@playola-radio/slipstream 0.1.0 → 0.3.0

package/dist/daemon.js

@@ -1,79 +1,66 @@
 import { createServer, connect } from 'node:net';
-import { chmod, lstat, unlink, realpath, open } from 'node:fs/promises';
-import { constants } from 'node:fs';
+import { chmod, lstat, unlink, realpath, stat } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { join } from 'node:path';
-import { startCapture, InvalidTitleError } from "./session.js";
-import { QuestionError } from "./questions.js";
+import { join, sep } from 'node:path';
+import { startCapture, InvalidTitleError, RootChangedError } from "./session.js";
+import { createTranscriptScheduler } from "./transcript/scheduler.js";
+import { QuestionError, assertAnswerText, normalizeRelayUpdate } from "./questions.js";
 import { verifyClaudeRootTranscript } from "./claude-root-transcript.js";
+import { verifyCodexRootTranscript } from "./codex-root-transcript.js";
 import { StorageError, mkdirpDurable, assertOwnerOnly } from "./storage.js";
-import { acquireSessionLock, SessionOwnedError } from "./lock.js";
+import { acquireSessionLock, SessionOwnedError, STALE_MS } from "./lock.js";
 import { startReaderServer } from "./http-reader.js";
-import { isValidSessionId, listSessions } from "./store-reader.js";
+import { isValidSessionId, listSessions, findWorkspaceSession, finalRecord, readTombstone, sessionLogPath, WorkspaceLookupError, } from "./store-reader.js";
+import { CorruptLogError } from "./recovery.js";
+import { LogCorruptError } from "./log-reader.js";
 import { publishTombstone, removeSessionHistory, sessionExists, reclaimUnreferencedBlobs, } from "./maintenance.js";
 import { createBoundaryRegistry } from "./boundary-registry.js";
+import { createCas } from "./cas.js";
+import { MAX_BINDINGS, MAX_CAPTURES, admitCapture, emptyIntent, findCapture, findLinked, forgetSession, linkBinding, linkedCount, revokeBinding, runningCount, withdrawCapture, } from "./capture-intent.js";
+import { loadIntent, saveIntent } from "./intent-store.js";
 import { liveBoundary } from "./reader-runtime.js";
 import { createLineDecoder, encodeMessage, } from "./control-protocol.js";
 const HARNESSES = ['claude-code', 'codex'];
-const SUPPORTED_CODEX_VERSIONS = new Set(['0.154.0', '0.155.1']);
-const MAX_CODEX_META_BYTES = 64 * 1024;
+const STORE_LOCK_WAIT_MS = 2_000;
+const STORE_LOCK_POLL_MS = 50;
+const RETRY_BACKOFF = { baseMs: 2_000, maxMs: 5 * 60_000 };
+const SETUP_REOFFER_MS = 30_000;
+const UNAVAILABLE_BY_CLAUDE_REASON = {
+    'unavailable': 'transcript-unreadable', 'not-yet': 'transcript-unreadable', 'gap': 'transcript-unreadable',
+    'mismatch': 'identity-changed',
+};
 class RootIdentityError extends Error {
-}
-/** Verify the selected transcript's own first record once at attach. It binds
- * the reported session and worktree without treating either as authorship. */
-async function verifyCodexRootTranscript(path, sessionId, worktree) {
-    try {
-        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-        let bytes;
-        try {
-            if (!(await handle.stat()).isFile())
-                throw new Error('transcript is not a file');
-            const buffer = Buffer.alloc(MAX_CODEX_META_BYTES + 1);
-            let total = 0;
-            let end = -1;
-            while (total < buffer.length && end < 0) {
-                const { bytesRead } = await handle.read(buffer, total, buffer.length - total, total);
-                if (bytesRead === 0)
-                    break;
-                end = buffer.subarray(total, total + bytesRead).indexOf(0x0a);
-                if (end >= 0)
-                    end += total;
-                total += bytesRead;
-            }
-            if (end < 0 || end > MAX_CODEX_META_BYTES)
-                throw new Error('transcript metadata exceeds limit');
-            bytes = buffer.subarray(0, end);
-        }
-        finally {
-            await handle.close();
-        }
-        const record = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
-        const payload = record.payload;
-        if (record.type !== 'session_meta' || !payload
-            || payload.originator !== 'codex_sdk_ts'
-            || (payload.source !== 'exec' && payload.source !== 'vscode')
-            || !SUPPORTED_CODEX_VERSIONS.has(String(payload.cli_version))
-            || payload.session_id !== sessionId || typeof payload.cwd !== 'string'
-            || await realpath(payload.cwd) !== worktree)
-            throw new Error('transcript metadata does not match selected root');
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
     }
-    catch {
-        throw new RootIdentityError('root Codex transcript is missing, mismatched, or from an unsupported runtime');
+}
+/** The intent record could not be written. Every later lifecycle change is
+ * refused: acknowledging one the record does not hold would be a lie after a
+ * restart. */
+class IntentWriteError extends Error {
+    constructor(cause) {
+        super(`the capture intent record could not be written (${cause.message}); `
+            + 'this daemon refuses attach, detach and unlink until it is restarted', { cause });
+        this.name = 'IntentWriteError';
     }
 }
-/** Build the per-session transcript runtime from resolved config: only harnesses
- * the operator declared `configured` are read. */
-function transcriptRuntimeFrom(config) {
+/** Build the daemon's one transcript scheduler from resolved config: only harnesses
+ * the operator declared `configured` are read, and with none there is no scheduler.
+ * Whether a chat is linked plays no part (spec unit 8). */
+function transcriptSchedulerFrom(config) {
     if (!config)
         return undefined;
     const harnesses = HARNESSES.filter((h) => config.policy.sources[h] === 'configured');
     if (harnesses.length === 0)
         return undefined;
-    return {
+    return createTranscriptScheduler({
         harnesses,
         homes: config.transcript.homes,
         codexScanLimit: config.transcript.codexScanLimit,
-    };
+        onError: (err) => console.error(`slipstream: transcript watcher error: ${err.message}`),
+    });
 }
 export class DaemonAlreadyRunningError extends Error {
     constructor(socketPath) {
@@ -148,9 +135,33 @@ async function bindControl(server, socketPath) {
         return;
     }
 }
+const END_MESSAGES = {
+    'root-missing': 'the workspace root was deleted or replaced; a directory recreated at that path is a new capture',
+    'watcher-failed': 'the watcher stopped delivering changes for this workspace',
+    'maintenance': 'stopped while gc reclaims storage; it resumes on its own afterwards',
+};
+const CAPTURE_LIMIT_MESSAGE = `${MAX_CAPTURES}/${MAX_CAPTURES} capture slots in use. This workspace is NOT recording. `
+    + 'Pause one first.';
+const CAPTURE_PAUSED_MESSAGE = 'This workspace is paused. Record it in Slipstream first, then attach again.';
+const BINDING_LIMIT_MESSAGE = `${MAX_BINDINGS}/${MAX_BINDINGS} chats linked. This workspace is still recording without `
+    + 'a linked chat. Unlink another chat to connect this one.';
+const WATCH_ONLY_MESSAGE = 'this capture is watch-only: no agent chat is linked to it. Run `slipstream attach` from '
+    + 'the agent chat to link one';
+const SETUP_PENDING_MESSAGE = 'the agent chat for this capture has not completed setup; finish the steps slipstream '
+    + 'attach printed';
+function isHarness(v) {
+    return HARNESSES.includes(v);
+}
+/** One root contains the other, by whole path components. */
+function overlaps(a, b) {
+    const within = (child, parent) => child.startsWith(parent.endsWith(sep) ? parent : parent + sep);
+    return within(a, b) || within(b, a);
+}
 export async function startDaemon(opts) {
     const storeDir = opts.storeDir;
     const identityRealpath = opts.identityRealpath ?? realpath;
+    const workspaceLookup = opts.workspaceLookup ?? findWorkspaceSession;
+    const transcripts = opts.transcriptScheduler ?? transcriptSchedulerFrom(opts.config);
     const socketPath = join(storeDir, 'control.sock');
     await mkdirpDurable(storeDir);
     await assertOwnerOnly(storeDir, 'dir');
@@ -172,21 +183,45 @@ export async function startDaemon(opts) {
     // an onCompromised callback that fires mid-startup never hits a temporal dead
     // zone (it may run with `reader` still undefined — teardown null-checks it).
     const registry = createBoundaryRegistry();
-    let state = 'detached';
-    let current;
-    const inflightTasks = new Set();
+    const backoff = opts.retryBackoff ?? RETRY_BACKOFF;
+    const reofferMs = opts.setupReofferMs ?? SETUP_REOFFER_MS;
+    let intent = emptyIntent();
+    /** The next intent write not yet started; joining it covers every mutation made
+     * before it begins. Writes run one at a time. */
+    let intentFlush;
+    let intentTail = Promise.resolve();
+    let intentBroken;
+    /** Every capture this daemon has admitted, by session id; withdrawn ones stay
+     * for history until their session is deleted. */
+    const captures = new Map();
+    /** Stops that settled with their capture `failed`: they recorded no stop. Read
+     * by the stop, since a retry waiting on it may requeue the capture first. */
+    const unrecordedStops = new WeakSet();
+    /** Roots between their canonicalization and their intent write. A second attach
+     * of the same root joins the first instead of admitting a duplicate. */
+    const admitting = new Map();
+    /** Baselines run one at a time, in admission order. */
+    let baselines = Promise.resolve();
+    /** The store's blob store, shared by every capture (see CaptureOptions.cas).
+     * Recreated after maintenance, which may delete blobs it trusts. */
+    let cas;
     const connections = new Set();
-    let attachInFlight;
-    // At most one detached-only maintenance op (delete_session / gc) runs at a time.
-    // The slot is claimed synchronously in runMaintenance before its first await, and
-    // attach refuses while it is held — so a single-threaded turn makes maintenance
-    // and attach mutually exclusive without a lock.
+    // At most one maintenance op (delete_session / gc) runs at a time. The slot is
+    // claimed synchronously in runMaintenance before its first await.
     let maintenanceInFlight;
+    /** A gc is stopping, sweeping or resuming: no capture is admitted or started
+     * and no chat is linked or unlinked until it is done. */
+    let quiescing = false;
+    /** The session a delete_session is removing, and the count of delete_sessions
+     * finished so far with the count at which each session's last one finished. An
+     * attach never resumes a session being deleted, or one whose delete finished
+     * after its lookup began; a later lookup reads the tombstone itself. */
+    let deleting;
+    let deletesDone = 0;
+    const deleteDoneAt = new Map();
     let reader;
     let torn = false;
     let compromised = false; // store lock lost
-    let sessionCompromised = false; // current session lock lost mid-attach
-    let abortStopError; // a failed stop of a session aborted mid-attach
     // Gates DISPATCH, not acceptance: connections are tracked and given a deadline
     // from the moment they arrive (so bind/chmod-window sockets can never orphan or
     // hang shutdown), but no verb runs until startup is fully ready — which is also
@@ -216,42 +251,46 @@ export async function startDaemon(opts) {
     }
     async function doTeardown() {
         torn = true;
+        for (const c of captures.values()) {
+            clearTimeout(c.retryTimer);
+            if (c.binding)
+                cancelRearm(c.binding);
+        }
         // Drop live control connections so server.close() cannot block on an idle or
         // half-sent request.
         for (const sock of connections)
             sock.destroy();
         await closeServer();
-        // An attach whose capture is still starting must not outlive shutdown: wait for
-        // it to settle (it self-stops once it observes `torn`), then stop whatever it or
-        // an active session left installed.
-        if (attachInFlight)
-            await attachInFlight.catch(() => { });
+        // Admissions and baselines in flight observe `torn` and start nothing new; wait
+        // for them so every session they opened is in the table and stopped below.
+        await Promise.allSettled([...admitting.values()]);
+        await baselines;
         // A maintenance op in flight has already seen `torn` (gc aborts its sweep); wait
         // for it to settle so a durable tombstone or blob unlink is not racing shutdown.
         if (maintenanceInFlight)
             await maintenanceInFlight.catch(() => { });
-        // An attach aborted mid-startup may have failed to stop its half-built session
-        // (it runs in startAndActivate, which sets abortStopError). Surface that too so
-        // shutdown never reports success over a capture that could not be confirmed
-        // stopped.
-        let stopErr = abortStopError;
-        if (current) {
-            // Drain in-flight task declarations before stopping, exactly like detach:
-            // `torn` is already set, so beginTask admits no new work, and the append of
-            // any task that slipped in before shutdown must not race the session log
-            // closing under session.stop().
-            await Promise.allSettled([...inflightTasks]);
+        let stopErr;
+        for (const c of captures.values()) {
+            await c.closing;
+            stopErr ??= c.closeError;
+            const session = c.session;
+            if (!session)
+                continue;
+            // Drain admitted appends before stopping: `torn` is already set, so no new
+            // work is admitted, and an append in flight must not race the log closing.
+            await Promise.allSettled([...c.inflight]);
             // Do NOT swallow a failed stop: if capture could not be confirmed stopped,
             // shutdown must not report success. session.stop() still releases the session
             // lock and halts the engine even when it rethrows, so releasing the store
-            // lock below is safe; we surface the failure once cleanup is complete.
+            // lock below is safe; we surface the failure once cleanup is complete. No
+            // stop reason: shutdown is not a withdrawal, so no capture.stopped is written.
             try {
-                await current.session.stop();
+                await session.stop();
             }
             catch (err) {
-                stopErr = err;
+                stopErr ??= err;
             }
-            current = undefined;
+            c.session = undefined;
         }
         await reader?.close().catch(() => { });
         // Unlink the socket only while we still hold the store lock. On the compromise
@@ -260,31 +299,54 @@ export async function startDaemon(opts) {
         // successor's socket. Leave it for the new owner instead.
         if (!compromised)
             await unlinkOwnSocket();
+        await intentTail;
         await lock.release();
         if (stopErr)
             throw stopErr;
     }
     let lock;
+    // A CLI recording a withdrawal while no daemon ran holds the store lock for
+    // milliseconds; wait it out. A lock still held after that, or a socket that
+    // starts answering, is another daemon.
+    const lockDeadline = Date.now() + STORE_LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            lock = await acquireSessionLock(storeDir, {
+                onCompromised: (reason) => {
+                    compromised = true;
+                    console.error(`slipstream daemon: store lock lost: ${reason}`);
+                    void teardown().catch((teardownErr) => {
+                        console.error('slipstream daemon: teardown after store-lock loss failed:', teardownErr);
+                    });
+                },
+            });
+            break;
+        }
+        catch (err) {
+            if (!(err instanceof SessionOwnedError))
+                throw err;
+            if (Date.now() >= lockDeadline || await probeSocket(socketPath, PROBE_TIMEOUT_MS) !== 'stale') {
+                throw new DaemonAlreadyRunningError(socketPath);
+            }
+            await new Promise((resolve) => setTimeout(resolve, STORE_LOCK_POLL_MS));
+        }
+    }
+    // Recovery reads intent only while holding the store lock, so a withdrawal a
+    // CLI recorded while no daemon ran is always seen, and pins every session it
+    // will resume before the reader can serve one.
+    let restored;
     try {
-        lock = await acquireSessionLock(storeDir, {
-            onCompromised: (reason) => {
-                compromised = true;
-                console.error(`slipstream daemon: store lock lost: ${reason}`);
-                void teardown().catch((teardownErr) => {
-                    console.error('slipstream daemon: teardown after store-lock loss failed:', teardownErr);
-                });
-            },
-        });
+        intent = await loadIntent(storeDir);
+        restored = await restoreCaptures();
     }
     catch (err) {
-        if (err instanceof SessionOwnedError)
-            throw new DaemonAlreadyRunningError(socketPath);
+        await lock.release();
         throw err;
     }
     // Bring the reader up before accepting control traffic, so a verb can never be
     // dispatched against a reader that is not yet serving the public view.
     try {
-        reader = await startReaderServer({ storeDir, registry });
+        reader = await startReaderServer({ storeDir, registry, captures: capturesProjection });
     }
     catch (err) {
         await lock.release();
@@ -324,198 +386,1181 @@ export async function startDaemon(opts) {
         throw new Error('slipstream daemon lost its store lock during startup');
     }
     const readerRef = reader;
-    function statusFields() {
-        const fields = { state, reader_url: readerRef.url };
-        if (current) {
-            // session_id is capture SCOPE, never authorship. The declared identity is the
-            // exact context the caller bound; semantic verification is the P4 forwarder's.
-            fields.session_id = current.id;
-            fields.worktree = current.worktree;
-            fields.harness = current.harness;
-            fields.harness_session_id = current.harnessSessionId;
-            if (current.rootTranscript)
-                fields.root_transcript = current.rootTranscript;
-            fields.durable_seq = current.session.health.snapshot().durable_seq;
-        }
-        return fields;
-    }
-    /** The active session lost its own lock. Stop presenting healthy, preserve the
-     * boundary at the last durable seq, and refuse further mutations (decision 9).
-     * `current` is retained so teardown can still stop the wedged session. */
-    function handleSessionCompromise(id, reason) {
-        console.error(`slipstream daemon: session ${id} lost its lock: ${reason}`);
-        if (current?.id === id && state === 'active') {
-            registry.freeze(id, BigInt(current.session.health.snapshot().durable_seq));
-            state = 'wedged';
+    // ---- capture state ------------------------------------------------------
+    /** The public state of a capture (contracts.md §6), folded from its intent and
+     * its runtime. A withdrawn capture is `stopped` only once its stop is durable. */
+    function publicState(c) {
+        const entry = findCapture(intent, c.id);
+        if (!entry || entry.intent === 'withdrawn') {
+            return c.lifecycle === 'stopped' ? { state: 'stopped', reason: entry?.withdrawn_reason ?? 'detached' }
+                : { state: 'not_recording', reason: 'stop-unconfirmed', message: 'detach was requested, but the capture could not be confirmed stopped' };
+        }
+        if (c.ended && ['queued', 'failed', 'stopped'].includes(c.lifecycle))
+            return { state: 'stopped', reason: c.ended, message: END_MESSAGES[c.ended] };
+        if (entry.last_failure)
+            return { state: 'not_recording', reason: entry.last_failure.reason, message: entry.last_failure.message };
+        const health = c.session?.health.snapshot().state;
+        if (health === 'failing' || health === 'recovering') {
+            return { state: 'not_recording', reason: 'storage-unavailable', message: `the store cannot accept events (${health}); capture resumes when it recovers` };
+        }
+        if (c.lifecycle === 'recording' || c.lifecycle === 'baselining')
+            return { state: c.lifecycle, reason: null };
+        return { state: 'queued', reason: null };
+    }
+    /** When recovery will next try a failed capture, while one is scheduled. */
+    function retryOf(c) {
+        const entry = findCapture(intent, c.id);
+        const at = entry?.intent === 'running' ? entry.last_failure?.next_attempt_at_ms : null;
+        return typeof at === 'number' ? { next_attempt_at_ms: at } : null;
+    }
+    function isRunning(c) {
+        return findCapture(intent, c.id)?.intent === 'running';
+    }
+    function isLive(c) {
+        const entry = findCapture(intent, c.id);
+        return entry !== undefined && entry.intent !== 'withdrawn';
+    }
+    /** The latest binding intent for a capture, linked or revoked. */
+    function bindingRow(c) {
+        const entry = intent.bindings.findLast((b) => b.session_id === c.id);
+        if (!entry)
+            return null;
+        const live = entry.intent === 'linked' ? c.binding : undefined;
+        const row = { harness: entry.harness, harness_session_id: entry.harness_session_id, binding_generation: entry.binding_generation };
+        if (entry.intent === 'revoked')
+            return { ...row, state: 'unlinked', reason: null };
+        if (entry.unavailable)
+            return { ...row, state: 'unavailable', reason: entry.unavailable.reason, message: entry.unavailable.message };
+        return { ...row, state: live?.check.state ?? 'setup_pending', reason: null };
+    }
+    async function statusRows(asOf, includeRuntimeDetails = false) {
+        const heartbeatOf = async (lockPath) => {
+            try {
+                return Math.trunc((await stat(lockPath)).mtimeMs);
+            }
+            catch {
+                return null; /* no owner */
+            }
+        };
+        const heartbeatLive = (heartbeat) => heartbeat !== null && asOf - heartbeat <= STALE_MS;
+        const daemonLive = heartbeatLive(await heartbeatOf(join(storeDir, 'owner.lock')));
+        return Promise.all([...captures.values()].map(async (c) => {
+            let { state, reason, message } = publicState(c);
+            let binding = bindingRow(c);
+            const heartbeat = await heartbeatOf(join(storeDir, 'sessions', c.id, 'owner.lock'));
+            // The public liveness rule (contracts.md §6, §7): a capture with no live
+            // session owner is waiting on a live daemon, or not confirmed live at all.
+            // Waiting, it has no current activation, so no chat is connected in it.
+            if (['queued', 'baselining', 'recording'].includes(state) && !heartbeatLive(heartbeat)) {
+                [state, reason] = daemonLive ? ['queued', null] : ['not_recording', 'daemon-unavailable'];
+                message = undefined;
+                if (daemonLive && binding?.state === 'connected')
+                    binding = { ...binding, state: 'setup_pending' };
+            }
+            const row = { session_id: c.id, root: c.root, state, reason, retry: retryOf(c), capture_mode: 'watch-only' };
+            if (includeRuntimeDetails && message)
+                row.message = message;
+            if (includeRuntimeDetails && c.session)
+                row.durable_seq = c.session.health.snapshot().durable_seq;
+            if (!includeRuntimeDetails)
+                row.heartbeat_ms = heartbeat;
+            row.binding = binding;
+            if (includeRuntimeDetails && c.binding)
+                row.binding = { ...row.binding, root_transcript: c.binding.transcript };
+            return row;
+        }));
+    }
+    /** `GET /v1/captures` (contracts.md §9). Heartbeats are read from the store and
+     * session ownership locks, exactly as an offline client would. */
+    async function capturesProjection() {
+        const asOf = Date.now();
+        const rows = await statusRows(asOf);
+        return { as_of_ms: asOf, binding_slots: { used: linkedCount(intent), limit: MAX_BINDINGS }, captures: rows };
+    }
+    async function statusFields() {
+        return {
+            reader_url: readerRef.url, attach_features: ['agent-connection-v1', 'capture-table-v1'],
+            binding_slots: { used: linkedCount(intent), limit: MAX_BINDINGS },
+            captures: await statusRows(Date.now(), true),
+        };
+    }
+    async function status(req) {
+        if (req.target === undefined)
+            return statusFields();
+        const c = await resolveTarget(req.target);
+        if (isErrorFields(c))
+            return c;
+        const capture = (await statusRows(Date.now(), true)).find((row) => row.session_id === c.id);
+        return { reader_url: readerRef.url, attach_features: ['agent-connection-v1', 'capture-table-v1'], capture };
+    }
+    /** A target is a session id or a root path. The id is authoritative; a path
+     * matches a stored canonical root by realpath equality, or literally when it can
+     * no longer be resolved, never by prefix. */
+    async function resolveTarget(target) {
+        if (!nonEmptyString(target))
+            return errFields('TARGET_NOT_FOUND', 'a target session id or workspace path is required');
+        const byId = captures.get(target);
+        if (byId)
+            return byId;
+        let root;
+        try {
+            root = await realpath(target);
+        }
+        catch {
+            root = target;
+        }
+        const atRoot = [...captures.values()].filter((c) => c.root === root);
+        // A root recreated at the same path is a newer capture than the one it replaced.
+        const found = atRoot.findLast(isLive) ?? atRoot.at(-1);
+        return found ?? errFields('TARGET_NOT_FOUND', `no capture of ${target}`);
+    }
+    /** The live capture of the directory now at `root`. A capture of a directory
+     * that was deleted or replaced there is a different workspace, not a match. */
+    function liveCaptureAt(root, identity) {
+        return [...captures.values()].find((c) => c.root === root && isLive(c) && sameRoot(c, identity));
+    }
+    function rootGone(c) {
+        return c.ended === 'root-missing' || findCapture(intent, c.id)?.last_failure?.reason === 'root-missing';
+    }
+    function sameRoot(c, identity) {
+        return sameDirectory(findCapture(intent, c.id)?.root_identity, identity);
+    }
+    function sameDirectory(known, identity) {
+        return !known || !identity || (known.dev === identity.dev && known.ino === identity.ino);
+    }
+    /** The capture a chat identity is linked to, store-wide (at most one). */
+    function captureForChat(harness, harnessSessionId) {
+        const entry = typeof harness === 'string' && typeof harnessSessionId === 'string'
+            ? findLinked(intent, harness, harnessSessionId) : undefined;
+        return entry ? captures.get(entry.session_id) : undefined;
+    }
+    /** Record a capture as not recording. A transient failure is retried with
+     * backoff, as a new activation. */
+    /** A stop is recorded only while the daemon holds the store lock. A shutdown
+     * keeps it, so only its loss makes a stop unrecordable. */
+    function assertStoreOwned() {
+        if (compromised)
+            throw new Error('the daemon lost its store lock');
+    }
+    function fail(c, reason, message, opts) {
+        c.lifecycle = 'failed';
+        const entry = findCapture(intent, c.id);
+        const next = opts.retry && entry?.intent === 'running' && !torn && !compromised ? scheduleRetry(c) : null;
+        if (entry)
+            entry.last_failure = { reason, message, at_ms: Date.now(), next_attempt_at_ms: next };
+        console.error(`slipstream daemon: capture ${c.id} of ${c.root} is not recording: ${message}`
+            + (next === null ? '' : ` (retrying at ${new Date(next).toISOString()})`));
+        persistQuietly();
+    }
+    function scheduleRetry(c) {
+        clearTimeout(c.retryTimer);
+        c.attempts++;
+        const delay = Math.min(backoff.baseMs * 2 ** (c.attempts - 1), backoff.maxMs);
+        c.retryTimer = setTimeout(() => {
+            c.retryTimer = undefined;
+            void retryScheduled(c);
+        }, delay);
+        return Date.now() + delay;
+    }
+    /** Not recording, and another activation may fix that. */
+    function retryable(c) {
+        return c.lifecycle === 'failed' || (c.lifecycle === 'stopped' && c.ended !== undefined);
+    }
+    async function retryScheduled(c) {
+        await c.closing;
+        const resume = c.resume || await hasHistory(c.id);
+        const entry = findCapture(intent, c.id);
+        if (torn || compromised || !retryable(c) || entry?.intent !== 'running' || !entry.last_failure)
             return;
+        entry.last_failure.next_attempt_at_ms = null;
+        persistQuietly();
+        c.lifecycle = 'queued';
+        c.resume = resume;
+        enqueueStart(c);
+    }
+    /** Whether a session's log holds a complete record to resume from. A log a
+     * failed first start left without one starts afresh under the same id; an
+     * unreadable log is resumed, so it fails visibly. */
+    async function hasHistory(id) {
+        try {
+            return await finalRecord(sessionLogPath(storeDir, id)) !== undefined;
+        }
+        catch {
+            return true;
         }
-        if (state === 'attaching')
-            sessionCompromised = true; // startup aborts below
     }
-    async function startAndActivate(id, worktree, harness, harnessSessionId, rootTranscript) {
-        let session;
-        let resolvedWorktree;
-        let resolvedTranscript;
-        try {
-            // Canonicalize before binding: capture resolves the root with realpath, so a
-            // symlinked or relative declared path must report the same durable root in
-            // status rather than the caller's raw string (locked design, decision 5).
-            resolvedWorktree = await realpath(worktree);
-            if (rootTranscript !== undefined) {
-                if (harness !== 'codex' && harness !== 'claude-code') {
-                    throw new RootIdentityError('root_transcript requires a supported harness');
-                }
-                try {
-                    resolvedTranscript = await realpath(rootTranscript);
-                }
-                catch {
-                    throw new RootIdentityError(harness === 'claude-code'
-                        ? 'root Claude transcript is unavailable; check its path or retry attach after the first root tool call'
-                        : 'root Codex transcript cannot be resolved');
-                }
-                if (harness === 'codex') {
-                    await verifyCodexRootTranscript(resolvedTranscript, harnessSessionId, resolvedWorktree);
-                }
-                else {
-                    const verified = await verifyClaudeRootTranscript(resolvedTranscript, harnessSessionId, resolvedWorktree);
-                    if (!verified.ok) {
-                        throw new RootIdentityError(verified.reason === 'not-yet'
-                            ? 'root Claude transcript head is not complete yet; retry attach after the first root tool call'
-                            : verified.reason === 'gap'
-                                ? 'root Claude transcript head exceeds the verification bounds; select a new root early in its session'
-                                : `root Claude transcript identity is ${verified.reason}`);
-                    }
-                }
+    /** Rebuild the capture table from the intent record after a restart. Every
+     * session recovery will resume is pinned at its durable high-water, and every
+     * fresh one reserved, before the reader is exposed or anything is written.
+     * Returns the running captures, in admission order, to start once ready. */
+    async function restoreCaptures() {
+        const toStart = [];
+        let forgot = false;
+        for (const entry of [...intent.captures]) {
+            const id = entry.session_id;
+            // A delete that crashed after its durable tombstone: finish forgetting it.
+            if (await readTombstone(storeDir, id) !== null) {
+                forgetSession(intent, id);
+                forgot = true;
+                continue;
+            }
+            let last;
+            let unreadable = false;
+            try {
+                last = await finalRecord(sessionLogPath(storeDir, id));
+            }
+            catch {
+                unreadable = true;
+            }
+            const c = { id, root: entry.root, lifecycle: 'queued', resume: last !== undefined || unreadable,
+                inflight: new Set(), attempts: 0 };
+            captures.set(id, c);
+            if (entry.intent === 'withdrawn') {
+                // `stopped` only when the last activation's stop is durable (§6).
+                c.lifecycle = c.resume && last?.type !== 'slipstream.capture.stopped.v1' ? 'failed' : 'stopped';
+                continue;
+            }
+            // An unreadable log is pinned at 0; its resume fails visibly below.
+            if (c.resume)
+                registry.freeze(id, last?.seq ?? 0n);
+            else
+                registry.reserve(id);
+            const stoppedFor = last?.type === 'slipstream.capture.stopped.v1' ? last.data?.reason : undefined;
+            if (stoppedFor === 'root-missing' || stoppedFor === 'watcher-failed' || stoppedFor === 'maintenance')
+                c.ended = stoppedFor;
+            // Connection state is not persisted: a linked chat comes back pending and is
+            // revalidated when its capture activates (contracts.md §8).
+            const linked = intent.bindings.find((b) => b.session_id === id && b.intent === 'linked');
+            if (linked) {
+                c.binding = { harness: linked.harness, harnessSessionId: linked.harness_session_id,
+                    transcript: linked.verified_transcript_path, generation: linked.binding_generation,
+                    check: { state: 'setup_pending', checkId: randomUUID() } };
+            }
+            toStart.push(c);
+        }
+        if (forgot)
+            await persistIntent();
+        return toStart;
+    }
+    /** Make the in-memory intent durable (contracts.md §8). Mutations are synchronous,
+     * so slot counts and the write they back cannot interleave; a lifecycle verb
+     * awaits this before it acts or replies. */
+    function persistIntent(opts = {}) {
+        const refuseOnFailure = opts.refuseOnFailure ?? true;
+        if (intentBroken)
+            return Promise.reject(intentBroken);
+        if (compromised)
+            return Promise.reject(new Error('the store lock was lost; the intent record belongs to another daemon'));
+        intentFlush ??= intentTail.then(async () => {
+            intentFlush = undefined;
+            if (intentBroken)
+                throw intentBroken;
+            if (compromised)
+                throw new Error('the store lock was lost; the intent record belongs to another daemon');
+            try {
+                await saveIntent(storeDir, intent);
+            }
+            catch (err) {
+                throw new IntentWriteError(err);
+            }
+        });
+        const flush = intentFlush;
+        intentTail = flush.catch(() => { });
+        return flush.catch((err) => {
+            if (!refuseOnFailure) {
+                console.error(`slipstream daemon: background capture-state update was not recorded; it will retry after storage recovers (${err.message})`);
+                throw err;
+            }
+            intentBroken ??= err instanceof IntentWriteError ? err : new IntentWriteError(err);
+            console.error(`slipstream daemon: ${intentBroken.message}`);
+            throw intentBroken;
+        });
+    }
+    /** Persist a change no acknowledgement depends on (a recorded failure). */
+    function persistQuietly() {
+        persistIntent({ refuseOnFailure: false }).catch(() => { });
+    }
+    function intentRefusal() {
+        return intentBroken ? errFields('STORAGE_UNAVAILABLE', intentBroken.message) : undefined;
+    }
+    async function rootIdentityOf(root) {
+        try {
+            const st = await stat(root, { bigint: true });
+            return { dev: st.dev.toString(), ino: st.ino.toString() };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Find or admit the capture of a canonical root. Only `resumePaused` restarts a
+     * withdrawn capture of this root. */
+    async function admit(root, opts) {
+        if (torn || compromised)
+            return errFields('STORAGE_UNAVAILABLE', 'the daemon is shutting down or its store lock was lost');
+        const refused = intentRefusal();
+        if (refused)
+            return refused;
+        const identity = await rootIdentityOf(root);
+        if (quiescing)
+            return errFields('CAPTURE_NOT_READY', 'gc is reclaiming storage; retry shortly');
+        const live = liveCaptureAt(root, identity);
+        if (live)
+            return retryIfFailed(live);
+        const pending = admitting.get(root);
+        if (pending) {
+            const joined = await pending;
+            if (isErrorFields(joined) && joined.code === 'CAPTURE_PAUSED' && opts.resumePaused) {
+                if (admitting.get(root) === pending)
+                    admitting.delete(root);
+                return admit(root, opts);
+            }
+            return isErrorFields(joined) ? joined : { capture: joined.capture, created: false };
+        }
+        // A withdrawn capture still watches its root until its stop completes.
+        // A capture whose root is gone watches nothing there any more.
+        const watching = [...captures.values()].filter((c) => (isLive(c) || c.lifecycle === 'stopping') && !rootGone(c));
+        const other = [...watching.map((c) => c.root), ...admitting.keys()].find((r) => overlaps(r, root));
+        if (other) {
+            return errFields('ROOT_OVERLAP', `${root} overlaps the capture of ${other}: one contains the other. Nothing was changed`);
+        }
+        const p = admitNew(root, identity, opts);
+        admitting.set(root, p);
+        try {
+            return await p;
+        }
+        finally {
+            if (admitting.get(root) === p)
+                admitting.delete(root);
+        }
+    }
+    async function admitNew(root, rootIdentity, opts) {
+        const lookedUpAt = deletesDone;
+        let lookup;
+        try {
+            lookup = await workspaceLookup(storeDir, root);
+        }
+        catch (err) {
+            if (err instanceof WorkspaceLookupError) {
+                const remedy = err.corrupt ? corruptRemedy(err.sessionId) : RETRY_REMEDY;
+                return errFields('SESSION_RESUME_FAILED', `${err.message}. ${remedy}`);
+            }
+            return errFields('STORAGE_UNAVAILABLE', `could not look up this workspace's session: ${err.message}`);
+        }
+        for (const s of lookup.skipped) {
+            console.error(`slipstream daemon: skipped session ${s.id} while looking for ${root}'s session: ${s.reason}`);
+        }
+        // A session of a directory since deleted or replaced at this path is never
+        // resumed: the recreated root starts a session of its own.
+        const prev = lookup.match && findCapture(intent, lookup.match.id)?.root_identity;
+        const match = prev && rootIdentity && (prev.dev !== rootIdentity.dev || prev.ino !== rootIdentity.ino)
+            ? undefined : lookup.match;
+        const id = match?.id ?? randomUUID();
+        // A detach of this same session may still be stopping it; its lock must be
+        // released before the session can start again.
+        const prior = captures.get(id);
+        await prior?.closing;
+        if (torn || compromised) {
+            if (match) {
+                return errFields('SESSION_RESUME_FAILED', `could not resume session ${id}: the daemon is shutting down or lost its store lock. ${RETRY_REMEDY}`);
             }
-            const transcript = transcriptRuntimeFrom(opts.config);
+            return errFields('STORAGE_UNAVAILABLE', 'the daemon is shutting down or its store lock was lost');
+        }
+        // Checked in the same turn as the intent entry below, which a delete checks.
+        if (match && (deleting === id || (deleteDoneAt.get(id) ?? 0) > lookedUpAt)) {
+            return errFields('CAPTURE_NOT_READY', `session ${id} was deleted while this attach looked it up; retry attach`);
+        }
+        // Checked in the same turn as the intent entry below, so a pause or a
+        // concurrent admission cannot slip between them. By root, not by log: a
+        // capture paused before it ever started has no log to find.
+        const latest = intent.captures.findLast((e) => e.root === root);
+        if (!opts.resumePaused && latest?.intent === 'withdrawn' && sameDirectory(latest.root_identity, rootIdentity)) {
+            return errFields('CAPTURE_PAUSED', CAPTURE_PAUSED_MESSAGE);
+        }
+        if (runningCount(intent) >= MAX_CAPTURES)
+            return errFields('CAPTURE_LIMIT_REACHED', CAPTURE_LIMIT_MESSAGE);
+        if (match) {
+            // Pin the boundary at the durable high-water BEFORE the log can grow, and
+            // hold it until activation: readers never see past it mid-resume.
+            registry.freeze(id, registry.get(id)?.boundary.current() ?? match.durableSeq);
+        }
+        else {
+            // Reserve the registry entry (boundary 0) before startCapture creates the log
+            // dir on disk, so the reader never over-publishes an uncommitted record.
+            registry.reserve(id);
+        }
+        const entry = admitCapture(intent, { session_id: id, root, root_identity: rootIdentity });
+        try {
+            await persistIntent();
+        }
+        catch (err) {
+            intent.captures = intent.captures.filter((e) => e !== entry);
+            return errFields('STORAGE_UNAVAILABLE', err.message);
+        }
+        const c = prior ?? { id, root, lifecycle: 'queued', resume: false, inflight: new Set(), attempts: 0 };
+        Object.assign(c, { root, lifecycle: 'queued', resume: match !== undefined, closeError: undefined });
+        captures.set(id, c);
+        enqueueStart(c);
+        return { capture: c, created: true };
+    }
+    /** Re-attaching a capture whose start or storage failed, or whose activation
+     * ended on its own, tries it again. */
+    async function retryIfFailed(c) {
+        if (!retryable(c))
+            return { capture: c, created: false };
+        await c.closing;
+        const resume = c.resume || await hasHistory(c.id);
+        const entry = findCapture(intent, c.id);
+        if (!retryable(c) || entry?.intent !== 'running' || torn || compromised)
+            return { capture: c, created: false };
+        clearTimeout(c.retryTimer);
+        c.retryTimer = undefined;
+        entry.last_failure = null;
+        persistQuietly();
+        c.lifecycle = 'queued';
+        c.resume = resume;
+        enqueueStart(c);
+        return { capture: c, created: false };
+    }
+    function enqueueStart(c) {
+        const job = baselines.then(() => startOne(c)).catch((err) => {
+            console.error(`slipstream daemon: capture ${c.id} start failed unexpectedly:`, err);
+        });
+        c.starting = job;
+        baselines = job;
+    }
+    /** Start (or resume) one capture. Never rejects: a failure is recorded on the
+     * capture, and the other captures are untouched. */
+    async function startOne(c) {
+        if (torn || compromised || c.lifecycle !== 'queued' || !isRunning(c))
+            return;
+        c.lifecycle = 'baselining';
+        const moved = await rootProblem(c);
+        if (c.lifecycle !== 'baselining')
+            return;
+        if (moved) {
+            if (!c.resume)
+                registry.freeze(c.id, 0n);
+            fail(c, 'root-missing', moved, { retry: false });
+            return;
+        }
+        const identity = findCapture(intent, c.id)?.root_identity;
+        const activation = { lost: false };
+        c.activation = activation;
+        c.ended = undefined;
+        let session;
+        try {
+            cas ??= await createCas(join(storeDir, 'blobs'));
             session = await startCapture({
-                root: resolvedWorktree,
+                root: c.root,
                 storeDir,
-                sessionId: id,
-                onCompromised: (reason) => handleSessionCompromise(id, reason),
+                ...(c.resume ? { resumeSessionId: c.id } : { sessionId: c.id }),
+                ...(identity ? { rootIdentity: identity } : {}),
+                captureMode: 'watch-only',
+                cas,
+                onCompromised: (reason) => onSessionLockLost(c, activation, reason),
+                onTerminal: (reason, message) => onActivationEnded(c, activation, reason, message),
+                onStorage: (state, failure) => onStorageChanged(c, activation, state, failure),
                 ...(opts.config ? { enrichmentPolicy: opts.config.policy } : {}),
-                ...(transcript ? { transcript } : {}),
+                ...(transcripts ? { transcript: transcripts } : {}),
             }, opts.captureDependencies);
         }
         catch (err) {
-            // Freeze at boundary 0 (capture never activated); never delete the entry,
-            // which would let the reader fall back to disk for a half-written session.
-            registry.freeze(id, 0n);
-            if (state === 'attaching')
-                state = 'detached';
-            if (err instanceof StorageError)
-                return errFields('STORAGE_UNAVAILABLE', err.message);
-            if (err instanceof RootIdentityError)
-                return errFields('IDENTITY_UNRESOLVED', err.message);
-            return errFields('CAPTURE_NOT_READY', err.message);
+            // A fresh session never activated: freeze at 0, never delete the entry, so
+            // the reader cannot fall back to disk for a half-written log. A resumed
+            // session keeps the boundary pinned at its pre-resume high-water.
+            if (!c.resume)
+                registry.freeze(c.id, 0n);
+            if (activation.lost || c.lifecycle !== 'baselining')
+                return;
+            if (err instanceof RootChangedError) {
+                fail(c, 'root-missing', err.message, { retry: false });
+                return;
+            }
+            if (c.resume) {
+                const corrupt = err instanceof CorruptLogError || err instanceof LogCorruptError;
+                fail(c, 'resume-failed', `could not resume session ${c.id}: ${err.message}. `
+                    + (corrupt ? corruptRemedy(c.id) : RETRY_REMEDY), { retry: !corrupt });
+            }
+            else {
+                fail(c, err instanceof StorageError ? 'storage-unavailable' : 'baseline-failed', err.message, { retry: true });
+            }
+            return;
+        }
+        activation.session = session;
+        c.session = session;
+        c.resume = true;
+        if (activation.lost) {
+            halt(c, session);
+            return;
+        }
+        // Shutdown or a detach arrived while starting: whoever is stopping it owns the
+        // session now.
+        if (torn || compromised || c.lifecycle !== 'baselining')
+            return;
+        c.lifecycle = 'recording';
+        c.attempts = 0;
+        const entry = findCapture(intent, c.id);
+        if (entry?.last_failure) {
+            entry.last_failure = null;
+            persistQuietly();
+        }
+        registry.activate(c.id, liveBoundary(session.health));
+        registry.setAgentConnection(c.id, 'none');
+        if (activation.ended) {
+            endActivation(c, session, activation.ended);
+            return;
+        }
+        // A chat stays linked across a restart of its capture, but `connected` is
+        // re-earned only by a fresh round trip in the new activation.
+        if (c.binding) {
+            c.binding.check = { state: 'setup_pending', checkId: randomUUID() };
+            c.binding.revalidations = 0;
+            startRearm(c, c.binding, session);
+        }
+    }
+    function startRearm(c, b, session) {
+        const rearm = (async () => {
+            for (;;) {
+                let failed;
+                try {
+                    failed = await rearmBinding(c, b, session);
+                }
+                catch (err) {
+                    console.error(`slipstream daemon: revalidating the chat linked to ${c.id} failed:`, err);
+                    failed = controlFailure(err);
+                }
+                if (!failed || quiescing)
+                    return;
+                const delay = Math.min(backoff.baseMs * 2 ** (b.revalidations ?? 0), backoff.maxMs);
+                b.revalidations = (b.revalidations ?? 0) + 1;
+                if (!await waitForRearmDelay(b, delay))
+                    return;
+                if (c.binding !== b || c.session !== session || c.lifecycle !== 'recording' || torn || compromised)
+                    return;
+            }
+        })();
+        b.publishing = rearm;
+        const clearPublishing = () => {
+            if (b.publishing === rearm)
+                b.publishing = undefined;
+        };
+        void rearm.then(clearPublishing, clearPublishing);
+    }
+    function waitForRearmDelay(b, delay) {
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                if (b.cancelRearmDelay === cancel)
+                    b.cancelRearmDelay = undefined;
+                resolve(true);
+            }, delay);
+            const cancel = () => {
+                clearTimeout(timer);
+                if (b.cancelRearmDelay === cancel)
+                    b.cancelRearmDelay = undefined;
+                resolve(false);
+            };
+            b.cancelRearmDelay = cancel;
+        });
+    }
+    function cancelRearm(b) {
+        clearTimeout(b.rearmTimer);
+        b.rearmTimer = undefined;
+        b.cancelRearmDelay?.();
+    }
+    /** Revalidate a linked chat's transcript in a new activation, then publish it
+     * pending. A link whose `agent.binding` never became durable (a crash after its
+     * intent) is recorded now, at its stored generation (contracts.md §6). */
+    async function rearmBinding(c, b, session) {
+        const entry = findLinked(intent, b.harness, b.harnessSessionId);
+        try {
+            b.transcript = await verifyRootTranscript(b.harness, b.harnessSessionId, c.root, b.transcript);
+        }
+        catch (err) {
+            if (!(err instanceof RootIdentityError))
+                throw err;
+            b.unavailable = true;
+            if (entry) {
+                entry.unavailable = { reason: err.reason, message: err.message };
+                persistQuietly();
+            }
+            console.error(`slipstream daemon: the chat linked to ${c.id} is unavailable: ${err.message}`);
+            // A transcript that comes back reconnects without another attach, while
+            // this binding is still the capture's in this activation.
+            const delay = Math.min(backoff.baseMs * 2 ** (b.revalidations ?? 0), backoff.maxMs);
+            b.revalidations = (b.revalidations ?? 0) + 1;
+            const timer = setTimeout(() => {
+                if (b.rearmTimer === timer)
+                    b.rearmTimer = undefined;
+                if (c.binding === b && b.unavailable && c.session === session && c.lifecycle === 'recording' && !quiescing && !torn && !compromised) {
+                    startRearm(c, b, session);
+                }
+            }, delay);
+            b.rearmTimer = timer;
+            timer.unref();
+            return undefined;
+        }
+        b.unavailable = false;
+        if (entry?.unavailable) {
+            entry.unavailable = null;
+            persistQuietly();
+        }
+        return publishBinding(c, b, { record: !session.bindingRecorded(b.generation), revokeOnFailure: false });
+    }
+    /** Whether a capture's root is still the directory it admitted. A root that is
+     * gone, or whose device or inode changed, is never captured as the same session. */
+    async function rootProblem(c) {
+        const known = findCapture(intent, c.id)?.root_identity;
+        let st;
+        try {
+            st = await stat(c.root, { bigint: true });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== 'ENOENT' && code !== 'ENOTDIR')
+                return undefined;
+            return `the workspace root ${c.root} no longer exists`;
+        }
+        if (st.isDirectory() && (!known || (st.dev.toString() === known.dev && st.ino.toString() === known.ino)))
+            return undefined;
+        return `the workspace root ${c.root} was replaced; a directory recreated there is captured under a new session`;
+    }
+    function onActivationEnded(c, activation, reason, message) {
+        if (c.activation !== activation || activation.lost || activation.ended)
+            return;
+        activation.ended = { reason, message };
+        console.error(`slipstream daemon: capture ${c.id} of ${c.root} stopped: ${message}`);
+        if (activation.session && c.lifecycle === 'recording')
+            endActivation(c, activation.session, activation.ended);
+    }
+    /** Stop an activation that ended on its own, recording why. Its intent stays
+     * running: a failed watcher is retried with backoff as a new activation; a
+     * missing root is not, since it cannot come back as the same directory. */
+    function endActivation(c, session, { reason, message }) {
+        c.lifecycle = 'stopping';
+        const prior = c.closing;
+        setClosing(c, (async () => {
+            await prior;
+            while (c.inflight.size)
+                await Promise.allSettled([...c.inflight]);
+            if (registry.get(c.id))
+                registry.setAgentConnection(c.id, 'none');
+            if (c.session === session)
+                c.session = undefined;
+            try {
+                await session.stop({ reason, assertOwnership: assertStoreOwned });
+            }
+            catch (err) {
+                registry.freeze(c.id, BigInt(session.health.snapshot().durable_seq));
+                fail(c, 'storage-unavailable', `the capture stopped (${message}), but the stop could not be recorded: ${err.message}`, { retry: true });
+                return;
+            }
+            registry.freeze(c.id, BigInt(session.health.snapshot().durable_seq));
+            c.ended = reason;
+            c.lifecycle = 'stopped';
+            const entry = findCapture(intent, c.id);
+            if (reason === 'watcher-failed' && entry?.intent === 'running' && !torn && !compromised) {
+                entry.last_failure = { reason, message, at_ms: Date.now(), next_attempt_at_ms: scheduleRetry(c) };
+                persistQuietly();
+            }
+        })());
+    }
+    /** Record a live activation's storage outage in the intent, and clear it on
+     * recovery, so offline readers agree with this daemon (contracts.md §6). */
+    function onStorageChanged(c, activation, state, failure) {
+        const entry = findCapture(intent, c.id);
+        if (c.activation !== activation || activation.lost || entry?.intent !== 'running')
+            return;
+        if (state === 'failing' && !entry.last_failure) {
+            entry.last_failure = { reason: 'storage-unavailable', at_ms: Date.now(), next_attempt_at_ms: null,
+                message: `the store cannot accept events (${failure?.operation ?? 'append'}: ${failure?.code ?? 'error'}); capture resumes when it recovers` };
+            persistQuietly();
+            return;
         }
-        if (torn || compromised || sessionCompromised || state !== 'attaching') {
-            // Shutdown, store-lock loss, or a session compromise arrived while capture was
-            // starting: do not publish this session. Stop it and hold the boundary. A
-            // failed stop here is recorded (not swallowed) so teardown can surface it.
+        // A recovery that lands while the capture is stopping keeps the outage until
+        // the stop replaces it. Clear synchronously so another outage records a
+        // fresh marker while this clear is still being written.
+        const outage = entry.last_failure;
+        if (state !== 'healthy' || c.lifecycle !== 'recording' || outage?.reason !== 'storage-unavailable'
+            || outage.next_attempt_at_ms !== null)
+            return;
+        entry.last_failure = null;
+        // If the clear cannot reach disk, retain the outage for both readers. A
+        // newer outage wins over this recovery if it arrives before the write fails.
+        persistIntent({ refuseOnFailure: false }).catch(() => { entry.last_failure ??= outage; });
+    }
+    function onSessionLockLost(c, activation, reason) {
+        console.error(`slipstream daemon: session ${c.id} lost its lock: ${reason}`);
+        if (c.activation !== activation || activation.lost)
+            return;
+        activation.lost = true;
+        fail(c, 'storage-unavailable', `capture lost its session lock: ${reason}`, { retry: true });
+        if (activation.session)
+            halt(c, activation.session);
+    }
+    /** Stop a capture whose storage can no longer be trusted, without recording a
+     * stop it cannot make durable. Its boundary stays at the last durable seq. */
+    function halt(c, session) {
+        registry.freeze(c.id, BigInt(session.health.snapshot().durable_seq));
+        const prior = c.closing;
+        setClosing(c, (async () => {
+            await prior;
+            await Promise.allSettled([...c.inflight]);
             try {
                 await session.stop();
             }
             catch (err) {
-                abortStopError ??= err;
+                console.error(`slipstream daemon: session ${c.id} did not stop cleanly after losing its lock:`, err);
             }
-            registry.freeze(id, BigInt(session.health.snapshot().durable_seq));
-            if (state === 'attaching')
-                state = 'detached';
-            return errFields('STORAGE_UNAVAILABLE', 'daemon could not complete the attach');
+            if (c.session === session)
+                c.session = undefined;
+        })());
+    }
+    /** Make `closing` the capture's stop in flight until it settles. Its outcome is
+     * read here, before any later waiter on it can run. */
+    function setClosing(c, closing) {
+        c.closing = closing;
+        const settle = () => {
+            if (c.lifecycle === 'failed')
+                unrecordedStops.add(closing);
+            if (c.closing === closing)
+                c.closing = undefined;
+        };
+        closing.then(settle, settle);
+    }
+    // ---- attach / detach / unlink -------------------------------------------
+    function admissionReply({ capture, created }) {
+        const { state, reason, message } = publicState(capture);
+        return { session_id: capture.id, state, reason, ...(message ? { message } : {}), created };
+    }
+    async function attachWatchOnly(req) {
+        if (!nonEmptyString(req.worktree))
+            return errFields('PROTOCOL', 'attach --watch-only requires a worktree');
+        let root;
+        try {
+            root = await realpath(req.worktree);
         }
-        registry.activate(id, liveBoundary(session.health));
-        current = { id, session, worktree: resolvedWorktree, harness, harnessSessionId, rootTranscript: resolvedTranscript };
-        state = 'active';
-        return { session_id: id };
+        catch (err) {
+            return errFields('CAPTURE_NOT_READY', err.message);
+        }
+        const admitted = await admit(root, { resumePaused: true });
+        return isErrorFields(admitted) ? admitted : admissionReply(admitted);
     }
-    async function attach(req) {
+    /** Verify a root chat transcript names this chat in this worktree. */
+    async function verifyRootTranscript(harness, harnessSessionId, root, path) {
+        let resolved;
+        try {
+            resolved = await realpath(path);
+        }
+        catch {
+            throw new RootIdentityError('transcript-missing', harness === 'claude-code'
+                ? 'root Claude transcript is unavailable; check its path or retry attach after the first root tool call'
+                : 'root Codex transcript cannot be resolved');
+        }
+        if (harness === 'codex') {
+            if (!await verifyCodexRootTranscript(resolved, harnessSessionId, root)) {
+                throw new RootIdentityError('identity-changed', 'root Codex transcript is missing, mismatched, or from an unsupported runtime');
+            }
+            return resolved;
+        }
+        const verified = await verifyClaudeRootTranscript(resolved, harnessSessionId, root);
+        if (!verified.ok) {
+            throw new RootIdentityError(UNAVAILABLE_BY_CLAUDE_REASON[verified.reason], verified.reason === 'not-yet'
+                ? 'root Claude transcript head is not complete yet; retry attach after the first root tool call'
+                : verified.reason === 'gap'
+                    ? 'root Claude transcript head exceeds the verification bounds; select a new root early in its session'
+                    : `root Claude transcript identity is ${verified.reason}`);
+        }
+        return resolved;
+    }
+    /** Attach from a chat. The chat's transcript is verified first, so a chat that
+     * cannot be linked records nothing. The workspace's capture is found or
+     * admitted; once it is recording the chat is linked in place. */
+    async function attachChat(req) {
         if (!nonEmptyString(req.worktree) || !nonEmptyString(req.harness) || !nonEmptyString(req.harness_session_id)) {
             // Structural fail-closed identity gate (honesty): an ambiguous or partial
-            // identity refuses attachment rather than guessing. Semantic verification
-            // that the declared harness is a live real process is the P4 forwarder's job.
+            // identity refuses attachment rather than guessing.
             return errFields('IDENTITY_UNRESOLVED', 'attach requires non-empty worktree, harness, and harness_session_id');
         }
-        if (req.root_transcript !== undefined && !nonEmptyString(req.root_transcript)) {
-            return errFields('IDENTITY_UNRESOLVED', 'root_transcript must be a non-empty existing path');
-        }
-        if (state !== 'detached') {
-            if (state === 'active')
-                return errFields('SESSION_ACTIVE', 'a session is already attached; detach it first');
-            if (state === 'wedged')
-                return errFields('STORAGE_UNAVAILABLE', 'daemon is wedged; restart it');
-            return errFields('CAPTURE_NOT_READY', `cannot attach while ${state}`);
-        }
-        // Refuse to attach over an in-flight maintenance op. This check and the
-        // `state === 'detached'` guard in runMaintenance are the two halves of the same
-        // mutual exclusion: both are synchronous, so whichever claims its slot first in
-        // this turn locks the other out. (Kept before `state = 'attaching'` so a refused
-        // attach leaves the state machine untouched.)
-        if (maintenanceInFlight)
-            return errFields('CAPTURE_NOT_READY', 'a maintenance operation is running; retry shortly');
-        // Set attaching BEFORE the first await so a concurrent attach is refused.
-        state = 'attaching';
-        sessionCompromised = false;
-        const id = randomUUID();
-        // Reserve the registry entry (boundary 0) before startCapture creates the log
-        // dir on disk, so the reader never over-publishes an uncommitted record from a
-        // session that momentarily appears on disk mid-startup.
-        registry.reserve(id);
-        const p = startAndActivate(id, req.worktree, req.harness, req.harness_session_id, req.root_transcript);
-        attachInFlight = p;
+        if (!nonEmptyString(req.root_transcript)) {
+            return errFields('IDENTITY_UNRESOLVED', 'linking a chat requires its root transcript; to record this workspace '
+                + 'without a chat, run `slipstream attach --watch-only`');
+        }
+        if (!isHarness(req.harness))
+            return errFields('IDENTITY_UNRESOLVED', 'root_transcript requires a supported harness');
+        const harness = req.harness;
+        const harnessSessionId = req.harness_session_id;
+        let root;
         try {
-            return await p;
+            root = await realpath(req.worktree);
+        }
+        catch (err) {
+            return errFields('CAPTURE_NOT_READY', err.message);
+        }
+        let transcript;
+        try {
+            transcript = await verifyRootTranscript(harness, harnessSessionId, root, req.root_transcript);
+        }
+        catch (err) {
+            if (err instanceof RootIdentityError)
+                return errFields('IDENTITY_UNRESOLVED', err.message);
+            throw err;
+        }
+        const admitted = await admit(root, { resumePaused: false });
+        if (isErrorFields(admitted))
+            return admitted;
+        const c = admitted.capture;
+        if (c.lifecycle !== 'recording' || !isRunning(c))
+            return admissionReply(admitted);
+        return link(c, { harness, harnessSessionId, transcript }, admitted.created);
+    }
+    function bindingExists(harness, harnessSessionId, c) {
+        return errFields('BINDING_EXISTS', `${harness} chat ${harnessSessionId} is already linked to the capture of ${c.root} `
+            + `(session ${c.id}). That link was kept. To link this chat here instead, run: slipstream unlink --session ${c.id}, `
+            + 'then run slipstream attach again from this chat.');
+    }
+    function bindReply(c, b, extra) {
+        return { session_id: c.id, state: 'recording', binding_generation: b.generation, agent_connection: b.check.state, ...extra };
+    }
+    /** Link a chat to a recording capture in place: same session, no baseline, no
+     * resume, no gap. The slot and identity are claimed synchronously, so the tenth
+     * slot and a chat racing itself onto two captures each resolve to one link. */
+    async function link(c, chat, created) {
+        // Finish an admitted unlink before publishing a replacement binding.
+        if (!c.binding)
+            await Promise.allSettled([...c.inflight]);
+        if (torn || compromised || quiescing || c.lifecycle !== 'recording' || !isRunning(c)) {
+            return errFields('CAPTURE_NOT_READY', 'the capture is no longer recording');
+        }
+        const mine = c.binding;
+        if (mine && mine.harness === chat.harness && mine.harnessSessionId === chat.harnessSessionId) {
+            const failed = await mine.publishing;
+            if (failed)
+                return failed;
+            if (c.binding !== mine)
+                return errFields('CAPTURE_NOT_READY', 'the chat was unlinked while it was being linked; retry attach');
+            if (mine.unavailable)
+                return relink(c, mine, chat.transcript);
+            if (mine.check.state === 'setup_pending')
+                mine.check.offeredAtMs = undefined;
+            return bindReply(c, mine, { already_active: true, created: false });
+        }
+        if (mine)
+            return bindingExists(mine.harness, mine.harnessSessionId, c);
+        const elsewhere = captureForChat(chat.harness, chat.harnessSessionId);
+        if (elsewhere)
+            return bindingExists(chat.harness, chat.harnessSessionId, elsewhere);
+        const refused = intentRefusal();
+        if (refused)
+            return refused;
+        if (linkedCount(intent) >= MAX_BINDINGS)
+            return errFields('BINDING_LIMIT_REACHED', BINDING_LIMIT_MESSAGE);
+        const entry = linkBinding(intent, {
+            session_id: c.id, harness: chat.harness, harness_session_id: chat.harnessSessionId,
+            canonical_worktree: c.root, verified_transcript_path: chat.transcript,
+        });
+        const b = { ...chat, generation: entry.binding_generation,
+            check: { state: 'setup_pending', checkId: randomUUID() } };
+        c.binding = b;
+        // The binding is durable before any event names it.
+        const publishing = persistIntent().then(() => publishBinding(c, b, { record: true, revokeOnFailure: true }), (err) => {
+            if (c.binding === b)
+                c.binding = undefined;
+            revokeBinding(intent, c.id);
+            return errFields('STORAGE_UNAVAILABLE', err.message);
+        });
+        b.publishing = publishing;
+        c.inflight.add(publishing);
+        let failed;
+        try {
+            failed = await publishing;
         }
         finally {
-            if (attachInFlight === p)
-                attachInFlight = undefined;
+            c.inflight.delete(publishing);
+            b.publishing = undefined;
         }
+        return failed ?? bindReply(c, b, { created });
     }
-    async function detach() {
-        if (state !== 'active' || !current) {
-            return errFields('SESSION_NOT_SELECTED', 'no active session to detach');
+    /** The same chat attaching again to its unavailable link, with a transcript that
+     * verifies now: the link keeps its generation and is published pending again. */
+    async function relink(c, b, transcript) {
+        const refused = intentRefusal();
+        if (refused)
+            return refused;
+        const entry = findLinked(intent, b.harness, b.harnessSessionId);
+        if (!entry || entry.session_id !== c.id)
+            return errFields('CAPTURE_NOT_READY', 'the chat was unlinked while it was being linked; retry attach');
+        entry.unavailable = null;
+        entry.verified_transcript_path = transcript;
+        b.transcript = transcript;
+        b.unavailable = false;
+        b.check = { state: 'setup_pending', checkId: randomUUID() };
+        const publishing = persistIntent().then(() => publishBinding(c, b, { record: !c.session.bindingRecorded(b.generation), revokeOnFailure: false }), (err) => errFields('STORAGE_UNAVAILABLE', err.message));
+        b.publishing = publishing;
+        c.inflight.add(publishing);
+        let failed;
+        try {
+            failed = await publishing;
         }
-        const { id, session } = current;
-        state = 'detaching'; // close admission synchronously; in-flight tasks still settle
-        await Promise.allSettled([...inflightTasks]);
-        let stopErr;
+        finally {
+            c.inflight.delete(publishing);
+            if (b.publishing === publishing)
+                b.publishing = undefined;
+        }
+        return failed ?? bindReply(c, b, { created: false });
+    }
+    /** Append a binding's events in contract order, then publish it to hooks and
+     * forwarders. A new link that cannot be recorded is revoked again. */
+    async function publishBinding(c, b, how) {
+        const session = c.session;
+        const target = { harness: b.harness, harness_session_id: b.harnessSessionId };
+        const own = () => {
+            if (torn || compromised || c.binding !== b || c.lifecycle !== 'recording' || c.activation?.lost) {
+                throw new QuestionError('STORAGE_UNAVAILABLE', 'the capture stopped or the chat was unlinked while it was being linked');
+            }
+        };
+        let recorded = false;
         try {
-            await session.stop();
+            if (how.record) {
+                const bindingRecord = session.recordAgent({ type: 'slipstream.agent.binding.v1', occurred_at_ms: Date.now(), data: {
+                        binding_generation: b.generation, target: { ...target, worktree: c.root }, verified_transcript_path: b.transcript
+                    } }, own);
+                b.bindingRecord = bindingRecord;
+                try {
+                    await bindingRecord;
+                    recorded = true;
+                }
+                finally {
+                    if (b.bindingRecord === bindingRecord)
+                        b.bindingRecord = undefined;
+                }
+            }
+            await session.recordAgent({ type: 'slipstream.agent.connection.v1', occurred_at_ms: Date.now(), data: {
+                    state: 'setup_pending', binding_generation: b.generation, target
+                } }, own);
         }
         catch (err) {
-            stopErr = err;
-        }
-        // Pin the reader at the final durable seq the session reached (honest even if
-        // stop() failed — health still holds the last durable value).
-        registry.freeze(id, BigInt(session.health.snapshot().durable_seq));
-        if (stopErr) {
-            // Fail closed: never claim a clean detach or admit new capture. Retain
-            // `current` so teardown can still attempt to release the session's resources.
-            state = 'wedged';
-            return errFields('STORAGE_UNAVAILABLE', `detach did not stop cleanly: ${stopErr.message}`);
-        }
-        current = undefined;
-        state = 'detached';
-        return { session_id: id };
+            if (how.revokeOnFailure && c.binding === b) {
+                c.binding = undefined;
+                revokeBinding(intent, c.id);
+                persistQuietly();
+                // The log already says this chat is linked; say it no longer is.
+                if (recorded) {
+                    await session.recordAgent({ type: 'slipstream.agent.unlinked.v1', occurred_at_ms: Date.now(),
+                        data: { binding_generation: b.generation, reason: 'unlinked' } }).catch(() => { });
+                }
+            }
+            return controlFailure(err);
+        }
+        registry.setAgentConnection(c.id, 'setup_pending');
+        return undefined;
+    }
+    async function detach(req) {
+        if (req.reason !== undefined && req.reason !== 'archived')
+            return errFields('PROTOCOL', `unknown detach reason: ${String(req.reason)}`);
+        const why = req.reason === 'archived' ? 'archived' : 'detached';
+        const c = await resolveTarget(req.target);
+        if (isErrorFields(c))
+            return c;
+        if (torn || compromised)
+            return errFields('STORAGE_UNAVAILABLE', 'the daemon is shutting down or its store lock was lost');
+        // A path withdraws every capture recorded at it, as the offline path does: an
+        // older capture of a replaced root would otherwise keep its slot.
+        const targets = captures.has(req.target) ? [c] : [...captures.values()].filter((x) => x.root === c.root);
+        const pending = targets.filter((t) => {
+            const entry = findCapture(intent, t.id);
+            return entry !== undefined && entry.intent !== 'withdrawn';
+        });
+        if (pending.length > 0) {
+            const refused = intentRefusal();
+            if (refused)
+                return refused;
+            for (const t of pending) {
+                withdrawCapture(intent, t.id, why);
+                revokeBinding(intent, t.id);
+            }
+            const durable = persistIntent();
+            for (const t of pending) {
+                const prior = t.closing;
+                // Set in this turn, so a concurrent detach waits for the same stop. A
+                // withdrawal that is not durable stops nothing, and is never acknowledged.
+                setClosing(t, durable.then(() => closeCapture(t, prior, why), (err) => { t.withdrawalError = err; }));
+            }
+        }
+        const already = !pending.includes(c) && findCapture(intent, c.id)?.intent === 'withdrawn' && c.lifecycle === 'stopped';
+        await Promise.all(targets.map((t) => t.closing));
+        const undurable = targets.find((t) => t.withdrawalError);
+        if (undurable)
+            return errFields('STORAGE_UNAVAILABLE', `the withdrawal was not saved: ${undurable.withdrawalError.message}`);
+        if (c.closeError) {
+            return errFields('STORAGE_UNAVAILABLE', `detach did not stop cleanly: ${c.closeError.message}`);
+        }
+        const { state, reason } = publicState(c);
+        return { session_id: c.id, state, reason, ...(already ? { already_stopped: true } : {}) };
+    }
+    /** Stop a withdrawn capture: unlink its chat, then record the stop. */
+    async function closeCapture(c, prior, why) {
+        clearTimeout(c.retryTimer);
+        const from = c.lifecycle;
+        if (from === 'queued') {
+            // Not activated: the start job sees the withdrawal and starts nothing. It is
+            // `stopped` only if its last activation, if any, ended in a durable stop (§6).
+            const last = c.resume ? await finalRecord(sessionLogPath(storeDir, c.id)).catch(() => undefined) : undefined;
+            c.lifecycle = !c.resume || last?.type === 'slipstream.capture.stopped.v1' ? 'stopped' : 'failed';
+            return;
+        }
+        c.lifecycle = 'stopping';
+        if (from === 'baselining')
+            await c.starting;
+        await prior;
+        // An unlink can join while an earlier admitted task is draining.
+        while (c.inflight.size)
+            await Promise.allSettled([...c.inflight]);
+        // Detach already revoked the binding's intent with the withdrawal.
+        const b = c.binding;
+        c.binding = undefined;
+        if (b) {
+            cancelRearm(b);
+            await b.bindingRecord?.catch(() => undefined);
+        }
+        if (registry.get(c.id))
+            registry.setAgentConnection(c.id, 'none');
+        const session = c.session;
+        if (!session) {
+            // Its activation already ended in a durable stop, or its storage failed
+            // earlier and it was halted without one.
+            c.lifecycle = c.ended || !c.activation ? 'stopped' : 'failed';
+            return;
+        }
+        c.session = undefined;
+        try {
+            // A link the log never named (a crash before its `agent.binding`) has no
+            // unlink to record.
+            const named = b && session.bindingRecorded(b.generation);
+            await session.stop(named ? { reason: why, unlinkGeneration: b.generation, assertOwnership: assertStoreOwned }
+                : { reason: why, assertOwnership: assertStoreOwned });
+            c.lifecycle = 'stopped';
+        }
+        catch (err) {
+            c.closeError = err;
+            c.lifecycle = 'failed';
+        }
+        // Pin the reader at the final durable seq (honest even if stop() failed).
+        registry.freeze(c.id, BigInt(session.health.snapshot().durable_seq));
+    }
+    /** Revoke a capture's chat link; the capture keeps recording. */
+    async function unlinkChat(req) {
+        const c = nonEmptyString(req.session_id) ? captures.get(req.session_id) : undefined;
+        if (!c)
+            return errFields('TARGET_NOT_FOUND', `no capture with session ${String(req.session_id)}`);
+        if (torn || compromised)
+            return errFields('STORAGE_UNAVAILABLE', 'the daemon is shutting down or its store lock was lost');
+        if (quiescing)
+            return errFields('CAPTURE_NOT_READY', 'gc is reclaiming storage; retry shortly');
+        const b = c.binding;
+        if (!b) {
+            // An unlink still being saved is not yet acknowledged to anyone.
+            if (c.unlinking && !await c.unlinking.then(() => true, () => false))
+                return intentRefusal();
+            return { session_id: c.id, already_unlinked: true };
+        }
+        const refused = intentRefusal();
+        if (refused)
+            return refused;
+        c.binding = undefined;
+        cancelRearm(b);
+        revokeBinding(intent, c.id);
+        if (registry.get(c.id))
+            registry.setAgentConnection(c.id, 'none');
+        const persisted = persistIntent();
+        c.unlinking = persisted;
+        const session = c.session;
+        if (!session || !['recording', 'stopping'].includes(c.lifecycle)) {
+            await persisted.catch(() => { });
+            return errFields('STORAGE_UNAVAILABLE', 'the chat was unlinked, but its capture cannot record the unlink');
+        }
+        const admitted = [...c.inflight];
+        const append = (async () => {
+            // Revoke immediately, but end task selection only after old admitted tasks
+            // have committed and the revocation is durable. Detach also drains this
+            // promise before closing the log.
+            await persisted;
+            await Promise.allSettled(admitted);
+            await b.bindingRecord?.catch(() => undefined);
+            if (!session.bindingRecorded(b.generation))
+                return;
+            await session.recordAgent({ type: 'slipstream.agent.unlinked.v1', occurred_at_ms: Date.now(),
+                data: { binding_generation: b.generation, reason: 'unlinked' } });
+        })();
+        c.inflight.add(append);
+        try {
+            await append;
+        }
+        catch (err) {
+            return errFields('STORAGE_UNAVAILABLE', `the chat was unlinked, but the unlink could not be recorded: ${err.message}`);
+        }
+        finally {
+            c.inflight.delete(append);
+        }
+        return { session_id: c.id, binding_generation: b.generation };
+    }
+    // ---- chat-facing verbs --------------------------------------------------
+    /** Capture-level ownership check run immediately before an append: nothing
+     * about any chat, only that this capture still holds its storage. */
+    function ownsCapture(c) {
+        return () => {
+            const live = c.lifecycle === 'recording' || c.lifecycle === 'stopping';
+            if (compromised || torn || !live || c.activation?.lost) {
+                throw new QuestionError('STORAGE_UNAVAILABLE', 'the selected capture lost storage ownership');
+            }
+        };
+    }
+    /** Ownership check run immediately before an append on a chat's behalf. A
+     * stopping capture still accepts work it admitted: the stop drains it before
+     * revoking the binding. */
+    function owns(c, b) {
+        const capture = ownsCapture(c);
+        return () => {
+            capture();
+            if (c.binding !== b)
+                throw new QuestionError('STORAGE_UNAVAILABLE', 'the selected capture lost storage ownership');
+        };
+    }
+    /** The chat's published binding and its capture, if it may act now. */
+    function chatTarget(c) {
+        const b = c?.binding;
+        return c && b && !b.publishing && !b.unavailable && c.lifecycle === 'recording' ? { c, b } : undefined;
+    }
+    /** The chat's binding when a request arrives. A request that awaits before it
+     * acts must still find this same binding afterwards: an unlink and relink in
+     * between is a different binding, even at the same capture. */
+    function bindingAtEntry(req) {
+        return captureForChat(req.harness, req.harness_session_id)?.binding;
+    }
+    function staleBinding(req, c, b) {
+        if (req.session_id !== undefined && req.session_id !== c.id) {
+            return errFields('STALE_BINDING', `session_id ${String(req.session_id)} is not the capture this chat is linked to`);
+        }
+        if (req.binding_generation !== undefined && req.binding_generation !== b.generation) {
+            return errFields('STALE_BINDING', `binding_generation ${String(req.binding_generation)} is no longer current`);
+        }
+        return undefined;
+    }
+    async function track(c, promise, ok) {
+        c.inflight.add(promise);
+        try {
+            return ok(await promise);
+        }
+        catch (err) {
+            if (err instanceof InvalidTitleError)
+                return errFields('INVALID_TITLE', err.message);
+            return controlFailure(err);
+        }
+        finally {
+            c.inflight.delete(promise);
+        }
     }
     async function beginTask(req) {
-        if (state === 'wedged')
-            return errFields('STORAGE_UNAVAILABLE', 'capture is wedged; its storage is no longer trustworthy');
-        if (state !== 'active' || !current) {
-            if (state === 'attaching')
-                return errFields('CAPTURE_NOT_READY', 'capture is still starting');
-            if (state === 'detaching')
-                return errFields('CAPTURE_NOT_READY', 'capture is detaching');
-            return errFields('SESSION_NOT_SELECTED', 'no active session');
-        }
-        if (req.session_id !== undefined && req.session_id !== current.id) {
-            // The optional target guards a retry after detach+attach-B from misrouting to
-            // a different session than the caller declared.
-            return errFields('SESSION_NOT_SELECTED', `session_id ${String(req.session_id)} is not the selected session`);
-        }
-        // Selection guard (locked design, decision X): the caller ships its verified
-        // identity triple and only the selected session's exact triple may declare.
-        // The P4 forwarder always sends the triple; a missing one is a contract
+        // The caller ships its verified identity triple; a missing one is a contract
         // violation, so fail closed rather than declare into whatever is selected.
         if (!nonEmptyString(req.harness) || !nonEmptyString(req.harness_session_id) || !nonEmptyString(req.worktree)) {
             return errFields('IDENTITY_UNRESOLVED', 'begin_task requires harness, harness_session_id, and worktree');
@@ -524,123 +1569,120 @@ export async function startDaemon(opts) {
             return errFields('INVALID_TITLE', 'begin_task requires a non-empty title');
         if (!nonEmptyString(req.request_id))
             return errFields('CAPTURE_NOT_READY', 'begin_task requires a non-empty request_id');
-        // Canonicalize the declared worktree with the SAME realpath policy as attach
-        // (startAndActivate), so a symlinked or relative declared path matches the
-        // durable root capture actually watches.
-        let declaredWorktree;
+        // Canonicalize the declared worktree with the same realpath policy attach
+        // uses, so a symlinked or relative declared path matches the capture's root.
+        const atEntry = bindingAtEntry(req);
+        let worktree;
         try {
-            declaredWorktree = await realpath(req.worktree);
+            worktree = await identityRealpath(req.worktree);
         }
         catch {
-            declaredWorktree = req.worktree; // an unresolvable path cannot match the canonical root
-        }
-        // Re-verify selection AFTER the realpath await: a concurrent detach, teardown,
-        // or store-lock loss may have changed state or swapped the session while we
-        // canonicalized. From here through inflightTasks.add there is no await, so
-        // neither a detach nor a teardown can slip between these checks and the append
-        // (they either observe the task in flight and drain it, or are observed here).
-        // Teardown fails closed without touching `state`, so check `torn`/`compromised`
-        // explicitly — otherwise a request could append after the daemon has already
-        // begun shutting down or lost its store lock.
-        if (compromised || torn) {
-            return errFields('STORAGE_UNAVAILABLE', 'the daemon is shutting down or its store lock was lost');
-        }
-        if (state !== 'active' || !current) {
-            return errFields('SESSION_NOT_SELECTED', 'the selected session changed before the declaration committed');
-        }
-        // Re-apply the optional session_id target guard after the await, exactly like
-        // the pre-await check: a concurrent detach+attach may have swapped in a session
-        // sharing the triple, and a request explicitly addressed to the prior session
-        // must not commit into its replacement.
-        if (req.session_id !== undefined && req.session_id !== current.id) {
-            return errFields('SESSION_NOT_SELECTED', `session_id ${String(req.session_id)} is not the selected session`);
-        }
-        if (req.harness !== current.harness ||
-            req.harness_session_id !== current.harnessSessionId ||
-            declaredWorktree !== current.worktree) {
-            return errFields('SESSION_NOT_SELECTED', 'the declared identity is not the selected session');
-        }
-        const { session } = current;
-        const promise = session.beginTask({ title: req.title, requestId: req.request_id });
-        inflightTasks.add(promise);
-        try {
-            const result = await promise;
-            return {
-                session_id: result.session_id,
-                task_id: result.task_id,
-                event_id: result.event_id,
-                seq: result.seq,
-            };
-        }
-        catch (err) {
-            if (err instanceof InvalidTitleError)
-                return errFields('INVALID_TITLE', err.message);
-            if (err instanceof StorageError)
-                return errFields('STORAGE_UNAVAILABLE', err.message);
-            return errFields('CAPTURE_NOT_READY', err.message);
+            worktree = req.worktree;
         }
-        finally {
-            inflightTasks.delete(promise);
+        // Everything below runs without an await until the append is admitted, so a
+        // concurrent unlink or detach either sees it in flight or is seen here.
+        if (compromised || torn)
+            return errFields('STORAGE_UNAVAILABLE', 'the daemon is shutting down or its store lock was lost');
+        const linked = captureForChat(req.harness, req.harness_session_id);
+        if (!linked || linked.root !== worktree) {
+            const here = liveCaptureAt(worktree);
+            if (here && !here.binding)
+                return errFields('AGENT_NOT_CONNECTED', WATCH_ONLY_MESSAGE);
+            return errFields('SESSION_NOT_SELECTED', `this chat is not linked to a capture of ${worktree}`);
         }
+        if (linked.activation?.lost)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is no longer trustworthy');
+        const target = chatTarget(linked);
+        if (!target)
+            return errFields('CAPTURE_NOT_READY', 'the linked capture is not recording yet');
+        if (target.b !== atEntry)
+            return errFields('SESSION_NOT_SELECTED', 'this chat was unlinked or relinked while the request was in flight');
+        const { c, b } = target;
+        const stale = staleBinding(req, c, b);
+        if (stale)
+            return stale;
+        if (b.check.state !== 'connected')
+            return errFields('AGENT_NOT_CONNECTED', SETUP_PENDING_MESSAGE);
+        return track(c, c.session.beginTask({ title: req.title, requestId: req.request_id }), (r) => c.binding !== b
+            ? errFields('STALE_BINDING', `task ${r.task_id} was recorded, but this chat was unlinked before it could be acknowledged`)
+            : { session_id: r.session_id, task_id: r.task_id, event_id: r.event_id, seq: r.seq });
     }
-    /** Queue a question on the selected capture. `askQuestion` installs its own
-     * request reservation synchronously; install the daemon-level lifetime promise
-     * in the same turn so detach and shutdown drain source reads and appends. */
+    /** Queue a question on the capture the app names. `askQuestion` installs its own
+     * request reservation synchronously; the daemon-level lifetime promise is
+     * installed in the same turn so detach and shutdown drain it. */
     async function ask(req) {
         if (compromised || torn)
             return errFields('STORAGE_UNAVAILABLE', 'daemon storage ownership is unavailable');
-        if (state === 'wedged')
-            return errFields('STORAGE_UNAVAILABLE', 'capture is wedged; its storage is no longer trustworthy');
-        if (state !== 'active' || !current) {
-            if (state === 'attaching' || state === 'detaching')
-                return errFields('CAPTURE_NOT_READY', 'capture is not ready to accept questions');
-            return errFields('SESSION_NOT_SELECTED', 'no active session');
-        }
-        if (current.harness !== 'claude-code' && current.harness !== 'codex') {
-            return errFields('SESSION_NOT_SELECTED', 'the selected capture has no supported question target');
-        }
-        // No await may appear before this call and registration: detach/shutdown must
-        // see any source verification admitted before they change state.
-        const binding = current;
-        const { session, harness, harnessSessionId, worktree } = binding;
-        const promise = session.askQuestion(req, {
-            harness: harness,
-            harness_session_id: harnessSessionId,
-            worktree,
-        }, () => {
-            if (compromised || sessionCompromised || current !== binding) {
-                throw new QuestionError('STORAGE_UNAVAILABLE', 'the selected capture lost storage ownership');
-            }
-        });
-        inflightTasks.add(promise);
+        const c = nonEmptyString(req.session_id) ? captures.get(req.session_id) : undefined;
+        if (!c || !isLive(c))
+            return errFields('SESSION_NOT_SELECTED', 'no capture with that session id is running');
+        if (c.activation?.lost)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is no longer trustworthy');
+        if (!c.binding)
+            return errFields('AGENT_NOT_CONNECTED', WATCH_ONLY_MESSAGE);
+        if (req.binding_generation !== undefined && req.binding_generation !== c.binding.generation) {
+            return errFields('STALE_BINDING', `binding_generation ${String(req.binding_generation)} is no longer current`);
+        }
+        if (c.lifecycle !== 'recording' || !isRunning(c))
+            return errFields('CAPTURE_NOT_READY', 'the capture is not recording yet');
+        const target = chatTarget(c);
+        if (!target)
+            return errFields('AGENT_NOT_CONNECTED', SETUP_PENDING_MESSAGE);
+        const { b } = target;
+        if (b.check.state !== 'connected')
+            return errFields('AGENT_NOT_CONNECTED', SETUP_PENDING_MESSAGE);
+        return track(c, c.session.askQuestion(req, {
+            harness: b.harness, harness_session_id: b.harnessSessionId, worktree: c.root,
+        }, owns(c, b)), (r) => ({ ...r }));
+    }
+    /** Record a question and the answer the client's own forked chat produced. The
+     * client is the writer, so there is no binding, chat or connection to check:
+     * the capture only has to be recording. The conversation ids it reports are
+     * stored as client-reported and are never used to bind or attribute. */
+    async function recordExchange(req) {
+        if (compromised || torn)
+            return errFields('STORAGE_UNAVAILABLE', 'daemon storage ownership is unavailable');
+        const c = nonEmptyString(req.session_id) ? captures.get(req.session_id) : undefined;
+        if (!c || !isLive(c))
+            return errFields('SESSION_NOT_SELECTED', 'no capture with that session id is running');
+        if (c.activation?.lost)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is no longer trustworthy');
+        if (c.lifecycle !== 'recording' || !isRunning(c))
+            return errFields('CAPTURE_NOT_READY', 'the capture is not recording yet');
+        return track(c, c.session.recordQuestionExchange(req, ownsCapture(c)), (r) => ({ ...r }));
+    }
+    /** Record one later step of a change request sent from a recorded exchange.
+     * The body is checked first so the bodiless capability probe is PROTOCOL
+     * whatever state the capture is in. */
+    async function recordRelayUpdate(req) {
+        if (compromised || torn)
+            return errFields('STORAGE_UNAVAILABLE', 'daemon storage ownership is unavailable');
         try {
-            const result = await promise;
-            return { ...result };
+            normalizeRelayUpdate(req);
         }
         catch (err) {
-            if (err instanceof QuestionError)
-                return errFields(err.code, err.message);
-            if (err instanceof StorageError)
-                return errFields('STORAGE_UNAVAILABLE', err.message);
-            return errFields('CAPTURE_NOT_READY', err.message);
-        }
-        finally {
-            inflightTasks.delete(promise);
+            return errFields(err.code, err.message);
         }
+        const c = captures.get(req.session_id);
+        if (!c || !isLive(c))
+            return errFields('SESSION_NOT_SELECTED', 'no capture with that session id is running');
+        if (c.activation?.lost)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is no longer trustworthy');
+        if (c.lifecycle !== 'recording' || !isRunning(c))
+            return errFields('CAPTURE_NOT_READY', 'the capture is not recording yet');
+        return track(c, c.session.recordQuestionRelayUpdate(req, ownsCapture(c)), (r) => ({ ...r }));
     }
+    /** The question hook asks for this chat's next question (or its setup check).
+     * Only a linked root chat may claim: subagents and other chats are refused. */
     async function claimQuestion(req) {
-        if (compromised || torn || state === 'wedged')
+        if (compromised || torn)
             return errFields('STORAGE_UNAVAILABLE', 'capture storage is unavailable');
-        if (state !== 'active' || !current)
-            return errFields('SESSION_NOT_SELECTED', 'no active capture');
-        if ((current.harness !== 'codex' && current.harness !== 'claude-code')
-            || !current.rootTranscript || req.harness !== current.harness
-            || !nonEmptyString(req.harness_session_id) || !nonEmptyString(req.worktree)
+        if (!isHarness(req.harness) || !nonEmptyString(req.harness_session_id) || !nonEmptyString(req.worktree)
             || !nonEmptyString(req.transcript_path)
             || Object.hasOwn(req, 'agent_id') || Object.hasOwn(req, 'agent_type')) {
             return errFields('IDENTITY_UNRESOLVED', 'unsupported or incomplete root identity');
         }
-        const binding = current;
+        const atEntry = bindingAtEntry(req);
         let worktree;
         let transcript;
         try {
@@ -649,46 +1691,39 @@ export async function startDaemon(opts) {
         catch {
             return errFields('IDENTITY_UNRESOLVED', 'identity path cannot be resolved');
         }
-        if (compromised || torn || sessionCompromised || state !== 'active' || current !== binding
-            || req.harness_session_id !== binding.harnessSessionId
-            || worktree !== binding.worktree || transcript !== binding.rootTranscript) {
-            return errFields('SESSION_NOT_SELECTED', 'the callback is not the selected root session');
-        }
-        const promise = binding.session.claimQuestion({ harness: binding.harness, harness_session_id: binding.harnessSessionId,
-            worktree: binding.worktree }, () => {
-            if (compromised || sessionCompromised || current !== binding) {
-                throw new QuestionError('STORAGE_UNAVAILABLE', 'the selected capture lost storage ownership');
-            }
-        });
-        inflightTasks.add(promise);
-        try {
-            const result = await promise;
-            return result === null ? { question: null } : { question: result };
-        }
-        catch (err) {
-            if (err instanceof QuestionError)
-                return errFields(err.code, err.message);
-            if (err instanceof StorageError)
-                return errFields('STORAGE_UNAVAILABLE', err.message);
-            return errFields('CAPTURE_NOT_READY', err.message);
+        if (compromised || torn)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is unavailable');
+        const linked = captureForChat(req.harness, req.harness_session_id);
+        if (linked?.activation?.lost)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is no longer trustworthy');
+        const target = chatTarget(linked);
+        if (!target || target.b !== atEntry || target.c.root !== worktree || target.b.transcript !== transcript) {
+            return errFields('SESSION_NOT_SELECTED', 'the callback is not a linked root chat');
         }
-        finally {
-            inflightTasks.delete(promise);
+        const { c, b } = target;
+        const stale = staleBinding(req, c, b);
+        if (stale)
+            return stale;
+        if (b.check.state === 'setup_pending') {
+            const now = Date.now();
+            if (b.check.offeredAtMs !== undefined && now - b.check.offeredAtMs < reofferMs)
+                return { question: null };
+            b.check.offeredAtMs = now;
+            return { question: null, setup_check: { check_id: b.check.checkId } };
         }
+        return track(c, c.session.claimQuestion({ harness: b.harness, harness_session_id: b.harnessSessionId, worktree: c.root }, owns(c, b)), (r) => (r === null ? { question: null } : { question: r }));
     }
-    /** Record an answer returned through the selected harness session's MCP tool.
-     * Like begin_task, the caller's triple must equal the binding after the realpath
-     * await; with no transcript or agent id this proves the call came through the
-     * selected harness session, not which agent in it wrote the answer. */
+    /** Record an answer returned through a linked chat's MCP tool. The caller's
+     * identity routes it to that chat's capture; with no transcript or agent id this
+     * proves the call came through the linked chat, not which agent in it wrote the
+     * answer. A question queued for another chat is not found here. */
     async function answerQuestion(req) {
         if (!nonEmptyString(req.harness) || !nonEmptyString(req.harness_session_id) || !nonEmptyString(req.worktree)) {
             return errFields('IDENTITY_UNRESOLVED', 'answer_question requires harness, harness_session_id, and worktree');
         }
-        if (compromised || torn || state === 'wedged')
+        if (compromised || torn)
             return errFields('STORAGE_UNAVAILABLE', 'capture storage is unavailable');
-        if (state !== 'active' || !current)
-            return errFields('SESSION_NOT_SELECTED', 'no active capture');
-        const binding = current;
+        const atEntry = bindingAtEntry(req);
         let worktree;
         try {
             worktree = await identityRealpath(req.worktree);
@@ -696,45 +1731,66 @@ export async function startDaemon(opts) {
         catch {
             worktree = req.worktree;
         }
-        if (compromised || torn || sessionCompromised || state !== 'active' || current !== binding
-            || req.harness !== binding.harness || req.harness_session_id !== binding.harnessSessionId || worktree !== binding.worktree) {
-            return errFields('SESSION_NOT_SELECTED', 'the caller is not the selected harness session');
-        }
-        const promise = binding.session.answerQuestion({ question_id: req.question_id, text: req.text }, { harness: binding.harness, harness_session_id: binding.harnessSessionId, worktree: binding.worktree }, () => {
-            if (compromised || sessionCompromised || current !== binding) {
-                throw new QuestionError('STORAGE_UNAVAILABLE', 'the selected capture lost storage ownership');
-            }
-        });
-        inflightTasks.add(promise);
+        if (compromised || torn)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is unavailable');
+        const linked = captureForChat(req.harness, req.harness_session_id);
+        if (linked?.activation?.lost)
+            return errFields('STORAGE_UNAVAILABLE', 'capture storage is no longer trustworthy');
+        const target = chatTarget(linked);
+        if (!target || target.b !== atEntry || target.c.root !== worktree)
+            return errFields('SESSION_NOT_SELECTED', 'the caller is not a linked chat');
+        const { c, b } = target;
+        const stale = staleBinding(req, c, b);
+        if (stale)
+            return stale;
+        if (req.question_id === b.check.checkId)
+            return confirmAgent(c, b, req.text);
+        return track(c, c.session.answerQuestion({ question_id: req.question_id, text: req.text }, { harness: b.harness, harness_session_id: b.harnessSessionId, worktree: c.root }, owns(c, b)), (r) => ({ ...r }));
+    }
+    /** The linked chat returned its setup check: record it connected, once. */
+    async function confirmAgent(c, b, text) {
+        const check = b.check;
         try {
-            return { ...await promise };
+            assertAnswerText(text);
         }
         catch (err) {
-            if (err instanceof QuestionError)
-                return errFields(err.code, err.message);
-            if (err instanceof StorageError)
-                return errFields('STORAGE_UNAVAILABLE', err.message);
-            return errFields('CAPTURE_NOT_READY', err.message);
+            return errFields(err.code, err.message);
+        }
+        if (check.ack)
+            return { ...check.ack, duplicate: true };
+        if (check.confirming) {
+            const settled = await check.confirming;
+            return isErrorFields(settled) ? settled : { ...settled, duplicate: true };
+        }
+        const promise = c.session.recordAgent({ type: 'slipstream.agent.connection.v1', occurred_at_ms: Date.now(), data: {
+                state: 'connected', binding_generation: b.generation, target: { harness: b.harness, harness_session_id: b.harnessSessionId }
+            } }, () => {
+            owns(c, b)();
+            if (b.check !== check)
+                throw new QuestionError('STORAGE_UNAVAILABLE', 'the setup check was re-armed by a restart');
+        }).then((event) => {
+            check.state = 'connected';
+            registry.setAgentConnection(c.id, 'connected');
+            check.ack = { session_id: event.data.session_id, question_id: check.checkId, event_id: event.seq, seq: event.seq,
+                answered_at_ms: Date.parse(event.time), duplicate: false };
+            return check.ack;
+        }, controlFailure);
+        check.confirming = promise;
+        c.inflight.add(promise);
+        try {
+            return await promise;
         }
         finally {
-            inflightTasks.delete(promise);
+            c.inflight.delete(promise);
+            check.confirming = undefined;
         }
     }
-    /** Admit and run a detached-only maintenance op. Admission is synchronous through
-     * claiming `maintenanceInFlight`, so it cannot interleave with attach (which sets
-     * `state` synchronously and refuses while the slot is held). The op runs only in
-     * `detached`; anything else — an active/attaching/detaching session, a wedged or
-     * compromised store, an op already running — is refused without touching disk. */
+    // ---- maintenance --------------------------------------------------------
+    /** Run one maintenance op at a time. The slot is claimed synchronously through
+     * `maintenanceInFlight`, and `op` runs up to its first await in the same turn. */
     async function runMaintenance(op) {
         if (compromised || torn)
             return errFields('STORAGE_UNAVAILABLE', 'the daemon is shutting down or its store lock was lost');
-        if (state !== 'detached') {
-            // A capture in any stage — attaching, active, or detaching — is SESSION_ACTIVE;
-            // CAPTURE_NOT_READY is reserved for the maintenance-slot contention below.
-            if (state === 'wedged')
-                return errFields('STORAGE_UNAVAILABLE', 'daemon is wedged; restart it');
-            return errFields('SESSION_ACTIVE', `a capture session is ${state}; detach it before deleting or collecting`);
-        }
         if (maintenanceInFlight)
             return errFields('CAPTURE_NOT_READY', 'another maintenance operation is running; retry shortly');
         let release;
@@ -757,75 +1813,243 @@ export async function startDaemon(opts) {
         }
         const id = req.session_id;
         return runMaintenance(async () => {
-            let present;
-            try {
-                present = await sessionExists(storeDir, id);
-            }
-            catch (err) {
-                return errFields('STORAGE_UNAVAILABLE', err.message);
-            }
-            if (!present)
-                return errFields('SESSION_NOT_FOUND', `no session ${id} to delete`);
-            // Durable-tombstone-first: publish the marker (fsynced) BEFORE removing any
-            // history, so a crash in between leaves a session the reader already serves as
-            // gone and a later gc finishes the cleanup. Nothing is committed yet, so a
-            // failure here is a plain STORAGE_UNAVAILABLE — no rollback needed.
-            try {
-                await publishTombstone(storeDir, id);
+            // Checked in the same turn `deleting` is set, which admission checks in the
+            // same turn as its intent entry: neither can slip past the other.
+            const target = captures.get(id);
+            const entry = findCapture(intent, id);
+            if ((entry && entry.intent !== 'withdrawn') || target?.session || (target && !['stopped', 'failed'].includes(target.lifecycle))) {
+                const state = target ? publicState(target).state : entry.intent;
+                return errFields('SESSION_ACTIVE', `session ${id} is ${state}; detach it and let it stop first`);
             }
-            catch (err) {
-                return errFields('STORAGE_UNAVAILABLE', `could not durably record deletion of ${id}: ${err.message}`);
-            }
-            // Now that the tombstone is durable, abort any in-flight follower of this
-            // session so it re-resolves, re-reads the tombstone, and gets 410 rather than
-            // streaming a log we are about to delete. The reader's installIfAbsent gives a
-            // followed retained session a registry entry this freeze can reach.
-            registry.freeze(id, 0n);
-            // The tombstone is durable → the session is logically removed and the marker is
-            // never rolled back. If we have since lost the store lock, or history cleanup
-            // fails, report that removal committed and cleanup is retryable via gc.
-            const committed = `session ${id} is logically removed (tombstone durable); history cleanup is retryable via gc`;
-            if (compromised || torn)
-                return errFields('STORAGE_UNAVAILABLE', committed);
+            deleting = id;
             try {
-                await removeSessionHistory(storeDir, id);
+                return await deleteInactive(id);
             }
-            catch (err) {
-                return errFields('STORAGE_UNAVAILABLE', `${committed}: ${err.message}`);
+            finally {
+                deleting = undefined;
+                deleteDoneAt.set(id, ++deletesDone);
             }
-            return { session_id: id };
         });
     }
+    async function deleteInactive(id) {
+        let present;
+        try {
+            present = await sessionExists(storeDir, id);
+        }
+        catch (err) {
+            return errFields('STORAGE_UNAVAILABLE', err.message);
+        }
+        if (!present)
+            return errFields('SESSION_NOT_FOUND', `no session ${id} to delete`);
+        // Durable-tombstone-first: publish the marker (fsynced) BEFORE removing any
+        // history, so a crash in between leaves a session the reader already serves as
+        // gone and a later gc finishes the cleanup. Nothing is committed yet, so a
+        // failure here is a plain STORAGE_UNAVAILABLE — no rollback needed.
+        try {
+            await publishTombstone(storeDir, id);
+        }
+        catch (err) {
+            return errFields('STORAGE_UNAVAILABLE', `could not durably record deletion of ${id}: ${err.message}`);
+        }
+        // Now that the tombstone is durable, abort any in-flight follower of this
+        // session so it re-resolves, re-reads the tombstone, and gets 410 rather than
+        // streaming a log we are about to delete. The reader's installIfAbsent gives a
+        // followed retained session a registry entry this freeze can reach.
+        registry.freeze(id, 0n);
+        // Deletion removes the session's capture and binding entries (§8).
+        forgetSession(intent, id);
+        captures.delete(id);
+        try {
+            await persistIntent();
+        }
+        catch (err) {
+            return errFields('STORAGE_UNAVAILABLE', `session ${id} is logically removed (tombstone durable), but ${err.message}`);
+        }
+        // The tombstone is durable → the session is logically removed and the marker is
+        // never rolled back. If we have since lost the store lock, or history cleanup
+        // fails, report that removal committed and cleanup is retryable via gc.
+        const committed = `session ${id} is logically removed (tombstone durable); history cleanup is retryable via gc`;
+        if (compromised || torn)
+            return errFields('STORAGE_UNAVAILABLE', committed);
+        try {
+            await removeSessionHistory(storeDir, id);
+        }
+        catch (err) {
+            return errFields('STORAGE_UNAVAILABLE', `${committed}: ${err.message}`);
+        }
+        return { session_id: id };
+    }
+    /** gc as one maintenance transaction (D9): close admission, stop every capture
+     * with `capture.stopped{maintenance}`, sweep, then resume each one stopped here.
+     * Intent is untouched throughout. */
     async function gc() {
         return runMaintenance(async () => {
+            quiescing = true;
             try {
-                // Finish any interrupted deletion first: a session tombstoned by a
-                // delete_session that crashed before cleanup still carries residual history.
-                // Re-establish the tombstone's durability, invalidate any follower a partial
-                // delete left pinned, then complete the removal — the same publish -> freeze
-                // -> remove sequence delete_session runs. Stop before any mutation if we lose
-                // the store lock: a successor now owns this store's files.
-                for (const s of await listSessions(storeDir)) {
-                    if (!s.removed)
+                await Promise.allSettled([...admitting.values()]);
+                // Starts already queued run first; none begins until this pass ends.
+                const pass = baselines.then(maintenancePass);
+                baselines = pass.then(() => { }, () => { });
+                return await pass;
+            }
+            finally {
+                quiescing = false;
+            }
+        });
+    }
+    async function maintenancePass() {
+        const stopped = new Set();
+        const unproven = new Map();
+        try {
+            for (const c of captures.values()) {
+                if (c.session && c.lifecycle === 'recording')
+                    stopForMaintenance(c, stopped, unproven);
+            }
+            // A detach, a halt or an ended activation may own a stop too; every stop gc
+            // waits for must finish and record its stop before any blob is swept.
+            // Read as each stop settles: a retry may requeue a failed capture later.
+            const settled = (c, closing) => {
+                const failed = c.lifecycle === 'failed' || (closing !== undefined && unrecordedStops.has(closing));
+                if (failed && !unproven.has(c.id))
+                    unproven.set(c.id, `capture ${c.id} stopped without recording its stop`);
+            };
+            // A stop still settling counts whatever the lifecycle reads: a lock lost
+            // mid-detach marks the capture `failed` while its log is still draining.
+            const writing = (c) => c.session || c.lifecycle === 'stopping' || c.closing;
+            for (;;) {
+                const busy = [...captures.values()].filter(writing);
+                if (busy.length === 0)
+                    break;
+                const closings = busy.map((c) => c.closing);
+                await Promise.allSettled(busy.map((c, i) => Promise.resolve(closings[i]).then(() => settled(c, closings[i]), () => settled(c, closings[i]))));
+                const stuck = busy.filter((c, i) => c.closing === closings[i] && writing(c));
+                if (stuck.length === busy.length) {
+                    for (const c of stuck)
+                        unproven.set(c.id, `capture ${c.id} has not stopped`);
+                    break;
+                }
+            }
+            if (torn || compromised)
+                throw new StorageError('gc-aborted', new Error('the daemon is shutting down or lost its store lock'));
+            if (unproven.size > 0)
+                return errFields('STORAGE_UNAVAILABLE', `gc swept nothing: ${[...unproven.values()].join('; ')}`);
+            const foreign = await freshSessionLock();
+            if (foreign) {
+                return errFields('STORAGE_UNAVAILABLE', `gc swept nothing: session ${foreign} is still being written by another process`);
+            }
+            return await sweep();
+        }
+        catch (err) {
+            // A corrupt/missing retained log or an aborted sweep deletes nothing; report
+            // the store as unavailable rather than a partial success.
+            return errFields('STORAGE_UNAVAILABLE', err.message);
+        }
+        finally {
+            // Resume even after a failed sweep: storage that refused a sweep may still
+            // record, and a capture that cannot fails visibly on its own.
+            quiescing = false;
+            if (!torn && !compromised) {
+                for (const entry of intent.captures) {
+                    const c = captures.get(entry.session_id);
+                    if (!c || !stopped.has(c) || entry.intent !== 'running' || c.lifecycle !== 'stopped')
                         continue;
-                    if (compromised || torn) {
-                        throw new StorageError('gc-aborted', new Error('store ownership lost mid-cleanup'));
-                    }
-                    await publishTombstone(storeDir, s.id);
-                    registry.freeze(s.id, 0n);
-                    await removeSessionHistory(storeDir, s.id);
+                    c.lifecycle = 'queued';
+                    c.resume = true;
+                    enqueueStart(c);
                 }
-                // Abort mid-sweep if we lose the store lock: a successor may then own the
-                // shared blobs, and deleting one it still references would be data loss.
-                const removed = await reclaimUnreferencedBlobs(storeDir, () => torn || compromised);
-                return { removed };
+            }
+        }
+    }
+    /** Stop one recording capture for maintenance, keeping its capture and binding
+     * intent. Admitted binding publication and chat work finish first, so a link in
+     * flight is kept rather than revoked; a check issued before the stop never
+     * connects afterwards. */
+    function stopForMaintenance(c, stopped, unproven) {
+        const prior = c.closing;
+        setClosing(c, (async () => {
+            await prior;
+            while (c.binding?.publishing || c.inflight.size) {
+                if (c.binding)
+                    cancelRearm(c.binding);
+                await Promise.allSettled([c.binding?.publishing, ...c.inflight]);
+            }
+            const session = c.session;
+            // A detach or an ended activation took it over meanwhile, and owns its stop.
+            if (!session || c.lifecycle !== 'recording' || !isRunning(c) || torn || compromised) {
+                if (session && (torn || compromised))
+                    unproven.set(c.id, `capture ${c.id} was not stopped`);
+                return;
+            }
+            c.lifecycle = 'stopping';
+            if (c.binding)
+                c.binding.check = { state: 'setup_pending', checkId: randomUUID() };
+            registry.setAgentConnection(c.id, 'none');
+            c.session = undefined;
+            const freeze = () => registry.freeze(c.id, BigInt(session.health.snapshot().durable_seq));
+            try {
+                await session.stop({ reason: 'maintenance', assertOwnership: assertStoreOwned });
             }
             catch (err) {
-                // A corrupt/missing retained log or an aborted sweep deletes nothing; report
-                // the store as unavailable rather than a partial success.
-                return errFields('STORAGE_UNAVAILABLE', err.message);
+                freeze();
+                const message = err.message;
+                unproven.set(c.id, `capture ${c.id} could not record its maintenance stop: ${message}`);
+                fail(c, 'storage-unavailable', `gc could not record this capture's maintenance stop: ${message}`, { retry: true });
+                return;
             }
-        });
+            freeze();
+            c.ended = 'maintenance';
+            c.lifecycle = 'stopped';
+            stopped.add(c);
+        })());
+    }
+    /** A session ownership lock some other writer refreshed recently: the daemon's
+     * own captures are all stopped by now, and released theirs. */
+    async function freshSessionLock() {
+        for (const s of await listSessions(storeDir)) {
+            let mtimeMs;
+            try {
+                mtimeMs = (await stat(join(storeDir, 'sessions', s.id, 'owner.lock'))).mtimeMs;
+            }
+            catch (err) {
+                if (err.code === 'ENOENT')
+                    continue;
+                throw err;
+            }
+            if (Date.now() - mtimeMs <= STALE_MS)
+                return s.id;
+        }
+        return undefined;
+    }
+    /** Finish interrupted deletions, then reclaim unreferenced blobs. */
+    async function sweep() {
+        // A session tombstoned by a delete_session that crashed before cleanup still
+        // carries residual history: re-establish the tombstone's durability, invalidate
+        // any follower a partial delete left pinned, then complete the removal. Stop
+        // before any mutation if we lose the store lock: a successor now owns this
+        // store's files.
+        for (const s of await listSessions(storeDir)) {
+            if (!s.removed)
+                continue;
+            if (compromised || torn) {
+                throw new StorageError('gc-aborted', new Error('store ownership lost mid-cleanup'));
+            }
+            await publishTombstone(storeDir, s.id);
+            registry.freeze(s.id, 0n);
+            await removeSessionHistory(storeDir, s.id);
+        }
+        // The shared blob store trusts blobs it published, some of which this sweep
+        // may delete: every resumed capture starts with a fresh instance. The sweep
+        // aborts if we lose the store lock, since a successor may own the blobs.
+        cas = undefined;
+        const removed = await reclaimUnreferencedBlobs(storeDir, () => torn || compromised);
+        return { removed };
+    }
+    async function attach(req) {
+        if (req.mode === 'watch-only')
+            return attachWatchOnly(req);
+        if (req.mode !== undefined)
+            return errFields('PROTOCOL', `unknown attach mode: ${String(req.mode)}`);
+        return attachChat(req);
     }
     async function dispatch(req) {
         if (compromised)
@@ -833,13 +2057,16 @@ export async function startDaemon(opts) {
         let outcome;
         switch (req.verb) {
             case 'status':
-                outcome = statusFields();
+                outcome = await status(req);
                 break;
             case 'attach':
                 outcome = await attach(req);
                 break;
             case 'detach':
-                outcome = await detach();
+                outcome = await detach(req);
+                break;
+            case 'unlink':
+                outcome = await unlinkChat(req);
                 break;
             case 'begin_task':
                 outcome = await beginTask(req);
@@ -847,6 +2074,12 @@ export async function startDaemon(opts) {
             case 'ask':
                 outcome = await ask(req);
                 break;
+            case 'record_question_exchange':
+                outcome = await recordExchange(req);
+                break;
+            case 'record_question_relay_update':
+                outcome = await recordRelayUpdate(req);
+                break;
             case 'claim_question':
                 outcome = await claimQuestion(req);
                 break;
@@ -936,6 +2169,8 @@ export async function startDaemon(opts) {
     // Startup is fully ready: reader running, lock held, not torn, readerRef bound.
     // Only now let the connection handler dispatch verbs (see the `ready` gate).
     ready = true;
+    for (const c of restored)
+        enqueueStart(c);
     return {
         socketPath,
         readerUrl: reader.url,
@@ -943,9 +2178,22 @@ export async function startDaemon(opts) {
         stop: teardown,
     };
 }
+function controlFailure(err) {
+    if (err instanceof QuestionError)
+        return errFields(err.code, err.message);
+    if (err instanceof StorageError)
+        return errFields('STORAGE_UNAVAILABLE', err.message);
+    return errFields('CAPTURE_NOT_READY', err.message);
+}
 function errFields(code, message) {
     return { __error: true, code, message };
 }
+/** What to do when a session cannot be read or resumed. */
+function corruptRemedy(id) {
+    return `Restore its data, or remove it with \`slipstream delete ${id}\` (this discards that history)`;
+}
+/** A lock, storage or shutdown failure says nothing about the session's data. */
+const RETRY_REMEDY = 'Retry attach';
 function isErrorFields(v) {
     return v.__error === true;
 }