@quantiya/codevibe-claude-plugin 2.0.74 → 2.0.76

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -2799,6 +2799,7 @@ var queries = {
         items {
           eventId
           sessionId
+          sessionGenerationId
           type
           source
           content
@@ -2902,14 +2903,6 @@ var queries = {
     }
   `
   ),
-  getGateResolutionV2: (
-    /* GraphQL */
-    `
-    query GetGateResolutionV2($input: GetGateResolutionV2Input!) {
-      getGateResolutionV2(input: $input)
-    }
-  `
-  ),
   getGateResolution: (
     /* GraphQL */
     `
@@ -3253,27 +3246,17 @@ var queries = {
     }
   `
   ),
-  createEventV2: (
-    /* GraphQL */
-    `
-    mutation CreateEventV2($input: CreateEventV2Input!) {
-      createEventV2(input: $input)
-    }
-  `
-  ),
-  recordWorkspaceOutcomeV2: (
+  updateEvent: (
     /* GraphQL */
     `
-    mutation RecordWorkspaceOutcomeV2($input: AWSJSON!) {
-      recordWorkspaceOutcomeV2(input: $input)
-    }
-  `
-  ),
-  updateEventV2: (
-    /* GraphQL */
-    `
-    mutation UpdateEventV2($input: UpdateEventV2Input!) {
-      updateEventV2(input: $input)
+    mutation UpdateEvent($input: UpdateEventInput!) {
+      updateEvent(input: $input) {
+        eventId sessionId sessionGenerationId type source timestamp emittedBy
+        content metadata promptId deliveryStatus deliveredAt executedAt
+        attachments { id type filename s3Key size width height }
+        isEncrypted encryptionVersion writerAuthenticated writerEventNonce
+        writerEventKind writerSessionGenerationId
+      }
     }
   `
   ),
@@ -3317,35 +3300,19 @@ var queries = {
     }
   `
   ),
-  refreshOpenPromptTtlV2: (
-    /* GraphQL */
-    `
-    mutation RefreshOpenPromptTtlV2($promptId: ID!) {
-      refreshOpenPromptTtlV2(promptId: $promptId)
-    }
-  `
-  ),
-  resolveOpenPromptV2: (
+  reportSecurityPosture: (
     /* GraphQL */
     `
-    mutation ResolveOpenPromptV2($input: ResolveOpenPromptV2Input!) {
-      resolveOpenPromptV2(input: $input)
+    mutation ReportSecurityPosture($input: AWSJSON!) {
+      reportSecurityPosture(input: $input)
     }
   `
   ),
-  reportSecurityPostureV2: (
+  confirmSessionRetirement: (
     /* GraphQL */
     `
-    mutation ReportSecurityPostureV2($input: AWSJSON!) {
-      reportSecurityPostureV2(input: $input)
-    }
-  `
-  ),
-  confirmSessionRetirementV2: (
-    /* GraphQL */
-    `
-    mutation ConfirmSessionRetirementV2($input: ConfirmSessionRetirementV2Input!) {
-      confirmSessionRetirementV2(input: $input)
+    mutation ConfirmSessionRetirement($input: ConfirmSessionRetirementInput!) {
+      confirmSessionRetirement(input: $input)
     }
   `
   ),
@@ -3356,6 +3323,7 @@ var queries = {
       updateEventStatus(input: $input) {
         eventId
         sessionId
+        sessionGenerationId
         type
         source
         content
@@ -3369,14 +3337,6 @@ var queries = {
     }
   `
   ),
-  updateEventStatusV2: (
-    /* GraphQL */
-    `
-    mutation UpdateEventStatusV2($input: UpdateEventStatusV2Input!) {
-      updateEventStatusV2(input: $input)
-    }
-  `
-  ),
   registerDeviceKey: (
     /* GraphQL */
     `
@@ -3591,11 +3551,11 @@ var queries = {
     }
   `
   ),
-  submitGateDecisionV2: (
+  submitGateDecision: (
     /* GraphQL */
     `
-    mutation SubmitGateDecisionV2($input: SubmitGateDecisionV2Input!) {
-      submitGateDecisionV2(input: $input) {
+    mutation SubmitGateDecision($input: SubmitGateDecisionInput!) {
+      submitGateDecision(input: $input) {
         decisionAttemptId
         acceptanceStatus
         decisionClaimId
@@ -3610,11 +3570,11 @@ var queries = {
     }
   `
   ),
-  submitGroupDecisionV2: (
+  submitGroupDecision: (
     /* GraphQL */
     `
-    mutation SubmitGroupDecisionV2($input: SubmitGroupDecisionV2Input!) {
-      submitGroupDecisionV2(input: $input) {
+    mutation SubmitGroupDecision($input: SubmitGroupDecisionInput!) {
+      submitGroupDecision(input: $input) {
         decisionAttemptId
         acceptanceStatus
         decisionClaimId
@@ -3707,11 +3667,11 @@ var queries = {
     }
   `
   ),
-  commitGroupDecisionV2: (
+  commitGroupDecision: (
     /* GraphQL */
     `
-    mutation CommitGroupDecisionV2($input: CommitGroupDecisionV2Input!) {
-      commitGroupDecisionV2(input: $input) {
+    mutation CommitGroupDecision($input: CommitGroupDecisionInput!) {
+      commitGroupDecision(input: $input) {
         taskGroupId decisionClaimId commitStatus workflowStatus groupStatus committedAt
       }
     }
@@ -3893,6 +3853,9 @@ var queries = {
       onEventCreated(sessionId: $sessionId) {
         eventId
         sessionId
+        sessionGenerationId
+        syncEventRevision
+        syncImmutableIdentityDigest
         type
         source
         content
@@ -4151,22 +4114,6 @@ function signDesktopSyncInput(action, data, userId, keys, issuedAtEpochMs) {
     desktopProof: Object.freeze({ ...proof, signature })
   });
 }
-function parseSyncEventMutationResponse(value, expected) {
-  let bad3 = () => {
-    throw new SyncEventClientError("INVALID_SYNC_RECEIPT");
-  };
-  if (typeof value == "string") {
-    Buffer.byteLength(value) > 2048 && bad3();
-    try {
-      value = JSON.parse(value);
-    } catch {
-      bad3();
-    }
-  }
-  plain(value) || bad3();
-  let row3 = value, refreshSyncState = own(row3, "refreshSyncState");
-  return refreshSyncState && row3.refreshSyncState !== !0 && bad3(), { receipt: parseSyncEventReceipt(Object.fromEntries(Object.entries(row3).filter(([field2]) => field2 !== "refreshSyncState")), expected), refreshSyncState };
-}
 function parseSyncEventReceipt(value, expected) {
   let bad3 = () => {
     throw new SyncEventClientError("INVALID_SYNC_RECEIPT");
@@ -4213,8 +4160,8 @@ function parseSyncPromptRetentionReceipt(value, promptId2) {
     }
   }
   plain(value) || bad3();
-  let row3 = value, keys = row3.status === "REFRESHED" ? ["expiresAt", "promptId", "status"] : ["promptId", "status"];
-  return (Object.keys(row3).sort().join(",") !== keys.join(",") || row3.promptId !== promptId2 || !ID.test(promptId2) || !["REFRESHED", "RERAISE_REQUIRED"].includes(row3.status) || row3.status === "REFRESHED" && (typeof row3.expiresAt != "number" || !Number.isSafeInteger(row3.expiresAt) || row3.expiresAt <= 0 || row3.expiresAt > 253402300799)) && bad3(), Object.freeze({ ...row3 });
+  let row3 = value, keys = row3.status === "REFRESHED" && own(row3, "expiresAt") ? ["expiresAt", "promptId", "status"] : ["promptId", "status"];
+  return (Object.keys(row3).sort().join(",") !== keys.join(",") || row3.promptId !== promptId2 || !ID.test(promptId2) || !["REFRESHED", "RERAISE_REQUIRED"].includes(row3.status) || row3.status === "REFRESHED" && own(row3, "expiresAt") && (typeof row3.expiresAt != "number" || !Number.isSafeInteger(row3.expiresAt) || row3.expiresAt <= 0 || row3.expiresAt > 253402300799)) && bad3(), Object.freeze({ ...row3 });
 }
 
 // src/appsync/sync-state.ts
@@ -4291,7 +4238,7 @@ function parseCompanionSyncState(value, environment, now = Date.now()) {
       let committed = count(value.usage[`${meter}Committed`]);
       count(value.usage[`${meter}Reserved`]);
       let limit = count(value.usage[`${meter}Limit`]), pausedAtLimit = count(value.usage[`${meter}PauseLimit`]);
-      pausedAtLimit > 0n && gap2 === 0n && invalid2(), value.usage[`${meter}Limit`] !== value.limits[meter] && invalid2(), committed >= limit || pausedAtLimit >= limit ? state = "PAUSED" : committed * 5n >= limit * 4n && state !== "PAUSED" && (state = "WARNING");
+      pausedAtLimit > 0n && gap2 === 0n && invalid2(), value.usage[`${meter}Limit`] !== value.limits[meter] && invalid2(), meter === "syncUnits" && (committed >= limit || pausedAtLimit >= limit) ? state = "PAUSED" : committed * 5n >= limit * 4n && state !== "PAUSED" && (state = "WARNING");
     }
     value.usage.syncState !== state && invalid2();
   } else (value.protocol === "SYNC_V2" && value.mode !== "SHADOW" || value.mode === "ROLLBACK_FREEZE" && value.protocol !== "FROZEN" || value.usage !== null || value.periodId !== null || value.resetAtEpochMs !== null) && invalid2();
@@ -4389,7 +4336,7 @@ function parseWorkspaceOutcomeReceipt(value, expected) {
   }
   return !exact(value, RECEIPT2) || Buffer.byteLength(JSON.stringify(value)) > 2048 || value.schemaVersion !== 1 || value.kind !== "WORKSPACE_OUTCOME" || value.state !== "ACKED" || value.sessionId !== expected.sessionId || value.sessionGenerationId !== expected.writerSessionGenerationId || value.writerEventNonce !== expected.writerAttestation?.writerEventNonce || typeof value.eventId != "string" || !UUID3.test(value.eventId) || typeof value.timestamp != "string" || !Number.isFinite(Date.parse(value.timestamp)) || new Date(value.timestamp).toISOString() !== value.timestamp || !["ADMITTED", "OMITTED_QUOTA", "LEGACY_COMMITTED"].includes(value.syncDisposition) ? bad("INVALID_SYNC_RECEIPT") : Object.freeze({ ...value });
 }
-function legacyWorkspaceOutcomeReceipt(event, expected) {
+function workspaceOutcomeEventReceipt(event, expected) {
   return !event || event.sessionId !== expected.sessionId || event.type !== "NOTIFICATION" || event.source !== "DESKTOP" || event.writerAuthenticated !== !0 || event.writerEventKind !== "WORKSPACE_OUTCOME" || event.writerEventNonce !== expected.writerAttestation?.writerEventNonce || event.writerSessionGenerationId !== expected.writerSessionGenerationId ? bad("INVALID_SYNC_RECEIPT") : parseWorkspaceOutcomeReceipt({
     schemaVersion: 1,
     kind: "WORKSPACE_OUTCOME",
@@ -4399,7 +4346,7 @@ function legacyWorkspaceOutcomeReceipt(event, expected) {
     writerEventNonce: event.writerEventNonce,
     eventId: event.eventId,
     timestamp: event.timestamp,
-    syncDisposition: "LEGACY_COMMITTED"
+    syncDisposition: "ADMITTED"
   }, expected);
 }
 
@@ -7327,6 +7274,7 @@ function createDesktopInbound(options) {
         uncertain: row3.entries.filter((e) => e.state === "UNCERTAIN" && !e.localExecuted).length
       };
     })),
+    retainedCoordinates: () => options.locked(async () => Object.freeze((await read()).entries.map((e) => Object.freeze({ ...e.target })))),
     pendingAcknowledgements: () => options.locked(async () => {
       let row3 = await read();
       return Object.freeze(row3.entries.filter((e) => e.state === "HANDED_OFF" || e.state === "UNCERTAIN").map((e) => Object.freeze({ ...e.target })));
@@ -7555,12 +7503,12 @@ function decodePromptRetention(value) {
   return row3;
 }
 function createPromptRetentionJournal(store) {
-  return Object.freeze({ run: (values, refresh, reRaise, now = Date.now) => {
+  return Object.freeze({ run: (values, refresh, reRaise) => {
     let promptIds = [...new Set(import_zod7.z.array(id4).max(4096).parse(values))].sort();
     return store.runExclusive(async (fence) => {
-      let row3 = await store.read(), live = new Set(promptIds), save = async () => {
+      let row3 = await store.read(), save = async () => {
         await fence(), await store.write(decodePromptRetention(row3)), await fence();
-      }, retained = row3.entries.filter((e) => live.has(e.promptId) || e.status === "RERAISE_REQUIRED");
+      }, retained = row3.entries.filter((e) => e.status === "RERAISE_REQUIRED");
       retained.length !== row3.entries.length && (row3.entries = retained, await save());
       let settle = async (promptId2) => {
         await fence();
@@ -7572,8 +7520,7 @@ function createPromptRetentionJournal(store) {
         row3.entries = row3.entries.filter((e) => e.promptId !== promptId2), await save();
       }, split = row3.cursor === null ? 0 : promptIds.findIndex((promptId2) => promptId2 > row3.cursor), start = split < 0 ? 0 : split, ordered = [...promptIds.slice(start), ...promptIds.slice(0, start)];
       for (let promptId2 of ordered) {
-        let at = time4.parse(now()), prior = row3.entries.find((e) => e.promptId === promptId2);
-        if (prior?.status === "REFRESHED" && at >= prior.checkedAt && at < prior.checkAfter) continue;
+        let prior = row3.entries.find((e) => e.promptId === promptId2);
         if (!prior && row3.entries.length >= 4096) throw Error("SYNC_JOURNAL_FULL");
         if (row3.cursor = promptId2, await save(), prior?.status === "RERAISE_REQUIRED") {
           await settle(promptId2);
@@ -7581,13 +7528,7 @@ function createPromptRetentionJournal(store) {
         }
         await fence();
         let receipt2 = parseSyncPromptRetentionReceipt(await refresh(promptId2), promptId2);
-        await fence();
-        let checkedAt = time4.parse(now()), next = receipt2.status === "RERAISE_REQUIRED" ? { ...receipt2, reRaiseToken: (0, import_node_crypto11.randomUUID)() } : {
-          ...receipt2,
-          checkedAt,
-          checkAfter: Math.max(checkedAt, Math.min(checkedAt + 864e5, receipt2.expiresAt * 1e3 - 864e5))
-        };
-        row3.entries = row3.entries.filter((e) => e.promptId !== promptId2), row3.entries.push(next), await save(), receipt2.status === "RERAISE_REQUIRED" && await settle(promptId2);
+        await fence(), receipt2.status === "RERAISE_REQUIRED" && (row3.entries.push({ ...receipt2, reRaiseToken: (0, import_node_crypto11.randomUUID)() }), await save(), await settle(promptId2));
       }
     });
   }, remove: () => store.runExclusive(async (fence) => {
@@ -7985,7 +7926,7 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
     });
   }
   async shellSources() {
-    return this.withStore(async (key) => {
+    return this.options.assertAccount(), await this.ensureDirectory(), (await this.recordNames(".shell")).length ? this.withStore(async (key) => {
       let result = [];
       for (let name of await this.recordNames(".shell")) {
         let id5 = name.slice(0, -6), row3 = await this.readShellSource(id5, key);
@@ -7998,7 +7939,7 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
         });
       }
       return result.sort((a, b) => a.sourceId.localeCompare(b.sourceId));
-    });
+    }) : (this.options.assertAccount(), []);
   }
   /** One encrypted intent/credential record per original desktop incarnation.
    * This uses the account journal's existing 256-file / 32-MiB total bound. */
@@ -8272,7 +8213,7 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
       if (errorCode(error) !== "ENOENT") throw error;
       return this.options.assertAccount(), [];
     }
-    return this.withStore(async (key) => {
+    return await this.ensureDirectory(), (await this.recordNames(".prompt")).length ? this.withStore(async (key) => {
       let results = [];
       for (let name of await this.recordNames(".prompt")) {
         let id5 = name.slice(0, -7), row3 = await this.readValue(id5, key, ".prompt", (value) => decodePromptPublication(value, invalid7));
@@ -8288,6 +8229,34 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
         });
       }
       return results;
+    }) : (this.options.assertAccount(), []);
+  }
+  /** Metadata-only inventory for preserving pre-consolidation re-raise owners.
+   * These generations identify local receipts, never a cloud API or tier. */
+  async promptRetentionScopes() {
+    this.options.assertAccount();
+    try {
+      await import_node_fs2.promises.lstat(this.directory);
+    } catch (error) {
+      if (errorCode(error) !== "ENOENT") throw error;
+      return this.options.assertAccount(), [];
+    }
+    return this.withStore(async (key) => {
+      let scopes = [];
+      for (let name of await this.recordNames(".retention")) {
+        let id5 = name.slice(0, -10), row3 = await this.readValue(id5, key, ".retention", decodePromptRetention);
+        if (!row3 || row3.operationId !== id5 || id5 !== stableUuid(
+          "codevibe-sync-prompt-retention-v1\0",
+          [row3.sessionId, row3.sessionGenerationId]
+        )) return invalid7();
+        let promptIds = row3.entries.filter((entry5) => entry5.status === "RERAISE_REQUIRED").map((entry5) => entry5.promptId);
+        this.matchesScope(row3) && promptIds.length && scopes.push({
+          sessionId: row3.sessionId,
+          sessionGenerationId: row3.sessionGenerationId,
+          promptIds
+        });
+      }
+      return scopes;
     });
   }
   promptRetention() {
@@ -8428,10 +8397,19 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
       scope,
       locked: (fn) => locked(`inbound-record-${id5}.lockdir`, fn),
       dispatchLocked: (fn) => locked(`inbound-dispatch-${id5}.lockdir`, fn),
-      read: () => this.withStore((key) => this.readValue(id5, key, ".inbox", (value) => {
-        let row3 = decodeDesktopInbound(value);
-        return row3.operationId !== id5 ? invalid7() : (this.requireScope(row3), row3);
-      })),
+      read: async () => {
+        this.options.assertAccount();
+        try {
+          await import_node_fs2.promises.lstat(this.file(id5, ".inbox"));
+        } catch (error) {
+          if (errorCode(error) === "ENOENT") return null;
+          throw error;
+        }
+        return this.withStore((key) => this.readValue(id5, key, ".inbox", (value) => {
+          let row3 = decodeDesktopInbound(value);
+          return row3.operationId !== id5 ? invalid7() : (this.requireScope(row3), row3);
+        }));
+      },
       write: (row3) => this.withStore(async (key) => {
         let sealed = this.seal(row3, key);
         await this.checkCapacity(Buffer.byteLength(sealed), id5 + ".inbox"), await this.write(id5, sealed, ".inbox");
@@ -9077,6 +9055,31 @@ var count3 = import_zod9.z.string().regex(/^(0|[1-9][0-9]{0,18})$/).refine((s) =
   sameScope(value) {
     return value.sessionId === this.scope.sessionId && value.sessionGenerationId === this.scope.sessionGenerationId;
   }
+  /** One finite upgrade recovery pass, not a live delivery transport. Recover
+   * saved coordinates and previously accepted lifecycle inputs whose hints
+   * never reached this host. Ordinary canonical Events have no lifecycle stamp
+   * and are left to AppSync. No socket, history scan, maintenance or timer. */
+  recoverAcceptedInputs(onCoordinate) {
+    return this.starting || this.phase !== "new" ? Promise.reject(failure()) : (this.phase = "ready", this.starting = Promise.resolve().then(async () => {
+      this.fence();
+      let recovery = await this.deps.inbound.recoverable();
+      this.fence();
+      for (let target2 of await this.deps.inbound.pendingAcknowledgements())
+        await this.reconcileAcknowledgement(target2);
+      for (let target2 of recovery.pending)
+        this.fence(), await this.reconcileReceived(await this.deps.reader.recoverCurrent(target2, this.abort.signal), target2);
+      let cursor;
+      do {
+        let page = await this.deps.reader.pendingInputs(cursor, this.abort.signal);
+        this.fence();
+        for (let coordinate2 of page.items)
+          await this.discoverCoordinate(coordinate2, { retainedLifecycleOnly: !0, onCoordinate });
+        cursor = page.nextToken ?? void 0;
+      } while (cursor);
+      let remaining = await this.deps.inbound.recoverable();
+      this.fence(), remaining.uncertain && this.deps.onUncertain?.(remaining.uncertain);
+    }), this.starting);
+  }
   start() {
     if (this.starting) return this.starting;
     if (this.phase !== "new") return Promise.reject(failure());
@@ -9301,11 +9304,15 @@ var count3 = import_zod9.z.string().regex(/^(0|[1-9][0-9]{0,18})$/).refine((s) =
       this.fence(), status.uncertain && this.deps.onUncertain?.(status.uncertain), this.recoveryPages = 0, this.scheduleDiscovery(PING);
     }
   }
-  async discoverCoordinate(coordinate2) {
+  async discoverCoordinate(coordinate2, upgrade) {
     let retained = await this.deps.inbound.pendingAcknowledgements();
     if (this.fence(), retained.some((item2) => item2.eventId === coordinate2.eventId && item2.timestamp === coordinate2.timestamp)) return;
     let event = await this.deps.reader.pendingInput(coordinate2, this.abort.signal);
-    this.fence(), event && (event.deliveryStatus === "EXECUTED" ? await this.deps.inbound.acknowledgeExecuted({ ...event, deliveryStatus: "EXECUTED" }) : await this.deps.inbound.stageDiscovered(event) === "RECEIVED" && await this.deliver(event, { timestamp: event.timestamp, eventRevision: event.syncEventRevision }));
+    if (this.fence(), !event) {
+      if (upgrade) throw new SyncReadClientError("SYNC_READ_UNAVAILABLE", "EVENT_FETCH_UNAVAILABLE");
+      return;
+    }
+    upgrade && (event.syncLifecycleVersion !== 1 || event.syncLegacyProjection === 1) || (upgrade?.onCoordinate?.(coordinate2), event.deliveryStatus === "EXECUTED" ? await this.deps.inbound.acknowledgeExecuted({ ...event, deliveryStatus: "EXECUTED" }) : await this.deps.inbound.stageDiscovered(event) === "RECEIVED" && await this.deliver(event, { timestamp: event.timestamp, eventRevision: event.syncEventRevision }));
   }
   startPings() {
     this.pingTimer = setInterval(() => {
@@ -10968,11 +10975,11 @@ function parseGroupOperationResult(raw, operation) {
 }
 function parseGroupDecisionCommitResult(raw) {
   if (!raw || typeof raw != "object" || Array.isArray(raw))
-    throw new Error("commitGroupDecisionV2: malformed result");
+    throw new Error("commitGroupDecision: malformed result");
   let value = raw;
-  if (typeof value.taskGroupId != "string" || typeof value.decisionClaimId != "string" || !["COMMITTED", "ALREADY_COMMITTED", "PENDING_RECOVERY"].includes(String(value.commitStatus)) || !["COMPLETE", "PENDING_ERROR"].includes(String(value.workflowStatus))) throw new Error("commitGroupDecisionV2: malformed identity or status");
+  if (typeof value.taskGroupId != "string" || typeof value.decisionClaimId != "string" || !["COMMITTED", "ALREADY_COMMITTED", "PENDING_RECOVERY"].includes(String(value.commitStatus)) || !["COMPLETE", "PENDING_ERROR"].includes(String(value.workflowStatus))) throw new Error("commitGroupDecision: malformed identity or status");
   let pending = value.commitStatus === "PENDING_RECOVERY";
-  if (pending !== (value.workflowStatus === "PENDING_ERROR") || pending && (value.groupStatus !== null || value.committedAt !== null) || !pending && (!["COMPLETE", "HALTED"].includes(String(value.groupStatus)) || typeof value.committedAt != "string" || !Number.isFinite(Date.parse(value.committedAt)))) throw new Error("commitGroupDecisionV2: contradictory result state");
+  if (pending !== (value.workflowStatus === "PENDING_ERROR") || pending && (value.groupStatus !== null || value.committedAt !== null) || !pending && (!["COMPLETE", "HALTED"].includes(String(value.groupStatus)) || typeof value.committedAt != "string" || !Number.isFinite(Date.parse(value.committedAt)))) throw new Error("commitGroupDecision: contradictory result state");
   return value;
 }
 function optionalCount(source2, key) {
@@ -11613,14 +11620,11 @@ var AppSyncClient = class _AppSyncClient {
       throw [
         mutations.createEvent,
         mutations.updateEventStatus,
-        mutations.createEventV2,
-        mutations.updateEventV2,
-        mutations.recordWorkspaceOutcomeV2,
-        mutations.reportSecurityPostureV2,
+        mutations.updateEvent,
+        mutations.reportSecurityPosture,
         queries.listEvents,
         queries.listSupervisionEvents,
-        queries.getGateResolution,
-        queries.getGateResolutionV2
+        queries.getGateResolution
       ].includes(query) && syncUserId === this.currentUserId && syncEpoch === this.syncDisplayEpoch && ["UPDATE_REQUIRED", "AUTHORITY_UNAVAILABLE", "SYNC_BLOCKED"].includes(first.errorType ?? "") && this.resetCompanionSyncDisplay(), new AppSyncGraphQLError({
         message: first.message,
         errorType: first.errorType,
@@ -11738,19 +11742,6 @@ var AppSyncClient = class _AppSyncClient {
       throw this.publishCompanionSyncDisplay(userId, null, epoch, sequence), error;
     }
   }
-  /** Reuse only the server-unexpired protocol selection, never its entitlement
-   * or usage as admission authority. Every selected cloud operation still
-   * authorizes itself. Explicit status/quota refreshes remain fresh reads. */
-  async getCompanionSyncRoute(signal) {
-    let userId = this.getCurrentUserId(), epoch = this.syncDisplayEpoch, check = () => {
-      if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), epoch !== this.syncDisplayEpoch) throw new SyncEventClientError("INVALID_SYNC_STATE");
-    };
-    check();
-    let cached = this.companionSyncStatusSnapshot(userId);
-    if (cached) return { protocol: cached.protocol };
-    let state = await this.getCompanionSyncState(signal);
-    return check(), { protocol: state.protocol };
-  }
   /** Subscribe to validated reads already performed by this client. No new
    * request, persistent journal, producer grant or retry is created here. */
   subscribeCompanionSyncState(userId, listener) {
@@ -11800,8 +11791,8 @@ var AppSyncClient = class _AppSyncClient {
     for (let entry5 of this.syncDisplayListeners) this.notifyCompanionSyncDisplay(entry5);
     return state;
   }
-  /** Signed closed safety fact, independent of customer event quota. Only an
-   * affirmative cloud LEGACY selection permits the caller's legacy sink.
+  /** Signed closed safety fact. The cloud owns availability/accounting policy;
+   * no client status read or transport selection precedes this operation.
    * Success confirms canonical persistence, never phone/render delivery. */
   async reportSecurityPostureIfSelected(sessionScope, posture, signal) {
     let scope = {
@@ -11810,11 +11801,7 @@ var AppSyncClient = class _AppSyncClient {
       expectedSessionKeyGen: sessionScope.sessionKeyGen ?? SESSION_KEY_GEN_ABSENT_SENTINEL,
       posture
     }, userId = this.getCurrentUserId();
-    this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal);
-    let state = await this.getCompanionSyncRoute(signal);
-    if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), state.protocol === "LEGACY") return null;
-    if (state.protocol !== "SYNC_V2") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    if (!scope.sessionGenerationId) throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
+    if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), !scope.sessionGenerationId) throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
     let input = makeSyncSecurityPostureInput(userId, { ...scope, sessionGenerationId: scope.sessionGenerationId }), identity = await keychainManager.getDeviceIdentity();
     if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), !identity) throw new SyncEventClientError("SYNC_IDENTITY_UNAVAILABLE");
     if (this.tokens && this.tokens.expiresAt <= Date.now() && await this.refreshTokens(this.tokens, signal), this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), getConfig().environment !== this.environment) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
@@ -11825,22 +11812,20 @@ var AppSyncClient = class _AppSyncClient {
       { privateKeyB64: identity.privateKey, publicKeyB64: identity.publicKey },
       Date.now()
     ), response = await this.graphqlRequest(
-      mutations.reportSecurityPostureV2,
+      mutations.reportSecurityPosture,
       { input: JSON.stringify(signed) },
       !0,
       signal,
       userId,
       8192
     );
-    return this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), parseSyncSecurityPostureReceipt(response?.data?.reportSecurityPostureV2, input);
+    return this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), parseSyncSecurityPostureReceipt(response?.data?.reportSecurityPosture, input);
   }
   /** Explicit bounded read plane. No registration, paging or legacy fallback
    * occurs at construction; lifecycle owners persist and supply credentials. */
   async desktopSyncReadClient(sessionScope, signal) {
     let scope = { ...sessionScope }, userId = this.getCurrentUserId();
     this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal);
-    let state = await this.getCompanionSyncRoute(signal);
-    if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), state.protocol !== "SYNC_V2") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
     let config = getConfig();
     if (config.environment !== this.environment || !config.aws.syncHttpUrl) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
     return new DesktopSyncReadClient({
@@ -11853,15 +11838,8 @@ var AppSyncClient = class _AppSyncClient {
         if (this.assertSyncAccount(userId), !identity) throw new SyncEventClientError("SYNC_IDENTITY_UNAVAILABLE");
         return { privateKeyB64: identity.privateKey, publicKeyB64: identity.publicKey };
       },
-      resolutionQuery: async (input, requestSignal) => {
-        this.assertSyncAccount(userId), this.assertSyncReadAdmission(scope.sessionId);
-        try {
-          let response = await this.graphqlRequest(queries.getGateResolutionV2, { input }, !0, requestSignal, userId, 8192);
-          return this.assertSyncAccount(userId), this.assertSyncReadAdmission(scope.sessionId), _AppSyncClient.throwIfAborted(requestSignal), response?.data?.getGateResolutionV2;
-        } catch (error) {
-          throw this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(requestSignal), error instanceof AppSyncGraphQLError ? syncReadResponseError({ ok: !1, errorCode: error.responseMessage }) : error;
-        }
-      },
+      // Retained Event-coordinate reads only. Product gate recovery uses the
+      // canonical getGateResolution; no removed V2 query is wired here.
       getToken: async (requestSignal) => {
         if (this.assertSyncAccount(userId), this.tokens && this.tokens.expiresAt <= Date.now() && await this.refreshTokens(this.tokens, requestSignal), this.assertSyncAccount(userId), !this.tokens?.accessToken) throw new SyncEventClientError("SYNC_IDENTITY_UNAVAILABLE");
         return this.tokens.accessToken;
@@ -11963,13 +11941,7 @@ var AppSyncClient = class _AppSyncClient {
       },
       send: (action, input, signal) => (this.assertSyncAccount(userId), this.mutateDesktopSyncEvent(action, input, signal)),
       isQuotaDenial: (error) => error instanceof AppSyncGraphQLError && error.errorType === "SYNC_QUOTA_EXHAUSTED",
-      omitNewPayload: async (signal) => {
-        this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal);
-        let observed = this.companionSyncStatusSnapshot(userId), state = observed?.mode === "SHADOW" ? observed : await this.getCompanionSyncState(signal);
-        if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), state.protocol !== "SYNC_V2" && !(state.mode === "SHADOW" && state.protocol === "LEGACY"))
-          throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-        return state.usage?.syncState === "PAUSED";
-      }
+      omitNewPayload: async (signal) => (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), !1)
     });
   }
   /** Closed metered tool producer; native source settlement owns journal acknowledgment. */
@@ -12142,56 +12114,64 @@ var AppSyncClient = class _AppSyncClient {
     } }), this.assertSyncAccount(userId);
   }
   /**
-   * Provider startup uses cloud routing, never a local tier/flag or an error
-   * fallback. A transport is generation-bound for its entire lifetime. Cutover
-   * and rollback must drain/restart the producer; they cannot reinterpret its
-   * sealed source windows as a different protocol.
+   * Both producer formats use the existing createEvent API. Retained signed
+   * sources keep their original generation and bytes; legacy sessions keep
+   * their supported request shape. Neither format selects accounting policy.
    */
   async selectToolActivityTransport(options) {
     let { sessionId, root, legacyTransport } = options;
     if (typeof sessionId != "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(sessionId) || legacyTransport.protocol !== void 0 && legacyTransport.protocol !== "LEGACY")
       throw new SyncEventClientError("INVALID_SYNC_INPUT");
     let selected = await this.selectCompanionSourceTransport({ sessionId, root });
-    return selected.protocol === "LEGACY" ? legacyTransport : this.toolActivitySyncTransport({
+    if (selected.protocol === "LEGACY") return legacyTransport;
+    let signed = this.toolActivitySyncTransport({
       root,
       sessionScope: selected.sessionScope,
       getEncryptionContext: selected.getEncryptionContext
     });
+    return Object.freeze({ ...signed, sendRetainedLegacy: async (id5, envelope) => {
+      if (id5 !== sessionId || envelope.backendSessionId !== sessionId || envelope.syncSessionGenerationId !== void 0)
+        throw new SyncEventClientError("INVALID_SYNC_INPUT");
+      if (await legacyTransport.send(id5, envelope) !== void 0) throw new SyncEventClientError("INVALID_SYNC_RECEIPT");
+    } });
   }
-  /** Shared cloud-selected routing for tools and ordinary native sources. */
+  /** Prepare request format from session identity, never quota/control mode.
+   * SDK tags remain temporarily for existing source owners. They identify
+   * journal formats, not different APIs or accounting policies. */
   async selectCompanionSourceTransport(options) {
     let { sessionId, root } = options;
     if (typeof sessionId != "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(sessionId)) throw new SyncEventClientError("INVALID_SYNC_INPUT");
     let userId = this.getCurrentUserId();
     this.assertSyncAccount(userId);
-    let state = await this.getCompanionSyncRoute();
-    if (this.assertSyncAccount(userId), state.protocol === "FROZEN") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    let existingGeneration = options.existingSessionGenerationId;
-    if (state.protocol === "LEGACY") {
-      if (this.companionSyncStatusSnapshot(userId)?.mode !== "SHADOW") {
-        if (existingGeneration === void 0) return Object.freeze({ protocol: "LEGACY" });
-        throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-      }
-      if (existingGeneration === void 0) {
-        let generations = new Set([...this.syncRegistrations.get(sessionId)?.values() ?? []].filter((row3) => row3.userId === userId && (row3.scope.root ?? null) === (root ?? null)).map((row3) => row3.scope.sessionGenerationId));
-        if (!generations.size) return Object.freeze({ protocol: "LEGACY" });
-        if (generations.size !== 1) throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
-        existingGeneration = [...generations][0];
-      }
-    }
+    let existingGeneration = options.existingSessionGenerationId, generations = new Set([...this.syncRegistrations.get(sessionId)?.values() ?? []].filter((row3) => row3.userId === userId && row3.signedProducer !== !1 && (row3.scope.root ?? null) === (root ?? null)).map((row3) => row3.scope.sessionGenerationId));
+    if (generations.size > 1 || existingGeneration !== void 0 && [...generations].some((value) => value !== existingGeneration))
+      throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
+    existingGeneration ??= [...generations][0];
     let readSession = async () => {
       this.assertSyncAccount(userId);
       let session3 = await this.getSession(sessionId);
-      if (this.assertSyncAccount(userId), !session3 || session3.sessionId !== sessionId || session3.userId !== userId || session3.status !== "ACTIVE" || session3.isEncrypted !== !0 || typeof session3.sessionGenerationId != "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(session3.sessionGenerationId))
+      if (this.assertSyncAccount(userId), !session3 || session3.sessionId !== sessionId || session3.userId !== userId || session3.status !== "ACTIVE" || session3.sessionGenerationId != null && (typeof session3.sessionGenerationId != "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(session3.sessionGenerationId)))
         throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
       return session3;
-    }, session2 = await readSession(), scope = Object.freeze({ sessionId, sessionGenerationId: session2.sessionGenerationId.toLowerCase() });
+    }, session2 = await readSession();
+    if (session2.sessionGenerationId == null || session2.isEncrypted !== !0) {
+      if (existingGeneration !== void 0) throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
+      return Object.freeze({ protocol: "LEGACY" });
+    }
+    let scope = Object.freeze({ sessionId, sessionGenerationId: session2.sessionGenerationId.toLowerCase() });
     if (existingGeneration !== void 0 && existingGeneration !== scope.sessionGenerationId)
       throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
+    if (!await this.canSignDesktopSession(session2, userId)) {
+      if (existingGeneration !== void 0) throw new SyncEventClientError("SYNC_IDENTITY_UNAVAILABLE");
+      return Object.freeze({ protocol: "LEGACY" });
+    }
     let getEncryptionContext = async () => {
       let current = await readSession();
+      if (current.isEncrypted !== !0 || typeof current.sessionGenerationId != "string")
+        throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
       if (current.sessionGenerationId.toLowerCase() !== scope.sessionGenerationId)
         throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
+      if (!await this.canSignDesktopSession(current, userId)) throw new SyncEventClientError("SYNC_IDENTITY_UNAVAILABLE");
       let sessionKeyGen = current.sessionKeyGen ?? null, sessionKey = await keychainManager.getSessionKey(sessionId, current.encryptedKeys ?? [], sessionKeyGen);
       if (this.assertSyncAccount(userId), !sessionKey) throw new SyncEventClientError("SYNC_SESSION_KEY_UNAVAILABLE");
       return { ...scope, sessionKey, sessionKeyGen };
@@ -12225,6 +12205,20 @@ var AppSyncClient = class _AppSyncClient {
       }
     });
   }
+  /** An ordinary subscription/reader is not authority to sign as the creator.
+   * Read the existing identity only; never mint a replacement for this check. */
+  async canSignDesktopSession(session2, userId) {
+    if (session2.writerAttestationEligible !== !0 || !/^[a-f0-9]{64}$/.test(session2.creatorSigningKeySha256 ?? "")) return !1;
+    let identity;
+    try {
+      identity = await keychainManager.getDeviceIdentity();
+    } catch {
+      return this.assertSyncAccount(userId), !1;
+    }
+    if (this.assertSyncAccount(userId), !identity?.privateKey || typeof identity.publicKey != "string") return !1;
+    let raw = Buffer.from(identity.publicKey, "base64");
+    return raw.length === 64 && raw.toString("base64") === identity.publicKey && (0, import_node_crypto17.createHash)("sha256").update(raw).digest("hex") === session2.creatorSigningKeySha256;
+  }
   /** Shared E1 producer adapter. The legacy encryption factory runs only after
    * affirmative cloud LEGACY selection. V2 encrypts inside the durable source
    * factory and never maps a quota omission to a successful cloud publication. */
@@ -12310,14 +12304,14 @@ var AppSyncClient = class _AppSyncClient {
       producerKind: "PLUGIN_APPROVAL",
       ownerToken: input.ownerToken
     });
-    return this.resolvePromptByProtocol(control, () => control, async () => (await this.createEvent({
+    return this.resolveOwnedPrompt(control, () => control, async () => (await this.createEvent({
       sessionId: input.sessionId,
       type: "NOTIFICATION" /* NOTIFICATION */,
       source: "DESKTOP" /* DESKTOP */,
       resolvedPromptId: input.promptId,
       ownerToken: input.ownerToken,
       ...input.resolutionAt !== void 0 && { resolutionAt: input.resolutionAt }
-    }))?.promptId === input.promptId, { root });
+    }))?.promptId === input.promptId, { root }, !0);
   }
   /** Core resolution carries the generation already bound to the session
    * owner. Never fetch a newer Session/key to clear an older offer. */
@@ -12325,15 +12319,15 @@ var AppSyncClient = class _AppSyncClient {
     if (!value || typeof value != "object" || Array.isArray(value) || typeof legacy != "function" || Reflect.ownKeys(value).some((field2) => typeof field2 != "string" || !["sessionId", "promptId", "sessionGenerationId", "sessionKeyGen"].includes(field2)) || Object.values(Object.getOwnPropertyDescriptors(value)).some((d) => !d.enumerable || !("value" in d) || d.value !== void 0 && d.value !== null && typeof d.value != "string"))
       return Promise.reject(new SyncEventClientError("INVALID_SYNC_INPUT"));
     let input = { ...value }, userId = this.getCurrentUserId();
-    return this.resolvePromptByProtocol({ sessionId: input.sessionId, promptId: input.promptId }, () => makeSyncPromptResolutionInput(userId, {
+    return this.resolveOwnedPrompt({ sessionId: input.sessionId, promptId: input.promptId }, () => makeSyncPromptResolutionInput(userId, {
       sessionId: input.sessionId,
       promptId: input.promptId,
       producerKind: "CORE_OFFER",
       sessionGenerationId: input.sessionGenerationId,
       expectedSessionKeyGen: input.sessionKeyGen ?? SESSION_KEY_GEN_ABSENT_SENTINEL
-    }), legacy, options);
+    }), legacy, options, input.sessionGenerationId != null);
   }
-  resolvePromptByProtocol(scope, prepareV2, legacy, options) {
+  resolveOwnedPrompt(scope, prepareControl, legacy, options, hasOriginalProof) {
     let userId = this.getCurrentUserId(), input = { sessionId: scope.sessionId, promptId: scope.promptId };
     if (typeof input.sessionId != "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(input.sessionId) || typeof input.promptId != "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(input.promptId))
       return Promise.reject(new SyncEventClientError("INVALID_SYNC_INPUT"));
@@ -12342,17 +12336,12 @@ var AppSyncClient = class _AppSyncClient {
       check();
       let resolutions = await writer.promptResolutions();
       check();
-      let knownV2 = [...publications, ...resolutions].some((row3) => row3.sessionId === input.sessionId && row3.promptId === input.promptId), durable = (control) => writer.runPromptResolution(control, async (saved, fence) => (await fence(), this.finishPromptResolution(saved, options, fence)));
-      if (knownV2) return durable(prepareV2());
-      let state = await this.getCompanionSyncRoute();
-      if (check(), state.protocol === "LEGACY")
-        return this.resolvePromptPublication(input, async (hasV2Publication) => {
-          if (hasV2Publication || (await writer.promptResolutions()).some((row3) => row3.sessionId === input.sessionId && row3.promptId === input.promptId))
-            throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-          return check(), legacy();
-        }, options);
-      if (state.protocol !== "SYNC_V2") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-      return durable(prepareV2());
+      let knownSigned = [...publications, ...resolutions].some((row3) => row3.sessionId === input.sessionId && row3.promptId === input.promptId), durable = (control) => writer.runPromptResolution(control, async (saved, fence) => (await fence(), this.finishPromptResolution(saved, options, fence)));
+      return knownSigned || hasOriginalProof ? durable(prepareControl()) : this.resolvePromptPublication(input, async (hasV2Publication) => {
+        if (hasV2Publication || (await writer.promptResolutions()).some((row3) => row3.sessionId === input.sessionId && row3.promptId === input.promptId))
+          throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
+        return check(), legacy();
+      }, options);
     })();
     return this.trackSyncClosure(input.sessionId, work.then(() => {
     }, () => {
@@ -12440,8 +12429,8 @@ var AppSyncClient = class _AppSyncClient {
       userId,
       { privateKeyB64: identity.privateKey, publicKeyB64: identity.publicKey },
       Date.now()
-    ), response = await this.graphqlRequest(mutations.confirmSessionRetirementV2, { input: prepared }, !1, signal, userId);
-    return this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), parseSyncSessionRetirementReceipt(response?.data?.confirmSessionRetirementV2, data);
+    ), response = await this.graphqlRequest(mutations.confirmSessionRetirement, { input: prepared }, !1, signal, userId);
+    return this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), parseSyncSessionRetirementReceipt(response?.data?.confirmSessionRetirement, data);
   }
   /** Explicit terminal owner boundary. quiesce must stop AND join native,
    * shell, prompt and source-recovery producers; a daemon handoff is not a
@@ -12557,8 +12546,22 @@ var AppSyncClient = class _AppSyncClient {
         Date.now()
       );
     }
-    let response = await this.graphqlRequest(mutations.resolveOpenPromptV2, { input: prepared }, !1, signal, userId);
-    return this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), parseSyncPromptResolutionReceipt(response?.data?.resolveOpenPromptV2, data);
+    let response = await this.graphqlRequest(mutations.createEvent, { input: {
+      ...prepared,
+      type: "NOTIFICATION",
+      source: "DESKTOP",
+      resolvedPromptId: data.promptId
+    } }, !1, signal, userId);
+    this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal);
+    let ack = response?.data?.createEvent;
+    if (!ack || typeof ack != "object" || Array.isArray(ack) || typeof ack.sessionId != "string" || !/^__blocked__[0-9a-f-]{36}$/.test(ack.sessionId) || ack.type !== "NOTIFICATION" || ack.source !== "DESKTOP" || ack.emittedBy !== "SYSTEM" || ack.promptId !== data.promptId)
+      throw new SyncEventClientError("INVALID_SYNC_RECEIPT");
+    return parseSyncPromptResolutionReceipt({
+      sessionId: data.sessionId,
+      promptId: ack.promptId,
+      state: "RESOLVED",
+      controlClass: "PROMPT_OWNERSHIP"
+    }, data);
   }
   /** Monotonic control transition; safe retry means re-read canonical status,
    * not retrying the provider input or manufacturing a full Event response. */
@@ -12574,52 +12577,71 @@ var AppSyncClient = class _AppSyncClient {
       userId,
       { privateKeyB64: identity.privateKey, publicKeyB64: identity.publicKey },
       Date.now()
-    ), response = await this.graphqlRequest(mutations.updateEventStatusV2, { input: prepared }, !1, signal, userId);
-    return this.assertSyncAccount(userId), parseSyncStatusReceipt(response?.data?.updateEventStatusV2, data);
+    ), response = await this.graphqlRequest(mutations.updateEventStatus, { input: prepared }, !1, signal, userId);
+    this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal);
+    let event = response?.data?.updateEventStatus;
+    if (!event || typeof event != "object" || Array.isArray(event)) throw new SyncEventClientError("INVALID_SYNC_RECEIPT");
+    return parseSyncStatusReceipt({
+      sessionId: event.sessionId,
+      sessionGenerationId: event.sessionGenerationId ?? data.sessionGenerationId,
+      eventId: event.eventId,
+      timestamp: event.timestamp,
+      type: event.type,
+      source: event.source,
+      deliveryStatus: event.deliveryStatus,
+      deliveredAt: event.deliveredAt,
+      ...event.executedAt !== void 0 && event.executedAt !== null && { executedAt: event.executedAt }
+    }, data);
   }
-  /** One budgeted liveness operation, never a legacy fallback. The producer
-   * must persist each receipt/progress before advancing its refresh batch. */
+  /** Compatibility helper over the existing batch API; no expiry is invented. */
   async refreshDesktopSyncPrompt(promptId2, signal) {
     if (_AppSyncClient.throwIfAborted(signal), typeof promptId2 != "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(promptId2))
       throw new SyncEventClientError("INVALID_SYNC_INPUT");
-    let userId = this.getCurrentUserId();
-    this.assertSyncAccount(userId);
-    let response = await this.graphqlRequest(mutations.refreshOpenPromptTtlV2, { promptId: promptId2 }, !1, signal, userId);
-    return this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), parseSyncPromptRetentionReceipt(response?.data?.refreshOpenPromptTtlV2, promptId2);
+    let missing = await this.refreshOpenPromptTtl([promptId2], signal);
+    return parseSyncPromptRetentionReceipt({
+      promptId: promptId2,
+      status: missing.includes(promptId2) ? "RERAISE_REQUIRED" : "REFRESHED"
+    }, promptId2);
   }
-  /** Producer-facing batch: V2 keeps exact per-incarnation progress; the
-   * legacy protocol retains its existing chunked endpoint until cutover. */
+  /** One canonical batch route. Retained generations identify only the local
+   * re-raise journal; they cannot select a cloud API or accounting policy. */
   async refreshSessionOpenPromptTtl(options, reRaise) {
     let { sessionId, root } = options, promptIds = [...options.promptIds];
     if (!promptIds.length) return;
     let userId = this.getCurrentUserId();
     this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId);
-    let selected = await this.selectCompanionSourceTransport({ sessionId, root });
-    if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId), selected.protocol === "LEGACY") {
-      let missing = await this.refreshOpenPromptTtl(promptIds);
-      this.assertSyncAccount(userId);
-      for (let promptId2 of missing) {
-        if (this.assertSyncReadAdmission(sessionId), await reRaise(promptId2) === "RETRY") throw new Error("SYNC_PROMPT_RERAISE_PENDING");
-        this.assertSyncAccount(userId);
-      }
-      return;
-    }
-    this.rememberSyncRegistration({ ...selected.sessionScope, root });
+    let retained = await this.desktopSyncWriter({ root }).promptRetentionScopes(), generations = new Set([...this.syncRegistrations.get(sessionId)?.values() ?? []].filter((row3) => row3.userId === userId && (row3.scope.root ?? null) === (root ?? null)).map((row3) => row3.scope.sessionGenerationId));
+    this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId);
     let check = () => {
       this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId);
-    }, work = selected.writer.promptRetention().run(
-      promptIds,
-      async (promptId2) => {
-        check();
-        let result = await this.refreshDesktopSyncPrompt(promptId2);
-        return check(), result;
-      },
-      async (promptId2, token4) => {
-        check();
-        let result = await reRaise(promptId2, token4);
-        return check(), result;
-      }
-    );
+    }, batch, refresh = async (promptId2) => {
+      check(), batch ??= this.refreshOpenPromptTtl(promptIds).then((missing2) => new Set(missing2));
+      let missing = await batch;
+      return check(), { promptId: promptId2, status: missing.has(promptId2) ? "RERAISE_REQUIRED" : "REFRESHED" };
+    }, raise = async (promptId2, token4) => {
+      check();
+      let result = await reRaise(promptId2, token4);
+      return check(), result;
+    }, work = (async () => {
+      let handled = /* @__PURE__ */ new Set();
+      for (let owner of retained.filter((scope) => scope.sessionId === sessionId)) {
+        let owned = promptIds.filter((id5) => owner.promptIds.includes(id5));
+        if (!owned.length) continue;
+        let sessionScope = { sessionId, sessionGenerationId: owner.sessionGenerationId };
+        await this.desktopSyncWriter({ root, sessionScope }).promptRetention().run(owned, refresh, raise);
+        for (let id5 of owned) handled.add(id5);
+      }
+      let remaining = promptIds.filter((id5) => !handled.has(id5));
+      if (remaining.length)
+        if (generations.size === 1) {
+          let sessionScope = { sessionId, sessionGenerationId: [...generations][0] };
+          await this.desktopSyncWriter({ root, sessionScope }).promptRetention().run(remaining, refresh, raise);
+        } else {
+          let missing = await this.refreshOpenPromptTtl(remaining);
+          check();
+          for (let id5 of missing) if (await raise(id5) === "RETRY") throw new Error("SYNC_PROMPT_RERAISE_PENDING");
+        }
+    })();
     this.trackSyncClosure(sessionId, work.then(() => {
     }, () => {
     })), await work;
@@ -12644,7 +12666,7 @@ var AppSyncClient = class _AppSyncClient {
       userId,
       { privateKeyB64: identity.privateKey, publicKeyB64: identity.publicKey },
       Date.now()
-    ), field2 = action === "CREATE_EVENT" ? "createEventV2" : "updateEventV2", response;
+    ), field2 = action === "CREATE_EVENT" ? "createEvent" : "updateEvent", response;
     try {
       response = await this.graphqlRequest(mutations[field2], { input: prepared }, !1, signal, userId, void 0, check);
     } catch (error) {
@@ -12668,15 +12690,13 @@ var AppSyncClient = class _AppSyncClient {
       throw error;
     }
     this.assertSyncAccount(userId);
-    let result = parseSyncEventMutationResponse(response?.data?.[field2], data);
-    if (result.refreshSyncState) {
-      try {
-        await this.getCompanionSyncState(signal);
-      } catch {
-      }
-      this.assertSyncAccount(userId);
-    }
-    return result.receipt;
+    let value = response?.data?.[field2];
+    if (!value || typeof value != "object" || Array.isArray(value))
+      throw new SyncEventClientError("INVALID_SYNC_RECEIPT");
+    return parseSyncEventReceipt(
+      Object.fromEntries(["eventId", "sessionId", "type", "source", "timestamp", "emittedBy"].map((key) => [key, value[key]])),
+      data
+    );
   }
   /**
    * Create a session
@@ -12802,27 +12822,13 @@ var AppSyncClient = class _AppSyncClient {
   // MARK: - Event Operations
   /** The workspace owner retains its existing durable outbox. Never put a
    * second journal around it, re-encrypt it, or choose the current generation.
-   * Quota omission is a canonical ACK, not a synthetic Event or a retry queue.
+   * Existing createEvent owns cloud policy and returns its authenticated Event.
    */
   async submitWorkspaceOutcome(value, options = {}) {
     let input = snapshotWorkspaceOutcomeInput(value), userId = this.getCurrentUserId();
-    this.assertSyncAccount(userId);
-    let route = await this.getCompanionSyncRoute();
-    if (this.assertSyncAccount(userId), route.protocol === "FROZEN") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    if (route.protocol === "LEGACY") {
-      if (options.requiresV2) throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-      let result = await this.createEvent(input);
-      return this.assertSyncAccount(userId), legacyWorkspaceOutcomeReceipt(result, input);
-    }
-    await options.beforeV2?.(), this.assertSyncAccount(userId);
-    let response = await this.graphqlRequest(
-      mutations.recordWorkspaceOutcomeV2,
-      { input: JSON.stringify(input) },
-      !1,
-      void 0,
-      userId
-    );
-    return this.assertSyncAccount(userId), parseWorkspaceOutcomeReceipt(response?.data?.recordWorkspaceOutcomeV2, input);
+    this.assertSyncAccount(userId), await options.beforeV2?.(), this.assertSyncAccount(userId);
+    let event = await this.createEvent(input);
+    return this.assertSyncAccount(userId), workspaceOutcomeEventReceipt(event, input);
   }
   /**
    * Create an event
@@ -12882,14 +12888,20 @@ var AppSyncClient = class _AppSyncClient {
    * row/Event had already aged out — the caller re-raises those (§6a-4
    * return-driven re-raise). No-ops on an empty list (no network call).
    */
-  async refreshOpenPromptTtl(promptIds) {
-    if (promptIds.length === 0) return [];
-    let MAX_BATCH = 100;
-    if (promptIds.length <= MAX_BATCH)
-      return (await this.graphqlRequest(mutations.refreshOpenPromptTtl, { promptIds })).data?.refreshOpenPromptTtl ?? [];
-    let agedOut = [];
-    for (let i = 0; i < promptIds.length; i += MAX_BATCH) {
-      let chunk = promptIds.slice(i, i + MAX_BATCH), returned = (await this.graphqlRequest(mutations.refreshOpenPromptTtl, { promptIds: chunk })).data?.refreshOpenPromptTtl ?? [];
+  async refreshOpenPromptTtl(promptIds, signal) {
+    let ids = [...new Set(promptIds)];
+    if (ids.length > 4096 || ids.some((id5) => typeof id5 != "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(id5)))
+      throw new SyncEventClientError("INVALID_SYNC_INPUT");
+    if (_AppSyncClient.throwIfAborted(signal), ids.length === 0) return [];
+    let userId = this.getCurrentUserId();
+    this.assertSyncAccount(userId);
+    let MAX_BATCH = 100, agedOut = [];
+    for (let i = 0; i < ids.length; i += MAX_BATCH) {
+      let chunk = ids.slice(i, i + MAX_BATCH), response = await this.graphqlRequest(mutations.refreshOpenPromptTtl, { promptIds: chunk }, !1, signal, userId);
+      this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal);
+      let returned = response.data?.refreshOpenPromptTtl;
+      if (!Array.isArray(returned) || new Set(returned).size !== returned.length || returned.some((id5) => typeof id5 != "string" || !chunk.includes(id5)))
+        throw new SyncEventClientError("INVALID_SYNC_RECEIPT");
       returned.length > 0 && agedOut.push(...returned);
     }
     return agedOut;
@@ -12911,19 +12923,19 @@ var AppSyncClient = class _AppSyncClient {
           source: "MOBILE" /* MOBILE */,
           type: expected.type
         }), this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal));
-    let route = await this.getCompanionSyncRoute(signal);
-    if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), route.protocol === "FROZEN") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    if (requiredSessionGenerationId !== void 0 && route.protocol !== "SYNC_V2") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    if (route.protocol === "LEGACY") {
+    let scopes = [...this.syncRegistrations.get(input.sessionId)?.values() ?? []].filter((row3) => row3.userId === userId);
+    if (requiredSessionGenerationId === void 0 && !scopes.some((row3) => row3.signedProducer !== !1)) {
       let response = await this.graphqlRequest(mutations.updateEventStatus, { input }, !1, signal, userId);
       return this.assertSyncAccount(userId), response.data.updateEventStatus;
     }
     if (input.deliveryStatus !== "DELIVERED" && input.deliveryStatus !== "EXECUTED") throw new SyncEventClientError("INVALID_SYNC_INPUT");
     let session2 = await this.getSession(input.sessionId);
     if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), !session2 || session2.sessionId !== input.sessionId || session2.userId !== userId || session2.status !== "ACTIVE" || typeof session2.sessionGenerationId != "string") throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
-    let scopes = [...this.syncRegistrations.get(input.sessionId)?.values() ?? []].filter((row3) => row3.userId === userId), generation = session2.sessionGenerationId.toLowerCase();
+    let generation = session2.sessionGenerationId.toLowerCase();
     if (requiredSessionGenerationId !== void 0 && generation !== requiredSessionGenerationId) throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
     if (scopes.length && !scopes.some((row3) => row3.scope.sessionGenerationId === generation)) throw new SyncEventClientError("SYNC_SESSION_GENERATION_CHANGED");
+    if (!await this.canSignDesktopSession(session2, userId)) throw new SyncEventClientError("SYNC_IDENTITY_UNAVAILABLE");
+    _AppSyncClient.throwIfAborted(signal);
     let receipt2 = await this.updateDesktopSyncEventStatus({
       ...input,
       clientOperationId: (0, import_uuid5.v4)(),
@@ -12939,13 +12951,16 @@ var AppSyncClient = class _AppSyncClient {
    * List events for a session
    */
   async listEvents(sessionId, source2, limit) {
-    let route = await this.getCompanionSyncRoute();
-    if (route.protocol === "FROZEN") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    if (route.protocol === "SYNC_V2") {
-      if (limit !== void 0 && (!Number.isSafeInteger(limit) || limit < 1 || limit > 100)) throw new SyncEventClientError("INVALID_SYNC_INPUT");
-      return (await this.syncHistoryForSession(sessionId)).items.filter((event) => source2 === void 0 || event.source === source2).slice(0, limit ?? 100);
-    }
-    return (await this.graphqlRequest(queries.listEvents, { sessionId, source: source2, limit })).data.listEvents.items;
+    let userId = this.getCurrentUserId(), epoch = this.syncReadEpoch;
+    this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId);
+    let response = await this.graphqlRequest(queries.listEvents, { sessionId, source: source2, limit }, !1, void 0, userId);
+    if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId), epoch !== this.syncReadEpoch) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
+    let items = response.data?.listEvents?.items;
+    if (!Array.isArray(items)) throw new Error("listEvents returned an invalid page");
+    let expectedGeneration = this.activeSubscriptions.get(sessionId)?.syncSessionGenerationId;
+    if (items.some((item2) => !item2 || item2.sessionId !== sessionId || expectedGeneration && item2.sessionGenerationId != null && item2.sessionGenerationId !== expectedGeneration))
+      throw new SyncReadClientError("INVALID_SYNC_READ_RESPONSE");
+    return items;
   }
   /**
    * Strongly-consistent, paginated supervision history used to close the
@@ -12953,13 +12968,11 @@ var AppSyncClient = class _AppSyncClient {
    * can merge each page through the same strict event classifier as live data.
    */
   async listSupervisionEvents(input) {
-    let route = await this.getCompanionSyncRoute();
-    if (route.protocol === "FROZEN") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    if (route.protocol === "SYNC_V2") {
-      if (input.limit !== void 0 && input.limit !== 100) throw new SyncEventClientError("INVALID_SYNC_INPUT");
-      return this.syncHistoryForSession(input.sessionId, input.sessionGenerationId, input.nextToken);
-    }
-    let page = (await this.graphqlRequest(queries.listSupervisionEvents, input)).data?.listSupervisionEvents;
+    let expected = { ...input }, userId = this.getCurrentUserId(), epoch = this.syncReadEpoch;
+    this.assertSyncAccount(userId), this.assertSyncReadAdmission(expected.sessionId);
+    let response = await this.graphqlRequest(queries.listSupervisionEvents, expected, !1, void 0, userId);
+    if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(expected.sessionId), epoch !== this.syncReadEpoch) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
+    let page = response.data?.listSupervisionEvents;
     if (!page || !Array.isArray(page.items))
       throw new Error("listSupervisionEvents returned an invalid page");
     if (page.nextToken !== void 0 && page.nextToken !== null && typeof page.nextToken != "string")
@@ -13397,18 +13410,18 @@ var AppSyncClient = class _AppSyncClient {
    * result is deliberately not subscribed: it fences the submitting client but
    * never stands in for the durable GATE_RESOLUTION Event.
    */
-  async submitGateDecisionV2(request3, canonicalRequestHash) {
-    let { promptKind: _promptKind, ...semanticInput } = request3, response = await this.graphqlRequest(mutations.submitGateDecisionV2, {
+  async submitGateDecision(request3, canonicalRequestHash) {
+    let { promptKind: _promptKind, ...semanticInput } = request3, response = await this.graphqlRequest(mutations.submitGateDecision, {
       input: { ...semanticInput, canonicalRequestHash }
     });
-    return parseDecisionSubmissionResult(response.data?.submitGateDecisionV2);
+    return parseDecisionSubmissionResult(response.data?.submitGateDecision);
   }
   /** P16/P20 TaskGroup-native decision admission (CLAIM, not workflow COMMIT). */
-  async submitGroupDecisionV2(request3, canonicalRequestHash) {
-    let { promptKind: _promptKind, ...semanticInput } = request3, response = await this.graphqlRequest(mutations.submitGroupDecisionV2, {
+  async submitGroupDecision(request3, canonicalRequestHash) {
+    let { promptKind: _promptKind, ...semanticInput } = request3, response = await this.graphqlRequest(mutations.submitGroupDecision, {
       input: { ...semanticInput, canonicalRequestHash }
     });
-    return parseDecisionSubmissionResult(response.data?.submitGroupDecisionV2);
+    return parseDecisionSubmissionResult(response.data?.submitGroupDecision);
   }
   async authorizeGroupTerminalOperation(input) {
     let response = await this.graphqlRequest(mutations.authorizeGroupTerminalOperation, { input });
@@ -13434,46 +13447,29 @@ var AppSyncClient = class _AppSyncClient {
     let response = await this.graphqlRequest(mutations.prepareGroupKeep, { input });
     return parseGroupOperationResult(response.data?.prepareGroupKeep, "prepareGroupKeep");
   }
-  async commitGroupDecisionV2(input) {
-    let response = await this.graphqlRequest(mutations.commitGroupDecisionV2, { input });
-    return parseGroupDecisionCommitResult(response.data?.commitGroupDecisionV2);
+  async commitGroupDecision(input) {
+    let response = await this.graphqlRequest(mutations.commitGroupDecision, { input });
+    return parseGroupDecisionCommitResult(response.data?.commitGroupDecision);
   }
   /** Owner-scoped recovery point-read for a locally durable attempt receipt. */
   async getDecisionAttempt(input) {
     let response = await this.graphqlRequest(queries.getDecisionAttempt, { input });
     return parseDecisionAttemptResult(response.data?.getDecisionAttempt);
   }
-  /** Cloud-selected recovery protocol. V2 requires the session owner's known
-   * generation and never falls back to a live Session lookup or legacy Event. */
+  /** One canonical recovery API. The cloud verifies owner/history authority
+   * and, when supplied, the exact generation. No accounting-route/status read
+   * or second delivery transport may block decision recovery. */
   async getGateResolution(input) {
     let expected = { ...input }, userId = this.getCurrentUserId(), epoch = this.syncReadEpoch;
-    this.assertSyncAccount(userId), this.assertSyncReadAdmission(expected.sessionId);
-    let route = await this.getCompanionSyncRoute();
+    this.assertSyncAccount(userId), this.assertSyncReadAdmission(expected.sessionId), expected.sessionGenerationId !== void 0 && validateSyncResolutionScope(
+      { ...expected, sessionGenerationId: expected.sessionGenerationId },
+      () => {
+        throw new SyncReadClientError("INVALID_SYNC_READ_INPUT");
+      }
+    );
+    let response = await this.graphqlRequest(queries.getGateResolution, { input: expected }, !1, void 0, userId);
     if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(expected.sessionId), epoch !== this.syncReadEpoch) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
-    if (route.protocol === "LEGACY") {
-      let response = await this.graphqlRequest(
-        queries.getGateResolution,
-        { input: { sessionId: expected.sessionId, promptId: expected.promptId } },
-        !1,
-        void 0,
-        userId
-      );
-      if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(expected.sessionId), epoch !== this.syncReadEpoch) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
-      return response.data?.getGateResolution;
-    }
-    if (route.protocol !== "SYNC_V2") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-    if (!expected.sessionGenerationId) throw new SyncReadClientError("INVALID_SYNC_READ_INPUT");
-    validateSyncResolutionScope({ ...expected, sessionGenerationId: expected.sessionGenerationId }, () => {
-      throw new SyncReadClientError("INVALID_SYNC_READ_INPUT");
-    });
-    let reader = await this.desktopSyncReadSession({ sessionId: expected.sessionId, sessionGenerationId: expected.sessionGenerationId });
-    try {
-      let result = await reader.gateResolution(expected.promptId);
-      if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(expected.sessionId), epoch !== this.syncReadEpoch) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
-      return result;
-    } finally {
-      await reader.close();
-    }
+    return response.data?.getGateResolution;
   }
   async applyUserDecision(input, sessionKeyBase64) {
     let encryptedNotes = null;
@@ -14378,12 +14374,12 @@ var AppSyncClient = class _AppSyncClient {
   assertSyncReadAdmission(sessionId) {
     if (this.syncRetiringSessions.has(sessionId)) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
   }
-  rememberSyncRegistration(scope) {
-    let userId = this.getCurrentUserId(), rows = this.syncRegistrations.get(scope.sessionId) ?? /* @__PURE__ */ new Map();
-    rows.set(JSON.stringify([userId, scope.sessionGenerationId, scope.root ?? null]), { userId, scope: { ...scope } }), this.syncRegistrations.set(scope.sessionId, rows);
+  rememberSyncRegistration(scope, signedProducer = !0) {
+    let userId = this.getCurrentUserId(), rows = this.syncRegistrations.get(scope.sessionId) ?? /* @__PURE__ */ new Map(), key = JSON.stringify([userId, scope.sessionGenerationId, scope.root ?? null]);
+    rows.set(key, { userId, scope: { ...scope }, signedProducer: signedProducer || rows.get(key)?.signedProducer === !0 }), this.syncRegistrations.set(scope.sessionId, rows);
   }
   ownSyncReader(scope, reader) {
-    this.rememberSyncRegistration(scope);
+    this.rememberSyncRegistration(scope, !1);
     let owners = this.syncReadOwners.get(scope.sessionId) ?? /* @__PURE__ */ new Set();
     this.syncReadOwners.set(scope.sessionId, owners);
     let closing, owner = Object.freeze({ ...reader, close: () => closing || (closing = reader.close().finally(() => {
@@ -14402,20 +14398,6 @@ var AppSyncClient = class _AppSyncClient {
     let pending = this.syncSubscriptionClosures.get(sessionId);
     pending && await Promise.all([...pending]);
   }
-  async syncHistoryForSession(sessionId, sessionGenerationId, nextToken) {
-    this.assertSyncReadAdmission(sessionId);
-    let userId = this.getCurrentUserId(), session2 = await this.getSession(sessionId);
-    if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId), session2?.sessionId !== sessionId || !session2.sessionGenerationId || session2.userId !== userId || sessionGenerationId !== void 0 && sessionGenerationId !== session2.sessionGenerationId)
-      throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
-    let scope = { sessionId, sessionGenerationId: session2.sessionGenerationId }, state = this.activeSubscriptions.get(sessionId), live = !state?.destroyed && state?.syncSessionGenerationId === scope.sessionGenerationId ? state.syncConnection : void 0, reader = live ?? await this.desktopSyncReadSession(scope);
-    try {
-      let page = await reader.history(nextToken);
-      if (this.assertSyncAccount(userId), this.assertSyncReadAdmission(sessionId), page.sessionId !== scope.sessionId || page.sessionGenerationId !== scope.sessionGenerationId) throw new SyncReadClientError("INVALID_SYNC_READ_RESPONSE");
-      return { items: page.items.map((event) => this.syncEventForConsumer(event)), nextToken: page.nextToken };
-    } finally {
-      live || await reader.close();
-    }
-  }
   /**
    * Subscribe to events for a session
    */
@@ -14480,41 +14462,49 @@ var AppSyncClient = class _AppSyncClient {
   createSubscription(state) {
     let abort = state.setupAbort = new AbortController(), current = () => !state.destroyed && !abort.signal.aborted && this.activeSubscriptions.get(state.sessionId) === state, setup = (async () => {
       if (await this.joinSyncSubscriptionClosures(state.sessionId), !current()) return;
-      let userId = this.getCurrentUserId(), route = await this.getCompanionSyncRoute(abort.signal);
-      if (!current()) return;
-      if (this.assertSyncAccount(userId), route.protocol === "FROZEN") throw new SyncEventClientError("SYNC_PRODUCER_FROZEN");
-      if (route.protocol === "LEGACY") {
-        this.createLegacySubscription(state);
-        return;
-      }
+      let userId = this.getCurrentUserId();
+      this.assertSyncAccount(userId);
       let session2 = await this.getSession(state.sessionId);
       if (!current()) return;
-      if (this.assertSyncAccount(userId), !session2?.sessionGenerationId || session2.userId !== userId || !["ACTIVE" /* ACTIVE */, "PAUSED" /* PAUSED */].includes(session2.status)) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
-      let generation = session2.sessionGenerationId, connection = await this.desktopSyncLiveSession(
-        {
-          sessionId: state.sessionId,
-          sessionGenerationId: generation,
-          revalidateRegistration: state.syncRegistrationRevalidationGeneration === generation,
-          onRegistrationRevalidated: () => {
-            current() && (state.syncRegistrationRevalidatedGeneration = generation, delete state.syncRegistrationRevalidationGeneration);
+      if (this.assertSyncAccount(userId), !session2 || session2.userId !== userId || !["ACTIVE" /* ACTIVE */, "PAUSED" /* PAUSED */].includes(session2.status))
+        throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
+      let retainedIds = /* @__PURE__ */ new Set();
+      state.mobileInputRecoveryHeld = !1, session2.sessionGenerationId && (state.compatibilityInboundIds = retainedIds, state.syncSessionGenerationId = session2.sessionGenerationId), this.createLegacySubscription(state), !(!session2.sessionGenerationId || !current()) && (async () => {
+        try {
+          let scope = { sessionId: state.sessionId, sessionGenerationId: session2.sessionGenerationId }, coordinates = await this.desktopSyncWriter({ sessionScope: scope }).inbound().retainedCoordinates();
+          if (!current()) return;
+          this.assertSyncAccount(userId);
+          for (let target2 of coordinates) retainedIds.add(target2.eventId);
+          state.mobileInputRecoveryHeld = !1;
+        } catch {
+          current() && (state.mobileInputRecoveryHeld = !0, logger.warn("[AppSyncClient] Mobile inputs held: retained journal requires recovery; desktop connection remains available", { sessionId: state.sessionId }), state.onError?.(new SyncEventClientError("SYNC_INBOUND_RECOVERY_REQUIRED")));
+          return;
+        }
+        let connection = await this.desktopSyncLiveSession(
+          {
+            sessionId: state.sessionId,
+            sessionGenerationId: session2.sessionGenerationId
           },
-          onUpgradeRejected: () => {
-            current() && state.syncRegistrationRevalidatedGeneration !== generation && (state.syncRegistrationRevalidationGeneration = generation);
-          }
-        },
-        (event) => {
-          if (current() && shouldDeliverSubscribedEvent(event, !!state.receiveDesktopEvents)) return state.onEvent(event);
-        },
-        (error) => {
-          current() && this.handleSubscriptionError(state, error);
-        },
-        abort.signal
-      );
-      if (!current()) {
-        await connection.close();
-        return;
-      }
-      state.syncConnection = connection, state.syncSessionGenerationId = session2.sessionGenerationId, this.rememberSyncRegistration({ sessionId: state.sessionId, sessionGenerationId: session2.sessionGenerationId }), await connection.start(), current() && (state.syncRegistrationRevalidationGeneration === generation && delete state.syncRegistrationRevalidationGeneration, state.syncRegistrationRevalidatedGeneration === generation && delete state.syncRegistrationRevalidatedGeneration, this.handleSubscriptionStartAck(state));
+          (event) => {
+            if (current() && shouldDeliverSubscribedEvent(event, !!state.receiveDesktopEvents)) return state.onEvent(event);
+          },
+          () => {
+          },
+          abort.signal
+        );
+        if (!current()) {
+          await connection.close();
+          return;
+        }
+        state.syncConnection = connection;
+        try {
+          await connection.recoverAcceptedInputs((coordinate2) => retainedIds.add(coordinate2.eventId));
+        } finally {
+          await connection.close();
+        }
+      })().catch(() => {
+        current() && (logger.warn("[AppSyncClient] Retained mobile input recovery incomplete; original journal preserved", { sessionId: state.sessionId }), state.onError?.(new SyncEventClientError("SYNC_INPUT_RECOVERY_INCOMPLETE")));
+      });
     })().catch((error) => {
       current() && this.handleSubscriptionError(state, error instanceof Error ? error : new Error("Sync connection failed"));
     });
@@ -14530,7 +14520,9 @@ var AppSyncClient = class _AppSyncClient {
       receiveDesktopEvents
     } = state;
     try {
-      let wsUrl = this.buildRealtimeUrl(), ws = new import_ws2.default(wsUrl, ["graphql-ws"]), pendingAcks = /* @__PURE__ */ new Set([
+      let wsUrl = this.buildRealtimeUrl(), owner = this.getCurrentUserId();
+      this.assertSyncAccount(owner);
+      let ws = new import_ws2.default(wsUrl, ["graphql-ws"]), pendingAcks = /* @__PURE__ */ new Set([
         subscriptionId,
         ...state.supervisionSubscriptionId ? [state.supervisionSubscriptionId] : []
       ]);
@@ -14538,6 +14530,8 @@ var AppSyncClient = class _AppSyncClient {
         logger.info("[AppSyncClient] WebSocket connected", { sessionId }), ws.send(JSON.stringify({ type: "connection_init" }));
       }), ws.on("message", (data) => {
         try {
+          if (state.destroyed || this.activeSubscriptions.get(sessionId) !== state || state.ws !== ws) return;
+          this.assertSyncAccount(owner);
           let message = JSON.parse(data.toString());
           switch (message.type) {
             case "connection_ack":
@@ -14553,8 +14547,8 @@ var AppSyncClient = class _AppSyncClient {
                 supervisionEvent?.sessionId === sessionId && state.onSupervisionEvent?.(supervisionEvent);
                 break;
               }
-              let event = message.payload?.data?.onEventCreated;
-              event && shouldDeliverSubscribedEvent(event, !!receiveDesktopEvents) && onEvent(event);
+              let event = message.payload?.data?.onEventCreated, retainedInput = event?.source === "MOBILE" /* MOBILE */ && ["USER_PROMPT" /* USER_PROMPT */, "PROMPT_RESPONSE" /* PROMPT_RESPONSE */].includes(event.type) && (event.syncEventRevision != null || event.syncImmutableIdentityDigest != null);
+              event && event.sessionId === sessionId && (event.sessionGenerationId == null || state.syncSessionGenerationId == null || event.sessionGenerationId === state.syncSessionGenerationId) && !(state.mobileInputRecoveryHeld && event.source === "MOBILE" /* MOBILE */ && ["USER_PROMPT" /* USER_PROMPT */, "PROMPT_RESPONSE" /* PROMPT_RESPONSE */].includes(event.type)) && !retainedInput && !state.compatibilityInboundIds?.has(event.eventId) && shouldDeliverSubscribedEvent(event, !!receiveDesktopEvents) && onEvent(event);
               break;
             case "ka":
               this.resetKeepAliveTimer(state);
@@ -58924,6 +58918,11 @@ function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDir
     '(deny mach-lookup (global-name "com.apple.SecurityServer"))',
     '(deny mach-lookup (global-name "com.apple.securityd"))',
     '(deny mach-lookup (global-name "com.apple.securityd.xpc"))',
+    // POSIX shared memory: grant read-data on CoreFoundation preferences shared
+    // memory published by cfprefsd (apple.cfprefs.<uid>v1, apple.cfprefs.daemonv1).
+    // Without this, CFPreferencesAppSynchronize fails with EPERM, breaking native
+    // macOS agents like Codex CLI during configuration/preference synchronization.
+    '(allow ipc-posix-shm-read-data (ipc-posix-name-prefix "apple.cfprefs."))',
     // The ANCESTOR DIR ENTRIES of the workdir — each as a `(literal ...)` read,
     // NOT a subpath (Stage-2 HIGH — the `/private/tmp` narrowing). When node runs
     // `node <workdir>/script.js`, `Module._findPath` → `realpathSync` `lstat`s
@@ -69407,8 +69406,8 @@ async function submitGateDecision(deps, promptEntryId, payload) {
     );
     return;
   }
-  let submitV2 = client.submitGateDecisionV2;
-  if (!submitV2) {
+  let submitDurable = client.submitGateDecision;
+  if (!submitDurable) {
     dispatchVisibleSubmitFailure(
       store,
       promptEntryId,
@@ -69457,9 +69456,9 @@ async function submitGateDecision(deps, promptEntryId, payload) {
       canonicalRequestHash: receipt2.canonicalRequestHash,
       decisionClaimId: null
     });
-    let result = await submitV2.call(client, request3, receipt2.canonicalRequestHash);
+    let result = await submitDurable.call(client, request3, receipt2.canonicalRequestHash);
     if (result.decisionAttemptId !== decisionAttemptId || result.promptId !== payload.gateId)
-      throw new Error("submitGateDecisionV2 returned a mismatched attempt or prompt identity");
+      throw new Error("submitGateDecision returned a mismatched attempt or prompt identity");
     if (result.acceptanceStatus === "REJECTED") {
       let terminal = await receiptStore.markTerminal(receipt2, {
         state: "REJECTED",
@@ -69702,8 +69701,8 @@ async function submitGroupGateDecision(deps, entry5, optionId, notes) {
     return;
   }
   if (groupEscalation.protocolVersion === 2) {
-    let submitV2 = deps.appsyncClient.submitGroupDecisionV2;
-    if (!submitV2 || groupEscalation.groupGeneration === void 0) {
+    let submitDurable = deps.appsyncClient.submitGroupDecision;
+    if (!submitDurable || groupEscalation.groupGeneration === void 0) {
       dispatchVisibleSubmitFailure(
         store,
         entry5.id,
@@ -69753,13 +69752,13 @@ async function submitGroupGateDecision(deps, entry5, optionId, notes) {
         canonicalRequestHash: receipt2.canonicalRequestHash,
         decisionClaimId: null
       });
-      let result2 = await submitV2.call(
+      let result2 = await submitDurable.call(
         deps.appsyncClient,
         request3,
         receipt2.canonicalRequestHash
       );
       if (result2.decisionAttemptId !== decisionAttemptId || result2.promptId !== request3.promptId)
-        throw new Error("submitGroupDecisionV2 returned a mismatched attempt or prompt identity");
+        throw new Error("submitGroupDecision returned a mismatched attempt or prompt identity");
       if (result2.acceptanceStatus === "REJECTED") {
         let terminal = await receiptStore.markTerminal(receipt2, {
           state: "REJECTED",
@@ -74407,7 +74406,7 @@ function createDurableResolutionAttemptHandoff(args) {
   }, handoff;
 }
 async function retryExactSubmission(client, receipt2) {
-  let result = receipt2.request.promptKind === "GATE" ? await client.submitGateDecisionV2?.(receipt2.request, receipt2.canonicalRequestHash) : await client.submitGroupDecisionV2?.(receipt2.request, receipt2.canonicalRequestHash);
+  let result = receipt2.request.promptKind === "GATE" ? await client.submitGateDecision?.(receipt2.request, receipt2.canonicalRequestHash) : await client.submitGroupDecision?.(receipt2.request, receipt2.canonicalRequestHash);
   if (!result) throw new Error(`No ${receipt2.request.promptKind} v2 recovery transport configured`);
   if (result.decisionAttemptId !== receipt2.request.decisionAttemptId || result.promptId !== promptId(receipt2)) throw new Error("Decision-attempt retry returned mismatched identity");
 }
@@ -78929,6 +78928,14 @@ async function runOrchestrationShell(args) {
       // an event actually arrives (async) — never during this synchronous setup.
       subscribedEventDispatcher,
       (err) => {
+        if (err instanceof SyncEventClientError && (err.code === "SYNC_INBOUND_RECOVERY_REQUIRED" || err.code === "SYNC_INPUT_RECOVERY_INCOMPLETE")) {
+          logger.warn("[orchestration-shell] mobile input recovery notice; connection remains available", { code: err.code }), store.dispatch({
+            type: "SHELL_ADVISORY",
+            source: "shell",
+            text: err.code === "SYNC_INBOUND_RECOVERY_REQUIRED" ? "Mobile input is paused for this session because its recovery journal could not be read. Desktop remains available. Messages sent during this pause are not automatically delivered later; recovery or explicit disposition is required." : "Previously accepted mobile input recovery is incomplete. Desktop and ordinary live events remain available. Retained inputs were preserved and uncertain inputs were not replayed."
+          });
+          return;
+        }
         initialSubscriptionSettled || logStartupFailure("subscription", err), initialCatchUpStarted && rejectInitialSubscription(err), logger.warn("[orchestration-shell] subscribeToEvents error", {
           error: err.message
         });
@@ -79666,7 +79673,7 @@ async function runOrchestrationShell(args) {
           if (prepared.callStatus === "REJECTED" || prepared.authorizationState !== "READY_TO_COMMIT" || prepared.operationReceiptHash !== receiptHash2) throw new Error(`TaskGroup keep preparation failed (${prepared.rejectionCode ?? prepared.callStatus})`);
           if (await workspaceTerminalCoordinator.prepareGroupOutcome(taskGroupId, "kept", {
             filesRetained
-          }), (await args.appsyncClient.commitGroupDecisionV2({
+          }), (await args.appsyncClient.commitGroupDecision({
             sessionId: resolution.sessionId,
             taskGroupId,
             decisionClaimId: resolution.decisionClaimId,
@@ -79712,7 +79719,7 @@ async function runOrchestrationShell(args) {
           taskGroupId,
           filesConflicted > 0 ? "partially_reverted" : "reverted",
           { filesReverted, filesConflicted }
-        ), (await args.appsyncClient.commitGroupDecisionV2({
+        ), (await args.appsyncClient.commitGroupDecision({
           sessionId: resolution.sessionId,
           taskGroupId,
           decisionClaimId: resolution.decisionClaimId,