agents-can-communicate 0.7.1 → 0.8.1

package/README.md

@@ -98,7 +98,9 @@ provide messages at the next normal turn; other sessions read their ACC inbox ex
 
 Experimental live delivery can wake eligible Claude Code and Codex sessions on Apple Silicon
 macOS. It requires opt-in and an active verified connection, is off by default, and can spend
-model tokens. Messages for busy sessions queue until the current turn ends.
+model tokens. Claude Code sessions wake through the inbox that Claude Code itself opens, so
+you start Claude Code with your ordinary command. A busy Claude Code session gets the message
+between two tool calls. A busy Codex session gets it when the current turn ends.
 
 See [client capabilities](docs/CAPABILITIES.md) for exact support. Run `acc doctor` from your
 project if a peer is missing or delivery differs from what you expect; see

package/bin/entrypoints/acc-bootstrap.mjs

@@ -1,51 +1,9 @@
 #!/usr/bin/env node
-// Internal entry point behind an ACC-owned shell shim: is this exact vendor
-// executable eligible for native delivery right now? Exit 0 means yes and the
-// shim exports its owned policy before `exec`; any other exit - including a
-// crash, a missing adapter, or a damaged install - means the shim launches the
-// vendor command untouched. Nothing is ever written to stdout, and stderr stays
-// empty unless ACC_BOOTSTRAP_DEBUG=1 asks for one safe line.
-import { checkNativeBootstrap } from "@agents-can-communicate/installer";
-
-import { createAntigravityAdapter } from "@agents-can-communicate/adapter-antigravity";
-import { createClaudeCodeAdapter } from "@agents-can-communicate/adapter-claude-code";
-import { createCodexAdapter } from "@agents-can-communicate/adapter-codex";
-import { createGeminiCliAdapter } from "@agents-can-communicate/adapter-gemini-cli";
-import { createGrokAdapter } from "@agents-can-communicate/adapter-grok";
-import { createKimiAdapter } from "@agents-can-communicate/adapter-kimi";
-
-import { parseBootstrapOptions } from "@agents-can-communicate/cli/managed-entry";
-
-function debug(line) {
-  if (process.env.ACC_BOOTSTRAP_DEBUG === "1") process.stderr.write(`acc-bootstrap: ${line}\n`);
-}
-
+// Kept only for installs made by ACC 0.7.x or earlier. A 0.7.x updater refuses a
+// downloaded package without this file, and a `claude` shell shim written by
+// 0.7.x still runs it through its launcher until `acc install` or `acc update`
+// retires the shim. A shim reads any exit other than 0 as "launch the vendor
+// command untouched", so this answers 1 and writes nothing.
 export async function main() {
-try {
-  const options = parseBootstrapOptions(process.argv.slice(2));
-  if (options === null) {
-    debug("usage: --adapter <id> --real-executable <path> --data-home <path>");
-    process.exit(2);
-  }
-  const registry = {
-    claude_code: createClaudeCodeAdapter, codex: createCodexAdapter,
-    gemini_cli: createGeminiCliAdapter, grok: createGrokAdapter, kimi: createKimiAdapter,
-    // No native delivery contract: this reports the client unsupported rather
-    // than unknown, which is a different and more useful thing to read.
-    antigravity: createAntigravityAdapter,
-  };
-  const adapter = registry[options.adapter]?.();
-  if (adapter === undefined) {
-    debug(`${options.adapter}: unknown adapter`);
-    process.exit(1);
-  }
-  const result = await checkNativeBootstrap({ adapter, realExecutable: options.realExecutable,
-    platform: `${process.platform}-${process.arch}`, dataHome: options.dataHome, timeoutMs: 750 });
-  debug(`${options.adapter}: ${result.supported ? "supported" : result.reasonCode}`);
-  process.exit(result.supported ? 0 : 1);
-} catch (error) {
-  debug(`failed: ${String(error?.code ?? error?.name ?? "error")}`);
-  process.exit(1);
-}
-
+  process.exitCode = 1;
 }

package/bin/entrypoints/acc-claude-channel.mjs

@@ -1,166 +1,56 @@
 #!/usr/bin/env node
-// The ACC Channel binary Claude Code spawns as a stdio MCP child. It composes
-// the same workspace discovery, session binding, core service, and local
-// data-home rules as acc-hook, opens a session-scoped endpoint for the delivery
-// router, and turns the model's explicit acc_reply / acc_ack into real ACC
-// records. It never collects a transcript or runs a model, and it fails open:
-// any composition error leaves Claude a plain MCP server that simply offers no
-// tools rather than crashing the session.
-import { randomBytes } from "node:crypto";
-
-import { createClaudeCodeAdapter } from "@agents-can-communicate/adapter-claude-code";
-import { listSessionBindings } from "@agents-can-communicate/adapter-sdk";
-import { createCoordinationService } from "@agents-can-communicate/core";
-import { createDeliveryRouter } from "@agents-can-communicate/delivery-router";
-import { readInstalledLivePolicy } from "@agents-can-communicate/installer";
-import { recordAndOffer } from "@agents-can-communicate/mcp-server";
-import { resolveClientPid } from "@agents-can-communicate/hook-runner/client-pid";
-import { readProcessTable } from "@agents-can-communicate/hook-runner/process-table";
-import { createId } from "@agents-can-communicate/protocol";
-import { openFilesystemStore } from "@agents-can-communicate/storage-filesystem";
-import { ALL_ADAPTERS, createGitProbe, discoverWorkspace, platformDataHome, runtimePaths }
-  from "@agents-can-communicate/cli";
-
-import { createAccChannel, endpointDir, routeAck, routeReply }
-  from "@agents-can-communicate/adapter-claude-code/channel";
-
-import { pump, startInertChannel } from "./claude-channel-stdio.mjs";
-import { activateClaudeChannel } from "./claude-channel-binding.mjs";
-
-const clock = { now: () => new Date().toISOString() };
-const ids = { next: kind => createId(kind, randomBytes) };
-
-/**
- * The ACC session this Claude process opened - decided by which client process
- * this Channel is running under, never by how many sessions happen to be
- * visible.
- *
- * There used to be a fallback here: if exactly one session was live, it was
- * taken to be this one. On a single-session machine that looked safe, and with
- * two sessions it silently handed one client the other's identity. The Channel
- * starts while its own SessionStart hook is still writing its binding, so the
- * only binding a second client can see at that moment is the *first* client's -
- * and the wait that was added to survive that race then locks the wrong answer
- * in on the first attempt, because it is a complete, live, plausible binding.
- *
- * Measured on two real 2.1.259 sessions: both Channels registered an endpoint
- * under the first client's pid. `bindNativeSession` refuses two registrations
- * for one pid, so the session that had been receiving live messages dropped
- * back to the durable inbox - and an `acc_reply` from the second window would
- * have been recorded as the first session's answer, which is a false record
- * rather than a lost message.
- *
- * This process was spawned by its client, so its own ancestry names that
- * client, and no race can change that. Ownership is decided by it.
- */
-export async function resolveSession({ runtimeDir, service, env, ownClientPid,
-  listBindings = listSessionBindings }) {
-  if (!Number.isInteger(ownClientPid)) return null;
-  const bindings = await listBindings({ runtimeDir });
-  if (bindings.length === 0) return null;
-  const status = await service.collectStatus({});
-  const live = new Set(status.participants
-    .filter(participant => participant.presence !== "offline")
-    .map(participant => participant.sessionId));
-  const mine = bindings.filter(binding => live.has(binding.accSessionId)
-    && binding.clientPid === ownClientPid);
-  // One client process can outlive a session and open another, so the pid alone
-  // can still name two. The harness session id the client exports separates
-  // them; with nothing to separate them the answer is nobody, as before.
-  const exported = new Set(Object.values(env ?? {}).filter(value => typeof value === "string"));
-  const matched = mine.filter(binding => exported.has(binding.harnessSessionId));
-  const chosen = mine.length === 1 ? mine[0] : matched.length === 1 ? matched[0] : null;
-  return chosen === null ? null
-    : { sessionId: chosen.accSessionId, generation: chosen.generation, clientPid: chosen.clientPid,
-      harnessSessionId: chosen.harnessSessionId };
-}
-
-/** The client process this Channel was spawned by, or null when nobody knows. */
-export async function ownClient({ table = null, from = process.pid,
-  command = createClaudeCodeAdapter().client.command } = {}) {
-  return resolveClientPid({ table: table ?? await readProcessTable(), from, command });
-}
-
-// How long the Channel will wait for the hook to publish this session's
-// binding. Claude spawns this child while SessionStart is still running - both
-// landed in the same second on a real 2.1.259 launch - and a single lookup
-// loses that race often enough to make native delivery activate or not per
-// launch. Bounded, because a session with no ACC binding must still be answered.
-const BINDING_WAIT_MS = 5_000;
-const BINDING_POLL_MS = 100;
-
-/**
- * The session binding, once it exists - or null when the wait runs out.
- *
- * A binding with no `clientPid` names no process, and the Channel binds an
- * exact one, so it does not count as resolved: the hook writes the identity
- * first and the certified facts after, and reading in between must keep waiting
- * rather than settle for the half-written answer.
- */
-export async function resolveWithin({ resolve, deadline, intervalMs = BINDING_POLL_MS,
-  now = () => Date.now(), sleep = ms => new Promise(resolve_ => setTimeout(resolve_, ms)) }) {
-  for (;;) {
-    const session = await resolve();
-    if (session !== null && Number.isInteger(session?.clientPid)) return session;
-    if (now() >= deadline) return null;
-    await sleep(intervalMs);
+// Kept only for installs made by ACC 0.7.x or earlier, which wired a Claude Channel MCP
+// server. A 0.7.x updater refuses a downloaded package without this file, and a
+// plugin copy written by 0.7.x can still ask Claude Code to spawn it until
+// `acc install` or `acc update` lays the plugin out again.
+//
+// A child that answers nothing is reported to the user as a server that failed
+// to connect, so this finishes the MCP handshake, declares no Channel and
+// offers no tools, and exits when Claude closes its stdin or stops it with a signal.
+
+function answer(message) {
+  if (message.method === "initialize") {
+    return { protocolVersion: message.params?.protocolVersion, capabilities: { tools: {} },
+      serverInfo: { name: "agents-can-communicate", version: "0.2.0" } };
   }
+  if (message.method === "tools/list") return { tools: [] };
+  if (message.method === "ping") return {};
+  return undefined;
 }
 
-async function compose() {
-  const descriptor = await discoverWorkspace({ cwd: process.cwd(), env: process.env,
-    gitProbe: createGitProbe() });
-  const dataHome = platformDataHome({ platform: process.platform, env: process.env });
-  const paths = runtimePaths({ dataHome, workspaceId: descriptor.id, workspaceRoots: descriptor.roots });
-  const store = await openFilesystemStore({ root: paths.root, clock, ids,
-    workspaceId: descriptor.id });
-  const service = createCoordinationService({ store, clock, ids });
-  const write = payload => process.stdout.write(`${JSON.stringify(payload)}\n`);
-  // Read once: the ancestry that decides ownership cannot change while this
-  // process runs, and re-reading it on every poll would spawn `ps` in a loop.
-  const clientPid = await ownClient();
-  const session = await resolveWithin({
-    resolve: () => resolveSession({ runtimeDir: paths.root, service, env: process.env,
-      ownClientPid: clientPid }),
-    deadline: Date.now() + BINDING_WAIT_MS });
-  // No binding to serve - but Claude is already speaking MCP to this child, and
-  // returning here left the event loop empty: the process exited in 75ms
-  // without answering `initialize`, and Claude reported the server as failed to
-  // connect on every session that enables the plugin without ACC's shim.
-  if (session === null || !Number.isInteger(session.clientPid)) {
-    return startInertChannel({ write });
+function handle(line) {
+  let message;
+  try { message = JSON.parse(line); } catch {
+    return { jsonrpc: "2.0", error: { code: -32700, message: "parse error" } };
   }
-
-  const deliveryRouter = createDeliveryRouter({ service, adapters: ALL_ADAPTERS(), clock,
-    readLivePolicy: ({ adapter }) => readInstalledLivePolicy({ dataHome, adapterId: adapter.id }) });
-  const channel = createAccChannel({
-    endpointDir: endpointDir(paths.root),
-    clientPid: session.clientPid,
-    write,
-    // The Channel tool records through its own bound session, then uses the
-    // same durable-first offer as ordinary MCP. A successful reply record alone
-    // does not deliver it to the peer, and a failed offer must not lose it.
-    routeReply: ({ messageId, body }) => recordAndOffer({ router: deliveryRouter,
-      selectMessage: value => value.reply,
-      record: () => routeReply({ service, session, messageId, body }) }),
-    routeAck: ({ messageId }) => routeAck({ service, session, messageId }),
-    // This process is the only party that knows the endpoint is still being
-    // served, and Claude publishes no heartbeat, so nothing else would move
-    // ACC's lease while the session sits idle - which is when live delivery is
-    // worth having.
-    refreshBinding: leaseUntil => service.refreshDeliveryBinding({
-      sessionId: session.sessionId, generation: session.generation, leaseUntil }),
-  });
-  await channel.listen();
-  pump(channel.handleLine, () => { channel.close(); process.exit(0); });
-  // Serve MCP immediately; a slow or failed ACC binding must not stop the
-  // client connecting. The listening endpoint lets an in-flight hook finish
-  // before this owner acquires the same lifecycle lock and completes startup.
-  await activateClaudeChannel({ session, service, runtimeDir: paths.root, dataHome,
-    env: process.env }).catch(() => {});
-  return channel;
+  if (message.id === undefined || message.id === null) return null;
+  const result = answer(message);
+  return result === undefined
+    ? { jsonrpc: "2.0", id: message.id, error: { code: -32601, message: `unknown method: ${message.method}` } }
+    : { jsonrpc: "2.0", id: message.id, result };
 }
 
 export async function main() {
-  await compose().catch(() => startInertChannel());
+  let buffer = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", chunk => {
+    buffer += chunk;
+    let newline = buffer.indexOf("\n");
+    while (newline !== -1) {
+      const line = buffer.slice(0, newline).trim();
+      buffer = buffer.slice(newline + 1);
+      newline = buffer.indexOf("\n");
+      const reply = line === "" ? null : handle(line);
+      if (reply !== null) process.stdout.write(`${JSON.stringify(reply)}\n`);
+    }
+  });
+  await new Promise(resolve => {
+    process.stdin.once("end", resolve);
+    process.once("SIGTERM", resolve);
+    process.once("SIGINT", resolve);
+    process.stdin.resume();
+  });
+  // A signal can arrive while Claude still holds the pipe open; a stdin left
+  // reading would keep this process alive after main() returns.
+  process.stdin.destroy();
 }

package/bin/entrypoints/acc-mcp.mjs

@@ -54,7 +54,6 @@ await serve({
   context: {
     service,
     deliveryRouter: createDeliveryRouter({ service, adapters, clock,
-      platform: `${process.platform}-${process.arch}`,
       readLivePolicy: ({ adapter }) => readInstalledLivePolicy({ dataHome,
         adapterId: adapter.id }) }),
     workspaceId: descriptor.id,

package/bin/entrypoints/acc.mjs

@@ -25,7 +25,6 @@ const runtime = {
   ids: { next: kind => createId(kind, randomBytes) },
   createDeliveryRouter: ({ service, clock, dataHome }) =>
     createDeliveryRouter({ service, adapters, clock,
-      platform: `${process.platform}-${process.arch}`,
       readLivePolicy: ({ adapter }) => readInstalledLivePolicy({ dataHome,
         adapterId: adapter.id }) }),
   // Asked only by `acc config init`, and only when stdout is a terminal. There

package/docs/ADAPTER_AUTHORING.md

@@ -81,10 +81,15 @@ is not evidence for compaction. Counts add no ids to `offeredMessageIds` or
 
 `client.command` does double duty. `detect.mjs` uses it as the version-probe binary, and
 presence liveness separately walks the hook's process ancestry for the first ancestor whose
-executable basename matches it, to learn the client's own pid. Declare the binary the client
-actually runs as — `command: "claude"` for a client that really runs as `node` resolves
-nothing, and the failure is silent: the session gets `pid: null` and falls back to reading
-presence by age alone, with nothing telling you why.
+executable basename matches it, to learn the client's own pid. A client shipped as a node
+script, such as Gemini CLI, runs as `node`; for a `node` ancestor the walk also matches the
+script it runs: the first argument after any interpreter options, by basename, with a
+`.js`, `.mjs` or `.cjs` extension ignored. A word right after an option written without `=`
+may be that option's value (`--require ./preload.cjs`), so it is also tried and the script
+after it still counts. Declare the name the client actually runs as. A
+command that matches neither resolves nothing, and the failure is silent: the session gets
+`pid: null`, falls back to reading presence by age alone, and is not pinned to its
+generation, with nothing telling you why.
 
 ## Declare only proven capabilities
 
@@ -148,35 +153,71 @@ to its capabilities:
 
 ```js
 nativeDelivery: {
-  minimumByPlatform: { "darwin-arm64": "2.1.258" },
-  anchors: [{ platform: "darwin-arm64", version: "2.1.258",
-    protocolContract: "claude-code-channel-mcp-v1" }],
+  minimum: "2.1.282",
+  anchors: [{ version: "2.1.282", protocolContract: "claude-code-inbox-socket-v1" }],
   knownBad: [],
-  activationKinds: ["shell-bootstrap"],
+  activationKinds: ["native-service"],
+  offerKind: "wake",
 }
 ```
 
 The rules `defineAdapter` enforces, and the ones the runtime applies:
 
-- A minimum is the **first passing capture** on that platform, never a guessed first vendor
-  release. Every anchor must have passing `delivery.livePush` evidence for the same client,
-  version, and platform, and each minimum must itself be an anchor.
-- There is intentionally **no maximum version**. A newer stable release is admitted only
-  when a current read-only feature probe (`probeNativeDelivery()`) and a per-session
-  handshake (`bindNativeSession()`) both report the anchored `protocolContract`;
-  `evaluateNativeEligibility()` and `validateNativeHandshake()` are those two checks.
-- Prereleases require their own passing capture; they are `prerelease_not_captured` even
-  when numerically newer. `knownBad` names exact versions or inclusive intervals.
-- Exact-version certification still governs every non-native capability;
+- The minimum is the **first passing capture**, never a guessed first vendor release. Every
+  anchor must have passing `delivery.livePush` evidence for the same client and version, and
+  the minimum must itself be an anchor. The platform an evidence row names is where the
+  capture was taken; it is provenance, and the anchor names no platform.
+- There is intentionally **no maximum version** and **no platform**. A newer release is
+  admitted, on every platform, only when a current read-only feature probe
+  (`probeNativeDelivery()`) and a per-session handshake (`bindNativeSession()`) both report
+  the anchored `protocolContract`; `evaluateNativeEligibility()` and
+  `validateNativeHandshake()` are those two checks.
+- A prerelease is judged by its release triple, as hook capabilities are: `2.2.0-beta.1` is
+  `2.2.0` against the minimum and `knownBad`. `knownBad` names exact versions or inclusive
+  intervals. A version that cannot be read at all is `version_unavailable`.
+- Certification evidence still governs every non-native capability;
   `effectiveCapabilities()` is unchanged. The native rule is used for live delivery alone.
+
+What may refuse live delivery is exactly three things:
+
+- the machine's own probe or per-session handshake failing;
+- a client older than the first passing capture;
+- a regression recorded in `knownBad`.
+
+Nothing else: not the platform, not a prerelease suffix, not where the evidence was taken. A
+transport that is technically different on some platform is the probe's fact to report, as
+`native_delivery_unsupported`, never a gap in the captures. The 0.8.0 shape,
+`minimumByPlatform` with a platform on each anchor, is refused by name; the design record is
+`docs/design/2026-09-26-native-delivery-across-platforms.md` in the repository.
 - Native methods return closed facts (`validateNativeActivationPlan()` closes the
   activation plan) and never put vendor data - endpoints, sockets, raw errors - into core.
 
-`nativeDelivery.policySource` defaults to the session environment. An adapter may
-declare `"installation-record"` when hooks and senders must read current recorded
-recipient consent independently of the vendor process environment. Installation
-records the requested policy even when current activation is unavailable. An absent
-or invalid record means `off`; a previously published binding cannot override it.
+`nativeDelivery.policySource` accepts only `"installation-record"`, which is also the
+default. Hooks and senders read the current recorded recipient consent, independently of
+the vendor process environment. Installation records the requested policy even when
+current activation is unavailable. An absent or invalid record means `off`. A previously
+published binding cannot override it.
+
+`nativeDelivery.offerKind` says what an accepted offer puts in front of the model. It is
+`"message"` (the default) or `"wake"`:
+
+- `"message"` carries the body. The router records the receipt as `offered` with the
+  transport name and returns the outcome `offered`.
+- `"wake"` carries only a notice that makes the client run a turn. The router records no
+  offer and returns the outcome `woken`. The receipt stays `queued`. The next-turn hook
+  records `offered` via `next-turn` after its output carried the body. Use `"wake"` only
+  where the turn that the wake starts runs the client's next-turn hook, as Claude Code's
+  `UserPromptSubmit` does. When the client takes the wake but holds it for its user's
+  approval, return `pendingApproval: true` with the acceptance; the outcome carries it so
+  the sender is told the truth.
+
+A failed offer of either kind is recorded as a failed offer and leaves the receipt queued.
+
+`nativeDelivery.activationKinds` names the mechanisms the adapter may plan:
+`"native-config"` or `"native-service"`. A `native-service` mechanism with
+`preExisting: true` and no commands describes a service that the client itself runs, such
+as the Claude Code inbox. A `shell-bootstrap` mechanism can no longer be planned. Install
+records of one stay readable, so that `acc install` and `acc update` can retire it.
 
 The optional `refreshNativeSession()` method may revalidate an expired lease before
 an offer. It returns the same closed handshake shape as `bindNativeSession()` and
@@ -204,7 +245,7 @@ earlier failures without duplicating a certification tuple.
 
 Installed hook wiring may reach tier 2, but each effective hook capability still
 requires exact client/version/platform evidence. Tier 3 has separate native
-contracts: Claude Code Channel from 2.1.258 and Codex LocalDaemon from 0.152.1 on
+contracts: the Claude Code inbox wake from 2.1.282 and Codex LocalDaemon from 0.152.1 on
 macOS arm64, with current probes and exact session handshakes. Codex's earlier
 remote-wrapper failure remains historical evidence. Ordinary launch now preserves
 workspace identity; the full installed product matrix, including negative controls
@@ -220,9 +261,18 @@ return normalizedEvent({
   kind, sessionId, cwd, model, parentSessionId, tool,
   targets,   // paths this call would WRITE. For a shell call, pass the command to
              // shellWriteTargets() — it reads write positions only, never reads.
+  permissionMode, // the client's own name for the session's permission mode, or null
+  endReason,      // on sessionEnd, the client's own word for why, or null
 });
 ```
 
+`permissionMode` and `endReason` are optional and default to `null`. Pass `permissionMode`
+when the client's hook reports one: a native binding reads it to tell a sender whether the
+client will hold a wake for approval. Claude Code reports it on most hooks but not on
+`SessionStart`. Pass `endReason` on `sessionEnd` when the client says why, as Claude Code's
+`reason` does (`"clear"` after `/clear`). ACC keeps it in the closed session record's
+`extensions`, and a sender is told that the conversation was cleared.
+
 Refuse an unrecognised payload. Inventing a session attaches the wrong one, or a new one
 every hook, and looks like it is working.
 

package/docs/ARCHITECTURE.md

@@ -48,6 +48,11 @@ The order is part of the public guarantee:
 4. ask one adapter to cross its transport boundary;
 5. only after acceptance, commit `offered` and an immutable success event.
 
+An adapter whose contract declares `offerKind: "wake"` puts only a notice in front of the
+client, never the body. The router records no offer for an accepted wake and returns the
+outcome `woken`. The receipt stays `queued` until the recipient's next-turn hook output
+carried the body. That hook then commits `offered` via `next-turn`.
+
 A failed offer records the selected recipient session id and generation with a safe
 diagnostic code, then leaves the receipt queued. Core validates that target provenance and
 derives the event actor from it. A crash after bytes cross the boundary but before the
@@ -78,12 +83,16 @@ or projected into agent context; session restart replaces it and SessionEnd atte
 cleanup. Doctor ignores closed or superseded generations even if cleanup could not finish. Diagnostic disk I/O runs in an
 unreferenced worker, so a stalled write cannot hold the hook process open.
 
-Claude's MCP process can become ready after the bounded SessionStart handshake
-has ended. Once its endpoint listens, the Channel completes the same validated
-binding without a user prompt. It acquires the session lifecycle lock, recovers
-any committed journal, and rechecks its exact owner and current consent before
-publication. The optional diagnostic records `channelReady`; MCP remains responsive
-if registration fails. This does not create a session or revive a closed one.
+Claude Code's inbox binding runs inside ACC's own hooks, with no ACC process in the
+session. Each turn hook reads the session's inbox socket from `CLAUDE_CODE_MESSAGING_SOCKET`
+and verifies it against Claude Code's session registry `<config>/sessions/<pid>.json`. The
+pid and the socket must match; the session id is checked from the first offer on, because
+Claude Code rewrites the entry for a `/resume` only after SessionStart. The hook then writes
+a private endpoint record and publishes the binding with a 120-second lease. The router refreshes an expired
+lease with the same registry check, so an idle session stays reachable between turns. The
+adapter repeats the check before each offer. A registry that disappeared, or that names
+another session or socket, refuses the offer, so a wake never reaches a reused pid. This
+does not create a session or revive a closed one.
 
 ## Certified capability versus current reachability
 
@@ -96,14 +105,16 @@ a third certification check. A binding says what that current generation
 exposes and whether its lease is current, while recipient policy says whether it may spend a
 turn.
 
-Claude Code Channel has installed-client evidence on 2.1.258 and 2.1.260; Codex
-LocalDaemon has it on 0.152.1 and 0.153.4; Antigravity CLI has it on 1.2.7 and later through a relay
-the agent starts in its own shell. All three use a captured platform minimum,
-current probe and exact session handshake. Codex preserves the ordinary client
-launch and verifies its registered thread and workspace; native delivery owns no vendor
-daemon lifecycle. Gemini CLI and Kimi Code have exact-version next-turn evidence only; Grok
-and generic MCP use inbox polling. Antigravity CLI additionally attaches
-a session only where the client reports an open workspace.
+The Claude Code inbox wake has installed-client evidence on 2.1.282. Codex LocalDaemon
+has it on 0.152.1 and 0.153.4. Antigravity CLI has it on 1.2.7 and later through a relay
+the agent starts in its own shell. All three use a captured minimum that applies on every
+platform, a current probe and an exact session handshake; a prerelease is judged by its
+release triple. Claude Code and Codex preserve the ordinary
+client launch. Claude Code verifies its session registry, and Codex verifies its registered
+thread and workspace. Native delivery owns no vendor daemon lifecycle. Gemini CLI and Kimi
+Code have exact-version next-turn evidence only. Grok and generic MCP use inbox polling.
+Antigravity CLI additionally attaches a session only where the client reports an open
+workspace.
 
 ## Storage and workspace identity
 
@@ -216,10 +227,12 @@ modes. It preserves explicit declarations and does not rewrite live leases. Miss
 changed generation files and unknown native bindings remain unverified holds.
 A session is also pinned to the generation
 it started with: its hooks delegate to that generation while the pin declares the same
-store contract this one does, and run the active generation otherwise. A generation
-directory is reclaimed once no control pointer, live lease, live pin or staging hold names
-it. Parsed help, version, and update recovery remain available when workspace admission is
-unavailable.
+store contract this one does, and run the active generation otherwise. Apart from
+`SessionEnd`, only the client's confirmed death releases a pin, so a session whose client
+process cannot be found is not pinned, and a pin that names no client is reaped. A
+generation directory is reclaimed once no control pointer, live lease, live pin or staging
+hold names it. Parsed help, version, and update recovery remain available when workspace
+admission is unavailable.
 
 An independent worker downloads npm packages with lifecycle scripts disabled, checks exact
 stable package identity and the discovered integrity, and health-checks the staged runtime.