return;
                 // Same reasoning as the reconnect branch above: whichever frame actually drove openSession
                 // already streamed this session's history (if it asked to); this frame is a second, racing
                 // open of the same ref and must not trigger a second replay — but still owes its own
@@ -876,8 +1618,15 @@ export class AgentSessionManager {
             }
             return;
         }
-        const attempt = this.openSession(frame)
-            .catch((err) => ({ live: null, error: errorMessage(err) }));
+        // A respawn of a dead keeper session keeps its (older) generation held across the retire and the spawn (Task 21 fix round 2).
+        const releaseHold = retireForRefresh && this.needsRespawn(retireForRefresh) ? this.agents.holdForReopen?.(frame.sessionRef) : undefined;
+        const attempt = (async () => {
+            if (retireForRefresh)
+                await this.retire(retireForRefresh, 'keep');
+            return this.openSession(openFrame);
+        })()
+            .catch((err) => ({ live: null, error: openFailureText(openFrame, err) }))
+            .finally(() => releaseHold?.());
         this.opening.set(frame.sessionRef, attempt);
         let outcome;
         try {
@@ -900,7 +1649,8 @@ export class AgentSessionManager {
         // resolving from the finally, and microtasks always drain before the next inbound frame.
         if (outcome.live) {
             // openSession returned successfully, having just done session/load or session/new.
-            await this.resumeAndReply(outcome.live, frame, true);
+            if (!await this.resumeAndReply(outcome.live, frame, true))
+                return;
             // Only the direct-attempt path: the existing-session and in-flight-piggyback branches above
             // return before reaching here, so a racing duplicate `agent_open` (or a reconnect of an
             // already-open ref) can never trigger a second replay of the same history.
@@ -920,6 +1670,332 @@ export class AgentSessionManager {
             });
         }
     }
+    // ---- switching (Task 24, spec §6.3) ---------------------------------------------------------------------------------------
+    /** Why `live` may not be switched now (the strict idle criterion, `switching.ts`); empty = strictly idle. */
+    switchBlockersOf(live, now) {
+        const ref = live.sessionRef;
+        return switchBlockers({
+            session: live.session,
+            lastActivityAt: live.lastActivityAt,
+            busyRef: this.opening.has(ref) || this.retiring.has(ref) || this.adopting.has(ref) || this.switching.has(ref),
+            now, quietMs: this.switchQuietMs,
+        });
+    }
+    /**
+     * An `agent_open` of a held session with a switch pending (spec §6.3): when the session is strictly idle, it is moved here — the
+     * open carries the spawn environment only the server has — and this open is answered with the session that holds the ref
+     * afterwards (`reloaded`; the server takes its runtime diagnostics whole). Every other frame of the ref is parked meanwhile.
+     * `false`: nothing to switch now (no intent, not idle, draining) — the caller reuses the session as usual.
+     */
+    async switchAtOpen(live, frame) {
+        const agents = this.agents;
+        if (!agents.switchSession || !agents.pendingSwitchFor || frame.delegationMcp)
+            return false;
+        // A switch spawns an adapter: new work, refused while the workstation drains (spec §8.2).
+        if (this.tasks && !this.tasks.accepting)
+            return false;
+        let target;
+        try {
+            target = await agents.pendingSwitchFor(live.sessionRef, live.session);
+        }
+        catch {
+            return false;
+        }
+        if (!target || live.closed || this.sessions.get(live.sessionRef) !== live)
+            return false;
+        const blockers = this.switchBlockersOf(live, Date.now());
+        if (blockers.length > 0) {
+            console.info(`[agent] ${live.sessionRef}: switch (${target.reason}) waits: ${blockers.join('; ')}`);
+            return false;
+        }
+        const ref = live.sessionRef;
+        // Like an open, the switch is counted while it runs (spec §8.2: a half-made keeper session would be stopped by a restart) — and
+        // a workstation that stopped admitting refuses it.
+        if (this.tasks && !this.tasks.tryReserveAgentOpen(ref))
+            return false;
+        let finished;
+        this.switching.set(ref, new Promise((resolve) => { finished = resolve; }));
+        try {
+            const resumeFrom = resumeFromSeqOf(frame);
+            const outcome = await agents.switchSession(live.session, {
+                ...openSpecOf(frame), seqBase: () => resumeFrom,
+                ...(live.nativeSessionId ? { nativeSessionId: live.nativeSessionId } : {}),
+                // Forced whatever the frame says (spec §5.5.4): a concurrent open can win the server's reopen without the flag.
+                requireSessionLoad: true,
+            }, { ...target, proceed: () => !this.tasks?.isForceStopping() && !live.closed });
+            await this.afterSwitch(live, frame, outcome);
+            return true;
+        }
+        finally {
+            this.tasks?.agentOpenFinished(ref);
+            this.switching.delete(ref);
+            finished();
+        }
+    }
+    async afterSwitch(live, frame, outcome) {
+        switch (outcome.kind) {
+            case 'unmovable':
+                // Nothing was torn down: the session goes on in its process, as for any reopen of a live session.
+                if (!await this.resumeAndReply(live, frame, false))
+                    return;
+                this.replyNoReplayNeeded(frame);
+                return;
+            case 'switched':
+            case 'rolledBack': {
+                const next = this.replaceSession(live, outcome.session, outcome.nativeSessionId);
+                if (!await this.resumeAndReply(next, frame, true))
+                    return;
+                this.replyNoReplayNeeded(frame);
+                return;
+            }
+            case 'lost': {
+                // Its adapter is gone and none could load it: retired like a degraded session (outbox kept), the server told. Its next
+                // `agent_open` reopens it the ordinary way.
+                this.unhold(live);
+                this.notifySwept(live.sessionRef);
+                const error = `The agent session could not be moved to another adapter process: ${outcome.error}`;
+                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error });
+                if (frame.backfill)
+                    this.emit({ t: 'agent_backfill_done', id: frame.id, ok: false, count: 0, error });
+            }
+        }
+    }
+    /** Stop holding `live` (its session is already closed by whoever ended it). */
+    unhold(live) {
+        // Replaced by a switch's successor or rollback, or lost by a switch: a different process from now on.
+        this.adapterCrashes.delete(live.sessionRef);
+        live.closed = true;
+        live.unwatch();
+        if (this.sessions.get(live.sessionRef) === live)
+            this.sessions.delete(live.sessionRef);
+        this.tasks?.unregisterAgentSession(live.sessionRef);
+    }
+    /** The ref is now held by `session` (a switch's successor or its rollback): registered exactly like an opened session. */
+    replaceSession(live, session, nativeSessionId) {
+        this.unhold(live);
+        let highestScopedJournalSeq = 0;
+        for (const item of session.outbox.pending) {
+            if (item.frame.t === 'agent_event' && item.frame.acpSessionId != null)
+                highestScopedJournalSeq = Math.max(highestScopedJournalSeq, item.seq);
+        }
+        const next = {
+            sessionRef: live.sessionRef, agentId: live.agentId, agentKey: live.agentKey, session, nativeSessionId,
+            scopedReplayBlocked: false, highestScopedJournalSeq, unwatch: () => { }, replays: Promise.resolve(), closed: false,
+            lastActivityAt: Date.now(),
+        };
+        this.register(next);
+        return next;
+    }
+    /**
+     * The daemon's switch scheduler (spec §6.3 step 7; the daemon calls it every few seconds): for each held session with a switch
+     * pending that is strictly idle, ask the server for an `agent_open` (`agent_reopen_request`, wire ≥ 25 only) — the switch happens
+     * at that open. Also (Task 23's carry): a keeper-hosted session whose adapter keeper-acp lost (`keeper_lost`/`keeper_stopped` —
+     * not an exit of the adapter's own, which would loop) gets its reopen asked for, so it is respawned and loaded without waiting for
+     * the user's next message — at most {@link ADAPTER_LOST_REOPEN_ATTEMPTS} times per lost spawn, backing off from
+     * {@link REOPEN_REQUEST_RETRY_MS}, never while draining. A switch request the server did not answer is asked again after
+     * {@link REOPEN_REQUEST_RETRY_MS}. Returns the refs a request went out for. Never rejects.
+     */
+    async pollSwitches(now = Date.now(), only) {
+        await this.adoptLate(); // the periodic tick also retries a keeper-acp listing that failed (final review finding 3)
+        const requested = [];
+        for (const live of [...this.sessions.values()]) {
+            const ref = live.sessionRef;
+            if (live.closed || (only && !only.has(ref)))
+                continue;
+            const last = this.reopenRequests.get(ref);
+            const recently = (why) => last !== undefined && last.why === why && now - last.at < REOPEN_REQUEST_RETRY_MS * 2 ** Math.max(0, last.attempts - 1);
+            const busyRef = this.opening.has(ref) || this.retiring.has(ref) || this.adopting.has(ref) || this.switching.has(ref);
+            const session = live.session;
+            const exit = session.adapterExit;
+            if (session.durable && exit && !session.liveness.agentAlive && !session.isDegraded) {
+                // Only a session that had a turn or a card open when keeper-acp lost its adapter (what this daemon saw fold): an idle one
+                // was reported lost and waits for its next message — a keeper-acp restart must not respawn every idle session at once.
+                const lostByKeeper = (exit.reason === 'keeper_lost' || exit.reason === 'keeper_stopped') &&
+                    live.adapterLost?.spawnId === exit.spawnId && live.adapterLost?.busy === true;
+                const why = `adapter-lost:${exit.spawnId ?? '?'}`;
+                // Bounded per lost spawn (fix round 1): 60 s, 120 s, 240 s apart, then the user's next message reopens it. Not while
+                // draining: a respawn is new work (spec §8.2).
+                const attempts = last?.why === why ? last.attempts : 0;
+                if (lostByKeeper && live.nativeSessionId && !busyRef && !session.liveness.turnRunning && !recently(why) &&
+                    attempts < ADAPTER_LOST_REOPEN_ATTEMPTS && (!this.tasks || this.tasks.accepting) && this.requestReopen(ref, 'agent_exited')) {
+                    this.reopenRequests.set(ref, { at: now, why, attempts: attempts + 1 });
+                    requested.push(ref);
+                }
+                continue;
+            }
+            if (!this.agents.pendingSwitchFor)
+                continue;
+            let target;
+            try {
+                target = await this.agents.pendingSwitchFor(ref, live.session);
+            }
+            catch {
+                continue;
+            }
+            if (!target || live.closed || (this.tasks && !this.tasks.accepting))
+                continue;
+            if (this.switchBlockersOf(live, now).length > 0 || recently('switch'))
+                continue;
+            if (this.requestReopen(ref, target.reason)) {
+                this.reopenRequests.set(ref, { at: now, why: 'switch', attempts: 1 });
+                requested.push(ref);
+            }
+        }
+        return requested;
+    }
+    /**
+     * "Move idle sessions" (Task 25's `agent_switch_idle`, spec §6.4): every held session of `agentId` that runs another build than
+     * `toBuild` (else the agent's current build) gets a persistent intent to move there; those already strictly idle get their
+     * `agent_reopen_request` at once, the others when they become idle. A session that can never be moved this way
+     * ({@link unmovableWhy}: a local-fallback session, a managed delegation, no native session, a target that already refused it) gets
+     * no intent — it would only be asked to reopen again and again — and is listed in `unmovable` with the reason. A `toBuild` that is
+     * not installed for the agent is refused (throws). Returns the refs registered, the ones a request went out for, and the unmovable.
+     */
+    async switchIdle(agentId, options = {}) {
+        const { requestSwitch, placementOf } = this.agents;
+        if (!requestSwitch || !placementOf)
+            return { registered: [], requested: [], unmovable: [] };
+        let target = options.toBuild;
+        if (this.agents.buildIdsOf) {
+            const ids = await this.agents.buildIdsOf(agentId);
+            if (target !== undefined && !ids.installed.includes(target))
+                throw new Error(`Adapter build ${target} of '${agentId}' is not installed on this workstation`);
+            target ??= ids.current;
+        }
+        const reason = options.reason ?? (options.toBuild ? `move to adapter build ${options.toBuild}` : 'move to the current adapter build');
+        const registered = [];
+        const unmovable = [];
+        for (const live of [...this.sessions.values()]) {
+            if (live.closed || live.agentId !== agentId)
+                continue;
+            const placement = placementOf.call(this.agents, live.session);
+            // A command override (a custom agent) has no build to move — and the scan does not count it either.
+            if (placement && placement.buildId === undefined)
+                continue;
+            // Already there: nothing to move, and nothing to report as unmovable either.
+            if (target !== undefined && placement?.buildId === target)
+                continue;
+            const why = this.unmovableWhy(live, target);
+            if (why !== undefined) {
+                console.info(`[agent] ${live.sessionRef}: not moved to ${target ?? 'the current build'}: ${why.detail ?? why.plain}`);
+                unmovable.push({ sessionRef: live.sessionRef, reason: why.plain });
+                continue;
+            }
+            await requestSwitch.call(this.agents, agentId, live.sessionRef, { ...(options.toBuild ? { toBuild: options.toBuild } : {}), reason, requestedBy: 'user' });
+            registered.push(live.sessionRef);
+        }
+        const requested = await this.pollSwitches(Date.now(), new Set(registered));
+        return { registered, requested, unmovable };
+    }
+    /**
+     * Why `live` can never be moved to `target` by a switch (spec §6.3 "当前限制"), or `undefined`: a session keeper-acp does not host
+     * (the local fallback), a managed delegation, a session with no native session to load, or one a switch to the same build already
+     * found unmovable. `plain` is what the scan card and the result frame say (Task 25); `detail` is the switch's own words, for the
+     * log, when there are any.
+     */
+    unmovableWhy(live, target) {
+        const placement = this.agents.placementOf?.call(this.agents, live.session);
+        if (!placement?.keeper)
+            return { plain: LOCAL_SESSION_UNMOVABLE };
+        if (live.session.delegation)
+            return { plain: 'it is a delegated session, which can\'t be moved to another build yet' };
+        if (!live.nativeSessionId)
+            return { plain: 'it has no saved conversation the new build could reload' };
+        const refused = this.agents.unmovableFor?.call(this.agents, live.sessionRef);
+        if (refused && (refused.toBuild === undefined || refused.toBuild === target)) {
+            return { plain: `the ${refused.toBuild ?? 'new'} adapter could not take it over when this was last tried`, detail: refused.reason };
+        }
+        return undefined;
+    }
+    /**
+     * How the external-agents scan counts one running session (spec §6.4, Task 25; `AcpAgents.roster({sessions})`): `unmovable` with
+     * the reason ({@link unmovableWhy}; also a session this daemon does not hold), else `busy` with the strict idle criterion's blockers
+     * ({@link switchBlockersOf}), else `idle`. `pendingTo`: the build a pending switch intent still owes it. Never rejects.
+     */
+    async rosterSessionState(running) {
+        const live = this.sessions.get(running.sessionRef);
+        if (!live || live.closed)
+            return { state: 'unmovable', reasons: ['it is not connected to a conversation right now'] };
+        const current = this.agents.buildIdsOf ? (await this.agents.buildIdsOf(running.agentId).catch(() => undefined))?.current : undefined;
+        let pendingTo;
+        try {
+            pendingTo = (await this.agents.pendingSwitchFor?.(running.sessionRef, live.session))?.toBuild;
+        }
+        catch { /* an unreadable builds.json: nothing pending to report */ }
+        const pending = pendingTo !== undefined ? { pendingTo } : {};
+        const why = this.unmovableWhy(live, current);
+        if (why !== undefined)
+            return { state: 'unmovable', reasons: [why.plain], ...pending };
+        // The card's words, not the log's (`plainSwitchBlocker`); `switchAtOpen` still logs the internal sentences.
+        const blockers = this.switchBlockersOf(live, Date.now()).map(plainSwitchBlocker);
+        return blockers.length > 0 ? { state: 'busy', reasons: blockers, ...pending } : { state: 'idle', ...pending };
+    }
+    /** Answers `agent_switch_idle` (Task 25): {@link switchIdle}, counted. */
+    async onSwitchIdle(frame) {
+        try {
+            const result = await this.switchIdle(frame.bridge, frame.toBuild !== undefined ? { toBuild: frame.toBuild } : {});
+            this.emit({
+                t: 'agent_switch_idle_result', id: frame.id, ok: true,
+                registered: result.registered.length, immediate: result.requested.length, unmovable: result.unmovable,
+            });
+        }
+        catch (error) {
+            this.emit({ t: 'agent_switch_idle_result', id: frame.id, ok: false, error: errorMessage(error) });
+        }
+    }
+    /**
+     * The Workstations page's view of a held session (Task 26, spec §8.1): which registry agent it runs and whether it is busy right
+     * now — a turn in flight or the agent reporting itself active (the same sample `activeAgentTasks` once used). `undefined` when this
+     * daemon does not hold the ref.
+     */
+    sessionView(sessionRef) {
+        const live = this.sessions.get(sessionRef);
+        if (!live || live.closed)
+            return undefined;
+        let busy = false;
+        try {
+            busy = live.session.liveness.turnRunning || activityIsBusy(live.session.activityRaw);
+        }
+        catch {
+            busy = false;
+        }
+        return { agentId: live.agentId, busy };
+    }
+    /**
+     * keeper-acp replacement (spec §8.3, for Task 26): every held session on an older keeper-acp generation — only on `gens` when given
+     * (the generations a replacement was decided for; another older one may merely be `available`) — gets a persistent intent to move
+     * to the current generation when idle (same build). Returns the refs registered.
+     */
+    async moveOffOlderKeeperGenerations(reason = 'keeper-acp was upgraded', gens) {
+        const { requestSwitch, placementOf } = this.agents;
+        if (!requestSwitch || !placementOf)
+            return [];
+        const registered = [];
+        for (const live of [...this.sessions.values()]) {
+            const placement = placementOf.call(this.agents, live.session);
+            if (live.closed || !placement?.keeper || placement.gen === undefined)
+                continue;
+            if (gens && !gens.includes(placement.gen))
+                continue;
+            await requestSwitch.call(this.agents, live.agentId, live.sessionRef, { keeperGen: 'current', reason, requestedBy: 'axom' });
+            registered.push(live.sessionRef);
+        }
+        await this.pollSwitches(Date.now(), new Set(registered));
+        return registered;
+    }
+    /** Cancel a pending switch: one ref's, or every one of an agent's. `true` when one existed. */
+    async cancelSwitch(target) {
+        if (!this.agents.cancelSwitch)
+            return false;
+        const cancelled = await this.agents.cancelSwitch(target);
+        if ('sessionRef' in target)
+            this.reopenRequests.delete(target.sessionRef);
+        else
+            for (const live of this.sessions.values())
+                if (live.agentId === target.agentId)
+                    this.reopenRequests.delete(live.sessionRef);
+        return cancelled;
+    }
     /**
      * Answers a backfill-flagged open that landed on an already-live (or already-being-opened)
      * session, without replaying anything.
@@ -946,8 +2022,8 @@ export class AgentSessionManager {
      * and `agent_open` already has the whole open path (spec construction, ok/error reply) that a
      * standalone frame would force the daemon to rebuild a second copy of.
      *
-     * Deliberately outside the live event/journal machinery — no `bridge_seq`, no
-     * {@link SessionJournal} entry, no `agent_event_ack` round trip. `bridge_seq` means one specific
+     * Deliberately outside the live event/outbox machinery — no `bridge_seq`, no
+     * outbox entry, no `agent_event_ack` round trip. `bridge_seq` means one specific
      * thing: live-consumption progress, the only basis for de-duplication across reconnects. Backfill
      * is a one-shot replay correlated purely by this open's `id`; folding it into that watermark would
      * give it two meanings, which is exactly what produced two watermark bugs in an earlier phase.
@@ -975,9 +2051,14 @@ export class AgentSessionManager {
             // legitimately rely on `this`, and a bare local `const backfill = session.backfill` would call
             // it unbound.
             for await (const event of session.backfill()) {
+                if (event.acpSessionId !== undefined && this.serverAgentWire < AGENT_WIRE_SCOPED_ORIGIN_VERSION) {
+                    throw new Error(`Scoped backfill requires agent wire ${AGENT_WIRE_SCOPED_ORIGIN_VERSION}; native origin cannot be discarded`);
+                }
                 batch.push(event);
                 count += 1;
                 if (batch.length >= BACKFILL_BATCH_SIZE) {
+                    // Bulk and never acknowledged: no session window, but it waits for the socket gate like session frames (agentFlow.ts).
+                    await this.gate.opened();
                     this.emit({ t: 'agent_backfill_events', id, events: batch });
                     batch = [];
                 }
@@ -1013,27 +2094,42 @@ export class AgentSessionManager {
                 `but the live one is '${live.nativeSessionId}'`);
         }
         const resumeFrom = resumeFromSeqOf(frame);
-        // On the session's own queue so an agent event produced mid-replay is sent after it, not into
-        // the middle of it.
-        await this.enqueue(live, async () => {
-            const entries = await live.journal.entriesAfter(resumeFrom);
-            if (this.hasGap(live, entries, resumeFrom)) {
-                this.emit({
-                    t: 'agent_event',
-                    sessionRef: live.sessionRef,
-                    // The hole left by the overflow drop starts exactly here. Reusing that seq (rather than
-                    // taking a fresh one) is what makes the notice survive the server's `seq > bridgeSeq`
-                    // filter *without* pushing the watermark past the replayed entries behind it.
-                    seq: resumeFrom + 1,
-                    eventName: 'step',
-                    payload: { message: 'transport gap: oldest streamed output dropped', tone: 'neutral' },
-                });
-            }
-            // Already-formed frames, carrying their original seq — resent verbatim so the server's
-            // de-duplication does the deciding.
-            for (const entry of entries)
-                this.emit(entry.frame);
+        // The server applied through `resumeFrom` (its durable watermark): that is an ack. Everything after it is resent in order —
+        // verbatim, carrying the original seq, so the server's de-duplication does the deciding. The outbox never drops its oldest
+        // entries (the backlog stays in the raw log instead, §5.6), so there is no gap to announce any more.
+        let incompatible = false;
+        // One replay at a time per session: two racing reopens resend the tail once, the second only what the first did not cover.
+        const replay = live.replays.then(async () => {
+            if (live.closed)
+                return;
+            incompatible = this.blockIncompatibleJournal(live);
+            if (incompatible)
+                return;
+            await this.acknowledge(live, resumeFrom);
+            if (live.closed)
+                return;
+            live.scopedReplayBlocked = false;
+            // Sends synchronously while the window and the socket allow, so on an idle link the tail precedes `agent_opened`; on a
+            // busy one `agent_opened` may overtake it — the session's frames keep their own order (analysis B §4.3), and a large tail
+            // cannot push the reply past the server's open timeout.
+            live.session.outbox.resendAll();
+            this.pump();
         });
+        live.replays = replay.catch((err) => console.error(`[agent] replay failed for ${live.sessionRef}: ${errorMessage(err)}`));
+        await live.replays;
+        if (incompatible) {
+            const error = `Scoped journal replay requires agent wire ${AGENT_WIRE_SCOPED_ORIGIN_VERSION}; retained history was not delivered or acknowledged`;
+            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error });
+            if (frame.backfill)
+                this.emit({ t: 'agent_backfill_done', id: frame.id, ok: false, count: 0, error });
+            return false;
+        }
+        if (live.closed) {
+            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'session was closed while opening' });
+            return false;
+        }
+        const delegation = live.session.delegation ?? undefined;
+        const activityRaw = live.session.activityRaw;
         this.emit({
             t: 'agent_opened',
             id: frame.id,
@@ -1044,6 +2140,13 @@ export class AgentSessionManager {
             // Emitted only when true, the same `supportsSteering` convention as below: absent is the
             // field's only "no", and it is also what an older peer sends.
             ...(reloaded ? { reloaded: true } : {}),
+            // Delegation's non-secret fields, from processor state (Task 19: `agent_opened` is assembled from state).
+            ...(delegation ? { delegationExpiresAtEpochMs: delegation.expiresAtEpochMs } : {}),
+            ...(delegation?.refreshPending ? { delegationRefreshPending: true } : {}),
+            ...(this.serverAgentWire >= AGENT_WIRE_DELEGATION_RENEW_VERSION && delegation?.instanceId ? {
+                delegationInstanceId: delegation.instanceId, delegationBindingId: delegation.bindingId,
+                delegationRenewalRevision: delegation.renewalRevision,
+            } : {}),
             // The server learns this here and nowhere else. It used to be published only on the roster in
             // the `agent_hello` handshake, which is a snapshot taken *before* any agent was connected to —
             // and the capability can only be observed on a live `initialize`, whose record
@@ -1078,6 +2181,7 @@ export class AgentSessionManager {
             // ruling R1: `agent_opened` is assembled from `live.session.*`, not from the roster, so a
             // field added to `BridgeInfo` would have no reader here).
             ...(live.session.agentInfo ? { agentInfo: live.session.agentInfo } : {}),
+            ...(live.session.runtimeDiagnostics ? { runtimeDiagnostics: live.session.runtimeDiagnostics } : {}),
             // ACP `PromptCapabilities.image`, learned at the same `initialize` and for the same
             // session-not-roster reason as `supportsSteering` above: `true`-or-absent is this field's
             // whole vocabulary, so an agent that said nothing (or a peer too old to answer) reads the
@@ -1094,85 +2198,97 @@ export class AgentSessionManager {
             // would report the pre-change values to the server after every config change. See
             // {@link AcpAgentSession.configOptions} for what that costs.
             configOptions: live.session.configOptions,
+            // Whether this daemon wired up an activity-state collector for this session's agent (design
+            // §5.3) — decided from the same `agentInfo.name` just read above, never from whether a push
+            // has actually arrived: those are different facts (see the field's own doc in
+            // `protocol/agent.ts`). No version floor: an additive key on a frame the peer already decodes
+            // with `ignoreUnknownKeys`, the same `supportsSteering`/`reloaded` shape, not the
+            // new-discriminator shape `agent_session_state` itself is.
+            ...(reportsActivity(live.session.agentInfo?.name) ? { reportsActivity: true } : {}),
+            ...(live.nativeSessionId && supportsAsyncTaskStop(live.session.agentInfo?.name)
+                ? { supportsAsyncTaskStop: true } : {}),
+            // A keeper-hosted session outlives this daemon (spec §5.5.4): the server resends answers it recorded for the cards still
+            // pending (a daemon that died between receiving an answer and writing it would leave the adapter blocked), and decides an
+            // unconfirmed steer by whether it was steered. Additive keys: a server that does not read them ignores them.
+            ...(live.session.durable ? {
+                durable: true,
+                pendingRequestIds: [...(live.session.pendingRequestIds ?? [])],
+                steeredIds: [...(live.session.steeredIds ?? [])],
+            } : {}),
+            // This session's activity-state snapshot as of right now (processor state), resent here because
+            // `agent_session_state` is never journaled and a reopen would otherwise have nothing to
+            // recover it from. Absent when nothing has ever arrived (including "no collector for this
+            // agent"), never a synthesized default.
+            ...(activityRaw !== undefined ? { activityRaw } : {}),
         });
-    }
-    /**
-     * Whether the overflow drop actually took something the server still needs. `droppedOldest` alone
-     * is not enough: by the time of this reconnect the server may have acked past the hole, and
-     * announcing a gap that no longer exists would both mislead the user and collide with the seq of
-     * the first replayed entry.
-     */
-    hasGap(live, entries, resumeFrom) {
-        if (!live.journal.droppedOldest)
-            return false;
-        const first = entries[0];
-        return first ? first.seq > resumeFrom + 1 : live.journal.lastSeq > resumeFrom;
+        return true;
     }
     async openSession(frame) {
-        // A previous incarnation of this ref may still be deleting its journal; two SessionJournal
-        // instances must never share a path (see {@link retiring}). This is the first statement on
-        // purpose — before init, before the agent spawns, before anything touches the filesystem.
+        // A previous incarnation of this ref may still be closing: its adapter stopped and its transport session (raw, outbox) kept or
+        // released — the new spawn goes under the same key (see {@link retiring}). This is the first statement on purpose — before the
+        // agent spawns, before anything touches the transport. The one-time legacy journal migration lands before any open too.
         await this.retiring.get(frame.sessionRef);
-        // spec.env is an OVERLAY merged onto process.env when the agent is spawned (see
-        // AcpOpenSpec.env), so it is built from frame-supplied values only. The single exception is
-        // PATH: when pathPrepend is set we resolve the whole variable here — prepends first, then the
-        // frame's PATH or, failing that, the daemon's — so the launcher uses spec.env.PATH verbatim
-        // instead of re-deriving it.
-        const env = { ...(frame.env ?? {}) };
-        const pathPrepend = frame.pathPrepend ?? [];
-        if (pathPrepend.length > 0) {
-            env.PATH = [...pathPrepend, env.PATH ?? process.env.PATH ?? ''].filter(Boolean).join(path.delimiter);
-        }
-        // Recovered before the agent spawns, because nextSeq() is synchronous and the first event may
-        // arrive the instant onEvent is registered: the high-water mark has to be known by then or a
-        // restarted daemon would restart seq at 1 and the server would swallow the next turn as
-        // already-applied. The frame's watermark is passed in as a floor under whatever the file
-        // yields, because "the file is empty" is the *normal* state between turns — everything in it
-        // was acked and truncated — so the file alone would say 0 while the server sits at N.
-        // init() only reads — the file appears on the first append — so an open that fails here leaves
-        // nothing behind.
-        const journal = new SessionJournal(this.sessionsDir, frame.sessionRef, this.maxJournalBytes);
-        try {
-            await journal.init(resumeFromSeqOf(frame));
-        }
-        catch (err) {
-            return { live: null, error: `journal init failed: ${errorMessage(err)}` };
-        }
-        // Both journal recovery and a retiring prior incarnation can await before this point. Only a
-        // force-stop may cancel an open admitted before that await; graceful drain owns its reservation
-        // and must let it settle without starting a second admission decision halfway through.
+        await this.adopting.get(frame.sessionRef)?.done;
+        await this.migrateLegacyJournals();
+        // The server's watermark is the floor the processor numbers from (AcpOpenSpec.seqBase); the outbox an earlier life left under
+        // the ref raises it (`max(outbox.maxSeq, committedTail.seq, resumeFromSeq)`, §5.5) — a restarted daemon never restarts seq at 1,
+        // or the server would swallow the next turn as already applied.
+        const resumeFrom = resumeFromSeqOf(frame);
+        // Only a force-stop may cancel an open admitted before the awaits above; graceful drain owns its reservation and must let it
+        // settle without starting a second admission decision halfway through.
         if (this.tasks?.isForceStopping()) {
-            await journal.destroy();
             return { live: null, error: 'Workstation is not accepting new work' };
         }
         let session;
         let nativeSessionId;
-        try {
-            const result = await this.agents.open({
-                // `frame.bridge` is the registry agent id now — the wire field keeps its name because Plan A
-                // renames nothing (Global Constraint 3); ruling R2 replaced what it *means*.
-                agentId: frame.bridge,
-                cwd: frame.cwd,
-                env,
-                agentEnv: frame.agentEnv ?? {},
-                ...(frame.command ? { command: frame.command } : {}),
-                args: frame.args ?? [],
-                ...(frame.nativeSessionId ? { nativeSessionId: frame.nativeSessionId } : {}),
-                // Retaining a whole adopted history costs memory for the session's lifetime, so it is only
-                // kept when this open is the one that will stream it back.
-                backfill: frame.backfill === true,
+        // Spec 2026-10-11 §6.2: an agent with nothing installed yet is installed once, by this open. A success becomes the session's
+        // own `agent_install_outcome` note (AcpAgents → the processor numbers one past-tense `step`, recorded in the outbox like any
+        // event). A failure has no session to go on: its `step` is sent here, numbered right after the server's watermark — not
+        // recorded anywhere (the open fails with the same reason, and a later open numbers from the server's watermark again).
+        // Nothing is written while the install runs: a durable "Installing…" card would never be updated and read as stuck.
+        let failedInstall;
+        const onInstallOutcome = (outcome) => {
+            if (!outcome.ok)
+                failedInstall = outcome;
+        };
+        // Sent before the failed open's reply — unless an earlier life left frames under the ref: one of them may hold
+        // `resumeFrom + 1`, and the server would keep the step and drop that frame as a duplicate. `agent_opened{ok:false}` carries
+        // the same error then.
+        const reportFailedInstall = async () => {
+            if (!failedInstall)
+                return;
+            let leftover = false;
+            try {
+                leftover = ((await this.agents.leftoverSessions?.()) ?? []).includes(frame.sessionRef);
+            }
+            catch {
+                leftover = true;
+            }
+            if (leftover)
+                return;
+            this.emit({
+                t: 'agent_event', sessionRef: frame.sessionRef, seq: resumeFrom + 1, eventName: 'step',
+                payload: { title: 'Agent adapter', message: `Could not install ${failedInstall.agentName} adapter ${failedInstall.version}`, detail: failedInstall.error, tone: 'error' },
             });
+        };
+        try {
+            const result = await this.agents.open({ ...openSpecOf(frame), onInstallOutcome, seqBase: () => resumeFrom });
             session = result.session;
             nativeSessionId = result.nativeSessionId;
+            if (frame.delegationMcp && !nativeSessionId) {
+                await session.close();
+                return { live: null, error: 'Managed delegation requires a native session ID' };
+            }
         }
         catch (err) {
+            await reportFailedInstall();
             // `open` throws on both sides of the agent's `initialize` — nothing to launch and a spawn
             // that failed look identical from here — so the marker is asked for rather than assumed. Only
             // an {@link AgentRefusedSessionError} is the agent's own no, which is what an `auth_required`
             // on `session/new` arrives as; see {@link OpenOutcome.agentRefused}.
             return {
                 live: null,
-                error: errorMessage(err),
+                error: openFailureText(frame, err),
                 // The code comes off the marker, not off `errorMessage(err)` above: the wrapper captured it
                 // from the original rejection at the moment that object still existed.
                 ...(err instanceof AgentRefusedSessionError
@@ -1189,7 +2305,6 @@ export class AgentSessionManager {
             catch (err) {
                 console.error(`[agent] close of force-stopped open failed for ${frame.sessionRef}: ${errorMessage(err)}`);
             }
-            await journal.destroy();
             return { live: null, error: 'Workstation is not accepting new work' };
         }
         // The session became pointless while it was spawning (agent_close, or the socket dropped and the
@@ -1199,35 +2314,59 @@ export class AgentSessionManager {
         if (abandonReason) {
             this.closedDuringOpen.delete(frame.sessionRef);
             try {
-                await session.close();
+                // Only an explicit agent_close retires the ref, and only then does its outbox go. A socket
+                // drop must leave it alone: it may hold frames an earlier life left, and the server will
+                // re-open the ref and ask for exactly those.
+                await session.close(abandonReason === 'closed' ? 'release' : 'keep');
             }
             catch (err) {
                 console.error(`[agent] close of abandoned open failed for ${frame.sessionRef}: ${errorMessage(err)}`);
             }
-            // Only an explicit agent_close retires the ref, and only then does its journal go. A socket
-            // drop must leave the file alone: it may hold entries this daemon recovered from a previous
-            // life, and the server will re-open the ref and ask for exactly those.
-            if (abandonReason === 'closed')
-                await journal.destroy();
             return { live: null, error: 'session closed during open' };
         }
+        // Frames an earlier life left (read back into the outbox at start) keep the scoped high-water mark they had.
+        let highestScopedJournalSeq = 0;
+        for (const item of session.outbox.pending) {
+            if (item.frame.t === 'agent_event' && item.frame.acpSessionId != null)
+                highestScopedJournalSeq = Math.max(highestScopedJournalSeq, item.seq);
+        }
         const live = {
             sessionRef: frame.sessionRef,
             agentId: frame.bridge,
             agentKey: frame.agentKey,
             session,
             nativeSessionId,
-            journal,
-            writes: Promise.resolve(),
+            scopedReplayBlocked: false,
+            highestScopedJournalSeq,
+            unwatch: () => { },
+            replays: Promise.resolve(),
             closed: false,
             lastActivityAt: Date.now(),
         };
-        this.sessions.set(frame.sessionRef, live);
-        this.tasks?.registerAgentSession(frame.sessionRef, () => this.retire(live, 'destroy'));
-        session.onEvent((e) => this.onAgentEvent(live, e));
-        session.onTurnDone((r) => this.onAgentTurnDone(live, r));
+        this.register(live);
         return { live };
     }
+    /** A session joins: held, registered with the TaskRegistry, its frames and its outbox wired to the sender. */
+    register(live) {
+        const session = live.session;
+        this.detached.delete(live.sessionRef);
+        this.sessions.set(live.sessionRef, live);
+        const durable = session.durable === true && session.detach !== undefined;
+        this.tasks?.registerAgentSession(live.sessionRef, 
+        // A keeper-hosted session is detached, never stopped, by the update paths (spec §5.5.5): its turn goes on in keeper-acp.
+        () => this.retire(live, durable ? 'detach' : 'destroy'), 
+        // 两个层级量取或：本进程发出的提示词是否在途（agent 自己也许在续跑一个我们没发起的回合，
+        // 那一种由第二项回答），以及 agent 自报的状态。两者都不累积，所以没有可泄漏的状态。
+        () => live.session.liveness.turnRunning || activityIsBusy(live.session.activityRaw), { durable });
+        // Everything the session produces arrives as processor frames (Task 19): numbered by the processor, projected for the
+        // connected server here, recorded in the outbox (the numbered ones) and sent from it (Task 20).
+        live.unwatch = session.outbox.onChange(() => this.pump());
+        session.onFrames((frames) => this.onSessionFrames(live, frames));
+        if (session.accountLimits && this.serverAgentWire >= 27)
+            this.emit({ t: 'agent_account_update', agentKey: live.agentKey, snapshot: session.accountLimits });
+        session.onDegraded?.((reason) => { void this.onSessionDegraded(live, reason); });
+        session.onAdapterExited?.((exit) => { this.onAdapterExited(live, exit); });
+    }
     /**
      * Answers `agent_list_native` by asking the agent itself, over a throwaway connection this manager
      * never sees. Deliberately involves no `LiveSession`: listing is what a user does *before* deciding
@@ -1268,6 +2407,25 @@ export class AgentSessionManager {
             this.emit({ t: 'agent_native_sessions', id: frame.id, ok: false, error: errorMessage(err) });
         }
     }
+    /**
+     * Answers `agent_delete_native`: `session/delete` per id over a throwaway connection, like
+     * {@link onListNative}. Per-id outcomes ride in `results` (`ok:true`); `ok:false` means the
+     * deletion could not be attempted at all (no launchable agent, bad query). Never throws.
+     */
+    async onDeleteNative(frame) {
+        const spec = sanitizeNativeSessionQuery(frame.bridge, frame.query);
+        if (!spec) {
+            this.emit({ t: 'agent_native_deleted', id: frame.id, ok: false, error: 'native session query is missing cwd' });
+            return;
+        }
+        try {
+            const results = await this.agents.deleteNativeSessions(spec, frame.nativeSessionIds);
+            this.emit({ t: 'agent_native_deleted', id: frame.id, ok: true, results });
+        }
+        catch (err) {
+            this.emit({ t: 'agent_native_deleted', id: frame.id, ok: false, error: errorMessage(err) });
+        }
+    }
     /**
      * Answers `agent_verify` by actually starting the agent and seeing what it says — the only way the
      * roster's auth fields can be populated for an agent no session has ever run (see
@@ -1440,102 +2598,251 @@ export class AgentSessionManager {
             this.emit({ t: 'agent_installed', id: frame.id, ok: false, error: errorMessage(err) });
         }
     }
-    onAgentEvent(live, e) {
-        if (live.closed)
-            return;
-        // An agent can resume an existing native turn after a client restart, so an inbound prompt is
-        // not the only reliable start marker. These are the two wire events that represent work which
-        // may still require user action or native execution; turn_done below releases the mark.
-        if (e.eventName === 'tool_call' || e.eventName === 'permission_request')
-            this.tasks?.agentTurnStarted(live.sessionRef);
-        // Before the contract check: an agent emitting even non-conforming events is a live process,
-        // and the idle sweep is about liveness, not correctness.
-        this.touch(live);
-        // Contract check BEFORE record(): record() takes the next seq synchronously, so a violating
-        // event that got numbered and then dropped would leave a hole in the sequence — the server's
-        // watermark reads a hole as lost data. Drop, don't throw: one bad event must not poison the
-        // session, and the diagnostic (agent, session, event) is what makes the violation debuggable.
-        const rejection = validateWireEvent(e);
-        if (rejection) {
-            console.warn(`[acp:${live.agentId} agent:${live.agentKey}] dropped event '${wireEventName(e)}' for ${live.sessionRef}: ` +
-                `${rejection.reason}${rejection.detail ? ` (${rejection.detail})` : ''}`);
-            return;
+    /**
+     * The session's processor frames (Task 19), in processor order: projected for the connected server
+     * (`processor/projection.ts`), the numbered ones journaled under the processor's own `seq` and then sent, the levels and
+     * RPC replies sent as they are.
+     *
+     * What used to be decided here moved to the processor, and is no longer re-decided:
+     *
+     * - **Numbering.** `seq` is processor state; this method never allocates one. The contract check that used to run before
+     *   `record()` (`validateWireEvent`) runs in the processor before it numbers (`emit.ts`), so a refused event still leaves no hole.
+     * - **Scoped events for an old server** (spec §5.4, "与连接状态无关"): the processor numbers them whatever the server; the
+     *   projection withholds them below {@link AGENT_WIRE_SCOPED_ORIGIN_VERSION} — leaving a `seq` gap the server does not detect —
+     *   and a withheld permission card is answered by an `agent_answer_undeliverable` note the processor turns into a logged
+     *   `cancelled` answer (the auto-answer used to be written straight to the agent).
+     * - **`refusalFields`**: the projection adds the agent's observed sign-in methods and code to an `agent_turn_done` the processor
+     *   marked `agentRefused` — exactly the turns {@link refusalFields} was gated on.
+     *
+     * A frame the projection withholds is not recorded either: the outbox (Task 20, the record-before-send buffer that replaced the
+     * journal) only ever holds frames this server can be sent, which is what keeps {@link blockIncompatibleJournal} meaningful.
+     *
+     * Returns the outbox append of the numbered frames: the session's record loop awaits it before folding another record, so the
+     * outbox holding a frame proves its record's commands are in raw (and a checkpoint never precedes a record's frames).
+     */
+    onSessionFrames(live, frames) {
+        const numbered = [];
+        for (const output of frames) {
+            if (live.closed) {
+                // Closed or detached while the session was finishing a record (Task 21 fix round 1, I-1): its numbered frames are still
+                // recorded — a detached session's next daemon resends them; dropping them would skip their seqs behind the head checkpoint.
+                // Nothing is sent or noted for it any more.
+                if (output.journaled && projectFrame(output, { sessionRef: live.sessionRef, serverAgentWire: this.serverAgentWire }).frame) {
+                    numbered.push({ seq: output.frame.seq, src: output.src, frame: output.frame });
+                }
+                continue;
+            }
+            const frame = output.frame;
+            if (frame.t === 'agent_account_update') {
+                if (this.serverAgentWire >= 27)
+                    this.emit({ t: 'agent_account_update', agentKey: live.agentKey, snapshot: frame.snapshot });
+                continue;
+            }
+            switch (frame.t) {
+                case 'agent_event':
+                    // A live process, whatever the event: the idle sweep is about liveness.
+                    this.touch(live);
+                    break;
+                case 'agent_turn_done':
+                    // Busy is sampled (`liveness.turnRunning`, already false by now); a session that was the registry's only busy one
+                    // may just have gone idle, and sampling has no event of its own to announce that.
+                    this.tasks?.sessionBusyChanged();
+                    this.touch(live);
+                    if (typeof frame.nativeSessionId === 'string' && frame.nativeSessionId)
+                        live.nativeSessionId = frame.nativeSessionId;
+                    // The adapter works: its earlier own exits no longer count towards the crash limit.
+                    if (frame.status !== 'failed')
+                        this.adapterCrashes.delete(live.sessionRef);
+                    break;
+                case 'agent_session_state':
+                    // A level, never journaled; the session keeps the latest (`activityRaw`) for `agent_opened`/the resume offer, even for a
+                    // server too old to be sent the push itself. A push is when sampled busy may flip, so the registry looks again.
+                    live.lastActivityAtMs = Date.now();
+                    live.staleActivityWarned = false;
+                    this.tasks?.sessionBusyChanged();
+                    break;
+                case 'agent_runtime_profile':
+                    if (this.sessions.get(live.sessionRef) !== live)
+                        continue;
+                    break;
+            }
+            const projection = projectFrame(output, {
+                sessionRef: live.sessionRef,
+                serverAgentWire: this.serverAgentWire,
+                ...(frame.t === 'agent_turn_done' && frame.agentRefused === true
+                    ? { authMethods: this.agents.observedAuthMethods(live.agentId) } : {}),
+            });
+            if (projection.note) {
+                void live.session.note(projection.note).catch((err) => {
+                    console.error(`[agent] auto-answer for an undeliverable card failed for ${live.sessionRef}: ${errorMessage(err)}`);
+                });
+            }
+            if (!projection.frame) {
+                if (frame.t === 'agent_event' && frame.acpSessionId !== undefined) {
+                    console.warn(`[acp:${live.agentId}] scoped live event '${String(frame.eventName)}' for '${String(frame.acpSessionId)}' disabled: ` +
+                        `requires agent wire ${AGENT_WIRE_SCOPED_ORIGIN_VERSION}`);
+                }
+                continue;
+            }
+            if (output.journaled)
+                numbered.push({ seq: frame.seq, src: output.src, frame });
+            else
+                this.emit(projection.frame);
         }
-        this.record(live, (seq) => ({
-            t: 'agent_event',
-            sessionRef: live.sessionRef,
-            seq,
-            eventName: e.eventName,
-            payload: e.payload,
-            // Present only for a subagent's own output. The frame still rides this session's ref, journal
-            // and seq — one watermark per ref (see `WireEvent.acpSessionId`); this field only says which
-            // session on the far side the event belongs to.
-            ...(e.acpSessionId ? { acpSessionId: e.acpSessionId } : {}),
-        }));
+        return numbered.length > 0 ? this.record(live, numbered) : undefined;
     }
-    onAgentTurnDone(live, r) {
-        if (live.closed)
+    /**
+     * The session degraded under its own loop (a poisoned processor, or a transport that failed): its open turns were already ended
+     * `failed` through {@link onSessionFrames} and its adapter is being stopped. It is retired like a swept session — the journal
+     * kept, the server told — so the next `agent_open` spawns anew and loads the native session (interface-contracts: the poison
+     * recovery contract; never retried from a checkpoint).
+     */
+    async onSessionDegraded(live, reason) {
+        if (live.closed || this.sessions.get(live.sessionRef) !== live)
             return;
-        this.tasks?.agentTurnFinished(live.sessionRef);
-        this.touch(live);
-        if (r.nativeSessionId)
-            live.nativeSessionId = r.nativeSessionId;
-        this.record(live, (seq) => ({
-            t: 'agent_turn_done',
-            sessionRef: live.sessionRef,
-            seq,
-            status: r.status,
-            stopReason: r.stopReason,
-            nativeSessionId: r.nativeSessionId ?? null,
-            error: r.error ?? null,
-            // Only on a failure the agent itself answered. This is the frame credentials that expired
-            // mid-conversation arrive on — the agent answers the next `session/prompt` with
-            // `auth_required` rather than ending the session — and it is also the busiest frame on this
-            // channel, one per turn for the life of every session, which is why a completed turn carries
-            // no table nothing reads.
-            //
-            // `status === 'failed'` on its own would be wrong, and wrong in the direction that hurts:
-            // `AcpSession` synthesises that status on three paths the agent never answered (a prompt
-            // after the read loop died, a connection that aborted mid-turn, an unmappable update), all of
-            // them on a *live* session whose method table this daemon certainly holds. An agent process
-            // crashing mid-turn is plausibly more common than a token expiring mid-turn, so pairing those
-            // with `authMethods` would put more false login cards on screen than real ones. See
-            // {@link TurnResult.agentRefused}.
-            //
-            // And `agentRefused` on its own is not enough either, which is what `errorCode` is here for:
-            // an exceeded context window is a refusal the agent genuinely answered, and it is common.
-            ...(r.status === 'failed' && r.agentRefused ? this.refusalFields(live.agentId, r.errorCode) : {}),
-        }));
+        console.error(`[acp:${live.agentId} agent:${live.agentKey}] session ${live.sessionRef} degraded and was stopped: ${reason}`);
+        const alreadyLost = live.adapterLost?.notified === true;
+        await this.retire(live, 'keep');
+        // Its adapter's exit already told the server: a second notice could arrive after the server reopened the ref, and void the new
+        // generation.
+        if (!alreadyLost)
+            this.notifySwept(live.sessionRef);
     }
     /**
-     * Numbers a frame, writes it, then sends it. The seq is taken synchronously so callbacks are
-     * numbered in arrival order; the write and the send ride the session's queue so they stay in that
-     * order on the wire.
+     * Records processor-numbered frames in the session's outbox (the processor's frame, without `sessionRef`). They are sent from
+     * there by {@link pump} — an append announces itself — under the session window and the socket gate. A failed append rejects:
+     * the session degrades (a frame that could not be recorded is not sent either).
      */
-    record(live, build) {
-        const seq = live.journal.nextSeq();
-        const frame = build(seq);
-        void this.enqueue(live, async () => {
-            try {
-                await live.journal.append({ seq, frame });
-            }
-            catch (err) {
-                // Losing durability is bad; losing the event outright is worse. Send it anyway — it just
-                // will not survive a reconnect.
-                console.error(`[agent] journal append failed for ${live.sessionRef}: ${errorMessage(err)}`);
+    record(live, frames) {
+        for (const { seq, frame } of frames) {
+            if (frame.t === 'agent_event' && frame.acpSessionId != null) {
+                live.highestScopedJournalSeq = Math.max(live.highestScopedJournalSeq, seq);
             }
-            this.emit(frame);
+        }
+        return live.session.outbox.append(frames);
+    }
+    /**
+     * The server applied through `throughSeq` (`agent_event_ack`, or the `resumeFromSeq` of a reopen): the outbox forgets those
+     * entries and the transport truncates its stream (with the `committedTail` watermark). Held back, like delivery, while an
+     * incompatible server still owes this session a scoped frame it cannot interpret.
+     */
+    async acknowledge(live, throughSeq) {
+        if (live.scopedReplayBlocked || this.blockIncompatibleJournal(live))
+            return;
+        await live.session.outbox.ack(throughSeq, (error) => {
+            console.error(`[agent] outbox commit failed for ${live.sessionRef}: ${errorMessage(error)}`);
         });
+        if (throughSeq >= live.highestScopedJournalSeq)
+            live.highestScopedJournalSeq = 0;
+    }
+    /**
+     * Must run before replay, delivery or ACK truncation: a server below {@link AGENT_WIRE_SCOPED_ORIGIN_VERSION} cannot deliver or
+     * acknowledge a scoped frame the outbox still holds, so nothing of this session goes to it (sending a higher seq would let it
+     * acknowledge past the child event it could not interpret).
+     */
+    blockIncompatibleJournal(live) {
+        if (this.serverAgentWire >= AGENT_WIRE_SCOPED_ORIGIN_VERSION)
+            return false;
+        if (live.scopedReplayBlocked)
+            return true;
+        // Only a compatible ACK proves the peer has applied (or explicitly accepted a gap through) that scoped sequence.
+        const incompatible = live.highestScopedJournalSeq > 0;
+        if (incompatible)
+            live.scopedReplayBlocked = true;
+        return incompatible;
+    }
+    /**
+     * The sender (spec §5.6): sessions take turns, one frame each per round, while the socket gate is open. A session sends its
+     * next unsent outbox entry only while fewer than {@link SESSION_WINDOW_EVENTS} events and {@link SESSION_WINDOW_BYTES} bytes it
+     * sent on this connection are unacknowledged (one frame always fits an empty window). Each frame is projected for the
+     * connected server as it leaves. Re-entrant calls fold into the running one.
+     */
+    pump() {
+        if (this.pumping) {
+            this.pumpAgain = true;
+            return;
+        }
+        this.pumping = true;
+        try {
+            do {
+                this.pumpAgain = false;
+                if (this.send === null)
+                    return;
+                const lives = [...this.sessions.values()];
+                if (lives.length === 0)
+                    return;
+                let progressed = true;
+                while (progressed) {
+                    progressed = false;
+                    const start = this.turn;
+                    this.turn = (start + 1) % lives.length;
+                    for (let k = 0; k < lives.length; k++) {
+                        const live = lives[(start + k) % lives.length];
+                        if (live.closed || this.sessions.get(live.sessionRef) !== live)
+                            continue;
+                        if (live.scopedReplayBlocked || this.blockIncompatibleJournal(live))
+                            continue;
+                        const outbox = live.session.outbox;
+                        const item = outbox.nextUnsent();
+                        if (!item)
+                            continue;
+                        // A resolving subagent relation and everything before it go out past the window, in seq order — the server cannot
+                        // acknowledge anything after a child frame without it (spec §5.6). Once sent they count again for a server that
+                        // acknowledges as soon as the relation releases its cap (wire ≥ 25); an older one wastes its acks while capped, so
+                        // there they keep not counting (`SessionOutbox.inflight`).
+                        const pinnedCountsWhenSent = this.serverAgentWire >= AGENT_WIRE_RELATION_ACK_VERSION;
+                        const inflight = outbox.inflight(this.epoch, pinnedCountsWhenSent);
+                        const bypass = item.seq <= outbox.pinnedThrough;
+                        if (!bypass && (inflight.events >= SESSION_WINDOW_EVENTS || (inflight.events > 0 && inflight.bytes + item.bytes > SESSION_WINDOW_BYTES)))
+                            continue;
+                        if (!this.gate.isOpen()) {
+                            this.gate.whenOpen(() => this.pump());
+                            return;
+                        }
+                        item.sentOn = this.epoch;
+                        this.sendRecorded(live, item.frame, item.src);
+                        progressed = true;
+                        if (this.send === null)
+                            return;
+                        if (live.adapterLost && !live.adapterLost.notified && item.seq >= live.adapterLost.throughSeq)
+                            this.flushAdapterLost(live.sessionRef);
+                    }
+                }
+            } while (this.pumpAgain);
+        }
+        finally {
+            this.pumping = false;
+        }
+    }
+    /** A retiring session's last unsent frames, in order (outside the rotation; bounded by its window). */
+    sendUnsent(live) {
+        if (this.send === null || live.scopedReplayBlocked || this.blockIncompatibleJournal(live))
+            return;
+        for (let item = live.session.outbox.nextUnsent(); item; item = live.session.outbox.nextUnsent()) {
+            item.sentOn = this.epoch;
+            this.sendRecorded(live, item.frame, item.src);
+        }
     }
-    /** Appends `op` to the session's serialized queue. The returned promise never rejects. */
-    enqueue(live, op) {
-        const next = live.writes.then(op).catch((err) => {
-            console.error(`[agent] journal operation failed for ${live.sessionRef}: ${errorMessage(err)}`);
+    /** One recorded frame, projected for the connected server as it leaves. */
+    sendRecorded(live, frame, src) {
+        const projection = projectFrame({ journaled: true, frame, src }, {
+            sessionRef: live.sessionRef,
+            serverAgentWire: this.serverAgentWire,
+            ...(frame.t === 'agent_turn_done' && frame.agentRefused === true ? { authMethods: this.agents.observedAuthMethods(live.agentId) } : {}),
         });
-        live.writes = next;
-        return next;
+        if (projection.note) {
+            void live.session.note(projection.note).catch((err) => {
+                console.error(`[agent] auto-answer for an undeliverable card failed for ${live.sessionRef}: ${errorMessage(err)}`);
+            });
+        }
+        if (projection.frame)
+            this.emit(projection.frame);
     }
     async onClose(sessionRef) {
+        // The server is done with the ref: a switch it was waiting for is moot (Task 24), and so is its adapter's crash count.
+        void this.agents.cancelSwitch?.({ sessionRef }).catch(() => false);
+        this.reopenRequests.delete(sessionRef);
+        this.adapterCrashes.delete(sessionRef);
         // Closing a ref that is still spawning: nothing to close yet, so tombstone it — openSession
         // closes the session (and destroys its journal) the moment the bridge hands it over.
         //
@@ -1548,47 +2855,78 @@ export class AgentSessionManager {
             return;
         }
         const live = this.sessions.get(sessionRef);
-        if (!live)
+        if (live) {
+            await this.retire(live, 'destroy');
             return;
-        await this.retire(live, 'destroy');
+        }
+        // Not held: whatever an earlier life left under the ref (a swept or degraded session's outbox, a previous daemon's, a migrated
+        // legacy journal) can never be asked for again — it goes, as the journal did on `agent_close`.
+        //
+        // The cleanup publishes on `retiring` — synchronously, before this handler's first await — because the server's close→reopen
+        // pair (a stale recycle, a config reload) can land its reopen while the cleanup is still listing the keeper. `openSession`
+        // waits on this map as its very first statement, so without the publication that open spawns under the cleanup, and the
+        // cleanup's list sees the fresh spawn as a running leftover and stops it mid-`initialize` ("exited before responding to
+        // initialize (code=null, signal=SIGTERM)"). The recheck stays inside: an open that appeared while a previous teardown was
+        // settling owns the ref — its reopen reads the leftover outbox back instead of dropping it. A cleanup that fails must not
+        // fail whatever waits on it (the published promise never rejects), and a second close chains behind this one as today.
+        const previous = this.retiring.get(sessionRef);
+        const cleanup = (async () => {
+            await previous;
+            if (this.sessions.has(sessionRef) || this.opening.has(sessionRef))
+                return;
+            await this.agents.releaseLeftover?.(sessionRef);
+        })().catch((error) => {
+            console.warn(`[agent] leftover cleanup for ${sessionRef} failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        this.retiring.set(sessionRef, cleanup);
+        try {
+            await cleanup;
+        }
+        finally {
+            if (this.retiring.get(sessionRef) === cleanup)
+                this.retiring.delete(sessionRef);
+        }
     }
     /**
      * The teardown behind `agent_close`: stop emitting, unregister, kill the agent subprocess, and —
-     * when
-     * `journal` says so — delete the journal. Shared with {@link sweepIdle} so an orphan swept on the
-     * timer leaves exactly as little behind as one the server closed properly, except for the file
-     * itself (see {@link sweepIdle} for why that one differs).
+     * when `outbox` says so — drop the session's transport session with its outbox. Shared with {@link sweepIdle} so an orphan swept
+     * on the timer leaves exactly as little behind as one the server closed properly, except for the outbox itself (see
+     * {@link sweepIdle} for why that one differs).
      *
-     * `journal: 'keep'` still rides the same queue and still publishes on {@link retiring}. The wait
-     * is not about the unlink: the point is that this session's pending appends must have landed
-     * before a reopen constructs a second {@link SessionJournal} on the same path, or the new
-     * instance recovers its seq counter from a file that is still being written behind it.
+     * Published on {@link retiring} either way: a reopen spawns under the same transport key, so it must wait until the old adapter
+     * is stopped and the session's pending appends (and its head checkpoint) have landed — or its outbox is gone.
      */
-    async retire(live, journal) {
+    async retire(live, outbox) {
         const sessionRef = live.sessionRef;
+        // Closed for good (an `agent_close`): its crash count goes with it. A `keep` retire is a respawn, a sweep or a degrade — the count
+        // must survive it, or a crash-looping adapter would be respawned for ever.
+        if (outbox === 'destroy')
+            this.adapterCrashes.delete(sessionRef);
         live.closed = true;
+        live.unwatch();
         this.sessions.delete(sessionRef);
         this.tasks?.unregisterAgentSession(sessionRef);
-        // Queued behind the pending writes: an append that landed after the file was removed would
-        // resurrect a journal for a session that no longer exists. Published on `retiring` for the whole
-        // teardown, so a reopen of this ref parks until the file is actually gone.
-        const journalDone = this.enqueue(live, async () => {
-            if (journal === 'destroy')
-                await live.journal.destroy();
+        if (outbox === 'detach')
+            this.detached.add(sessionRef);
+        const closed = (async () => {
+            // Frames produced before the close still go out (as the journal's queued sends did): appends in flight land, then whatever
+            // is unsent is written — the session left the sender's rotation with the `sessions` entry.
+            await live.session.outbox.flush();
+            this.sendUnsent(live);
+            if (outbox === 'detach' && live.session.detach)
+                await live.session.detach();
+            else
+                await live.session.close(outbox === 'destroy' ? 'release' : 'keep');
+        })().catch((err) => {
+            console.error(`[agent] close failed for ${sessionRef}: ${errorMessage(err)}`);
         });
-        const retired = journalDone.finally(() => {
+        const retired = closed.then(() => undefined).finally(() => {
             // Only clear our own entry: a later close of the same ref may already have replaced it.
             if (this.retiring.get(sessionRef) === retired)
                 this.retiring.delete(sessionRef);
         });
         this.retiring.set(sessionRef, retired);
-        try {
-            await live.session.close();
-        }
-        catch (err) {
-            console.error(`[agent] close failed for ${sessionRef}: ${errorMessage(err)}`);
-        }
-        await journalDone;
+        await retired;
     }
     /**
      * The one place every outbound agent frame passes, and so the one place the wire contract can be