multi-agent-collaboration-mcp 0.13.0 → 0.16.0

package/dist/index.js

@@ -2,13 +2,13 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { randomBytes } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { readFileSync } from "node:fs";
 import { z } from "zod";
-import { ChatStore, ModelTupleMismatchError, PersonaLostError, DEFAULT_MAX_BYTES, MAX_AGENT_ID_CHARS, MAX_CLIENT_MESSAGE_ID_CHARS, MAX_CROSSED_PREVIEW_CHARS, MAX_MESSAGE_BODY_BYTES, MIN_CATCH_UP_RESULT_BUDGET, } from "./db.js";
+import { ChatStore, ConnectionNonceCollisionError, PersonaLostError, DEFAULT_MAX_BYTES, MAX_AGENT_ID_CHARS, MAX_CLIENT_MESSAGE_ID_CHARS, MAX_CROSSED_PREVIEW_CHARS, MAX_MESSAGE_BODY_BYTES, MIN_CATCH_UP_RESULT_BUDGET, } from "./db.js";
 import { BoundedLineTransform, MAX_MCP_FRAME_BYTES, } from "./bounded-lines.js";
 import { stringifyWellFormedJson } from "./unicode.js";
 // The watcher is a sibling entry. Production executes compiled poller.js;
@@ -45,23 +45,18 @@ function pollerCmd(agentId, opts = {}) {
     // accumulating until a long timeout. Direct CLI commands can omit
     // --owner-pid when independent lifetime is intentional.
     //
-    // --owner-pid together with --epoch is also what marks a watcher as GENERATED
-    // rather than hand-run, and only a generated watcher refreshes last_seen.
+    // --owner-pid ALONE is what marks a watcher as GENERATED rather than
+    // hand-run, and only a generated watcher refreshes last_seen. A watcher
+    // without it stays strictly read-only.
     cmd += ` --owner-pid ${shq(String(process.pid))}`;
     if (opts.room !== undefined)
         cmd += ` --room ${shq(opts.room)}`;
-    // Bind the watcher to the epoch that was current when it was generated. This
-    // is a SECOND, independent retirement condition, not a restatement of
-    // --owner-pid: the runtime that armed the watcher can stay alive and still
-    // lose the persona to a later resume, and from that moment the command speaks
-    // for a runtime that no longer holds it. The epoch is what lets the watcher
-    // notice and exit instead of reporting traffic to a seat nobody is sitting
-    // in. Every probe still resolves the CURRENT read cursor:
-    // never bake a point-in-time --since baseline into a restartable command,
-    // because once crossed it fires forever.
-    if (opts.epoch !== undefined) {
-        cmd += ` --epoch ${shq(String(opts.epoch))}`;
-    }
+    // No tenure argument is baked in. The watcher re-reads the identity's live
+    // state on every probe, and an agent_id has exactly one tenure, so there is
+    // nothing a captured ordinal could add. Every probe likewise resolves the
+    // CURRENT read cursor: never bake a point-in-time --since baseline into a
+    // restartable command, because once crossed it fires forever.
+    //
     // Baked-in loop knobs, so callers stop hand-editing the command string
     // (the historical -32602 friction: the values LOOK like tool params).
     if (opts.timeoutSec !== undefined) {
@@ -101,7 +96,7 @@ const WAIT_CAP_SECONDS = configuredWaitCapSeconds();
 // Validate process-level configuration before opening the shared
 // database. A typo must fail without mutating production state first.
 const store = new ChatStore();
-const INSTRUCTIONS = `Agent Chat is a local SQLite ledger. Start create_persona (first time; SAVE the returned resume_word) or resume_persona -> list_rooms -> join_room -> catch_up. One runtime holds one persona; the latest valid resume takes it over and fences the old runtime, whose next write returns persona_lost. catch_up advances one room; my_mentions peeks across rooms. priority_only is explicitly lossy. For out-of-turn watching, wait_for_messages returns the background poller command. server_info holds routing/shared budgets; each tool schema states its cap.`;
+const INSTRUCTIONS = `Agent Chat is a local SQLite ledger. Start identify_persona -> list_rooms or create_room -> join_room -> catch_up. identify_persona takes your actual brand, model, and complete version string (version is TEXT: keep a known '.0'); the server allocates your nickname and you cannot submit or recover one. Repeating the exact tuple on this MCP process is idempotent; a changed tuple allocates a new nickname and terminally retires the old one; a restarted MCP process always gets a new nickname, so never save one for reuse. Model identity is self-declared and unverified. catch_up advances one room; my_mentions peeks across rooms. priority_only is explicitly lossy. For out-of-turn watching, wait_for_messages returns the background poller command. server_info holds routing/shared budgets; each tool schema states its cap.`;
 // The layered operating manual, served by server_info: stable reference
 // detail that would otherwise bloat every tools/list. Tool descriptions keep
 // only their unique semantics and point here.
@@ -114,51 +109,148 @@ ROUTING
 
 IN-CALL WAIT
 - catch_up wait_seconds (0..${WAIT_CAP_SECONDS} effective max) blocks that one call until a message from another agent lands in the target room, then returns it and advances. The safe default max is 25s; an operator may set AGENT_CHAT_MAX_WAIT_SECONDS up to 120 only after measuring end-to-end behavior on that host. wait_seconds bounds the polling deadline, not total RPC wall time: SQLite contention, lease cleanup, and serialization can add several bounded busy-timeout windows. On timeout: timed_out:true, call_again:true, rooms_with_unread. Normal hit/timeout responses carry waited_ms; cancellation/deletion errors may not.
-- The best-effort watching lease expires wait_seconds+5s after it begins. Raising the cap therefore also lengthens the maximum stale watching:true window after a hard-killed host; this is part of the operator opt-in.
+- A best-effort watching lease expires at the furthest deadline of the overlapping waits it represents, including 5s grace. Raising the cap therefore also lengthens the maximum stale watching:true window after a hard-killed host; this is part of the operator opt-in.
 - While your wait is open and its lease write succeeds, peers see watching:true for you (list_agents, post_message recipients): evidence that a blocking call was open, not a delivery guarantee. It drops on normal return/cancellation; TTL bounds a hard-kill ghost. A detached poller never produces it -- an armed watcher refreshes last_seen only, which is the weaker signal.
-- A wait is fenced: every 500ms probe re-reads your epoch, so a takeover ends the wait with terminal persona_lost within one probe rather than at the deadline.
+- A wait is fenced: every 500ms probe re-reads your identity's live state, so a retirement ends the wait with terminal persona_lost within one probe rather than at the deadline.
 - The wait holds your turn open, so it fits "I am waiting for a reply and have nothing else to do". To be notified while doing other work, or for watches longer than the cap, use the background poller.
 
 SIZE AND PAGING
 - Bulk reads are byte-bounded (default ${DEFAULT_MAX_BYTES} serialized chars; max_bytes tunes it, see limits). byte_limited:true = more remain: catch_up/read_history call again, my_mentions pages with after_id. Priority-only catch_up never advances past an unseen qualifying row when a row/byte cap cuts the page. Oversized bodies arrive truncated:true with length; fetch the rest via get_message offset -> next_offset (codepoints), passing room when the source row came from a non-active room. A truncated json body is a partial raw string, not an object.
-- Shared size and response budgets are in server_info limits; each tool schema states its own local cap. Message bodies cap at ${MAX_MESSAGE_BODY_BYTES} UTF-8 bytes; the newline-delimited stdio frame has a separate ${MAX_MCP_FRAME_BYTES}-byte wire cap to allow JSON escaping without unbounded pre-parse buffering.
+- Shared size and response budgets are in server_info limits; each tool schema states its own local cap. Message bodies cap at ${MAX_MESSAGE_BODY_BYTES} UTF-8 bytes; newline-delimited stdio line content has a separate ${MAX_MCP_FRAME_BYTES}-byte cap excluding the LF delimiter, allowing JSON escaping without unbounded pre-parse buffering.
 
 POSTING
 - crossed counts ALL unread from others past your marker at post time (old backlog included, not only mid-composition arrivals); crossed_directed says how many are aimed at you; crossed_range gives the seq span. If crossed > 0, catch_up before acting on replies. crossed_preview_chars opts into bounded previews of the crossed messages in the same response.
 - Dispositive posts (verdicts, commissions, dispositions): if_last_read_seq is a conditional post -- rejected (posted:false) if ANYTHING from others landed past your token, with bounded crossed previews returned; call catch_up for the complete delta before retrying. If pruning removed evidence after the token, it rejects conservatively with rejected:evidence_pruned and no invented previews. A token ahead of the target room's effective cursor is invalid and fails before posting. client_message_id makes an exact lost-response retry return the original seq instead of inserting twice; its guarantee lasts while that message is retained. Repeat the same explicit room or expected_room on retry so active-room drift cannot create a post in another room; a deduplicated response does not replay the original crossed/recipient snapshot, so catch_up for current state. room: posts to a named joined room without switching the active room; expected_room asserts which room is active. Never use the CAS on routine traffic: crossing is normal, the CAS is for posts whose validity depends on having read everything.
-- recipients reports factual room-local state: status, idle_seconds, last_read_seq, marker_behind. A new unread tag normally adds one to marker_behind. delivery_warnings is definitive for never-joined/left recipients; a long-idle warning is emitted only for pre-existing lag and states observed facts, never a responsiveness prediction.
+- recipients reports factual room-local state: status, idle_seconds, last_read_seq, marker_behind. A new unread tag normally adds one to marker_behind. delivery_warnings is definitive for never-joined/left/retired recipients; a long-idle warning is emitted only for pre-existing lag and states observed facts, never a responsiveness prediction.
 - status/idle_seconds/last_seen measure LISTENER recency: an MCP call from the bound runtime, or the two-minute heartbeat of a watcher it armed. active therefore means a runtime is reachable, not that the model is reading, reasoning, or able to wake, and an armed seat stays active no matter how long its model has been silent. The absence of a long-idle warning is not evidence anyone is listening; watching:true (an open blocking call) is the stronger claim.
 - supersedes_seq corrects YOUR OWN earlier message; readers see superseded_by on it. reply_to_seq threads; the log stays flat and globally ordered.
 - priority:true marks an immutable high-signal checkpoint for priority-only catch-up. Use it sparingly; correct a priority post with a new priority post + supersedes_seq rather than mutating history.
 - claim/release_claim: atomic single-winner advisory locks with TTL expiry (a crashed holder cannot block forever). Claims are mutual exclusion between live writers; they do not verify content.
 
-PERSONAS AND RUNTIMES
-- A PERSONA is the durable identity: its brand/model/version, rooms, read positions, room-local roles, and claims. A RUNTIME is one MCP server process. One runtime holds one persona, and a persona has one runtime at a time.
-- create_persona mints a persona and returns its id and resume_word. MCP returns the word ONCE and never again; it is the only way a later runtime can take the persona back. Losing it costs RESUMING that persona (its memberships, read markers, roles, claims), not access to any room's history. It exists to stop an operator pasting a wrong id from adopting someone else's persona -- it is not authentication, and it is stored in the database in plain text.
-- resume_persona binds an existing persona to this runtime and increments its runtime_epoch. The LATEST valid resume wins: any older runtime is fenced out at once, its background watchers exit, and its next write or advancing read fails with persona_lost (terminal -- retrying cannot help). Re-resuming from the runtime that already holds the persona is a no-op.
-- Every persona-authored write and every marker-advancing read re-verifies the runtime's epoch inside its own transaction, so a fenced-out runtime cannot commit anything.
-- Non-advancing reads (whoami, list_agents, my_mentions, read_history, get_message, get_thread, search_messages, list_claims) still return their normal data and DISCLOSE the loss instead of failing: the response carries persona_lost:true, your_epoch, and current_epoch at top level, the same three fields the persona_lost error uses. current_epoch:null means the persona row is gone. Reads keep working on purpose -- a fenced-out runtime needs to see what happened -- but nothing it reads can be written back until it resumes.
-- The poller command carries --epoch. A watcher whose epoch has moved on exits 2 with stale_binding instead of reporting traffic to a seat nobody is sitting in; resume_persona hands back a fresh command. Every probe resolves the CURRENT read cursor and never freezes a --since baseline.
-- brand/model/version are IMMUTABLE and describe what is actually running. Before resuming, check them against the model you actually are right now. If your provider, model, or version has changed, do NOT resume the old persona: create_persona with your real tuple, join the rooms the old persona was in, and tell them the seat changed model and has a new id. Resuming a tuple that no longer describes you posts under a false identifier, and peers read brand/model/version as who is speaking. A correct resume word with a changed tuple is refused with code new_persona_required and lists those rooms; a wrong word is a separate rejection.
+IDENTITY
+- A PERSONA is the durable identity: its brand/model/version, rooms, read positions, room-local roles, and claims. It belongs to ONE MCP server process incarnation and ONE exact tuple, for its whole life. There is no takeover, no resume, and no credential.
+- identify_persona is the only way in. Send your ACTUAL brand, model, and COMPLETE version string; the server allocates the nickname. You cannot submit an id, nickname, connection value, password, or resume token, and none exists to be stolen or pasted. Call it before create_room or join_room.
+- version is TEXT end to end. Send it as a JSON STRING: a JSON number is REJECTED by the schema, not silently coerced, so 5.0 is an input error rather than a wrong-but-accepted "5". If your version is officially '5.0', send "5.0" and keep the '.0'; if it is officially '5', send "5" and do not invent '.0'. The strings "5" and "5.0" are both valid and are DIFFERENT models to this server. Tuples are compared exactly: no case folding, no aliases, no version parsing.
+- Repeating identify_persona with the EXACT same tuple on this process is idempotent and returns the same nickname. Changing ANY field allocates a new nickname and TERMINALLY RETIRES the old one: it keeps its messages and membership history but can never post, advance a read marker, claim, join, or come back; its claims are released, and its pollers and open waits are fenced and exit on their next probe. Its NON-advancing reads are not the point: it is gone as a participant. Going A -> B -> A gives three distinct nicknames; a retired one is never revived.
+- Nothing is forwarded on a transition. No successor redirect, no mention or reply forwarding, no automatic handoff post. The response lists the rooms the old identity was in; rejoin the ones you need and tell them the seat changed model. It reports previous_retired:true and carries the explanatory prose in previous_retired_note.
+- Restarting the MCP process ALWAYS produces a new nickname, because it is a new process incarnation. Do not record a nickname for reuse, and do not treat one found in project notes as yours -- a second CLI in the same directory is a different participant with the same tuple.
+- Model identity is SELF-DECLARED. The server stores what you report and does not verify it.
+- Every persona-authored write and every marker-advancing read re-verifies inside its own transaction that the bound identity still exists and is not retired, so a superseded identity cannot commit anything. There is no tenure number: an agent_id is allocated once and never deleted, reinserted, revived, or rebound, so the id itself names the tenure.
+- Non-advancing reads (whoami, list_agents, my_mentions, read_history, get_message, get_thread, search_messages, list_claims) still return their normal data and DISCLOSE the loss instead of failing: the response carries persona_lost:true plus missing and retired at top level, the same booleans the persona_lost error uses. missing:true means the persona row is gone; retired:true means it is terminally retired. They are never both true. Reads keep working on purpose -- an identity that has just been retired needs to see what happened -- but nothing it reads can be written back.
+- A retired nickname is a distinct recipient state from a departed one: list_agents reports retired:true with present/active/watching all false, and post_message recipients report status "retired" and raise a delivery_warning saying the tag reaches no one. "left" can come back; "retired" cannot, and a post aimed at it is history rather than delivery.
+- The poller command carries --owner-pid, which marks it as generated and enables its liveness heartbeat. A watcher whose identity is missing or retired exits 2 rather than reporting traffic to a seat nobody can sit in; join_room or wait_for_messages hands back a fresh command. Every probe resolves the CURRENT read cursor and never freezes a --since baseline.
 - Roles are ROOM-LOCAL: set one on join_room or change/clear it with set_role. They are not stamped into message envelopes, because a role can change after a message was written.
+- Human web participants use the reserved 'human-' prefix with a numeric ordinal (human-alex-1). The number prevents two independent browsers from colliding on one name; it is not ownership and not authentication.
 
 BACKGROUND POLLER
-- Run the command join_room/resume_persona/wait_for_messages return as a BACKGROUND task. One Node process holds one SQLite connection and runs one indexed LIMIT 1 probe after each sleep; it launches no children. Generated commands exit 0 for either a hit or quiet deadline: parse stdout has_updates true/false. Direct CLI calls without --ok-on-timeout retain exit 124 on timeout. Exit 2 is an error or equivalent watcher. Options: --interval <sec> (minimum/default 5), --timeout <sec> (default 1200, finite), --ok-on-timeout, --mentions-only, --room <id|name>, --epoch <n>. Your own posts never wake it. Exit 2 with stale_binding means the persona was resumed elsewhere and this watcher is dead: do not re-arm it, resume_persona and use the command it returns.
-- The poller is an OS-level detector: its exit does NOT by itself schedule your next turn. Whether you are actually woken depends on your harness's background-task contract; do not report "watcher active" as evidence you will see a message.
+- Run the command returned by join_room or wait_for_messages as a BACKGROUND task. Before arming, call catch_up until remaining is 0 or stops falling. The watcher probes before its first sleep, so unread traffic makes it exit immediately. One Node process holds one SQLite connection and runs one indexed LIMIT 1 probe after each sleep; it launches no children. Generated commands exit 0 for either a hit or quiet deadline: parse stdout has_updates true/false. Direct CLI calls without --ok-on-timeout retain exit 124 on timeout. Exit 2 is an error, a live-PID watcher lock, retired_identity, left_room, left_all_rooms, or no_room_memberships; inspect stderr before re-arming. Options: --interval <sec> (minimum/default 5), --timeout <sec> (default 1200, finite), --ok-on-timeout, --mentions-only, --room <id|name>, --owner-pid <pid>. Your own posts never wake it.
+- The poller is an OS-level detector: its exit does NOT by itself schedule your next turn. This MCP does not replace an exited watcher; watching resumes only when a client runs a new command. Whether you are actually woken depends on your harness's background-task contract; do not report "watcher active" as evidence you will see a message.
 
 RETENTION
 - prune_messages deletes old messages (refuses while any non-author member has them unread; force overrides). A room seq you cite in a document is durable only as long as nobody prunes past it.`;
+// This process incarnation's connection nonce.
+//
+// Generated HERE, by this server, once per process. It is not supplied by MCP,
+// by the client, or by any caller: the probe established that the stdio
+// transport reports no session id and that client info identifies Claude Code
+// rather than the active model, so nothing arriving over the wire can serve as
+// a connection boundary. PID, working directory, and request/tool-use ids are
+// not substitutes either -- the first two are reused across incarnations and
+// the last three change per call.
+//
+// It is NOT authentication, NOT a secret, and NOT proof of liveness. Its only
+// job is to make "the same process asking again" distinguishable from "a
+// different process asking", which is what stops a second CLI in the same
+// directory from inheriting the first one's nickname.
+//
+// Mutable ONLY while `bound` is false, so the first-bind collision retry is a
+// real mechanism rather than a comment. After binding it is frozen, because
+// from then on the recorded binding is what identifies this process's row.
+let connectionId = randomUUID();
 // One stdio server process is ONE RUNTIME, and a runtime holds at most one
-// persona. The binding lives here, in process memory, and is deliberately not
-// persisted: durability across a restart is the resume word's job, and a second
-// persisted holder token would be a second source of truth about who holds the
-// persona. `epoch` is the value captured when this runtime bound; every write
-// re-verifies it against the stored one inside the write's own transaction.
+// CURRENT persona at a time. Not one for its whole life: an explicit tuple
+// transition retires the current persona and binds a new one on the same
+// connection, so a process can hold several sequentially -- never two at once,
+// and never a retired one again. The binding lives here, in process memory, AND
+// as the connection_id on the row; the two must agree before any identify
+// decision. Process memory is not a cache of the database here: it is the only
+// thing that distinguishes this process's established mapping from a row that
+// merely happens to carry an equal UUID.
+//
+// Every write re-verifies inside its own transaction that the captured
+// agent_id still exists and is not retired.
 const session = {
     agentId: null,
-    epoch: null,
     roomId: null,
+    bound: false,
 };
+/** The binding this process asserts, or null before it has ever bound. Both
+ *  fields are handed to the store together; a nonce match alone is never
+ *  treated as ownership. */
+function expectedBinding() {
+    if (!session.bound || session.agentId === null)
+        return null;
+    return { agentId: session.agentId, connectionId };
+}
+/**
+ * Bounded structured diagnostic to STDERR.
+ *
+ * Never stdout: that carries the JSON-RPC stream. Every free-form field is
+ * capped BEFORE serialization so a self-reported tuple or client string cannot
+ * produce an unbounded log record. Deliberately excludes request ids, progress
+ * tokens, tool-use ids, headers, and anything credential-shaped: the probe
+ * showed far more metadata than production identity needs, and none of it is
+ * stable identity.
+ */
+const DIAG_FIELD_CHARS = 200;
+/** This incarnation's start time, stamped once at module load. It is the field
+ *  that distinguishes two processes that reused a PID, which the nonce alone
+ *  does not communicate to a human reading a log. */
+const PROCESS_STARTED_AT = new Date(Date.now() - process.uptime() * 1000).toISOString();
+/** Client name and version, available only AFTER MCP initialization supplies
+ *  them. Recorded because it identifies the HOST, which is stable correlation
+ *  data; it deliberately says nothing about the active model. */
+let clientInfo = null;
+function diag(event, fields) {
+    const capped = {};
+    for (const [k, v] of Object.entries(fields)) {
+        capped[k] = typeof v === "string" ? v.slice(0, DIAG_FIELD_CHARS) : v;
+    }
+    const record = {
+        event: event.slice(0, DIAG_FIELD_CHARS),
+        connection_id: connectionId,
+        pid: process.pid,
+        started_at: PROCESS_STARTED_AT,
+        ...(clientInfo
+            ? {
+                client_name: clientInfo.name.slice(0, DIAG_FIELD_CHARS),
+                client_version: clientInfo.version.slice(0, DIAG_FIELD_CHARS),
+            }
+            : {}),
+        ...capped,
+    };
+    try {
+        process.stderr.write(stringifyWellFormedJson(record, "diagnostic") + "\n");
+    }
+    catch {
+        // A self-reported tuple can contain a lone surrogate, which the strict
+        // encoder refuses rather than emit as invalid JSON. Do not lose the event:
+        // fall back to a record carrying only server-generated values, all of
+        // which are well-formed by construction.
+        try {
+            process.stderr.write(JSON.stringify({
+                event: record.event,
+                connection_id: connectionId,
+                pid: process.pid,
+                started_at: PROCESS_STARTED_AT,
+                note: "fields omitted: not well-formed UTF-16",
+            }) + "\n");
+        }
+        catch {
+            // A diagnostic must never take the server down.
+        }
+    }
+}
 /** Stable key for a (room, identity) pair in process-local maps. \u0000 cannot
  *  appear in an agent id (control chars are rejected), so keys never collide. */
 function roomKey(roomId, agentId) {
@@ -167,11 +259,13 @@ function roomKey(roomId, agentId) {
 /** The bound persona, or a clean "bind first" error. Every persona-scoped tool
  *  goes through this or requireActive(). */
 function requirePersona() {
-    if (session.agentId === null || session.epoch === null) {
-        throw new Error("no persona bound to this runtime; call create_persona for a new one, " +
-            "or resume_persona with an existing id, resume word, and brand/model/version");
+    if (session.agentId === null) {
+        throw new Error("no persona bound to this runtime; call identify_persona with your " +
+            "ACTUAL brand, model, and complete version string (send version as a " +
+            "string and keep a known '.0'). There is no id, nickname, or " +
+            "credential to supply: identity belongs to this MCP process.");
     }
-    return { agentId: session.agentId, epoch: session.epoch };
+    return { agentId: session.agentId };
 }
 // Compact (not pretty-printed) JSON: bulk reads run against a hard client
 // output cap, and indentation wastes budget that could carry messages.
@@ -187,26 +281,32 @@ function fail(message) {
 /**
  * Render an error, tagging the one class callers must treat as TERMINAL.
  *
- * persona_lost is not a retryable failure: another runtime holds the persona
- * now, and every future call under this binding fails the same way. The tag
- * exists so a caller can distinguish it from a transient DB error without
- * matching on message text, and `terminal:true` says explicitly not to loop.
- * The binding is cleared here as well: continuing to hold a dead epoch would
- * make every later call re-derive the same answer more slowly.
+ * persona_lost is terminal FOR THE IDENTITY AND OPERATION THAT RAISED IT, which
+ * is not always the same thing as terminal for this process. The tag lets a
+ * caller distinguish it from a transient DB error without matching message
+ * text, and `terminal:true` says not to loop on this request.
+ *
+ * Recovery is therefore context-dependent, and getting that wrong is expensive
+ * in both directions. Requests are dispatched concurrently, so a catch_up that
+ * began under persona A can return AFTER this same process transitioned to a
+ * live persona B. Telling that process to restart would retire B and burn
+ * another nickname for no reason. Telling a genuinely dead process to carry on
+ * would leave it issuing calls that can never commit. So the recorded binding
+ * decides which of the two answers is true.
+ *
+ * The session is NEVER mutated here. Clearing agentId left `bound` true,
+ * which made expectedBinding() return null and presented a process that HAS
+ * bound as one that never did; identify_persona then took its allocate-fresh
+ * path, the one outcome the design forbids for an established process. Keeping
+ * the binding also keeps the nonce-clash branch unreachable while bound, so the
+ * internal connection value cannot surface in an error message.
  */
 function failFrom(e) {
     if (e instanceof PersonaLostError) {
-        // Clear ONLY the binding that actually died: same persona AND same epoch.
-        // Matching on the id alone let a late error from a superseded epoch wipe a
-        // binding this runtime had already re-established. That happens whenever a
-        // slow call started before a resume_persona lands after it -- the runtime
-        // holds a live epoch, and the stale error tore it down, forcing a
-        // pointless second resume.
-        if (session.agentId === e.agentId && session.epoch === e.expectedEpoch) {
-            session.agentId = null;
-            session.epoch = null;
-            session.roomId = null;
-        }
+        // Is the identity that died still the one this process is recorded as
+        // holding? If so this process is finished. If the session has since moved
+        // to a different binding, only this late request died.
+        const stillCurrent = session.agentId === e.agentId;
         return {
             content: [
                 {
@@ -216,40 +316,27 @@ function failFrom(e) {
                         code: "persona_lost",
                         terminal: true,
                         agent_id: e.agentId,
-                        your_epoch: e.expectedEpoch,
-                        current_epoch: e.currentEpoch,
-                        recover: "resume_persona with the id, resume word, and brand/model/version " +
-                            "to take it back, or create_persona for a new identity",
-                    }, null, 2),
-                },
-            ],
-            isError: true,
-        };
-    }
-    if (e instanceof ModelTupleMismatchError) {
-        // A DISTINCT code from a wrong word, because the remedy is distinct. A
-        // wrong word means "find the word"; this means "you are not that
-        // participant any more". Rendering both as a generic rejection sent an
-        // agent whose model had been upgraded hunting for a credential that was
-        // never the problem.
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({
-                        error: e.message,
-                        code: "new_persona_required",
-                        agent_id: e.agentId,
-                        persona_model: e.stored,
-                        your_model: e.offered,
-                        // The caller has no binding, so it cannot look these up itself.
-                        // Guidance to notify rooms it cannot name is not guidance.
-                        persona_rooms: e.rooms,
-                        recover: "call create_persona with your ACTUAL brand/model/version, " +
-                            "join the rooms listed in persona_rooms, and post there that " +
-                            "the seat changed model and carries a new persona id. Do NOT " +
-                            "resume the old tuple: peers read brand/model/version as who " +
-                            "is speaking, and it would now be wrong.",
+                        // Mutually exclusive by construction: a row cannot be both
+                        // absent and retired, and a live-row binding mismatch is
+                        // neither.
+                        missing: e.missing,
+                        retired: e.retired,
+                        // There is no path back to this identity. A nickname belongs to
+                        // one process incarnation and one exact tuple, and nothing a
+                        // caller can send reattaches to it -- which is the point, since
+                        // that is what stops a copied id from becoming a takeover.
+                        recover: stillCurrent
+                            ? "this is terminal for this MCP process: the identity it is " +
+                                "bound to is no longer valid, and identify_persona will keep " +
+                                "failing under that binding rather than allocate a " +
+                                "replacement. RESTART the MCP process, then call " +
+                                "identify_persona for a fresh nickname. This binding cannot " +
+                                "be recovered."
+                            : "this request is terminal, but this process is NOT: it has " +
+                                "already moved to a different identity, and the call that " +
+                                "failed was issued under the older one. Call whoami for the " +
+                                "current identity and continue under it. Do NOT restart on " +
+                                "the strength of this response alone.",
                     }, null, 2),
                 },
             ],
@@ -258,11 +345,19 @@ function failFrom(e) {
     }
     return fail(asMessage(e));
 }
-function lossDisclosure(agentId, epoch) {
-    const current = store.currentEpoch(agentId);
-    return current === epoch
-        ? null
-        : { persona_lost: true, your_epoch: epoch, current_epoch: current };
+function lossDisclosure(agentId) {
+    // The same three terminal states the guards use, reported instead of thrown.
+    // This function is called only for the process's recorded persona, so the
+    // process nonce completes the expected binding without accepting any
+    // caller-supplied authority.
+    const reason = store.personaLoss({ agentId, connectionId });
+    if (reason === null)
+        return null;
+    return {
+        persona_lost: true,
+        missing: reason === "missing",
+        retired: reason === "retired",
+    };
 }
 /** Serialized cost of splicing a disclosure into a response object, charged
  *  against a byte budget exactly the way catch_up reserves its routing
@@ -281,25 +376,21 @@ let activeBlockingWaits = 0;
  *  read; a hard-killed process's lease self-expires this soon after. */
 const WAIT_LEASE_GRACE_SECONDS = 5;
 /**
- * How many blocking waits THIS runtime currently has open per (room, persona,
- * epoch).
+ * How many blocking waits THIS runtime currently has open per (room, persona).
  *
- * The lease row is keyed (room_id, agent_id) because one persona has one
- * runtime and a takeover must REPLACE the row rather than sit beside it. That
+ * The lease row is keyed (room_id, agent_id) because one persona belongs to one
+ * connection, so two rows would report two watchers for one persona. That
  * keying alone would let two concurrent waits from this same runtime share one
  * row, so whichever finished first would delete it and report the other as not
  * watching. The row means "this persona has at least one wait open here", and
  * only this process knows how many, so the count lives here: the last waiter
  * out closes the lease.
  *
- * The EPOCH is part of this key even though it is not part of the row's key.
- * One process can hold a wait from an old epoch and a wait from a new one at
- * the same time (resume_persona is a tool call, so it can land while an earlier
- * wait sleeps). Sharing a counter across them makes the old wait's exit
- * decrement the new wait's count, and the new wait then closes a lease it does
- * not own -- or, worse, does not close its own. Separate counters keep the two
- * tenures independent; each closes with the epoch it captured, and
- * endWaitLease's epoch guard makes the loser's close a no-op.
+ * A process CAN hold a wait under an old identity and one under a new identity
+ * at the same time, because identify_persona is a tool call and a tuple
+ * transition can land while an earlier wait sleeps. They do not collide: the
+ * transition allocates a DIFFERENT agent_id, so the two waits already have
+ * different keys and different lease rows.
  */
 const openWaits = new Map();
 /** Sleep that wakes EARLY on abort (never rejects; callers re-check
@@ -327,88 +418,65 @@ function abortableSleep(ms, signal) {
         signal.addEventListener("abort", onAbort, { once: true });
     });
 }
+/** Resolve the active room and return its name from the same lookup. */
 function requireActive() {
-    const { agentId, epoch } = requirePersona();
+    const { agentId } = requirePersona();
     if (session.roomId === null) {
         throw new Error("join a room first with join_room");
     }
     // The room may have been deleted by another server process; the local session
     // would otherwise stay pointed at it and fail later with a low-level DB error.
     // The identity survives: only the active room is gone.
-    if (!store.getRoom(session.roomId)) {
+    const active = store.getRoom(session.roomId);
+    if (!active) {
         const stale = session.roomId;
         session.roomId = null;
-        throw new Error(`active room ${stale} no longer exists (deleted); rejoin with join_room`);
+        throw new Error(`active room ${stale} no longer exists (it was deleted); it cannot be ` +
+            "rejoined -- use list_rooms to see what remains, or create_room to " +
+            "make a new one");
     }
-    return { agentId, epoch, roomId: session.roomId };
+    return { agentId, roomId: session.roomId, roomName: active.name };
 }
-/** Resolve an optional explicit joined room without changing the active room.
- * Explicit operations require an established identity and an existing
- * membership, but a soft-left membership remains addressable: naming the room
- * is deliberate and may be needed to inspect history or release old claims. */
-function resolveJoinedRoom(room) {
-    if (room === undefined) {
-        const { agentId, epoch, roomId } = requireActive();
-        return {
-            agentId,
-            epoch,
-            roomId,
-            roomName: store.getRoom(roomId)?.name ?? null,
-        };
-    }
-    const { agentId, epoch } = requirePersona();
+/** Resolve an explicit or active room. Present-only callers leave membership
+ *  enforcement to the store transaction. */
+function resolveTargetRoom(room) {
+    if (room === undefined)
+        return requireActive();
+    const { agentId } = requirePersona();
     const target = store.resolveRoom(room);
     if (!target) {
         throw new Error(`no room "${room}". Use list_rooms to see options.`);
     }
-    if (!store.getMembership(target.id, agentId)) {
-        throw new Error(`you have never joined room "${target.name}"; join_room it first`);
+    return { agentId, roomId: target.id, roomName: target.name };
+}
+/** Resolve a room for operations that remain available after soft-leave.
+ *  Membership must exist, but left_at may be set. */
+function resolveJoinedRoom(room) {
+    const resolved = resolveTargetRoom(room);
+    if (room !== undefined &&
+        !store.getMembership(resolved.roomId, resolved.agentId)) {
+        throw new Error(`you have never joined room "${resolved.roomName}"; join_room it first`);
     }
-    return {
-        agentId,
-        epoch,
-        roomId: target.id,
-        roomName: target.name,
-    };
+    return resolved;
 }
-/**
- * Mark the bound persona alive in its active room on tool invocations.
- * Throttled: every tool call otherwise costs a write transaction on the shared
- * file (cross-process lock contention for pure reads like list_rooms). 30s
- * granularity is far inside the `active` liveness window, which is minutes.
- *
- * EPOCH-FENCED through store.touch(), which is what keeps a fenced-out runtime
- * from refreshing liveness: its PersonaLostError lands in the catch below and
- * the write never happened. A stale read therefore leaves last_seen alone.
- */
-let lastTouchMs = 0;
-const TOUCH_INTERVAL_MS = 30_000;
+/** Mark the bound persona alive in its active room. Shares the throttle below,
+ *  so an operation touching the active room and then the same room as its
+ *  resolved target writes once; a different target still gets its own write.
+ *  Fenced through store.touch(): a retired runtime cannot refresh liveness. */
 function touchSession() {
-    if (session.agentId === null || session.epoch === null)
+    if (session.agentId === null)
         return;
     if (session.roomId === null)
         return;
-    const now = Date.now();
-    if (now - lastTouchMs < TOUCH_INTERVAL_MS)
-        return;
-    lastTouchMs = now;
-    try {
-        store.touch(session.roomId, session.agentId, session.epoch);
-    }
-    catch {
-        // Liveness is best-effort: a briefly-locked database must not fail the
-        // tool call this touch piggybacks on (pure reads included). lastTouchMs
-        // already advanced, so failures back off to the next interval. A
-        // PersonaLostError lands here too and is CORRECTLY swallowed: the write it
-        // guards did not happen, which is the point, and the next real operation
-        // reports persona_lost to the caller.
-    }
+    touchCapturedRoom(session.roomId, session.agentId);
 }
-// Cross-room operations capture a target that can differ from mutable active
-// session state. Throttle each captured (room, identity) independently: using
-// touchSession() in a named-room wait kept refreshing the active room instead.
+// One throttle per (room, identity). Without it every tool call costs a write
+// transaction on the shared file, and 30s is far inside the minutes-scale
+// `active` window. Keyed per pair rather than per process so a cross-room
+// operation refreshes its captured target and not the active room.
+const TOUCH_INTERVAL_MS = 30_000;
 const capturedTouchMs = new Map();
-function touchCapturedRoom(roomId, agentId, epoch) {
+function touchCapturedRoom(roomId, agentId) {
     const key = roomKey(roomId, agentId);
     const now = Date.now();
     if (now - (capturedTouchMs.get(key) ?? 0) < TOUCH_INTERVAL_MS)
@@ -428,12 +496,14 @@ function touchCapturedRoom(roomId, agentId, epoch) {
     }
     capturedTouchMs.set(key, now);
     try {
-        // Unlike store.touch(), this refreshes only a room whose membership is
-        // still PRESENT, so it cannot resurrect an explicitly left room.
-        store.touchJoinedRoom(roomId, agentId, epoch);
+        // touch refreshes only a present membership and cannot rejoin a room.
+        store.touch(roomId, agentId);
     }
     catch {
-        // Best-effort heartbeat, matching touchSession().
+        // Best-effort: a briefly-locked database must not fail the tool call this
+        // piggybacks on. The throttle entry already advanced, so failures back off
+        // to the next interval; a PersonaLostError lands here too, and the next
+        // real operation reports the loss to the caller.
     }
 }
 const DEV_BUILD = {
@@ -484,25 +554,8 @@ function buildStatus() {
         latest_artifact_hash: latest?.artifact_hash ?? null,
     };
 }
-/**
- * Build identity for a WATCHER HANDOFF.
- *
- * A poller command is unlike every other response this server produces: the
- * caller takes it OUT of the MCP session and runs it as a separate process
- * against the same database, for up to a day. That process is `dist/poller.js`
- * as it exists ON DISK at launch, not the code this server loaded at startup, so
- * the two can be different builds -- and the handoff is the only moment where
- * saying so costs nothing. Every response carrying a poller_cmd states which
- * build minted it and, when a newer one is on disk, what that one is.
- *
- * The command is returned REGARDLESS of staleness, and nothing here fails on it.
- * Withholding the only out-of-turn watching mechanism because a rebuild landed
- * would trade a working watcher for a warning; the caller is told, and decides.
- *
- * Deliberately NOT a poller protocol version: a version number would be a second
- * compatibility surface to maintain, and the artifact hash already answers the
- * only question anyone can act on -- is the disk the same code I am.
- */
+/** Disclose the loaded build at identity and watcher handoff points. A stdio
+ * server never hot-reloads; a launched poller reads the current on-disk dist. */
 function handoffBuild() {
     const status = buildStatus();
     return {
@@ -526,10 +579,10 @@ function handoffBuild() {
             : {}),
         ...(status.stale
             ? {
-                reconnect_guidance: "a newer build is on disk than this server is running. The command " +
-                    "above still works -- use it. Reconnect the MCP when convenient so " +
-                    "the tools and the watcher come from one build (stdio servers do " +
-                    "not hot-reload).",
+                reconnect_guidance: "a newer build is on disk than this server is running. Reconnecting " +
+                    "loads it; the next identify_persona call creates a new identity. " +
+                    "Any poller_cmd or membership state already returned belongs to the " +
+                    "old identity. The stdio server does not hot-reload.",
             }
             : {}),
     };
@@ -627,7 +680,7 @@ server.registerTool = ((name, config, callback) => {
 // store asserts; keep them in sync when either changes.
 const LIMITS = {
     message_body_max_bytes: MAX_MESSAGE_BODY_BYTES,
-    mcp_stdio_frame_max_bytes: MAX_MCP_FRAME_BYTES,
+    mcp_stdio_line_content_max_bytes: MAX_MCP_FRAME_BYTES,
     bulk_read_default_budget_chars: DEFAULT_MAX_BYTES,
     max_bytes_range: [1000, 400_000],
     get_message_max_chars_range: [100, 400_000],
@@ -641,6 +694,7 @@ const LIMITS = {
         read_history: 50,
         my_mentions: 50,
         search_messages: 20,
+        pending_work: 50,
         listings: 200,
     },
     metadata_caps_chars: {
@@ -651,7 +705,6 @@ const LIMITS = {
         persona_brand: 100,
         persona_model: 100,
         persona_version: 100,
-        resume_word: 200,
         room_role: 200,
         agent_description: 2000,
         claim_key: 500,
@@ -739,18 +792,11 @@ server.registerTool("create_room", {
 }, async ({ name, description, pinned }) => {
     try {
         touchSession();
-        const { agentId, epoch } = requirePersona();
-        // Room references are resolved id-first (resolveRoom), so an all-digit
-        // name would be shadowed by any room with that numeric id -- and
-        // delete_room resolves the same way, making the ambiguity destructive.
-        if (/^\d+$/.test(name)) {
-            return fail("room names cannot be all digits (ambiguous with room ids); " +
-                "pick a descriptive kebab-case topic name");
-        }
+        const { agentId } = requirePersona();
         if (store.getRoomByName(name)) {
             return fail(`a room named "${name}" already exists`);
         }
-        const room = store.createRoom(name, description ?? null, pinned ?? null, agentId, epoch);
+        const room = store.createRoom(name, description ?? null, pinned ?? null, agentId);
         return ok({ room_id: room.id, name: room.name });
     }
     catch (e) {
@@ -804,19 +850,20 @@ server.registerTool("list_rooms", {
         return failFrom(e);
     }
 });
-server.registerTool("create_persona", {
-    title: "Create persona",
-    description: "Create a NEW persona and bind it to this runtime. brand/model/version " +
-        "are immutable and identify what you are (e.g. 'anthropic'/'claude-opus'/" +
-        "'5'); the server derives the canonical id from them. Returns `agent_id` " +
-        "and `resume_word`: SAVE BOTH. The resume word is the only way a later " +
-        "runtime can take this persona back with its rooms, read positions, " +
-        "roles, and claims intact, and MCP returns it ONCE and never again. " +
-        "Losing it does not hide any room's history, which any persona can " +
-        "still read; what it costs is RESUMING this persona -- its memberships, " +
-        "read markers, roles, and claims -- so the only remedy is a new persona " +
-        "starting from scratch. If you already have an id and word, call " +
-        "resume_persona instead.",
+server.registerTool("identify_persona", {
+    title: "Identify persona",
+    description: "Declare what you ARE. The server allocates and returns your nickname; " +
+        "you cannot choose, submit, or recover one. Send your actual brand, " +
+        "model, and COMPLETE version string (version is text: keep a known " +
+        "'.0', and never send it as a JSON number). Repeating the exact same " +
+        "tuple on this MCP process is idempotent and returns the same nickname. " +
+        "Changing ANY tuple field allocates a new nickname and TERMINALLY " +
+        "retires the old one, which keeps its history but can never post, " +
+        "advance a read marker, " +
+        "claim, or return. Restarting the MCP process always produces a new " +
+        "nickname, so do not save one for reuse. Model identity is " +
+        "self-declared: the server stores what you say and does not verify it. " +
+        "Call this before create_room or join_room.",
     inputSchema: z.object({
         brand: z
             .string()
@@ -832,169 +879,113 @@ server.registerTool("create_persona", {
             .string()
             .min(1)
             .max(100)
-            .describe("Model version, e.g. '5', '4.5'"),
+            .describe("Model version AS A STRING, e.g. '5', '4.5', '5.0'. Compared " +
+            "exactly: '5.0' and '5' are different models to this server."),
         description: z
             .string()
             .max(2000)
             .optional()
-            .describe("Short description of who you are / what you do"),
+            .describe("Short description of who you are / what you do. Recorded when an " +
+            "identity is created; re-identifying does not rewrite it."),
     }).strict(),
 }, async ({ brand, model, version, description }) => {
     try {
-        if (session.agentId !== null) {
-            return fail(`this runtime already holds persona "${session.agentId}"; one runtime ` +
-                "holds one persona. Reconnect the MCP to start a fresh runtime.");
-        }
-        const { id, resumeWord } = createPersona(brand, model, version, description ?? null);
-        // A freshly created persona is at epoch 1 by construction (the column
-        // default), and this runtime created it, so it is the holder.
-        session.agentId = id;
-        session.epoch = 1;
-        return ok({
-            agent_id: id,
-            resume_word: resumeWord,
-            brand,
-            model,
-            version,
-            // persona_description, never a bare `description`: every persona
-            // response uses one name for this string so it can never be read as
-            // the room's.
-            persona_description: description ?? null,
-            runtime_epoch: 1,
-            save_this: "Store agent_id and resume_word now. resume_word is shown only here " +
-                "and cannot be recovered or reset; without it this persona's history " +
-                "is unreachable from any future runtime.",
-            next: "join_room to enter a room.",
-            server_stale: buildStatus().stale,
-        });
-    }
-    catch (e) {
-        return failFrom(e);
-    }
-});
-server.registerTool("resume_persona", {
-    title: "Resume persona",
-    description: "Bind an EXISTING persona to this runtime, recovering its rooms, read " +
-        "positions, room-local roles, and claims. Requires the agent_id, its " +
-        "resume_word, and brand/model/version matching what it was created with. " +
-        "The latest valid resume WINS: any older runtime still holding this " +
-        "persona is fenced out immediately and its next write fails with " +
-        "persona_lost. Re-calling this from the runtime that already holds the " +
-        "persona is a no-op and does not fence anything.",
-    inputSchema: z.object({
-        agent_id: z
-            .string()
-            .min(1)
-            .max(200)
-            .describe("The persona id returned by create_persona"),
-        resume_word: z
-            .string()
-            .min(1)
-            .max(200)
-            .describe("The resume word returned by create_persona"),
-        brand: z.string().min(1).max(100).describe("Must match the persona's brand"),
-        model: z.string().min(1).max(100).describe("Must match the persona's model"),
-        version: z
-            .string()
-            .min(1)
-            .max(100)
-            .describe("Must match the persona's version"),
-    }).strict(),
-}, async ({ agent_id, resume_word, brand, model, version }) => {
-    try {
-        // A runtime may not silently switch personas: binding a second one would
-        // leave the first still bound in every caller's mental model while this
-        // process quietly acted as someone else.
-        if (session.agentId !== null && session.agentId !== agent_id) {
-            return fail(`this runtime already holds persona "${session.agentId}"; it cannot ` +
-                `switch to "${agent_id}". Reconnect the MCP to start a fresh runtime.`);
-        }
-        // IDEMPOTENT re-attach: this runtime already holds the persona AND its
-        // epoch is still current, so there is nothing to take over. Skipping the
-        // increment matters -- incrementing here would invalidate this runtime's
-        // OWN outstanding pollers and open waits for no reason.
-        //
-        // ONE row read decides both questions. Asking currentEpoch() and then
-        // getPersona() in separate autocommits leaves a window where a takeover
-        // lands between them, and the "still current" branch would then answer
-        // with this runtime's dead epoch while another runtime already holds the
-        // persona -- a false all-clear at the one moment the caller needed the
-        // truth. Reading epoch and credentials from the same snapshot removes the
-        // window: if the epoch on THIS row is ours, these credentials are the ones
-        // that were current when the epoch was.
-        const held = session.agentId === agent_id && session.epoch !== null
-            ? store.getPersona(agent_id)
-            : undefined;
-        if (held && held.runtime_epoch === session.epoch) {
-            // Validate the credentials even though nothing is being taken over. The
-            // obvious use of this call is a holder CHECKING that the word it wrote
-            // down still works, and returning success without looking would confirm
-            // a mistranscribed word -- discovered only after a crash, when it is the
-            // one thing that cannot be recovered. Validation here never increments,
-            // so a holder can re-verify as often as it likes without fencing itself.
-            // Same split as attachPersona: the word is the credential, the tuple is
-            // identity. A holder re-verifying with a changed model must get the
-            // new_persona_required answer here too, not a credential rejection --
-            // this branch is the one a long-running runtime hits most.
-            if (held.resume_word !== resume_word) {
-                return fail(`resume rejected for persona "${agent_id}": the resume word does ` +
-                    `not match the one it was created with. This runtime still holds ` +
-                    `the persona -- nothing was fenced -- but this word would NOT ` +
-                    `recover it later.`);
+        // Everything that mutates process identity happens synchronously here,
+        // before any await, for the same reason the other handlers bind their
+        // state up front: MCP requests can be dispatched concurrently, and a
+        // later call must not capture a half-replaced identity.
+        const allocator = personaIdAllocator(brand, model, version);
+        let result;
+        // BOUNDED. A first-bind nonce clash is astronomically improbable with
+        // randomUUID, but an unbounded retry here would be an unthrottled loop
+        // generating UUIDs and hitting SQLite: if the clash were ever systematic
+        // rather than random, this would spin the host instead of failing. A
+        // small bound turns that into a clean error.
+        const MAX_NONCE_ATTEMPTS = 5;
+        for (let attempt = 1;; attempt++) {
+            try {
+                result = store.identifyPersona({
+                    connectionId,
+                    brand,
+                    model,
+                    version,
+                    description: description ?? null,
+                    expected: expectedBinding(),
+                    nextCandidateId: allocator,
+                });
+                break;
             }
-            if (held.brand !== brand ||
-                held.model !== model ||
-                held.version !== version) {
-                return failFrom(new ModelTupleMismatchError(agent_id, {
-                    brand: held.brand,
-                    model: held.model,
-                    version: held.version,
-                }, { brand, model, version }, store.presentRoomNames(agent_id)));
+            catch (e) {
+                // A nonce this process generated is already on a row, and this
+                // process has not bound anything, so that row belongs to someone
+                // else. Draw another nonce and retry rather than adopt it. Only
+                // reachable while unbound: the store rejects a mismatched binding
+                // outright once `bound` is true.
+                if (e instanceof ConnectionNonceCollisionError && !session.bound) {
+                    if (attempt >= MAX_NONCE_ATTEMPTS) {
+                        // Deliberately does NOT echo the nonce: it is internal, and a
+                        // response is exactly where it must not appear.
+                        throw new Error(`could not obtain an unused connection identifier after ` +
+                            `${MAX_NONCE_ATTEMPTS} attempts; no identity was created`);
+                    }
+                    diag("connection_nonce_collision", { attempt });
+                    connectionId = randomUUID();
+                    continue;
+                }
+                throw e;
             }
-            return ok({
-                agent_id,
-                runtime_epoch: session.epoch,
-                brand: held.brand,
-                model: held.model,
-                version: held.version,
-                persona_description: held.description,
-                reattached: true,
-                note: "already bound to this runtime; nothing was fenced. The resume " +
-                    "word and metadata were validated: they will recover this persona.",
-                poller_cmd: pollerCmd(agent_id, { epoch: session.epoch }),
-                ...handoffBuild(),
-            });
         }
-        const { epoch, persona } = store.attachPersona({
-            id: agent_id,
-            resumeWord: resume_word,
+        session.agentId = result.persona.id;
+        session.bound = true;
+        if (result.identityChanged) {
+            // A replacement inherits NOTHING runtime-local. The old active room
+            // was the old identity's view, and the new persona is not a member of
+            // it.
+            session.roomId = null;
+        }
+        diag(result.identityChanged
+            ? "identify_transitioned"
+            : result.bindingReused
+                ? "identify_reused"
+                : "identify_created", {
+            agent_id: result.persona.id,
             brand,
             model,
             version,
+            previous_agent_id: result.previousAgentId ?? null,
         });
-        const previous = session.agentId === agent_id ? session.epoch : null;
-        session.agentId = agent_id;
-        session.epoch = epoch;
-        // The active room does NOT survive a takeover: room membership is durable
-        // but "which room am I looking at" is runtime-local state this runtime
-        // never had. Rejoin explicitly.
-        session.roomId = null;
         return ok({
-            agent_id,
-            runtime_epoch: epoch,
-            brand: persona.brand,
-            model: persona.model,
-            version: persona.version,
-            persona_description: persona.description,
-            reattached: false,
-            ...(previous !== null ? { previous_epoch: previous } : {}),
-            fenced: "any runtime holding this persona at an earlier epoch is now fenced " +
-                "out; its pollers exit and its next write fails with persona_lost",
-            // Old poller commands carry the OLD epoch and will exit as stale. Hand
-            // back a live one in the same response so the caller is never left
-            // silently deaf holding a command that can no longer fire.
-            poller_cmd: pollerCmd(agent_id, { epoch }),
-            next: "join_room to enter a room; memberships and read positions are intact.",
+            agent_id: result.persona.id,
+            brand: result.persona.brand,
+            model: result.persona.model,
+            version: result.persona.version,
+            // persona_description, never a bare `description`: every persona
+            // response uses one name for this string so it can never be read as
+            // the room's.
+            persona_description: result.persona.description,
+            binding_reused: result.bindingReused,
+            identity_changed: result.identityChanged,
+            ...(result.previousAgentId !== undefined
+                ? {
+                    previous_agent_id: result.previousAgentId,
+                    previous_room_count: result.previousRoomCount,
+                    previous_room_names: result.previousRoomNames,
+                    previous_room_names_truncated: result.previousRoomNamesTruncated,
+                    previous_retired: true,
+                    previous_retired_note: "the previous nickname is terminally retired: its messages and " +
+                        "membership history stand, but it cannot post, advance a read " +
+                        "marker, claim, or " +
+                        "return. Its wait leases are removed and its pollers and open " +
+                        "waits are fenced and will exit on their next probe. " +
+                        "Nothing is forwarded -- rejoin the rooms you still need and " +
+                        "tell them the seat changed model.",
+                }
+                : {}),
+            // A new persona has no memberships, so its poller would exit 2.
+            // join_room returns the first usable command.
+            next: result.identityChanged
+                ? "join_room to re-enter any room you still need; this identity has no memberships."
+                : "create_room or join_room to enter a room.",
             ...handoffBuild(),
         });
     }
@@ -1005,7 +996,7 @@ server.registerTool("resume_persona", {
 server.registerTool("join_room", {
     title: "Join room",
     description: "Join a room (id or name) and make it active for this runtime. Requires " +
-        "a bound persona (create_persona or resume_persona first). Returns your " +
+        "a bound persona (identify_persona first). Returns your " +
         "persona (brand/model/version, persona_description) alongside the room " +
         "(room_name, room_description, pinned) and your room-local `role`. " +
         "Rejoining RESUMES your read position; `cursor_start` only applies the " +
@@ -1036,12 +1027,12 @@ server.registerTool("join_room", {
 }, async ({ room, role, cursor_start }) => {
     try {
         touchSession();
-        const { agentId, epoch } = requirePersona();
+        const { agentId } = requirePersona();
         const target = store.resolveRoom(room);
         if (!target) {
             return fail(`no room "${room}". Use list_rooms to see options or create_room to make one.`);
         }
-        const { created } = store.joinRoom(target.id, agentId, epoch, {
+        const { created } = store.joinRoom(target.id, agentId, {
             cursorStart: cursor_start,
             role,
         });
@@ -1054,7 +1045,8 @@ server.registerTool("join_room", {
             // The room was deleted by another process between our join and this
             // read; same recovery contract as requireActive.
             session.roomId = null;
-            return fail(`room "${target.name}" was deleted while joining; rejoin with join_room`);
+            return fail(`room "${target.name}" was deleted while joining; use list_rooms ` +
+                "to see what remains, or create_room to make a new one");
         }
         const persona = store.getPersona(agentId);
         return ok({
@@ -1082,8 +1074,18 @@ server.registerTool("join_room", {
             unread: store.unreadCount(target.id, cur.last_read_seq, agentId),
             members: store.presentCount(target.id),
             // Ready-to-run background poller invocation, shell-quoted for THIS
-            // persona and bound to the current epoch (see the server instructions).
-            poller_cmd: pollerCmd(agentId, { epoch }),
+            // persona (see the server instructions).
+            poller_cmd: pollerCmd(agentId),
+            next: "call catch_up until it returns `remaining: 0` or the value stops " +
+                "falling; then run poller_cmd as a background task before starting " +
+                "work. The watcher checks immediately, so unread traffic makes it " +
+                "exit immediately. This MCP server returns the command but cannot " +
+                "launch it.",
+            presence_note: "active = recent MCP or poller contact, or a live blocking wait. " +
+                "watching = only a live blocking wait; detached pollers do not set " +
+                "it. A silent agent may be working or waiting for its client to " +
+                "surface an exited watcher. True does not prove a model is reading " +
+                "or will wake.",
             // Build identity rides with the command, at the session-start
             // checkpoint where it is seen once without per-call noise.
             ...handoffBuild(),
@@ -1119,8 +1121,8 @@ server.registerTool("set_role", {
 }, async ({ role, room }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId, roomName } = resolveJoinedRoom(room);
-        store.setRole(roomId, agentId, epoch, role);
+        const { agentId, roomId, roomName } = resolveTargetRoom(room);
+        store.setRole(roomId, agentId, role);
         return ok({
             agent_id: agentId,
             room_id: roomId,
@@ -1142,8 +1144,8 @@ server.registerTool("leave_room", {
 }, async () => {
     try {
         touchSession();
-        const { agentId, epoch, roomId } = requireActive();
-        const left = store.leaveRoom(roomId, agentId, epoch);
+        const { agentId, roomId } = requireActive();
+        const left = store.leaveRoom(roomId, agentId);
         // Keep the persona bound: the runtime is still this persona, and
         // my_mentions (memberships elsewhere) must keep working after leaving one
         // room. The membership row survives too, so its read position and role
@@ -1158,8 +1160,10 @@ server.registerTool("leave_room", {
 server.registerTool("whoami", {
     title: "Who am I",
     description: "Report this runtime's bound persona (agent_id, brand/model/version, " +
-        "persona_description, runtime_epoch), its active room if any, and " +
-        "`persona_lost` when a newer runtime has taken the persona over. The " +
+        "persona_description), its active room if any, and " +
+        "`persona_lost` when this binding has been lost -- the row is gone, the " +
+        "identity was terminally retired, or this binding no longer describes " +
+        "it. The " +
         "PERSONA fields are reported whether or not a room is active, because " +
         "'which identity am I' is the question this tool exists to answer; the " +
         "room fields (room_id, room_name, room_description, role, last_read_seq, " +
@@ -1168,15 +1172,14 @@ server.registerTool("whoami", {
 }, async () => {
     try {
         touchSession();
-        if (session.agentId === null || session.epoch === null) {
+        if (session.agentId === null) {
             return ok({ bound: false, joined: false });
         }
         const agentId = session.agentId;
-        const epoch = session.epoch;
         const persona = store.getPersona(agentId);
         // The persona block is UNCONDITIONAL once a persona is bound. Reporting
         // only joined:false and an id when no room is active hid the brand,
-        // model, version, epoch and the loss state -- exactly the facts a runtime
+        // model, version and the loss state -- exactly the facts a runtime
         // that has just been fenced, or has just left a room, needs to see.
         const identity = {
             bound: true,
@@ -1185,8 +1188,7 @@ server.registerTool("whoami", {
             model: persona?.model ?? null,
             version: persona?.version ?? null,
             persona_description: persona?.description ?? null,
-            runtime_epoch: epoch,
-            ...lossDisclosure(agentId, epoch),
+            ...lossDisclosure(agentId),
         };
         if (session.roomId === null) {
             return ok({ ...identity, joined: false });
@@ -1199,7 +1201,8 @@ server.registerTool("whoami", {
             return ok({
                 ...identity,
                 joined: false,
-                note: "active room was deleted; rejoin",
+                note: "active room was deleted; use list_rooms to see what remains, " +
+                    "or create_room to make a new one",
             });
         }
         const cur = store.getCursor(session.roomId, agentId);
@@ -1229,7 +1232,11 @@ server.registerTool("list_agents", {
         "not an acknowledgement or delivery guarantee). `last_seen`/`idle_seconds`/" +
         "`active` measure LISTENER recency -- an MCP call or an armed watcher's " +
         "two-minute heartbeat -- so they say a runtime is reachable, NOT that the " +
-        "model is reading or able to wake; `watching` is the stronger claim. Long " +
+        "model is reading or able to wake; `watching` is the stronger claim. " +
+        "`retired` marks a terminally retired LLM identity: its membership row " +
+        "remains as history, and the row is forced to present:false, " +
+        "active:false, watching:false because it can never participate again. " +
+        "Long " +
         "descriptions are listing previews (description_truncated). " +
         "`next_after` present = more rows exist; page by passing it back as " +
         "`after` (keyset paging, so a concurrent join cannot make you skip or " +
@@ -1264,10 +1271,10 @@ server.registerTool("list_agents", {
 }, async ({ filter, active_within_minutes, limit, after }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId } = requireActive();
+        const { agentId, roomId } = requireActive();
         const { agents, total, next_after, size_trimmed } = store.listAgents(roomId, active_within_minutes ?? 5, filter, limit ?? 200, after);
         return ok({
-            ...lossDisclosure(agentId, epoch),
+            ...lossDisclosure(agentId),
             agents,
             total,
             ...(next_after !== undefined ? { next_after, truncated: true } : {}),
@@ -1399,36 +1406,16 @@ server.registerTool("post_message", {
             return fail("pass either room (explicit target) or expected_room (active-room " +
                 "assertion), not both");
         }
-        let agentId;
-        let epoch;
-        let roomId;
-        let roomName;
-        if (room !== undefined) {
-            // Explicit target: same membership rule as catch_up({room}).
-            ({ agentId, epoch } = requirePersona());
-            const target = store.resolveRoom(room);
-            if (!target) {
-                return fail(`no room "${room}". Use list_rooms to see options.`);
+        const { agentId, roomId, roomName } = resolveTargetRoom(room);
+        if (room === undefined && expected_room !== undefined) {
+            const expect = store.resolveRoom(expected_room);
+            if (!expect || expect.id !== roomId) {
+                return fail(`expected_room "${expected_room}" does not match the active room ` +
+                    `(${roomId} "${roomName}"); nothing was posted. ` +
+                    "Pass room: to target a specific room, or join_room it first.");
             }
-            if (!store.getMembership(target.id, agentId)) {
-                return fail(`you have never joined room "${target.name}"; join_room it before posting there`);
-            }
-            roomId = target.id;
-            roomName = target.name;
         }
-        else {
-            ({ agentId, epoch, roomId } = requireActive());
-            roomName = store.getRoom(roomId)?.name ?? null;
-            if (expected_room !== undefined) {
-                const expect = store.resolveRoom(expected_room);
-                if (!expect || expect.id !== roomId) {
-                    return fail(`expected_room "${expected_room}" does not match the active room ` +
-                        `(${roomId}${roomName ? ` "${roomName}"` : ""}); nothing was posted. ` +
-                        "Pass room: to target a specific room, or join_room it first.");
-                }
-            }
-        }
-        touchCapturedRoom(roomId, agentId, epoch);
+        touchCapturedRoom(roomId, agentId);
         const isText = typeof content === "string";
         // Validate structured strings DURING serialization, before JSON.stringify
         // escapes lone surrogates to harmless-looking ASCII. The store validates
@@ -1440,7 +1427,7 @@ server.registerTool("post_message", {
             return fail(`message body exceeds the ${MAX_MESSAGE_BODY_BYTES}-byte safety limit`);
         }
         const mentions = to && to.length > 0 ? dedupe(to) : null;
-        const res = store.postMessage(roomId, agentId, body, isText ? "text" : "json", mentions, reply_to_seq ?? null, supersedes_seq ?? null, epoch, {
+        const res = store.postMessage(roomId, agentId, body, isText ? "text" : "json", mentions, reply_to_seq ?? null, supersedes_seq ?? null, {
             ifLastReadSeq: if_last_read_seq ?? null,
             crossedPreviewChars: crossed_preview_chars,
             recipientActiveWithinMinutes: mentions ? 5 : undefined,
@@ -1495,10 +1482,10 @@ server.registerTool("post_message", {
         }
         const { seq, crossed, crossed_directed, crossed_range } = res;
         const recipients = res.recipients ?? [];
-        // Loud but factual delivery state. Unknown/left are definitive routing
-        // facts. Room-local idleness is not a responsiveness prediction, so it
-        // is mentioned only when older backlog already existed; seq-1 is the
-        // pre-insert room maximum and costs no extra query.
+        // Loud but factual delivery state. Unknown/left/retired are definitive
+        // routing facts. Room-local idleness is not a responsiveness prediction,
+        // so it is mentioned only when older backlog already existed; seq-1 is
+        // the pre-insert room maximum and costs no extra query.
         //
         // The idle arm measures last_seen, which an ARMED WATCHER refreshes every
         // two minutes. So this warning cannot fire for a seat with a live
@@ -1516,6 +1503,11 @@ server.registerTool("post_message", {
                         : `${r.id}: left this room; the message waits unread unless they return`,
                 ];
             }
+            if (r.status === "retired") {
+                return [
+                    `${r.id}: terminally retired; the tag reaches no one and this identity can never return`,
+                ];
+            }
             if (r.watching)
                 return [];
             const priorMarkerBehind = r.last_read_seq === null ? 0 : Math.max(0, seq - 1 - r.last_read_seq);
@@ -1650,36 +1642,14 @@ server.registerTool("catch_up", {
         // dispatch can mutate `session` (the persona binding, the active room)
         // while a wait sleeps, so everything below runs off these captured
         // values.
-        let agentId;
-        let epoch;
-        let roomId;
-        let roomName;
-        if (room !== undefined) {
-            // Cross-room read: the ACTIVE room stays untouched. Requires an
-            // existing membership (a never-joined room has no read position to
-            // advance); a soft-left room stays readable -- naming it is the intent
-            // to read it (parity with the scoped poller watch).
-            ({ agentId, epoch } = requirePersona());
-            const target = store.resolveRoom(room);
-            if (!target) {
-                return fail(`no room "${room}". Use list_rooms to see options.`);
-            }
-            if (!store.getMembership(target.id, agentId)) {
-                return fail(`you have never joined room "${target.name}", so there is no read position to advance; join_room it first`);
-            }
-            roomId = target.id;
-            roomName = target.name;
-        }
-        else {
-            ({ agentId, epoch, roomId } = requireActive());
-            roomName = store.getRoom(roomId)?.name ?? null;
-        }
-        touchCapturedRoom(roomId, agentId, epoch);
+        // An explicit room leaves the active room unchanged.
+        const { agentId, roomId, roomName } = resolveTargetRoom(room);
+        touchCapturedRoom(roomId, agentId);
         const signal = extra?.signal;
         // max_bytes bounds the COMPLETE JSON text returned to the MCP client,
-        // not merely ChatStore.catchUp's inner object. v0.9 added routing fields
-        // and v0.10 added wait fields after the store had spent the full budget;
-        // an advancing page could then be rejected after its marker committed.
+        // not merely ChatStore.catchUp's inner object. Routing and optional wait
+        // fields sit outside that store result; without reserving them, an
+        // advancing page could be rejected after its marker committed.
         // Reserve their exact serialized cost BEFORE the advancing transaction.
         const responseIdentity = {
             agent_id: agentId,
@@ -1709,15 +1679,15 @@ server.registerTool("catch_up", {
             ...result,
             ...extraFields,
         });
-        const advancingRead = (includeUnreadSummary) => store.catchUp(roomId, agentId, limit ?? 50, preview_chars, storeMaxBytes, epoch, 
+        const advancingRead = (includeUnreadSummary) => store.catchUp(roomId, agentId, limit ?? 50, preview_chars, storeMaxBytes, 
         // rooms_with_unread on an empty read.
         includeUnreadSummary
             ? { priorityOnly: priority_only === true }
             : null);
-        // A takeover is the only way this call's authority can change under it.
-        // Every advancingRead re-verifies the captured epoch inside its own
-        // transaction, so a fenced read throws persona_lost rather than consuming
-        // from a position this call did not capture.
+        // Retirement is the only way this call's authority can change under it.
+        // Every advancingRead re-verifies the captured identity's live state
+        // inside its own transaction, so a fenced read throws persona_lost rather
+        // than consuming from a position this call did not capture.
         const roomDeletedResult = (duringWait = false) => {
             // A delete racing the active-room read invalidates that active route.
             // Do not clear a different room selected by a concurrent join, nor the
@@ -1725,7 +1695,7 @@ server.registerTool("catch_up", {
             if (session.roomId === roomId && session.agentId === agentId) {
                 session.roomId = null;
             }
-            return fail(`room "${roomName ?? roomId}" was deleted while ${duringWait ? "waiting" : "reading"}; nothing was read. list_rooms shows what still exists.`);
+            return fail(`room "${roomName}" was deleted while ${duringWait ? "waiting" : "reading"}; nothing was read. list_rooms shows what still exists.`);
         };
         // Abort boundary rule for everything below: once an abort has been
         // observed, NO advancing transaction may run.
@@ -1752,13 +1722,13 @@ server.registerTool("catch_up", {
         // Presence lease: when its best-effort write succeeds, `watching`
         // records that this call was open. TTL bounds a hard-kill ghost; a lease
         // failure must not break the wait (the probe surfaces a deleted room).
-        // The lease is keyed by persona and carries the epoch CAPTURED here, so
-        // the cleanup in the finally below can only ever delete this call's own
-        // row -- never one a takeover wrote after fencing this call out.
-        const leaseKey = `${roomKey(roomId, agentId)}\u0000${epoch}`;
+        // Keyed by persona and room. An agent_id has exactly one tenure, so the
+        // cleanup in the finally below can only ever reach this identity's own
+        // row; a successor identity is a DIFFERENT id with its own key.
+        const leaseKey = roomKey(roomId, agentId);
         openWaits.set(leaseKey, (openWaits.get(leaseKey) ?? 0) + 1);
         try {
-            store.beginWaitLease(roomId, agentId, epoch, waitSeconds + WAIT_LEASE_GRACE_SECONDS);
+            store.beginWaitLease(roomId, agentId, waitSeconds + WAIT_LEASE_GRACE_SECONDS);
         }
         catch { }
         try {
@@ -1773,16 +1743,16 @@ server.registerTool("catch_up", {
                     break;
                 // Self-throttled heartbeat: a genuinely-waiting agent reads as
                 // `active` to peers instead of indistinguishable from a dormant one.
-                touchCapturedRoom(roomId, agentId, epoch);
+                touchCapturedRoom(roomId, agentId);
                 let unread;
                 try {
-                    // Epoch-fenced: a takeover surfaces here, within one probe
-                    // interval, instead of waiting for traffic or the deadline.
-                    unread = store.unreadProbe(roomId, agentId, epoch);
+                    // Fenced: a retirement surfaces here, within one probe interval,
+                    // instead of waiting for traffic or the deadline.
+                    unread = store.unreadProbe(roomId, agentId);
                 }
                 catch (e) {
                     // A lost persona is NOT a deleted room. Rethrow it before the
-                    // room-existence fallback, or a takeover would be reported as
+                    // room-existence fallback, or a retirement would be reported as
                     // "the room was deleted".
                     if (e instanceof PersonaLostError)
                         throw e;
@@ -1839,7 +1809,7 @@ server.registerTool("catch_up", {
             else {
                 openWaits.delete(leaseKey);
                 try {
-                    store.endWaitLease(roomId, agentId, epoch);
+                    store.endWaitLease(roomId, agentId);
                 }
                 catch { }
             }
@@ -1901,10 +1871,10 @@ server.registerTool("my_mentions", {
         // my_mentions needs a PERSONA but no active room: it reads across every
         // room the persona is present in, which is exactly what makes it usable
         // after a leave. So the remedy is binding, not joining.
-        const { agentId, epoch } = requirePersona();
+        const { agentId } = requirePersona();
         // Reserve the disclosure's exact serialized cost BEFORE the bounded read,
         // so a caller's max_bytes still holds on the fenced path.
-        const lost = lossDisclosure(agentId, epoch);
+        const lost = lossDisclosure(agentId);
         const requested = max_bytes ?? DEFAULT_MAX_BYTES;
         const reserve = disclosureReserve(lost);
         return ok({
@@ -1965,7 +1935,8 @@ server.registerTool("pending_work", {
 });
 server.registerTool("wait_for_messages", {
     title: "Wait for new messages (background poller)",
-    description: "Return (do not run) one childless background poller command. It watches " +
+    description: "Returns one childless background poller command for YOU to run as a " +
+        "background task; this server does not execute it. It watches " +
         "all joined rooms or one `room`; `mentions_only` narrows it. Generated " +
         "commands exit 0 on hit or quiet deadline: parse stdout `has_updates`. " +
         "Use catch_up({wait_seconds}) for an in-turn blocking read.",
@@ -2003,16 +1974,15 @@ server.registerTool("wait_for_messages", {
 }, async ({ room, mentions_only, timeout, interval }) => {
     try {
         touchSession();
-        const { agentId, epoch } = requirePersona();
-        // Check the binding BEFORE handing out a command. The poller keeps its
-        // own per-probe epoch check for a takeover that lands after generation,
-        // but a command minted for an already-dead epoch is a command that can
-        // only ever exit stale_binding, and returning one sends the caller off to
-        // arm a watcher instead of telling it the thing it needs to know.
-        const current = store.currentEpoch(agentId);
-        if (current !== epoch) {
-            return failFrom(new PersonaLostError(agentId, epoch, current));
-        }
+        const { agentId } = requirePersona();
+        // Check the binding with one indexed primary-key lookup BEFORE handing out
+        // a command. The poller keeps its own per-probe check for a retirement
+        // that lands after generation, but a command minted for an already-dead
+        // identity can only exit retired_identity. Refuse it here instead of
+        // sending the caller away to arm a watcher that cannot run.
+        const loss = store.personaLoss({ agentId, connectionId });
+        if (loss !== null)
+            return failFrom(new PersonaLostError(agentId, loss));
         let roomArg;
         if (room !== undefined) {
             // PRESENT membership required, not merely an existing row. A watcher on
@@ -2035,15 +2005,21 @@ server.registerTool("wait_for_messages", {
             }
             roomArg = String(target.id);
         }
-        else if (store.presentRoomCount(agentId) === 0) {
-            // Unscoped watch of ALL your rooms, but you are in none: the poller
-            // would exit 2 immediately. Say so rather than emit a doomed command.
-            return fail("you are not present in any room, so there is nothing to watch; join_room first, or pass a room you have joined");
+        else {
+            const memberships = store.roomMembershipCounts(agentId);
+            if (memberships.total === 0) {
+                return fail("no_room_memberships: you have not joined any existing room, so " +
+                    "there is nothing to watch; use list_rooms and join_room first");
+            }
+            if (memberships.present === 0) {
+                return fail("left_all_rooms: you have LEFT every room you joined, so there is " +
+                    "nothing to watch; call join_room to rejoin one -- its read " +
+                    "position and role are preserved");
+            }
         }
         const command = pollerCmd(agentId, {
             room: roomArg,
             mentionsOnly: mentions_only,
-            epoch,
             timeoutSec: timeout,
             intervalSec: interval,
         });
@@ -2052,13 +2028,14 @@ server.registerTool("wait_for_messages", {
             run_as: "background process (do not wait for it inline)",
             how_to: "Run `command` in the background. On exit 0, parse stdout: " +
                 "has_updates:true names the room to catch_up; has_updates:false is a " +
-                "normal quiet deadline. Exit 2 is an error/duplicate watcher. Re-arm " +
-                "only if still needed. The exit is only an OS signal; whether it " +
-                "wakes YOU depends on the harness.",
+                "normal quiet deadline. Exit 2 is an error, duplicate watcher, or a " +
+                "terminal room/binding state; inspect stderr before re-arming. The " +
+                "exit is only an OS signal; whether it wakes YOU depends on the harness.",
             exit_codes: {
                 "0": "normal completion; inspect stdout has_updates",
                 "124": "quiet timeout only for direct CLI without --ok-on-timeout",
-                "2": "error or equivalent watcher already running",
+                "2": "error, live-PID watcher lock, retired_identity, left_room, " +
+                    "left_all_rooms, or no_room_memberships; inspect stderr",
             },
             baselined: false,
             single_process: true,
@@ -2110,8 +2087,8 @@ server.registerTool("read_history", {
 }, async ({ limit, before_seq, preview_chars, max_bytes }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId } = requireActive();
-        const lost = lossDisclosure(agentId, epoch);
+        const { agentId, roomId } = requireActive();
+        const lost = lossDisclosure(agentId);
         const requested = max_bytes ?? DEFAULT_MAX_BYTES;
         return ok({
             ...lost,
@@ -2139,8 +2116,8 @@ server.registerTool("mark_read", {
 }, async ({ seq }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId } = requireActive();
-        return ok(store.markRead(roomId, agentId, epoch, seq));
+        const { agentId, roomId } = requireActive();
+        return ok(store.markRead(roomId, agentId, seq));
     }
     catch (e) {
         return failFrom(e);
@@ -2183,13 +2160,13 @@ server.registerTool("get_message", {
 }, async ({ room, seq, offset, max_chars }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId, roomName } = resolveJoinedRoom(room);
-        touchCapturedRoom(roomId, agentId, epoch);
+        const { agentId, roomId, roomName } = resolveJoinedRoom(room);
+        touchCapturedRoom(roomId, agentId);
         const msg = store.getMessage(roomId, seq, offset ?? 0, max_chars);
         if (!msg) {
-            return fail(`no message ${seq} in room "${roomName ?? roomId}"`);
+            return fail(`no message ${seq} in room "${roomName}"`);
         }
-        return ok({ ...lossDisclosure(agentId, epoch), ...msg });
+        return ok({ ...lossDisclosure(agentId), ...msg });
     }
     catch (e) {
         return failFrom(e);
@@ -2230,13 +2207,13 @@ server.registerTool("get_thread", {
 }, async ({ room, seq, max_depth, preview_chars }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId, roomName } = resolveJoinedRoom(room);
-        touchCapturedRoom(roomId, agentId, epoch);
+        const { agentId, roomId, roomName } = resolveJoinedRoom(room);
+        touchCapturedRoom(roomId, agentId);
         const thread = store.getThread(roomId, seq, max_depth ?? 3, preview_chars);
         if (!thread) {
-            return fail(`no message ${seq} in room "${roomName ?? roomId}"`);
+            return fail(`no message ${seq} in room "${roomName}"`);
         }
-        return ok({ ...lossDisclosure(agentId, epoch), ...thread });
+        return ok({ ...lossDisclosure(agentId), ...thread });
     }
     catch (e) {
         return failFrom(e);
@@ -2255,9 +2232,9 @@ server.registerTool("set_room_intro", {
 }, async ({ text }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId } = requireActive();
+        const { agentId, roomId } = requireActive();
         const value = text.length > 0 ? text : null;
-        store.setPinned(roomId, agentId, epoch, value);
+        store.setPinned(roomId, agentId, value);
         return ok({ room_id: roomId, pinned: value });
     }
     catch (e) {
@@ -2291,9 +2268,9 @@ server.registerTool("search_messages", {
 }, async ({ query, limit, offset }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId } = requireActive();
+        const { agentId, roomId } = requireActive();
         return ok({
-            ...lossDisclosure(agentId, epoch),
+            ...lossDisclosure(agentId),
             ...store.searchMessages(roomId, query, limit ?? 20, offset ?? 0),
         });
     }
@@ -2339,12 +2316,12 @@ server.registerTool("claim", {
 }, async ({ room, key, ttl_seconds, note }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId, roomName } = resolveJoinedRoom(room);
-        touchCapturedRoom(roomId, agentId, epoch);
+        const { agentId, roomId, roomName } = resolveTargetRoom(room);
+        touchCapturedRoom(roomId, agentId);
         return ok({
             room_id: roomId,
             room_name: roomName,
-            ...store.claimResource(roomId, key, agentId, epoch, ttl_seconds ?? 900, note ?? null),
+            ...store.claimResource(roomId, key, agentId, ttl_seconds ?? 900, note ?? null),
         });
     }
     catch (e) {
@@ -2368,12 +2345,12 @@ server.registerTool("release_claim", {
 }, async ({ room, key }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId, roomName } = resolveJoinedRoom(room);
-        touchCapturedRoom(roomId, agentId, epoch);
+        const { agentId, roomId, roomName } = resolveJoinedRoom(room);
+        touchCapturedRoom(roomId, agentId);
         return ok({
             room_id: roomId,
             room_name: roomName,
-            ...store.releaseClaim(roomId, key, agentId, epoch),
+            ...store.releaseClaim(roomId, key, agentId),
         });
     }
     catch (e) {
@@ -2416,11 +2393,11 @@ server.registerTool("list_claims", {
 }, async ({ room, limit, after_key }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId, roomName } = resolveJoinedRoom(room);
-        touchCapturedRoom(roomId, agentId, epoch);
+        const { agentId, roomId, roomName } = resolveJoinedRoom(room);
+        touchCapturedRoom(roomId, agentId);
         const { claims, total, next_key, size_trimmed } = store.listClaims(roomId, limit ?? 200, after_key ?? "");
         return ok({
-            ...lossDisclosure(agentId, epoch),
+            ...lossDisclosure(agentId),
             room_id: roomId,
             room_name: roomName,
             claims,
@@ -2455,10 +2432,10 @@ server.registerTool("prune_messages", {
 }, async ({ keep_last, force }) => {
     try {
         touchSession();
-        const { agentId, epoch, roomId } = requireActive();
+        const { agentId, roomId } = requireActive();
         return ok({
             room_id: roomId,
-            ...store.pruneMessages(roomId, agentId, epoch, keep_last, force ?? false),
+            ...store.pruneMessages(roomId, agentId, keep_last, force ?? false),
         });
     }
     catch (e) {
@@ -2480,14 +2457,14 @@ server.registerTool("delete_room", {
 }, async ({ room, confirm }) => {
     try {
         touchSession();
-        const { agentId, epoch } = requirePersona();
+        const { agentId } = requirePersona();
         const target = store.resolveRoom(room);
         if (!target)
             return fail(`no room "${room}"`);
         if (confirm !== true) {
             return fail(`pass confirm:true to delete room ${target.id} ("${target.name}")`);
         }
-        const result = store.deleteRoom(target.id, agentId, epoch);
+        const result = store.deleteRoom(target.id, agentId);
         if (session.roomId === target.id) {
             session.roomId = null; // identity survives; only the room is gone
         }
@@ -2497,39 +2474,6 @@ server.registerTool("delete_room", {
         return failFrom(e);
     }
 });
-// Resume-word vocabulary. Two 26-entry word lists plus a 16-bit number give
-// 26 * 26 * 65536 = ~44 million combinations, which is ample for the ONLY job
-// this word has: making it improbable that an operator who pastes a
-// wrong-but-plausible word lands on a persona that is not theirs. It is not a
-// secret, not a password, and is stored in plain text -- see create_persona's
-// description for the explicit threat model. Every part is drawn from
-// randomBytes (a CSPRNG) rather than Math.random, so two personas created in
-// the same millisecond do not collide.
-const WORD_ADJECTIVES = [
-    "amber", "brisk", "calm", "clever", "cobalt", "copper", "deft", "eager",
-    "fern", "gilded", "hardy", "ivory", "jade", "keen", "lucid", "mellow",
-    "nimble", "olive", "prime", "quiet", "rapid", "sable", "teal", "umber",
-    "vivid", "warm",
-];
-const WORD_NOUNS = [
-    "otter", "falcon", "cedar", "harbor", "lynx", "maple", "comet", "delta",
-    "ember", "fjord", "grove", "heron", "inlet", "kite", "larch", "mesa",
-    "nimbus", "onyx", "pike", "quartz", "ridge", "summit", "tundra", "vale",
-    "willow", "yarrow",
-];
-/** Uniform index into xs, drawn from CSPRNG bytes with rejection sampling so a
- *  non-multiple list length cannot bias the draw. */
-function pick(xs) {
-    const limit = Math.floor(256 / xs.length) * xs.length;
-    for (;;) {
-        const b = randomBytes(1)[0];
-        if (b < limit)
-            return xs[b % xs.length];
-    }
-}
-function makeResumeWord() {
-    return `${pick(WORD_ADJECTIVES)}-${pick(WORD_NOUNS)}-${randomBytes(2).readUInt16BE(0)}`;
-}
 /**
  * Normalize one component of a canonical persona id: lowercase, non-alphanumeric
  * runs collapsed to single hyphens, trimmed. "Claude Opus 4.5" -> "claude-opus-4-5".
@@ -2542,41 +2486,41 @@ function slug(s) {
         .replace(/^-+|-+$/g, "");
 }
 /**
- * Build and atomically claim the canonical persona id
+ * Build a supplier of canonical persona id candidates
  * `brand-model-vversion-shorttoken`.
  *
  * The short token is what makes two personas with the SAME brand/model/version
- * distinguishable -- a common case, since two runtimes of one model routinely
- * work in one room. The claim is atomic (INSERT ... ON CONFLICT DO NOTHING) so
- * two processes drawing the same token cannot both believe they own it and
- * collapse onto a single row, sharing its read marker, memberships, and claims.
+ * distinguishable -- a common case, since two processes of one model routinely
+ * work in one room, and neither can be handed the other's nickname. The token
+ * is NEVER omitted, not even when no matching tuple exists yet, because a
+ * second process with that tuple is normal rather than exceptional.
+ *
+ * The supplier only proposes. Claiming is the store's job, inside the identify
+ * transaction, so a token collision retries under the same transaction that
+ * would otherwise commit half a transition.
  */
-function createPersona(brand, model, version, description) {
+const PERSONA_TOKEN_CHARS = 6;
+function personaIdAllocator(brand, model, version) {
     const parts = [slug(brand), slug(model), `v${slug(version)}`];
     if (parts[0] === "" || parts[1] === "" || parts[2] === "v") {
         throw new Error("brand, model, and version must each contain at least one letter or digit");
     }
-    const base = parts.join("-");
-    // One fixed token width, so a persona id has one shape and the length check
-    // below is exact rather than a bound that holds only while collisions stay
-    // rare.
-    const TOKEN_CHARS = 6;
-    if (base.length + 1 + TOKEN_CHARS > MAX_AGENT_ID_CHARS) {
+    let base = parts.join("-");
+    // `human-` is reserved for web participants. A tuple whose slug lands there
+    // (brand "Human", say) is escaped DETERMINISTICALLY rather than by redrawing
+    // the token: the collision is in the base, so no number of new tokens can
+    // clear it, and a retry loop would spin until it gave up.
+    if (base.startsWith("human-"))
+        base = `llm-${base}`;
+    const full = base.length + 1 + PERSONA_TOKEN_CHARS;
+    if (full > MAX_AGENT_ID_CHARS) {
         throw new Error(`brand/model/version are too long: the canonical persona id ` +
-            `"${base}-<token>" needs ${base.length + 1 + TOKEN_CHARS} characters ` +
+            `"${base}-<token>" needs ${full} characters ` +
             `and the limit is ${MAX_AGENT_ID_CHARS}. Shorten them by at least ` +
-            `${base.length + 1 + TOKEN_CHARS - MAX_AGENT_ID_CHARS} characters ` +
+            `${full - MAX_AGENT_ID_CHARS} characters ` +
             `(punctuation collapses to single hyphens, so it still counts).`);
     }
-    const resumeWord = makeResumeWord();
-    for (let i = 0; i < 40; i++) {
-        const token = randomBytes(TOKEN_CHARS / 2).toString("hex");
-        const id = `${base}-${token}`;
-        if (store.tryCreatePersona({ id, brand, model, version, resumeWord, description })) {
-            return { id, resumeWord };
-        }
-    }
-    throw new Error("could not allocate a persona id after 40 attempts; retry create_persona");
+    return () => `${base}-${randomBytes(PERSONA_TOKEN_CHARS / 2).toString("hex")}`;
 }
 function dedupe(xs) {
     return [...new Set(xs)];
@@ -2606,7 +2550,7 @@ function shutdown(code, message) {
         return shutdownPromise;
     process.exitCode = code;
     if (message)
-        process.stderr.write(`${message}\n`);
+        diag("fatal", { reason: message });
     shutdownPromise = (async () => {
         // Keep a hard bound even if a third-party transport stops honoring close.
         const forcedExit = setTimeout(() => process.exit(code), 3_000);
@@ -2616,6 +2560,33 @@ function shutdown(code, message) {
             // shared store, so EOF cannot leave a wait alive or advance afterward.
             await server.close().catch(() => undefined);
             await Promise.allSettled(activeToolRequests);
+            // Retire this process's identity AFTER in-flight requests have finished
+            // (so nothing is still writing under it) and BEFORE the store closes (so
+            // the transaction can still run). Guarded on the exact agent id and nonce
+            // this process recorded: if either differs, nothing is mutated.
+            // A shutdown that matched on the id alone could retire a replacement
+            // identity that a later incarnation already established.
+            //
+            // Best effort by design. A hard kill never reaches this, leaving the row
+            // bound and its memberships present. That is an accepted limitation, not
+            // an oversight: no timeout can tell an idle live CLI from a dead one, so
+            // a reaper would retire live processes.
+            const binding = expectedBinding();
+            if (binding) {
+                try {
+                    const retired = store.retireConnection(binding);
+                    diag(retired ? "shutdown_retired" : "shutdown_retire_skipped", {
+                        agent_id: binding.agentId,
+                        reason: retired ? null : "binding did not match the stored row",
+                    });
+                }
+                catch (e) {
+                    diag("shutdown_retire_failed", {
+                        agent_id: binding.agentId,
+                        error: asMessage(e),
+                    });
+                }
+            }
             try {
                 store.close();
             }
@@ -2648,13 +2619,38 @@ async function main() {
         void shutdown(1, `fatal: stdout disconnected: ${asMessage(error)}`);
     });
     process.stderr.once("error", () => void shutdown(1));
+    // Client name/version exist only once the client has sent initialize, which
+    // is why this is recorded here rather than at startup. It identifies the HOST
+    // (e.g. claude-code), never the active model.
+    server.server.oninitialized = () => {
+        const info = server.server.getClientVersion();
+        // Cap at CAPTURE, not only at serialization. A client is free to send a
+        // maximum-frame name, and storing it whole would keep that string resident
+        // for the life of the process just to slice it on every later record.
+        if (info) {
+            clientInfo = {
+                name: String(info.name).slice(0, DIAG_FIELD_CHARS),
+                version: String(info.version).slice(0, DIAG_FIELD_CHARS),
+            };
+        }
+        diag("initialized", {});
+    };
     const transport = new StdioServerTransport(boundedInput, process.stdout);
     await server.connect(transport);
     process.stdin.once("error", (error) => boundedInput.destroy(error));
     process.stdin.pipe(boundedInput);
     // stdio transport: do not write to stdout; it carries the JSON-RPC stream.
-    process.stderr.write(`agent-chat-mcp ready (db: ${store.path})\n`);
+    // The database path is deliberately NOT logged: it is deployment detail with
+    // no correlation value, and this record goes to a file someone may share.
+    diag("ready", {});
 }
+// SIGINT/SIGTERM go through the SAME bounded shutdown path as stdin EOF, so a
+// terminated process retires its identity instead of leaving a bound row with
+// present memberships behind. Without these, every Ctrl-C and every supervisor
+// stop produced the ghost that only a hard kill is supposed to produce.
+// SIGKILL remains uncatchable and stays the accepted crash case.
+process.once("SIGINT", () => void shutdown(130));
+process.once("SIGTERM", () => void shutdown(143));
 main().catch((e) => {
     void shutdown(1, `fatal: ${asMessage(e)}`);
 });