agl 40.5.1 → 41.0.0

package/ts/aglapi/aglapisurface.document.ts

@@ -1408,8 +1408,8 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
     {
       "method": "agl.mcp.ticket.get",
       "path": "agl.agl_mcp_ticket_get",
-      "summary": "Reads a ticket by its `AGL-<n>` key, with its Markdown comments, source, links, questions and their answers, and its co…",
-      "description": "Reads a ticket by its `AGL-<n>` key, with its Markdown comments, source, links, questions and\ntheir answers, and its complete activity log.",
+      "summary": "Reads a ticket by its `AGL-<n>` key with its source, links, all its questions and their answers, and the newest page of…",
+      "description": "Reads a ticket by its `AGL-<n>` key with its source, links, all its questions and their answers,\nand the newest page of its history (up to `limit` entries, default 50, at most 500, within 256 KiB), oldest first: the\nactivity entries and the Markdown comments they name, a `commented` entry naming its comment by\nid. `historyBefore` is present while older history exists; pass it as `before` for the next page.\n`commentId` reads that one comment instead (`comments: [it]`, `activity: []`), without `before` or `limit`.",
       "omitted": [
         "ownerToken"
       ],
@@ -1419,6 +1419,18 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
         "properties": {
           "ticketId": {
             "type": "string"
+          },
+          "before": {
+            "type": "string",
+            "description": "An activity id, as `historyBefore` returned it: the page holds only older entries."
+          },
+          "limit": {
+            "type": "number",
+            "description": "Entries on the page, 1 to 500 (`ticketHistoryPage.maximum`); 50 (`ticketHistoryPage.default`) when absent."
+          },
+          "commentId": {
+            "type": "string",
+            "description": "One comment of this ticket, by the id an activity entry or a fleet event names: the response holds the ticket, its questions and that comment alone (`comments: [it]`, `activity: []`, no `historyBefore`). Excludes `before` and `limit`."
           }
         },
         "required": [
@@ -1426,39 +1438,9 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
         ]
       },
       "outputSchema": {
-        "type": "object",
-        "properties": {
-          "ticket": {
-            "$ref": "#/$defs/ITicket"
-          },
-          "comments": {
-            "type": "array",
-            "items": {
-              "$ref": "#/$defs/ITicketComment"
-            }
-          },
-          "activity": {
-            "type": "array",
-            "items": {
-              "$ref": "#/$defs/ITicketActivity"
-            }
-          },
-          "questions": {
-            "type": "array",
-            "items": {
-              "$ref": "#/$defs/ITicketQuestion"
-            }
-          }
-        },
-        "required": [
-          "ticket",
-          "comments",
-          "activity",
-          "questions"
-        ],
-        "additionalProperties": false
+        "$ref": "#/$defs/ITicketDetail"
       },
-      "declaration": "/**\n * Reads a ticket by its `AGL-<n>` key, with its Markdown comments, source, links, questions and\n * their answers, and its complete activity log.\n */\nfunction agl_mcp_ticket_get(params: { ticketId: string }): Promise<{ ticket: ITicket; comments: ITicketComment[]; activity: ITicketActivity[]; questions: ITicketQuestion[] }>;"
+      "declaration": "/**\n * Reads a ticket by its `AGL-<n>` key with its source, links, all its questions and their answers,\n * and the newest page of its history (up to `limit` entries, default 50, at most 500, within 256 KiB), oldest first: the\n * activity entries and the Markdown comments they name, a `commented` entry naming its comment by\n * id. `historyBefore` is present while older history exists; pass it as `before` for the next page.\n * `commentId` reads that one comment instead (`comments: [it]`, `activity: []`), without `before` or `limit`.\n */\nfunction agl_mcp_ticket_get(params: ITicketGet): Promise<ITicketDetail>;"
     },
     {
       "method": "agl.mcp.ticket.link",
@@ -3783,7 +3765,7 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
           },
           "protocolVersion": {
             "type": "number",
-            "const": 45
+            "const": 46
           },
           "upgradeManagementVersion": {
             "type": "number"
@@ -3905,7 +3887,7 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
         ],
         "additionalProperties": false
       },
-      "declaration": "interface IControllerStatus {\n  packageName: string;\n  packageVersion: string;\n  protocolVersion: 45;\n  upgradeManagementVersion: number;\n  controllerPid: number;\n  processGroupId: number;\n  processFingerprint: string;\n  processMode: TControllerProcessMode;\n  lifecycleState: TControllerLifecycleState;\n  startedAt: number;\n  setupRequired: boolean;\n  /** Present when the controller runs as the systemd user unit (`agl service install`); absent for a detached or foreground one. */\n  serviceUnit?: \"agl-controller.service\";\n  /** The TLS mode of the runtime configuration the controller runs with; absent until it is resolved. */\n  tlsMode?: TControllerTlsMode;\n  upgrade?: IControllerUpgradeStatus;\n  /** AGL's inference proxy, by state only; details need a signed-in owner (`controller.proxy.status.get`). */\n  proxy?: { state: TControllerProxyState };\n  harnesses: Array<{\n    harnessId: TControllerSessionHarnessId;\n    pid?: number;\n    state: TControllerHarnessLifecycleState;\n    healthy: boolean;\n    version?: string;\n    supportsLocalAttachments?: boolean;\n    connectionMode?: 'local' | 'shared' | 'remote';\n    diagnostic?: IControllerCodexDiagnostic;\n    /** Codex only: automatic reconnection of this entry's profile to the local shared app-server. */\n    rejoin?: IControllerCodexRejoinStatus;\n    /**\n     * Codex only, on the controller status: every connected or required profile. The entry's\n     * `healthy` is then true only when each of them is, apart from a profile on an account Codex\n     * cannot run on now, listed `stopped` with an `account_unavailable` diagnostic that says why;\n     * its other members describe the default profile.\n     */\n    profiles?: IControllerCodexProfileStatus[];\n  }>;\n}"
+      "declaration": "interface IControllerStatus {\n  packageName: string;\n  packageVersion: string;\n  protocolVersion: 46;\n  upgradeManagementVersion: number;\n  controllerPid: number;\n  processGroupId: number;\n  processFingerprint: string;\n  processMode: TControllerProcessMode;\n  lifecycleState: TControllerLifecycleState;\n  startedAt: number;\n  setupRequired: boolean;\n  /** Present when the controller runs as the systemd user unit (`agl service install`); absent for a detached or foreground one. */\n  serviceUnit?: \"agl-controller.service\";\n  /** The TLS mode of the runtime configuration the controller runs with; absent until it is resolved. */\n  tlsMode?: TControllerTlsMode;\n  upgrade?: IControllerUpgradeStatus;\n  /** AGL's inference proxy, by state only; details need a signed-in owner (`controller.proxy.status.get`). */\n  proxy?: { state: TControllerProxyState };\n  harnesses: Array<{\n    harnessId: TControllerSessionHarnessId;\n    pid?: number;\n    state: TControllerHarnessLifecycleState;\n    healthy: boolean;\n    version?: string;\n    supportsLocalAttachments?: boolean;\n    connectionMode?: 'local' | 'shared' | 'remote';\n    diagnostic?: IControllerCodexDiagnostic;\n    /** Codex only: automatic reconnection of this entry's profile to the local shared app-server. */\n    rejoin?: IControllerCodexRejoinStatus;\n    /**\n     * Codex only, on the controller status: every connected or required profile. The entry's\n     * `healthy` is then true only when each of them is, apart from a profile on an account Codex\n     * cannot run on now, listed `stopped` with an `account_unavailable` diagnostic that says why;\n     * its other members describe the default profile.\n     */\n    profiles?: IControllerCodexProfileStatus[];\n  }>;\n}"
     },
     {
       "name": "IControllerTerminalResource",
@@ -4743,10 +4725,55 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
       "name": "ITicketCreate",
       "declaration": "interface ITicketCreate {\n  project: string;\n  kind?: TTicketKind;\n  title: string;\n  description?: string;\n  columnId?: TTicketColumn;\n  parentId?: string;\n  priority?: TTicketPriority;\n  assignee?: ITicketPerson;\n  labels?: string[];\n  sourceText?: string;\n  attachments?: ITicketAttachment[];\n}"
     },
+    {
+      "name": "ITicketDetail",
+      "schema": {
+        "type": "object",
+        "properties": {
+          "ticket": {
+            "$ref": "#/$defs/ITicket"
+          },
+          "comments": {
+            "type": "array",
+            "items": {
+              "$ref": "#/$defs/ITicketComment"
+            }
+          },
+          "activity": {
+            "type": "array",
+            "items": {
+              "$ref": "#/$defs/ITicketActivity"
+            }
+          },
+          "questions": {
+            "type": "array",
+            "items": {
+              "$ref": "#/$defs/ITicketQuestion"
+            }
+          },
+          "historyBefore": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "ticket",
+          "comments",
+          "activity",
+          "questions"
+        ],
+        "additionalProperties": false,
+        "description": "A ticket, all its questions and one page of its history, oldest first. `activity` is the page; `comments` are the comments its `commented` entries name, whose `changes.comment` holds only `{ after: { id } }` here (the stored entry keeps the whole comment). `historyBefore` is present while older entries exist: pass it as `before`."
+      },
+      "declaration": "/**\n * A ticket, all its questions and one page of its history, oldest first. `activity` is the page; `comments` are the\n * comments its `commented` entries name, whose `changes.comment` holds only `{ after: { id } }` here (the stored\n * entry keeps the whole comment). `historyBefore` is present while older entries exist: pass it as `before`.\n */\ninterface ITicketDetail {\n  ticket: ITicket;\n  comments: ITicketComment[];\n  activity: ITicketActivity[];\n  questions: ITicketQuestion[];\n  historyBefore?: string;\n}"
+    },
     {
       "name": "ITicketFilters",
       "declaration": "interface ITicketFilters {\n  mine?: boolean;\n  project?: string;\n  status?: TTicketColumn;\n  /** Matches a hand label or an AutoLabel. */\n  label?: string;\n  text?: string;\n}"
     },
+    {
+      "name": "ITicketGet",
+      "declaration": "/** A ticket and one page of its history: the newest entries, or those older than the entry `before` names, within `ticketHistoryPage`. */\ninterface ITicketGet {\n  ticketId: string;\n  /** An activity id, as `historyBefore` returned it: the page holds only older entries. */\n  before?: string;\n  /** Entries on the page, 1 to 500 (`ticketHistoryPage.maximum`); 50 (`ticketHistoryPage.default`) when absent. */\n  limit?: number;\n  /**\n   * One comment of this ticket, by the id an activity entry or a fleet event names: the response holds the ticket, its\n   * questions and that comment alone (`comments: [it]`, `activity: []`, no `historyBefore`). Excludes `before` and `limit`.\n   */\n  commentId?: string;\n}"
+    },
     {
       "name": "ITicketMove",
       "declaration": "interface ITicketMove { ticketId: string; columnId: TTicketColumn; beforeTicketId?: string; }"

package/ts/classes.aglhome.ts

@@ -64,6 +64,11 @@ export interface IAGLHomePaths {
   proxy: string;
   /** The running proxy's private control socket. */
   proxySocket: string;
+  /**
+   * The proxy's confined listener: a Unix socket alone in a private directory of its own, which a confined run mounts
+   * into its container, so the container sees nothing else of AGL. Only confined credentials are accepted on it.
+   */
+  proxyConfinedSocket: string;
   /** The credentials the proxy keeps in files, one per client with delivery `file` (OpenCode's `{file:...}`). */
   proxyCredentials: string;
   /** The credential command a harness routed through the proxy runs; the proxy writes it whenever it starts. */
@@ -211,6 +216,7 @@ export const resolveAGLHomePaths = (
     claudeOnChatGpt: path.join(root, 'claude-gateway'),
     proxy: path.join(root, 'proxy'),
     proxySocket: path.join(sockets, 'agl-proxy.sock'),
+    proxyConfinedSocket: path.join(sockets, 'agl-proxy-confined', 'proxy.sock'),
     proxyCredentials: path.join(root, 'proxy', 'credentials'),
     proxyCredentialHelper: path.join(root, 'proxy', 'credential-helper'),
     migration: path.join(root, 'migration'),

package/ts/classes.authstore.ts

@@ -3,6 +3,7 @@ import { DriverModel } from './driver/classes.driverstore.js';
 import { DirectReportModel } from './driver/classes.directreportstore.js';
 import { SessionFeedAcknowledgementModel } from './classes.sessionfeedacknowledgements.js';
 import { HarnessReleaseModel } from './classes.harnessreleases.js';
+import { WorkerCallerBindingModel } from './classes.workercallerbindings.js';
 import { FleetTicketEffectModel } from './fleet/classes.ticketeffects.js';
 import { ControllerCodexOriginMigrationModel } from '../ts_migration/v29_codexorigins.js';
 import { ControllerCodexConnectionStore } from './classes.codexconnectionstore.js';
@@ -781,6 +782,7 @@ const setAuthStoreModelManager = (
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, SessionFeedAcknowledgementModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, FleetTicketEffectModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, HarnessReleaseModel);
+  plugins.nosqldb.setDefaultManagerForDoc(managerArg, WorkerCallerBindingModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketBoardModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketCommentModel);
@@ -1054,6 +1056,8 @@ export class SmartDataAuthStore implements IAuthStore, IAuthStoreSessionIdentity
       await FleetTicketEffectModel.exact.prepare();
       await HarnessReleaseModel.init();
       await HarnessReleaseModel.exact.prepare();
+      await WorkerCallerBindingModel.init();
+      await WorkerCallerBindingModel.exact.prepare();
       await TicketModel.init();
       await TicketBoardModel.init();
       await TicketCommentModel.init();

package/ts/classes.controller.ts

@@ -5,6 +5,7 @@ import { FleetDispatchError } from './fleet/interfaces.workers.js';
 import type { TFleetWorkerAction, TFleetWorkerRequest } from '../ts_interfaces/fleetworkers.js';
 import { ControllerBrowserOperationAuthority } from './classes.browseroperationauthority.js';
 import { ControllerWorkerCallers, type IWorkerCodexCallerOrigin } from './classes.workercallers.js';
+import { WorkerCallerBindingStore } from './classes.workercallerbindings.js';
 import { FleetWorkerLaunches } from './fleet/classes.workerlaunches.js';
 import { workerCallerEnrollmentToolName } from './classes.mcpworkercaller.js';
 import { readWorkerProcessSnapshot, readWorkerUnixSocketOwner, workerSnapshotsEqual, isWorkerCallerProofRefusal, type IWorkerCallerConnection } from './functions.workerprocessproof.js';
@@ -86,6 +87,7 @@ import {
 } from './functions.canonicaldirectory.js';
 import { commitinfo } from './00_commitinfo_data.js';
 import { controllerFailureJournal } from './classes.failurejournal.js';
+import { ControllerEventDelivery } from './classes.controllereventdelivery.js';
 import {
   controllerPackageName,
   controllerBuiltinCommands,
@@ -928,6 +930,9 @@ const maxSessionArchiveReconciliationReads = 3;
 const maxLatestOpenCodeToolExecutions = 512;
 const maxLatestOpenCodeMessageUpdates = 512;
 const maxPendingFlexControllerEvents = 512;
+/** Events and serialized bytes one browser may have waiting before its queue collapses into a resync. */
+const maxPendingControllerEventsPerViewer = 512;
+const maxPendingControllerEventBytesPerViewer = 16 * 1024 * 1024;
 const maxLatestFlexToolExecutions = 512;
 const maxLatestFlexToolExecutionBytes = 8 * 1024 * 1024;
 const maxLatestFlexMessageUpdateBytes = 16 * 1024 * 1024;
@@ -1351,6 +1356,12 @@ interface ILatestTextUpdate {
   bytes?: number;
 }
 
+/** A live Flex reasoning snapshot with the accounting its deltas extend. */
+type TLatestFlexReasoningUpdate = ILatestReasoningUpdate & IFlexLiveTextAccounting;
+
+/** A live Flex text snapshot with the accounting its deltas extend. */
+type TLatestFlexTextUpdate = ILatestTextUpdate & IFlexLiveTextAccounting;
+
 type TControllerMessageDelta = IControllerReasoningDelta | IControllerTextDelta;
 
 interface IControllerTextDeltaFragment {
@@ -1388,6 +1399,67 @@ const controllerTextAfterAppendUtf8Bytes = (
   return Number.isSafeInteger(result) && result >= 0 ? result : undefined;
 };
 
+const isHighSurrogate = (codeArg: number): boolean => codeArg >= 0xD800 && codeArg <= 0xDBFF;
+const isLowSurrogate = (codeArg: number): boolean => codeArg >= 0xDC00 && codeArg <= 0xDFFF;
+
+/** The UTF-8 bytes `JSON.stringify` writes for a string's content (without its quotes), counted without serializing. */
+const controllerJsonStringContentBytes = (valueArg: string): number => {
+  let bytes = 0;
+  for (let index = 0; index < valueArg.length; index += 1) {
+    const code = valueArg.charCodeAt(index);
+    if (
+      code === 0x22 || code === 0x5C
+      || code === 0x08 || code === 0x09 || code === 0x0A || code === 0x0C || code === 0x0D
+    ) bytes += 2;
+    else if (code < 0x20) bytes += 6;
+    else if (code < 0x80) bytes += 1;
+    else if (code < 0x800) bytes += 2;
+    else if (isHighSurrogate(code)) {
+      if (index + 1 < valueArg.length && isLowSurrogate(valueArg.charCodeAt(index + 1))) {
+        bytes += 4;
+        index += 1;
+      } else bytes += 6;
+    } else if (isLowSurrogate(code)) bytes += 6;
+    else bytes += 3;
+  }
+  return bytes;
+};
+
+/**
+ * What a live Flex snapshot's text costs, kept beside the text so a delta is accounted by its own length: the
+ * cumulative text is never encoded, serialized or even read again on the append path.
+ */
+interface IFlexLiveTextAccounting {
+  textUtf8Bytes: number;
+  /** `JSON.stringify(text)` bytes without the quotes. */
+  textJsonBytes: number;
+  textEndsWithHighSurrogate: boolean;
+}
+
+const flexLiveTextAccounting = (textArg: string): IFlexLiveTextAccounting => ({
+  textUtf8Bytes: Buffer.byteLength(textArg, 'utf8'),
+  textJsonBytes: controllerJsonStringContentBytes(textArg),
+  textEndsWithHighSurrogate: textArg.length > 0 && isHighSurrogate(textArg.charCodeAt(textArg.length - 1)),
+});
+
+const flexLiveTextAccountingAfterAppend = (
+  accountingArg: IFlexLiveTextAccounting,
+  deltaArg: string,
+): IFlexLiveTextAccounting | undefined => {
+  if (deltaArg.length === 0) return accountingArg;
+  // A surrogate pair split across the append: two lone halves (3 + 3 UTF-8 bytes, `\uXXXX` + `\uXXXX` in JSON)
+  // become one pair (4 bytes in both).
+  const joinsPair = accountingArg.textEndsWithHighSurrogate && isLowSurrogate(deltaArg.charCodeAt(0));
+  const textUtf8Bytes = accountingArg.textUtf8Bytes + Buffer.byteLength(deltaArg, 'utf8') - (joinsPair ? 2 : 0);
+  const textJsonBytes = accountingArg.textJsonBytes + controllerJsonStringContentBytes(deltaArg) - (joinsPair ? 8 : 0);
+  if (!Number.isSafeInteger(textUtf8Bytes) || !Number.isSafeInteger(textJsonBytes)) return undefined;
+  return {
+    textUtf8Bytes,
+    textJsonBytes,
+    textEndsWithHighSurrogate: isHighSurrogate(deltaArg.charCodeAt(deltaArg.length - 1)),
+  };
+};
+
 const fragmentControllerTextDelta = (valueArg: string): IControllerTextDeltaFragment[] => {
   const fragments: IControllerTextDeltaFragment[] = [];
   let delta = '';
@@ -3030,8 +3102,8 @@ export class OpenCodeController {
   private readonly latestOpenCodeReasoningUpdates = new Map<string, ILatestReasoningUpdate>();
   private readonly latestOpenCodeTextUpdates = new Map<string, ILatestTextUpdate>();
   private readonly latestFlexToolExecutions = new Map<string, ILatestToolExecution>();
-  private readonly latestFlexReasoningUpdates = new Map<string, ILatestReasoningUpdate>();
-  private readonly latestFlexTextUpdates = new Map<string, ILatestTextUpdate>();
+  private readonly latestFlexReasoningUpdates = new Map<string, TLatestFlexReasoningUpdate>();
+  private readonly latestFlexTextUpdates = new Map<string, TLatestFlexTextUpdate>();
   private readonly pendingFlexControllerEvents = new Map<string, IControllerEvent>();
   private readonly pendingFlexAutoAcceptSweeps = new Map<string, IFlexAutoAcceptSweep>();
   private openCodeControllerEventDrainTask?: Promise<void>;
@@ -3048,6 +3120,7 @@ export class OpenCodeController {
   private pendingFlexToolEventBytes = 0;
   private pendingFlexMessageEventBytes = 0;
   private flexControllerEventDrainTask?: Promise<void>;
+  private controllerEventDelivery?: ControllerEventDelivery;
   private flexAutoAcceptDrainTask?: Promise<void>;
   /** Sweeps whose auto-accept failed, queued again when the retry timer fires. */
   private readonly failedFlexAutoAcceptSweeps = new Map<string, IFlexAutoAcceptSweep>();
@@ -10555,7 +10628,12 @@ export class OpenCodeController {
         readMaster: async () => {
           const resource = await configurationAuthority.getResource();
           return (await configurationAuthority.getMaster({ resourceId: resource.resourceId })).master;
-        }, captureCodexOrigin: launch => this.captureWorkerCodexOrigin(launch) });
+        }, captureCodexOrigin: launch => this.captureWorkerCodexOrigin(launch),
+        // Claude launches keep their bindings, so a fleet worker's bridge proves itself again after this restart and
+        // after Claude Code continued its job in another process; the fleet reads the job's inventory for that proof.
+        bindings: new WorkerCallerBindingStore(),
+        observeClaudeJob: async (request) => this.fleetWorkers
+          ? await this.fleetWorkers.observeCallerJob(request) : { state: 'unproven', reason: 'the fleet is not running yet' } });
       this.workerCallers = workerCallers;
       const mcpControllerHost = new ControllerMcpHost({
         controllerPort: runtimeConfig.controllerPort,
@@ -12955,6 +13033,9 @@ export class OpenCodeController {
       }
     };
 
+    // Fleet jobs prepare, bind and revoke worker launches through the caller hooks: admit none and let the running
+    // ones settle before the hooks go, so a stop or archive meets the fleet's own refusal, never missing hooks.
+    await stopPart(async () => { await this.fleetWorkers?.closeAdmission(); });
     await stopPart(async () => {
       await this.workerCallers?.close();
       this.workerCallers = undefined;
@@ -13221,6 +13302,7 @@ export class OpenCodeController {
       ...(this.openCodeControllerEventDrainTask ? [this.openCodeControllerEventDrainTask] : []),
       ...(this.flexControllerEventDrainTask ? [this.flexControllerEventDrainTask] : []),
     ]);
+    await this.controllerEventDelivery?.stop();
 
     if (this.flexProjectionReader) {
       await stopPart(async () => {
@@ -16748,7 +16830,7 @@ export class OpenCodeController {
         return { owner, ...(configuration.boardPump ? { configuration: configuration.boardPump } : {}) };
       },
       tickets: async () => (await this.ticketStore.execute('list', {}, undefined)).tickets,
-      ticket: (ticketKeyArg) => this.ticketStore.execute('get', { ticketId: ticketKeyArg }, undefined),
+      history: (ticketKeyArg) => this.ticketStore.history(ticketKeyArg),
       workers: (ownerArg) => this.requireFleetWorkers().views(ownerArg),
       steer: (sessionIdArg, ticketKeyArg, textArg) => this.requireFleetWorkers().notify(sessionIdArg, ticketKeyArg, textArg),
       publish: (eventArg, ownerArg) => this.requireFleetWorkers().events.publish(eventArg, ownerArg),
@@ -17622,6 +17704,7 @@ export class OpenCodeController {
         driver: {
           instructions: service.instructions(await this.readDriverConfiguration()),
           notes: state.scratchpad.text,
+          notesRevision: state.scratchpad.revision,
         },
       };
     }
@@ -23842,7 +23925,8 @@ export class OpenCodeController {
         let cursor: string | undefined;
         for (let pages = 0; ; pages++) {
           if (pages >= 1000) throw new Error('Flex delivery transcript exceeded its inspection limit.');
-          const page = await supervisorArg.request('message.page', {
+          // Metadata pages: identity and state only, so a full scan never moves the transcript's text.
+          const page = await supervisorArg.request('message.metadata.page', {
             ...payload, limit: 50, includeUndone: true, ...(cursor === undefined ? {} : { before: cursor }),
           }, signal);
           for (const message of page.messages) {
@@ -29179,7 +29263,7 @@ export class OpenCodeController {
 
   private setLatestFlexReasoningUpdate(
     keyArg: string,
-    entryArg: ILatestReasoningUpdate,
+    entryArg: TLatestFlexReasoningUpdate,
     bytesArg: number,
   ): void {
     this.deleteLatestFlexReasoningUpdate(keyArg);
@@ -29189,7 +29273,7 @@ export class OpenCodeController {
 
   private setLatestFlexTextUpdate(
     keyArg: string,
-    entryArg: ILatestTextUpdate,
+    entryArg: TLatestFlexTextUpdate,
     bytesArg: number,
   ): void {
     this.deleteLatestFlexTextUpdate(keyArg);
@@ -29712,7 +29796,7 @@ export class OpenCodeController {
       {
         projectId: eventArg.scopeId,
         update,
-        textUtf8Bytes: Buffer.byteLength(update.text, 'utf8'),
+        ...flexLiveTextAccounting(update.text),
       },
       eventBytes,
     );
@@ -29779,7 +29863,7 @@ export class OpenCodeController {
       {
         projectId: eventArg.scopeId,
         update,
-        textUtf8Bytes: Buffer.byteLength(update.text, 'utf8'),
+        ...flexLiveTextAccounting(update.text),
       },
       eventBytes,
     );
@@ -29827,13 +29911,11 @@ export class OpenCodeController {
       this.advanceFlexMessageStreamEpoch(true);
       return;
     }
-    const textUtf8Bytes = controllerTextAfterAppendUtf8Bytes(
-      previous.text,
-      entry.textUtf8Bytes,
-      eventArg.delta,
-    );
+    const accounting = flexLiveTextAccountingAfterAppend(entry, eventArg.delta);
+    const textUtf8Bytes = accounting?.textUtf8Bytes;
     if (
-      textUtf8Bytes === undefined
+      accounting === undefined
+      || textUtf8Bytes === undefined
       || textUtf8Bytes <= entry.textUtf8Bytes
       || textUtf8Bytes !== eventArg.textUtf8Bytes
     ) {
@@ -29842,9 +29924,11 @@ export class OpenCodeController {
     }
 
     const revision = this.flexMessageStreamRevision + 1;
+    // Measured with empty text first: the snapshot's size is that frame plus the text's tracked JSON bytes, so
+    // the growing text is serialized only when a snapshot is served.
     const update = {
       ...previous,
-      text: `${previous.text}${eventArg.delta}`,
+      text: '',
       sourceUpdatedAt,
       revision,
       streamEpoch: this.flexMessageStreamEpoch,
@@ -29906,7 +29990,7 @@ export class OpenCodeController {
           timestamp: sourceUpdatedAt,
         };
     const eventBytes = Buffer.byteLength(JSON.stringify(controllerEvent), 'utf8');
-    const snapshotBytes = Buffer.byteLength(JSON.stringify(snapshotEvent), 'utf8');
+    const snapshotBytes = Buffer.byteLength(JSON.stringify(snapshotEvent), 'utf8') + accounting.textJsonBytes;
     if (
       eventBytes > controllerMaxLiveMessageEventBytes
       || snapshotBytes > controllerMaxLiveMessageEventBytes
@@ -29917,6 +30001,7 @@ export class OpenCodeController {
       return;
     }
 
+    update.text = `${previous.text}${eventArg.delta}`;
     this.flexMessageStreamRevision = revision;
     if (eventArg.partType === 'reasoning') {
       this.setLatestFlexReasoningUpdate(
@@ -29924,7 +30009,7 @@ export class OpenCodeController {
         {
           projectId: eventArg.scopeId,
           update: update as IControllerReasoningUpdate,
-          textUtf8Bytes,
+          ...accounting,
         },
         snapshotBytes,
       );
@@ -29934,7 +30019,7 @@ export class OpenCodeController {
         {
           projectId: eventArg.scopeId,
           update: update as IControllerTextUpdate,
-          textUtf8Bytes,
+          ...accounting,
         },
         snapshotBytes,
       );
@@ -30625,7 +30710,7 @@ export class OpenCodeController {
         {
           projectId: eventArg.projectId,
           update,
-          textUtf8Bytes: Buffer.byteLength(update.text, 'utf8'),
+          ...flexLiveTextAccounting(update.text),
         },
         Buffer.byteLength(JSON.stringify(event), 'utf8'),
       );
@@ -30653,7 +30738,7 @@ export class OpenCodeController {
         {
           projectId: eventArg.projectId,
           update,
-          textUtf8Bytes: Buffer.byteLength(update.text, 'utf8'),
+          ...flexLiveTextAccounting(update.text),
         },
         Buffer.byteLength(JSON.stringify(event), 'utf8'),
       );
@@ -35065,20 +35150,44 @@ export class OpenCodeController {
     ));
   }
 
+  /** Every browser's own ordered event queue (`ControllerEventDelivery`), created with the first event. */
+  private controllerEventDeliveryQueues(): ControllerEventDelivery {
+    this.controllerEventDelivery ??= new ControllerEventDelivery({
+      viewers: async () => {
+        const typedSocket = this.typedServer?.typedsocket;
+        if (!typedSocket) return [];
+        const targets = await this.controllerEventViewers();
+        return targets.map((targetArg) => ({
+          peerId: targetArg.peer.id,
+          send: async (eventArg: IControllerEvent) => {
+            await typedSocket.createTypedRequest<IReq_ControllerEvent>(
+              'controller.event',
+              targetArg,
+              { timeoutMs: 2_000 },
+            ).fire(eventArg, { timeoutMs: 2_000, maxRetries: 0 });
+          },
+        }));
+      },
+      eventKey: (eventArg) => this.controllerEventKey(eventArg),
+      mergeDelta: mergeControllerMessageDeltaEvents,
+      limits: {
+        events: maxPendingControllerEventsPerViewer,
+        bytes: maxPendingControllerEventBytesPerViewer,
+        mergedDeltaBytes: controllerMaxLiveMessageEventBytes,
+      },
+    });
+    return this.controllerEventDelivery;
+  }
+
+  /**
+   * The driver and the session feed see every event once, in order, before any browser; each browser then gets it
+   * through its own queue, so one that acknowledges slowly delays only itself. Resolves once every browser's queue
+   * holds the event, never on an acknowledgement.
+   */
   private async pushControllerEvent(eventArg: IControllerEvent): Promise<void> {
     this.driverService?.observe(eventArg);
     this.sessionFeed?.observe(eventArg);
-    const typedSocket = this.typedServer?.typedsocket;
-    if (!typedSocket) return;
-    const targets = await this.controllerEventViewers();
-    await Promise.allSettled(targets.map(async (targetArg) => {
-      const request = typedSocket.createTypedRequest<IReq_ControllerEvent>(
-        'controller.event',
-        targetArg,
-        { timeoutMs: 2_000 },
-      );
-      await request.fire(eventArg, { timeoutMs: 2_000, maxRetries: 0 });
-    }));
+    await this.controllerEventDeliveryQueues().push(eventArg);
   }
 
   private runUpgradePreparationAdmission<T>(operationArg: () => Promise<T>): Promise<T> {