@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/agentSessions.js

@@ -1,21 +1,14 @@
 import path from 'node:path';
-import { createHash, randomUUID } from 'node:crypto';
-import { AGENT_WIRE_AUTH_URL_VERSION, AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION, AGENT_WIRE_SCOPED_ORIGIN_VERSION, AGENT_WIRE_ORPHAN_OFFER_VERSION, AGENT_WIRE_SESSION_AUTH_METHODS_VERSION, AGENT_WIRE_SESSION_LOST_VERSION, AGENT_WIRE_VERSION, AGENT_WIRE_DELEGATION_MCP_VERSION, AGENT_WIRE_DELEGATION_RENEW_VERSION, AGENT_WIRE_PROVIDER_TASK_VERSION, AGENT_WIRE_REOPEN_REQUEST_VERSION, AGENT_WIRE_RELATION_ACK_VERSION, outboundAgentFrameRejection, outboundFailureReply, } from './protocol/agent.js';
+import { AGENT_WIRE_AUTH_URL_VERSION, AGENT_WIRE_HEARTBEAT_INVENTORY_VERSION, AGENT_WIRE_SCOPED_ORIGIN_VERSION, AGENT_WIRE_ORPHAN_OFFER_VERSION, AGENT_WIRE_SESSION_AUTH_METHODS_VERSION, AGENT_WIRE_SESSION_LOST_VERSION, AGENT_WIRE_VERSION, AGENT_WIRE_PROVIDER_TASK_VERSION, AGENT_WIRE_REOPEN_REQUEST_VERSION, AGENT_WIRE_RELATION_ACK_VERSION, outboundAgentFrameRejection, outboundFailureReply, } from './protocol/agent.js';
 import { listLegacyJournalRefs, readLegacyJournal, removeLegacyJournal } from './journal.js';
 import { SESSION_WINDOW_BYTES, SESSION_WINDOW_EVENTS } from './acp/outbox.js';
 import { SocketGate } from './agentFlow.js';
 import { AGENT_PROBE_TIMEOUT_MS, AgentRefusedSessionError, LOCAL_SESSION_UNMOVABLE } from './acp/acpAgents.js';
-import { AdapterStillInstallingError } from './acp/builds/model.js';
 import { projectFrame } from './acp/processor/projection.js';
+import { TaskRegistry } from './update/taskRegistry.js';
 import { reportsActivity, supportsAsyncTaskStop } from './acp/activityReporting.js';
 import { activityIsBusy } from './acp/activityBusy.js';
-import { buildSessionMcpServers } from './acp/delegationMcp.js';
 import { ADAPTER_LOST_REOPEN_ATTEMPTS, plainSwitchBlocker, REOPEN_REQUEST_RETRY_MS, switchBlockers, SWITCH_QUIET_MS } from './acp/switching.js';
-function delegationLeaseId(lease) {
-    return createHash('sha256').update(JSON.stringify([
-        lease.url, lease.headers, lease.bindingId,
-    ])).digest('hex');
-}
 /**
  * 从线上收来的验证预算的绝对上限。
  *
@@ -129,10 +122,6 @@ function openSpecOf(frame) {
         openRequestId: frame.id,
         sessionRef: frame.sessionRef,
         agentKey: frame.agentKey,
-        ...(frame.delegationMcp ? { delegation: {
-                leaseId: delegationLeaseId(frame.delegationMcp),
-                ...(frame.delegationMcp.bindingId ? { bindingId: frame.delegationMcp.bindingId, instanceId: randomUUID() } : {}),
-            } } : {}),
         // `frame.bridge` is the registry agent id now — the wire field keeps its name because Plan A
         // renames nothing (Global Constraint 3); ruling R2 replaced what it *means*.
         agentId: frame.bridge,
@@ -143,7 +132,6 @@ function openSpecOf(frame) {
         args: frame.args ?? [],
         ...(frame.nativeSessionId ? { nativeSessionId: frame.nativeSessionId } : {}),
         ...(frame.requireSessionLoad ? { requireSessionLoad: true } : {}),
-        ...(frame.delegationMcp ? { delegationMcp: frame.delegationMcp } : {}),
         // Retaining a whole adopted history costs memory for the session's lifetime, so it is only
         // kept when this open is the one that will stream it back.
         backfill: frame.backfill === true,
@@ -163,13 +151,6 @@ function exitWords(exit) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
-/**
- * The reply text of an open that failed. A managed (delegation) open hides the cause behind one fixed sentence — except when
- * the adapter is still being installed: that one is actionable ("try again shortly") and carries nothing about the lease (15c).
- */
-function openFailureText(frame, err) {
-    return frame.delegationMcp && !(err instanceof AdapterStillInstallingError) ? 'Managed delegation session could not open' : errorMessage(err);
-}
 /**
  * Batch size for `agent_backfill_events`. Kept modest so a session with a long history does not
  * arrive as one giant frame; the last batch of a stream is whatever remains below this size.
@@ -250,7 +231,11 @@ export class AgentSessionManager {
     agents;
     journalDir;
     tasks;
+    admission;
+    ownership;
     sessions = new Map();
+    /** A failed recorded-build respawn keeps this binding even after no LiveSession remains. */
+    retainedRespawnBuilds = new Map();
     /** In-flight opens, keyed by sessionRef, so two racing agent_open frames cannot spawn two agents. */
     opening = new Map();
     /**
@@ -356,10 +341,12 @@ export class AgentSessionManager {
     /** `<configDir>/agents`: the legacy journals (`sessions/<ref>.jsonl`) an older CLI left are migrated from here, once. */
     journalDir, 
     /** Shared update admission and force-cancellation authority, when this daemon supports updates. */
-    tasks) {
+    tasks, admission = () => true, ownership) {
         this.agents = agents;
         this.journalDir = journalDir;
         this.tasks = tasks;
+        this.admission = admission;
+        this.ownership = ownership;
         this.send = send;
     }
     /** Where an older CLI's journals live: `<journalDir>/sessions/<sessionRef>.jsonl` (read-only legacy, `journal.ts`). */
@@ -387,7 +374,7 @@ export class AgentSessionManager {
             }
             for (const sessionRef of refs) {
                 try {
-                    const entries = await readLegacyJournal(this.sessionsDir, sessionRef);
+                    const entries = await readLegacyJournal(this.sessionsDir, sessionRef, this.ownership);
                     const imported = await importOutbox(sessionRef, entries.map((entry) => ({
                         seq: entry.seq,
                         ...(entry.src ? { src: entry.src } : {}),
@@ -578,7 +565,7 @@ export class AgentSessionManager {
         this.send = send;
         this.serverAgentWire = serverAgentWire;
         // A new connection: its own window and socket. What was sent on the previous one waits for the server's reopen to say how far
-        // it got; what was never sent goes out now.
+        // it got. An already-exited adapter's recovered turn is replayed in full to finish it before reopen.
         this.epoch += 1;
         for (const live of this.sessions.values())
             live.session.outbox.connectionChanged();
@@ -586,6 +573,9 @@ export class AgentSessionManager {
         // Before any inbound frame on this connection can be answered: a sweep notice that arrived here
         // after the server had already re-opened its ref would invalidate a healthy generation.
         this.flushSwept();
+        for (const live of this.sessions.values())
+            if (live.replayDeadTail)
+                live.session.outbox.resendAll();
         this.pump();
         // Account observations are outside the session journal. Replay the cached state on reconnect
         // so a server restart does not depend on the provider sending another quota notification.
@@ -756,12 +746,17 @@ export class AgentSessionManager {
                 highestScopedJournalSeq = Math.max(highestScopedJournalSeq, item.seq);
         }
         const live = {
-            sessionRef: candidate.sessionRef, adopted: true, agentId: candidate.agentId, agentKey: candidate.agentKey, session,
+            sessionRef: candidate.sessionRef, adopted: true, replayDeadTail: candidate.agentAlive === false, agentId: candidate.agentId, agentKey: candidate.agentKey, session,
             nativeSessionId: session.nativeSessionId ?? null,
             scopedReplayBlocked: false, highestScopedJournalSeq, unwatch: () => { }, replays: Promise.resolve(), closed: false,
             lastActivityAt: Date.now(),
         };
-        this.register(live);
+        this.register(live, this.adoptionOrigin);
+        // An exited adapter is adopted only to finish its recovered turn. Release its entire retained
+        // prefix in order so that tail can settle the server's turn before a reopen respawns the adapter.
+        // Live adapters retain the ordinary reopen/watermark gate.
+        if (live.replayDeadTail)
+            live.session.outbox.resendAll();
         console.info(`[acp:${live.agentId} agent:${live.agentKey}] adopted session ${live.sessionRef} from keeper-acp`);
     }
     /** Waits (bounded) for the start-time adoption; what is still rebuilding afterwards is reported as such. */
@@ -796,6 +791,23 @@ export class AgentSessionManager {
         clearTimeout(timer);
     }
     async handleFrame(frame) {
+        const live = 'sessionRef' in frame && typeof frame.sessionRef === 'string' ? this.liveSession(frame.sessionRef) : undefined;
+        const openContinuation = frame.t === 'agent_open' && ((live && !this.needsRespawn(live)) || this.opening.has(frame.sessionRef) || this.adopting.has(frame.sessionRef));
+        const newWork = !openContinuation && ['agent_open', 'agent_prompt', 'agent_list_native', 'agent_delete_native', 'agent_account_read', 'agent_verify', 'agent_authenticate', 'agent_install', 'agent_switch_idle'].includes(frame.t);
+        const registry = this.tasks ?? this.acceptedTasks;
+        const ticket = newWork && this.admission() ? registry.beginAcceptedAgentWork(frame.t, frame, frame.t === 'agent_prompt' ? this.adoptionOrigin : undefined) : null;
+        const admitted = (!newWork && (frame.t !== 'agent_open' || this.admission())) || ticket !== null;
+        try {
+            await this.handleAcceptedFrame(frame, ticket, admitted, registry);
+        }
+        finally {
+            if (ticket)
+                registry.finishAcceptedAgentWork(ticket);
+        }
+    }
+    acceptedTasks = new TaskRegistry();
+    adoptionOrigin = {};
+    async handleAcceptedFrame(frame, ticket, admitted, registry) {
         // A frame for a ref keeper-acp still runs from a previous daemon waits until that session is rebuilt (Task 21): answering
         // it "unknown session" would end a turn that is going on.
         const frameRef = 'sessionRef' in frame && typeof frame.sessionRef === 'string' ? frame.sessionRef : undefined;
@@ -809,40 +821,8 @@ export class AgentSessionManager {
         for (let parked = frameRef !== undefined ? this.switching.get(frameRef) : undefined; parked; parked = this.switching.get(frameRef))
             await parked;
         switch (frame.t) {
-            case 'agent_delegation_renew': {
-                if (this.serverAgentWire < AGENT_WIRE_DELEGATION_RENEW_VERSION)
-                    return;
-                const live = this.liveSession(frame.sessionRef);
-                const now = Date.now();
-                // Delegation's non-secret fields are processor state (Task 19): the checks read it, an accepted renewal is a note.
-                const delegation = live?.session.delegation ?? undefined;
-                if (!live || !delegation || live.closed || !live.session.liveness.agentAlive || live.session.liveness.turnRunning ||
-                    activityIsBusy(live.session.activityRaw) || delegation.refreshPending ||
-                    live.nativeSessionId !== frame.nativeSessionId || delegation.instanceId !== frame.instanceId ||
-                    delegation.bindingId !== frame.bindingId || !frame.bindingId ||
-                    !Number.isSafeInteger(frame.renewalRevision) || frame.renewalRevision < 1 ||
-                    !Number.isSafeInteger(frame.expiresAtEpochMs) || frame.expiresAtEpochMs <= now ||
-                    frame.expiresAtEpochMs > now + 330_000 || frame.renewalRevision < (delegation.renewalRevision ?? 0) ||
-                    frame.expiresAtEpochMs < delegation.expiresAtEpochMs ||
-                    (frame.renewalRevision === delegation.renewalRevision && frame.expiresAtEpochMs !== delegation.expiresAtEpochMs)) {
-                    this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: false, error: 'The original managed instance cannot renew' });
-                    return;
-                }
-                try {
-                    await live.session.note({ type: 'agent_delegation_renewed', expiresAtEpochMs: frame.expiresAtEpochMs, renewalRevision: frame.renewalRevision });
-                }
-                catch (err) {
-                    this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: false, error: errorMessage(err) });
-                    return;
-                }
-                const renewed = live.session.delegation ?? delegation;
-                this.emit({ t: 'agent_delegation_renewed', id: frame.id, ok: true,
-                    nativeSessionId: live.nativeSessionId, instanceId: renewed.instanceId, bindingId: renewed.bindingId,
-                    renewalRevision: renewed.renewalRevision, expiresAtEpochMs: renewed.expiresAtEpochMs });
-                return;
-            }
             case 'agent_open': {
-                const admission = this.reserveOpen(frame.id, frame.sessionRef);
+                const admission = this.reserveOpen(frame, ticket, admitted, registry);
                 if (admission === 'rejected')
                     return;
                 const ref = frame.sessionRef;
@@ -852,7 +832,7 @@ export class AgentSessionManager {
                 }
                 finally {
                     if (admission === 'reserved')
-                        this.tasks?.agentOpenFinished(ref);
+                        registry.agentOpenFinished(ref);
                     const left = (this.openHandling.get(ref) ?? 1) - 1;
                     if (left > 0)
                         this.openHandling.set(ref, left);
@@ -868,7 +848,7 @@ export class AgentSessionManager {
                 const live = this.routableSession(frame.sessionRef, 'prompt');
                 if (!live)
                     return;
-                if (this.tasks && !this.tasks.tryAdmitTurn(frame.sessionRef)) {
+                if (!admitted) {
                     // The refusal is the daemon's decision, so it is a note (`agent_prompt{admitted:false}`) and the processor ends the
                     // turn `failed` with the same words (`ADMISSION_REFUSED`), numbered in the session's own sequence (spec §5.4). No
                     // `authMethods`: the processor's short frame carries no `agentRefused`, so the projection adds none — the prompt
@@ -876,6 +856,14 @@ export class AgentSessionManager {
                     live.session.refusePrompt(frame.platformTurnId);
                     return;
                 }
+                if (ticket)
+                    try {
+                        registry.consumeAcceptedAgentWork(ticket, frame.t, frame);
+                    }
+                    catch {
+                        live.session.refusePrompt(frame.platformTurnId);
+                        return;
+                    }
                 live.session.prompt(promptBlocks(frame), frame.platformTurnId);
                 return;
             }
@@ -1013,6 +1001,10 @@ export class AgentSessionManager {
              * keep holding that row or to deliver it the ordinary way. A silent drop parks it forever.
              */
             case 'agent_steer': {
+                if (!this.admission()) {
+                    this.emit({ t: 'agent_steered', id: frame.id, ok: false, error: 'Registration admission is paused' });
+                    return;
+                }
                 const live = this.routableSession(frame.sessionRef, 'steer');
                 if (!live) {
                     this.emit({ t: 'agent_steered', id: frame.id, ok: false, error: `no live session '${frame.sessionRef}'` });
@@ -1054,6 +1046,10 @@ export class AgentSessionManager {
              * a request that never resolves.
              */
             case 'agent_set_config_option': {
+                if (!this.admission()) {
+                    this.emit({ t: 'agent_config_option_set', id: frame.id, ok: false, error: 'Registration admission is paused' });
+                    return;
+                }
                 const live = this.routableSession(frame.sessionRef, 'set_config_option');
                 if (!live) {
                     this.emit({ t: 'agent_config_option_set', id: frame.id, ok: false, error: `no live session '${frame.sessionRef}'` });
@@ -1089,14 +1085,14 @@ export class AgentSessionManager {
                 return;
             }
             case 'agent_list_native':
-                if (this.tasks && !this.tasks.accepting) {
+                if (!admitted) {
                     this.emit({ t: 'agent_native_sessions', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
                     return;
                 }
                 await this.onListNative(frame);
                 return;
             case 'agent_delete_native':
-                if (this.tasks && !this.tasks.accepting) {
+                if (!admitted) {
                     this.emit({ t: 'agent_native_deleted', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
                     return;
                 }
@@ -1105,7 +1101,7 @@ export class AgentSessionManager {
             // Both of these spawn an agent subprocess, exactly as `agent_list_native` does, so they answer
             // a draining workstation the same way rather than starting work it is trying to finish.
             case 'agent_account_read': {
-                if (this.tasks && !this.tasks.accepting) {
+                if (!admitted) {
                     this.emit({ t: 'agent_account_read_result', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
                     return;
                 }
@@ -1127,14 +1123,14 @@ export class AgentSessionManager {
                 return;
             }
             case 'agent_verify':
-                if (this.tasks && !this.tasks.accepting) {
+                if (!admitted) {
                     this.emit({ t: 'agent_verified', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
                     return;
                 }
                 await this.onVerify(frame);
                 return;
             case 'agent_authenticate':
-                if (this.tasks && !this.tasks.accepting) {
+                if (!admitted) {
                     this.emit({ t: 'agent_authenticated', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
                     return;
                 }
@@ -1143,7 +1139,7 @@ export class AgentSessionManager {
             // Downloads a package; starts nothing. Still refused while draining, because a workstation on
             // its way down should not begin a multi-megabyte fetch it will be killed in the middle of.
             case 'agent_install':
-                if (this.tasks && !this.tasks.accepting) {
+                if (!admitted) {
                     this.emit({ t: 'agent_installed', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
                     return;
                 }
@@ -1151,7 +1147,7 @@ export class AgentSessionManager {
                 return;
             // "Move idle sessions" (Task 25): a move spawns adapters, so a draining workstation refuses it like an install.
             case 'agent_switch_idle':
-                if (this.tasks && !this.tasks.accepting) {
+                if (!admitted) {
                     this.emit({ t: 'agent_switch_idle_result', id: frame.id, ok: false, error: 'Workstation is not accepting new work' });
                     return;
                 }
@@ -1199,24 +1195,31 @@ export class AgentSessionManager {
      * stop leaves attached. A ref absent from both maps is genuinely new work and still needs
      * the ordinary TaskRegistry admission reservation.
      */
-    reserveOpen(openId, sessionRef) {
-        if (!this.tasks)
-            return 'continuation';
+    reserveOpen(frame, ticket, admitted, registry) {
+        const { id: openId, sessionRef } = frame;
+        if (!admitted) {
+            this.emit({ t: 'agent_opened', id: openId, ok: false, error: 'Workstation is not accepting new work' });
+            return 'rejected';
+        }
         const live = this.liveSession(sessionRef);
         // A keeper-hosted session whose adapter is gone is respawned by this open: new work, not a continuation — it takes a reservation,
         // and a draining workstation refuses it like any open (spec §8.2; fix round 1, minor 9).
         const respawn = live !== undefined && this.needsRespawn(live);
-        if (this.tasks.isForceStopping()) {
+        if (registry.isForceStopping()) {
             // A keeper-hosted session a force update left attached (TaskRegistry.stopAll) is still reopened as a continuation — a reconnect
             // during the download must not cut it off; anything else is refused.
-            if (live && !respawn && this.tasks.isDurableSession(sessionRef))
+            if (live && !respawn && registry.isDurableSession(sessionRef))
                 return 'continuation';
             this.emit({ t: 'agent_opened', id: openId, ok: false, error: 'Workstation is not accepting new work' });
             return 'rejected';
         }
         if ((live && !respawn) || this.opening.has(sessionRef) || this.adopting.has(sessionRef))
             return 'continuation';
-        if (this.tasks.tryReserveAgentOpen(sessionRef))
+        if (ticket) {
+            registry.reserveAcceptedAgentOpen(ticket, frame);
+            return 'reserved';
+        }
+        if (registry.tryReserveAgentOpen(sessionRef))
             return 'reserved';
         this.emit({ t: 'agent_opened', id: openId, ok: false, error: 'Workstation is not accepting new work' });
         return 'rejected';
@@ -1490,20 +1493,6 @@ export class AgentSessionManager {
         return idle.map((live) => live.sessionRef);
     }
     async onOpen(frame) {
-        if (frame.delegationMcp && (this.serverAgentWire < AGENT_WIRE_DELEGATION_MCP_VERSION ||
-            (frame.delegationMcp.bindingId && this.serverAgentWire < AGENT_WIRE_DELEGATION_RENEW_VERSION))) {
-            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation requires a newer server' });
-            return;
-        }
-        if (frame.delegationMcp) {
-            try {
-                buildSessionMcpServers([], frame.delegationMcp);
-            }
-            catch {
-                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Delegation MCP configuration is unavailable' });
-                return;
-            }
-        }
         // Rotation is server-driven. A busy reconnect resends the original process's outbox.
         let existing = this.liveSession(frame.sessionRef);
         // An open that would spawn the ref's adapter anew after it kept exiting on its own waits out the backoff (no crash loop).
@@ -1532,69 +1521,33 @@ export class AgentSessionManager {
             retireForRefresh = existing;
             existing = undefined;
         }
+        // A keeper session's label records the build that created its native session. Preserve that
+        // binding across an adapter exit: the agent's current pointer may have advanced meanwhile,
+        // but a cached reconnect must retry the recorded package before any explicit switch.
+        const recordedBuildId = retireForRefresh
+            ? this.agents.placementOf?.(retireForRefresh.session)?.buildId
+            : this.retainedRespawnBuilds.get(frame.sessionRef);
         if (existing) {
-            const delegation = existing.session.delegation ?? undefined;
-            if (delegation && !frame.delegationMcp) {
-                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation lease is required' });
+            // Spec §6.3: a session with a switch pending (a persistent intent: another adapter build, or off an older keeper-acp
+            // generation) moves at this open — the only moment its spawn secrets are at hand — when it is strictly idle.
+            if (await this.switchAtOpen(existing, frame))
                 return;
-            }
-            if (frame.delegationMcp && frame.nativeSessionId && frame.nativeSessionId !== existing.nativeSessionId) {
-                this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation cannot reload the original session' });
+            // Reusing a live session: neither the process nor the native session moved.
+            if (!await this.resumeAndReply(existing, frame, false))
                 return;
-            }
-            const refresh = !!frame.delegationMcp &&
-                (delegation?.leaseId !== delegationLeaseId(frame.delegationMcp) || delegation?.refreshPending === true);
-            if (refresh) {
-                if (!existing.nativeSessionId || (frame.nativeSessionId && frame.nativeSessionId !== existing.nativeSessionId)) {
-                    this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation cannot reload the original session' });
-                    return;
-                }
-                if (existing.session.liveness.turnRunning || activityIsBusy(existing.session.activityRaw)) {
-                    if (!delegation?.refreshPending) {
-                        try {
-                            await existing.session.note({ type: 'agent_delegation_refresh_pending' });
-                        }
-                        catch (err) {
-                            this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: errorMessage(err) });
-                            return;
-                        }
-                    }
-                    if (!await this.resumeAndReply(existing, frame, false))
-                        return;
-                    this.replyNoReplayNeeded(frame);
-                    return;
-                }
-                openFrame = { ...frame, nativeSessionId: existing.nativeSessionId, requireSessionLoad: true };
-                retireForRefresh = existing;
-            }
-            else {
-                // Spec §6.3: a session with a switch pending (a persistent intent: another adapter build, or off an older keeper-acp
-                // generation) moves at this open — the only moment its spawn secrets are at hand — when it is strictly idle.
-                if (await this.switchAtOpen(existing, frame))
-                    return;
-                // Reusing a live session: neither the process nor the native session moved.
-                if (!await this.resumeAndReply(existing, frame, false))
-                    return;
-                // The session already exists, so any history it has was already streamed under whichever
-                // open first established it (or never will be, if that open didn't ask for it) — replaying it
-                // again here would duplicate what the platform already holds. But if THIS frame asked for
-                // backfill, the server is waiting on exactly one `agent_backfill_done` for THIS open's id:
-                // silence is not "no", it is a wait that never resolves. Answer it without replaying.
-                this.replyNoReplayNeeded(frame);
-                return;
-            }
+            // The session already exists, so any history it has was already streamed under whichever
+            // open first established it (or never will be, if that open didn't ask for it) — replaying it
+            // again here would duplicate what the platform already holds. But if THIS frame asked for
+            // backfill, the server is waiting on exactly one `agent_backfill_done` for THIS open's id:
+            // silence is not "no", it is a wait that never resolves. Answer it without replaying.
+            this.replyNoReplayNeeded(frame);
+            return;
         }
         const inFlight = this.opening.get(frame.sessionRef);
         if (inFlight) {
             // Piggyback on the attempt already running, and report its real failure — not a generic one.
             const { live, error, agentRefused } = await inFlight;
             if (live) {
-                const delegation = live.session.delegation ?? undefined;
-                if (!!frame.delegationMcp !== !!delegation ||
-                    (frame.delegationMcp && delegation?.leaseId !== delegationLeaseId(frame.delegationMcp))) {
-                    this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'Managed delegation lease does not match the live session' });
-                    return;
-                }
                 // Piggybacking on the attempt already running: a non-null `live` means that attempt was a
                 // real open (`session/load` or `session/new`), which this frame is reporting secondhand.
                 if (!await this.resumeAndReply(live, frame, true))
@@ -1623,9 +1576,9 @@ export class AgentSessionManager {
         const attempt = (async () => {
             if (retireForRefresh)
                 await this.retire(retireForRefresh, 'keep');
-            return this.openSession(openFrame);
+            return this.openSession(openFrame, recordedBuildId);
         })()
-            .catch((err) => ({ live: null, error: openFailureText(openFrame, err) }))
+            .catch((err) => ({ live: null, error: errorMessage(err) }))
             .finally(() => releaseHold?.());
         this.opening.set(frame.sessionRef, attempt);
         let outcome;
@@ -1648,6 +1601,7 @@ export class AgentSessionManager {
         // tombstone without anything ever closing it. Nothing but microtasks separates `attempt`
         // resolving from the finally, and microtasks always drain before the next inbound frame.
         if (outcome.live) {
+            this.retainedRespawnBuilds.delete(frame.sessionRef);
             // openSession returned successfully, having just done session/load or session/new.
             if (!await this.resumeAndReply(outcome.live, frame, true))
                 return;
@@ -1658,6 +1612,8 @@ export class AgentSessionManager {
                 await this.streamBackfill(frame.id, outcome.live.session);
         }
         else {
+            if (recordedBuildId !== undefined)
+                this.retainedRespawnBuilds.set(frame.sessionRef, recordedBuildId);
             this.emit({
                 t: 'agent_opened', id: frame.id, ok: false, error: outcome.error,
                 // Only when the agent is the one that said no, and then it is the one refusal that can be
@@ -1689,7 +1645,7 @@ export class AgentSessionManager {
      */
     async switchAtOpen(live, frame) {
         const agents = this.agents;
-        if (!agents.switchSession || !agents.pendingSwitchFor || frame.delegationMcp)
+        if (!agents.switchSession || !agents.pendingSwitchFor)
             return false;
         // A switch spawns an adapter: new work, refused while the workstation drains (spec §8.2).
         if (this.tasks && !this.tasks.accepting)
@@ -1847,7 +1803,7 @@ export class AgentSessionManager {
      * "Move idle sessions" (Task 25's `agent_switch_idle`, spec §6.4): every held session of `agentId` that runs another build than
      * `toBuild` (else the agent's current build) gets a persistent intent to move there; those already strictly idle get their
      * `agent_reopen_request` at once, the others when they become idle. A session that can never be moved this way
-     * ({@link unmovableWhy}: a local-fallback session, a managed delegation, no native session, a target that already refused it) gets
+     * ({@link unmovableWhy}: a local-fallback session, no native session, a target that already refused it) gets
      * no intent — it would only be asked to reopen again and again — and is listed in `unmovable` with the reason. A `toBuild` that is
      * not installed for the agent is refused (throws). Returns the refs registered, the ones a request went out for, and the unmovable.
      */
@@ -1889,7 +1845,7 @@ export class AgentSessionManager {
     }
     /**
      * Why `live` can never be moved to `target` by a switch (spec §6.3 "当前限制"), or `undefined`: a session keeper-acp does not host
-     * (the local fallback), a managed delegation, a session with no native session to load, or one a switch to the same build already
+     * (the local fallback), a session with no native session to load, or one a switch to the same build already
      * found unmovable. `plain` is what the scan card and the result frame say (Task 25); `detail` is the switch's own words, for the
      * log, when there are any.
      */
@@ -1897,8 +1853,6 @@ export class AgentSessionManager {
         const placement = this.agents.placementOf?.call(this.agents, live.session);
         if (!placement?.keeper)
             return { plain: LOCAL_SESSION_UNMOVABLE };
-        if (live.session.delegation)
-            return { plain: 'it is a delegated session, which can\'t be moved to another build yet' };
         if (!live.nativeSessionId)
             return { plain: 'it has no saved conversation the new build could reload' };
         const refused = this.agents.unmovableFor?.call(this.agents, live.sessionRef);
@@ -2128,7 +2082,6 @@ export class AgentSessionManager {
             this.emit({ t: 'agent_opened', id: frame.id, ok: false, error: 'session was closed while opening' });
             return false;
         }
-        const delegation = live.session.delegation ?? undefined;
         const activityRaw = live.session.activityRaw;
         this.emit({
             t: 'agent_opened',
@@ -2140,13 +2093,6 @@ export class AgentSessionManager {
             // Emitted only when true, the same `supportsSteering` convention as below: absent is the
             // field's only "no", and it is also what an older peer sends.
             ...(reloaded ? { reloaded: true } : {}),
-            // Delegation's non-secret fields, from processor state (Task 19: `agent_opened` is assembled from state).
-            ...(delegation ? { delegationExpiresAtEpochMs: delegation.expiresAtEpochMs } : {}),
-            ...(delegation?.refreshPending ? { delegationRefreshPending: true } : {}),
-            ...(this.serverAgentWire >= AGENT_WIRE_DELEGATION_RENEW_VERSION && delegation?.instanceId ? {
-                delegationInstanceId: delegation.instanceId, delegationBindingId: delegation.bindingId,
-                delegationRenewalRevision: delegation.renewalRevision,
-            } : {}),
             // The server learns this here and nowhere else. It used to be published only on the roster in
             // the `agent_hello` handshake, which is a snapshot taken *before* any agent was connected to —
             // and the capability can only be observed on a live `initialize`, whose record
@@ -2223,7 +2169,7 @@ export class AgentSessionManager {
         });
         return true;
     }
-    async openSession(frame) {
+    async openSession(frame, recordedBuildId) {
         // A previous incarnation of this ref may still be closing: its adapter stopped and its transport session (raw, outbox) kept or
         // released — the new spawn goes under the same key (see {@link retiring}). This is the first statement on purpose — before the
         // agent spawns, before anything touches the transport. The one-time legacy journal migration lands before any open too.
@@ -2272,13 +2218,14 @@ export class AgentSessionManager {
             });
         };
         try {
-            const result = await this.agents.open({ ...openSpecOf(frame), onInstallOutcome, seqBase: () => resumeFrom });
+            const result = await this.agents.open({
+                ...openSpecOf(frame),
+                ...(recordedBuildId !== undefined ? { recordedBuildId } : {}),
+                onInstallOutcome,
+                seqBase: () => resumeFrom,
+            });
             session = result.session;
             nativeSessionId = result.nativeSessionId;
-            if (frame.delegationMcp && !nativeSessionId) {
-                await session.close();
-                return { live: null, error: 'Managed delegation requires a native session ID' };
-            }
         }
         catch (err) {
             await reportFailedInstall();
@@ -2288,7 +2235,7 @@ export class AgentSessionManager {
             // on `session/new` arrives as; see {@link OpenOutcome.agentRefused}.
             return {
                 live: null,
-                error: openFailureText(frame, err),
+                error: errorMessage(err),
                 // The code comes off the marker, not off `errorMessage(err)` above: the wrapper captured it
                 // from the original rejection at the moment that object still existed.
                 ...(err instanceof AgentRefusedSessionError
@@ -2347,7 +2294,7 @@ export class AgentSessionManager {
         return { live };
     }
     /** A session joins: held, registered with the TaskRegistry, its frames and its outbox wired to the sender. */
-    register(live) {
+    register(live, adoption) {
         const session = live.session;
         this.detached.delete(live.sessionRef);
         this.sessions.set(live.sessionRef, live);
@@ -2357,7 +2304,7 @@ export class AgentSessionManager {
         () => this.retire(live, durable ? 'detach' : 'destroy'), 
         // 两个层级量取或：本进程发出的提示词是否在途（agent 自己也许在续跑一个我们没发起的回合，
         // 那一种由第二项回答），以及 agent 自报的状态。两者都不累积，所以没有可泄漏的状态。
-        () => live.session.liveness.turnRunning || activityIsBusy(live.session.activityRaw), { durable });
+        () => live.session.liveness.turnRunning || activityIsBusy(live.session.activityRaw), { durable, adoption });
         // Everything the session produces arrives as processor frames (Task 19): numbered by the processor, projected for the
         // connected server here, recorded in the outbox (the numbered ones) and sent from it (Task 20).
         live.unwatch = session.outbox.onChange(() => this.pump());
@@ -2843,6 +2790,7 @@ export class AgentSessionManager {
         void this.agents.cancelSwitch?.({ sessionRef }).catch(() => false);
         this.reopenRequests.delete(sessionRef);
         this.adapterCrashes.delete(sessionRef);
+        this.retainedRespawnBuilds.delete(sessionRef);
         // Closing a ref that is still spawning: nothing to close yet, so tombstone it — openSession
         // closes the session (and destroys its journal) the moment the bridge hands it over.
         //

package/dist/workstation/channels/agent.js

@@ -3,6 +3,7 @@ import { connectEncryptedChannel } from '../connection/encryptedChannel.js';
 import { AGENT_WIRE_MIN_VERSION, AGENT_WIRE_RESUME_OFFER_VERSION, AGENT_WIRE_VERSION, decodeAgentFrame, encodeAgentFrame, outboundAgentFrameRejection, } from '../protocol/agent.js';
 import { bridgesForWire, helloRoster } from '../protocol/common.js';
 import { workstationChannelUrl } from './url.js';
+import { DeviceEventRouter } from '../runtime/events.js';
 /** Binds daemon-scoped sessions only to the encrypted agent channel's sender. */
 export class AgentChannel {
     options;
@@ -24,7 +25,14 @@ export class AgentChannel {
         });
         // Hoisted rather than inlined twice: `closeAll` compares it by identity to decide whether the
         // binding it is being asked to drop is still this connection's. See AgentSessionManager.closeAll.
-        const send = (frame) => channel.send(frame);
+        const registrationId = this.options.registrationId;
+        const events = registrationId ? new DeviceEventRouter((_recipient, event) => channel.send(event.payload), new Set([registrationId])) : undefined;
+        const send = (frame) => {
+            if (events && registrationId)
+                events.publish({ scope: 'registration', registrationId, payload: frame });
+            else
+                channel.send(frame);
+        };
         // The socket's unsent bytes: the manager's socket gate holds session frames back above 1 MiB so the heartbeat (written by the
         // channel itself) never queues behind a backlog (spec §5.6).
         void dispatchAgentChannelFrames(channel.messages, send, this.options.agents, () => channel.close(), () => channel.bufferedAmount);