fix: preserve worker run generations across restore

# Conflicts:
#	web/workspace/deno.json

AGENTS.md

@@ -1,21 +1,19 @@
-すでにシステムのドッグフーディングに成功しているが、一旦安定した旧バージョンで、ブラウザ/TUI Client/backend/runtimeの分離とチームスペースとしてのworkspaceを作るObjectiveを進めている。
+すでにシステムのドッグフーディングに成功しており、ブラウザ/TUI Client/backend/runtimeの分離とチームスペースとしてのworkspaceの実装を進めている。
 
 ## このシステムに置ける設計要旨
 
-- プロンプトはすべて resources/promptsに集約している。管理効率の向上と同時に、ユーザーがオーバーライドする形式でもある。
+- プロンプトはすべて`resources/prompts`に集約している。管理効率の向上のためであると同時に、ユーザーがオーバーライドする形式でもある。
 - 変更量を最小にするために設計を歪めたり、設計問題に対して不必要な後方互換性を作らない。長期的なメンテナンスと型安全性を追求すること。
 
 ### LLM コンテキストの加工原則
 
-LLM に投げる context への割り込みは、大きく2種類に分かれる。**前者は許されるが、後者は禁止**。
+LLM に投げる context はappend-onlyが基本であり、またその永続化形式からAPIコールの形式を純粋に再現可能である必要が有る。
 
-Workerの状態から純粋に再現可能で、且つ揮発性の無い操作であることが望ましい。（pruning、tool result の content 切り詰め、prompt cache anchor の付与等）。
-原則として、コンテキストは積み重ねるものであり、一時的にメッセージを差し込むことや、過去のメッセージを改ざんすることはKVキャッシュのヒット率を下げる。
+一時的にメッセージを差し込む等の、揮発性の有るコンテキストの改変や、過去のメッセージを改ざんすることは基本的に禁止されている。
+これを行うと、 LLM はそのコンテキストに基づいて生成を行う一方、次以降のターンでhistoryに残らないため、「自分がなぜその発言/tool call をしたか」の根拠が消えるうえ、prompt cache のヒット率も低下させることになる。
 
-**禁止**: ターンを跨ぐことができない情報に基づいて、history に記録せずに context だけにコンテンツを差し込むこと。これをやると LLM はそれに反応して生成を行う一方、次以降のターンでhistoryに残らないため、「自分がなぜその発言/tool call をしたか」の根拠が消えるうえ、prompt cache のヒット率も低下させることになる。
-
-新しい input を context に乗せたいなら、必ず先に `worker.history` に append して commit すること。`history.json` への永続化はそこから自動的についてくる。Notify / WorkerEvent / typed `SystemItem` reminder はこの原則で扱う。
-また、キャッシュを破壊するタイミングは正確にコントロールされる必要があり、キャッシュ破壊とトークン消費のトレードオフに基づいて慎重に設計されるべきである。
+過去のコンテキストの圧縮は、キャッシュ破壊とトークン消費のトレードオフであり、必要であれば行っている。
+しかし、キャッシュを破壊するタイミングと頻度は正確にコントロールされる必要があり、実際のセッションデータの解析に基づいて慎重に設計されるべきである。
 
 ---
 

Cargo.toml

@@ -5,6 +5,7 @@ members = [
     "crates/agen",
     "crates/agen-macros",
     "crates/session-store",
+    "crates/standalone",
     "crates/secrets",
     "crates/manifest",
     "crates/mcp",
@@ -36,6 +37,7 @@ default-members = [
     "crates/agen",
     "crates/agen-macros",
     "crates/session-store",
+    "crates/standalone",
     "crates/secrets",
     "crates/manifest",
     "crates/mcp",
@@ -66,6 +68,12 @@ default-members = [
 edition = "2024"
 license = "MIT"
 
+[profile.dev]
+debug = "line-tables-only"
+
+[profile.dev.package."*"]
+debug = false
+
 [workspace.dependencies]
 # Internal crates
 client = { path = "crates/client" }
@@ -87,6 +95,7 @@ protocol = { path = "crates/protocol" }
 session-metrics = { path = "crates/session-metrics" }
 session-analytics = { path = "crates/session-analytics" }
 session-store = { path = "crates/session-store" }
+standalone = { path = "crates/standalone" }
 secrets = { path = "crates/secrets" }
 tools = { path = "crates/tools" }
 config-source = { path = "crates/config-source" }
@@ -123,6 +132,7 @@ tokio-tungstenite = "0.29"
 tower = "0.5"
 toml = "1.1"
 tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 url = "2.5"
 uuid = "1.23"
 zeroize = "1"

crates/agen/README.md

@@ -21,20 +21,22 @@ agen = { version = "0.2.1", features = ["codex"] }
 
 ## Quick start
 
-Supply an implementation of [`LlmClient`](https://docs.rs/agen/latest/agen/llm_client/trait.LlmClient.html), then run a turn. The first call consumes the mutable engine and returns a cache-locked engine for later turns.
+Supply an implementation of [`LlmClient`](https://docs.rs/agen/latest/agen/llm_client/trait.LlmClient.html), keep conversation history in your application, then run a turn. The first call consumes the mutable engine and returns a cache-locked engine for later turns.
 
 ```no_run
-use agen::Engine;
+use agen::{Engine, EngineError, History};
 use agen::llm_client::LlmClient;
 
-async fn conversation<C: LlmClient>(client: C) {
+async fn conversation<C: LlmClient>(client: C) -> Result<(), EngineError> {
+    let mut history = History::new();
     let output = Engine::new(client)
         .system_prompt("You are a concise assistant.")
-        .run("Explain typed state in one sentence.")
+        .run(&mut history, "Explain typed state in one sentence.")
         .await;
 
     let mut engine = output.engine;
-    let _exit = engine.run("Give a Rust example.").await;
+    let _result = engine.run(&mut history, "Give a Rust example.").await;
+    Ok(())
 }
 ```
 

crates/agen/examples/engine_cancel_demo.rs

@@ -4,7 +4,7 @@
 
 use agen::llm_client::scheme::{Scheme, anthropic::AnthropicScheme};
 use agen::llm_client::transport::{HttpTransport, ResolvedAuth};
-use agen::{Engine, EngineRunExit, StopReason};
+use agen::{Engine, EngineRunExit, RunInterruptionReason};
 use std::time::Duration;
 
 #[tokio::main]
@@ -29,6 +29,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let base_url = scheme.default_base_url().to_string();
     let client = HttpTransport::new(scheme, model, base_url, ResolvedAuth::ApiKey(api_key), cap);
     let engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     println!("🚀 Starting Engine...");
     println!("💡 Will cancel after 2 seconds\n");
@@ -45,12 +46,12 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     println!("📡 Sending request to LLM...");
 
-    let output = engine.run("Tell me a very long story about a brave knight. Make it as detailed as possible with many paragraphs.").await;
+    let output = engine.run(&mut history, "Tell me a very long story about a brave knight. Make it as detailed as possible with many paragraphs.").await;
     match output.result {
         EngineRunExit::Finished => println!("✅ Task completed normally"),
         EngineRunExit::Paused => println!("⏸️  Task paused"),
         EngineRunExit::Yielded => println!("↩️  Task yielded"),
-        EngineRunExit::Interrupted(StopReason::LimitReached) => {
+        EngineRunExit::Interrupted(RunInterruptionReason::LimitReached) => {
             println!("🔒 Turn limit reached")
         }
         EngineRunExit::Interrupted(reason) => println!("❌ Task interrupted: {reason:?}"),

crates/agen/examples/engine_cli.rs

@@ -39,8 +39,8 @@ use tracing::info;
 use tracing_subscriber::EnvFilter;
 
 use agen::{
-    Engine, EngineRunExit, StopReason,
-    interceptor::{Interceptor, PostToolAction, ToolResultInfo},
+    Engine, EngineRunExit, RunInterruptionReason,
+    interceptor::{Interceptor, InterceptorResult, PostToolAction, ToolResultInfo},
     llm_client::{
         LlmClient,
         capability::{CacheStrategy, ModelCapability, StructuredOutput, ToolCallingSupport},
@@ -280,7 +280,10 @@ impl ToolResultPrinterPolicy {
 
 #[async_trait]
 impl Interceptor for ToolResultPrinterPolicy {
-    async fn post_tool_call(&self, info: &mut ToolResultInfo) -> PostToolAction {
+    async fn post_tool_call(
+        &self,
+        info: &ToolResultInfo<'_, ()>,
+    ) -> InterceptorResult<PostToolAction> {
         let name = self
             .call_names
             .lock()
@@ -294,7 +297,7 @@ impl Interceptor for ToolResultPrinterPolicy {
             println!("   Result ({}): ✅ {}", name, info.result.summary);
         }
 
-        PostToolAction::Continue
+        Ok(PostToolAction::Continue)
     }
 }
 
@@ -451,6 +454,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Create Engine
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     let tool_call_names = Arc::new(Mutex::new(HashMap::new()));
 
@@ -476,8 +480,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // One-shot mode
     if let Some(prompt) = args.prompt {
-        let output = engine.run(&prompt).await;
-        if let EngineRunExit::Interrupted(StopReason::Unexpected(error)) = output.result {
+        let output = engine.run(&mut history, &prompt).await;
+        if let EngineRunExit::Interrupted(RunInterruptionReason::Unexpected(error)) = output.result
+        {
             eprintln!("\n❌ Error: {error}");
         }
 
@@ -497,7 +502,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         return Ok(());
     }
 
-    let output = engine.run(first_input).await;
+    let output = engine.run(&mut history, first_input).await;
     let mut locked = output.engine;
 
     loop {
@@ -517,7 +522,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             break;
         }
 
-        if let EngineRunExit::Interrupted(StopReason::Unexpected(error)) = locked.run(input).await {
+        if let EngineRunExit::Interrupted(RunInterruptionReason::Unexpected(error)) =
+            locked.run(&mut history, input).await
+        {
             eprintln!("\n❌ Error: {error}");
         }
     }

crates/agen/src/history.rs

@@ -0,0 +1,199 @@
+//! Typed conversation history containers.
+//!
+//! Agen keeps provider-visible [`Item`](crate::Item) values separate from any
+//! host-domain provenance. The host chooses the annotation type `A`, while Agen
+//! preserves each item and annotation as one entry for clone/truncate/restore
+//! style history operations.
+
+use serde::{Deserialize, Serialize};
+
+use crate::Item;
+
+/// One conversation-history entry with host-owned annotation.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HistoryEntry<A = ()> {
+    /// Provider/model-visible conversation item.
+    pub item: Item,
+    /// Host-domain metadata kept with the item and never projected to providers.
+    pub annotation: A,
+}
+
+impl<A> HistoryEntry<A> {
+    /// Build an entry from an item and its annotation.
+    pub fn new(item: Item, annotation: A) -> Self {
+        Self { item, annotation }
+    }
+
+    /// Split the entry into its item and annotation.
+    pub fn into_parts(self) -> (Item, A) {
+        (self.item, self.annotation)
+    }
+}
+
+impl HistoryEntry<()> {
+    /// Build a unit-annotated entry.
+    pub fn from_item(item: Item) -> Self {
+        Self {
+            item,
+            annotation: (),
+        }
+    }
+}
+
+/// Conversation history with one annotation per item.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct History<A = ()> {
+    entries: Vec<HistoryEntry<A>>,
+}
+
+impl<A> History<A> {
+    /// Create an empty history.
+    pub fn new() -> Self {
+        Self {
+            entries: Vec::new(),
+        }
+    }
+
+    /// Build history from already annotated entries, preserving order.
+    pub fn from_entries(entries: Vec<HistoryEntry<A>>) -> Self {
+        Self { entries }
+    }
+
+    /// Replace all entries as one restore/rebuild operation and return the old entries.
+    pub fn replace_entries(&mut self, entries: Vec<HistoryEntry<A>>) -> Vec<HistoryEntry<A>> {
+        std::mem::replace(&mut self.entries, entries)
+    }
+
+    /// Borrow annotated entries.
+    pub fn entries(&self) -> &[HistoryEntry<A>] {
+        &self.entries
+    }
+
+    /// Mutably borrow annotated entries for host-owned rebuild operations.
+    pub fn entries_mut(&mut self) -> &mut [HistoryEntry<A>] {
+        &mut self.entries
+    }
+
+    /// Consume the history into annotated entries.
+    pub fn into_entries(self) -> Vec<HistoryEntry<A>> {
+        self.entries
+    }
+
+    /// Number of entries.
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    /// Whether the history is empty.
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+
+    /// Iterate over annotated entries.
+    pub fn iter(&self) -> impl ExactSizeIterator<Item = &HistoryEntry<A>> {
+        self.entries.iter()
+    }
+
+    /// Iterate over provider-visible items only.
+    pub fn items(&self) -> impl ExactSizeIterator<Item = &Item> {
+        self.entries.iter().map(|entry| &entry.item)
+    }
+
+    /// Clone provider-visible items into a request-local projection.
+    pub fn items_cloned(&self) -> Vec<Item> {
+        self.items().cloned().collect()
+    }
+
+    /// Append an already annotated entry.
+    pub fn push_entry(&mut self, entry: HistoryEntry<A>) {
+        self.entries.push(entry);
+    }
+
+    /// Append many already annotated entries.
+    pub fn extend_entries(&mut self, entries: impl IntoIterator<Item = HistoryEntry<A>>) {
+        self.entries.extend(entries);
+    }
+
+    /// Commit one item through a trusted annotation callback before it becomes live.
+    ///
+    /// The callback may durably persist the item and returns the annotation that
+    /// must be stored with it. If the callback fails, the history is left unchanged.
+    pub fn append_with(
+        &mut self,
+        item: Item,
+        annotate: &mut impl FnMut(&Item) -> Result<A, String>,
+    ) -> Result<(), String> {
+        let annotation = annotate(&item)?;
+        self.entries.push(HistoryEntry { item, annotation });
+        Ok(())
+    }
+
+    /// Commit items through a trusted annotation callback before they become live.
+    ///
+    /// Items before a failure remain appended; the failing item and later items do
+    /// not enter history. This mirrors append-only durable logs where each accepted
+    /// item is already committed before the next item is attempted.
+    pub fn extend_with(
+        &mut self,
+        items: impl IntoIterator<Item = Item>,
+        annotate: &mut impl FnMut(&Item) -> Result<A, String>,
+    ) -> Result<(), String> {
+        for item in items {
+            self.append_with(item, annotate)?;
+        }
+        Ok(())
+    }
+
+    /// Truncate entries, preserving item+annotation pairing for retained entries.
+    pub fn truncate(&mut self, len: usize) {
+        self.entries.truncate(len);
+    }
+
+    /// Clear all entries.
+    pub fn clear(&mut self) {
+        self.entries.clear();
+    }
+}
+
+impl History<()> {
+    /// Build unit-annotated history from provider-visible items.
+    pub fn from_items(items: Vec<Item>) -> Self {
+        Self {
+            entries: items.into_iter().map(HistoryEntry::from_item).collect(),
+        }
+    }
+
+    /// Replace history from provider-visible items using unit annotations.
+    pub fn replace_items(&mut self, items: Vec<Item>) -> Vec<HistoryEntry<()>> {
+        self.replace_entries(items.into_iter().map(HistoryEntry::from_item).collect())
+    }
+
+    /// Append one item with unit annotation.
+    pub fn push(&mut self, item: Item) {
+        self.entries.push(HistoryEntry::from_item(item));
+    }
+
+    /// Append items with unit annotations.
+    pub fn extend_items(&mut self, items: impl IntoIterator<Item = Item>) {
+        self.entries
+            .extend(items.into_iter().map(HistoryEntry::from_item));
+    }
+}
+
+impl<A> IntoIterator for History<A> {
+    type Item = HistoryEntry<A>;
+    type IntoIter = std::vec::IntoIter<HistoryEntry<A>>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.entries.into_iter()
+    }
+}
+
+impl<'a, A> IntoIterator for &'a History<A> {
+    type Item = &'a HistoryEntry<A>;
+    type IntoIter = std::slice::Iter<'a, HistoryEntry<A>>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.entries.iter()
+    }
+}

crates/agen/src/interceptor.rs

@@ -9,8 +9,202 @@ use std::sync::Arc;
 use async_trait::async_trait;
 
 use crate::Item;
+use crate::engine::EngineRunExit;
+use crate::history::HistoryEntry;
 use crate::tool::{Tool, ToolCall, ToolExecutionContext, ToolMeta, ToolResult};
 
+// =============================================================================
+// Typed lifecycle metadata and failures
+// =============================================================================
+
+/// Maximum UTF-8 byte length retained for interceptor diagnostics.
+pub const MAX_INTERCEPTOR_DIAGNOSTIC_BYTES: usize = 1024;
+
+/// Stable category for the source of an interceptor failure.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum InterceptorErrorCategory {
+    Policy,
+    Dependency,
+    ContractViolation,
+    Internal,
+}
+
+impl std::fmt::Display for InterceptorErrorCategory {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(match self {
+            Self::Policy => "policy",
+            Self::Dependency => "dependency",
+            Self::ContractViolation => "contract_violation",
+            Self::Internal => "internal",
+        })
+    }
+}
+
+/// A typed, bounded failure returned by an [`Interceptor`] implementation.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[error("{category}: {diagnostic}")]
+pub struct InterceptorError {
+    category: InterceptorErrorCategory,
+    diagnostic: String,
+}
+
+impl InterceptorError {
+    pub fn new(category: InterceptorErrorCategory, diagnostic: impl Into<String>) -> Self {
+        let mut diagnostic = diagnostic.into();
+        if diagnostic.len() > MAX_INTERCEPTOR_DIAGNOSTIC_BYTES {
+            let mut end = MAX_INTERCEPTOR_DIAGNOSTIC_BYTES;
+            while !diagnostic.is_char_boundary(end) {
+                end -= 1;
+            }
+            diagnostic.truncate(end);
+        }
+        Self {
+            category,
+            diagnostic,
+        }
+    }
+
+    pub fn category(&self) -> InterceptorErrorCategory {
+        self.category
+    }
+
+    pub fn diagnostic(&self) -> &str {
+        &self.diagnostic
+    }
+}
+
+/// The lifecycle phase at which an interceptor callback executes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum InterceptorPhase {
+    #[default]
+    PromptSubmit,
+    PendingHistoryAppends,
+    PreLlmRequest,
+    PreToolCall,
+    PostToolCall,
+    AssistantTurnEnd,
+    RunExit,
+}
+
+impl std::fmt::Display for InterceptorPhase {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(match self {
+            Self::PromptSubmit => "prompt_submit",
+            Self::PendingHistoryAppends => "pending_history_appends",
+            Self::PreLlmRequest => "pre_llm_request",
+            Self::PreToolCall => "pre_tool_call",
+            Self::PostToolCall => "post_tool_call",
+            Self::AssistantTurnEnd => "assistant_turn_end",
+            Self::RunExit => "run_exit",
+        })
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
+pub struct InterceptorRunId(pub u64);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct InterceptorTurnId(pub u64);
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum InterceptorCallId {
+    Llm(u64),
+    Tool(String),
+}
+
+/// Saturating public counter used by interceptor contexts.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Default)]
+pub struct InterceptorCounter(u32);
+
+impl InterceptorCounter {
+    pub fn from_usize(value: usize) -> Self {
+        Self(u32::try_from(value).unwrap_or(u32::MAX))
+    }
+
+    pub fn get(self) -> u32 {
+        self.0
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub struct InterceptorCounters {
+    pub invocation: InterceptorCounter,
+    pub engine_turn: InterceptorCounter,
+    pub run_turn: InterceptorCounter,
+    pub llm_call: InterceptorCounter,
+    pub tool_batch: InterceptorCounter,
+    pub tool_call: InterceptorCounter,
+}
+
+/// Identity, phase, and bounded counters common to every lifecycle callback.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct InterceptorInvocation {
+    pub run_id: InterceptorRunId,
+    pub turn_id: Option<InterceptorTurnId>,
+    pub call_id: Option<InterceptorCallId>,
+    pub phase: InterceptorPhase,
+    pub counters: InterceptorCounters,
+}
+
+/// An interceptor failure bound to the exact Engine lifecycle phase that ran it.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[error("{phase} interceptor failed: {error}")]
+pub struct InterceptorFailure {
+    phase: InterceptorPhase,
+    #[source]
+    error: InterceptorError,
+}
+
+impl InterceptorFailure {
+    pub(crate) fn new(phase: InterceptorPhase, error: InterceptorError) -> Self {
+        Self { phase, error }
+    }
+
+    pub fn phase(&self) -> InterceptorPhase {
+        self.phase
+    }
+
+    pub fn error(&self) -> &InterceptorError {
+        &self.error
+    }
+}
+
+pub type InterceptorResult<T> = Result<T, InterceptorError>;
+
+// =============================================================================
+// Lifecycle Contexts
+// =============================================================================
+
+pub struct PromptSubmitContext<'a, A = ()> {
+    pub invocation: InterceptorInvocation,
+    pub item: &'a mut Item,
+    pub history: &'a [HistoryEntry<A>],
+}
+
+pub struct PendingHistoryAppendsContext<'a, A = ()> {
+    pub invocation: InterceptorInvocation,
+    pub history: &'a [HistoryEntry<A>],
+}
+
+pub struct PreLlmRequestContext<'a, A = ()> {
+    pub invocation: InterceptorInvocation,
+    pub items: &'a mut Vec<Item>,
+    pub history: &'a [HistoryEntry<A>],
+}
+
+pub struct AssistantTurnEndContext<'a, A = ()> {
+    pub invocation: InterceptorInvocation,
+    pub assistant_entries: &'a [HistoryEntry<A>],
+    pub history: &'a [HistoryEntry<A>],
+    pub tool_calls: &'a [ToolCall],
+}
+
+pub struct RunExitContext<'a, A = ()> {
+    pub invocation: InterceptorInvocation,
+    pub exit: &'a EngineRunExit,
+    pub history: &'a [HistoryEntry<A>],
+}
+
 // =============================================================================
 // Action Enums
 // =============================================================================
@@ -86,9 +280,9 @@ pub enum PostToolAction {
 /// Action at the end of a turn (when LLM produces no tool calls).
 #[derive(Debug, Clone)]
 pub enum TurnEndAction {
-    /// Turn is finished, return to caller.
+    /// Accept the Engine's natural next phase: execute tools, or finish when none exist.
     Finish,
-    /// Continue with additional messages injected into history.
+    /// Commit additional messages, then continue through the natural next phase.
     ContinueWithMessages(Vec<Item>),
     /// Pause execution (can be resumed later).
     Pause,
@@ -99,8 +293,9 @@ pub enum TurnEndAction {
 // =============================================================================
 
 /// Context for pre-tool-call decisions.
-pub struct ToolCallInfo {
-    /// Tool call information (modifiable).
+pub struct ToolCallInfo<'a, A = ()> {
+    pub invocation: InterceptorInvocation,
+    pub history: &'a [HistoryEntry<A>],
     pub call: ToolCall,
     /// Tool meta information.
     pub meta: ToolMeta,
@@ -111,10 +306,11 @@ pub struct ToolCallInfo {
 }
 
 /// Context for post-tool-call decisions.
-pub struct ToolResultInfo {
-    /// Original tool call.
+pub struct ToolResultInfo<'a, A = ()> {
+    pub invocation: InterceptorInvocation,
+    pub history: &'a [HistoryEntry<A>],
     pub call: ToolCall,
-    /// Tool execution result (modifiable).
+    /// Committed terminal tool execution result.
     pub result: ToolResult,
     /// Tool meta information.
     pub meta: ToolMeta,
@@ -130,14 +326,22 @@ pub struct ToolResultInfo {
 
 /// Intercepts the Engine execution loop at key decision points.
 ///
-/// All methods have default implementations that let the Engine
-/// proceed without intervention. Callers provide richer implementations for
-/// approval flows, permission checks, etc.
+/// Every lifecycle method is asynchronous and returns [`InterceptorResult`],
+/// keeping implementation failure separate from the method's control-flow
+/// action. The Engine reports a failure as a typed run interruption annotated
+/// with the exact [`InterceptorPhase`] that failed.
+///
+/// All methods have default implementations that let the Engine proceed
+/// without intervention. Callers provide richer implementations for approval
+/// flows, permission checks, and other trusted host adaptation.
 #[async_trait]
-pub trait Interceptor: Send + Sync {
-    /// Called after receiving user input, before adding to history.
-    async fn on_prompt_submit(&self, _item: &mut Item) -> PromptAction {
-        PromptAction::Continue
+pub trait Interceptor<A: Send + Sync = ()>: Send + Sync {
+    /// Called after receiving user input, before adding it to Engine history.
+    async fn on_prompt_submit(
+        &self,
+        _context: PromptSubmitContext<'_, A>,
+    ) -> InterceptorResult<PromptAction> {
+        Ok(PromptAction::Continue)
     }
 
     /// Items that should be **committed to `engine.history`** just
@@ -158,7 +362,10 @@ pub trait Interceptor: Send + Sync {
     /// reproducible per-request transformations (pruning, content
     /// trimming, cache anchors) that depend only on the existing
     /// history.
-    async fn pending_history_appends(&self) -> Result<Vec<Item>, String> {
+    async fn pending_history_appends(
+        &self,
+        _context: PendingHistoryAppendsContext<'_, A>,
+    ) -> InterceptorResult<Vec<Item>> {
         Ok(Vec::new())
     }
 
@@ -170,27 +377,42 @@ pub trait Interceptor: Send + Sync {
     /// If an interceptor derives a human/model-visible nudge from the current
     /// request context, return [`PreRequestAction::ContinueWith`] so the Engine
     /// commits it to history before the request is sent.
-    async fn pre_llm_request(&self, _context: &mut Vec<Item>) -> PreRequestAction {
-        PreRequestAction::Continue
+    async fn pre_llm_request(
+        &self,
+        _context: PreLlmRequestContext<'_, A>,
+    ) -> InterceptorResult<PreRequestAction> {
+        Ok(PreRequestAction::Continue)
     }
 
     /// Called before each tool is executed.
-    async fn pre_tool_call(&self, _info: &mut ToolCallInfo) -> PreToolAction {
-        PreToolAction::Continue
+    async fn pre_tool_call(
+        &self,
+        _info: &mut ToolCallInfo<'_, A>,
+    ) -> InterceptorResult<PreToolAction> {
+        Ok(PreToolAction::Continue)
     }
 
-    /// Called after each tool completes.
-    async fn post_tool_call(&self, _info: &mut ToolResultInfo) -> PostToolAction {
-        PostToolAction::Continue
+    /// Called after each tool reaches one terminal result and that result is committed.
+    async fn post_tool_call(
+        &self,
+        _info: &ToolResultInfo<'_, A>,
+    ) -> InterceptorResult<PostToolAction> {
+        Ok(PostToolAction::Continue)
     }
 
-    /// Called when a turn ends with no tool calls.
-    async fn on_turn_end(&self, _history: &[Item]) -> TurnEndAction {
-        TurnEndAction::Finish
+    /// Called after every terminal assistant response is committed and before
+    /// the Engine decides whether to execute tools, continue, or finish.
+    async fn on_assistant_turn_end(
+        &self,
+        _context: AssistantTurnEndContext<'_, A>,
+    ) -> InterceptorResult<TurnEndAction> {
+        Ok(TurnEndAction::Finish)
     }
 
-    /// Called when execution is interrupted (abort or cancel).
-    async fn on_abort(&self, _reason: &str) {}
+    /// Called once for the terminal outcome of each public run or resume call.
+    async fn on_run_exit(&self, _context: RunExitContext<'_, A>) -> InterceptorResult<()> {
+        Ok(())
+    }
 }
 
 /// Default interceptor: no intervention. Engine proceeds through the loop
@@ -198,4 +420,4 @@ pub trait Interceptor: Send + Sync {
 pub(crate) struct DefaultInterceptor;
 
 #[async_trait]
-impl Interceptor for DefaultInterceptor {}
+impl<A: Send + Sync> Interceptor<A> for DefaultInterceptor {}

crates/agen/src/lib.rs

@@ -2,6 +2,7 @@
 
 mod engine;
 mod handler;
+mod history;
 mod message;
 
 pub(crate) mod callback;
@@ -21,12 +22,23 @@ pub use agen_macros::{description, tool, tool_registry};
 pub use callback::{TextBlockScope, ThinkingBlockScope, ToolUseBlockScope};
 pub use engine::{
     Engine, EngineConfig, EngineError, EngineResult, EngineRunExit, EngineRunOutput,
-    LlmRetryNotice, StopReason, ToolRegistryError,
+    LlmRetryNotice, RunInterruptionReason, ToolRegistryError,
 };
 pub use handler::ToolUseBlockStart;
-pub use interceptor::Interceptor;
+pub use history::{History, HistoryEntry};
+pub use interceptor::{
+    AssistantTurnEndContext, Interceptor, InterceptorCallId, InterceptorCounter,
+    InterceptorCounters, InterceptorError, InterceptorErrorCategory, InterceptorFailure,
+    InterceptorInvocation, InterceptorPhase, InterceptorResult, InterceptorRunId,
+    InterceptorTurnId, MAX_INTERCEPTOR_DIAGNOSTIC_BYTES, PendingHistoryAppendsContext,
+    PreLlmRequestContext, PromptSubmitContext, RunExitContext,
+};
 pub use message::{ContentPart, Item, Message, Role};
-pub use tool::{ToolCall, ToolExecutionContext, ToolOutputLimits, ToolResult};
+pub use tool::{
+    ToolCall, ToolExecutionContext, ToolExecutionHandle, ToolExecutionPolicy,
+    ToolExecutionTerminal, ToolExecutionTerminalFuture, ToolOutputLimits, ToolResult,
+    ToolResultDisposition,
+};
 pub use usage_record::UsageRecord;
 
 /// Implementation dependencies used by code generated from `agen` macros.

crates/agen/src/llm_client/types.rs

@@ -9,7 +9,7 @@
 
 use std::{fmt, sync::Arc};
 
-use crate::tool::Attachment;
+use crate::tool::{Attachment, ToolResultDisposition};
 use base64::Engine as _;
 use serde::{Deserialize, Serialize};
 
@@ -121,6 +121,9 @@ pub enum Item {
         /// Detailed output (removed by pruning when old enough)
         #[serde(default, skip_serializing_if = "Option::is_none")]
         content: Option<String>,
+        /// Typed terminal state used for replay and recovery.
+        #[serde(default, skip_serializing_if = "ToolResultDisposition::is_success")]
+        disposition: ToolResultDisposition,
         /// Whether the tool result represents an execution error.
         #[serde(default, skip_serializing_if = "is_false")]
         is_error: bool,
@@ -261,7 +264,17 @@ impl Item {
         content: Option<String>,
         is_error: bool,
     ) -> Self {
-        Self::tool_result_item_with_attachments(call_id, summary, content, is_error, Vec::new())
+        Self::tool_result_item_with_disposition_and_attachments(
+            call_id,
+            summary,
+            content,
+            if is_error {
+                ToolResultDisposition::Error
+            } else {
+                ToolResultDisposition::Success
+            },
+            Vec::new(),
+        )
     }
 
     /// Create a tool result item with durable, prunable structured attachments.
@@ -272,11 +285,33 @@ impl Item {
         is_error: bool,
         attachments: Vec<Attachment>,
     ) -> Self {
+        Self::tool_result_item_with_disposition_and_attachments(
+            call_id,
+            summary,
+            content,
+            if is_error {
+                ToolResultDisposition::Error
+            } else {
+                ToolResultDisposition::Success
+            },
+            attachments,
+        )
+    }
+
+    pub fn tool_result_item_with_disposition_and_attachments(
+        call_id: impl Into<String>,
+        summary: impl Into<String>,
+        content: Option<String>,
+        disposition: ToolResultDisposition,
+        attachments: Vec<Attachment>,
+    ) -> Self {
+        let is_error = !disposition.is_success();
         Self::ToolResult {
             id: None,
             call_id: call_id.into(),
             summary: summary.into(),
             content,
+            disposition,
             is_error,
             attachments,
         }

crates/agen/src/state.rs

@@ -19,7 +19,7 @@ mod private {
 /// - Editing message history (add, delete, clear)
 /// - Registering tools and hooks
 ///
-/// Can transition to [`Locked`] state via `Engine::lock()`.
+/// Can transition to [`Locked`] state via `Engine::lock(&history)`.
 ///
 /// # Examples
 ///

crates/agen/src/tool.rs

@@ -3,7 +3,14 @@
 //! Traits for defining tools callable by LLM.
 //! Usually auto-implemented using the `#[tool]` macro.
 
-use std::{collections::HashMap, fmt, sync::Arc};
+use std::{
+    collections::HashMap,
+    fmt,
+    future::Future,
+    pin::Pin,
+    sync::Arc,
+    task::{Context, Poll},
+};
 
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::STANDARD};
@@ -23,6 +30,12 @@ pub enum ToolError {
     /// Internal error
     #[error("Internal error: {0}")]
     Internal(String),
+    /// Cooperative cancellation completed with bounded terminal output.
+    #[error("Tool execution cancelled")]
+    Cancelled(ToolOutput),
+    /// Execution was interrupted with a confirmed bounded terminal output.
+    #[error("Tool execution interrupted")]
+    Interrupted(ToolOutput),
 }
 
 // =============================================================================
@@ -158,6 +171,28 @@ pub enum Attachment {
     Image(ImageAttachment),
 }
 
+/// Terminal disposition of one started tool call.
+///
+/// `Cancelled` means the tool confirmed cancellation. `OutcomeUnknown` means
+/// execution stopped without confirmation, so neither completion nor side
+/// effects may be inferred.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum ToolResultDisposition {
+    #[default]
+    Success,
+    Error,
+    Interrupted,
+    Cancelled,
+    OutcomeUnknown,
+}
+
+impl ToolResultDisposition {
+    pub const fn is_success(&self) -> bool {
+        matches!(self, Self::Success)
+    }
+}
+
 /// Tool execution result.
 ///
 /// Every output has a mandatory `summary` (1-2 lines) that persists in
@@ -322,6 +357,12 @@ impl ToolExecutionContext {
         }
     }
 
+    /// Identifies one live execution attempt without making the batch id a durable
+    /// replay or idempotency authority.
+    pub fn execution_id(&self) -> String {
+        format!("{}:{}", self.batch_id, self.call_id)
+    }
+
     /// Context for direct, non-engine calls in unit tests and low-level callers.
     pub fn direct() -> Self {
         Self::new("direct", "direct", 0)
@@ -334,6 +375,142 @@ impl Default for ToolExecutionContext {
     }
 }
 
+/// The provider-confirmed terminal result of one started tool execution.
+///
+/// `OutcomeUnknown` is reserved for an execution task that had to be force-closed
+/// or failed before the provider could confirm its terminal result.
+#[derive(Debug)]
+pub enum ToolExecutionTerminal {
+    Confirmed(Result<ToolOutput, ToolError>),
+    OutcomeUnknown,
+}
+
+/// The completion future paired with a [`ToolExecutionHandle`]. Dropping this
+/// future does not drop the provider execution: the spawned execution remains
+/// owned by its handle until it completes or is explicitly force-closed.
+pub struct ToolExecutionTerminalFuture {
+    task: tokio::task::JoinHandle<Result<ToolOutput, ToolError>>,
+}
+
+impl Future for ToolExecutionTerminalFuture {
+    type Output = ToolExecutionTerminal;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        match Pin::new(&mut self.task).poll(cx) {
+            Poll::Ready(Ok(result)) => Poll::Ready(ToolExecutionTerminal::Confirmed(result)),
+            Poll::Ready(Err(_)) => Poll::Ready(ToolExecutionTerminal::OutcomeUnknown),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+}
+
+/// Live ownership and control for one started tool execution.
+///
+/// Execution, cancellation, and terminal confirmation remain provider-owned:
+/// this handle starts `Tool::execute`, delegates cooperative cancellation to
+/// `Tool::cancel_execution`, and treats execution-future completion as the
+/// provider's terminal confirmation. Agen may force-close only after its caller's
+/// deadline expires, at which point the outcome is necessarily unknown.
+#[derive(Clone)]
+pub struct ToolExecutionHandle {
+    inner: Arc<ToolExecutionHandleInner>,
+}
+
+struct ToolExecutionHandleInner {
+    tool: Arc<dyn Tool>,
+    context: ToolExecutionContext,
+    abort: tokio::task::AbortHandle,
+}
+
+impl Drop for ToolExecutionHandleInner {
+    fn drop(&mut self) {
+        // Losing the final live owner is an explicit forced close, never a
+        // best-effort detached provider future.
+        self.abort.abort();
+    }
+}
+
+impl fmt::Debug for ToolExecutionHandle {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ToolExecutionHandle")
+            .field("call_id", &self.inner.context.call_id)
+            .field("batch_id", &self.inner.context.batch_id)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ToolExecutionHandle {
+    pub fn start(
+        tool: Arc<dyn Tool>,
+        input_json: String,
+        context: ToolExecutionContext,
+    ) -> (Self, ToolExecutionTerminalFuture) {
+        let execution_tool = Arc::clone(&tool);
+        let execution_context = context.clone();
+        let task =
+            tokio::spawn(
+                async move { execution_tool.execute(&input_json, execution_context).await },
+            );
+        let abort = task.abort_handle();
+        (
+            Self {
+                inner: Arc::new(ToolExecutionHandleInner {
+                    tool,
+                    context,
+                    abort,
+                }),
+            },
+            ToolExecutionTerminalFuture { task },
+        )
+    }
+
+    pub fn context(&self) -> &ToolExecutionContext {
+        &self.inner.context
+    }
+
+    pub async fn cancel_before(&self, deadline: tokio::time::Instant) -> Result<(), ToolError> {
+        match tokio::time::timeout_at(
+            deadline,
+            self.inner.tool.cancel_execution(&self.inner.context),
+        )
+        .await
+        {
+            Ok(result) => result,
+            Err(_) => Err(ToolError::Internal(format!(
+                "tool cancellation request exceeded its deadline for call {}",
+                self.inner.context.call_id
+            ))),
+        }
+    }
+
+    pub fn force_close(&self) {
+        self.inner.abort.abort();
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ToolExecutionPolicy {
+    /// Time a pause waits for already-started providers to reach a natural safe
+    /// boundary before escalating to explicit cooperative cancellation.
+    pub pause_safe_boundary_timeout: std::time::Duration,
+    /// Maximum time allowed for a provider to accept one cooperative
+    /// cancellation request.
+    pub cancellation_request_timeout: std::time::Duration,
+    /// Maximum time allowed for all providers to confirm terminal results after
+    /// cancellation has been requested.
+    pub terminal_confirmation_timeout: std::time::Duration,
+}
+
+impl Default for ToolExecutionPolicy {
+    fn default() -> Self {
+        Self {
+            pause_safe_boundary_timeout: std::time::Duration::from_millis(100),
+            cancellation_request_timeout: std::time::Duration::from_millis(100),
+            terminal_confirmation_timeout: std::time::Duration::from_millis(500),
+        }
+    }
+}
+
 // =============================================================================
 // Tool trait
 // =============================================================================
@@ -402,6 +579,26 @@ pub trait Tool: Send + Sync {
         input_json: &str,
         ctx: ToolExecutionContext,
     ) -> Result<ToolOutput, ToolError>;
+
+    /// Request cooperative cancellation for one started call.
+    ///
+    /// Implementations that own cancellable provider operations should signal
+    /// every live execution identified by `call_id`, then let `execute` return
+    /// the confirmed bounded terminal output. Direct callers may use this
+    /// compatibility surface; Agen uses [`Tool::cancel_execution`] so providers
+    /// can bind cancellation to one exact live attempt.
+    async fn cancel(&self, _call_id: &str) -> Result<(), ToolError> {
+        Ok(())
+    }
+
+    /// Request cooperative cancellation for one exact started execution.
+    ///
+    /// The default preserves existing tools by delegating to `cancel(call_id)`.
+    /// Providers with their own execution registry should override this method
+    /// and key cancellation by [`ToolExecutionContext::execution_id`].
+    async fn cancel_execution(&self, ctx: &ToolExecutionContext) -> Result<(), ToolError> {
+        self.cancel(&ctx.call_id).await
+    }
 }
 
 // =============================================================================
@@ -429,6 +626,9 @@ pub struct ToolCall {
 pub struct ToolResult {
     /// Corresponding tool call ID
     pub tool_use_id: String,
+    /// Typed terminal state.
+    #[serde(default, skip_serializing_if = "ToolResultDisposition::is_success")]
+    pub disposition: ToolResultDisposition,
     /// Short summary (always kept in history)
     pub summary: String,
     /// Detailed output (prunable)
@@ -445,11 +645,20 @@ pub struct ToolResult {
 impl ToolResult {
     /// Create a success result from a [`ToolOutput`].
     pub fn from_output(tool_use_id: impl Into<String>, output: ToolOutput) -> Self {
+        Self::from_output_with_disposition(tool_use_id, output, ToolResultDisposition::Success)
+    }
+
+    pub fn from_output_with_disposition(
+        tool_use_id: impl Into<String>,
+        output: ToolOutput,
+        disposition: ToolResultDisposition,
+    ) -> Self {
         Self {
             tool_use_id: tool_use_id.into(),
+            disposition,
             summary: output.summary,
             content: output.content,
-            is_error: false,
+            is_error: !disposition.is_success(),
             attachments: output.attachments,
         }
     }
@@ -458,12 +667,28 @@ impl ToolResult {
     pub fn error(tool_use_id: impl Into<String>, message: impl Into<String>) -> Self {
         Self {
             tool_use_id: tool_use_id.into(),
+            disposition: ToolResultDisposition::Error,
             summary: message.into(),
             content: None,
             is_error: true,
             attachments: Vec::new(),
         }
     }
+
+    /// Close an execution whose completion and side effects cannot be confirmed.
+    pub fn outcome_unknown(tool_use_id: impl Into<String>) -> Self {
+        Self {
+            tool_use_id: tool_use_id.into(),
+            disposition: ToolResultDisposition::OutcomeUnknown,
+            summary: "Tool execution outcome unknown".to_string(),
+            content: Some(
+                "Execution was interrupted before completion could be confirmed. Completion and side effects are unknown."
+                    .to_string(),
+            ),
+            is_error: true,
+            attachments: Vec::new(),
+        }
+    }
 }
 
 #[cfg(test)]

crates/agen/tests/annotated_history_test.rs

@@ -0,0 +1,210 @@
+mod common;
+
+use agen::interceptor::{
+    AssistantTurnEndContext, Interceptor, InterceptorCallId, InterceptorInvocation,
+    InterceptorPhase, InterceptorResult, PendingHistoryAppendsContext, PreLlmRequestContext,
+    PreRequestAction, PromptAction, PromptSubmitContext, RunExitContext, TurnEndAction,
+};
+use agen::llm_client::event::{Event, ResponseStatus, StatusEvent};
+use agen::{Engine, EngineError, History, HistoryEntry, Item, Role};
+use async_trait::async_trait;
+use common::MockLlmClient;
+use std::sync::{Arc, Mutex};
+
+fn completed_text_events(text: &str) -> Vec<Event> {
+    vec![
+        Event::text_block_start(0),
+        Event::text_delta(0, text),
+        Event::text_block_stop(0, None),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]
+}
+
+#[tokio::test]
+async fn run_preserves_item_annotations_without_projecting_them() {
+    let client = MockLlmClient::new(completed_text_events("assistant reply"));
+    let engine = Engine::<_, agen::state::Mutable, String>::new_annotated(client);
+    let mut history = History::<String>::new();
+    let mut next = 0usize;
+    let mut annotate = |item: &Item| {
+        next += 1;
+        let kind = match item {
+            Item::Message { role, .. } => match role {
+                Role::User => "user",
+                Role::Assistant => "assistant",
+                Role::System => "system",
+            },
+            Item::ToolCall { .. } => "tool_call",
+            Item::ToolResult { .. } => "tool_result",
+            Item::Reasoning { .. } => "reasoning",
+        };
+        Ok(format!("{next}:{kind}"))
+    };
+
+    let output = engine
+        .run_with_annotation(&mut history, "hello", &mut annotate)
+        .await;
+
+    assert!(matches!(output.result, agen::EngineRunExit::Finished));
+    assert_eq!(history.len(), 2);
+    assert_eq!(history.entries()[0].annotation, "1:user");
+    assert_eq!(history.entries()[1].annotation, "2:assistant");
+    assert_eq!(history.items_cloned().len(), 2);
+}
+
+#[derive(Clone)]
+struct AnnotationObservingInterceptor {
+    observed: Arc<Mutex<Vec<(InterceptorInvocation, Vec<String>)>>>,
+}
+
+impl AnnotationObservingInterceptor {
+    fn record(&self, invocation: &InterceptorInvocation, history: &[HistoryEntry<String>]) {
+        self.observed.lock().unwrap().push((
+            invocation.clone(),
+            history
+                .iter()
+                .map(|entry| entry.annotation.clone())
+                .collect(),
+        ));
+    }
+}
+
+#[async_trait]
+impl Interceptor<String> for AnnotationObservingInterceptor {
+    async fn on_prompt_submit(
+        &self,
+        context: PromptSubmitContext<'_, String>,
+    ) -> InterceptorResult<PromptAction> {
+        self.record(&context.invocation, context.history);
+        Ok(PromptAction::Continue)
+    }
+
+    async fn pending_history_appends(
+        &self,
+        context: PendingHistoryAppendsContext<'_, String>,
+    ) -> InterceptorResult<Vec<Item>> {
+        self.record(&context.invocation, context.history);
+        Ok(Vec::new())
+    }
+
+    async fn pre_llm_request(
+        &self,
+        context: PreLlmRequestContext<'_, String>,
+    ) -> InterceptorResult<PreRequestAction> {
+        self.record(&context.invocation, context.history);
+        Ok(PreRequestAction::Continue)
+    }
+
+    async fn on_assistant_turn_end(
+        &self,
+        context: AssistantTurnEndContext<'_, String>,
+    ) -> InterceptorResult<TurnEndAction> {
+        assert_eq!(context.assistant_entries.len(), 1);
+        assert_eq!(context.assistant_entries[0].annotation, "2:assistant");
+        self.record(&context.invocation, context.history);
+        Ok(TurnEndAction::Finish)
+    }
+
+    async fn on_run_exit(&self, context: RunExitContext<'_, String>) -> InterceptorResult<()> {
+        self.record(&context.invocation, context.history);
+        Ok(())
+    }
+}
+
+#[tokio::test]
+async fn interceptor_contexts_preserve_annotations_and_typed_lifecycle_identity() {
+    let client = MockLlmClient::new(completed_text_events("assistant reply"));
+    let mut engine = Engine::<_, agen::state::Mutable, String>::new_annotated(client);
+    let observed = Arc::new(Mutex::new(Vec::new()));
+    engine.set_interceptor(AnnotationObservingInterceptor {
+        observed: observed.clone(),
+    });
+    let mut history = History::<String>::new();
+    let mut next = 0usize;
+    let mut annotate = |item: &Item| {
+        next += 1;
+        let kind = if item.is_assistant_message() {
+            "assistant"
+        } else {
+            "user"
+        };
+        Ok(format!("{next}:{kind}"))
+    };
+
+    let output = engine
+        .run_with_annotation(&mut history, "hello", &mut annotate)
+        .await;
+    assert!(matches!(output.result, agen::EngineRunExit::Finished));
+
+    let observed = observed.lock().unwrap();
+    let phases: Vec<_> = observed
+        .iter()
+        .map(|(invocation, _)| invocation.phase)
+        .collect();
+    assert_eq!(
+        phases,
+        [
+            InterceptorPhase::PromptSubmit,
+            InterceptorPhase::PendingHistoryAppends,
+            InterceptorPhase::PreLlmRequest,
+            InterceptorPhase::AssistantTurnEnd,
+            InterceptorPhase::RunExit,
+        ]
+    );
+    assert!(
+        observed
+            .iter()
+            .all(|(invocation, _)| invocation.run_id == observed[0].0.run_id)
+    );
+    assert_eq!(
+        observed
+            .iter()
+            .map(|(invocation, _)| invocation.counters.invocation.get())
+            .collect::<Vec<_>>(),
+        [0, 1, 2, 3, 4]
+    );
+    assert_eq!(observed[2].0.call_id, Some(InterceptorCallId::Llm(0)));
+    assert_eq!(observed[3].0.call_id, Some(InterceptorCallId::Llm(0)));
+    assert_eq!(observed[1].1, ["1:user"]);
+    assert_eq!(observed[2].1, ["1:user"]);
+    assert_eq!(observed[3].1, ["1:user", "2:assistant"]);
+    assert_eq!(observed[4].1, ["1:user", "2:assistant"]);
+}
+
+#[test]
+fn append_failure_does_not_make_item_live() {
+    let client = MockLlmClient::new(vec![]);
+    let mut engine = Engine::<_, agen::state::Mutable, usize>::new_annotated(client);
+    let mut history = History::<usize>::new();
+    let mut fail = |_item: &Item| Err("commit failed".to_string());
+
+    let err = engine
+        .append_history_with(&mut history, [Item::user_message("uncommitted")], &mut fail)
+        .unwrap_err();
+
+    assert!(matches!(err, EngineError::HistoryAppend(message) if message == "commit failed"));
+    assert!(history.is_empty());
+}
+
+#[test]
+fn replacement_keeps_items_and_annotations_together() {
+    let mut history = History::from_entries(vec![
+        HistoryEntry::new(Item::user_message("old"), "old-ann".to_string()),
+        HistoryEntry::new(Item::user_message("second"), "second-ann".to_string()),
+    ]);
+
+    history.truncate(1);
+    assert_eq!(history.entries()[0].item.as_text(), Some("old"));
+    assert_eq!(history.entries()[0].annotation, "old-ann");
+
+    let previous = history.replace_entries(vec![HistoryEntry::new(
+        Item::user_message("restored"),
+        "restored-ann".to_string(),
+    )]);
+
+    assert_eq!(previous.len(), 1);
+    assert_eq!(history.entries()[0].item.as_text(), Some("restored"));
+    assert_eq!(history.entries()[0].annotation, "restored-ann");
+}

crates/agen/tests/callback_test.rs

@@ -58,6 +58,7 @@ async fn test_callback_llm_retry_event() {
         max_attempts: 2,
         total_timeout: Duration::from_secs(1),
     });
+    let mut history = agen::History::new();
 
     let notices = Arc::new(Mutex::new(Vec::new()));
     let sink = notices.clone();
@@ -65,7 +66,7 @@ async fn test_callback_llm_retry_event() {
         sink.lock().unwrap().push((llm_call, notice.clone()));
     });
 
-    let result = engine.run("retry once").await;
+    let result = engine.run(&mut history, "retry once").await;
     assert!(
         matches!(result.result, agen::EngineRunExit::Finished),
         "engine should succeed after one retry"
@@ -94,6 +95,7 @@ async fn test_callback_text_block_events() {
 
     let client = MockLlmClient::new(events);
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     let text_deltas = Arc::new(Mutex::new(Vec::new()));
     let text_completes = Arc::new(Mutex::new(Vec::new()));
@@ -112,7 +114,7 @@ async fn test_callback_text_block_events() {
     });
 
     // Mutable::run consumes self, returns (Locked, EngineRunExit)
-    let result = engine.run("Greet me").await;
+    let result = engine.run(&mut history, "Greet me").await;
     assert!(
         matches!(result.result, agen::EngineRunExit::Finished),
         "Engine should complete"
@@ -143,6 +145,7 @@ async fn test_callback_tool_call_complete() {
 
     let client = MockLlmClient::new(events);
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     let tool_starts = Arc::new(Mutex::new(Vec::<(String, String)>::new()));
     let tool_completes = Arc::new(Mutex::new(Vec::new()));
@@ -161,7 +164,7 @@ async fn test_callback_tool_call_complete() {
     });
 
     // Mutable::run consumes self, returns (Locked, EngineRunExit)
-    let _ = engine.run("Weather please").await;
+    let _ = engine.run(&mut history, "Weather please").await;
 
     let starts = tool_starts.lock().unwrap();
     assert_eq!(starts.len(), 1);
@@ -189,6 +192,7 @@ async fn test_callback_turn_events() {
 
     let client = MockLlmClient::new(events);
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     let turn_starts = Arc::new(Mutex::new(Vec::new()));
     let turn_ends = Arc::new(Mutex::new(Vec::new()));
@@ -204,7 +208,7 @@ async fn test_callback_turn_events() {
     });
 
     // Mutable::run consumes self, returns (Locked, EngineRunExit)
-    let result = engine.run("Do something").await;
+    let result = engine.run(&mut history, "Do something").await;
     assert!(matches!(result.result, agen::EngineRunExit::Finished));
 
     let starts = turn_starts.lock().unwrap();
@@ -260,6 +264,7 @@ async fn test_callback_tool_result_events() {
 
     let client = MockLlmClient::new(events);
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     engine.register_tool(fixed_tool(
         "fixed",
@@ -282,7 +287,7 @@ async fn test_callback_tool_result_events() {
         ));
     });
 
-    let _ = engine.run("call it").await;
+    let _ = engine.run(&mut history, "call it").await;
 
     let observed = captured.lock().unwrap();
     assert_eq!(observed.len(), 1);
@@ -336,6 +341,7 @@ async fn test_callback_tool_result_error_path() {
 
     let client = MockLlmClient::new(events);
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     engine.register_tool(erroring_tool("erroring", "boom"));
 
@@ -351,7 +357,7 @@ async fn test_callback_tool_result_error_path() {
         ));
     });
 
-    let _ = engine.run("fail it").await;
+    let _ = engine.run(&mut history, "fail it").await;
 
     let observed = captured.lock().unwrap();
     assert_eq!(observed.len(), 1);
@@ -380,6 +386,7 @@ async fn test_callback_usage_events() {
 
     let client = MockLlmClient::new(events);
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     let usage_events = Arc::new(Mutex::new(Vec::new()));
 
@@ -389,7 +396,7 @@ async fn test_callback_usage_events() {
     });
 
     // Mutable::run consumes self, returns (Locked, EngineRunExit)
-    let _ = engine.run("Hello").await;
+    let _ = engine.run(&mut history, "Hello").await;
 
     let usages = usage_events.lock().unwrap();
     assert_eq!(usages.len(), 1);

crates/agen/tests/common/mod.rs

@@ -19,6 +19,7 @@ use std::sync::atomic::{AtomicUsize, Ordering};
 pub struct MockLlmClient {
     responses: Arc<Vec<Vec<Event>>>,
     call_count: Arc<AtomicUsize>,
+    requests: Arc<Mutex<Vec<Request>>>,
 }
 
 impl MockLlmClient {
@@ -30,6 +31,7 @@ impl MockLlmClient {
         Self {
             responses: Arc::new(responses),
             call_count: Arc::new(AtomicUsize::new(0)),
+            requests: Arc::new(Mutex::new(Vec::new())),
         }
     }
 
@@ -41,6 +43,10 @@ impl MockLlmClient {
     pub fn event_count(&self) -> usize {
         self.responses.iter().map(|v| v.len()).sum()
     }
+
+    pub fn requests(&self) -> Vec<Request> {
+        self.requests.lock().unwrap().clone()
+    }
 }
 
 #[async_trait]
@@ -51,8 +57,9 @@ impl LlmClient for MockLlmClient {
 
     async fn stream(
         &self,
-        _request: Request,
+        request: Request,
     ) -> Result<Pin<Box<dyn Stream<Item = Result<Event, ClientError>> + Send>>, ClientError> {
+        self.requests.lock().unwrap().push(request);
         let count = self.call_count.fetch_add(1, Ordering::SeqCst);
         if count >= self.responses.len() {
             return Err(ClientError::Api {

crates/agen/tests/engine_fixtures.rs

@@ -134,9 +134,10 @@ async fn test_engine_simple_text_response() {
 
     let client = MockLlmClient::from_fixture(&fixture_path).unwrap();
     let engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     // Send a simple message (Mutable::run consumes self, returns tuple)
-    let result = engine.run("Hello").await;
+    let result = engine.run(&mut history, "Hello").await;
 
     assert!(
         matches!(result.result, agen::EngineRunExit::Finished),
@@ -159,6 +160,7 @@ async fn test_engine_tool_call() {
 
     let client = MockLlmClient::from_fixture(&fixture_path).unwrap();
     let mut engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     // Register tool
     let weather_tool = MockWeatherTool::new();
@@ -166,7 +168,9 @@ async fn test_engine_tool_call() {
     engine.register_tool(weather_tool.definition());
 
     // Send message (Mutable::run consumes self, returns tuple)
-    let _result = engine.run("What's the weather in Tokyo?").await;
+    let _result = engine
+        .run(&mut history, "What's the weather in Tokyo?")
+        .await;
 
     // Verify tool was called
     // Note: max_turns=1 so no request is sent after tool result
@@ -198,9 +202,10 @@ async fn test_engine_with_programmatic_events() {
 
     let client = MockLlmClient::new(events);
     let engine = Engine::new(client);
+    let mut history = agen::History::new();
 
     // Mutable::run consumes self, returns tuple
-    let result = engine.run("Greet me").await;
+    let result = engine.run(&mut history, "Greet me").await;
 
     assert!(
         matches!(result.result, agen::EngineRunExit::Finished),

crates/agen/tests/reasoning_round_trip_test.rs

@@ -13,12 +13,12 @@
 
 mod common;
 
-use agen::Engine;
 use agen::Item;
 use agen::llm_client::event::{
     BlockMetadata, BlockStart, BlockStop, BlockType, Event, ReasoningBlockData, ResponseStatus,
     StatusEvent,
 };
+use agen::{Engine, History};
 use common::MockLlmClient;
 
 fn reasoning_block(text: impl Into<String>, data: ReasoningBlockData) -> Vec<Event> {
@@ -65,15 +65,15 @@ async fn anthropic_thinking_round_trips_signature_into_history() {
     ]);
     let client = MockLlmClient::new(events);
     let engine = Engine::new(client);
-    let out = engine.run("question?").await;
-    let engine = out.engine;
+    let mut history: History = History::new();
+    let _out = engine.run(&mut history, "question?").await;
 
-    let history = engine.history();
+    let entries = history.entries();
     // user / reasoning / assistant_message
     assert_eq!(history.len(), 3, "history: {history:?}");
 
-    assert!(matches!(history[0], Item::Message { .. }));
-    match &history[1] {
+    assert!(matches!(entries[0].item, Item::Message { .. }));
+    match &entries[1].item {
         Item::Reasoning {
             text, signature, ..
         } => {
@@ -82,7 +82,7 @@ async fn anthropic_thinking_round_trips_signature_into_history() {
         }
         other => panic!("expected Reasoning, got {other:?}"),
     }
-    assert_eq!(history[2].as_text(), Some("Here's the answer"));
+    assert_eq!(entries[2].item.as_text(), Some("Here's the answer"));
 }
 
 /// OpenAI Responses 風: encrypted_content + summary を持った reasoning が
@@ -109,11 +109,11 @@ async fn openai_reasoning_round_trips_encrypted_and_summary() {
     ]);
     let client = MockLlmClient::new(events);
     let engine = Engine::new(client);
-    let out = engine.run("q").await;
-    let engine = out.engine;
+    let mut history: History = History::new();
+    let _out = engine.run(&mut history, "q").await;
 
-    let history = engine.history();
-    match &history[1] {
+    let entries = history.entries();
+    match &entries[1].item {
         Item::Reasoning {
             text,
             summary,
@@ -155,13 +155,13 @@ async fn reasoning_precedes_text_in_assistant_burst() {
     }));
     let client = MockLlmClient::new(events);
     let engine = Engine::new(client);
-    let out = engine.run("q").await;
-    let engine = out.engine;
+    let mut history: History = History::new();
+    let _out = engine.run(&mut history, "q").await;
 
-    let history = engine.history();
+    let entries = history.entries();
     // user / reasoning(先頭) / assistant_message
-    assert!(matches!(history[1], Item::Reasoning { .. }));
-    assert_eq!(history[2].as_text(), Some("intermediate"));
+    assert!(matches!(entries[1].item, Item::Reasoning { .. }));
+    assert_eq!(entries[2].item.as_text(), Some("intermediate"));
 }
 
 /// resume シナリオ: history.json 由来の Item::Reasoning(signature) を Engine に
@@ -207,14 +207,18 @@ async fn injected_reasoning_survives_into_outgoing_request() {
     };
 
     let mut engine = Engine::new(client);
+    let mut history: History = History::new();
     // resume: 既存 history を流し込む
-    engine.set_history(vec![
-        Item::user_message("prior question"),
-        Item::reasoning("prior thinking").with_signature("SIG-PRIOR"),
-        Item::assistant_message("prior answer"),
-    ]);
+    engine.set_history(
+        &mut history,
+        vec![
+            Item::user_message("prior question"),
+            Item::reasoning("prior thinking").with_signature("SIG-PRIOR"),
+            Item::assistant_message("prior answer"),
+        ],
+    );
 
-    let _ = engine.run("follow up").await;
+    let _ = engine.run(&mut history, "follow up").await;
 
     let req = captured
         .lock()

crates/agen/tests/ui/locked_register_tool.rs

@@ -1,4 +1,4 @@
-use agen::Engine;
+use agen::{Engine, History};
 use agen::llm_client::capability::{
     CacheStrategy, ModelCapability, StructuredOutput, ToolCallingSupport,
 };
@@ -22,7 +22,8 @@ fn main() {
         cap,
     );
     let engine = Engine::new(client);
-    let mut locked = engine.lock();
+    let history = History::new();
+    let mut locked = engine.lock(&history);
     let def: agen::tool::ToolDefinition = Arc::new(|| panic!("unused"));
     let _ = locked.register_tool(def);
 }

crates/agen/tests/ui/locked_register_tool.stderr

@@ -1,8 +1,8 @@
 error[E0599]: no method named `register_tool` found for struct `Engine<HttpTransport<AnthropicScheme>, Locked>` in the current scope
-  --> tests/ui/locked_register_tool.rs:27:20
+  --> tests/ui/locked_register_tool.rs:28:20
    |
-27 |     let _ = locked.register_tool(def);
+28 |     let _ = locked.register_tool(def);
    |                    ^^^^^^^^^^^^^ method not found in `Engine<HttpTransport<AnthropicScheme>, Locked>`
    |
    = note: the method was found for
-           - `Engine<C>`
+           - `Engine<C, Mutable, A>`

crates/client/Cargo.toml

@@ -5,19 +5,19 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
+async-trait.workspace = true
+chrono = { version = "0.4", default-features = false, features = ["clock"] }
 protocol = { workspace = true }
-manifest = { workspace = true }
 ticket = { workspace = true }
 futures = { workspace = true }
 reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "native-tls"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
-tokio = { workspace = true, features = ["rt", "macros", "net", "io-util", "sync", "time", "process", "fs"] }
+tokio = { workspace = true, features = ["rt", "macros", "net", "io-util", "sync", "time"] }
 tokio-tungstenite = { workspace = true }
 uuid = { workspace = true }
 workspace-api.workspace = true
-workdir = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }

crates/client/src/backend_api.rs

@@ -0,0 +1,839 @@
+use chrono::{DateTime, Utc};
+use reqwest::{Method, StatusCode, Url, redirect};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use std::env;
+use std::fmt;
+use std::fs::{self, OpenOptions};
+use std::io::Write as _;
+use std::path::{Path, PathBuf};
+
+const TOKEN_FILE_NAME: &str = "backend-tokens.json";
+const MAX_REDIRECTS: usize = 10;
+
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct BackendOrigin(String);
+
+impl BackendOrigin {
+    pub fn parse(input: &str) -> Result<Self, BackendApiClientError> {
+        let url = Url::parse(input.trim()).map_err(|error| {
+            BackendApiClientError::InvalidBackendOrigin(format!(
+                "Backend URL is not a valid absolute URL: {error}"
+            ))
+        })?;
+        if !url.path().bytes().all(|byte| byte == b'/')
+            || url.query().is_some()
+            || url.fragment().is_some()
+        {
+            return Err(BackendApiClientError::InvalidBackendOrigin(
+                "Backend URL must contain only an origin, without a path, query, or fragment"
+                    .to_string(),
+            ));
+        }
+        Self::from_url(url)
+    }
+
+    fn from_url(mut url: Url) -> Result<Self, BackendApiClientError> {
+        if !matches!(url.scheme(), "http" | "https") {
+            return Err(BackendApiClientError::InvalidBackendOrigin(
+                "Backend URL scheme must be http or https".to_string(),
+            ));
+        }
+        if !url.username().is_empty() || url.password().is_some() {
+            return Err(BackendApiClientError::InvalidBackendOrigin(
+                "Backend URL must not contain user information".to_string(),
+            ));
+        }
+        if url.host().is_none() {
+            return Err(BackendApiClientError::InvalidBackendOrigin(
+                "Backend URL must contain a host".to_string(),
+            ));
+        }
+        let default_port = match url.scheme() {
+            "http" => 80,
+            "https" => 443,
+            _ => unreachable!("validated Backend URL scheme"),
+        };
+        if url.port() == Some(default_port) {
+            url.set_port(None).map_err(|()| {
+                BackendApiClientError::InvalidBackendOrigin(
+                    "Backend URL contains an invalid port".to_string(),
+                )
+            })?;
+        }
+        url.set_path("");
+        url.set_query(None);
+        url.set_fragment(None);
+        let normalized = url.as_str().trim_end_matches('/').to_string();
+        Ok(Self(normalized))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    fn url(&self, path_and_query: &str) -> Result<Url, BackendApiClientError> {
+        if !path_and_query.starts_with('/') || path_and_query.starts_with("//") {
+            return Err(BackendApiClientError::InvalidRequestPath(
+                "Backend API request path must start with one `/`".to_string(),
+            ));
+        }
+        Url::parse(&format!("{}{path_and_query}", self.0)).map_err(|error| {
+            BackendApiClientError::InvalidRequestPath(format!(
+                "Backend API request path is invalid: {error}"
+            ))
+        })
+    }
+}
+
+impl fmt::Debug for BackendOrigin {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_tuple("BackendOrigin").field(&self.0).finish()
+    }
+}
+
+impl fmt::Display for BackendOrigin {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+#[derive(Clone)]
+struct BackendAccessToken(String);
+
+impl fmt::Debug for BackendAccessToken {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("BackendAccessToken([REDACTED])")
+    }
+}
+
+#[derive(Clone)]
+pub struct BackendApiClient {
+    origin: BackendOrigin,
+    access_token: BackendAccessToken,
+    asynchronous: reqwest::Client,
+}
+
+impl fmt::Debug for BackendApiClient {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("BackendApiClient")
+            .field("origin", &self.origin)
+            .field("access_token", &self.access_token)
+            .finish_non_exhaustive()
+    }
+}
+
+impl BackendApiClient {
+    pub fn from_stored_token(base_url: &str) -> Result<Self, BackendApiClientError> {
+        let path = backend_token_file_path()?;
+        Self::from_token_file(base_url, &path)
+    }
+
+    fn from_token_file(base_url: &str, path: &Path) -> Result<Self, BackendApiClientError> {
+        let origin = BackendOrigin::parse(base_url)?;
+        let token_file = read_token_file(path)?;
+        let entry = token_file.tokens.get(origin.as_str()).ok_or_else(|| {
+            BackendApiClientError::TokenEntryMissing {
+                origin: origin.clone(),
+                path: path.to_path_buf(),
+            }
+        })?;
+        validate_token_entry(entry, &origin, path)?;
+        Self::new(origin, BackendAccessToken(entry.access_token.clone()))
+    }
+
+    fn new(
+        origin: BackendOrigin,
+        access_token: BackendAccessToken,
+    ) -> Result<Self, BackendApiClientError> {
+        let asynchronous = reqwest::Client::builder()
+            .redirect(redirect_policy(origin.clone()))
+            .build()
+            .map_err(BackendApiClientError::Http)?;
+        Ok(Self {
+            origin,
+            access_token,
+            asynchronous,
+        })
+    }
+
+    pub fn origin(&self) -> &BackendOrigin {
+        &self.origin
+    }
+
+    pub fn request(
+        &self,
+        method: Method,
+        path_and_query: &str,
+    ) -> Result<reqwest::RequestBuilder, BackendApiClientError> {
+        let url = self.origin.url(path_and_query)?;
+        Ok(self
+            .asynchronous
+            .request(method, url)
+            .bearer_auth(&self.access_token.0))
+    }
+
+    pub fn blocking_request(
+        &self,
+        method: Method,
+        path_and_query: &str,
+    ) -> Result<reqwest::blocking::RequestBuilder, BackendApiClientError> {
+        let url = self.origin.url(path_and_query)?;
+        let client = reqwest::blocking::Client::builder()
+            .redirect(redirect_policy(self.origin.clone()))
+            .build()
+            .map_err(BackendApiClientError::Http)?;
+        Ok(client
+            .request(method, url)
+            .bearer_auth(&self.access_token.0))
+    }
+
+    pub(crate) fn authorization_header_value(&self) -> String {
+        format!("Bearer {}", self.access_token.0)
+    }
+
+    pub async fn require_success(
+        &self,
+        response: reqwest::Response,
+    ) -> Result<reqwest::Response, BackendApiClientError> {
+        let status = response.status();
+        match status {
+            StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN => {
+                self.check_status(status)?;
+            }
+            status if !status.is_success() => {
+                let detail = response
+                    .bytes()
+                    .await
+                    .ok()
+                    .and_then(|body| backend_error_detail(&body));
+                return Err(BackendApiClientError::BackendResponse {
+                    origin: self.origin.clone(),
+                    status: status.as_u16(),
+                    detail,
+                });
+            }
+            _ => {}
+        }
+        Ok(response)
+    }
+
+    pub fn check_status(&self, status: StatusCode) -> Result<(), BackendApiClientError> {
+        match status {
+            StatusCode::UNAUTHORIZED => Err(BackendApiClientError::Unauthorized {
+                origin: self.origin.clone(),
+            }),
+            StatusCode::FORBIDDEN => Err(BackendApiClientError::Forbidden {
+                origin: self.origin.clone(),
+            }),
+            status if !status.is_success() => Err(BackendApiClientError::BackendStatus {
+                origin: self.origin.clone(),
+                status: status.as_u16(),
+            }),
+            _ => Ok(()),
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn from_access_token_for_test(
+        base_url: &str,
+        access_token: &str,
+    ) -> Result<Self, BackendApiClientError> {
+        Self::new(
+            BackendOrigin::parse(base_url)?,
+            BackendAccessToken(access_token.to_string()),
+        )
+    }
+}
+
+fn redirect_policy(origin: BackendOrigin) -> redirect::Policy {
+    redirect::Policy::custom(move |attempt| {
+        if attempt.previous().len() >= MAX_REDIRECTS {
+            return attempt.error("Backend request exceeded the redirect limit");
+        }
+        match BackendOrigin::from_url(attempt.url().clone()) {
+            Ok(target_origin) if target_origin == origin => attempt.follow(),
+            Ok(target_origin) => attempt.error(format!(
+                "Backend request refused a cross-origin redirect from {origin} to {target_origin}"
+            )),
+            Err(error) => attempt.error(error.to_string()),
+        }
+    })
+}
+
+#[derive(Deserialize)]
+struct BackendErrorBody {
+    message: String,
+}
+
+fn backend_error_detail(body: &[u8]) -> Option<String> {
+    serde_json::from_slice::<BackendErrorBody>(body)
+        .ok()
+        .map(|body| body.message)
+        .filter(|message| !message.trim().is_empty())
+}
+
+#[derive(Debug)]
+pub enum BackendApiClientError {
+    InvalidBackendOrigin(String),
+    InvalidRequestPath(String),
+    ConfigDirectoryUnavailable,
+    TokenFileMissing {
+        path: PathBuf,
+    },
+    TokenFileMalformed {
+        path: PathBuf,
+        message: String,
+    },
+    TokenEntryMissing {
+        origin: BackendOrigin,
+        path: PathBuf,
+    },
+    TokenExpired {
+        origin: BackendOrigin,
+        expired_at: String,
+    },
+    Http(reqwest::Error),
+    Unauthorized {
+        origin: BackendOrigin,
+    },
+    Forbidden {
+        origin: BackendOrigin,
+    },
+    BackendStatus {
+        origin: BackendOrigin,
+        status: u16,
+    },
+    BackendResponse {
+        origin: BackendOrigin,
+        status: u16,
+        detail: Option<String>,
+    },
+    Io {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+}
+
+impl fmt::Display for BackendApiClientError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidBackendOrigin(message) | Self::InvalidRequestPath(message) => {
+                f.write_str(message)
+            }
+            Self::ConfigDirectoryUnavailable => f.write_str(
+                "cannot locate the client configuration directory for backend-tokens.json",
+            ),
+            Self::TokenFileMissing { path } => write!(
+                f,
+                "Backend token file {} is missing; run `yoi login --backend <BACKEND>` first",
+                path.display()
+            ),
+            Self::TokenFileMalformed { path, message } => write!(
+                f,
+                "Backend token file {} is malformed: {message}; run `yoi login --backend <BACKEND>` again",
+                path.display()
+            ),
+            Self::TokenEntryMissing { origin, path } => write!(
+                f,
+                "no Backend token for {origin} exists in {}; login URLs are matched by normalized origin, so run `yoi login --backend {origin}`",
+                path.display()
+            ),
+            Self::TokenExpired { origin, expired_at } => write!(
+                f,
+                "Backend token for {origin} expired at {expired_at}; run `yoi login --backend {origin}` again"
+            ),
+            Self::Http(error) => write!(f, "Backend request failed: {error}"),
+            Self::Unauthorized { origin } => write!(
+                f,
+                "Backend {origin} returned HTTP 401 for the saved token; it may be expired or revoked, so run `yoi login --backend {origin}` again"
+            ),
+            Self::Forbidden { origin } => write!(
+                f,
+                "Backend {origin} returned HTTP 403; the saved token is authenticated but is not authorized for this operation"
+            ),
+            Self::BackendStatus { origin, status } => {
+                write!(f, "Backend {origin} returned HTTP {status}")
+            }
+            Self::BackendResponse {
+                origin,
+                status,
+                detail,
+            } => {
+                write!(f, "Backend {origin} returned HTTP {status}")?;
+                if let Some(detail) = detail {
+                    write!(f, ": {detail}")?;
+                }
+                Ok(())
+            }
+            Self::Io { path, source } => {
+                write!(f, "failed to access {}: {source}", path.display())
+            }
+        }
+    }
+}
+
+impl std::error::Error for BackendApiClientError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Http(error) => Some(error),
+            Self::Io { source, .. } => Some(source),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct BackendTokenFile {
+    tokens: BTreeMap<String, BackendTokenEntry>,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct BackendTokenEntry {
+    token_type: String,
+    access_token: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    expires_at: Option<String>,
+}
+
+pub fn save_backend_token(
+    base_url: &str,
+    token_type: &str,
+    access_token: &str,
+) -> Result<PathBuf, BackendApiClientError> {
+    save_backend_token_with_expiry(base_url, token_type, access_token, None)
+}
+
+fn save_backend_token_with_expiry(
+    base_url: &str,
+    token_type: &str,
+    access_token: &str,
+    expires_at: Option<String>,
+) -> Result<PathBuf, BackendApiClientError> {
+    let path = backend_token_file_path()?;
+    save_backend_token_to_file(base_url, token_type, access_token, expires_at, &path)?;
+    Ok(path)
+}
+
+fn save_backend_token_to_file(
+    base_url: &str,
+    token_type: &str,
+    access_token: &str,
+    expires_at: Option<String>,
+    path: &Path,
+) -> Result<(), BackendApiClientError> {
+    let origin = BackendOrigin::parse(base_url)?;
+    let mut token_file = if path.exists() {
+        read_token_file(&path)?
+    } else {
+        BackendTokenFile {
+            tokens: BTreeMap::new(),
+        }
+    };
+    let entry = BackendTokenEntry {
+        token_type: token_type.to_string(),
+        access_token: access_token.to_string(),
+        expires_at,
+    };
+    validate_token_entry(&entry, &origin, path)?;
+    token_file.tokens.insert(origin.to_string(), entry);
+    write_token_file(path, &token_file)?;
+    Ok(())
+}
+
+pub fn backend_token_file_path() -> Result<PathBuf, BackendApiClientError> {
+    if let Some(config_home) = env::var_os("XDG_CONFIG_HOME") {
+        return Ok(PathBuf::from(config_home).join("yoi").join(TOKEN_FILE_NAME));
+    }
+    let Some(home) = env::var_os("HOME") else {
+        return Err(BackendApiClientError::ConfigDirectoryUnavailable);
+    };
+    Ok(PathBuf::from(home)
+        .join(".config")
+        .join("yoi")
+        .join(TOKEN_FILE_NAME))
+}
+
+fn read_token_file(path: &Path) -> Result<BackendTokenFile, BackendApiClientError> {
+    let bytes = fs::read(path).map_err(|source| {
+        if source.kind() == std::io::ErrorKind::NotFound {
+            BackendApiClientError::TokenFileMissing {
+                path: path.to_path_buf(),
+            }
+        } else {
+            BackendApiClientError::Io {
+                path: path.to_path_buf(),
+                source,
+            }
+        }
+    })?;
+    let raw: BackendTokenFile = serde_json::from_slice(&bytes).map_err(|error| {
+        BackendApiClientError::TokenFileMalformed {
+            path: path.to_path_buf(),
+            message: error.to_string(),
+        }
+    })?;
+    normalize_token_file(raw, path)
+}
+
+fn normalize_token_file(
+    token_file: BackendTokenFile,
+    path: &Path,
+) -> Result<BackendTokenFile, BackendApiClientError> {
+    let mut normalized = BTreeMap::new();
+    for (raw_origin, entry) in token_file.tokens {
+        let origin = BackendOrigin::parse(&raw_origin).map_err(|error| {
+            BackendApiClientError::TokenFileMalformed {
+                path: path.to_path_buf(),
+                message: format!("token key `{raw_origin}` is invalid: {error}"),
+            }
+        })?;
+        if normalized.insert(origin.to_string(), entry).is_some() {
+            return Err(BackendApiClientError::TokenFileMalformed {
+                path: path.to_path_buf(),
+                message: format!("more than one token entry normalizes to `{origin}`"),
+            });
+        }
+    }
+    Ok(BackendTokenFile { tokens: normalized })
+}
+
+fn validate_token_entry(
+    entry: &BackendTokenEntry,
+    origin: &BackendOrigin,
+    path: &Path,
+) -> Result<(), BackendApiClientError> {
+    if !entry.token_type.eq_ignore_ascii_case("Bearer") {
+        return Err(BackendApiClientError::TokenFileMalformed {
+            path: path.to_path_buf(),
+            message: format!("token for `{origin}` does not use the Bearer token type"),
+        });
+    }
+    if entry.access_token.trim().is_empty()
+        || entry.access_token.contains('\r')
+        || entry.access_token.contains('\n')
+    {
+        return Err(BackendApiClientError::TokenFileMalformed {
+            path: path.to_path_buf(),
+            message: format!("token for `{origin}` is empty or contains an invalid line break"),
+        });
+    }
+    if reqwest::header::HeaderValue::from_str(&format!("Bearer {}", entry.access_token)).is_err() {
+        return Err(BackendApiClientError::TokenFileMalformed {
+            path: path.to_path_buf(),
+            message: format!("token for `{origin}` cannot be represented as an HTTP header"),
+        });
+    }
+    if let Some(expires_at) = entry.expires_at.as_deref() {
+        let expiration = DateTime::parse_from_rfc3339(expires_at).map_err(|error| {
+            BackendApiClientError::TokenFileMalformed {
+                path: path.to_path_buf(),
+                message: format!("token for `{origin}` has invalid expires_at: {error}"),
+            }
+        })?;
+        if expiration <= Utc::now() {
+            return Err(BackendApiClientError::TokenExpired {
+                origin: origin.clone(),
+                expired_at: expires_at.to_string(),
+            });
+        }
+    }
+    Ok(())
+}
+
+fn write_token_file(
+    path: &Path,
+    token_file: &BackendTokenFile,
+) -> Result<(), BackendApiClientError> {
+    let parent = path
+        .parent()
+        .ok_or(BackendApiClientError::ConfigDirectoryUnavailable)?;
+    fs::create_dir_all(parent).map_err(|source| BackendApiClientError::Io {
+        path: parent.to_path_buf(),
+        source,
+    })?;
+    let payload = serde_json::to_vec_pretty(token_file).map_err(|error| {
+        BackendApiClientError::TokenFileMalformed {
+            path: path.to_path_buf(),
+            message: error.to_string(),
+        }
+    })?;
+    let temp_path = parent.join(format!(".{TOKEN_FILE_NAME}.tmp-{}", std::process::id()));
+    let mut options = OpenOptions::new();
+    options.write(true).create(true).truncate(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+    }
+    let mut file = options
+        .open(&temp_path)
+        .map_err(|source| BackendApiClientError::Io {
+            path: temp_path.clone(),
+            source,
+        })?;
+    file.write_all(&payload)
+        .and_then(|()| file.write_all(b"\n"))
+        .and_then(|()| file.sync_all())
+        .map_err(|source| BackendApiClientError::Io {
+            path: temp_path.clone(),
+            source,
+        })?;
+    fs::rename(&temp_path, path).map_err(|source| BackendApiClientError::Io {
+        path: path.to_path_buf(),
+        source,
+    })?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{Read, Write};
+    use std::net::TcpListener;
+    use std::thread;
+    use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+    fn temp_path(label: &str) -> PathBuf {
+        let nonce = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_nanos();
+        env::temp_dir().join(format!(
+            "yoi-client-{label}-{}-{nonce}.json",
+            std::process::id()
+        ))
+    }
+
+    fn write_fixture(path: &Path, value: serde_json::Value) {
+        fs::write(path, serde_json::to_vec(&value).unwrap()).unwrap();
+    }
+
+    #[test]
+    fn backend_origin_normalizes_safe_equivalents() {
+        let variants = [
+            "HTTP://Example.COM",
+            "http://example.com/",
+            "http://example.com:80////",
+        ];
+        for variant in variants {
+            assert_eq!(
+                BackendOrigin::parse(variant).unwrap().as_str(),
+                "http://example.com"
+            );
+        }
+        assert_eq!(
+            BackendOrigin::parse("https://EXAMPLE.com:443/")
+                .unwrap()
+                .as_str(),
+            "https://example.com"
+        );
+        assert_eq!(
+            BackendOrigin::parse("https://example.com:8443/")
+                .unwrap()
+                .as_str(),
+            "https://example.com:8443"
+        );
+    }
+
+    #[test]
+    fn backend_error_detail_preserves_public_server_message() {
+        let detail = backend_error_detail(
+            br#"{"error":"Bad Request","message":"working_directory_runtime_mismatch: Working directory is owned by a different Runtime","diagnostics":[{"code":"working_directory_runtime_mismatch"}]}"#,
+        );
+        let error = BackendApiClientError::BackendResponse {
+            origin: BackendOrigin::parse("http://127.0.0.1:8787").unwrap(),
+            status: 400,
+            detail,
+        };
+
+        assert_eq!(
+            error.to_string(),
+            "Backend http://127.0.0.1:8787 returned HTTP 400: working_directory_runtime_mismatch: Working directory is owned by a different Runtime"
+        );
+    }
+
+    #[test]
+    fn backend_origin_rejects_unsafe_authority_changes() {
+        for invalid in [
+            "ftp://example.com",
+            "https://user@example.com",
+            "https://example.com/api",
+            "https://example.com/?query=1",
+            "https://example.com/#fragment",
+        ] {
+            assert!(BackendOrigin::parse(invalid).is_err(), "accepted {invalid}");
+        }
+        assert_ne!(
+            BackendOrigin::parse("http://localhost:8787").unwrap(),
+            BackendOrigin::parse("http://127.0.0.1:8787").unwrap()
+        );
+    }
+
+    #[test]
+    fn token_lookup_distinguishes_missing_malformed_mismatch_and_expired() {
+        let missing = temp_path("missing");
+        assert!(matches!(
+            BackendApiClient::from_token_file("http://localhost:8787", &missing),
+            Err(BackendApiClientError::TokenFileMissing { .. })
+        ));
+
+        let malformed = temp_path("malformed");
+        fs::write(&malformed, b"not json").unwrap();
+        assert!(matches!(
+            BackendApiClient::from_token_file("http://localhost:8787", &malformed),
+            Err(BackendApiClientError::TokenFileMalformed { .. })
+        ));
+
+        let mismatch = temp_path("mismatch");
+        write_fixture(
+            &mismatch,
+            serde_json::json!({"tokens": {"http://localhost:8787": {
+                "token_type": "Bearer", "access_token": "secret"
+            }}}),
+        );
+        assert!(matches!(
+            BackendApiClient::from_token_file("http://127.0.0.1:8787", &mismatch),
+            Err(BackendApiClientError::TokenEntryMissing { .. })
+        ));
+
+        let expired = temp_path("expired");
+        write_fixture(
+            &expired,
+            serde_json::json!({"tokens": {"http://localhost:8787": {
+                "token_type": "Bearer",
+                "access_token": "secret",
+                "expires_at": "2000-01-01T00:00:00Z"
+            }}}),
+        );
+        assert!(matches!(
+            BackendApiClient::from_token_file("http://localhost:8787", &expired),
+            Err(BackendApiClientError::TokenExpired { .. })
+        ));
+
+        for path in [malformed, mismatch, expired] {
+            let _ = fs::remove_file(path);
+        }
+    }
+
+    #[test]
+    fn token_write_and_lookup_share_origin_normalization() {
+        let path = temp_path("normalized-write");
+        save_backend_token_to_file(
+            "HTTP://Example.COM:80////",
+            "Bearer",
+            "normalized-secret",
+            None,
+            &path,
+        )
+        .unwrap();
+        let contents = fs::read_to_string(&path).unwrap();
+        assert!(contents.contains("\"http://example.com\""));
+        let client = BackendApiClient::from_token_file("http://example.com/", &path).unwrap();
+        assert_eq!(
+            client.authorization_header_value(),
+            "Bearer normalized-secret"
+        );
+        fs::remove_file(path).unwrap();
+    }
+
+    #[test]
+    fn client_debug_and_errors_never_include_token_value() {
+        let client = BackendApiClient::from_access_token_for_test(
+            "http://localhost:8787",
+            "never-print-this-token",
+        )
+        .unwrap();
+        assert!(!format!("{client:?}").contains("never-print-this-token"));
+        assert!(
+            !BackendApiClientError::Unauthorized {
+                origin: client.origin().clone()
+            }
+            .to_string()
+            .contains("never-print-this-token")
+        );
+    }
+
+    #[test]
+    fn authenticated_requests_follow_only_same_origin_redirects() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let origin = format!("http://{}", listener.local_addr().unwrap());
+        let handle = thread::spawn(move || {
+            for response in [
+                "HTTP/1.1 302 Found\r\nLocation: /final\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+                "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            ] {
+                let (mut stream, _) = listener.accept().unwrap();
+                let mut request = vec![0; 4096];
+                let read = stream.read(&mut request).unwrap();
+                let request = String::from_utf8_lossy(&request[..read]).to_ascii_lowercase();
+                assert!(request.contains("authorization: bearer redirect-secret\r\n"));
+                stream.write_all(response.as_bytes()).unwrap();
+            }
+        });
+        let client =
+            BackendApiClient::from_access_token_for_test(&origin, "redirect-secret").unwrap();
+        let response = client
+            .blocking_request(Method::GET, "/start")
+            .unwrap()
+            .send()
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+        handle.join().unwrap();
+    }
+
+    #[test]
+    fn authenticated_requests_reject_cross_origin_redirects_without_leaking_token() {
+        let source = TcpListener::bind("127.0.0.1:0").unwrap();
+        let target = TcpListener::bind("127.0.0.1:0").unwrap();
+        target.set_nonblocking(true).unwrap();
+        let source_origin = format!("http://{}", source.local_addr().unwrap());
+        let target_origin = format!("http://{}", target.local_addr().unwrap());
+        let location = format!("{target_origin}/capture");
+        let handle = thread::spawn(move || {
+            let (mut stream, _) = source.accept().unwrap();
+            let mut request = vec![0; 4096];
+            let read = stream.read(&mut request).unwrap();
+            let request = String::from_utf8_lossy(&request[..read]).to_ascii_lowercase();
+            assert!(request.contains("authorization: bearer redirect-secret\r\n"));
+            let response = format!(
+                "HTTP/1.1 302 Found\r\nLocation: {location}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+            );
+            stream.write_all(response.as_bytes()).unwrap();
+        });
+        let client =
+            BackendApiClient::from_access_token_for_test(&source_origin, "redirect-secret")
+                .unwrap();
+        let error = client
+            .blocking_request(Method::GET, "/start")
+            .unwrap()
+            .send()
+            .unwrap_err();
+        let message = error.to_string();
+        assert!(message.contains("redirect"));
+        assert!(!message.contains("redirect-secret"));
+        handle.join().unwrap();
+        thread::sleep(Duration::from_millis(20));
+        assert!(matches!(
+            target.accept(),
+            Err(error) if error.kind() == std::io::ErrorKind::WouldBlock
+        ));
+    }
+
+    #[test]
+    fn status_diagnostics_distinguish_unauthorized_and_forbidden() {
+        let client =
+            BackendApiClient::from_access_token_for_test("http://localhost:8787", "secret")
+                .unwrap();
+        assert!(matches!(
+            client.check_status(StatusCode::UNAUTHORIZED),
+            Err(BackendApiClientError::Unauthorized { .. })
+        ));
+        assert!(matches!(
+            client.check_status(StatusCode::FORBIDDEN),
+            Err(BackendApiClientError::Forbidden { .. })
+        ));
+    }
+}

crates/client/src/backend_auth.rs

@@ -1,7 +1,11 @@
-use serde::{Deserialize, Serialize};
+use crate::BackendOrigin;
+use serde::Deserialize;
 use std::fmt;
 use std::time::Duration;
 
+use workspace_api::{DeviceLoginPollRequest, DeviceLoginPollStatus, DeviceLoginStartRequest};
+pub use workspace_api::{DeviceLoginPollResponse, DeviceLoginStartResponse};
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct BackendAuthTarget {
     pub base_url: String,
@@ -9,9 +13,11 @@ pub struct BackendAuthTarget {
 
 impl BackendAuthTarget {
     pub fn new(base_url: impl Into<String>) -> Self {
-        Self {
-            base_url: base_url.into(),
-        }
+        let base_url = base_url.into();
+        let base_url = BackendOrigin::parse(&base_url)
+            .map(|origin| origin.to_string())
+            .unwrap_or(base_url);
+        Self { base_url }
     }
 
     fn api_url(&self, path: &str) -> String {
@@ -25,23 +31,6 @@ impl BackendAuthTarget {
     }
 }
 
-#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
-pub struct DeviceLoginStartResponse {
-    pub device_code: String,
-    pub user_code: String,
-    pub verification_uri: String,
-    pub verification_uri_complete: String,
-    pub expires_in: u64,
-    pub interval: u64,
-}
-
-#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
-pub struct DeviceLoginPollResponse {
-    pub status: String,
-    pub access_token: Option<String>,
-    pub token_type: Option<String>,
-}
-
 #[derive(Debug)]
 pub enum BackendAuthClientError {
     Http(reqwest::Error),
@@ -71,16 +60,6 @@ impl From<reqwest::Error> for BackendAuthClientError {
     }
 }
 
-#[derive(Debug, Serialize)]
-struct DeviceLoginStartRequest<'a> {
-    client_name: Option<&'a str>,
-}
-
-#[derive(Debug, Serialize)]
-struct DeviceLoginPollRequest<'a> {
-    device_code: &'a str,
-}
-
 pub async fn start_device_login(
     target: &BackendAuthTarget,
     client_name: Option<&str>,
@@ -88,7 +67,9 @@ pub async fn start_device_login(
     let client = reqwest::Client::new();
     let response = client
         .post(target.api_url("/api/auth/device-login/start"))
-        .json(&DeviceLoginStartRequest { client_name })
+        .json(&DeviceLoginStartRequest {
+            client_name: client_name.map(ToOwned::to_owned),
+        })
         .send()
         .await?;
     parse_json_response(response).await
@@ -101,12 +82,38 @@ pub async fn poll_device_login(
     let client = reqwest::Client::new();
     let response = client
         .post(target.api_url("/api/auth/device-login/poll"))
-        .json(&DeviceLoginPollRequest { device_code })
+        .json(&DeviceLoginPollRequest {
+            device_code: device_code.to_string(),
+        })
         .send()
         .await?;
     parse_json_response(response).await
 }
 
+fn device_login_poll_result(
+    response: DeviceLoginPollResponse,
+) -> Result<Option<String>, BackendAuthClientError> {
+    match response.status {
+        DeviceLoginPollStatus::Approved => response
+            .access_token
+            .ok_or(BackendAuthClientError::MissingAccessToken)
+            .map(Some),
+        DeviceLoginPollStatus::Expired => Err(BackendAuthClientError::BackendStatus {
+            status: 410,
+            body: "device login expired".to_string(),
+        }),
+        DeviceLoginPollStatus::Denied => Err(BackendAuthClientError::BackendStatus {
+            status: 403,
+            body: "device login was denied".to_string(),
+        }),
+        DeviceLoginPollStatus::Consumed => Err(BackendAuthClientError::BackendStatus {
+            status: 409,
+            body: "device login was already consumed".to_string(),
+        }),
+        DeviceLoginPollStatus::Pending => Ok(None),
+    }
+}
+
 pub async fn wait_for_device_login(
     target: &BackendAuthTarget,
     device_code: &str,
@@ -116,25 +123,8 @@ pub async fn wait_for_device_login(
     let started = std::time::Instant::now();
     loop {
         let response = poll_device_login(target, device_code).await?;
-        match response.status.as_str() {
-            "approved" => {
-                return response
-                    .access_token
-                    .ok_or(BackendAuthClientError::MissingAccessToken);
-            }
-            "expired" => {
-                return Err(BackendAuthClientError::BackendStatus {
-                    status: 410,
-                    body: "device login expired".to_string(),
-                });
-            }
-            "consumed" => {
-                return Err(BackendAuthClientError::BackendStatus {
-                    status: 409,
-                    body: "device login was already consumed".to_string(),
-                });
-            }
-            _ => {}
+        if let Some(access_token) = device_login_poll_result(response)? {
+            return Ok(access_token);
         }
         if started.elapsed() >= expires_in {
             return Err(BackendAuthClientError::BackendStatus {
@@ -159,3 +149,81 @@ async fn parse_json_response<T: for<'de> Deserialize<'de>>(
     }
     Ok(response.json::<T>().await?)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use workspace_api::DeviceAccessTokenType;
+
+    fn poll_response(status: DeviceLoginPollStatus) -> DeviceLoginPollResponse {
+        DeviceLoginPollResponse {
+            status,
+            access_token: None,
+            token_type: None,
+        }
+    }
+
+    #[test]
+    fn device_login_start_response_enforces_shared_expiry_bounds() {
+        let valid = serde_json::json!({
+            "device_code": "device-secret",
+            "user_code": "ABCD-EFGH",
+            "verification_uri": "https://yoi.example/login/device",
+            "verification_uri_complete": "https://yoi.example/login/device?user_code=ABCD-EFGH",
+            "expires_in": 600,
+            "interval": 5
+        });
+        assert!(serde_json::from_value::<DeviceLoginStartResponse>(valid.clone()).is_ok());
+
+        let mut expired = valid;
+        expired["expires_in"] = serde_json::json!(0);
+        assert!(serde_json::from_value::<DeviceLoginStartResponse>(expired).is_err());
+    }
+
+    #[test]
+    fn device_login_poll_response_rejects_unknown_status() {
+        assert!(
+            serde_json::from_value::<DeviceLoginPollResponse>(
+                serde_json::json!({"status": "future_status"}),
+            )
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn device_login_poll_result_handles_pending_and_terminal_states() {
+        assert!(
+            device_login_poll_result(poll_response(DeviceLoginPollStatus::Pending))
+                .unwrap()
+                .is_none()
+        );
+
+        let approved = DeviceLoginPollResponse {
+            status: DeviceLoginPollStatus::Approved,
+            access_token: Some("access-secret".to_string()),
+            token_type: Some(DeviceAccessTokenType::Bearer),
+        };
+        assert_eq!(
+            device_login_poll_result(approved).unwrap(),
+            Some("access-secret".to_string())
+        );
+        assert!(matches!(
+            device_login_poll_result(poll_response(DeviceLoginPollStatus::Approved)),
+            Err(BackendAuthClientError::MissingAccessToken)
+        ));
+
+        for (status, expected_http_status) in [
+            (DeviceLoginPollStatus::Expired, 410),
+            (DeviceLoginPollStatus::Denied, 403),
+            (DeviceLoginPollStatus::Consumed, 409),
+        ] {
+            assert!(matches!(
+                device_login_poll_result(poll_response(status)),
+                Err(BackendAuthClientError::BackendStatus {
+                    status,
+                    ..
+                }) if status == expected_http_status
+            ));
+        }
+    }
+}

crates/client/src/backend_runtime.rs

@@ -1,20 +1,30 @@
-use futures::{SinkExt, StreamExt};
-use protocol::stream::{decode_event, encode_method};
-use protocol::{ErrorCode, Event, Method};
-use std::collections::VecDeque;
+use crate::transport::websocket::{Socket as WebSocket, SocketError as WebSocketError};
+use crate::{BackendApiClient, BackendApiClientError, Client};
+use reqwest::Method as HttpMethod;
+use serde::Deserialize;
 use std::fmt;
-use tokio::sync::mpsc;
-use tokio_tungstenite::connect_async;
-use tokio_tungstenite::tungstenite::Message as TungsteniteMessage;
-pub use workdir::workspace::WorkingDirectorySummary as BackendWorkingDirectorySummary;
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tokio_tungstenite::tungstenite::http::HeaderValue;
+use tokio_tungstenite::tungstenite::http::header::AUTHORIZATION;
 pub use workspace_api::{
-    Diagnostic as BackendDiagnostic, DiagnosticSeverity as BackendDiagnosticSeverity,
-    ListResponse as BackendRuntimeListResponse, RuntimeSummary as BackendRuntimeSummary,
+    BrowserCreateWorkerResponse as BackendCreateWorkerResponse,
+    CreateWorkspaceWorkerRequest as BackendCreateWorkerRequest, Diagnostic as BackendDiagnostic,
+    DiagnosticSeverity as BackendDiagnosticSeverity, ListResponse as BackendRuntimeListResponse,
+    RuntimeSummary as BackendRuntimeSummary,
     WorkerCapabilitySummary as BackendWorkerCapabilitySummary,
     WorkerImplementationSummary as BackendWorkerImplementationSummary,
+    WorkerLaunchOptionsResponse as BackendWorkerLaunchOptions,
+    WorkerLaunchProfileCandidate as BackendWorkerLaunchProfileCandidate,
+    WorkerLaunchRuntimeOption as BackendWorkerLaunchRuntimeOption,
+    WorkerOperationState as BackendWorkerOperationState,
     WorkerRestoreResponse as BackendWorkerRestoreResponse,
     WorkerRestoreResult as BackendWorkerRestoreResult, WorkerSummary as BackendWorkerSummary,
     WorkerWorkspaceSummary as BackendWorkerWorkspaceSummary,
+    WorkingDirectoryCreateRequest as BackendWorkingDirectoryCreateRequest,
+    WorkingDirectoryCreateResponse as BackendWorkingDirectoryCreateResponse,
+    WorkingDirectoryDetailResponse as BackendWorkingDirectoryDetailResponse,
+    WorkingDirectoryListResponse as BackendWorkingDirectoryListResponse,
+    WorkingDirectorySummary as BackendWorkingDirectorySummary,
 };
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -48,6 +58,164 @@ impl BackendRuntimeTarget {
     pub fn display_label(&self) -> String {
         format!("{}:{}", self.runtime_id, self.worker_id)
     }
+
+    pub async fn upload_file(
+        &self,
+        file_name: &str,
+        media_type: &str,
+        content: Vec<u8>,
+    ) -> Result<protocol::UploadedFileRef, BackendRuntimeClientError> {
+        self.upload_file_with_id(
+            &uuid::Uuid::now_v7().to_string(),
+            file_name,
+            media_type,
+            content,
+        )
+        .await
+    }
+
+    pub async fn upload_file_with_id(
+        &self,
+        upload_id: &str,
+        file_name: &str,
+        media_type: &str,
+        content: Vec<u8>,
+    ) -> Result<protocol::UploadedFileRef, BackendRuntimeClientError> {
+        let api = BackendApiClient::from_stored_token(&self.base_url)?;
+        let worker_path = format!(
+            "/api/w/{}/runtimes/{}/workers/{}",
+            path_segment_encode(&self.workspace_id),
+            path_segment_encode(&self.runtime_id),
+            path_segment_encode(&self.worker_id),
+        );
+        let grant_path = format!(
+            "{worker_path}/attachment-upload-grants?file_name={}&media_type={}&upload_id={}",
+            path_segment_encode(file_name),
+            path_segment_encode(media_type),
+            path_segment_encode(&upload_id),
+        );
+        let grant_response = api
+            .request(HttpMethod::POST, &grant_path)?
+            .send()
+            .await
+            .map_err(BackendRuntimeClientError::Http)?;
+        api.check_status(grant_response.status())?;
+        let grant = grant_response
+            .json::<AttachmentUploadGrantResponse>()
+            .await
+            .map_err(BackendRuntimeClientError::Http)?;
+        let upload_path = format!(
+            "{worker_path}/attachment-uploads/{}",
+            path_segment_encode(&grant.upload_id),
+        );
+        let response = api
+            .request(HttpMethod::PUT, &upload_path)?
+            .body(content)
+            .send()
+            .await
+            .map_err(BackendRuntimeClientError::Http)?;
+        api.check_status(response.status())?;
+        response
+            .json::<UploadedFileResponse>()
+            .await
+            .map(|response| response.file)
+            .map_err(BackendRuntimeClientError::Http)
+    }
+
+    pub async fn cancel_file_upload(
+        &self,
+        upload_id: &str,
+    ) -> Result<(), BackendRuntimeClientError> {
+        let api = BackendApiClient::from_stored_token(&self.base_url)?;
+        let path = format!(
+            "/api/w/{}/runtimes/{}/workers/{}/attachment-uploads/{}",
+            path_segment_encode(&self.workspace_id),
+            path_segment_encode(&self.runtime_id),
+            path_segment_encode(&self.worker_id),
+            path_segment_encode(upload_id),
+        );
+        let response = api
+            .request(HttpMethod::DELETE, &path)?
+            .send()
+            .await
+            .map_err(BackendRuntimeClientError::Http)?;
+        api.check_status(response.status())?;
+        Ok(())
+    }
+
+    pub async fn delete_uploaded_file(
+        &self,
+        artifact_id: &str,
+    ) -> Result<(), BackendRuntimeClientError> {
+        let api = BackendApiClient::from_stored_token(&self.base_url)?;
+        let path = format!(
+            "/api/w/{}/runtimes/{}/workers/{}/attachments/{}",
+            path_segment_encode(&self.workspace_id),
+            path_segment_encode(&self.runtime_id),
+            path_segment_encode(&self.worker_id),
+            path_segment_encode(artifact_id),
+        );
+        let response = api
+            .request(HttpMethod::DELETE, &path)?
+            .send()
+            .await
+            .map_err(BackendRuntimeClientError::Http)?;
+        api.check_status(response.status())?;
+        Ok(())
+    }
+}
+
+#[derive(Deserialize)]
+struct AttachmentUploadGrantResponse {
+    upload_id: String,
+    #[allow(dead_code)]
+    expires_at_ms: u64,
+}
+
+#[derive(Deserialize)]
+struct UploadedFileResponse {
+    file: protocol::UploadedFileRef,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BackendWorkerLaunchTarget {
+    pub base_url: String,
+    pub workspace_id: Option<String>,
+}
+
+impl BackendWorkerLaunchTarget {
+    pub fn new(base_url: impl Into<String>, workspace_id: Option<String>) -> Self {
+        Self {
+            base_url: base_url.into(),
+            workspace_id,
+        }
+    }
+
+    pub fn select_workspace(&mut self, workspace_id: impl Into<String>) {
+        self.workspace_id = Some(workspace_id.into());
+    }
+
+    pub fn workspace_id(&self) -> Option<&str> {
+        self.workspace_id.as_deref()
+    }
+
+    pub fn runtime_target(
+        &self,
+        runtime_id: impl Into<String>,
+        worker_id: impl Into<String>,
+    ) -> Result<BackendRuntimeTarget, BackendRuntimeClientError> {
+        let workspace_id = self.workspace_id.clone().ok_or_else(|| {
+            BackendRuntimeClientError::InvalidTarget(
+                "workspace_id is required before creating a Backend worker".to_string(),
+            )
+        })?;
+        Ok(BackendRuntimeTarget::new(
+            self.base_url.clone(),
+            workspace_id,
+            runtime_id,
+            worker_id,
+        ))
+    }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -101,43 +269,96 @@ impl BackendRuntimeListTarget {
     }
 }
 
-#[derive(Debug)]
-pub struct BackendRuntimeClient {
-    target: BackendRuntimeTarget,
-    command_tx: mpsc::UnboundedSender<Method>,
-    events: mpsc::UnboundedReceiver<Event>,
-    diagnostics: VecDeque<Event>,
-    _protocol_task: tokio::task::JoinHandle<()>,
-}
-
 #[derive(Debug)]
 pub enum BackendRuntimeClientError {
     InvalidTarget(String),
+    Api(BackendApiClientError),
     Http(reqwest::Error),
+    Protocol(String),
 }
 
 impl fmt::Display for BackendRuntimeClientError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             Self::InvalidTarget(message) => f.write_str(message),
+            Self::Api(error) => write!(f, "{error}"),
             Self::Http(error) => write!(f, "{error}"),
+            Self::Protocol(message) => f.write_str(message),
         }
     }
 }
 
 impl std::error::Error for BackendRuntimeClientError {}
 
+impl From<BackendApiClientError> for BackendRuntimeClientError {
+    fn from(error: BackendApiClientError) -> Self {
+        Self::Api(error)
+    }
+}
+
 impl From<reqwest::Error> for BackendRuntimeClientError {
     fn from(error: reqwest::Error) -> Self {
         Self::Http(error)
     }
 }
 
+pub async fn get_backend_worker_launch_options(
+    target: &BackendWorkerLaunchTarget,
+) -> Result<BackendWorkerLaunchOptions, BackendRuntimeClientError> {
+    validate_launch_target(target)?;
+    let api = BackendApiClient::from_stored_token(&target.base_url)?;
+    get_backend_worker_launch_options_with_client(target, &api).await
+}
+
+async fn get_backend_worker_launch_options_with_client(
+    target: &BackendWorkerLaunchTarget,
+    api: &BackendApiClient,
+) -> Result<BackendWorkerLaunchOptions, BackendRuntimeClientError> {
+    let path = backend_workspace_workers_launch_options_path(
+        target
+            .workspace_id
+            .as_deref()
+            .expect("validated Backend Workspace scope"),
+    );
+    let response = api.request(HttpMethod::GET, &path)?.send().await?;
+    let response = api.require_success(response).await?;
+    Ok(response.json::<BackendWorkerLaunchOptions>().await?)
+}
+
+pub async fn create_backend_worker(
+    target: &BackendWorkerLaunchTarget,
+    request: &BackendCreateWorkerRequest,
+) -> Result<BackendCreateWorkerResponse, BackendRuntimeClientError> {
+    validate_launch_target(target)?;
+    let api = BackendApiClient::from_stored_token(&target.base_url)?;
+    create_backend_worker_with_client(target, request, &api).await
+}
+
+async fn create_backend_worker_with_client(
+    target: &BackendWorkerLaunchTarget,
+    request: &BackendCreateWorkerRequest,
+    api: &BackendApiClient,
+) -> Result<BackendCreateWorkerResponse, BackendRuntimeClientError> {
+    let path = backend_workspace_workers_path(
+        target
+            .workspace_id
+            .as_deref()
+            .expect("validated Backend Workspace scope"),
+    );
+    let response = api
+        .request(HttpMethod::POST, &path)?
+        .json(request)
+        .send()
+        .await?;
+    let response = api.require_success(response).await?;
+    Ok(response.json::<BackendCreateWorkerResponse>().await?)
+}
+
 pub async fn list_backend_workers(
     target: &BackendRuntimeListTarget,
 ) -> Result<BackendRuntimeListResponse<BackendWorkerSummary>, BackendRuntimeClientError> {
     validate_list_target(target)?;
-    let http = reqwest::Client::new();
+    let api = BackendApiClient::from_stored_token(&target.base_url)?;
     if let Some(runtime_id) = target.runtime_id.as_deref() {
         let path = backend_runtime_workers_path(
             target
@@ -146,12 +367,9 @@ pub async fn list_backend_workers(
                 .expect("validated Backend Workspace scope"),
             runtime_id,
         );
-        let url = join_base_and_path(&target.base_url, &path);
-        return Ok(http
-            .get(url)
-            .send()
-            .await?
-            .error_for_status()?
+        let response = api.request(HttpMethod::GET, &path)?.send().await?;
+        api.check_status(response.status())?;
+        return Ok(response
             .json::<BackendRuntimeListResponse<BackendWorkerSummary>>()
             .await?);
     }
@@ -162,12 +380,9 @@ pub async fn list_backend_workers(
             .as_deref()
             .expect("validated Backend Workspace scope"),
     );
-    let runtime_url = join_base_and_path(&target.base_url, &runtime_path);
-    let runtimes = http
-        .get(runtime_url)
-        .send()
-        .await?
-        .error_for_status()?
+    let response = api.request(HttpMethod::GET, &runtime_path)?.send().await?;
+    api.check_status(response.status())?;
+    let runtimes = response
         .json::<BackendRuntimeListResponse<BackendRuntimeSummary>>()
         .await?;
 
@@ -181,29 +396,43 @@ pub async fn list_backend_workers(
                 .expect("validated Backend Workspace scope"),
             &runtime.runtime_id,
         );
-        let url = join_base_and_path(&target.base_url, &path);
-        match http
-            .get(url)
-            .send()
-            .await
-            .and_then(|response| response.error_for_status())
-        {
-            Ok(response) => {
-                let response = response
-                    .json::<BackendRuntimeListResponse<BackendWorkerSummary>>()
-                    .await?;
-                diagnostics.extend(response.diagnostics);
-                items.extend(response.items);
+        let response = match api.request(HttpMethod::GET, &path)?.send().await {
+            Ok(response) => response,
+            Err(error) => {
+                diagnostics.push(BackendDiagnostic {
+                    code: "runtime_worker_list_failed".to_string(),
+                    severity: BackendDiagnosticSeverity::Error,
+                    message: format!(
+                        "failed to list workers for runtime {}: {error}",
+                        runtime.runtime_id
+                    ),
+                });
+                continue;
             }
-            Err(error) => diagnostics.push(BackendDiagnostic {
+        };
+        if matches!(
+            response.status(),
+            reqwest::StatusCode::UNAUTHORIZED | reqwest::StatusCode::FORBIDDEN
+        ) {
+            api.check_status(response.status())?;
+        }
+        if !response.status().is_success() {
+            diagnostics.push(BackendDiagnostic {
                 code: "runtime_worker_list_failed".to_string(),
                 severity: BackendDiagnosticSeverity::Error,
                 message: format!(
-                    "failed to list workers for runtime {}: {error}",
-                    runtime.runtime_id
+                    "failed to list workers for runtime {}: Backend returned HTTP {}",
+                    runtime.runtime_id,
+                    response.status().as_u16()
                 ),
-            }),
+            });
+            continue;
         }
+        let response = response
+            .json::<BackendRuntimeListResponse<BackendWorkerSummary>>()
+            .await?;
+        diagnostics.extend(response.diagnostics);
+        items.extend(response.items);
     }
 
     Ok(BackendRuntimeListResponse {
@@ -224,7 +453,7 @@ pub async fn list_backend_stopped_workers(
             "stopped worker listing requires a runtime id".to_string(),
         ));
     };
-    let http = reqwest::Client::new();
+    let api = BackendApiClient::from_stored_token(&target.base_url)?;
     let path = backend_runtime_workers_path(
         target
             .workspace_id
@@ -232,12 +461,12 @@ pub async fn list_backend_stopped_workers(
             .expect("validated Backend Workspace scope"),
         runtime_id,
     );
-    let url = join_base_and_path(&target.base_url, &format!("{path}?status=stopped"));
-    Ok(http
-        .get(url)
+    let response = api
+        .request(HttpMethod::GET, &format!("{path}?status=stopped"))?
         .send()
-        .await?
-        .error_for_status()?
+        .await?;
+    api.check_status(response.status())?;
+    Ok(response
         .json::<BackendRuntimeListResponse<BackendWorkerSummary>>()
         .await?)
 }
@@ -246,166 +475,61 @@ pub async fn restore_backend_worker(
     target: &BackendRuntimeTarget,
 ) -> Result<BackendWorkerRestoreResponse, BackendRuntimeClientError> {
     validate_target(target)?;
-    let http = reqwest::Client::new();
+    let api = BackendApiClient::from_stored_token(&target.base_url)?;
     let path = backend_runtime_worker_restore_path(
         &target.workspace_id,
         &target.runtime_id,
         &target.worker_id,
     );
-    let url = join_base_and_path(&target.base_url, &path);
-    Ok(http
-        .post(url)
+    let response = api
+        .request(HttpMethod::POST, &path)?
         .json(&serde_json::json!({}))
         .send()
-        .await?
-        .error_for_status()?
-        .json::<BackendWorkerRestoreResponse>()
-        .await?)
+        .await?;
+    let response = api.require_success(response).await?;
+    Ok(response.json::<BackendWorkerRestoreResponse>().await?)
 }
 
-impl BackendRuntimeClient {
-    pub async fn connect(target: BackendRuntimeTarget) -> Result<Self, BackendRuntimeClientError> {
-        validate_target(&target)?;
-        let (event_tx, rx) = mpsc::unbounded_channel();
-        let (command_tx, command_rx) = mpsc::unbounded_channel();
-
-        let protocol_target = target.clone();
-        let protocol_event_tx = event_tx.clone();
-        let protocol_task = tokio::spawn(async move {
-            run_worker_protocol_transport(protocol_target, command_rx, protocol_event_tx).await;
-        });
-
-        Ok(Self {
-            target,
-            command_tx,
-            events: rx,
-            diagnostics: VecDeque::new(),
-            _protocol_task: protocol_task,
-        })
-    }
-
-    pub fn try_next_event(&mut self) -> Option<Event> {
-        if let Some(event) = self.diagnostics.pop_front() {
-            return Some(event);
-        }
-        self.events.try_recv().ok()
-    }
-
-    pub async fn next_event(&mut self) -> Option<Event> {
-        if let Some(event) = self.diagnostics.pop_front() {
-            return Some(event);
-        }
-        self.events.recv().await
-    }
-
-    pub async fn send(&mut self, method: &Method) -> Result<(), BackendRuntimeClientError> {
-        self.command_tx.send(method.clone()).map_err(|_| {
-            BackendRuntimeClientError::InvalidTarget(format!(
-                "Backend protocol command stream is closed for {}",
-                self.target.display_label()
-            ))
-        })?;
-        Ok(())
-    }
-}
-
-impl Drop for BackendRuntimeClient {
-    fn drop(&mut self) {
-        self._protocol_task.abort();
-    }
-}
-
-async fn run_worker_protocol_transport(
+pub async fn connect_backend_runtime(
     target: BackendRuntimeTarget,
-    mut commands: mpsc::UnboundedReceiver<Method>,
-    tx: mpsc::UnboundedSender<Event>,
-) {
-    let url = protocol_ws_url(&target);
-    match connect_async(&url).await {
-        Ok((ws, _)) => {
-            let (mut sink, mut stream) = ws.split();
-            loop {
-                tokio::select! {
-                    maybe_method = commands.recv() => {
-                        let Some(method) = maybe_method else {
-                            break;
-                        };
-                        match encode_method(&method) {
-                            Ok(text) => {
-                                if let Err(error) = sink.send(TungsteniteMessage::Text(text.into())).await {
-                                    let _ = tx.send(diagnostic_event(format!(
-                                        "Backend protocol command send failed for {}: {error}",
-                                        target.display_label()
-                                    )));
-                                    break;
-                                }
-                            }
-                            Err(error) => {
-                                let _ = tx.send(diagnostic_event(format!(
-                                    "Backend protocol command could not serialize method for {}: {error}",
-                                    target.display_label()
-                                )));
-                            }
-                        }
-                    }
-                    frame = stream.next() => {
-                        match frame {
-                            Some(Ok(TungsteniteMessage::Text(text))) => {
-                                match decode_event(&text) {
-                                    Ok(event) => {
-                                        let _ = tx.send(event);
-                                    }
-                                    Err(error) => {
-                                        let _ = tx.send(diagnostic_event(format!(
-                                            "Backend protocol response was not valid Event JSON for {}: {error}",
-                                            target.display_label()
-                                        )));
-                                    }
-                                }
-                            }
-                            Some(Ok(TungsteniteMessage::Close(_))) | None => {
-                                let _ = tx.send(diagnostic_event(format!(
-                                    "Backend protocol command stream closed for {}",
-                                    target.display_label()
-                                )));
-                                break;
-                            }
-                            Some(Ok(TungsteniteMessage::Ping(_)))
-                            | Some(Ok(TungsteniteMessage::Pong(_)))
-                            | Some(Ok(TungsteniteMessage::Binary(_)))
-                            | Some(Ok(TungsteniteMessage::Frame(_))) => {}
-                            Some(Err(error)) => {
-                                let _ = tx.send(diagnostic_event(format!(
-                                    "Backend protocol WebSocket error for {}: {error}",
-                                    target.display_label()
-                                )));
-                                break;
-                            }
-                        }
-                    }
+) -> Result<Client<WebSocket>, BackendRuntimeClientError> {
+    validate_target(&target)?;
+    let api = BackendApiClient::from_stored_token(&target.base_url)?;
+    let request = protocol_ws_request(&target, &api).map_err(|error| {
+        BackendRuntimeClientError::Protocol(format!(
+            "Backend protocol request could not be constructed for {}: {error}",
+            target.display_label()
+        ))
+    })?;
+    match WebSocket::connect(request).await {
+        Ok(socket) => Ok(Client::new(socket)),
+        Err(WebSocketError::WebSocket(error)) => Err(BackendRuntimeClientError::Protocol(
+            protocol_connect_error_message(&target, &api, &error),
+        )),
+    }
+}
+
+fn protocol_connect_error_message(
+    target: &BackendRuntimeTarget,
+    api: &BackendApiClient,
+    error: &tokio_tungstenite::tungstenite::Error,
+) -> String {
+    if let tokio_tungstenite::tungstenite::Error::Http(response) = error {
+        if let Ok(status) = reqwest::StatusCode::from_u16(response.status().as_u16()) {
+            if matches!(
+                status,
+                reqwest::StatusCode::UNAUTHORIZED | reqwest::StatusCode::FORBIDDEN
+            ) {
+                if let Err(error) = api.check_status(status) {
+                    return error.to_string();
                 }
             }
         }
-        Err(error) => {
-            let _ = tx.send(diagnostic_event(format!(
-                "Backend protocol WebSocket connect failed for {}: {error}",
-                target.display_label()
-            )));
-            while commands.recv().await.is_some() {
-                let _ = tx.send(diagnostic_event(format!(
-                    "Backend protocol command was not sent because command stream is unavailable for {}",
-                    target.display_label()
-                )));
-            }
-        }
-    }
-}
-
-fn diagnostic_event(message: impl Into<String>) -> Event {
-    Event::Error {
-        code: ErrorCode::Internal,
-        message: message.into(),
     }
+    format!(
+        "Backend protocol WebSocket connect failed for {}: {error}",
+        target.display_label()
+    )
 }
 
 fn validate_target(target: &BackendRuntimeTarget) -> Result<(), BackendRuntimeClientError> {
@@ -437,6 +561,30 @@ fn validate_target(target: &BackendRuntimeTarget) -> Result<(), BackendRuntimeCl
     Ok(())
 }
 
+fn validate_launch_target(
+    target: &BackendWorkerLaunchTarget,
+) -> Result<(), BackendRuntimeClientError> {
+    if target.base_url.trim().is_empty() {
+        return Err(BackendRuntimeClientError::InvalidTarget(
+            "Backend API base URL is required".to_string(),
+        ));
+    }
+    if !(target.base_url.starts_with("http://") || target.base_url.starts_with("https://")) {
+        return Err(BackendRuntimeClientError::InvalidTarget(
+            "Backend API base URL must start with http:// or https://".to_string(),
+        ));
+    }
+    match target.workspace_id.as_deref() {
+        Some("") => Err(BackendRuntimeClientError::InvalidTarget(
+            "workspace_id must not be empty".to_string(),
+        )),
+        None => Err(BackendRuntimeClientError::InvalidTarget(
+            "workspace selection is required before creating a Backend worker".to_string(),
+        )),
+        Some(_) => Ok(()),
+    }
+}
+
 fn validate_list_target(
     target: &BackendRuntimeListTarget,
 ) -> Result<(), BackendRuntimeClientError> {
@@ -471,6 +619,17 @@ fn validate_list_target(
     Ok(())
 }
 
+fn backend_workspace_workers_path(workspace_id: &str) -> String {
+    format!("/api/w/{}/workers", path_segment_encode(workspace_id))
+}
+
+fn backend_workspace_workers_launch_options_path(workspace_id: &str) -> String {
+    format!(
+        "{}/launch-options",
+        backend_workspace_workers_path(workspace_id)
+    )
+}
+
 fn backend_runtimes_path(workspace_id: &str) -> String {
     format!("/api/w/{}/runtimes", path_segment_encode(workspace_id))
 }
@@ -496,6 +655,19 @@ fn backend_runtime_worker_restore_path(
     )
 }
 
+fn protocol_ws_request(
+    target: &BackendRuntimeTarget,
+    api: &BackendApiClient,
+) -> Result<tokio_tungstenite::tungstenite::http::Request<()>, String> {
+    let mut request = protocol_ws_url(target)
+        .into_client_request()
+        .map_err(|error| error.to_string())?;
+    let value = HeaderValue::from_str(&api.authorization_header_value())
+        .map_err(|_| "saved Backend token is not a valid Authorization header".to_string())?;
+    request.headers_mut().insert(AUTHORIZATION, value);
+    Ok(request)
+}
+
 fn protocol_ws_url(target: &BackendRuntimeTarget) -> String {
     let path = format!(
         "/api/w/{}/runtimes/{}/workers/{}/protocol/ws",
@@ -542,6 +714,155 @@ fn percent_encode(input: &str, keep: impl Fn(u8) -> bool) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use tokio::net::TcpListener;
+
+    async fn serve_json_once(body: serde_json::Value) -> (String, tokio::task::JoinHandle<String>) {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let base_url = format!("http://{}", listener.local_addr().unwrap());
+        let task = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let mut request = Vec::new();
+            let header_end = loop {
+                let mut buffer = [0_u8; 4096];
+                let read = socket.read(&mut buffer).await.unwrap();
+                assert!(read > 0, "client closed before sending HTTP headers");
+                request.extend_from_slice(&buffer[..read]);
+                if let Some(position) = request.windows(4).position(|part| part == b"\r\n\r\n") {
+                    break position + 4;
+                }
+            };
+            let headers = String::from_utf8_lossy(&request[..header_end]);
+            let content_length = headers
+                .lines()
+                .find_map(|line| {
+                    let (name, value) = line.split_once(':')?;
+                    name.eq_ignore_ascii_case("content-length")
+                        .then(|| value.trim().parse::<usize>().unwrap())
+                })
+                .unwrap_or(0);
+            while request.len() < header_end + content_length {
+                let mut buffer = [0_u8; 4096];
+                let read = socket.read(&mut buffer).await.unwrap();
+                assert!(read > 0, "client closed before sending HTTP body");
+                request.extend_from_slice(&buffer[..read]);
+            }
+
+            let body = serde_json::to_vec(&body).unwrap();
+            let response = format!(
+                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+                body.len()
+            );
+            socket.write_all(response.as_bytes()).await.unwrap();
+            socket.write_all(&body).await.unwrap();
+            String::from_utf8(request).unwrap()
+        });
+        (base_url, task)
+    }
+
+    #[tokio::test]
+    async fn launch_options_request_uses_workspace_path_and_bearer_auth() {
+        let (base_url, server) = serve_json_once(serde_json::json!({
+            "workspace_id": "team main",
+            "runtimes": [{
+                "runtime_id": "embedded",
+                "display_name": "Embedded",
+                "built_in": true,
+                "worker_creation_available": true,
+                "working_directory_required": false,
+                "status": "online",
+                "diagnostics": []
+            }],
+            "default_profile": "builtin:default",
+            "profiles": [{
+                "id": "builtin:default",
+                "label": "Default",
+                "description": ""
+            }],
+            "repositories": [],
+            "working_directories": [],
+            "diagnostics": []
+        }))
+        .await;
+        let target = BackendWorkerLaunchTarget::new(&base_url, Some("team main".to_string()));
+        let api = BackendApiClient::from_access_token_for_test(&base_url, "launch-secret").unwrap();
+
+        let response = get_backend_worker_launch_options_with_client(&target, &api)
+            .await
+            .unwrap();
+        assert_eq!(response.runtimes[0].runtime_id, "embedded");
+        let request = server.await.unwrap();
+        assert!(request.starts_with("GET /api/w/team%20main/workers/launch-options HTTP/1.1\r\n"));
+        assert!(
+            request
+                .to_ascii_lowercase()
+                .contains("authorization: bearer launch-secret\r\n")
+        );
+    }
+
+    #[tokio::test]
+    async fn create_worker_posts_frontend_contract_to_workspace_path() {
+        let (base_url, server) = serve_json_once(serde_json::json!({
+            "workspace_id": "workspace-1",
+            "runtime_id": "embedded",
+            "worker_id": "worker-1",
+            "console_href": "/w/workspace-1/workers/embedded/worker-1",
+            "worker": {
+                "runtime_id": "embedded",
+                "worker_id": "worker-1",
+                "host_id": "host-1",
+                "display_name": "Coder one",
+                "label": "Coder one",
+                "profile": "builtin:coder",
+                "singleton_key": null,
+                "tags": [],
+                "workspace": {
+                    "visibility": "workspace",
+                    "identity": "workspace",
+                    "workspace_id": "workspace-1"
+                },
+                "state": "idle",
+                "last_seen_at": null,
+                "pinned": false,
+                "retention_state": "resident",
+                "implementation": {"kind": "embedded", "display_hint": "Embedded"},
+                "capabilities": {"can_stop": true, "can_spawn_followup": false},
+                "diagnostics": []
+            },
+            "diagnostics": []
+        }))
+        .await;
+        let target = BackendWorkerLaunchTarget::new(&base_url, Some("workspace-1".to_string()));
+        let api = BackendApiClient::from_access_token_for_test(&base_url, "create-secret").unwrap();
+        let create = BackendCreateWorkerRequest {
+            runtime_id: "embedded".to_string(),
+            display_name: "Coder one".to_string(),
+            profile: Some("builtin:coder".to_string()),
+            ticket_assignment: None,
+            initial_submit: Vec::new(),
+            working_directory: None,
+            control_operation_id: None,
+        };
+
+        let response = create_backend_worker_with_client(&target, &create, &api)
+            .await
+            .unwrap();
+        assert_eq!(response.worker_id, "worker-1");
+        let request = server.await.unwrap();
+        assert!(request.starts_with("POST /api/w/workspace-1/workers HTTP/1.1\r\n"));
+        assert!(
+            request
+                .to_ascii_lowercase()
+                .contains("authorization: bearer create-secret\r\n")
+        );
+        let body = request.split_once("\r\n\r\n").unwrap().1;
+        let body: serde_json::Value = serde_json::from_str(body).unwrap();
+        assert_eq!(body["runtime_id"], "embedded");
+        assert_eq!(body["display_name"], "Coder one");
+        assert_eq!(body["profile"], "builtin:coder");
+        assert_eq!(body["initial_submit"], serde_json::json!([]));
+        assert_eq!(body["working_directory"], serde_json::Value::Null);
+    }
 
     #[test]
     fn protocol_url_uses_backend_runtime_worker_identity() {
@@ -557,6 +878,26 @@ mod tests {
         );
     }
 
+    #[test]
+    fn protocol_request_attaches_saved_bearer_authorization() {
+        let target = BackendRuntimeTarget::new(
+            "http://127.0.0.1:8787/",
+            "workspace alpha",
+            "runtime/one",
+            "worker one",
+        );
+        let api = BackendApiClient::from_access_token_for_test(
+            "http://127.0.0.1:8787",
+            "websocket-secret",
+        )
+        .unwrap();
+        let request = protocol_ws_request(&target, &api).unwrap();
+        assert_eq!(
+            request.headers().get(AUTHORIZATION).unwrap(),
+            "Bearer websocket-secret"
+        );
+    }
+
     #[test]
     fn backend_worker_summary_decodes_current_occupied_workdir_contract() {
         let payload = serde_json::json!({
@@ -572,8 +913,8 @@ mod tests {
             "capabilities": {"can_stop": true, "can_spawn_followup": false},
             "working_directory": {
                 "working_directory_id": "wd-1",
-                "repository_id": "main",
-                "materializer_kind": "local_git_worktree",
+                "repository_key": "main",
+                "materializer_kind": "runtime_git_clone",
                 "status": "active",
                 "occupied_by": {
                     "runtime_id": "arcadia",
@@ -585,13 +926,11 @@ mod tests {
         });
 
         let worker: BackendWorkerSummary = serde_json::from_value(payload.clone()).unwrap();
-        let occupied_by = worker
-            .working_directory
-            .unwrap()
-            .occupied_by
-            .expect("occupied Workdir");
-        assert_eq!(occupied_by.worker.runtime_id, "arcadia");
-        assert_eq!(occupied_by.worker.worker_id, "worker-opaque-64");
+        let workdir = worker.working_directory.unwrap();
+        assert_eq!(workdir.repository_key, "main");
+        let occupied_by = workdir.occupied_by.expect("occupied Workdir");
+        assert_eq!(occupied_by.runtime_id, "arcadia");
+        assert_eq!(occupied_by.worker_id, "worker-opaque-64");
 
         let mut stale = payload;
         stale["working_directory"]["occupied_by"]["runtime_worker_id"] = serde_json::json!(64);

crates/client/src/backend_workspace.rs

@@ -1,58 +1,18 @@
-use serde::{Deserialize, Serialize};
+use crate::{BackendApiClient, BackendApiClientError};
+use reqwest::Method;
 use std::fmt;
-use workspace_api::{RepositoryObservedStatus, RepositorySource};
+use workspace_api::{
+    InitialRepositoryIntent, RepositoryListResponse, RepositorySummary,
+    WorkspaceCatalogListResponse, WorkspaceCreateRequest, WorkspaceCreateResponse,
+    WorkspaceSummary,
+};
 
 const DEFAULT_WORKSPACE_LIMIT: usize = 200;
 
-#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
-pub struct BackendWorkspace {
-    pub workspace_id: String,
-    pub owner_account_id: Option<String>,
-    pub display_name: String,
-    pub state: String,
-    pub created_at: String,
-    pub updated_at: String,
-}
-
-#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct CreateBackendWorkspaceRequest {
-    pub operation_key: String,
-    pub display_name: String,
-    pub repository: CreateBackendWorkspaceRepository,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct CreateBackendWorkspaceRepository {
-    pub uri: String,
-    pub display_name: Option<String>,
-    pub default_ref: Option<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
-pub struct CreateBackendWorkspaceResponse {
-    pub workspace: BackendWorkspace,
-    pub repository: CreateBackendWorkspaceRepositoryRecord,
-    pub config_revision: u64,
-    pub request_fingerprint: String,
-    pub replayed: bool,
-}
-
-#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
-pub struct CreateBackendWorkspaceRepositoryRecord {
-    pub workspace_id: String,
-    pub repository_id: String,
-    pub name: String,
-    pub kind: String,
-    pub provider: Option<String>,
-    pub source: RepositorySource,
-    pub default_ref: Option<String>,
-    pub source_revision: u64,
-    pub source_fingerprint: String,
-    pub observed_status: RepositoryObservedStatus,
-    pub observed_at: Option<String>,
-}
+pub type BackendWorkspace = WorkspaceSummary;
+pub type CreateBackendWorkspaceResponse = WorkspaceCreateResponse;
+pub type CreateBackendWorkspaceRequest = WorkspaceCreateRequest;
+pub type CreateBackendWorkspaceRepository = InitialRepositoryIntent;
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct BackendWorkspaceCatalogTarget {
@@ -70,7 +30,7 @@ impl BackendWorkspaceCatalogTarget {
 #[derive(Debug)]
 pub enum BackendWorkspaceClientError {
     InvalidTarget(String),
-    RequestFailed { status: u16, message: String },
+    Api(BackendApiClientError),
     Http(reqwest::Error),
 }
 
@@ -78,9 +38,7 @@ impl fmt::Display for BackendWorkspaceClientError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             Self::InvalidTarget(message) => f.write_str(message),
-            Self::RequestFailed { status, message } => {
-                write!(f, "Backend request failed with HTTP {status}: {message}")
-            }
+            Self::Api(error) => write!(f, "{error}"),
             Self::Http(error) => write!(f, "{error}"),
         }
     }
@@ -88,65 +46,129 @@ impl fmt::Display for BackendWorkspaceClientError {
 
 impl std::error::Error for BackendWorkspaceClientError {}
 
+impl From<BackendApiClientError> for BackendWorkspaceClientError {
+    fn from(error: BackendApiClientError) -> Self {
+        Self::Api(error)
+    }
+}
+
 impl From<reqwest::Error> for BackendWorkspaceClientError {
     fn from(error: reqwest::Error) -> Self {
         Self::Http(error)
     }
 }
 
+pub fn list_backend_workspaces_blocking(
+    target: &BackendWorkspaceCatalogTarget,
+) -> Result<Vec<BackendWorkspace>, BackendWorkspaceClientError> {
+    let client = BackendApiClient::from_stored_token(&target.base_url)?;
+    let response = client
+        .blocking_request(
+            Method::GET,
+            &format!("/api/workspaces?limit={DEFAULT_WORKSPACE_LIMIT}"),
+        )?
+        .send()?;
+    client.check_status(response.status())?;
+    Ok(response.json::<WorkspaceCatalogListResponse>()?.0)
+}
+
+pub fn list_backend_workspace_repositories_blocking(
+    target: &BackendWorkspaceCatalogTarget,
+    workspace_id: &str,
+) -> Result<Vec<RepositorySummary>, BackendWorkspaceClientError> {
+    if workspace_id.is_empty()
+        || workspace_id.len() > 200
+        || !workspace_id
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+    {
+        return Err(BackendWorkspaceClientError::InvalidTarget(
+            "Workspace id returned by Backend is invalid".to_string(),
+        ));
+    }
+    let client = BackendApiClient::from_stored_token(&target.base_url)?;
+    let response = client
+        .blocking_request(Method::GET, &format!("/api/w/{workspace_id}/repositories"))?
+        .send()?;
+    client.check_status(response.status())?;
+    let response = response.json::<RepositoryListResponse>()?;
+    if response.workspace_id != workspace_id {
+        return Err(BackendWorkspaceClientError::InvalidTarget(
+            "Repository catalog response does not match the requested Workspace".to_string(),
+        ));
+    }
+    Ok(response.items)
+}
+
 pub async fn list_backend_workspaces(
     target: &BackendWorkspaceCatalogTarget,
 ) -> Result<Vec<BackendWorkspace>, BackendWorkspaceClientError> {
-    validate_target(target)?;
-    let url = format!(
-        "{}/api/workspaces?limit={DEFAULT_WORKSPACE_LIMIT}",
-        target.base_url.trim_end_matches('/')
-    );
-    let response = reqwest::Client::new().get(url).send().await?;
-    let response = require_success(response).await?;
-    Ok(response.json::<Vec<BackendWorkspace>>().await?)
+    let client = BackendApiClient::from_stored_token(&target.base_url)?;
+    list_backend_workspaces_with_client(&client).await
+}
+
+async fn list_backend_workspaces_with_client(
+    client: &BackendApiClient,
+) -> Result<Vec<BackendWorkspace>, BackendWorkspaceClientError> {
+    let response = client
+        .request(
+            Method::GET,
+            &format!("/api/workspaces?limit={DEFAULT_WORKSPACE_LIMIT}"),
+        )?
+        .send()
+        .await?;
+    client.check_status(response.status())?;
+    Ok(response.json::<WorkspaceCatalogListResponse>().await?.0)
 }
 
 pub async fn create_backend_workspace(
     target: &BackendWorkspaceCatalogTarget,
     request: &CreateBackendWorkspaceRequest,
 ) -> Result<CreateBackendWorkspaceResponse, BackendWorkspaceClientError> {
-    validate_target(target)?;
-    let url = format!("{}/api/workspaces", target.base_url.trim_end_matches('/'));
-    let response = reqwest::Client::new()
-        .post(url)
+    let client = BackendApiClient::from_stored_token(&target.base_url)?;
+    let response = client
+        .request(Method::POST, "/api/workspaces")?
         .json(request)
         .send()
         .await?;
-    let response = require_success(response).await?;
+    client.check_status(response.status())?;
     Ok(response.json::<CreateBackendWorkspaceResponse>().await?)
 }
 
-async fn require_success(
-    response: reqwest::Response,
-) -> Result<reqwest::Response, BackendWorkspaceClientError> {
-    if response.status().is_success() {
-        return Ok(response);
-    }
-    let status = response.status().as_u16();
-    let message = response.text().await.unwrap_or_default();
-    Err(BackendWorkspaceClientError::RequestFailed { status, message })
-}
-
-fn validate_target(
-    target: &BackendWorkspaceCatalogTarget,
-) -> Result<(), BackendWorkspaceClientError> {
-    if !(target.base_url.starts_with("http://") || target.base_url.starts_with("https://")) {
-        return Err(BackendWorkspaceClientError::InvalidTarget(
-            "Backend API base URL must start with http:// or https://".to_string(),
-        ));
-    }
-    Ok(())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::io::{Read, Write};
+    use std::net::TcpListener;
+    use std::thread;
+
+    #[tokio::test]
+    async fn workspace_catalog_request_uses_shared_bearer_client() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let base_url = format!("http://{}", listener.local_addr().unwrap());
+        let handle = thread::spawn(move || {
+            let (mut stream, _) = listener.accept().unwrap();
+            let mut request = vec![0; 4096];
+            let read = stream.read(&mut request).unwrap();
+            let request = String::from_utf8_lossy(&request[..read]).to_ascii_lowercase();
+            assert!(request.starts_with("get /api/workspaces?limit=200 "));
+            assert!(request.contains("authorization: bearer catalog-secret\r\n"));
+            stream
+                .write_all(
+                    b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 2\r\nConnection: close\r\n\r\n[]",
+                )
+                .unwrap();
+        });
+        let client =
+            BackendApiClient::from_access_token_for_test(&base_url, "catalog-secret").unwrap();
+        assert!(
+            list_backend_workspaces_with_client(&client)
+                .await
+                .unwrap()
+                .is_empty()
+        );
+        handle.join().unwrap();
+    }
 
     #[test]
     fn create_request_keeps_operation_key_for_exact_retry() {
@@ -154,8 +176,8 @@ mod tests {
             operation_key: "workspace-create-1".to_string(),
             display_name: "Alpha".to_string(),
             repository: CreateBackendWorkspaceRepository {
+                repository_key: "main".to_string(),
                 uri: "/srv/repos/alpha".to_string(),
-                display_name: Some("Main".to_string()),
                 default_ref: Some("develop".to_string()),
             },
         };

crates/client/src/client.rs

@@ -0,0 +1,138 @@
+use std::error::Error;
+use std::fmt;
+
+use protocol::stream::{decode_event, encode_method};
+use protocol::{Event, Method};
+
+use crate::transport::Socket;
+
+/// Typed Worker protocol client over an injected message transport.
+pub struct Client<T> {
+    socket: T,
+}
+
+#[derive(Debug)]
+pub enum ClientError<E> {
+    Transport(E),
+    Protocol(serde_json::Error),
+}
+
+impl<T> Client<T> {
+    pub fn new(socket: T) -> Self {
+        Self { socket }
+    }
+
+    pub fn into_inner(self) -> T {
+        self.socket
+    }
+}
+
+impl<T: Socket> Client<T> {
+    pub async fn send(&mut self, method: &Method) -> Result<(), ClientError<T::Error>> {
+        let message = encode_method(method).map_err(ClientError::Protocol)?;
+        self.socket
+            .send(message)
+            .await
+            .map_err(ClientError::Transport)
+    }
+
+    pub async fn next_event(&mut self) -> Result<Option<Event>, ClientError<T::Error>> {
+        self.socket
+            .next()
+            .await
+            .map_err(ClientError::Transport)?
+            .map(|message| decode_event(&message).map_err(ClientError::Protocol))
+            .transpose()
+    }
+
+    pub fn try_next_event(&mut self) -> Result<Option<Event>, ClientError<T::Error>> {
+        self.socket
+            .try_next()
+            .map_err(ClientError::Transport)?
+            .map(|message| decode_event(&message).map_err(ClientError::Protocol))
+            .transpose()
+    }
+}
+
+impl<E: fmt::Display> fmt::Display for ClientError<E> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Transport(error) => write!(formatter, "Worker transport error: {error}"),
+            Self::Protocol(error) => write!(formatter, "Worker protocol error: {error}"),
+        }
+    }
+}
+
+impl<E: Error + 'static> Error for ClientError<E> {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match self {
+            Self::Transport(error) => Some(error),
+            Self::Protocol(error) => Some(error),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::VecDeque;
+    use std::convert::Infallible;
+
+    use async_trait::async_trait;
+    use protocol::stream::{decode_method, encode_event};
+    use protocol::{Event, Method, WorkerStatus};
+
+    use super::Client;
+    use crate::transport::Socket;
+
+    #[derive(Default)]
+    struct TestSocket {
+        sent: Vec<String>,
+        incoming: VecDeque<String>,
+    }
+
+    #[async_trait]
+    impl Socket for TestSocket {
+        type Error = Infallible;
+
+        async fn send(&mut self, message: String) -> Result<(), Self::Error> {
+            self.sent.push(message);
+            Ok(())
+        }
+
+        async fn next(&mut self) -> Result<Option<String>, Self::Error> {
+            Ok(self.incoming.pop_front())
+        }
+
+        fn try_next(&mut self) -> Result<Option<String>, Self::Error> {
+            Ok(self.incoming.pop_front())
+        }
+    }
+
+    #[tokio::test]
+    async fn encodes_methods_and_decodes_events_above_transport() {
+        let mut socket = TestSocket::default();
+        socket.incoming.push_back(
+            encode_event(&Event::WorkerState {
+                snapshot: WorkerStatus::Idle.into(),
+            })
+            .expect("encode event"),
+        );
+        let mut client = Client::new(socket);
+
+        client
+            .send(&Method::submit_text(
+                protocol::new_submission_request_id(),
+                "hello",
+            ))
+            .await
+            .expect("send method");
+        assert!(matches!(
+            decode_method(&client.socket.sent[0]),
+            Ok(Method::Submit { .. })
+        ));
+        assert!(matches!(
+            client.next_event().await,
+            Ok(Some(Event::WorkerState { .. }))
+        ));
+    }
+}

crates/client/src/lib.rs

@@ -1,57 +1,54 @@
-//! Worker プロトコルを喋るクライアント。
+//! Backend Workspace/Runtime と既存 Worker protocol へ接続するクライアント。
 //!
-//! - [`WorkerClient`]: 既存 worker の Unix ソケットへ接続して `Method` を送り、
-//!   `Event` を受け取る低レベル接続。
-//! - [`spawn`]: worker バイナリをサブプロセスとして起動し、`YOI-READY`
-//!   ハンドシェイクが終わるまで待つフロー。subprocess を立ち上げる必要が
-//!   ない呼び出し側 (=既存 worker に attach する場合) は使わなくてよい。
-//!
-//! TUI / GUI / E2E ハーネスはこの crate に依存して protocol を喋る。
+//! Standalone execution is owned by the `standalone` crate and does not spawn
+//! a Worker subprocess through this crate.
 
-pub mod backend_auth;
+pub mod backend_api;
+mod backend_auth;
 pub mod backend_runtime;
 pub mod backend_workspace;
-pub mod runtime_command;
-pub mod spawn;
+mod client;
 pub mod target;
-pub mod ticket_role;
-mod worker_client;
+pub mod transport;
 mod workspace_product;
 
+pub use backend_api::{
+    BackendApiClient, BackendApiClientError, BackendOrigin, backend_token_file_path,
+    save_backend_token,
+};
 pub use backend_auth::{
     BackendAuthClientError, BackendAuthTarget, DeviceLoginPollResponse, DeviceLoginStartResponse,
     poll_device_login, start_device_login, wait_for_device_login,
 };
 pub use backend_runtime::{
-    BackendDiagnostic, BackendDiagnosticSeverity, BackendRuntimeClient, BackendRuntimeClientError,
-    BackendRuntimeListResponse, BackendRuntimeListTarget, BackendRuntimeSummary,
-    BackendRuntimeTarget, BackendWorkerCapabilitySummary, BackendWorkerImplementationSummary,
-    BackendWorkerRestoreResponse, BackendWorkerRestoreResult, BackendWorkerSummary,
-    BackendWorkerWorkspaceSummary, BackendWorkingDirectorySummary, list_backend_stopped_workers,
-    list_backend_workers, restore_backend_worker,
+    BackendCreateWorkerRequest, BackendCreateWorkerResponse, BackendDiagnostic,
+    BackendDiagnosticSeverity, BackendRuntimeClientError, BackendRuntimeListResponse,
+    BackendRuntimeListTarget, BackendRuntimeSummary, BackendRuntimeTarget,
+    BackendWorkerCapabilitySummary, BackendWorkerImplementationSummary, BackendWorkerLaunchOptions,
+    BackendWorkerLaunchProfileCandidate, BackendWorkerLaunchRuntimeOption,
+    BackendWorkerLaunchTarget, BackendWorkerOperationState, BackendWorkerRestoreResponse,
+    BackendWorkerRestoreResult, BackendWorkerSummary, BackendWorkerWorkspaceSummary,
+    BackendWorkingDirectorySummary, connect_backend_runtime, create_backend_worker,
+    get_backend_worker_launch_options, list_backend_stopped_workers, list_backend_workers,
+    restore_backend_worker,
 };
 pub use backend_workspace::{
     BackendWorkspace, BackendWorkspaceCatalogTarget, BackendWorkspaceClientError,
     CreateBackendWorkspaceRepository, CreateBackendWorkspaceRequest,
-    CreateBackendWorkspaceResponse, create_backend_workspace, list_backend_workspaces,
+    CreateBackendWorkspaceResponse, create_backend_workspace,
+    list_backend_workspace_repositories_blocking, list_backend_workspaces,
+    list_backend_workspaces_blocking,
 };
-pub use runtime_command::WorkerRuntimeCommand;
+pub use client::{Client, ClientError};
 pub use target::{
-    BackendTarget, Dashboard, LocalTarget, ResolvedTarget, Target, TargetError, TargetKind,
-    WorkerByName, WorkerConnection, WorkerConnectionSelector, WorkerList, WorkerListRequest,
-    WorkerResume, WorkerSpawn,
+    BackendTarget, BackendWorkerLaunch, Dashboard, ResolvedTarget, StandaloneTarget,
+    StandaloneWorkerListIntent, StandaloneWorkerResumeIntent, Target, TargetError, TargetKind,
+    WorkerConnection, WorkerConnectionSelector, WorkerList, WorkerListRequest, WorkerSpawn,
 };
-
-pub use spawn::{
-    SpawnConfig, SpawnError, SpawnReady, WorkerProcessLaunchConfig, WorkerProcessLaunchOptions,
-    spawn_worker, spawn_worker_with_options,
+pub use workspace_api::{
+    CompanionCancelRequest, CompanionLifecycleState, CompanionMessageDisposition,
+    CompanionMessageRequest, CompanionMessageResponse, CompanionStatusResponse,
+    CompanionTranscriptItem, CompanionTranscriptProjection, CompanionTranscriptRole,
+    CompanionTransportSummary, ObjectiveDetail, ObjectiveSummary,
 };
-pub use ticket_role::{
-    TicketRef, TicketRoleLaunchContext, TicketRoleLaunchError, TicketRoleLaunchOptions,
-    TicketRoleLaunchPlan, TicketRoleLaunchResult, TicketRolePreRunWarning,
-    launch_ticket_role_worker, launch_ticket_role_worker_with_options, plan_ticket_role_launch,
-    plan_ticket_role_launch_with_config,
-};
-pub use worker_client::WorkerClient;
-pub use workspace_api::{ObjectiveDetail, ObjectiveSummary};
 pub use workspace_product::BackendWorkspaceProductClient;

crates/client/src/spawn.rs

@@ -1,435 +0,0 @@
-//! Worker runtime command をサブプロセスとして立ち上げ、`YOI-READY` を待つ
-//! ハンドシェイク。
-//!
-//! - 親プロセス (TUI / GUI / E2E) は profile/default/typed restore flags を
-//!   指定してこの関数に渡す。worker はそれを受けて socket を bind し、stderr に
-//!   `YOI-READY\t<name>\t<socket>` を吐く。
-//! - 待機中の stderr 行は `progress` コールバック越しに呼び出し側へ流す。
-//!   UI の進捗表示や E2E のログ収集はここで賄う。
-//! - `kill_on_drop = false` + `process_group(0)` により、親プロセス
-//!   ライフサイクルから切り離した detached worker を作る。ready 後の lifecycle
-//!   管理は runtime ディレクトリ / socket を介して行う。
-
-use std::io;
-use std::path::{Path, PathBuf};
-use std::process::Stdio;
-use std::time::Duration;
-
-use crate::WorkerRuntimeCommand;
-use tokio::process::Command;
-use uuid::Uuid;
-
-const READY_PREFIX: &str = "YOI-READY\t";
-const READY_TIMEOUT: Duration = Duration::from_secs(20);
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct WorkerProcessLaunchConfig {
-    pub runtime_command: WorkerRuntimeCommand,
-    /// `worker.name` として使う識別子。runtime ディレクトリ
-    /// (`manifest::paths::worker_runtime_dir`) の解決と、ready 行に乗る
-    /// 名前との突き合わせに使う。
-    pub worker_name: String,
-    /// Optional reusable Profile selector. Worker identity is always supplied
-    /// separately with `--worker`; profile selection must not imply a name.
-    pub profile: Option<String>,
-    /// Explicit runtime workspace root. The child receives it via
-    /// `--workspace` so startup does not infer workspace identity from the
-    /// parent process cwd.
-    pub workspace_root: PathBuf,
-    /// Optional child process cwd. This is not runtime workspace identity and
-    /// is not passed as a CLI argument; the child observes it as its ordinary
-    /// process current directory.
-    pub cwd: Option<PathBuf>,
-    /// `Some(id)` のとき `--session <id>` を付与し、当該セッションから
-    /// resume させる。
-    pub resume_from: Option<Uuid>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Default)]
-pub struct WorkerProcessLaunchOptions {
-    /// Extra child CLI arguments supplied by an upper resolver layer. The
-    /// low-level launch config intentionally does not model Ticket IDs,
-    /// Ticket roles, orchestration roles, executable authority, or raw
-    /// browser-provided profile/cwd/workspace inputs.
-    pub extra_args: Vec<String>,
-}
-
-impl WorkerProcessLaunchOptions {
-    pub fn with_hidden_arg(mut self, name: impl Into<String>, value: impl Into<String>) -> Self {
-        self.extra_args.extend([name.into(), value.into()]);
-        self
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.extra_args.is_empty()
-    }
-}
-
-pub type SpawnConfig = WorkerProcessLaunchConfig;
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SpawnReady {
-    pub worker_name: String,
-    pub socket_path: PathBuf,
-}
-
-#[derive(Debug)]
-pub enum SpawnError {
-    Io(io::Error),
-    /// runtime ディレクトリが解決できなかった (環境変数未設定等)。
-    RuntimeDirUnavailable,
-    WorkerLaunchFailed {
-        command: WorkerRuntimeCommand,
-        source: io::Error,
-    },
-    WorkerExitedEarly {
-        stderr_tail: String,
-    },
-    Timeout,
-}
-
-impl std::fmt::Display for SpawnError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Io(e) => write!(f, "io error: {e}"),
-            Self::RuntimeDirUnavailable => write!(
-                f,
-                "could not resolve runtime directory (set YOI_HOME, YOI_RUNTIME_DIR, XDG_RUNTIME_DIR, or HOME)"
-            ),
-            Self::WorkerLaunchFailed { command, source } => write!(
-                f,
-                "failed to launch worker runtime command `{command}`: {source}"
-            ),
-            Self::WorkerExitedEarly { stderr_tail } => {
-                if stderr_tail.is_empty() {
-                    write!(f, "worker exited before becoming ready")
-                } else {
-                    write!(f, "worker exited before becoming ready: {stderr_tail}")
-                }
-            }
-            Self::Timeout => write!(
-                f,
-                "worker did not become ready within {}s",
-                READY_TIMEOUT.as_secs()
-            ),
-        }
-    }
-}
-
-impl std::error::Error for SpawnError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Io(error) | Self::WorkerLaunchFailed { source: error, .. } => Some(error),
-            Self::RuntimeDirUnavailable | Self::WorkerExitedEarly { .. } | Self::Timeout => None,
-        }
-    }
-}
-
-impl From<io::Error> for SpawnError {
-    fn from(e: io::Error) -> Self {
-        Self::Io(e)
-    }
-}
-
-fn runtime_args(
-    config: &WorkerProcessLaunchConfig,
-    options: &WorkerProcessLaunchOptions,
-) -> Vec<String> {
-    let mut args = vec![
-        "--workspace".to_string(),
-        config.workspace_root.display().to_string(),
-    ];
-    if let Some(id) = config.resume_from {
-        args.extend([
-            "--session".to_string(),
-            id.to_string(),
-            "--worker".to_string(),
-            config.worker_name.clone(),
-        ]);
-    } else {
-        args.extend(["--worker".to_string(), config.worker_name.clone()]);
-        if let Some(profile) = &config.profile {
-            args.extend(["--profile".to_string(), profile.clone()]);
-        }
-    }
-    args.extend(options.extra_args.clone());
-    args
-}
-
-/// worker を spawn し、`YOI-READY` ハンドシェイクが終わるまで待つ。
-///
-/// `progress` は ready 行を見つけるまでに観測した stderr の各行で呼ばれる
-/// (ready 行自体は除外される)。UI の表示更新や E2E ログ取得に使う。
-pub async fn spawn_worker<F>(
-    config: WorkerProcessLaunchConfig,
-    progress: F,
-) -> Result<SpawnReady, SpawnError>
-where
-    F: FnMut(&str),
-{
-    spawn_worker_with_options(config, WorkerProcessLaunchOptions::default(), progress).await
-}
-
-pub async fn spawn_worker_with_options<F>(
-    config: WorkerProcessLaunchConfig,
-    options: WorkerProcessLaunchOptions,
-    mut progress: F,
-) -> Result<SpawnReady, SpawnError>
-where
-    F: FnMut(&str),
-{
-    let worker_runtime_dir = manifest::paths::worker_runtime_dir(&config.worker_name)
-        .ok_or(SpawnError::RuntimeDirUnavailable)?;
-    std::fs::create_dir_all(&worker_runtime_dir).map_err(SpawnError::Io)?;
-    let stderr_path = worker_runtime_dir.join("stderr.log");
-    let stderr_file = std::fs::File::create(&stderr_path).map_err(SpawnError::Io)?;
-
-    let mut command = Command::new(config.runtime_command.program());
-    command
-        .args(config.runtime_command.prefix_args())
-        .current_dir(config.cwd.as_ref().unwrap_or(&config.workspace_root))
-        .stdin(Stdio::null())
-        .stdout(Stdio::null())
-        .stderr(Stdio::from(stderr_file))
-        .process_group(0);
-    for arg in runtime_args(&config, &options) {
-        command.arg(arg);
-    }
-    let mut child = command
-        .spawn()
-        .map_err(|source| SpawnError::WorkerLaunchFailed {
-            command: config.runtime_command.clone(),
-            source,
-        })?;
-
-    // Default `kill_on_drop = false` plus `process_group(0)` makes this
-    // a detached Worker once startup succeeds: dropping the handle does not
-    // terminate it, and terminal-generated signals for the parent's
-    // process group do not hit the Worker. Runtime state/socket files are
-    // the source of truth after that point.
-    let ready = match wait_for_ready_file(&mut progress, &stderr_path, &mut child).await {
-        Ok(ready) => ready,
-        Err(e) => {
-            let _ = child.start_kill();
-            let _ = child.wait().await;
-            return Err(e);
-        }
-    };
-    tokio::spawn(async move {
-        let _ = child.wait().await;
-    });
-    Ok(ready)
-}
-
-async fn wait_for_ready_file<F>(
-    progress: &mut F,
-    stderr_path: &Path,
-    child: &mut tokio::process::Child,
-) -> Result<SpawnReady, SpawnError>
-where
-    F: FnMut(&str),
-{
-    let mut tail = StderrTail::new();
-    let deadline = tokio::time::Instant::now() + READY_TIMEOUT;
-    let mut offset = 0usize;
-
-    loop {
-        let content = match tokio::fs::read_to_string(stderr_path).await {
-            Ok(content) => content,
-            Err(e) if e.kind() == io::ErrorKind::NotFound => String::new(),
-            Err(e) => return Err(SpawnError::Io(e)),
-        };
-        if content.len() > offset {
-            for line in content[offset..].lines() {
-                if let Some(rest) = line.strip_prefix(READY_PREFIX) {
-                    let mut parts = rest.splitn(2, '\t');
-                    let worker_name = parts.next().unwrap_or("").to_string();
-                    let socket_str = parts.next().unwrap_or("").to_string();
-                    if worker_name.is_empty() || socket_str.is_empty() {
-                        return Err(SpawnError::WorkerExitedEarly {
-                            stderr_tail: format!("malformed ready line: {line}"),
-                        });
-                    }
-                    let socket_path = PathBuf::from(socket_str);
-                    wait_for_socket(
-                        &socket_path,
-                        deadline,
-                        child,
-                        stderr_path,
-                        &mut tail,
-                        &mut offset,
-                    )
-                    .await?;
-                    return Ok(SpawnReady {
-                        worker_name,
-                        socket_path,
-                    });
-                }
-                tail.push(line);
-                progress(line);
-            }
-            offset = content.len();
-        }
-
-        if tokio::time::Instant::now() >= deadline {
-            return Err(SpawnError::Timeout);
-        }
-        tokio::select! {
-            status = child.wait() => {
-                let _ = status;
-                // Worker は exit 直前に最終 stderr 行を flush することがある。
-                // child.wait() が解決した後に再読みして、原因行を取りこ
-                // ぼさず WorkerExitedEarly に載せる。
-                drain_stderr_into_tail(stderr_path, &mut tail, &mut offset).await;
-                return Err(SpawnError::WorkerExitedEarly {
-                    stderr_tail: tail.into_string(),
-                });
-            }
-            _ = tokio::time::sleep(Duration::from_millis(100)) => {}
-        }
-    }
-}
-
-async fn wait_for_socket(
-    socket_path: &Path,
-    deadline: tokio::time::Instant,
-    child: &mut tokio::process::Child,
-    stderr_path: &Path,
-    tail: &mut StderrTail,
-    offset: &mut usize,
-) -> Result<(), SpawnError> {
-    loop {
-        match tokio::net::UnixStream::connect(socket_path).await {
-            Ok(_) => return Ok(()),
-            Err(e)
-                if e.kind() == io::ErrorKind::NotFound
-                    || e.kind() == io::ErrorKind::ConnectionRefused => {}
-            Err(e) => return Err(SpawnError::Io(e)),
-        }
-        if tokio::time::Instant::now() >= deadline {
-            return Err(SpawnError::Timeout);
-        }
-        tokio::select! {
-            status = child.wait() => {
-                let _ = status;
-                drain_stderr_into_tail(stderr_path, tail, offset).await;
-                return Err(SpawnError::WorkerExitedEarly {
-                    stderr_tail: tail.as_string(),
-                });
-            }
-            _ = tokio::time::sleep(Duration::from_millis(50)) => {}
-        }
-    }
-}
-
-async fn drain_stderr_into_tail(stderr_path: &Path, tail: &mut StderrTail, offset: &mut usize) {
-    let Ok(content) = tokio::fs::read_to_string(stderr_path).await else {
-        return;
-    };
-    if content.len() <= *offset {
-        return;
-    }
-    for line in content[*offset..].lines() {
-        if !line.starts_with(READY_PREFIX) {
-            tail.push(line);
-        }
-    }
-    *offset = content.len();
-}
-
-struct StderrTail {
-    lines: std::collections::VecDeque<String>,
-}
-
-impl StderrTail {
-    fn new() -> Self {
-        Self {
-            lines: std::collections::VecDeque::with_capacity(8),
-        }
-    }
-    fn push(&mut self, line: &str) {
-        if self.lines.len() == 8 {
-            self.lines.pop_front();
-        }
-        self.lines.push_back(line.to_string());
-    }
-    fn as_string(&self) -> String {
-        self.lines.iter().cloned().collect::<Vec<_>>().join(" | ")
-    }
-    fn into_string(self) -> String {
-        self.lines.into_iter().collect::<Vec<_>>().join(" | ")
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::ffi::OsString;
-
-    fn base_config() -> WorkerProcessLaunchConfig {
-        WorkerProcessLaunchConfig {
-            runtime_command: WorkerRuntimeCommand::new("/bin/yoi", vec![OsString::from("worker")]),
-            worker_name: "explicit-worker".to_string(),
-            profile: Some("project:companion".to_string()),
-            workspace_root: PathBuf::from("/work/other-project"),
-            cwd: None,
-            resume_from: None,
-        }
-    }
-
-    #[test]
-    fn runtime_args_keep_workspace_worker_and_profile_separate() {
-        assert_eq!(
-            runtime_args(&base_config(), &WorkerProcessLaunchOptions::default()),
-            vec![
-                "--workspace",
-                "/work/other-project",
-                "--worker",
-                "explicit-worker",
-                "--profile",
-                "project:companion",
-            ]
-        );
-    }
-
-    #[test]
-    fn runtime_args_use_session_mode_without_profile_identity_alias() {
-        let mut config = base_config();
-        config.resume_from = Some(Uuid::nil());
-        assert_eq!(
-            runtime_args(&config, &WorkerProcessLaunchOptions::default()),
-            vec![
-                "--workspace",
-                "/work/other-project",
-                "--session",
-                "00000000-0000-0000-0000-000000000000",
-                "--worker",
-                "explicit-worker",
-            ]
-        );
-    }
-
-    #[test]
-    fn runtime_args_include_upper_resolver_extra_args_without_child_cwd() {
-        let mut config = base_config();
-        config.cwd = Some(PathBuf::from("/work/main/.worktree/orchestration/yoi"));
-
-        assert_eq!(
-            runtime_args(
-                &config,
-                &WorkerProcessLaunchOptions::default()
-                    .with_hidden_arg("--ticket-role", "orchestrator"),
-            ),
-            vec![
-                "--workspace",
-                "/work/other-project",
-                "--worker",
-                "explicit-worker",
-                "--profile",
-                "project:companion",
-                "--ticket-role",
-                "orchestrator",
-            ]
-        );
-    }
-}

crates/client/src/target.rs

@@ -1,16 +1,20 @@
-use std::fmt;
+use std::{fmt, path::PathBuf};
 
-use crate::{BackendRuntimeListTarget, BackendRuntimeTarget, WorkerRuntimeCommand};
+use crate::{
+    BackendApiClient, BackendApiClientError, BackendOrigin, BackendRuntimeListTarget,
+    BackendRuntimeTarget, BackendWorkerLaunchTarget,
+};
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum TargetKind {
-    Local,
+    /// One-process Standalone authority with no Runtime or Workspace backend.
+    Standalone,
     Backend,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum ResolvedTarget {
-    Local,
+    Standalone,
     Backend {
         base_url: String,
         workspace_id: String,
@@ -20,7 +24,7 @@ pub enum ResolvedTarget {
 impl ResolvedTarget {
     pub fn kind(&self) -> TargetKind {
         match self {
-            Self::Local => TargetKind::Local,
+            Self::Standalone => TargetKind::Standalone,
             Self::Backend { .. } => TargetKind::Backend,
         }
     }
@@ -29,31 +33,12 @@ impl ResolvedTarget {
 impl fmt::Display for TargetKind {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            Self::Local => f.write_str("local"),
+            Self::Standalone => f.write_str("Standalone"),
             Self::Backend => f.write_str("Backend"),
         }
     }
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct LocalTarget;
-
-impl LocalTarget {
-    pub fn new() -> Self {
-        Self
-    }
-
-    fn runtime_command(&self) -> Result<WorkerRuntimeCommand, TargetError> {
-        WorkerRuntimeCommand::resolve().map_err(TargetError::local_runtime_command)
-    }
-}
-
-impl Default for LocalTarget {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct BackendTarget {
     pub base_url: String,
@@ -62,11 +47,19 @@ pub struct BackendTarget {
 
 impl BackendTarget {
     pub fn new(base_url: impl Into<String>, workspace_id: Option<impl Into<String>>) -> Self {
+        let base_url = base_url.into();
+        let base_url = BackendOrigin::parse(&base_url)
+            .map(|origin| origin.to_string())
+            .unwrap_or(base_url);
         Self {
-            base_url: base_url.into(),
+            base_url,
             workspace_id: workspace_id.map(Into::into),
         }
     }
+
+    pub fn authenticated_client(&self) -> Result<BackendApiClient, BackendApiClientError> {
+        BackendApiClient::from_stored_token(&self.base_url)
+    }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -108,34 +101,36 @@ impl WorkerConnectionSelector {
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct WorkerSpawn {
-    pub runtime_command: WorkerRuntimeCommand,
+    pub state_dir: PathBuf,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct WorkerByName {
-    pub runtime_command: WorkerRuntimeCommand,
+pub struct StandaloneWorkerListIntent {
+    pub state_dir: PathBuf,
+    pub cwd: PathBuf,
+    pub include_all: bool,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct WorkerResume {
-    pub runtime_command: WorkerRuntimeCommand,
+pub struct StandaloneWorkerResumeIntent {
+    pub state_dir: PathBuf,
+    pub worker_id: String,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Dashboard {
-    Local {
-        runtime_command: WorkerRuntimeCommand,
-    },
-    Backend {
-        base_url: String,
-        workspace_id: String,
-    },
+pub struct Dashboard {
+    pub base_url: String,
+    pub workspace_id: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BackendWorkerLaunch {
+    pub target: BackendWorkerLaunchTarget,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct WorkerList {
-    pub local_runtime_command: Option<WorkerRuntimeCommand>,
-    pub backend_target: Option<BackendRuntimeListTarget>,
+    pub backend_target: BackendRuntimeListTarget,
     pub include_stopped: bool,
 }
 
@@ -161,12 +156,6 @@ impl TargetError {
             message: format!("invalid {target} target: {}", message.into()),
         }
     }
-
-    fn local_runtime_command(error: std::io::Error) -> Self {
-        Self {
-            message: format!("failed to resolve local Worker runtime command: {error}"),
-        }
-    }
 }
 
 impl fmt::Display for TargetError {
@@ -183,71 +172,47 @@ pub trait Target: fmt::Debug + Send + Sync {
     /// Resolve the target once for Workspace product-state operations.
     ///
     /// Backend targets must carry an explicit Workspace identity. Callers use
-    /// this value instead of rediscovering Backend/local authority from cwd or
-    /// process configuration after command dispatch.
+    /// this value instead of rediscovering authority from cwd or process
+    /// configuration after command dispatch.
     fn resolve(&self) -> Result<ResolvedTarget, TargetError>;
 
-    fn spawn_worker(&self) -> Result<WorkerSpawn, TargetError>;
-
-    fn worker_by_name(&self) -> Result<WorkerByName, TargetError>;
-
-    fn resume_worker(&self) -> Result<WorkerResume, TargetError>;
-
-    fn dashboard(&self) -> Result<Dashboard, TargetError>;
-
-    fn list_workers(&self, request: WorkerListRequest) -> Result<WorkerList, TargetError>;
-
-    fn connect_worker(
-        &self,
-        selector: WorkerConnectionSelector,
-    ) -> Result<WorkerConnection, TargetError>;
-}
-
-impl Target for LocalTarget {
-    fn kind(&self) -> TargetKind {
-        TargetKind::Local
-    }
-
-    fn resolve(&self) -> Result<ResolvedTarget, TargetError> {
-        Ok(ResolvedTarget::Local)
-    }
-
     fn spawn_worker(&self) -> Result<WorkerSpawn, TargetError> {
-        Ok(WorkerSpawn {
-            runtime_command: self.runtime_command()?,
-        })
+        Err(TargetError::unsupported("Worker spawn", self.kind()))
     }
 
-    fn worker_by_name(&self) -> Result<WorkerByName, TargetError> {
-        Ok(WorkerByName {
-            runtime_command: self.runtime_command()?,
-        })
+    fn standalone_worker_list(
+        &self,
+        _include_all: bool,
+    ) -> Result<StandaloneWorkerListIntent, TargetError> {
+        Err(TargetError::unsupported(
+            "standalone Worker listing",
+            self.kind(),
+        ))
     }
 
-    fn resume_worker(&self) -> Result<WorkerResume, TargetError> {
-        Ok(WorkerResume {
-            runtime_command: self.runtime_command()?,
-        })
+    fn standalone_worker_resume(
+        &self,
+        _worker_id: String,
+    ) -> Result<StandaloneWorkerResumeIntent, TargetError> {
+        Err(TargetError::unsupported(
+            "standalone Worker restore",
+            self.kind(),
+        ))
     }
 
     fn dashboard(&self) -> Result<Dashboard, TargetError> {
-        Ok(Dashboard::Local {
-            runtime_command: self.runtime_command()?,
-        })
+        Err(TargetError::unsupported("Worker dashboard", self.kind()))
     }
 
-    fn list_workers(&self, request: WorkerListRequest) -> Result<WorkerList, TargetError> {
-        if request.runtime_id.is_some() {
-            return Err(TargetError::unsupported(
-                "Explicit runtime id for local worker listing",
-                self.kind(),
-            ));
-        }
-        Ok(WorkerList {
-            local_runtime_command: Some(self.runtime_command()?),
-            backend_target: None,
-            include_stopped: request.include_stopped,
-        })
+    fn launch_backend_worker(&self) -> Result<BackendWorkerLaunch, TargetError> {
+        Err(TargetError::unsupported(
+            "Backend Worker launch",
+            self.kind(),
+        ))
+    }
+
+    fn list_workers(&self, _request: WorkerListRequest) -> Result<WorkerList, TargetError> {
+        Err(TargetError::unsupported("Worker listing", self.kind()))
     }
 
     fn connect_worker(
@@ -261,6 +226,59 @@ impl Target for LocalTarget {
     }
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct StandaloneTarget {
+    state_dir: PathBuf,
+}
+
+impl StandaloneTarget {
+    #[must_use]
+    pub fn new(state_dir: impl Into<PathBuf>) -> Self {
+        Self {
+            state_dir: state_dir.into(),
+        }
+    }
+}
+
+impl Target for StandaloneTarget {
+    fn kind(&self) -> TargetKind {
+        TargetKind::Standalone
+    }
+
+    fn resolve(&self) -> Result<ResolvedTarget, TargetError> {
+        Ok(ResolvedTarget::Standalone)
+    }
+
+    fn spawn_worker(&self) -> Result<WorkerSpawn, TargetError> {
+        Ok(WorkerSpawn {
+            state_dir: self.state_dir.clone(),
+        })
+    }
+
+    fn standalone_worker_list(
+        &self,
+        include_all: bool,
+    ) -> Result<StandaloneWorkerListIntent, TargetError> {
+        let cwd = std::env::current_dir()
+            .map_err(|error| TargetError::invalid(self.kind(), error.to_string()))?;
+        Ok(StandaloneWorkerListIntent {
+            state_dir: self.state_dir.clone(),
+            cwd,
+            include_all,
+        })
+    }
+
+    fn standalone_worker_resume(
+        &self,
+        worker_id: String,
+    ) -> Result<StandaloneWorkerResumeIntent, TargetError> {
+        Ok(StandaloneWorkerResumeIntent {
+            state_dir: self.state_dir.clone(),
+            worker_id,
+        })
+    }
+}
+
 impl Target for BackendTarget {
     fn kind(&self) -> TargetKind {
         TargetKind::Backend
@@ -279,42 +297,36 @@ impl Target for BackendTarget {
         })
     }
 
-    fn spawn_worker(&self) -> Result<WorkerSpawn, TargetError> {
-        Err(TargetError::unsupported("Worker spawn", self.kind()))
-    }
-
-    fn worker_by_name(&self) -> Result<WorkerByName, TargetError> {
-        Err(TargetError::unsupported(
-            "Worker name attachment",
-            self.kind(),
-        ))
-    }
-
-    fn resume_worker(&self) -> Result<WorkerResume, TargetError> {
-        Err(TargetError::unsupported("Worker resume", self.kind()))
-    }
-
     fn dashboard(&self) -> Result<Dashboard, TargetError> {
-        match self.resolve()? {
-            ResolvedTarget::Backend {
-                base_url,
-                workspace_id,
-            } => Ok(Dashboard::Backend {
-                base_url,
-                workspace_id,
-            }),
-            ResolvedTarget::Local => unreachable!("BackendTarget cannot resolve as Local"),
-        }
+        let ResolvedTarget::Backend {
+            base_url,
+            workspace_id,
+        } = self.resolve()?
+        else {
+            unreachable!("BackendTarget resolves only Backend authority")
+        };
+        Ok(Dashboard {
+            base_url,
+            workspace_id,
+        })
+    }
+
+    fn launch_backend_worker(&self) -> Result<BackendWorkerLaunch, TargetError> {
+        Ok(BackendWorkerLaunch {
+            target: BackendWorkerLaunchTarget::new(
+                self.base_url.clone(),
+                self.workspace_id.clone(),
+            ),
+        })
     }
 
     fn list_workers(&self, request: WorkerListRequest) -> Result<WorkerList, TargetError> {
         Ok(WorkerList {
-            local_runtime_command: None,
-            backend_target: Some(BackendRuntimeListTarget::new(
+            backend_target: BackendRuntimeListTarget::new(
                 self.base_url.clone(),
                 self.workspace_id.clone(),
                 request.runtime_id,
-            )),
+            ),
             include_stopped: request.include_stopped,
         })
     }
@@ -371,8 +383,34 @@ mod tests {
     }
 
     #[test]
-    fn local_target_resolves_local_product_state_authority() {
-        assert_eq!(LocalTarget::new().resolve().unwrap(), ResolvedTarget::Local);
+    fn standalone_target_carries_in_process_state_without_runtime_command() {
+        let target = StandaloneTarget::new("/tmp/yoi-standalone-state");
+
+        assert_eq!(target.kind(), TargetKind::Standalone);
+        assert_eq!(target.resolve().unwrap(), ResolvedTarget::Standalone);
+        assert_eq!(
+            target.spawn_worker().unwrap(),
+            WorkerSpawn {
+                state_dir: PathBuf::from("/tmp/yoi-standalone-state"),
+            }
+        );
+    }
+
+    #[test]
+    fn standalone_target_never_exposes_workspace_worker_operations() {
+        let target = StandaloneTarget::new("/tmp/yoi-standalone-state");
+
+        assert_eq!(
+            target
+                .list_workers(WorkerListRequest::new(None))
+                .unwrap_err()
+                .to_string(),
+            "Worker listing is not supported by Standalone target"
+        );
+        assert_eq!(
+            target.dashboard().unwrap_err().to_string(),
+            "Worker dashboard is not supported by Standalone target"
+        );
     }
 
     #[test]
@@ -381,26 +419,13 @@ mod tests {
 
         assert_eq!(
             target.dashboard().unwrap(),
-            Dashboard::Backend {
+            Dashboard {
                 base_url: "http://127.0.0.1:8787".to_string(),
                 workspace_id: "workspace-a".to_string(),
             }
         );
     }
 
-    #[test]
-    fn backend_target_rejects_dashboard_without_workspace_selection() {
-        let target = BackendTarget::new("http://127.0.0.1:8787", None::<String>);
-
-        assert!(
-            target
-                .dashboard()
-                .unwrap_err()
-                .to_string()
-                .contains("workspace selection is required")
-        );
-    }
-
     #[test]
     fn backend_target_builds_worker_list() {
         let target = BackendTarget::new("http://127.0.0.1:8787", Some("workspace-a"));
@@ -408,26 +433,13 @@ mod tests {
             .list_workers(WorkerListRequest::new(Some("runtime-a".to_string())))
             .unwrap();
 
+        assert_eq!(workers.backend_target.base_url, "http://127.0.0.1:8787");
         assert_eq!(
-            workers.backend_target.as_ref().unwrap().base_url,
-            "http://127.0.0.1:8787"
-        );
-        assert_eq!(
-            workers
-                .backend_target
-                .as_ref()
-                .unwrap()
-                .workspace_id
-                .as_deref(),
+            workers.backend_target.workspace_id.as_deref(),
             Some("workspace-a")
         );
         assert_eq!(
-            workers
-                .backend_target
-                .as_ref()
-                .unwrap()
-                .runtime_id
-                .as_deref(),
+            workers.backend_target.runtime_id.as_deref(),
             Some("runtime-a")
         );
     }
@@ -446,41 +458,17 @@ mod tests {
     }
 
     #[test]
-    fn backend_target_rejects_worker_connection_before_workspace_selection() {
-        let target = BackendTarget::new("http://127.0.0.1:8787", None::<String>);
-        let error =
-            match target.connect_worker(WorkerConnectionSelector::new("runtime-a", "worker-b")) {
-                Ok(_) => panic!("unscoped connection must fail"),
-                Err(error) => error,
-            };
+    fn standalone_target_builds_explicit_worker_intents() {
+        let target = StandaloneTarget::new("/tmp/yoi-client-workers");
+        let list = target.standalone_worker_list(true).unwrap();
+        assert_eq!(list.state_dir, PathBuf::from("/tmp/yoi-client-workers"));
+        assert!(list.include_all);
+        assert!(list.cwd.is_absolute());
 
-        assert!(
-            error
-                .to_string()
-                .contains("workspace selection is required")
-        );
-    }
-
-    #[test]
-    fn backend_target_rejects_local_worker_operations() {
-        let target = BackendTarget::new("http://127.0.0.1:8787", None::<String>);
-        let err = target.spawn_worker().unwrap_err();
-
-        assert_eq!(
-            err.to_string(),
-            "Worker spawn is not supported by Backend target"
-        );
-    }
-
-    #[test]
-    fn local_target_builds_local_worker_list() {
-        let target = LocalTarget::new();
-        let workers = target
-            .list_workers(WorkerListRequest::with_stopped(None))
+        let resume = target
+            .standalone_worker_resume("019d1234-0000-7000-8000-000000000000".to_string())
             .unwrap();
-
-        assert!(workers.local_runtime_command.is_some());
-        assert!(workers.backend_target.is_none());
-        assert!(workers.include_stopped);
+        assert_eq!(resume.state_dir, list.state_dir);
+        assert_eq!(resume.worker_id, "019d1234-0000-7000-8000-000000000000");
     }
 }

crates/client/src/transport/in_process.rs

@@ -0,0 +1,116 @@
+use async_trait::async_trait;
+use thiserror::Error;
+use tokio::sync::mpsc;
+
+use super::Socket as SocketContract;
+
+const CHANNEL_CAPACITY: usize = 256;
+
+pub struct Socket {
+    outgoing: mpsc::Sender<String>,
+    incoming: mpsc::Receiver<String>,
+}
+
+/// Host-side endpoint paired with an in-process client transport.
+pub struct Peer {
+    incoming: mpsc::Receiver<String>,
+    outgoing: mpsc::Sender<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum SocketError {
+    #[error("in-process Worker protocol transport closed")]
+    Closed,
+}
+
+impl Socket {
+    pub fn pair() -> (Self, Peer) {
+        let (client_tx, peer_rx) = mpsc::channel(CHANNEL_CAPACITY);
+        let (peer_tx, client_rx) = mpsc::channel(CHANNEL_CAPACITY);
+        (
+            Self {
+                outgoing: client_tx,
+                incoming: client_rx,
+            },
+            Peer {
+                incoming: peer_rx,
+                outgoing: peer_tx,
+            },
+        )
+    }
+}
+
+#[async_trait]
+impl SocketContract for Socket {
+    type Error = SocketError;
+
+    async fn send(&mut self, message: String) -> Result<(), Self::Error> {
+        self.outgoing
+            .send(message)
+            .await
+            .map_err(|_| SocketError::Closed)
+    }
+
+    async fn next(&mut self) -> Result<Option<String>, Self::Error> {
+        Ok(self.incoming.recv().await)
+    }
+
+    fn try_next(&mut self) -> Result<Option<String>, Self::Error> {
+        match self.incoming.try_recv() {
+            Ok(message) => Ok(Some(message)),
+            Err(mpsc::error::TryRecvError::Empty | mpsc::error::TryRecvError::Disconnected) => {
+                Ok(None)
+            }
+        }
+    }
+}
+
+impl Peer {
+    pub async fn next(&mut self) -> Option<String> {
+        self.incoming.recv().await
+    }
+
+    pub async fn send(&self, message: String) -> Result<(), String> {
+        self.outgoing.send(message).await.map_err(|error| error.0)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use protocol::stream::{decode_method, encode_event};
+    use protocol::{Event, Method, WorkerStatus};
+
+    use super::Socket;
+    use crate::Client;
+
+    #[tokio::test]
+    async fn pair_carries_typed_protocol_through_generic_client() {
+        let (socket, mut peer) = Socket::pair();
+        let mut client = Client::new(socket);
+
+        client
+            .send(&Method::submit_text(
+                protocol::new_submission_request_id(),
+                "hello",
+            ))
+            .await
+            .expect("send method");
+        assert!(matches!(
+            peer.next().await.as_deref().map(decode_method),
+            Some(Ok(Method::Submit { .. }))
+        ));
+
+        peer.send(
+            encode_event(&Event::WorkerState {
+                snapshot: WorkerStatus::Idle.into(),
+            })
+            .expect("encode event"),
+        )
+        .await
+        .expect("send event");
+        assert!(matches!(
+            client.next_event().await,
+            Ok(Some(Event::WorkerState { .. }))
+        ));
+    }
+}

crates/client/src/transport/mod.rs

@@ -0,0 +1,22 @@
+use std::error::Error;
+
+use async_trait::async_trait;
+
+pub mod in_process;
+pub mod unix_socket;
+pub mod websocket;
+
+/// Message-oriented transport for one Worker protocol connection.
+///
+/// Implementations own physical framing. `client::Client` owns the typed
+/// Method/Event protocol encoding layered on top of these UTF-8 messages.
+#[async_trait]
+pub trait Socket {
+    type Error: Error + Send + Sync + 'static;
+
+    async fn send(&mut self, message: String) -> Result<(), Self::Error>;
+
+    async fn next(&mut self) -> Result<Option<String>, Self::Error>;
+
+    fn try_next(&mut self) -> Result<Option<String>, Self::Error>;
+}

crates/client/src/transport/unix_socket.rs

@@ -0,0 +1,173 @@
+use std::io;
+use std::path::Path;
+
+use async_trait::async_trait;
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::UnixStream;
+use tokio::sync::mpsc;
+use tokio::task::JoinHandle;
+
+use super::Socket as SocketContract;
+
+pub struct Socket {
+    writer: tokio::io::WriteHalf<UnixStream>,
+    messages: mpsc::Receiver<io::Result<String>>,
+    reader_task: JoinHandle<()>,
+}
+
+impl Socket {
+    pub async fn connect(path: &Path) -> io::Result<Self> {
+        let stream = UnixStream::connect(path).await?;
+        let (reader, writer) = tokio::io::split(stream);
+        let (message_tx, messages) = mpsc::channel(256);
+        let reader_task = tokio::spawn(async move {
+            let mut lines = BufReader::new(reader).lines();
+            loop {
+                match lines.next_line().await {
+                    Ok(Some(message)) if message.trim().is_empty() => {}
+                    Ok(Some(message)) => {
+                        if message_tx.send(Ok(message)).await.is_err() {
+                            return;
+                        }
+                    }
+                    Ok(None) => return,
+                    Err(error) => {
+                        let _ = message_tx.send(Err(error)).await;
+                        return;
+                    }
+                }
+            }
+        });
+        Ok(Self {
+            writer,
+            messages,
+            reader_task,
+        })
+    }
+}
+
+#[async_trait]
+impl SocketContract for Socket {
+    type Error = io::Error;
+
+    async fn send(&mut self, message: String) -> Result<(), Self::Error> {
+        self.writer.write_all(message.as_bytes()).await?;
+        self.writer.write_all(b"\n").await?;
+        self.writer.flush().await
+    }
+
+    async fn next(&mut self) -> Result<Option<String>, Self::Error> {
+        match self.messages.recv().await {
+            Some(message) => message.map(Some),
+            None => Ok(None),
+        }
+    }
+
+    fn try_next(&mut self) -> Result<Option<String>, Self::Error> {
+        match self.messages.try_recv() {
+            Ok(message) => message.map(Some),
+            Err(mpsc::error::TryRecvError::Empty | mpsc::error::TryRecvError::Disconnected) => {
+                Ok(None)
+            }
+        }
+    }
+}
+
+impl Drop for Socket {
+    fn drop(&mut self) {
+        self.reader_task.abort();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::ErrorKind;
+    use std::time::Duration;
+
+    use protocol::stream::{decode_method, encode_event};
+    use protocol::{Event, Method, WorkerStatus};
+    use tempfile::tempdir;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use tokio::net::UnixListener;
+
+    use super::*;
+    use crate::Client;
+
+    async fn assert_peer_closed(stream: &mut UnixStream, reason: &str) {
+        let mut buf = [0_u8; 1];
+        match tokio::time::timeout(Duration::from_secs(1), stream.read(&mut buf))
+            .await
+            .expect(reason)
+        {
+            Ok(0) => {}
+            Err(error) if error.kind() == ErrorKind::ConnectionReset => {}
+            Ok(n) => panic!("server should observe peer close, read {n} byte(s)"),
+            Err(error) => panic!("server read failed unexpectedly: {error}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn client_receives_events_over_unix_socket() {
+        let socket_dir = tempdir().unwrap();
+        let socket_path = socket_dir.path().join("events.sock");
+        let listener = UnixListener::bind(&socket_path).unwrap();
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.unwrap();
+            let event = encode_event(&Event::WorkerState {
+                snapshot: WorkerStatus::Idle.into(),
+            })
+            .unwrap();
+            stream.write_all(event.as_bytes()).await.unwrap();
+            stream.write_all(b"\n").await.unwrap();
+        });
+
+        let mut client = Client::new(Socket::connect(&socket_path).await.unwrap());
+        let event = tokio::time::timeout(Duration::from_secs(1), client.next_event())
+            .await
+            .expect("client should receive event while alive")
+            .expect("transport should succeed");
+        assert!(matches!(event, Some(Event::WorkerState { .. })));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn client_sends_methods_over_unix_socket() {
+        let socket_dir = tempdir().unwrap();
+        let socket_path = socket_dir.path().join("send.sock");
+        let listener = UnixListener::bind(&socket_path).unwrap();
+        let server = tokio::spawn(async move {
+            let (reader, _) = listener.accept().await.unwrap();
+            BufReader::new(reader).lines().next_line().await.unwrap()
+        });
+
+        let mut client = Client::new(Socket::connect(&socket_path).await.unwrap());
+        client
+            .send(&Method::submit_text(
+                protocol::new_submission_request_id(),
+                "hello",
+            ))
+            .await
+            .expect("send method");
+
+        let received = server.await.unwrap().expect("method message");
+        assert!(matches!(
+            decode_method(&received),
+            Ok(Method::Submit { .. })
+        ));
+    }
+
+    #[tokio::test]
+    async fn dropping_socket_closes_server_connection() {
+        let socket_dir = tempdir().unwrap();
+        let socket_path = socket_dir.path().join("drop.sock");
+        let listener = UnixListener::bind(&socket_path).unwrap();
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.unwrap();
+            assert_peer_closed(&mut stream, "dropped socket should close promptly").await;
+        });
+
+        let socket = Socket::connect(&socket_path).await.unwrap();
+        drop(socket);
+        server.await.unwrap();
+    }
+}

crates/client/src/transport/websocket.rs

@@ -0,0 +1,141 @@
+use async_trait::async_trait;
+use futures::{SinkExt, StreamExt};
+use thiserror::Error;
+use tokio::net::TcpStream;
+use tokio::sync::mpsc;
+use tokio::task::JoinHandle;
+use tokio_tungstenite::tungstenite::http::Request;
+use tokio_tungstenite::tungstenite::{self, Message};
+use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async};
+
+use super::Socket as SocketContract;
+
+type Writer = futures::stream::SplitSink<WebSocketStream<MaybeTlsStream<TcpStream>>, Message>;
+
+pub struct Socket {
+    writer: Writer,
+    messages: mpsc::Receiver<Result<String, SocketError>>,
+    reader_task: JoinHandle<()>,
+}
+
+#[derive(Debug, Error)]
+pub enum SocketError {
+    #[error("WebSocket transport failed: {0}")]
+    WebSocket(#[from] tungstenite::Error),
+}
+
+impl Socket {
+    pub async fn connect(request: Request<()>) -> Result<Self, SocketError> {
+        let (stream, _) = connect_async(request).await?;
+        let (writer, mut reader) = stream.split();
+        let (message_tx, messages) = mpsc::channel(256);
+        let reader_task = tokio::spawn(async move {
+            loop {
+                match reader.next().await {
+                    Some(Ok(Message::Text(message))) => {
+                        if message_tx.send(Ok(message.to_string())).await.is_err() {
+                            return;
+                        }
+                    }
+                    Some(Ok(Message::Close(_))) | None => return,
+                    Some(Ok(
+                        Message::Binary(_)
+                        | Message::Ping(_)
+                        | Message::Pong(_)
+                        | Message::Frame(_),
+                    )) => {}
+                    Some(Err(error)) => {
+                        let _ = message_tx.send(Err(SocketError::WebSocket(error))).await;
+                        return;
+                    }
+                }
+            }
+        });
+        Ok(Self {
+            writer,
+            messages,
+            reader_task,
+        })
+    }
+}
+
+#[async_trait]
+impl SocketContract for Socket {
+    type Error = SocketError;
+
+    async fn send(&mut self, message: String) -> Result<(), Self::Error> {
+        self.writer.send(Message::Text(message.into())).await?;
+        Ok(())
+    }
+
+    async fn next(&mut self) -> Result<Option<String>, Self::Error> {
+        match self.messages.recv().await {
+            Some(message) => message.map(Some),
+            None => Ok(None),
+        }
+    }
+
+    fn try_next(&mut self) -> Result<Option<String>, Self::Error> {
+        match self.messages.try_recv() {
+            Ok(message) => message.map(Some),
+            Err(mpsc::error::TryRecvError::Empty | mpsc::error::TryRecvError::Disconnected) => {
+                Ok(None)
+            }
+        }
+    }
+}
+
+impl Drop for Socket {
+    fn drop(&mut self) {
+        self.reader_task.abort();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use futures::{SinkExt, StreamExt};
+    use protocol::stream::{decode_method, encode_event};
+    use protocol::{Event, Method, WorkerStatus};
+    use tokio::net::TcpListener;
+    use tokio_tungstenite::accept_async;
+    use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+
+    use super::*;
+    use crate::Client;
+
+    #[tokio::test]
+    async fn carries_typed_protocol_through_generic_client() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            let mut socket = accept_async(stream).await.unwrap();
+            let message = socket.next().await.unwrap().unwrap();
+            assert!(matches!(
+                message,
+                Message::Text(ref text)
+                    if matches!(decode_method(text), Ok(Method::Submit { .. }))
+            ));
+            let event = encode_event(&Event::WorkerState {
+                snapshot: WorkerStatus::Idle.into(),
+            })
+            .unwrap();
+            socket.send(Message::Text(event.into())).await.unwrap();
+        });
+
+        let request = format!("ws://{address}").into_client_request().unwrap();
+        let mut client = Client::new(Socket::connect(request).await.unwrap());
+        client
+            .send(&Method::submit_text(
+                protocol::new_submission_request_id(),
+                "hello",
+            ))
+            .await
+            .expect("send method");
+        assert!(matches!(
+            client.next_event().await,
+            Ok(Some(Event::WorkerState { .. }))
+        ));
+        server.await.unwrap();
+    }
+}

crates/client/src/worker_client.rs

@@ -1,186 +0,0 @@
-use std::io;
-use std::path::Path;
-
-use protocol::stream::{JsonLineReader, JsonLineWriter};
-use protocol::{Event, Method};
-use tokio::net::UnixStream;
-use tokio::sync::mpsc;
-use tokio::task::JoinHandle;
-
-pub struct WorkerClient {
-    writer: JsonLineWriter<tokio::io::WriteHalf<UnixStream>>,
-    event_rx: mpsc::Receiver<Event>,
-    reader_task: JoinHandle<()>,
-}
-
-impl WorkerClient {
-    pub async fn connect(path: &Path) -> Result<Self, io::Error> {
-        let stream = UnixStream::connect(path).await?;
-        let (reader, writer) = tokio::io::split(stream);
-        let writer = JsonLineWriter::new(writer);
-
-        let (event_tx, event_rx) = mpsc::channel::<Event>(256);
-
-        let reader_task = tokio::spawn(async move {
-            let mut reader = JsonLineReader::new(reader);
-            while let Ok(Some(event)) = reader.next::<Event>().await {
-                if event_tx.send(event).await.is_err() {
-                    break;
-                }
-            }
-        });
-
-        Ok(Self {
-            writer,
-            event_rx,
-            reader_task,
-        })
-    }
-
-    pub async fn send(&mut self, method: &Method) -> Result<(), io::Error> {
-        self.writer.write(method).await
-    }
-
-    pub fn try_next_event(&mut self) -> Option<Event> {
-        self.event_rx.try_recv().ok()
-    }
-
-    pub async fn next_event(&mut self) -> Option<Event> {
-        self.event_rx.recv().await
-    }
-}
-
-impl Drop for WorkerClient {
-    fn drop(&mut self) {
-        self.reader_task.abort();
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::io::ErrorKind;
-    use std::time::Duration;
-
-    use protocol::{Segment, WorkerStatus};
-    use tempfile::tempdir;
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-    use tokio::net::UnixListener;
-
-    use super::*;
-
-    async fn assert_peer_closed(stream: &mut UnixStream, reason: &str) {
-        let mut buf = [0_u8; 1];
-        match tokio::time::timeout(Duration::from_secs(1), stream.read(&mut buf))
-            .await
-            .expect(reason)
-        {
-            Ok(0) => {}
-            Err(error) if error.kind() == ErrorKind::ConnectionReset => {}
-            Ok(n) => panic!("server should observe peer close, read {n} byte(s)"),
-            Err(error) => panic!("server read failed unexpectedly: {error}"),
-        }
-    }
-
-    #[tokio::test]
-    async fn receives_events_while_client_is_alive() {
-        let socket_dir = tempdir().unwrap();
-        let socket_path = socket_dir.path().join("events.sock");
-        let listener = UnixListener::bind(&socket_path).unwrap();
-        let server = tokio::spawn(async move {
-            let (stream, _) = listener.accept().await.unwrap();
-            let mut writer = JsonLineWriter::new(stream);
-            writer
-                .write(&Event::Status {
-                    status: WorkerStatus::Idle,
-                })
-                .await
-                .unwrap();
-        });
-
-        let mut client = WorkerClient::connect(&socket_path).await.unwrap();
-
-        let event = tokio::time::timeout(Duration::from_secs(1), client.next_event())
-            .await
-            .expect("client should receive event while alive");
-        assert!(matches!(
-            event,
-            Some(Event::Status {
-                status: WorkerStatus::Idle
-            })
-        ));
-        server.await.unwrap();
-    }
-
-    #[tokio::test]
-    async fn send_writes_methods_while_client_is_alive() {
-        let socket_dir = tempdir().unwrap();
-        let socket_path = socket_dir.path().join("send.sock");
-        let listener = UnixListener::bind(&socket_path).unwrap();
-        let server = tokio::spawn(async move {
-            let (stream, _) = listener.accept().await.unwrap();
-            let mut reader = JsonLineReader::new(stream);
-            reader.next::<Method>().await.unwrap()
-        });
-
-        let mut client = WorkerClient::connect(&socket_path).await.unwrap();
-        let method = Method::Run {
-            input: vec![Segment::text("hello")],
-        };
-        client.send(&method).await.unwrap();
-
-        let received = tokio::time::timeout(Duration::from_secs(1), server)
-            .await
-            .expect("server should receive method while client is alive")
-            .unwrap();
-        match received {
-            Some(Method::Run { input }) => assert_eq!(input, vec![Segment::text("hello")]),
-            other => panic!("expected Run method, got {other:?}"),
-        }
-    }
-
-    #[tokio::test]
-    async fn dropping_repeated_clients_closes_server_connections() {
-        let socket_dir = tempdir().unwrap();
-        let socket_path = socket_dir.path().join("drop.sock");
-        let listener = UnixListener::bind(&socket_path).unwrap();
-        let server = tokio::spawn(async move {
-            for _ in 0..16 {
-                let (mut stream, _) = listener.accept().await.unwrap();
-                assert_peer_closed(
-                    &mut stream,
-                    "dropped client should close its socket promptly",
-                )
-                .await;
-            }
-        });
-
-        for _ in 0..16 {
-            let client = WorkerClient::connect(&socket_path).await.unwrap();
-            drop(client);
-        }
-
-        server.await.unwrap();
-    }
-
-    #[tokio::test]
-    async fn dropping_client_aborts_blocked_reader_task() {
-        let socket_dir = tempdir().unwrap();
-        let socket_path = socket_dir.path().join("blocked-reader.sock");
-        let listener = UnixListener::bind(&socket_path).unwrap();
-        let server = tokio::spawn(async move {
-            let (mut stream, _) = listener.accept().await.unwrap();
-            stream.write_all(b"{\"event\"").await.unwrap();
-            assert_peer_closed(
-                &mut stream,
-                "aborting the blocked client reader should close the socket",
-            )
-            .await;
-        });
-
-        let client = WorkerClient::connect(&socket_path).await.unwrap();
-        tokio::task::yield_now().await;
-        drop(client);
-
-        server.await.unwrap();
-    }
-}

crates/client/src/workspace_product.rs

@@ -1,6 +1,6 @@
 use reqwest::Method;
+use serde::Serialize;
 use serde::de::DeserializeOwned;
-use serde::{Deserialize, Serialize};
 use ticket::{
     MarkdownText, NewOrchestrationPlanRecord, NewTicket, NewTicketEvent, NewTicketRelation,
     OrchestrationPlanKind, OrchestrationPlanRecord, Ticket, TicketBackend, TicketDependencyCheck,
@@ -9,47 +9,27 @@ use ticket::{
     TicketRelationKind, TicketRelationView, TicketStateChange, TicketStateSelector, TicketSummary,
 };
 use workspace_api::{
-    ListResponse, ObjectiveCreateRequest, ObjectiveDetail, ObjectiveEditRequest,
-    ObjectiveLinkTicketRequest, ObjectiveStateRequest, ObjectiveSummary,
-    TICKET_ORCHESTRATION_PLANS_QUERY_PATH, TICKET_RELATIONS_QUERY_PATH,
+    BrowserCreateWorkerResponse, BrowserWorkspaceOrchestratorResponse,
+    CreateWorkspaceWorkerRequest, ListResponse, MemoryDocumentResponse, MemoryStagingListResponse,
+    ObjectiveCreateRequest, ObjectiveDetail, ObjectiveEditRequest, ObjectiveLinkTicketRequest,
+    ObjectiveStateRequest, ObjectiveSummary, RevokeRuntimeTrustKeyRequest,
+    RuntimeTrustKeyRevealResponse, TICKET_ORCHESTRATION_PLANS_QUERY_PATH,
+    TICKET_RELATIONS_QUERY_PATH, WorkerLaunchOptionsResponse, WorkspaceRuntimeDetail,
+    WorkspaceRuntimeResource,
 };
 
-use crate::BackendWorkspaceClientError;
+use crate::{BackendApiClient, BackendWorkspaceClientError};
 
 const DEFAULT_PRODUCT_LIST_LIMIT: usize = 1_000;
 
-#[derive(Debug, Deserialize)]
-struct BackendWorkerLaunchOptions {
-    runtimes: Vec<BackendWorkerLaunchRuntime>,
-}
-
-#[derive(Debug, Deserialize)]
-struct BackendWorkerLaunchRuntime {
-    runtime_id: String,
-    worker_creation_available: bool,
-    working_directory_required: bool,
-}
-
-#[derive(Debug, Deserialize)]
-struct BackendCreateWorkerResponse {
-    runtime_id: String,
-    worker_id: String,
-}
-
-#[derive(Debug, Deserialize)]
-struct BackendWorkspaceOrchestratorResponse {
-    disposition: String,
-    worker: Option<BackendCreateWorkerResponse>,
-}
-
 /// Workspace-scoped Backend client for Ticket and Objective product state.
 ///
 /// Construction requires both the selected Backend URL and Workspace identity.
 /// Callers should derive these once from `Target::resolve()` and must not retry
 /// failed requests against repository-local state.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone)]
 pub struct BackendWorkspaceProductClient {
-    base_url: String,
+    api: BackendApiClient,
     workspace_id: String,
 }
 
@@ -58,22 +38,32 @@ impl BackendWorkspaceProductClient {
         base_url: impl Into<String>,
         workspace_id: impl Into<String>,
     ) -> Result<Self, BackendWorkspaceClientError> {
-        let base_url = base_url.into().trim_end_matches('/').to_string();
-        if base_url.is_empty() {
-            return Err(BackendWorkspaceClientError::InvalidTarget(
-                "Backend base URL must not be empty".into(),
-            ));
-        }
+        let base_url = base_url.into();
+        let api = BackendApiClient::from_stored_token(&base_url)?;
         let workspace_id = workspace_id.into();
         if workspace_id.trim().is_empty() {
             return Err(BackendWorkspaceClientError::InvalidTarget(
                 "Backend Workspace identity must not be empty".into(),
             ));
         }
-        Ok(Self {
-            base_url,
-            workspace_id,
-        })
+        Ok(Self { api, workspace_id })
+    }
+
+    #[cfg(test)]
+    fn new_with_access_token(
+        base_url: impl Into<String>,
+        workspace_id: impl Into<String>,
+        access_token: &str,
+    ) -> Result<Self, BackendWorkspaceClientError> {
+        let base_url = base_url.into();
+        let api = BackendApiClient::from_access_token_for_test(&base_url, access_token)?;
+        let workspace_id = workspace_id.into();
+        if workspace_id.trim().is_empty() {
+            return Err(BackendWorkspaceClientError::InvalidTarget(
+                "Backend Workspace identity must not be empty".into(),
+            ));
+        }
+        Ok(Self { api, workspace_id })
     }
 
     pub fn workspace_id(&self) -> &str {
@@ -253,11 +243,57 @@ impl BackendWorkspaceProductClient {
         )
     }
 
+    pub fn list_runtimes(
+        &self,
+    ) -> Result<ListResponse<WorkspaceRuntimeResource>, BackendWorkspaceClientError> {
+        self.get_json("/runtimes")
+    }
+
+    pub fn runtime_detail(
+        &self,
+        runtime_id: &str,
+    ) -> Result<WorkspaceRuntimeDetail, BackendWorkspaceClientError> {
+        self.get_json(&format!("/runtimes/{}", encode_path_segment(runtime_id)))
+    }
+
+    pub fn reveal_runtime_trust_key(
+        &self,
+        runtime_id: &str,
+    ) -> Result<RuntimeTrustKeyRevealResponse, BackendWorkspaceClientError> {
+        self.get_json(&format!(
+            "/runtimes/{}/trust-key",
+            encode_path_segment(runtime_id)
+        ))
+    }
+
+    pub fn revoke_runtime_trust_key(
+        &self,
+        runtime_id: &str,
+        request: &RevokeRuntimeTrustKeyRequest,
+    ) -> Result<WorkspaceRuntimeDetail, BackendWorkspaceClientError> {
+        self.send_json(
+            Method::DELETE,
+            &format!("/runtimes/{}/trust-key", encode_path_segment(runtime_id)),
+            Some(request),
+        )
+    }
+
+    pub fn memory_document(&self) -> Result<MemoryDocumentResponse, BackendWorkspaceClientError> {
+        self.get_json("/memory")
+    }
+
+    pub fn list_memory_staging(
+        &self,
+        limit: usize,
+    ) -> Result<MemoryStagingListResponse, BackendWorkspaceClientError> {
+        self.get_json(&format!("/memory/staging?limit={limit}"))
+    }
+
     pub fn launch_ticket_intake(
         &self,
         ticket_id: &str,
     ) -> Result<String, BackendWorkspaceClientError> {
-        let options: BackendWorkerLaunchOptions = self.get_json("/workers/launch-options")?;
+        let options: WorkerLaunchOptionsResponse = self.get_json("/workers/launch-options")?;
         let runtime = options
             .runtimes
             .iter()
@@ -268,19 +304,19 @@ impl BackendWorkspaceProductClient {
                         .to_string(),
                 )
             })?;
-        let response: BackendCreateWorkerResponse = self.send_json(
-            Method::POST,
-            "/workers",
-            Some(&serde_json::json!({
-                "runtime_id": runtime.runtime_id,
-                "display_name": format!("intake-{ticket_id}"),
-                "profile": "builtin:intake",
-                "initial_submit": [{
-                    "kind": "text",
-                    "content": format!("Please handle intake for Ticket {ticket_id}.")
-                }]
-            })),
-        )?;
+        let request = CreateWorkspaceWorkerRequest {
+            runtime_id: runtime.runtime_id.clone(),
+            display_name: format!("intake-{ticket_id}"),
+            profile: Some("builtin:intake".to_string()),
+            ticket_assignment: None,
+            initial_submit: vec![protocol::Segment::Text {
+                content: format!("Please handle intake for Ticket {ticket_id}."),
+            }],
+            working_directory: None,
+            control_operation_id: None,
+        };
+        let response: BrowserCreateWorkerResponse =
+            self.send_json(Method::POST, "/workers", Some(&request))?;
         Ok(format!(
             "Started Intake Worker {}/{} for Ticket {ticket_id}",
             response.runtime_id, response.worker_id
@@ -288,7 +324,7 @@ impl BackendWorkspaceProductClient {
     }
 
     pub fn start_workspace_orchestrator(&self) -> Result<String, BackendWorkspaceClientError> {
-        let response: BackendWorkspaceOrchestratorResponse =
+        let response: BrowserWorkspaceOrchestratorResponse =
             self.send_json::<(), _>(Method::POST, "/orchestrator", None)?;
         let worker = response.worker.ok_or_else(|| {
             BackendWorkspaceClientError::InvalidTarget(
@@ -316,7 +352,7 @@ impl BackendWorkspaceProductClient {
         body: Option<&B>,
     ) -> Result<R, BackendWorkspaceClientError> {
         let response = self.request(method, path, body)?.send()?;
-        let response = ensure_success(response)?;
+        self.api.check_status(response.status())?;
         response.json().map_err(BackendWorkspaceClientError::Http)
     }
 
@@ -326,7 +362,8 @@ impl BackendWorkspaceProductClient {
         path: &str,
         body: Option<&B>,
     ) -> Result<(), BackendWorkspaceClientError> {
-        ensure_success(self.request(method, path, body)?.send()?)?;
+        let response = self.request(method, path, body)?.send()?;
+        self.api.check_status(response.status())?;
         Ok(())
     }
 
@@ -336,14 +373,12 @@ impl BackendWorkspaceProductClient {
         path: &str,
         body: Option<&B>,
     ) -> Result<reqwest::blocking::RequestBuilder, BackendWorkspaceClientError> {
-        let client = reqwest::blocking::Client::builder().build()?;
-        let url = format!(
-            "{}/api/w/{}/{}",
-            self.base_url,
+        let path = format!(
+            "/api/w/{}/{}",
             encode_path_segment(&self.workspace_id),
             path.trim_start_matches('/')
         );
-        let request = client.request(method, url);
+        let request = self.api.blocking_request(method, &path)?;
         Ok(match body {
             Some(body) => request.json(body),
             None => request,
@@ -588,19 +623,6 @@ fn ticket_client_error(error: BackendWorkspaceClientError) -> TicketError {
     TicketError::Sqlite(format!("Backend request failed: {error}"))
 }
 
-fn ensure_success(
-    response: reqwest::blocking::Response,
-) -> Result<reqwest::blocking::Response, BackendWorkspaceClientError> {
-    if response.status().is_success() {
-        return Ok(response);
-    }
-    let status = response.status().as_u16();
-    let message = response
-        .text()
-        .unwrap_or_else(|_| "Backend request failed".to_string());
-    Err(BackendWorkspaceClientError::RequestFailed { status, message })
-}
-
 fn ticket_reference(id: &TicketIdOrSlug) -> String {
     match id {
         TicketIdOrSlug::Id(id) => id.to_string(),
@@ -695,27 +717,111 @@ mod tests {
     }
 
     #[test]
-    fn objective_list_uses_workspace_scoped_backend_route() {
-        let body = r#"{"workspace_id":"workspace-a","limit":1000,"items":[],"source":"sqlite","diagnostics":[]}"#;
+    fn memory_document_uses_shared_workspace_scoped_response() {
+        let body = r##"{"body_md":"# Memory\\n","created_at":"2026-09-01T00:00:00Z","updated_at":"2026-09-02T00:00:00Z","bytes":10,"record_source":"workspace-sqlite"}"##;
         let (base_url, request, handle) = one_response_server("200 OK", body);
-        let client = BackendWorkspaceProductClient::new(base_url, "workspace-a").unwrap();
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
 
-        let response = client.list_objectives(1_000).unwrap();
+        let response = client.memory_document().unwrap();
 
-        assert!(response.items.is_empty());
+        assert_eq!(response.record_source, "workspace-sqlite");
         assert!(
             request
                 .recv()
                 .unwrap()
-                .starts_with("GET /api/w/workspace-a/objectives?limit=1000 ")
+                .starts_with("GET /api/w/workspace-a/memory ")
         );
         handle.join().unwrap();
     }
 
+    #[test]
+    fn memory_staging_uses_shared_dto_with_typed_origin() {
+        let body = r#"{"limit":10,"returned_count":1,"total_valid_count":1,"invalid_count":0,"truncated":false,"order":"imported_at_desc_candidate_id_asc","record_authority":"sqlite_workspace_authority.memory_staging","items":[{"id":"candidate-1","byte_len":128,"record":{"schema_version":1,"id":"candidate-1","extract_run_id":"run-1","source":{"segment_id":"segment-1","range":[1,2]},"kind":"decision","claim":"Keep typed provenance.","why_useful":"Prevents trust loss.","staleness":null,"evidence":[],"source_refs":[{"session_id":"session-1","segment_id":"segment-1","entry_range":[1,2],"evidence_id":"evidence-1","origin":{"kind":"worker_input","workspace_id":"workspace-a","runtime_id":"runtime-1","worker_id":"worker-1"},"evidence_kind":"worker_session_entry","label":null,"summary":null}]}}],"diagnostics":[]}"#;
+        let (base_url, request, handle) = one_response_server("200 OK", body);
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
+
+        let response = client.list_memory_staging(10).unwrap();
+
+        assert_eq!(
+            response.items[0].record.source_refs[0]
+                .origin
+                .as_ref()
+                .unwrap()
+                .kind,
+            workspace_api::MemoryEvidenceOriginKind::WorkerInput
+        );
+        assert!(
+            request
+                .recv()
+                .unwrap()
+                .starts_with("GET /api/w/workspace-a/memory/staging?limit=10 ")
+        );
+        handle.join().unwrap();
+    }
+
+    #[test]
+    fn memory_staging_rejects_unknown_origin_kind() {
+        let body = r#"{"limit":10,"returned_count":1,"total_valid_count":1,"invalid_count":0,"truncated":false,"order":"order","record_authority":"authority","items":[{"id":"candidate-1","byte_len":1,"record":{"schema_version":1,"id":"candidate-1","extract_run_id":"run-1","source":{"segment_id":"segment-1","range":[1,2]},"kind":"decision","claim":"claim","why_useful":"useful","staleness":null,"evidence":[],"source_refs":[{"session_id":null,"segment_id":null,"entry_range":null,"evidence_id":null,"origin":{"kind":"future_origin"},"evidence_kind":null,"label":null,"summary":null}]}}],"diagnostics":[]}"#;
+        let (base_url, request, handle) = one_response_server("200 OK", body);
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
+
+        let error = client.list_memory_staging(10).unwrap_err();
+
+        assert!(matches!(error, BackendWorkspaceClientError::Http(_)));
+        assert!(
+            request
+                .recv()
+                .unwrap()
+                .starts_with("GET /api/w/workspace-a/memory/staging?limit=10 ")
+        );
+        handle.join().unwrap();
+    }
+
+    #[test]
+    fn objective_list_uses_workspace_scoped_backend_route() {
+        let body = r#"{"workspace_id":"workspace-a","limit":1000,"items":[],"source":"sqlite","diagnostics":[]}"#;
+        let (base_url, request, handle) = one_response_server("200 OK", body);
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
+
+        let response = client.list_objectives(1_000).unwrap();
+
+        assert!(response.items.is_empty());
+        let request = request.recv().unwrap();
+        assert!(request.starts_with("GET /api/w/workspace-a/objectives?limit=1000 "));
+        assert!(request.contains("authorization: Bearer test-backend-token\r\n"));
+        handle.join().unwrap();
+    }
+
     #[test]
     fn backend_mutation_failure_is_returned_without_local_fallback() {
-        let (base_url, request, handle) = one_response_server("403 Forbidden", "denied");
-        let client = BackendWorkspaceProductClient::new(base_url, "workspace-a").unwrap();
+        let (base_url, request, handle) =
+            one_response_server("403 Forbidden", "test-backend-token");
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
 
         let error = client
             .create_objective(&ObjectiveCreateRequest {
@@ -727,6 +833,7 @@ mod tests {
             .unwrap_err();
 
         assert!(error.to_string().contains("403"));
+        assert!(!error.to_string().contains("test-backend-token"));
         assert!(
             request
                 .recv()
@@ -739,7 +846,12 @@ mod tests {
     #[test]
     fn ticket_relation_query_uses_workspace_scoped_backend_route() {
         let (base_url, request, handle) = one_response_server("200 OK", "[]");
-        let client = BackendWorkspaceProductClient::new(base_url, "workspace-a").unwrap();
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
 
         let relations = client
             .query_ticket_relations(
@@ -758,7 +870,12 @@ mod tests {
     #[test]
     fn orchestration_plan_query_uses_workspace_scoped_backend_route() {
         let (base_url, request, handle) = one_response_server("200 OK", "[]");
-        let client = BackendWorkspaceProductClient::new(base_url, "workspace-a").unwrap();
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
 
         let records = TicketBackend::query_orchestration_plan_records(&client, None, None).unwrap();
 
@@ -777,14 +894,19 @@ mod tests {
         let (base_url, requests, handle) = response_sequence_server(vec![
             (
                 "200 OK",
-                r#"{"runtimes":[{"runtime_id":"embedded","worker_creation_available":true,"working_directory_required":false}]}"#,
+                r#"{"workspace_id":"workspace-a","runtimes":[{"runtime_id":"embedded","display_name":"Embedded","built_in":true,"worker_creation_available":true,"working_directory_required":false,"status":"connected","diagnostics":[]}],"default_profile":null,"profiles":[],"repositories":[],"working_directories":[],"diagnostics":[]}"#,
             ),
             (
                 "200 OK",
-                r#"{"runtime_id":"embedded","worker_id":"worker-1"}"#,
+                r#"{"workspace_id":"workspace-a","runtime_id":"embedded","worker_id":"worker-1","console_href":"/w/workspace-a/workers/worker-1","worker":{"runtime_id":"embedded","worker_id":"worker-1","host_id":"embedded","display_name":"Intake","label":"worker-1","profile":"builtin:intake","singleton_key":null,"tags":[],"workspace":{"visibility":"workspace","identity":"workspace-a","workspace_id":"workspace-a"},"state":"idle","last_seen_at":null,"pinned":false,"retention_state":"active","implementation":{"kind":"runtime","display_hint":"Runtime Worker"},"capabilities":{"can_stop":true,"can_spawn_followup":false},"diagnostics":[]},"diagnostics":[]}"#,
             ),
         ]);
-        let client = BackendWorkspaceProductClient::new(base_url, "workspace-a").unwrap();
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
 
         let status = client.launch_ticket_intake("T-1").unwrap();
 
@@ -804,9 +926,14 @@ mod tests {
 
     #[test]
     fn workspace_orchestrator_launch_uses_scoped_backend_route() {
-        let body = r#"{"disposition":"created","worker":{"runtime_id":"embedded","worker_id":"worker-2"}}"#;
+        let body = r#"{"workspace_id":"workspace-a","online":true,"disposition":"created","worker":{"runtime_id":"embedded","worker_id":"worker-2","host_id":"embedded","display_name":"Orchestrator","label":"worker-2","profile":"builtin:orchestrator","singleton_key":"workspace-orchestrator","tags":[],"workspace":{"visibility":"workspace","identity":"workspace-a","workspace_id":"workspace-a"},"state":"idle","last_seen_at":null,"pinned":true,"retention_state":"active","implementation":{"kind":"runtime","display_hint":"Runtime Worker"},"capabilities":{"can_stop":true,"can_spawn_followup":false},"diagnostics":[]},"diagnostics":[]}"#;
         let (base_url, request, handle) = one_response_server("200 OK", body);
-        let client = BackendWorkspaceProductClient::new(base_url, "workspace-a").unwrap();
+        let client = BackendWorkspaceProductClient::new_with_access_token(
+            base_url,
+            "workspace-a",
+            "test-backend-token",
+        )
+        .unwrap();
 
         let status = client.start_workspace_orchestrator().unwrap();
 
@@ -822,7 +949,12 @@ mod tests {
 
     #[test]
     fn product_client_requires_workspace_identity() {
-        let error = BackendWorkspaceProductClient::new("http://127.0.0.1:8787", "").unwrap_err();
+        let error = BackendWorkspaceProductClient::new_with_access_token(
+            "http://127.0.0.1:8787",
+            "",
+            "test-backend-token",
+        )
+        .unwrap_err();
         assert!(error.to_string().contains("Workspace identity"));
     }
 

crates/client/tests/backend_workspace.rs

@@ -9,14 +9,21 @@ fn workspace_creation_request_preserves_operation_key_for_retry() {
         operation_key: "workspace-create-1".to_string(),
         display_name: "Alpha".to_string(),
         repository: CreateBackendWorkspaceRepository {
+            repository_key: "main".to_string(),
             uri: "/srv/repos/alpha".to_string(),
-            display_name: Some("Main".to_string()),
             default_ref: Some("develop".to_string()),
         },
     };
 
     assert_eq!(request.clone(), request);
     assert_eq!(request.operation_key, "workspace-create-1");
+    let json = serde_json::to_value(&request).unwrap();
+    assert_eq!(json["operation_key"], "workspace-create-1");
+    assert_eq!(json["repository"]["repository_key"], "main");
+    assert_eq!(json["repository"]["uri"], "/srv/repos/alpha");
+    assert!(json.get("operation_id").is_none());
+    assert!(json["repository"].get("display_name").is_none());
+    assert!(json["repository"].get("source").is_none());
 }
 
 #[test]

crates/config-source-wasm/src/lib.rs

@@ -101,20 +101,24 @@ pub fn complete_current(
         let utf8_byte_offset = utf16_to_utf8_offset(&source, utf16_offset)?;
         let result = session_environment(snapshot.clone())
             .complete_config(&entrypoint, &source, utf8_byte_offset, explicit)
-            .map_err(|error| JsValue::from_str(&format!("{error:?}")))?
-            .map(|result| WasmCompletionResult {
-                from: result.from,
-                items: result
-                    .items
-                    .into_iter()
-                    .map(|item| WasmCompletionItem {
-                        label: item.label,
-                        kind: format!("{:?}", item.kind).to_lowercase(),
-                        detail: item.detail,
-                        priority: item.priority,
-                    })
-                    .collect(),
-            });
+            .map_err(|error| JsValue::from_str(&format!("{error:?}")))?;
+        let result = result
+            .map(|result| {
+                Ok::<WasmCompletionResult, JsValue>(WasmCompletionResult {
+                    from: utf8_to_utf16_offset(&source, result.from)?,
+                    items: result
+                        .items
+                        .into_iter()
+                        .map(|item| WasmCompletionItem {
+                            label: item.label,
+                            kind: format!("{:?}", item.kind).to_lowercase(),
+                            detail: item.detail,
+                            priority: item.priority,
+                        })
+                        .collect(),
+                })
+            })
+            .transpose()?;
         encode(result)
     })
 }
@@ -177,6 +181,16 @@ fn utf16_to_utf8_offset(source: &str, utf16_offset: usize) -> Result<usize, JsVa
     }
 }
 
+fn utf8_to_utf16_offset(source: &str, utf8_offset: usize) -> Result<usize, JsValue> {
+    if utf8_offset > source.len() {
+        return Err(JsValue::from_str("UTF-8 offset is outside the source"));
+    }
+    if !source.is_char_boundary(utf8_offset) {
+        return Err(JsValue::from_str("UTF-8 offset splits a character"));
+    }
+    Ok(source[..utf8_offset].encode_utf16().count())
+}
+
 fn decode<T: serde::de::DeserializeOwned>(value: JsValue) -> Result<T, JsValue> {
     from_value(value).map_err(|error| JsValue::from_str(&error.to_string()))
 }

crates/config-source/src/lib.rs

@@ -1203,6 +1203,9 @@ impl SnapshotEnvironment {
         {
             let mut member_source = format!("{WORKSPACE_CONFIG_SCHEMA_GLOBAL}.");
             member_source.push_str(&context.schema_path.join("."));
+            if !context.schema_path.is_empty() && context.from == utf8_byte_offset {
+                member_source.push('.');
+            }
             let mut completion = LanguageService::new(self).complete(
                 entrypoint.as_str(),
                 &member_source,
@@ -1961,6 +1964,31 @@ mod tests {
                 .iter()
                 .any(|item| item.label == "default_profile")
         );
+
+        let blank_nested_source = "{ profile = {  } } as WorkspaceConfigSchema";
+        let blank_nested_cursor = blank_nested_source.find("{  }").unwrap() + 2;
+        let blank_nested = environment
+            .complete_config(
+                &path("main.dcdl"),
+                blank_nested_source,
+                blank_nested_cursor,
+                true,
+            )
+            .unwrap()
+            .unwrap();
+        assert_eq!(blank_nested.from, blank_nested_cursor);
+        assert!(
+            blank_nested
+                .items
+                .iter()
+                .any(|item| item.label == "default_profile")
+        );
+        assert!(
+            !blank_nested
+                .items
+                .iter()
+                .any(|item| item.label == "profile")
+        );
     }
 
     #[test]

crates/fs-operation/src/glob.rs

@@ -3,7 +3,7 @@ use std::path::{Path, PathBuf};
 use globset::Glob;
 use ignore::WalkBuilder;
 
-use crate::{FsAccessPolicy, FsError, FsPath, GlobRequest, GlobResult, direct_symlink};
+use crate::{FsAccessPolicy, FsError, FsPath, GlobRequest, GlobResult, resolve_access_path};
 
 /// Execute a bounded glob entirely inside the provider process.
 pub fn run_glob(
@@ -15,26 +15,24 @@ pub fn run_glob(
     if !root.is_absolute() {
         return Err(FsError::RelativePath(root.to_path_buf()));
     }
-    if !access.is_readable(base) {
+    let base_resolved = resolve_access_path(base).map_err(|error| FsError::Io {
+        path: PathBuf::from(request.path.as_str()),
+        source: error,
+    })?;
+    if !access.is_readable_paths(base, &base_resolved) {
         return Err(FsError::OutOfScope(PathBuf::from(request.path.as_str())));
     }
-    if let Some(info) = direct_symlink(base)
-        && info.target_exists
-        && info.resolved_path.is_dir()
-    {
-        return Err(FsError::SymlinkDirectoryNotTraversed {
-            tool: "Glob",
-            path: PathBuf::from(request.path.as_str()),
-            target: PathBuf::from("<provider-internal target>"),
-        });
-    }
     let matcher = Glob::new(&request.pattern)
         .map_err(|error| FsError::InvalidGlob(error.to_string()))?
         .compile_matcher();
     let mut matches = Vec::new();
-    for entry in WalkBuilder::new(base).hidden(false).build().flatten() {
+    let mut walker = WalkBuilder::new(base);
+    walker.hidden(false).follow_links(false);
+    for entry in walker.build().flatten() {
         let path = entry.path();
-        if !path.is_file() || !access.is_readable(path) {
+        let readable = resolve_access_path(path)
+            .is_ok_and(|resolved| access.is_readable_paths(path, &resolved));
+        if !path.is_file() || !readable {
             continue;
         }
         let relative = path.strip_prefix(base).unwrap_or(path);

crates/fs-operation/src/lib.rs

@@ -14,7 +14,7 @@ use std::path::{Path, PathBuf};
 use thiserror::Error;
 
 pub use glob::run_glob;
-pub use local::{run_edit, run_list, run_read, run_stat, run_write};
+pub use local::{resolve_access_path, run_edit, run_list, run_read, run_stat, run_write};
 pub use operation::*;
 pub use search::run_grep;
 
@@ -22,6 +22,19 @@ pub use search::run_grep;
 pub trait FsAccessPolicy: Send + Sync {
     fn is_readable(&self, path: &Path) -> bool;
     fn is_writable(&self, path: &Path) -> bool;
+
+    /// Authorize both the Workdir-visible path and its provider-resolved
+    /// target. Implementations that do not distinguish symbolic-link identity
+    /// retain resolved-target semantics through the defaults.
+    fn is_readable_paths(&self, logical: &Path, resolved: &Path) -> bool {
+        let _ = logical;
+        self.is_readable(resolved)
+    }
+
+    fn is_writable_paths(&self, logical: &Path, resolved: &Path) -> bool {
+        let _ = logical;
+        self.is_writable(resolved)
+    }
 }
 
 /// First symlink encountered while resolving a provider path.
@@ -157,10 +170,28 @@ mod tests {
         }
     }
 
+    fn grep_request(path: &str, pattern: &str) -> GrepRequest {
+        GrepRequest {
+            pattern: pattern.to_string(),
+            path: FsPath::new(path).unwrap(),
+            glob: None,
+            file_type: None,
+            case_insensitive: false,
+            before_context: 0,
+            after_context: 0,
+            multiline: false,
+            output_mode: GrepOutputMode::Content,
+            limit: 10,
+            offset: 0,
+        }
+    }
+
     #[test]
     fn logical_paths_reject_absolute_parent_and_backslash_forms() {
         assert!(FsPath::new("src/lib.rs").is_ok());
         assert!(FsPath::new("/tmp/file").is_err());
+        assert!(FsPath::new_scoped("/tmp/file").is_ok());
+        assert!(FsPath::new_scoped("/tmp/../secret").is_err());
         assert!(FsPath::new("../file").is_err());
         assert!(FsPath::new("src\\lib.rs").is_err());
     }
@@ -279,4 +310,331 @@ mod tests {
         assert_eq!(grep.matched_files, 2);
         assert!(!grep.output.contains("c.txt"));
     }
+
+    #[test]
+    fn grep_accepts_a_direct_file_without_searching_siblings() {
+        let temp = tempfile::tempdir().unwrap();
+        let selected = temp.path().join("selected.txt");
+        std::fs::write(&selected, "before\nneedle selected\nafter\n").unwrap();
+        std::fs::write(temp.path().join("sibling.txt"), "needle sibling\n").unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let readable = RootAccess(root.clone());
+
+        let mut request = grep_request("selected.txt", "needle");
+        request.before_context = 1;
+        request.after_context = 1;
+        let direct = run_grep(&root, selected, request, &readable).unwrap();
+
+        assert_eq!(direct.match_count, 1);
+        assert_eq!(direct.matched_files, 1);
+        assert_eq!(
+            direct.output,
+            concat!(
+                "selected.txt\n",
+                "   1 │ before\n",
+                " > 2 │ needle selected\n",
+                "   3 │ after\n",
+            )
+        );
+        assert!(!direct.output.contains("sibling"));
+
+        let directory = run_grep(
+            &root,
+            root.clone(),
+            GrepRequest {
+                pattern: "needle".to_string(),
+                path: FsPath::root(),
+                glob: None,
+                file_type: None,
+                case_insensitive: false,
+                before_context: 0,
+                after_context: 0,
+                multiline: false,
+                output_mode: GrepOutputMode::Content,
+                limit: 10,
+                offset: 0,
+            },
+            &readable,
+        )
+        .unwrap();
+        assert_eq!(directory.match_count, 2);
+        assert_eq!(directory.matched_files, 2);
+    }
+
+    #[test]
+    fn grep_direct_file_applies_glob_and_type_filters_for_every_output_mode() {
+        let temp = tempfile::tempdir().unwrap();
+        let nested = temp.path().join("nested");
+        std::fs::create_dir(&nested).unwrap();
+        let selected = nested.join("selected.rs");
+        std::fs::write(&selected, "needle one\nneedle two\n").unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let readable = RootAccess(root.clone());
+
+        for mode in [
+            GrepOutputMode::Content,
+            GrepOutputMode::FilesWithMatches,
+            GrepOutputMode::Count,
+        ] {
+            for (glob, file_type) in [(Some("other/*.rs"), None), (None, Some("python"))] {
+                let mut request = grep_request("nested/selected.rs", "needle");
+                request.output_mode = mode;
+                request.glob = glob.map(str::to_string);
+                request.file_type = file_type.map(str::to_string);
+
+                let excluded = run_grep(&root, selected.clone(), request, &readable).unwrap();
+                assert_eq!(excluded.output, "", "mode {mode:?}");
+                assert_eq!(excluded.match_count, 0, "mode {mode:?}");
+                assert_eq!(excluded.matched_files, 0, "mode {mode:?}");
+                assert!(!excluded.truncated, "mode {mode:?}");
+            }
+
+            let mut request = grep_request("nested/selected.rs", "needle");
+            request.output_mode = mode;
+            request.glob = Some("nested/*.rs".to_string());
+            request.file_type = Some("rust".to_string());
+            let matched = run_grep(&root, selected.clone(), request, &readable).unwrap();
+
+            match mode {
+                GrepOutputMode::Content => {
+                    assert_eq!(matched.match_count, 2);
+                    assert_eq!(matched.matched_files, 1);
+                    assert!(matched.output.starts_with("nested/selected.rs\n"));
+                    assert!(matched.output.contains("> 1 │ needle one"));
+                    assert!(matched.output.contains("> 2 │ needle two"));
+                }
+                GrepOutputMode::FilesWithMatches => {
+                    assert_eq!(matched.match_count, 1);
+                    assert_eq!(matched.matched_files, 1);
+                    assert_eq!(matched.output, "nested/selected.rs\n");
+                }
+                GrepOutputMode::Count => {
+                    assert_eq!(matched.match_count, 2);
+                    assert_eq!(matched.matched_files, 1);
+                    assert_eq!(matched.output, "nested/selected.rs:2\n");
+                }
+            }
+            assert!(!matched.truncated, "mode {mode:?}");
+        }
+    }
+
+    #[test]
+    fn grep_direct_file_preserves_explicit_hidden_and_gitignored_behavior() {
+        let temp = tempfile::tempdir().unwrap();
+        let hidden = temp.path().join(".hidden.rs");
+        let ignored = temp.path().join("ignored.rs");
+        std::fs::write(&hidden, "needle hidden\n").unwrap();
+        std::fs::write(&ignored, "needle ignored\n").unwrap();
+        std::fs::write(temp.path().join(".gitignore"), "ignored.rs\n").unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let readable = RootAccess(root.clone());
+
+        for (path, expected) in [
+            (".hidden.rs", "needle hidden"),
+            ("ignored.rs", "needle ignored"),
+        ] {
+            let result = run_grep(
+                &root,
+                root.join(path),
+                grep_request(path, "needle"),
+                &readable,
+            )
+            .unwrap();
+            assert_eq!(result.match_count, 1, "path {path}");
+            assert!(result.output.contains(expected), "path {path}");
+        }
+    }
+
+    #[test]
+    fn grep_direct_file_preserves_case_multiline_and_bounds() {
+        let temp = tempfile::tempdir().unwrap();
+        let selected = temp.path().join("selected.txt");
+        std::fs::write(&selected, "NEEDLE first\nstart\nfinish\nneedle last\n").unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let readable = RootAccess(root.clone());
+
+        let mut case_request = grep_request("selected.txt", "needle");
+        case_request.case_insensitive = true;
+        case_request.offset = 1;
+        case_request.limit = 1;
+        let bounded = run_grep(&root, selected.clone(), case_request, &readable).unwrap();
+        assert_eq!(bounded.match_count, 1);
+        assert!(!bounded.output.contains("NEEDLE first"));
+        assert!(bounded.output.contains("needle last"));
+        assert!(bounded.truncated);
+
+        let mut multiline_request = grep_request("selected.txt", "start\\nfinish");
+        multiline_request.multiline = true;
+        let multiline = run_grep(&root, selected, multiline_request, &readable).unwrap();
+        assert_eq!(multiline.match_count, 1);
+        assert!(multiline.output.contains("start\nfinish"));
+    }
+
+    #[test]
+    fn grep_returns_not_found_for_a_missing_direct_path() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let missing = root.join("missing.txt");
+        let readable = RootAccess(root.clone());
+
+        let error = run_grep(
+            &root,
+            missing.clone(),
+            grep_request("missing.txt", "needle"),
+            &readable,
+        )
+        .unwrap_err();
+
+        assert!(matches!(error, FsError::NotFound(path) if path == missing));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn grep_traverses_a_direct_symlink_directory_and_rejects_a_broken_path() {
+        use std::os::unix::fs::symlink;
+
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let readable = RootAccess(root.clone());
+        std::fs::create_dir(root.join("target-dir")).unwrap();
+        std::fs::write(root.join("target-dir/nested.rs"), "needle nested\n").unwrap();
+        std::fs::write(root.join("target-file.rs"), "needle file\n").unwrap();
+        symlink(root.join("target-file.rs"), root.join("file-link.rs")).unwrap();
+        symlink(root.join("target-dir"), root.join("directory-link")).unwrap();
+        symlink(root.join("missing-target"), root.join("broken-link")).unwrap();
+
+        let request = |path: &str| grep_request(path, "needle");
+
+        let file_result = run_grep(
+            &root,
+            root.join("file-link.rs"),
+            request("file-link.rs"),
+            &readable,
+        )
+        .unwrap();
+        assert_eq!(file_result.match_count, 1);
+        assert!(file_result.output.starts_with("file-link.rs\n"));
+
+        let directory_result = run_grep(
+            &root,
+            root.join("directory-link"),
+            request("directory-link"),
+            &readable,
+        )
+        .unwrap();
+        assert_eq!(directory_result.match_count, 1);
+        assert!(
+            directory_result
+                .output
+                .starts_with("directory-link/nested.rs\n")
+        );
+
+        let glob_result = run_glob(
+            &root,
+            &root.join("directory-link"),
+            GlobRequest {
+                pattern: "**/*.rs".to_string(),
+                path: FsPath::new("directory-link").unwrap(),
+                limit: 10,
+            },
+            &readable,
+        )
+        .unwrap();
+        assert_eq!(
+            glob_result.paths,
+            vec![FsPath::new("directory-link/nested.rs").unwrap()]
+        );
+
+        let broken_error = run_grep(
+            &root,
+            root.join("broken-link"),
+            request("broken-link"),
+            &readable,
+        )
+        .unwrap_err();
+        assert!(matches!(
+            broken_error,
+            FsError::BrokenSymlink { path, .. } if path == root.join("broken-link")
+        ));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn grep_rejects_a_direct_special_file_as_invalid_argument() {
+        use std::os::unix::net::UnixListener;
+
+        let temp = tempfile::tempdir().unwrap();
+        let socket = temp.path().join("grep.sock");
+        let _listener = UnixListener::bind(&socket).unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let readable = RootAccess(root.clone());
+
+        let error = run_grep(
+            &root,
+            socket,
+            grep_request("grep.sock", "needle"),
+            &readable,
+        )
+        .unwrap_err();
+
+        assert!(matches!(
+            error,
+            FsError::InvalidArgument(message)
+                if message.contains("must be a regular file or directory")
+        ));
+    }
+
+    #[test]
+    fn grep_content_groups_lines_by_file_and_marks_matches() {
+        let temp = tempfile::tempdir().unwrap();
+        std::fs::write(
+            temp.path().join("first.txt"),
+            "before\nneedle one\nafter\nomitted one\nomitted two\nbefore distant\nneedle distant\nafter distant\n",
+        )
+        .unwrap();
+        std::fs::write(temp.path().join("second.txt"), "needle two\n").unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let readable = RootAccess(root.clone());
+
+        let grep = run_grep(
+            &root,
+            root.clone(),
+            GrepRequest {
+                pattern: "needle".to_string(),
+                path: FsPath::root(),
+                glob: Some("*.txt".to_string()),
+                output_mode: GrepOutputMode::Content,
+                case_insensitive: false,
+                before_context: 1,
+                after_context: 1,
+                multiline: false,
+                file_type: None,
+                limit: 20,
+                offset: 0,
+            },
+            &readable,
+        )
+        .unwrap();
+
+        assert_eq!(grep.match_count, 3);
+        assert_eq!(grep.matched_files, 2);
+        assert_eq!(
+            grep.output,
+            concat!(
+                "first.txt\n",
+                "   1 │ before\n",
+                " > 2 │ needle one\n",
+                "   3 │ after\n",
+                "   …\n",
+                "   6 │ before distant\n",
+                " > 7 │ needle distant\n",
+                "   8 │ after distant\n",
+                "\n",
+                "second.txt\n",
+                " > 1 │ needle two\n",
+            )
+        );
+        assert_eq!(grep.output.matches("first.txt").count(), 1);
+        assert_eq!(grep.output.matches("second.txt").count(), 1);
+    }
 }

crates/fs-operation/src/local.rs

@@ -1,3 +1,4 @@
+use std::ffi::OsString;
 use std::fs;
 use std::io::Write;
 use std::path::{Path, PathBuf};
@@ -18,7 +19,8 @@ pub fn run_stat(
 ) -> Result<StatResult, FsError> {
     let logical = request.path;
     let path = resolve(root, &logical)?;
-    if !access.is_readable(&path) {
+    let resolved = resolve_access_path(&path).map_err(|error| map_io(&logical, error))?;
+    if !access.is_readable_paths(&path, &resolved) {
         return Err(FsError::OutOfScope(PathBuf::from(logical.as_str())));
     }
     let metadata = fs::symlink_metadata(&path).map_err(|error| map_io(&logical, error))?;
@@ -45,7 +47,7 @@ pub fn run_read(
 ) -> Result<ReadResult, FsError> {
     let logical = request.path;
     let path = resolve(root, &logical)?;
-    let path = require_access(&path, &logical, access, false)?;
+    let path = require_access(&path, &logical, access, false, false)?;
     let metadata = fs::metadata(&path).map_err(|error| map_io(&logical, error))?;
     if metadata.is_dir() {
         return Err(FsError::IsDirectory(PathBuf::from(logical.as_str())));
@@ -99,7 +101,7 @@ pub fn run_write(
     let path = resolve(root, &logical)?;
     let created = !path.exists();
     if path.exists() {
-        let target = require_access(&path, &logical, access, true)?;
+        let target = require_access(&path, &logical, access, true, false)?;
         let metadata = fs::metadata(&target).map_err(|error| map_io(&logical, error))?;
         if metadata.is_dir() {
             return Err(FsError::IsDirectory(PathBuf::from(logical.as_str())));
@@ -113,12 +115,8 @@ pub fn run_write(
         if request.expected_hash.is_some() {
             return Err(FsError::Conflict(logical.as_str().to_string()));
         }
-        let parent = path.parent().ok_or_else(|| {
-            FsError::InvalidArgument(format!("{} has no parent", logical.as_str()))
-        })?;
-        let parent_logical = logical_parent(&logical);
-        require_access(parent, &parent_logical, access, true)?;
-        atomic_write(&path, &request.content, &logical)?;
+        let target = require_access(&path, &logical, access, true, true)?;
+        atomic_write(&target, &request.content, &logical)?;
     }
     Ok(WriteResult {
         bytes_written: request.content.len(),
@@ -133,7 +131,7 @@ pub fn run_edit(
 ) -> Result<EditResult, FsError> {
     let logical = request.path;
     let path = resolve(root, &logical)?;
-    let target = require_access(&path, &logical, access, true)?;
+    let target = require_access(&path, &logical, access, true, false)?;
     let bytes = fs::read(&target).map_err(|error| map_io(&logical, error))?;
     let actual_hash = hash_bytes(&bytes);
     if actual_hash != request.expected_hash {
@@ -173,7 +171,8 @@ pub fn run_list(
 ) -> Result<ListResult, FsError> {
     let logical = request.path;
     let path = resolve(root, &logical)?;
-    let path = require_access(&path, &logical, access, false)?;
+    let logical_base = path.clone();
+    let path = require_access(&path, &logical, access, false, true)?;
     let metadata = fs::metadata(&path).map_err(|error| map_io(&logical, error))?;
     if !metadata.is_dir() {
         return Err(FsError::NotDirectory(PathBuf::from(logical.as_str())));
@@ -183,7 +182,15 @@ pub fn run_list(
     for entry in read_dir {
         let entry = entry.map_err(|error| map_io(&logical, error))?;
         let absolute = entry.path();
-        if !access.is_readable(&absolute) {
+        let relative_to_base = absolute.strip_prefix(&path).map_err(|_| {
+            FsError::InvalidArgument("provider returned a path outside its list base".to_string())
+        })?;
+        let logical_absolute = logical_base.join(relative_to_base);
+        let resolved = match resolve_access_path(&absolute) {
+            Ok(resolved) => resolved,
+            Err(_) => continue,
+        };
+        if !access.is_readable_paths(&logical_absolute, &resolved) {
             continue;
         }
         let link_metadata =
@@ -203,7 +210,7 @@ pub fn run_list(
         } else {
             EntryKind::Other
         };
-        let relative = absolute.strip_prefix(root).map_err(|_| {
+        let relative = logical_absolute.strip_prefix(root).map_err(|_| {
             FsError::InvalidArgument("provider returned a path outside its root".to_string())
         })?;
         entries.push(ListEntry {
@@ -247,19 +254,24 @@ fn require_access(
     logical: &FsPath,
     access: &dyn FsAccessPolicy,
     write: bool,
+    allow_symlink_directory: bool,
 ) -> Result<PathBuf, FsError> {
-    if let Some(info) = direct_symlink(path) {
-        if !info.target_exists {
-            return Err(FsError::BrokenSymlink {
-                path: PathBuf::from(logical.as_str()),
-                link: PathBuf::from(logical.as_str()),
-                target: PathBuf::from("<provider-internal target>"),
-            });
-        }
+    let symlink = direct_symlink(path);
+    if let Some(info) = symlink.as_ref()
+        && !info.target_exists
+    {
+        return Err(FsError::BrokenSymlink {
+            path: PathBuf::from(logical.as_str()),
+            link: PathBuf::from(logical.as_str()),
+            target: PathBuf::from("<provider-internal target>"),
+        });
+    }
+    let resolved = resolve_access_path(path).map_err(|error| map_io(logical, error))?;
+    if let Some(info) = symlink {
         let allowed = if write {
-            access.is_writable(&info.resolved_path)
+            access.is_writable_paths(path, &resolved)
         } else {
-            access.is_readable(&info.resolved_path)
+            access.is_readable_paths(path, &resolved)
         };
         if !allowed {
             return Err(FsError::SymlinkOutOfScope {
@@ -268,21 +280,21 @@ fn require_access(
                 required_permission: if write { "write" } else { "read" },
             });
         }
-        if write && info.resolved_path.is_dir() {
+        if !allow_symlink_directory && info.resolved_path.is_dir() {
             return Err(FsError::SymlinkTargetIsDirectory {
                 path: PathBuf::from(logical.as_str()),
                 target: PathBuf::from("<provider-internal target>"),
             });
         }
-        return Ok(info.resolved_path);
+        return Ok(resolved);
     }
     let allowed = if write {
-        access.is_writable(path)
+        access.is_writable_paths(path, &resolved)
     } else {
-        access.is_readable(path)
+        access.is_readable_paths(path, &resolved)
     };
     if allowed {
-        Ok(path.to_path_buf())
+        Ok(resolved)
     } else if write {
         Err(FsError::ReadOnly(PathBuf::from(logical.as_str())))
     } else {
@@ -290,12 +302,38 @@ fn require_access(
     }
 }
 
-fn logical_parent(path: &FsPath) -> FsPath {
-    let parent = Path::new(path.as_str())
-        .parent()
-        .unwrap_or_else(|| Path::new(""))
-        .to_string_lossy();
-    FsPath::new(parent).unwrap_or_else(|_| FsPath::root())
+/// Resolve every existing component of an absolute provider path while
+/// retaining a missing final tail for create operations. Dangling symlinks are
+/// rejected because no resolved authority identity can be established.
+pub fn resolve_access_path(path: &Path) -> std::io::Result<PathBuf> {
+    let mut cursor = path;
+    let mut missing = Vec::<OsString>::new();
+    loop {
+        match fs::canonicalize(cursor) {
+            Ok(mut resolved) => {
+                for component in missing.iter().rev() {
+                    resolved.push(component);
+                }
+                return Ok(resolved);
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                if fs::symlink_metadata(cursor)
+                    .is_ok_and(|metadata| metadata.file_type().is_symlink())
+                {
+                    return Err(error);
+                }
+                let name = cursor.file_name().ok_or(error)?;
+                missing.push(name.to_os_string());
+                cursor = cursor.parent().ok_or_else(|| {
+                    std::io::Error::new(
+                        std::io::ErrorKind::NotFound,
+                        "path has no existing ancestor",
+                    )
+                })?;
+            }
+            Err(error) => return Err(error),
+        }
+    }
 }
 
 fn atomic_write(path: &Path, content: &[u8], logical: &FsPath) -> Result<(), FsError> {

crates/fs-operation/src/operation.rs

@@ -5,7 +5,8 @@ use serde::{Deserialize, Serialize};
 
 use crate::FsError;
 
-/// Logical path relative to the bound Workdir root.
+/// Scope-checked filesystem path. Relative paths resolve below the bound
+/// Workdir root; absolute paths require an explicit matching scope rule.
 #[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize)]
 #[serde(transparent)]
 pub struct FsPath(String);
@@ -16,11 +17,30 @@ impl<'de> Deserialize<'de> for FsPath {
         D: serde::Deserializer<'de>,
     {
         let value = String::deserialize(deserializer)?;
-        Self::new(&value).map_err(serde::de::Error::custom)
+        Self::new_scoped(&value).map_err(serde::de::Error::custom)
     }
 }
 
 impl FsPath {
+    /// Construct a path for a scope-checked operation that may target an
+    /// explicitly granted absolute path outside the provider root.
+    pub fn new_scoped(value: impl Into<String>) -> Result<Self, FsError> {
+        let value = value.into();
+        if !Path::new(&value).is_absolute() {
+            return Self::new(value);
+        }
+        if value.contains('\\') {
+            return Err(FsError::InvalidPath(value));
+        }
+        if Path::new(&value)
+            .components()
+            .any(|component| component == Component::ParentDir)
+        {
+            return Err(FsError::InvalidPath(value));
+        }
+        Ok(Self(value))
+    }
+
     pub fn root() -> Self {
         Self(String::new())
     }

crates/fs-operation/src/search.rs

@@ -1,3 +1,5 @@
+use std::collections::BTreeMap;
+use std::fmt::Write as _;
 use std::path::{Path, PathBuf};
 
 use crate::FsAccessPolicy;
@@ -5,10 +7,12 @@ use grep_regex::RegexMatcherBuilder;
 use grep_searcher::sinks::UTF8 as UTF8Sink;
 use grep_searcher::{BinaryDetection, Searcher, SearcherBuilder, Sink, SinkContext, SinkMatch};
 use ignore::WalkBuilder;
-use ignore::overrides::OverrideBuilder;
-use ignore::types::TypesBuilder;
+use ignore::overrides::{Override, OverrideBuilder};
+use ignore::types::{Types, TypesBuilder};
 
-use crate::{FsError, GrepOutputMode, GrepRequest, GrepResult, direct_symlink};
+use crate::{
+    FsError, GrepOutputMode, GrepRequest, GrepResult, direct_symlink, resolve_access_path,
+};
 
 struct ContentLine {
     path: PathBuf,
@@ -57,20 +61,11 @@ impl GrepReport {
                 }
             }
             GrepOutputMode::Content => {
-                for line in &self.lines {
-                    let separator = if line.is_match { ':' } else { '-' };
-                    let path = logical_display(root, &line.path);
-                    if self.show_line_numbers
-                        && let Some(number) = line.line_number
-                    {
-                        output.push_str(&format!(
-                            "{path}{separator}{number}{separator}{}\n",
-                            line.text
-                        ));
-                    } else {
-                        output.push_str(&format!("{path}{separator}{}\n", line.text));
-                    }
-                }
+                output.push_str(&render_content_lines(
+                    root,
+                    &self.lines,
+                    self.show_line_numbers,
+                ));
             }
         }
         GrepResult {
@@ -82,6 +77,48 @@ impl GrepReport {
     }
 }
 
+fn render_content_lines(root: &Path, lines: &[ContentLine], show_line_numbers: bool) -> String {
+    let mut grouped = BTreeMap::<&Path, Vec<&ContentLine>>::new();
+    for line in lines {
+        grouped.entry(&line.path).or_default().push(line);
+    }
+
+    let mut output = String::new();
+    for (file_index, (path, file_lines)) in grouped.into_iter().enumerate() {
+        if file_index > 0 {
+            output.push('\n');
+        }
+        let _ = writeln!(output, "{}", logical_display(root, path));
+
+        let number_width = file_lines
+            .iter()
+            .filter_map(|line| line.line_number)
+            .map(|number| number.to_string().len())
+            .max()
+            .unwrap_or(1);
+        let mut previous_line_end = None;
+        for line in file_lines {
+            if let (Some(previous_end), Some(number)) = (previous_line_end, line.line_number)
+                && number > previous_end
+            {
+                let _ = writeln!(output, "   …");
+            }
+
+            let marker = if line.is_match { '>' } else { ' ' };
+            if show_line_numbers && let Some(number) = line.line_number {
+                let _ = writeln!(output, " {marker} {number:>number_width$} │ {}", line.text);
+            } else {
+                let _ = writeln!(output, " {marker} │ {}", line.text);
+            }
+            previous_line_end = line
+                .line_number
+                .map(|number| number + line.text.split('\n').count() as u64);
+        }
+    }
+
+    output
+}
+
 fn logical_display(root: &Path, path: &Path) -> String {
     path.strip_prefix(root)
         .unwrap_or(path)
@@ -91,6 +128,38 @@ fn logical_display(root: &Path, path: &Path) -> String {
 
 const DEFAULT_HEAD_LIMIT: usize = 250;
 
+fn build_overrides(base: &Path, glob: Option<&str>) -> Result<Option<Override>, FsError> {
+    let Some(glob) = glob else {
+        return Ok(None);
+    };
+    let mut builder = OverrideBuilder::new(base);
+    builder
+        .add(glob)
+        .map_err(|error| FsError::InvalidGlob(error.to_string()))?;
+    builder
+        .build()
+        .map(Some)
+        .map_err(|error| FsError::InvalidGlob(error.to_string()))
+}
+
+fn build_types(file_type: Option<&str>) -> Result<Option<Types>, FsError> {
+    let Some(file_type) = file_type else {
+        return Ok(None);
+    };
+    let mut builder = TypesBuilder::new();
+    builder.add_defaults();
+    builder.select(file_type);
+    builder
+        .build()
+        .map(Some)
+        .map_err(|error| FsError::InvalidArgument(format!("invalid type {file_type}: {error}")))
+}
+
+fn direct_file_selected(path: &Path, overrides: Option<&Override>, types: Option<&Types>) -> bool {
+    !overrides.is_some_and(|filter| filter.matched(path, false).is_ignore())
+        && !types.is_some_and(|filter| filter.matched(path, false).is_ignore())
+}
+
 struct GrepParams {
     pattern: String,
     path: Option<PathBuf>,
@@ -153,14 +222,28 @@ pub fn run_grep(
         return Err(FsError::RelativePath(base));
     }
     let symlink = direct_symlink(&base);
-    if !access.is_readable(&base) {
+    if let Some(info) = symlink.as_ref()
+        && !info.target_exists
+    {
+        return Err(FsError::BrokenSymlink {
+            path: base.clone(),
+            link: info.link_path.clone(),
+            target: info.resolved_path.clone(),
+        });
+    }
+    let resolved_base = resolve_access_path(&base).map_err(|error| FsError::io(&base, error))?;
+    if !access.is_readable_paths(&base, &resolved_base) {
         return Err(if let Some(info) = symlink.as_ref() {
             let link_parent_readable = info
                 .link_path
                 .parent()
-                .map(|parent| access.is_readable(parent))
+                .and_then(|parent| {
+                    resolve_access_path(parent)
+                        .ok()
+                        .map(|resolved| access.is_readable_paths(parent, &resolved))
+                })
                 .unwrap_or(false);
-            if info.target_exists && link_parent_readable {
+            if link_parent_readable {
                 FsError::SymlinkOutOfScope {
                     path: base.clone(),
                     target: info.resolved_path.clone(),
@@ -173,59 +256,19 @@ pub fn run_grep(
             FsError::OutOfScope(base.clone())
         });
     }
-    if let Some(info) = symlink.as_ref() {
-        if !info.target_exists {
-            return Err(FsError::BrokenSymlink {
-                path: base.clone(),
-                link: info.link_path.clone(),
-                target: info.target_path.clone(),
-            });
-        }
-    }
     let base_meta = std::fs::metadata(&base).map_err(|e| match e.kind() {
         std::io::ErrorKind::NotFound => FsError::NotFound(base.clone()),
         _ => FsError::io(&base, e),
     })?;
-    if !base_meta.is_dir() {
+    if !base_meta.is_file() && !base_meta.is_dir() {
         return Err(FsError::InvalidArgument(format!(
-            "grep search path is not a directory: {}",
+            "grep search path must be a regular file or directory: {}",
             base.display()
         )));
     }
-    if let Some(info) = symlink.as_ref() {
-        return Err(FsError::SymlinkDirectoryNotTraversed {
-            tool: "Grep",
-            path: base.clone(),
-            target: info.resolved_path.clone(),
-        });
-    }
-
-    let mut wb = WalkBuilder::new(&base);
-    wb.hidden(true)
-        .git_ignore(true)
-        .git_global(true)
-        .git_exclude(true)
-        .ignore(true)
-        .parents(true)
-        .follow_links(false);
-
-    if let Some(t) = p.file_type.as_deref() {
-        let mut tb = TypesBuilder::new();
-        tb.add_defaults();
-        tb.select(t);
-        let types = tb
-            .build()
-            .map_err(|e| FsError::InvalidArgument(format!("invalid type {t}: {e}")))?;
-        wb.types(types);
-    }
-    if let Some(g) = p.glob.as_deref() {
-        let mut ob = OverrideBuilder::new(&base);
-        ob.add(g).map_err(|e| FsError::InvalidGlob(e.to_string()))?;
-        let ov = ob
-            .build()
-            .map_err(|e| FsError::InvalidGlob(e.to_string()))?;
-        wb.overrides(ov);
-    }
+    let filter_base = if base_meta.is_file() { root } else { &base };
+    let types = build_types(p.file_type.as_deref())?;
+    let overrides = build_overrides(filter_base, p.glob.as_deref())?;
 
     let mode = p.output_mode.unwrap_or_default();
     let head_limit = p.head_limit.unwrap_or(DEFAULT_HEAD_LIMIT);
@@ -240,74 +283,135 @@ pub fn run_grep(
         lines: Vec::new(),
         truncated: false,
     };
+    let mut matching_files_seen = 0;
+    let mut matches_seen = 0;
 
-    // Per-mode walker state.
-    let mut matching_files_seen: usize = 0;
-    let mut matches_seen: usize = 0;
+    if base_meta.is_file() {
+        if direct_file_selected(&base, overrides.as_ref(), types.as_ref()) {
+            scan_path(
+                &mut searcher,
+                &matcher,
+                &base,
+                mode,
+                &mut report,
+                &mut matching_files_seen,
+                &mut matches_seen,
+                offset,
+                head_limit,
+            )?;
+        }
+        return Ok(report.into_result(root));
+    }
 
-    'walker: for entry in wb.build().flatten() {
-        if !entry.file_type().map(|t| t.is_file()).unwrap_or(false) {
+    let mut walker = WalkBuilder::new(&base);
+    walker
+        .hidden(true)
+        .git_ignore(true)
+        .git_global(true)
+        .git_exclude(true)
+        .ignore(true)
+        .parents(true)
+        .follow_links(false);
+    if let Some(types) = types {
+        walker.types(types);
+    }
+    if let Some(overrides) = overrides {
+        walker.overrides(overrides);
+    }
+
+    for entry in walker.build().flatten() {
+        if !entry
+            .file_type()
+            .map(|kind| kind.is_file())
+            .unwrap_or(false)
+        {
             continue;
         }
         let path = entry.path();
-        if !access.is_readable(path) {
+        let readable = resolve_access_path(path)
+            .is_ok_and(|resolved| access.is_readable_paths(path, &resolved));
+        if !readable {
             continue;
         }
-
-        match mode {
-            GrepOutputMode::FilesWithMatches => {
-                let hit = scan_any_match(&mut searcher, &matcher, path)?;
-                if !hit {
-                    continue;
-                }
-                if matching_files_seen >= offset {
-                    report.files.push(path.to_path_buf());
-                    if report.files.len() >= head_limit {
-                        report.truncated = true;
-                        break 'walker;
-                    }
-                }
-                matching_files_seen += 1;
-            }
-            GrepOutputMode::Count => {
-                let count = scan_count(&mut searcher, &matcher, path)?;
-                if count == 0 {
-                    continue;
-                }
-                if matching_files_seen >= offset {
-                    report.counts.push((path.to_path_buf(), count));
-                    if report.counts.len() >= head_limit {
-                        report.truncated = true;
-                        break 'walker;
-                    }
-                }
-                matching_files_seen += 1;
-            }
-            GrepOutputMode::Content => {
-                let before_count = matches_seen;
-                let mut sink = ContentSink {
-                    path: path.to_path_buf(),
-                    lines: &mut report.lines,
-                    matches_seen: &mut matches_seen,
-                    offset,
-                    head_limit,
-                };
-                searcher
-                    .search_path(&matcher, path, &mut sink)
-                    .map_err(|e| FsError::io(path, e))?;
-                // If we hit head_limit during this file, stop walking.
-                if matches_seen >= offset.saturating_add(head_limit) && matches_seen > before_count
-                {
-                    report.truncated = true;
-                    break 'walker;
-                }
-            }
+        if scan_path(
+            &mut searcher,
+            &matcher,
+            path,
+            mode,
+            &mut report,
+            &mut matching_files_seen,
+            &mut matches_seen,
+            offset,
+            head_limit,
+        )? {
+            break;
         }
     }
 
     Ok(report.into_result(root))
 }
 
+#[allow(clippy::too_many_arguments)]
+fn scan_path(
+    searcher: &mut Searcher,
+    matcher: &grep_regex::RegexMatcher,
+    path: &Path,
+    mode: GrepOutputMode,
+    report: &mut GrepReport,
+    matching_files_seen: &mut usize,
+    matches_seen: &mut usize,
+    offset: usize,
+    head_limit: usize,
+) -> Result<bool, FsError> {
+    match mode {
+        GrepOutputMode::FilesWithMatches => {
+            if !scan_any_match(searcher, matcher, path)? {
+                return Ok(false);
+            }
+            if *matching_files_seen >= offset {
+                report.files.push(path.to_path_buf());
+                if report.files.len() >= head_limit {
+                    report.truncated = true;
+                    return Ok(true);
+                }
+            }
+            *matching_files_seen += 1;
+        }
+        GrepOutputMode::Count => {
+            let count = scan_count(searcher, matcher, path)?;
+            if count == 0 {
+                return Ok(false);
+            }
+            if *matching_files_seen >= offset {
+                report.counts.push((path.to_path_buf(), count));
+                if report.counts.len() >= head_limit {
+                    report.truncated = true;
+                    return Ok(true);
+                }
+            }
+            *matching_files_seen += 1;
+        }
+        GrepOutputMode::Content => {
+            let before_count = *matches_seen;
+            let mut sink = ContentSink {
+                path: path.to_path_buf(),
+                lines: &mut report.lines,
+                matches_seen,
+                offset,
+                head_limit,
+            };
+            searcher
+                .search_path(matcher, path, &mut sink)
+                .map_err(|error| FsError::io(path, error))?;
+            if *matches_seen >= offset.saturating_add(head_limit) && *matches_seen > before_count {
+                report.truncated = true;
+                return Ok(true);
+            }
+        }
+    }
+    Ok(false)
+}
+
 fn scan_any_match(
     searcher: &mut Searcher,
     matcher: &grep_regex::RegexMatcher,

crates/manifest/Cargo.toml

@@ -7,6 +7,7 @@ license.workspace = true
 [dependencies]
 arc-swap = "1"
 agen = { workspace = true }
+decodal.workspace = true
 protocol = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }

crates/manifest/src/builtin_profile.rs

@@ -0,0 +1,318 @@
+use std::collections::BTreeMap;
+
+use decodal::{Data, Engine, ImportLoader, LoadedImport};
+use serde_json::{Map, Number, Value};
+use sha2::{Digest, Sha256};
+
+use crate::profile::ProfileError;
+
+pub const BUILTIN_PROFILE_CATALOG_ID: &str = "builtin-profiles-v2";
+pub const BUILTIN_DEFAULT_PROFILE: &str = "builtin:default";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct BuiltinProfileImport {
+    pub specifier: &'static str,
+    pub resolved_path: &'static str,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct BuiltinProfileResource {
+    pub selector: Option<&'static str>,
+    pub path: &'static str,
+    pub source: &'static str,
+    pub description: &'static str,
+    pub imports: &'static [BuiltinProfileImport],
+}
+
+const BASE_PATH: &str = "profiles/base.dcdl";
+const BASE_IMPORT: &[BuiltinProfileImport] = &[BuiltinProfileImport {
+    specifier: "./base.dcdl",
+    resolved_path: BASE_PATH,
+}];
+const NO_IMPORTS: &[BuiltinProfileImport] = &[];
+
+pub const BUILTIN_PROFILE_RESOURCES: &[BuiltinProfileResource] = &[
+    BuiltinProfileResource {
+        selector: None,
+        path: BASE_PATH,
+        source: include_str!("../../../resources/profiles/base.dcdl"),
+        description: "Shared built-in Profile defaults.",
+        imports: NO_IMPORTS,
+    },
+    BuiltinProfileResource {
+        selector: Some(BUILTIN_DEFAULT_PROFILE),
+        path: "profiles/default.dcdl",
+        source: include_str!("../../../resources/profiles/default.dcdl"),
+        description: "Standalone Yoi coding profile.",
+        imports: BASE_IMPORT,
+    },
+    BuiltinProfileResource {
+        selector: Some("builtin:coder"),
+        path: "profiles/coder.dcdl",
+        source: include_str!("../../../resources/profiles/coder.dcdl"),
+        description: "Ticket implementation with direct Reviewer SubWorkers.",
+        imports: BASE_IMPORT,
+    },
+    BuiltinProfileResource {
+        selector: Some("builtin:companion"),
+        path: "profiles/companion.dcdl",
+        source: include_str!("../../../resources/profiles/companion.dcdl"),
+        description: "General assistance with Workspace tools.",
+        imports: BASE_IMPORT,
+    },
+    BuiltinProfileResource {
+        selector: Some("builtin:intake"),
+        path: "profiles/intake.dcdl",
+        source: include_str!("../../../resources/profiles/intake.dcdl"),
+        description: "Read-only intake and planning.",
+        imports: BASE_IMPORT,
+    },
+    BuiltinProfileResource {
+        selector: Some("builtin:reviewer"),
+        path: "profiles/reviewer.dcdl",
+        source: include_str!("../../../resources/profiles/reviewer.dcdl"),
+        description: "Independent review of a published Merge Request source.",
+        imports: BASE_IMPORT,
+    },
+    BuiltinProfileResource {
+        selector: Some("builtin:orchestrator"),
+        path: "profiles/orchestrator.dcdl",
+        source: include_str!("../../../resources/profiles/orchestrator.dcdl"),
+        description: "Workspace orchestration and Worker control.",
+        imports: BASE_IMPORT,
+    },
+    BuiltinProfileResource {
+        selector: Some("builtin:memory-consolidation"),
+        path: "profiles/memory-consolidation.dcdl",
+        source: include_str!("../../../resources/profiles/memory-consolidation.dcdl"),
+        description: "Internal Memory consolidation service.",
+        imports: BASE_IMPORT,
+    },
+];
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BuiltinProfileCatalogSnapshot {
+    pub id: &'static str,
+    pub sources: BTreeMap<String, String>,
+    pub entrypoints: BTreeMap<String, String>,
+    pub imports: BTreeMap<String, String>,
+}
+
+impl BuiltinProfileCatalogSnapshot {
+    pub fn digest(&self) -> String {
+        let mut hasher = Sha256::new();
+        hasher.update(self.id.as_bytes());
+        for (path, source) in &self.sources {
+            hasher.update((path.len() as u64).to_le_bytes());
+            hasher.update(path.as_bytes());
+            hasher.update((source.len() as u64).to_le_bytes());
+            hasher.update(source.as_bytes());
+        }
+        for (selector, path) in &self.entrypoints {
+            hasher.update((selector.len() as u64).to_le_bytes());
+            hasher.update(selector.as_bytes());
+            hasher.update((path.len() as u64).to_le_bytes());
+            hasher.update(path.as_bytes());
+        }
+        for (request, resolved_path) in &self.imports {
+            hasher.update((request.len() as u64).to_le_bytes());
+            hasher.update(request.as_bytes());
+            hasher.update((resolved_path.len() as u64).to_le_bytes());
+            hasher.update(resolved_path.as_bytes());
+        }
+        format!("sha256:{:x}", hasher.finalize())
+    }
+}
+
+pub fn builtin_profile_catalog_snapshot() -> BuiltinProfileCatalogSnapshot {
+    let mut sources = BTreeMap::new();
+    let mut entrypoints = BTreeMap::new();
+    let mut imports = BTreeMap::new();
+
+    for resource in BUILTIN_PROFILE_RESOURCES {
+        sources.insert(resource.path.to_owned(), resource.source.to_owned());
+        for import in resource.imports {
+            imports.insert(
+                format!("{}\0{}", resource.path, import.specifier),
+                import.resolved_path.to_owned(),
+            );
+        }
+        if let Some(selector) = resource.selector {
+            entrypoints.insert(selector.to_owned(), resource.path.to_owned());
+        }
+    }
+
+    BuiltinProfileCatalogSnapshot {
+        id: BUILTIN_PROFILE_CATALOG_ID,
+        sources,
+        entrypoints,
+        imports,
+    }
+}
+
+pub fn builtin_profile_entrypoints() -> impl Iterator<Item = &'static BuiltinProfileResource> {
+    BUILTIN_PROFILE_RESOURCES
+        .iter()
+        .filter(|resource| resource.selector.is_some())
+}
+
+pub(crate) fn resolve_builtin_profile_artifact(
+    selector: &str,
+) -> Result<Option<Value>, ProfileError> {
+    let catalog = builtin_profile_catalog_snapshot();
+    let Some(entrypoint) = catalog.entrypoints.get(selector) else {
+        return Ok(None);
+    };
+    let source = catalog
+        .sources
+        .get(entrypoint)
+        .expect("built-in Profile entrypoint must name a source")
+        .clone();
+    let mut engine = Engine::new(BuiltinProfileImportLoader {
+        sources: catalog.sources,
+    });
+    let module = engine
+        .add_root_source(entrypoint, entrypoint, &source)
+        .map_err(|error| ProfileError::BuiltinProfileEvaluation {
+            selector: selector.to_owned(),
+            message: format!("{error:?}"),
+        })?;
+    let value =
+        engine
+            .eval_module(module)
+            .map_err(|error| ProfileError::BuiltinProfileEvaluation {
+                selector: selector.to_owned(),
+                message: format!("{error:?}"),
+            })?;
+    let data =
+        engine
+            .materialize(&value)
+            .map_err(|error| ProfileError::BuiltinProfileEvaluation {
+                selector: selector.to_owned(),
+                message: format!("{error:?}"),
+            })?;
+    Ok(Some(data_to_json(&data)))
+}
+
+#[derive(Debug)]
+struct BuiltinProfileImportLoader {
+    sources: BTreeMap<String, String>,
+}
+
+impl ImportLoader for BuiltinProfileImportLoader {
+    fn load(
+        &mut self,
+        current_key: Option<&str>,
+        specifier: &str,
+    ) -> decodal::Result<LoadedImport> {
+        let current_key = current_key.ok_or_else(|| {
+            decodal::Diagnostic::new(
+                decodal::DiagnosticKind::Import,
+                decodal::Span::default(),
+                format!("built-in Profile import `{specifier}` has no source context"),
+            )
+        })?;
+        let resolved = resolve_import_path(current_key, specifier).ok_or_else(|| {
+            decodal::Diagnostic::new(
+                decodal::DiagnosticKind::Import,
+                decodal::Span::default(),
+                format!("built-in Profile import `{specifier}` from `{current_key}` is invalid"),
+            )
+        })?;
+        let source = self.sources.get(&resolved).ok_or_else(|| {
+            decodal::Diagnostic::new(
+                decodal::DiagnosticKind::Import,
+                decodal::Span::default(),
+                format!("built-in Profile import `{specifier}` from `{current_key}` was not found"),
+            )
+        })?;
+        Ok(LoadedImport::source(
+            resolved.clone(),
+            resolved,
+            source.clone(),
+        ))
+    }
+}
+
+fn resolve_import_path(current_key: &str, specifier: &str) -> Option<String> {
+    let current_parent = current_key
+        .rsplit_once('/')
+        .map_or("", |(parent, _)| parent);
+    let joined = if let Some(relative) = specifier.strip_prefix("./") {
+        format!("{current_parent}/{relative}")
+    } else {
+        return None;
+    };
+    if joined
+        .split('/')
+        .any(|segment| segment.is_empty() || segment == "." || segment == "..")
+    {
+        return None;
+    }
+    Some(joined)
+}
+
+fn data_to_json(data: &Data) -> Value {
+    match data {
+        Data::Bool(value) => Value::Bool(*value),
+        Data::Int(value) => Value::Number(Number::from(*value)),
+        Data::Float(value) => Number::from_f64(*value)
+            .map(Value::Number)
+            .unwrap_or(Value::Null),
+        Data::String(value) => Value::String(value.clone()),
+        Data::Array(values) => Value::Array(values.iter().map(data_to_json).collect()),
+        Data::Object(fields) => Value::Object(
+            fields
+                .iter()
+                .map(|field| (field.name.clone(), data_to_json(&field.value)))
+                .collect::<Map<_, _>>(),
+        ),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn catalog_has_one_explicit_entrypoint_for_each_builtin_profile() {
+        let catalog = builtin_profile_catalog_snapshot();
+        assert_eq!(catalog.sources.len(), BUILTIN_PROFILE_RESOURCES.len());
+        assert_eq!(catalog.entrypoints.len() + 1, catalog.sources.len());
+        assert_eq!(
+            catalog.entrypoints.get(BUILTIN_DEFAULT_PROFILE),
+            Some(&"profiles/default.dcdl".to_owned())
+        );
+        assert!(catalog.digest().starts_with("sha256:"));
+    }
+
+    #[test]
+    fn default_profile_evaluates_from_the_shared_resource_graph() {
+        let value = resolve_builtin_profile_artifact(BUILTIN_DEFAULT_PROFILE)
+            .expect("evaluate built-in default")
+            .expect("default exists");
+        assert_eq!(value["slug"], "default");
+        assert_eq!(value["feature"]["task"]["enabled"], true);
+        assert_eq!(value["feature"]["sub_worker"]["enabled"], true);
+        assert_eq!(value["feature"]["memory"]["enabled"], false);
+        assert_eq!(value["feature"]["ticket"]["enabled"], false);
+        assert_eq!(value["feature"]["worker"]["enabled"], false);
+        assert_eq!(value["feature"]["manage_workdir"]["enabled"], false);
+    }
+
+    #[test]
+    fn imports_cannot_escape_the_builtin_resource_catalog() {
+        assert_eq!(
+            resolve_import_path("profiles/default.dcdl", "./base.dcdl").as_deref(),
+            Some("profiles/base.dcdl")
+        );
+        assert_eq!(
+            resolve_import_path("profiles/default.dcdl", "../outside.dcdl"),
+            None
+        );
+        assert_eq!(
+            resolve_import_path("profiles/default.dcdl", "/outside.dcdl"),
+            None
+        );
+    }
+}

crates/manifest/src/config.rs

@@ -15,13 +15,13 @@ use serde::{Deserialize, Serialize};
 
 use crate::defaults;
 use crate::model::{AuthRef, ModelManifest, ReasoningControl};
-use crate::plugin::PluginConfig;
 use crate::{
     CompactionConfig, EngineManifest, FeatureConfig, FeatureFlagConfig, FileUploadLimits,
-    McpConfig, McpEnvValue, McpStdioCwdPolicy, MemoryConfig, MemoryFeatureConfig,
-    MergeRequestFeatureConfig, ScopeConfig, SessionConfig, SkillsConfig, TicketFeatureConfig,
-    ToolOutputLimits, ToolPermissionConfig, ToolPermissionRule, WebConfig, WorkerFeatureConfig,
-    WorkerManifest, WorkerMeta,
+    McpConfig, McpEnvValue, McpStdioCwdPolicy, MemoryConsolidationProfileConfig,
+    MemoryExtractionProfileConfig, MemoryFeatureProfileConfig, MemoryResidentProfileConfig,
+    MergeRequestFeatureConfig, ResolvedMemoryFeatureConfig, ScopeConfig, SessionConfig,
+    SkillsConfig, TicketFeatureConfig, ToolOutputLimits, ToolPermissionConfig, ToolPermissionRule,
+    WebConfig, WorkerFeatureConfig, WorkerManifest, WorkerMeta,
 };
 
 /// Partial-form Worker manifest. Every field is optional; one or more
@@ -54,10 +54,6 @@ pub struct WorkerManifestConfig {
     /// disabled after cascade merge.
     #[serde(default)]
     pub feature: FeatureConfigPartial,
-    /// Explicit plugin package enablement entries. Discovery/resolution is a
-    /// separate step and does not run during config merge.
-    #[serde(default)]
-    pub plugins: PluginConfig,
     /// Explicit Model Context Protocol provider declarations. Config parsing
     /// never starts a local MCP subprocess.
     #[serde(default)]
@@ -67,15 +63,13 @@ pub struct WorkerManifestConfig {
     /// First-class web tool opt-in. See [`WebConfig`].
     #[serde(default)]
     pub web: Option<WebConfig>,
-    /// Memory subsystem opt-in. See [`MemoryConfig`].
-    #[serde(default)]
-    pub memory: Option<MemoryConfig>,
     /// External Agent Skills directories. See [`crate::SkillsConfig`].
     #[serde(default)]
     pub skills: Option<SkillsConfig>,
 }
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct FeatureConfigPartial {
     #[serde(default)]
     pub task: Option<FeatureFlagConfigPartial>,
@@ -92,6 +86,8 @@ pub struct FeatureConfigPartial {
     #[serde(default)]
     pub worker: Option<WorkerFeatureConfigPartial>,
     #[serde(default)]
+    pub workspace_worker_discovery: Option<FeatureFlagConfigPartial>,
+    #[serde(default)]
     pub objective: Option<FeatureFlagConfigPartial>,
     #[serde(default)]
     pub manage_workdir: Option<FeatureFlagConfigPartial>,
@@ -101,8 +97,6 @@ pub struct FeatureConfigPartial {
     pub merge_request: Option<MergeRequestFeatureConfigPartial>,
     #[serde(default)]
     pub orchestration: Option<FeatureFlagConfigPartial>,
-    #[serde(default)]
-    pub plugins: Option<FeatureFlagConfigPartial>,
 }
 
 impl FeatureConfigPartial {
@@ -119,6 +113,11 @@ impl FeatureConfigPartial {
             ),
             flow: merge_option(self.flow, other.flow, FeatureFlagConfigPartial::merge),
             worker: merge_option(self.worker, other.worker, WorkerFeatureConfigPartial::merge),
+            workspace_worker_discovery: merge_option(
+                self.workspace_worker_discovery,
+                other.workspace_worker_discovery,
+                FeatureFlagConfigPartial::merge,
+            ),
             objective: merge_option(
                 self.objective,
                 other.objective,
@@ -140,7 +139,6 @@ impl FeatureConfigPartial {
                 other.orchestration,
                 FeatureFlagConfigPartial::merge,
             ),
-            plugins: merge_option(self.plugins, other.plugins, FeatureFlagConfigPartial::merge),
         }
     }
 }
@@ -186,18 +184,86 @@ impl From<WorkerFeatureConfigPartial> for WorkerFeatureConfig {
 }
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct MemoryFeatureConfigPartial {
     #[serde(default)]
     pub enabled: Option<bool>,
     #[serde(default)]
-    pub staging: Option<bool>,
+    pub staging_tools: Option<bool>,
+    #[serde(default)]
+    pub resident: Option<MemoryResidentProfileConfigPartial>,
+    #[serde(default)]
+    pub extraction: Option<MemoryExtractionProfileConfigPartial>,
+    #[serde(default)]
+    pub consolidation: Option<MemoryConsolidationProfileConfigPartial>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryResidentProfileConfigPartial {
+    #[serde(default)]
+    pub inject_summary: Option<bool>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryExtractionProfileConfigPartial {
+    #[serde(default)]
+    pub enabled: Option<bool>,
+    #[serde(default)]
+    pub model: Option<ModelManifest>,
+    #[serde(default)]
+    pub threshold: Option<u64>,
+    #[serde(default)]
+    pub worker_max_turns: Option<u32>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MemoryConsolidationProfileConfigPartial {
+    #[serde(default)]
+    pub request_enabled: Option<bool>,
 }
 
 impl MemoryFeatureConfigPartial {
     fn merge(self, other: Self) -> Self {
         Self {
             enabled: other.enabled.or(self.enabled),
-            staging: other.staging.or(self.staging),
+            staging_tools: other.staging_tools.or(self.staging_tools),
+            resident: merge_option(
+                self.resident,
+                other.resident,
+                MemoryResidentProfileConfigPartial::merge,
+            ),
+            extraction: merge_option(
+                self.extraction,
+                other.extraction,
+                MemoryExtractionProfileConfigPartial::merge,
+            ),
+            consolidation: merge_option(
+                self.consolidation,
+                other.consolidation,
+                MemoryConsolidationProfileConfigPartial::merge,
+            ),
+        }
+    }
+}
+
+impl MemoryResidentProfileConfigPartial {
+    fn merge(self, other: Self) -> Self {
+        Self {
+            inject_summary: other.inject_summary.or(self.inject_summary),
+        }
+    }
+}
+
+impl MemoryExtractionProfileConfigPartial {
+    fn merge(self, other: Self) -> Self {
+        Self {
+            enabled: other.enabled.or(self.enabled),
+            model: other.model.or(self.model),
+            threshold: other.threshold.or(self.threshold),
+            worker_max_turns: other.worker_max_turns.or(self.worker_max_turns),
         }
     }
 }
@@ -246,13 +312,21 @@ impl MergeRequestFeatureConfigPartial {
     }
 }
 
+impl MemoryConsolidationProfileConfigPartial {
+    fn merge(self, other: Self) -> Self {
+        Self {
+            request_enabled: other.request_enabled.or(self.request_enabled),
+        }
+    }
+}
+
 impl From<FeatureConfigPartial> for FeatureConfig {
     fn from(value: FeatureConfigPartial) -> Self {
         Self {
             task: value.task.map(FeatureFlagConfig::from).unwrap_or_default(),
             memory: value
                 .memory
-                .map(MemoryFeatureConfig::from)
+                .map(ResolvedMemoryFeatureConfig::from)
                 .unwrap_or_default(),
             web: value.web.map(FeatureFlagConfig::from).unwrap_or_default(),
             image: value.image.map(FeatureFlagConfig::from).unwrap_or_default(),
@@ -265,6 +339,10 @@ impl From<FeatureConfigPartial> for FeatureConfig {
                 .worker
                 .map(WorkerFeatureConfig::from)
                 .unwrap_or_default(),
+            workspace_worker_discovery: value
+                .workspace_worker_discovery
+                .map(FeatureFlagConfig::from)
+                .unwrap_or_default(),
             objective: value
                 .objective
                 .map(FeatureFlagConfig::from)
@@ -285,10 +363,6 @@ impl From<FeatureConfigPartial> for FeatureConfig {
                 .orchestration
                 .map(FeatureFlagConfig::from)
                 .unwrap_or_default(),
-            plugins: value
-                .plugins
-                .map(FeatureFlagConfig::from)
-                .unwrap_or_default(),
         }
     }
 }
@@ -318,20 +392,52 @@ impl From<WorkerFeatureConfig> for WorkerFeatureConfigPartial {
     }
 }
 
-impl From<MemoryFeatureConfigPartial> for MemoryFeatureConfig {
+impl From<MemoryFeatureConfigPartial> for ResolvedMemoryFeatureConfig {
     fn from(value: MemoryFeatureConfigPartial) -> Self {
+        let resident = value.resident.unwrap_or_default();
+        let extraction = value.extraction.unwrap_or_default();
+        let consolidation = value.consolidation.unwrap_or_default();
         Self {
-            enabled: value.enabled.unwrap_or_default(),
-            staging: value.staging.unwrap_or_default(),
+            profile: MemoryFeatureProfileConfig {
+                enabled: value.enabled.unwrap_or_default(),
+                staging_tools: value.staging_tools.unwrap_or_default(),
+                resident: MemoryResidentProfileConfig {
+                    inject_summary: resident.inject_summary.unwrap_or(true),
+                },
+                extraction: MemoryExtractionProfileConfig {
+                    enabled: extraction.enabled.unwrap_or(true),
+                    model: extraction.model,
+                    threshold: extraction.threshold.or(Some(50_000)),
+                    worker_max_turns: extraction
+                        .worker_max_turns
+                        .or(defaults::MEMORY_EXTRACT_WORKER_MAX_TURNS),
+                },
+                consolidation: MemoryConsolidationProfileConfig {
+                    request_enabled: consolidation.request_enabled.unwrap_or(true),
+                },
+            },
+            workspace_settings: None,
         }
     }
 }
 
-impl From<MemoryFeatureConfig> for MemoryFeatureConfigPartial {
-    fn from(value: MemoryFeatureConfig) -> Self {
+impl From<ResolvedMemoryFeatureConfig> for MemoryFeatureConfigPartial {
+    fn from(value: ResolvedMemoryFeatureConfig) -> Self {
         Self {
-            enabled: Some(value.enabled),
-            staging: Some(value.staging),
+            enabled: Some(value.profile.enabled),
+            staging_tools: Some(value.profile.staging_tools),
+            resident: Some(MemoryResidentProfileConfigPartial {
+                inject_summary: Some(value.profile.resident.inject_summary),
+            }),
+            extraction: Some(MemoryExtractionProfileConfigPartial {
+                enabled: Some(value.profile.extraction.enabled),
+                model: value.profile.extraction.model,
+                threshold: value.profile.extraction.threshold,
+                worker_max_turns: value.profile.extraction.worker_max_turns,
+            }),
+            consolidation: Some(MemoryConsolidationProfileConfigPartial {
+                request_enabled: Some(value.profile.consolidation.request_enabled),
+            }),
         }
     }
 }
@@ -394,12 +500,12 @@ impl From<FeatureConfig> for FeatureConfigPartial {
             sub_worker: Some(value.sub_worker.into()),
             flow: Some(value.flow.into()),
             worker: Some(value.worker.into()),
+            workspace_worker_discovery: Some(value.workspace_worker_discovery.into()),
             objective: Some(value.objective.into()),
             manage_workdir: Some(value.manage_workdir.into()),
             ticket: Some(value.ticket.into()),
             merge_request: Some(value.merge_request.into()),
             orchestration: Some(value.orchestration.into()),
-            plugins: Some(value.plugins.into()),
         }
     }
 }
@@ -531,13 +637,23 @@ pub(crate) fn reject_removed_manifest_fields(s: &str) -> Result<(), toml::de::Er
              (removed; use compaction.prune_protected_tokens)",
         ));
     }
+    if value.get("memory").is_some() {
+        return Err(toml::de::Error::custom(
+            "unknown field in manifest: memory (removed; configure feature.memory)",
+        ));
+    }
+    if value.get("plugins").is_some() {
+        return Err(toml::de::Error::custom(
+            "unknown field in manifest: plugins (dynamic Plugins are not supported)",
+        ));
+    }
     if value
-        .get("memory")
+        .get("feature")
         .and_then(toml::Value::as_table)
-        .is_some_and(|table| table.contains_key("extract_worker_max_input_tokens"))
+        .is_some_and(|table| table.contains_key("plugins"))
     {
         return Err(toml::de::Error::custom(
-            "unknown field in manifest: memory.extract_worker_max_input_tokens (removed)",
+            "unknown field in manifest: feature.plugins (dynamic Plugins are not supported)",
         ));
     }
     if value
@@ -566,15 +682,16 @@ impl WorkerManifestConfig {
         })
     }
 
-    /// Base config populated with the in-code defaults listed in
-    /// [`crate::defaults`]. Profile and one-file Manifest resolvers start
-    /// from this layer so every per-field default lives at exactly one
-    /// call site (the `defaults` module).
+    /// Base config populated with the in-code per-field defaults listed in
+    /// [`crate::defaults`]. This is not a selectable Profile and does not
+    /// enable a launch capability surface. Profile and one-file Manifest
+    /// resolvers start from this layer so every per-field default lives at
+    /// exactly one call site (the `defaults` module).
     ///
     /// `TryFrom<WorkerManifestConfig>` also reads the same constants as a
     /// belt-and-suspenders fallback, so a manually-constructed config
     /// that skips this layer still resolves to the same values.
-    pub fn builtin_defaults() -> Self {
+    pub fn resolution_defaults() -> Self {
         Self {
             engine: EngineManifestConfig {
                 tool_output: ToolOutputLimitsPartial {
@@ -620,11 +737,6 @@ impl WorkerManifestConfig {
         for rule in &mut self.delegation_scope.deny {
             rule.target = join_if_relative(base, &rule.target);
         }
-        if let Some(ref mut memory) = self.memory
-            && let Some(ref mut root) = memory.workspace_root
-        {
-            *root = join_if_relative(base, root);
-        }
         if let Some(ref mut compaction) = self.compaction
             && let Some(ref mut cp) = compaction.model
         {
@@ -661,7 +773,6 @@ impl WorkerManifestConfig {
                 PermissionConfigPartial::merge,
             ),
             feature: self.feature.merge(upper.feature),
-            plugins: merge_plugin_config(self.plugins, upper.plugins),
             mcp: merge_mcp_config(self.mcp, upper.mcp),
             compaction: merge_option(
                 self.compaction,
@@ -669,7 +780,6 @@ impl WorkerManifestConfig {
                 CompactionConfigPartial::merge,
             ),
             web: merge_option(self.web, upper.web, WebConfig::merge),
-            memory: merge_option(self.memory, upper.memory, MemoryConfig::merge),
             skills: merge_option(self.skills, upper.skills, SkillsConfig::merge),
         }
     }
@@ -682,16 +792,6 @@ impl SkillsConfig {
     }
 }
 
-fn merge_plugin_config(mut base: PluginConfig, upper: PluginConfig) -> PluginConfig {
-    let upper_has_resolved_plan = upper.has_resolved_plan();
-    base.enabled.extend(upper.enabled);
-    if upper_has_resolved_plan {
-        base.resolved = upper.resolved;
-        base.diagnostics = upper.diagnostics;
-    }
-    base
-}
-
 fn merge_mcp_config(mut base: McpConfig, upper: McpConfig) -> McpConfig {
     base.stdio_servers.extend(upper.stdio_servers);
     base
@@ -741,32 +841,6 @@ impl crate::WebFetchConfig {
     }
 }
 
-impl MemoryConfig {
-    fn merge(self, upper: Self) -> Self {
-        Self {
-            workspace_root: upper.workspace_root.or(self.workspace_root),
-            query_result_limit: upper.query_result_limit.or(self.query_result_limit),
-            query_excerpt_lines: upper.query_excerpt_lines.or(self.query_excerpt_lines),
-            inject_summary: upper.inject_summary.or(self.inject_summary),
-            workspace_id: upper.workspace_id.or(self.workspace_id),
-            settings_revision: upper.settings_revision.or(self.settings_revision),
-            language: upper.language.or(self.language),
-            extract_model: upper.extract_model.or(self.extract_model),
-            extract_threshold: upper.extract_threshold.or(self.extract_threshold),
-            extract_worker_max_turns: upper
-                .extract_worker_max_turns
-                .or(self.extract_worker_max_turns),
-            consolidation_model: upper.consolidation_model.or(self.consolidation_model),
-            consolidation_threshold_files: upper
-                .consolidation_threshold_files
-                .or(self.consolidation_threshold_files),
-            consolidation_threshold_bytes: upper
-                .consolidation_threshold_bytes
-                .or(self.consolidation_threshold_bytes),
-        }
-    }
-}
-
 impl WorkerMetaConfig {
     fn merge(self, upper: Self) -> Self {
         Self {
@@ -1206,11 +1280,9 @@ impl TryFrom<WorkerManifestConfig> for WorkerManifest {
             session,
             permissions,
             feature: FeatureConfig::from(cfg.feature),
-            plugins: cfg.plugins,
             mcp: cfg.mcp,
             compaction,
             web: cfg.web,
-            memory: cfg.memory,
             skills: cfg.skills,
             profile: None,
         })
@@ -1247,18 +1319,17 @@ mod tests {
                     target: abs("/worker"),
                     permission: Permission::Write,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 }],
                 deny: Vec::new(),
             },
             delegation_scope: ScopeConfig::default(),
             permissions: None,
             feature: FeatureConfigPartial::default(),
-            plugins: PluginConfig::default(),
             mcp: McpConfig::default(),
             session: None,
             compaction: None,
             web: None,
-            memory: None,
             skills: None,
         }
     }
@@ -1494,6 +1565,7 @@ mod tests {
             target: PathBuf::from("secrets"),
             permission: Permission::Write,
             recursive: true,
+            symlink_policy: Default::default(),
         });
         let resolved = cfg.resolve_paths(Path::new("/workspace/proj"));
         assert_eq!(resolved.scope.allow[0].target, Path::new("/workspace/proj"));
@@ -1631,6 +1703,7 @@ mod tests {
                     target: abs("/a"),
                     permission: Permission::Read,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 }],
                 deny: Vec::new(),
             },
@@ -1642,11 +1715,13 @@ mod tests {
                     target: abs("/b"),
                     permission: Permission::Write,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 }],
                 deny: vec![ScopeRule {
                     target: abs("/a/secret"),
                     permission: Permission::Read,
                     recursive: false,
+                    symlink_policy: Default::default(),
                 }],
             },
             ..Default::default()
@@ -1833,29 +1908,50 @@ prune_protected_turns = 3
     }
 
     #[test]
-    fn from_toml_rejects_removed_extract_worker_max_input_tokens_field() {
-        let bad = r#"
-[memory]
-extract_worker_max_input_tokens = 30000
-"#;
-        let err = WorkerManifestConfig::from_toml(bad).unwrap_err();
-        assert!(
-            err.to_string()
-                .contains("memory.extract_worker_max_input_tokens"),
-            "unexpected error: {err}"
-        );
+    fn from_toml_accepts_memory_extraction_settings_only_under_feature_memory() {
+        let cfg = WorkerManifestConfig::from_toml(
+            r#"
+[feature.memory]
+enabled = true
+staging_tools = false
+
+[feature.memory.resident]
+inject_summary = false
+
+[feature.memory.extraction]
+enabled = true
+threshold = 42000
+worker_max_turns = 2
+
+[feature.memory.consolidation]
+request_enabled = false
+"#,
+        )
+        .unwrap();
+        let memory = cfg.feature.memory.unwrap();
+        assert_eq!(memory.enabled, Some(true));
+        assert_eq!(memory.staging_tools, Some(false));
+        assert_eq!(memory.resident.unwrap().inject_summary, Some(false));
+        assert_eq!(memory.consolidation.unwrap().request_enabled, Some(false));
+        let extraction = memory.extraction.unwrap();
+        assert_eq!(extraction.enabled, Some(true));
+        assert_eq!(extraction.threshold, Some(42_000));
+        assert_eq!(extraction.worker_max_turns, Some(2));
     }
 
     #[test]
-    fn from_toml_accepts_extract_worker_max_turns() {
-        let cfg = WorkerManifestConfig::from_toml(
+    fn from_toml_rejects_legacy_top_level_memory_authority() {
+        let err = WorkerManifestConfig::from_toml(
             r#"
 [memory]
 extract_worker_max_turns = 2
 "#,
         )
-        .unwrap();
-        assert_eq!(cfg.memory.unwrap().extract_worker_max_turns, Some(2));
+        .unwrap_err();
+        assert!(
+            err.to_string().contains("memory"),
+            "unexpected error: {err}"
+        );
     }
 
     #[test]
@@ -1935,7 +2031,7 @@ worker_max_turns = 7
     fn feature_flags_default_disabled_in_resolved_manifest() {
         let manifest: WorkerManifest = minimal_valid().try_into().unwrap();
         assert!(!manifest.feature.task.enabled);
-        assert!(!manifest.feature.memory.enabled);
+        assert!(!manifest.feature.memory.profile.enabled);
         assert!(!manifest.feature.web.enabled);
         assert!(!manifest.feature.sub_worker.enabled);
         assert!(!manifest.feature.objective.enabled);
@@ -1973,7 +2069,7 @@ enabled = false
 "#,
         )
         .unwrap();
-        let manifest: WorkerManifest = WorkerManifestConfig::builtin_defaults()
+        let manifest: WorkerManifest = WorkerManifestConfig::resolution_defaults()
             .merge(cfg)
             .merge(WorkerManifestConfig {
                 worker: WorkerMetaConfig {
@@ -1989,6 +2085,7 @@ enabled = false
                         target: abs("/worker"),
                         permission: Permission::Read,
                         recursive: true,
+                        symlink_policy: Default::default(),
                     }],
                     deny: Vec::new(),
                 },
@@ -2012,8 +2109,8 @@ enabled = false
             }
         );
         assert!(!manifest.feature.orchestration.enabled);
-        assert!(!manifest.feature.memory.enabled);
-        assert!(!manifest.feature.memory.staging);
+        assert!(!manifest.feature.memory.profile.enabled);
+        assert!(!manifest.feature.memory.profile.staging_tools);
         assert!(!manifest.feature.objective.enabled);
     }
 
@@ -2061,7 +2158,7 @@ readiness_check = true
 enabled = true
 
 [feature.memory]
-staging = true
+staging_tools = true
 
 [feature.manage_workdir]
 enabled = true
@@ -2074,7 +2171,7 @@ enabled = true
 "#,
         )
         .unwrap();
-        let manifest: WorkerManifest = WorkerManifestConfig::builtin_defaults()
+        let manifest: WorkerManifest = WorkerManifestConfig::resolution_defaults()
             .merge(base)
             .merge(upper)
             .merge(WorkerManifestConfig {
@@ -2091,6 +2188,7 @@ enabled = true
                         target: abs("/worker"),
                         permission: Permission::Read,
                         recursive: true,
+                        symlink_policy: Default::default(),
                     }],
                     deny: Vec::new(),
                 },
@@ -2098,8 +2196,8 @@ enabled = true
             })
             .try_into()
             .unwrap();
-        assert!(manifest.feature.memory.enabled);
-        assert!(manifest.feature.memory.staging);
+        assert!(manifest.feature.memory.profile.enabled);
+        assert!(manifest.feature.memory.profile.staging_tools);
         assert!(manifest.feature.manage_workdir.enabled);
         assert!(manifest.feature.ticket.enabled);
         assert!(!manifest.feature.ticket.authoring);
@@ -2137,7 +2235,7 @@ permission = "write"
 
     #[test]
     fn builtin_defaults_populates_worker_limit_defaults() {
-        let cfg = WorkerManifestConfig::builtin_defaults();
+        let cfg = WorkerManifestConfig::resolution_defaults();
         assert_eq!(
             cfg.engine.tool_output.default_max_bytes,
             Some(defaults::TOOL_OUTPUT_MAX_BYTES)
@@ -2167,12 +2265,13 @@ permission = "write"
                     target: abs("/worker"),
                     permission: Permission::Write,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 }],
                 deny: Vec::new(),
             },
             ..Default::default()
         };
-        let merged = WorkerManifestConfig::builtin_defaults().merge(overlay);
+        let merged = WorkerManifestConfig::resolution_defaults().merge(overlay);
         let manifest: WorkerManifest = merged.try_into().unwrap();
         assert_eq!(
             manifest.engine.tool_output.default_max_bytes,

crates/manifest/src/defaults.rs

@@ -93,5 +93,5 @@ pub const COMPACT_RESULT_CONTEXT_MAX_TOKENS: u64 = 60_000;
 pub const COMPACT_DEFAULT_REFERENCE_COUNT: usize = 5;
 
 /// Optional maximum extract-worker tool-loop depth. `None` means unlimited.
-/// See [`crate::MemoryConfig::extract_worker_max_turns`].
+/// See [`crate::MemoryExtractionProfileConfig::worker_max_turns`].
 pub const MEMORY_EXTRACT_WORKER_MAX_TURNS: Option<u32> = Some(8);

crates/manifest/src/profile.rs

@@ -6,62 +6,27 @@
 //! from launch context.
 
 use serde::{Deserialize, Serialize};
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
 use std::path::{Path, PathBuf};
 
+use crate::builtin_profile::{
+    BUILTIN_DEFAULT_PROFILE, builtin_profile_catalog_snapshot, builtin_profile_entrypoints,
+    resolve_builtin_profile_artifact,
+};
 use crate::config::{
     CompactionConfigPartial, FeatureConfigPartial, PermissionConfigPartial, SessionConfigPartial,
 };
 use crate::model::{AuthRef, ModelManifest};
-use crate::plugin::PluginConfig;
 use crate::{
-    EngineManifestConfig, McpConfig, McpStdioCwdPolicy, MemoryConfig, Permission, ResolveError,
-    ScopeConfig, ScopeRule, SkillsConfig, WebConfig, WorkerManifest, WorkerManifestConfig,
-    WorkerMetaConfig, paths,
+    EngineManifestConfig, McpConfig, McpStdioCwdPolicy, Permission, ResolveError, ScopeConfig,
+    ScopeRule, SkillsConfig, WebConfig, WorkerManifest, WorkerManifestConfig, WorkerMetaConfig,
+    paths,
 };
 
 const PROFILE_FORMAT_V1: &str = "yoi.profile.v1";
 const BUILTIN_MODEL_CATALOG: &str = include_str!("../../../resources/models/builtin.toml");
 
-struct BuiltinProfile {
-    name: &'static str,
-    label: &'static str,
-    description: &'static str,
-}
-
-const BUILTIN_PROFILES: &[BuiltinProfile] = &[
-    BuiltinProfile {
-        name: "companion",
-        label: "builtin:companion",
-        description: "Bundled Companion role profile",
-    },
-    BuiltinProfile {
-        name: "intake",
-        label: "builtin:intake",
-        description: "Bundled Intake role profile",
-    },
-    BuiltinProfile {
-        name: "orchestrator",
-        label: "builtin:orchestrator",
-        description: "Bundled Orchestrator role profile",
-    },
-    BuiltinProfile {
-        name: "coder",
-        label: "builtin:coder",
-        description: "Bundled Coder role profile",
-    },
-    BuiltinProfile {
-        name: "reviewer",
-        label: "builtin:reviewer",
-        description: "Bundled Reviewer role profile",
-    },
-    BuiltinProfile {
-        name: "memory-consolidation",
-        label: "builtin:memory-consolidation",
-        description: "Bundled Memory staging consolidation profile",
-    },
-];
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ProfileRegistrySource {
@@ -159,6 +124,103 @@ impl ProfileSelector {
     }
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProfileExecutionTarget {
+    Workspace,
+    Standalone,
+}
+
+impl fmt::Display for ProfileExecutionTarget {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Workspace => formatter.write_str("workspace"),
+            Self::Standalone => formatter.write_str("standalone"),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum WorkspaceAuthorityRequirement {
+    Flow,
+    ManageWorkdir,
+    Memory,
+    MergeRequest,
+    Objective,
+    Orchestration,
+    Ticket,
+    Worker,
+}
+
+impl fmt::Display for WorkspaceAuthorityRequirement {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Flow => formatter.write_str("feature.flow"),
+            Self::ManageWorkdir => formatter.write_str("feature.manage_workdir"),
+            Self::Memory => formatter.write_str("feature.memory"),
+            Self::MergeRequest => formatter.write_str("feature.merge_request"),
+            Self::Objective => formatter.write_str("feature.objective"),
+            Self::Orchestration => formatter.write_str("feature.orchestration"),
+            Self::Ticket => formatter.write_str("feature.ticket"),
+            Self::Worker => formatter.write_str("feature.worker"),
+        }
+    }
+}
+
+pub fn validate_profile_execution_target(
+    manifest: &WorkerManifest,
+    target: ProfileExecutionTarget,
+) -> Result<(), ProfileError> {
+    if target == ProfileExecutionTarget::Workspace {
+        return Ok(());
+    }
+
+    let feature = &manifest.feature;
+    let mut requirements = BTreeSet::new();
+    if feature.flow.enabled {
+        requirements.insert(WorkspaceAuthorityRequirement::Flow);
+    }
+    if feature.manage_workdir.enabled {
+        requirements.insert(WorkspaceAuthorityRequirement::ManageWorkdir);
+    }
+    if feature.memory.profile.enabled || feature.memory.profile.staging_tools {
+        requirements.insert(WorkspaceAuthorityRequirement::Memory);
+    }
+    if feature.merge_request.show
+        || feature.merge_request.open
+        || feature.merge_request.review
+        || feature.merge_request.readiness_check
+        || feature.merge_request.complete
+    {
+        requirements.insert(WorkspaceAuthorityRequirement::MergeRequest);
+    }
+    if feature.objective.enabled {
+        requirements.insert(WorkspaceAuthorityRequirement::Objective);
+    }
+    if feature.orchestration.enabled {
+        requirements.insert(WorkspaceAuthorityRequirement::Orchestration);
+    }
+    if feature.ticket.enabled
+        || feature.ticket.authoring
+        || feature.ticket.thread
+        || feature.ticket.intake
+        || feature.ticket.workflow
+    {
+        requirements.insert(WorkspaceAuthorityRequirement::Ticket);
+    }
+    if feature.worker.enabled {
+        requirements.insert(WorkspaceAuthorityRequirement::Worker);
+    }
+
+    if requirements.is_empty() {
+        Ok(())
+    } else {
+        Err(ProfileError::UnsupportedExecutionTarget {
+            target,
+            requirements: requirements.into_iter().collect(),
+        })
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum ProfileSource {
@@ -217,13 +279,14 @@ impl ProfileRegistryEntry {
         source: ProfileRegistrySource,
         name: &'static str,
         label: &'static str,
+        provenance: String,
         description: Option<String>,
     ) -> Self {
         Self {
             source,
             name: name.to_string(),
             path: None,
-            provenance: label.to_string(),
+            provenance,
             description,
             is_default: false,
             artifact: ProfileRegistryArtifact::Builtin { label },
@@ -321,12 +384,16 @@ pub struct ProfileDiscovery {
 }
 
 impl ProfileDiscovery {
-    pub fn for_cwd(_cwd: &Path) -> Self {
+    pub fn user_settings() -> Self {
         Self {
             user_config: paths::user_profiles_path(),
             project_config: None,
         }
     }
+
+    pub fn for_cwd(_cwd: &Path) -> Self {
+        Self::user_settings()
+    }
     pub fn with_sources(user_config: Option<PathBuf>, project_config: Option<PathBuf>) -> Self {
         Self {
             user_config,
@@ -412,15 +479,22 @@ impl ProfileResolver {
                 options,
             ),
             ProfileSelector::Named { .. } | ProfileSelector::Default => {
-                let cwd = std::env::current_dir().map_err(|source| ProfileError::CommandIo {
-                    path: PathBuf::from("."),
-                    source,
-                })?;
-                let registry = ProfileDiscovery::for_cwd(&cwd).discover()?;
+                let registry = ProfileDiscovery::user_settings().discover()?;
                 self.resolve_from_registry(selector, &registry, options)
             }
         }
     }
+
+    pub fn resolve_for_target(
+        &self,
+        selector: &ProfileSelector,
+        options: ProfileResolveOptions,
+        target: ProfileExecutionTarget,
+    ) -> Result<ResolvedProfile, ProfileError> {
+        let resolved = self.resolve(selector, options)?;
+        validate_profile_execution_target(&resolved.manifest, target)?;
+        Ok(resolved)
+    }
     /// Resolve a registry/default selector against an already-discovered
     /// registry. Callers such as SubWorkerSpawn use this to bind discovery to the
     /// Worker's cwd instead of the process current directory.
@@ -503,7 +577,7 @@ impl ProfileResolver {
                 .as_deref()
                 .unwrap_or_else(|| Path::new(".")),
         )?;
-        let raw_artifact = builtin_profile_artifact(label).ok_or_else(|| {
+        let raw_artifact = resolve_builtin_profile_artifact(label)?.ok_or_else(|| {
             ProfileError::InvalidProfile(format!("unknown builtin profile artifact `{label}`"))
         })?;
         resolve_profile_value(
@@ -558,14 +632,13 @@ fn resolve_profile_value(
         session: profile.session,
         permissions: profile.permissions,
         feature: profile.feature,
-        plugins: profile.plugins,
         mcp: profile.mcp,
         compaction,
         web: profile.web,
-        memory: profile.memory.map(Into::into),
         skills: profile.skills,
     };
-    let config = WorkerManifestConfig::builtin_defaults().merge(config.resolve_paths(profile_dir));
+    let config =
+        WorkerManifestConfig::resolution_defaults().merge(config.resolve_paths(profile_dir));
     let mut manifest = WorkerManifest::try_from(config).map_err(ProfileError::ManifestResolve)?;
     manifest.profile = Some(ProfileManifestSnapshot {
         source: source.clone(),
@@ -582,51 +655,6 @@ fn resolve_profile_value(
     })
 }
 
-#[derive(Debug, Default, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct ProfileMemoryConfig {
-    #[serde(default)]
-    workspace_root: Option<PathBuf>,
-    #[serde(default)]
-    query_result_limit: Option<usize>,
-    #[serde(default)]
-    query_excerpt_lines: Option<usize>,
-    #[serde(default)]
-    inject_summary: Option<bool>,
-    #[serde(default)]
-    extract_model: Option<ModelManifest>,
-    #[serde(default)]
-    extract_threshold: Option<u64>,
-    #[serde(default)]
-    extract_worker_max_turns: Option<u32>,
-    #[serde(default)]
-    consolidation_model: Option<ModelManifest>,
-    #[serde(default)]
-    consolidation_threshold_files: Option<usize>,
-    #[serde(default)]
-    consolidation_threshold_bytes: Option<u64>,
-}
-
-impl From<ProfileMemoryConfig> for MemoryConfig {
-    fn from(profile: ProfileMemoryConfig) -> Self {
-        Self {
-            workspace_root: profile.workspace_root,
-            query_result_limit: profile.query_result_limit,
-            query_excerpt_lines: profile.query_excerpt_lines,
-            inject_summary: profile.inject_summary,
-            workspace_id: None,
-            settings_revision: None,
-            language: None,
-            extract_model: profile.extract_model,
-            extract_threshold: profile.extract_threshold,
-            extract_worker_max_turns: profile.extract_worker_max_turns,
-            consolidation_model: profile.consolidation_model,
-            consolidation_threshold_files: profile.consolidation_threshold_files,
-            consolidation_threshold_bytes: profile.consolidation_threshold_bytes,
-        }
-    }
-}
-
 #[derive(Debug, Default, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct ProfileConfig {
@@ -649,16 +677,12 @@ struct ProfileConfig {
     #[serde(default)]
     feature: FeatureConfigPartial,
     #[serde(default)]
-    plugins: PluginConfig,
-    #[serde(default)]
     mcp: McpConfig,
     #[serde(default)]
     compaction: Option<serde_json::Value>,
     #[serde(default)]
     web: Option<WebConfig>,
     #[serde(default)]
-    memory: Option<ProfileMemoryConfig>,
-    #[serde(default)]
     skills: Option<SkillsConfig>,
 }
 
@@ -759,14 +783,30 @@ fn load_profile_registry_file(
 }
 
 fn add_builtin_profiles(registry: &mut ProfileRegistry) {
-    for profile in BUILTIN_PROFILES {
+    let catalog = builtin_profile_catalog_snapshot();
+    let digest = catalog.digest();
+    for profile in builtin_profile_entrypoints() {
+        let label = profile
+            .selector
+            .expect("built-in Profile entrypoint must have a selector");
+        let name = label
+            .strip_prefix("builtin:")
+            .expect("built-in Profile selector must be source-qualified");
         registry.push_entry(ProfileRegistryEntry::embedded(
             ProfileRegistrySource::Builtin,
-            profile.name,
-            profile.label,
+            name,
+            label,
+            format!("{}#{digest}", profile.path),
             Some(profile.description.into()),
         ));
     }
+    registry.set_default(ProfileDefault {
+        source: Some(ProfileRegistrySource::Builtin),
+        name: BUILTIN_DEFAULT_PROFILE
+            .strip_prefix("builtin:")
+            .expect("built-in default selector must be source-qualified")
+            .to_owned(),
+    });
 }
 
 fn parse_profile_ref(raw: &str) -> (Option<ProfileRegistrySource>, String) {
@@ -804,201 +844,6 @@ fn read_profile_artifact_file(path: &Path) -> Result<serde_json::Value, ProfileE
     }
 }
 
-fn builtin_profile_artifact(label: &str) -> Option<serde_json::Value> {
-    let mut value = builtin_base_profile_artifact();
-    match label {
-        "builtin:companion" | "companion" => {
-            apply_role_profile(
-                &mut value,
-                "companion",
-                "Workspace companion profile.",
-                "workspace_write",
-                true,
-                true,
-                true,
-                true,
-            );
-            Some(value)
-        }
-        "builtin:intake" | "intake" => {
-            apply_role_profile(
-                &mut value,
-                "intake",
-                "Ticket intake profile.",
-                "workspace_write",
-                true,
-                true,
-                true,
-                false,
-            );
-            Some(value)
-        }
-        "builtin:orchestrator" | "orchestrator" => {
-            apply_role_profile(
-                &mut value,
-                "orchestrator",
-                "Ticket orchestrator profile.",
-                "workspace_write",
-                true,
-                true,
-                true,
-                false,
-            );
-            Some(value)
-        }
-        "builtin:coder" | "coder" => {
-            apply_role_profile(
-                &mut value,
-                "coder",
-                "Ticket implementation coder profile.",
-                "workspace_write",
-                true,
-                true,
-                true,
-                true,
-            );
-            Some(value)
-        }
-        "builtin:reviewer" | "reviewer" => {
-            apply_role_profile(
-                &mut value,
-                "reviewer",
-                "Ticket review profile.",
-                "workspace_read",
-                true,
-                true,
-                true,
-                false,
-            );
-            Some(value)
-        }
-        "builtin:memory-consolidation" | "memory-consolidation" => {
-            value["slug"] = serde_json::Value::String("memory-consolidation".to_string());
-            value["description"] =
-                serde_json::Value::String("Memory staging consolidation profile.".to_string());
-            value["feature"]["task"] = serde_json::json!({ "enabled": false });
-            value["feature"]["memory"] = serde_json::json!({ "enabled": true, "staging": true });
-            value["feature"]["web"] = serde_json::json!({ "enabled": false });
-            value["feature"]["sub_worker"] = serde_json::json!({ "enabled": false });
-            value["feature"]["objective"] = serde_json::json!({ "enabled": false });
-            value["feature"]["ticket"] = serde_json::json!({ "enabled": false, "thread": false });
-            Some(value)
-        }
-        _ => None,
-    }
-}
-
-fn builtin_base_profile_artifact() -> serde_json::Value {
-    serde_json::json!({
-        "slug": "default",
-        "description": "Default Yoi coding profile.",
-        "model": { "ref": "codex-oauth/gpt-5.5" },
-        "session": { "record_event_trace": true },
-        "engine": { "reasoning": "high" },
-        "compaction": {
-            "kind": "tokens",
-            "threshold": 240000,
-            "request_threshold": 270000,
-            "worker_context_max_tokens": 100000
-        },
-        "feature": {
-            "task": { "enabled": true },
-            "memory": { "enabled": true },
-            "web": { "enabled": true },
-            "image": { "enabled": true },
-            "sub_worker": { "enabled": true },
-            "worker": { "enabled": false },
-            "objective": { "enabled": true },
-            "ticket": { "enabled": true, "authoring": true, "thread": true }
-        },
-        "memory": {
-            "extract_threshold": 50000,
-            "consolidation_threshold_files": 5,
-            "consolidation_threshold_bytes": 50000
-        },
-        "web": {
-            "enabled": true,
-            "search": {
-                "provider": "brave",
-                "api_key_secret": "web/brave/default"
-            }
-        }
-    })
-}
-
-#[allow(clippy::too_many_arguments)]
-fn apply_role_profile(
-    value: &mut serde_json::Value,
-    slug: &str,
-    description: &str,
-    _scope: &str,
-    task: bool,
-    memory: bool,
-    web: bool,
-    sub_worker: bool,
-) {
-    value["slug"] = serde_json::Value::String(slug.to_string());
-    value["description"] = serde_json::Value::String(description.to_string());
-    value["feature"]["task"] = serde_json::json!({ "enabled": task });
-    value["feature"]["memory"] = serde_json::json!({ "enabled": memory });
-    value["feature"]["web"] = serde_json::json!({ "enabled": web });
-    value["feature"]["image"] = serde_json::json!({ "enabled": true });
-    value["feature"]["sub_worker"] = serde_json::json!({ "enabled": sub_worker });
-    value["feature"]["flow"] = serde_json::json!({ "enabled": slug == "coder" });
-    value["feature"]["worker"] = serde_json::json!({
-        "enabled": matches!(slug, "companion" | "orchestrator"),
-        "direct_spawn": slug != "orchestrator"
-    });
-    value["feature"]["manage_workdir"] = serde_json::json!({
-        "enabled": matches!(slug, "companion" | "orchestrator")
-    });
-    value["feature"]["orchestration"] = serde_json::json!({ "enabled": slug == "orchestrator" });
-    let ticket = match slug {
-        "companion" => serde_json::json!({ "enabled": true, "authoring": true, "thread": true }),
-        "intake" => {
-            serde_json::json!({ "enabled": true, "authoring": true, "thread": true, "intake": true })
-        }
-        "orchestrator" => {
-            serde_json::json!({ "enabled": true, "thread": true, "workflow": true })
-        }
-        "coder" => serde_json::json!({ "enabled": true, "thread": true }),
-        "reviewer" => serde_json::json!({ "enabled": true, "thread": true }),
-        _ => serde_json::json!({ "enabled": true, "authoring": true, "thread": true }),
-    };
-    value["feature"]["ticket"] = ticket;
-    let merge_request = match slug {
-        "coder" => serde_json::json!({
-            "show": true,
-            "open": true,
-            "review": false,
-            "readiness_check": false,
-            "complete": false
-        }),
-        "reviewer" => serde_json::json!({
-            "show": true,
-            "open": false,
-            "review": true,
-            "readiness_check": false,
-            "complete": false
-        }),
-        "orchestrator" => serde_json::json!({
-            "show": true,
-            "open": false,
-            "review": false,
-            "readiness_check": true,
-            "complete": true
-        }),
-        _ => serde_json::json!({
-            "show": false,
-            "open": false,
-            "review": false,
-            "readiness_check": false,
-            "complete": false
-        }),
-    };
-    value["feature"]["merge_request"] = merge_request;
-}
-
 fn reject_manifest_shaped_profile(value: &serde_json::Value) -> Result<(), ProfileError> {
     let Some(map) = value.as_object() else {
         return Err(ProfileError::InvalidProfile(
@@ -1038,12 +883,6 @@ fn validate_profile_paths(profile: &ProfileConfig) -> Result<(), ProfileError> {
             .map_err(|source| ProfileError::ProfileDeserialize { source })?;
         reject_absolute_auth_file(&model.auth, "compaction.model.auth.file")?;
     }
-    if let Some(memory) = &profile.memory
-        && let Some(root) = &memory.workspace_root
-        && root.is_absolute()
-    {
-        return Err(ProfileError::InvalidProfile("field `memory.workspace_root` is a resolved path and is not allowed in reusable Profiles".into()));
-    }
     if let Some(skills) = &profile.skills {
         for dir in &skills.directories {
             if dir.is_absolute() {
@@ -1122,6 +961,7 @@ fn profile_scope_intent_to_config(
             target: workspace_base.join(path),
             permission: Permission::Write,
             recursive: true,
+            symlink_policy: Default::default(),
         });
     }
     Ok(ScopeConfig {
@@ -1129,6 +969,7 @@ fn profile_scope_intent_to_config(
             target: workspace_base.to_path_buf(),
             permission,
             recursive: true,
+            symlink_policy: Default::default(),
         }],
         deny,
     })
@@ -1288,6 +1129,13 @@ pub enum ProfileError {
         #[source]
         source: toml::de::Error,
     },
+    #[error("failed to evaluate built-in Profile `{selector}`: {message}")]
+    BuiltinProfileEvaluation { selector: String, message: String },
+    #[error("Profile requires unsupported {target} launch authorities: {requirements:?}")]
+    UnsupportedExecutionTarget {
+        target: ProfileExecutionTarget,
+        requirements: Vec<WorkspaceAuthorityRequirement>,
+    },
     #[error("no default profile is configured")]
     NoDefaultProfile,
     #[error("profile resolution requires an explicit runtime Worker name")]
@@ -1341,18 +1189,21 @@ mod tests {
         );
     }
     #[test]
-    fn builtin_profiles_do_not_define_an_implicit_default() {
+    fn builtin_default_is_explicit_registry_authority() {
         let registry = ProfileDiscovery::with_sources(None, None)
             .discover()
             .unwrap();
-        assert!(matches!(
-            registry.default_entry(),
-            Err(ProfileError::NoDefaultProfile)
-        ));
-        assert!(matches!(
-            registry.select(&ProfileSelector::Default),
-            Err(ProfileError::NoDefaultProfile)
-        ));
+        let default = registry.default_entry().unwrap();
+        assert_eq!(default.source, ProfileRegistrySource::Builtin);
+        assert_eq!(default.name, "default");
+        assert_eq!(default.qualified_name(), BUILTIN_DEFAULT_PROFILE);
+        assert!(default.is_default);
+        assert!(
+            default
+                .provenance
+                .starts_with("profiles/default.dcdl#sha256:")
+        );
+        assert_eq!(registry.select(&ProfileSelector::Default).unwrap(), default);
     }
     #[test]
     fn builtin_role_profiles_are_registered_and_resolve() {
@@ -1387,7 +1238,9 @@ mod tests {
             ("settings_revision", serde_json::json!(2)),
             ("language", serde_json::json!("Japanese")),
         ] {
-            let artifact = serde_json::json!({ "memory": { (field): value } });
+            let artifact = serde_json::json!({
+                "feature": { "memory": { (field): value } }
+            });
             let error = resolve_profile_artifact_value(
                 artifact,
                 ProfileSource::Registry {
@@ -1408,7 +1261,151 @@ mod tests {
     }
 
     #[test]
-    fn builtin_companion_can_manage_workdirs() {
+    fn ambient_plugin_directories_do_not_affect_builtin_profile_resolution() {
+        let tmp = TempDir::new().unwrap();
+        let workspace = tmp.path().join("workspace/nested");
+        std::fs::create_dir_all(&workspace).unwrap();
+        for root in [tmp.path(), tmp.path().join("workspace").as_path()] {
+            let package = root.join(".yoi/plugins/broken.yoi-plugin");
+            std::fs::create_dir_all(package.parent().unwrap()).unwrap();
+            std::fs::write(package, b"malformed ambient package").unwrap();
+        }
+
+        let resolved = ProfileResolver::new()
+            .with_workspace_base(&workspace)
+            .resolve_for_target(
+                &ProfileSelector::source_named(ProfileRegistrySource::Builtin, "default"),
+                ProfileResolveOptions::with_worker_name("standalone-worker"),
+                ProfileExecutionTarget::Standalone,
+            )
+            .unwrap();
+
+        assert_eq!(resolved.manifest.worker.name, "standalone-worker");
+    }
+
+    #[test]
+    fn profile_rejects_dynamic_plugin_configuration() {
+        let tmp = TempDir::new().unwrap();
+        for body in [
+            "[feature.plugins]\nenabled = true\n",
+            "[[plugins.enabled]]\nid = \"explicit:example\"\n",
+        ] {
+            let profile = write_profile(tmp.path(), "plugin.toml", body);
+            let error = ProfileResolver::new()
+                .with_workspace_base(tmp.path())
+                .resolve(
+                    &ProfileSelector::path(profile),
+                    ProfileResolveOptions::with_worker_name("runtime-worker"),
+                )
+                .unwrap_err();
+            assert!(
+                error.to_string().contains("unknown field"),
+                "unexpected error: {error}"
+            );
+        }
+    }
+
+    #[test]
+    fn builtin_default_resolves_as_a_standalone_local_capability_profile() {
+        let tmp = TempDir::new().unwrap();
+        let resolved = ProfileResolver::new()
+            .with_workspace_base(tmp.path())
+            .resolve_for_target(
+                &ProfileSelector::source_named(ProfileRegistrySource::Builtin, "default"),
+                ProfileResolveOptions::with_worker_name("standalone-worker"),
+                ProfileExecutionTarget::Standalone,
+            )
+            .unwrap();
+
+        assert!(matches!(
+            &resolved.source,
+            ProfileSource::Registry {
+                source: ProfileRegistrySource::Builtin,
+                name,
+                path: None,
+                provenance: Some(provenance),
+                ..
+            } if name == "default" && provenance.starts_with("profiles/default.dcdl#sha256:")
+        ));
+        assert!(resolved.manifest.feature.task.enabled);
+        assert!(resolved.manifest.feature.web.enabled);
+        assert!(resolved.manifest.feature.image.enabled);
+        assert!(resolved.manifest.feature.sub_worker.enabled);
+        assert!(resolved.manifest.scope.allow.iter().any(|rule| {
+            rule.permission == protocol::Permission::Write && rule.target == tmp.path()
+        }));
+        assert!(resolved.manifest.delegation_scope.allow.iter().any(|rule| {
+            rule.permission == protocol::Permission::Write && rule.target == tmp.path()
+        }));
+        assert!(!resolved.manifest.feature.memory.profile.enabled);
+        assert!(!resolved.manifest.feature.ticket.enabled);
+        assert!(!resolved.manifest.feature.objective.enabled);
+        assert!(!resolved.manifest.feature.flow.enabled);
+        assert!(!resolved.manifest.feature.worker.enabled);
+        assert!(!resolved.manifest.feature.manage_workdir.enabled);
+    }
+
+    #[test]
+    fn standalone_rejects_profiles_that_require_workspace_authority() {
+        let tmp = TempDir::new().unwrap();
+        let error = ProfileResolver::new()
+            .with_workspace_base(tmp.path())
+            .resolve_for_target(
+                &ProfileSelector::source_named(ProfileRegistrySource::Builtin, "coder"),
+                ProfileResolveOptions::with_worker_name("standalone-worker"),
+                ProfileExecutionTarget::Standalone,
+            )
+            .unwrap_err();
+        let diagnostic = error.to_string();
+
+        let ProfileError::UnsupportedExecutionTarget {
+            target,
+            requirements,
+        } = error
+        else {
+            panic!("unexpected error: {error}");
+        };
+        assert_eq!(target, ProfileExecutionTarget::Standalone);
+        assert!(requirements.contains(&WorkspaceAuthorityRequirement::Memory));
+        assert!(requirements.contains(&WorkspaceAuthorityRequirement::MergeRequest));
+        assert!(requirements.contains(&WorkspaceAuthorityRequirement::Ticket));
+        assert!(!diagnostic.contains(tmp.path().to_string_lossy().as_ref()));
+    }
+
+    #[test]
+    fn repository_markers_do_not_change_builtin_profile_authority() {
+        let tmp = TempDir::new().unwrap();
+        let nested = tmp.path().join("repository/nested");
+        std::fs::create_dir_all(&nested).unwrap();
+        std::fs::create_dir_all(tmp.path().join("repository/.yoi")).unwrap();
+        std::fs::write(
+            tmp.path().join("repository/.yoi/profiles.toml"),
+            "default = { source = 'project', name = 'shadow' }\n",
+        )
+        .unwrap();
+
+        let discovery = ProfileDiscovery::for_cwd(&nested);
+        assert_eq!(discovery.user_config, paths::user_profiles_path());
+        assert!(discovery.project_config.is_none());
+    }
+
+    #[test]
+    fn builtin_coder_uses_sub_worker_control_without_worker_control() {
+        let tmp = TempDir::new().unwrap();
+        let resolved = ProfileResolver::new()
+            .with_workspace_base(tmp.path())
+            .resolve(
+                &ProfileSelector::source_named(ProfileRegistrySource::Builtin, "coder"),
+                ProfileResolveOptions::with_worker_name("coder-worker"),
+            )
+            .unwrap();
+
+        assert!(resolved.manifest.feature.sub_worker.enabled);
+        assert!(!resolved.manifest.feature.worker.enabled);
+    }
+
+    #[test]
+    fn builtin_companion_combines_runtime_and_sub_worker_control_with_discovery() {
         let tmp = TempDir::new().unwrap();
         let resolved = ProfileResolver::new()
             .with_workspace_base(tmp.path())
@@ -1419,6 +1416,32 @@ mod tests {
             .unwrap();
 
         assert!(resolved.manifest.feature.manage_workdir.enabled);
+        assert!(resolved.manifest.feature.sub_worker.enabled);
+        assert!(resolved.manifest.feature.worker.enabled);
+        assert!(!resolved.manifest.feature.worker.direct_spawn);
+        assert!(resolved.manifest.feature.workspace_worker_discovery.enabled);
+    }
+
+    #[test]
+    fn builtin_orchestrator_keeps_cleanup_tool_providers_enabled() {
+        let tmp = TempDir::new().unwrap();
+        let resolved = ProfileResolver::new()
+            .with_workspace_base(tmp.path())
+            .resolve(
+                &ProfileSelector::source_named(ProfileRegistrySource::Builtin, "orchestrator"),
+                ProfileResolveOptions::with_worker_name("orchestrator-worker"),
+            )
+            .unwrap();
+        let feature = resolved.manifest.feature;
+
+        assert!(feature.worker.enabled);
+        assert!(!feature.worker.direct_spawn);
+        assert!(feature.manage_workdir.enabled);
+        assert!(feature.merge_request.show);
+        assert!(feature.merge_request.readiness_check);
+        assert!(feature.merge_request.complete);
+        assert!(!feature.merge_request.open);
+        assert!(!feature.merge_request.review);
     }
 
     #[test]
@@ -1591,7 +1614,7 @@ enabled = false
             .unwrap();
         assert_eq!(resolved.manifest.worker.name, "runtime-worker");
         assert!(resolved.manifest.feature.task.enabled);
-        assert!(!resolved.manifest.feature.memory.enabled);
+        assert!(!resolved.manifest.feature.memory.profile.enabled);
         assert!(resolved.manifest.feature.web.enabled);
         assert!(resolved.manifest.feature.sub_worker.enabled);
         assert!(resolved.manifest.feature.ticket.enabled);

crates/manifest/src/scope.rs

@@ -3,16 +3,17 @@
 //! Built from [`crate::ScopeConfig`] via [`Scope::from_config`]. Every
 //! rule `target` must already be an absolute path — per-layer path
 //! resolution runs earlier, inside [`crate::WorkerManifestConfig::resolve_paths`].
-//! All rule `target` paths inside the [`Scope`] are canonicalised (where
-//! possible) so access checks are pure path comparisons.
+//! All rule targets retain both their lexically normalized logical identity and
+//! their provider-resolved identity. Allow rules select one identity explicitly;
+//! deny rules always inspect both so aliases cannot bypass a restriction.
 
 use std::ffi::OsString;
-use std::path::{Path, PathBuf};
+use std::path::{Component, Path, PathBuf};
 use std::sync::{Arc, Mutex};
 
 use arc_swap::{ArcSwap, Guard};
 
-use crate::{Permission, ScopeConfig, ScopeRule};
+use crate::{Permission, ScopeConfig, ScopeRule, SymlinkPolicy};
 
 /// Parsed, pwd-resolved set of allow/deny rules for a Worker.
 ///
@@ -26,10 +27,13 @@ pub struct Scope {
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct ResolvedRule {
-    /// Absolute, canonicalized-or-normalized target directory/file.
-    target: PathBuf,
+    /// Absolute, lexically normalized target as presented through the Workdir.
+    logical_target: PathBuf,
+    /// Absolute target after provider-side symbolic-link resolution.
+    resolved_target: PathBuf,
     permission: Permission,
     recursive: bool,
+    symlink_policy: SymlinkPolicy,
 }
 
 /// Parsed filesystem authority this Worker may pass to spawned children.
@@ -98,18 +102,46 @@ fn permission_denies_requested(denied: Permission, requested: Permission) -> boo
 
 fn rule_covers(available: &ResolvedRule, requested: &ResolvedRule) -> bool {
     permission_covers(available.permission, requested.permission)
-        && rule_path_set_contains(available, requested)
+        && available.symlink_policy >= requested.symlink_policy
+        && rule_path_set_contains(
+            available,
+            requested,
+            match available.symlink_policy {
+                SymlinkPolicy::Resolved => RuleIdentity::Resolved,
+                SymlinkPolicy::Logical => RuleIdentity::Logical,
+            },
+        )
 }
 
 fn denial_overlaps_requested(deny: &ResolvedRule, requested: &ResolvedRule) -> bool {
     permission_denies_requested(deny.permission, requested.permission)
-        && rule_path_sets_overlap(deny, requested)
+        && (rule_path_sets_overlap(deny, requested, RuleIdentity::Logical)
+            || rule_path_sets_overlap(deny, requested, RuleIdentity::Resolved))
 }
 
-fn rule_path_set_contains(available: &ResolvedRule, requested: &ResolvedRule) -> bool {
+#[derive(Clone, Copy)]
+enum RuleIdentity {
+    Logical,
+    Resolved,
+}
+
+fn rule_target(rule: &ResolvedRule, identity: RuleIdentity) -> &Path {
+    match identity {
+        RuleIdentity::Logical => &rule.logical_target,
+        RuleIdentity::Resolved => &rule.resolved_target,
+    }
+}
+
+fn rule_path_set_contains(
+    available: &ResolvedRule,
+    requested: &ResolvedRule,
+    identity: RuleIdentity,
+) -> bool {
+    let available_target = rule_target(available, identity);
+    let requested_target = rule_target(requested, identity);
     match (available.recursive, requested.recursive) {
         // A recursive grant contains every possible requested path below its target.
-        (true, _) => requested.target.starts_with(&available.target),
+        (true, _) => requested_target.starts_with(available_target),
         // A non-recursive grant contains only the target and its direct children;
         // a recursive request always includes descendants beyond that finite-depth
         // set.
@@ -117,36 +149,42 @@ fn rule_path_set_contains(available: &ResolvedRule, requested: &ResolvedRule) ->
         // Two non-recursive rules have the same finite-depth set only when their
         // target is identical. A request rooted at a direct child would also grant
         // that child's children, which are grandchildren of `available.target`.
-        (false, false) => requested.target == available.target,
+        (false, false) => requested_target == available_target,
     }
 }
 
-fn rule_path_sets_overlap(left: &ResolvedRule, right: &ResolvedRule) -> bool {
+fn rule_path_sets_overlap(
+    left: &ResolvedRule,
+    right: &ResolvedRule,
+    identity: RuleIdentity,
+) -> bool {
+    let left_target = rule_target(left, identity);
+    let right_target = rule_target(right, identity);
     match (left.recursive, right.recursive) {
         (true, true) => {
-            left.target.starts_with(&right.target) || right.target.starts_with(&left.target)
+            left_target.starts_with(right_target) || right_target.starts_with(left_target)
         }
-        (true, false) => recursive_and_non_recursive_sets_overlap(left, right),
-        (false, true) => recursive_and_non_recursive_sets_overlap(right, left),
+        (true, false) => recursive_and_non_recursive_sets_overlap(left_target, right_target),
+        (false, true) => recursive_and_non_recursive_sets_overlap(right_target, left_target),
         (false, false) => {
-            left.target == right.target
-                || direct_child(&left.target, &right.target)
-                || direct_child(&right.target, &left.target)
+            left_target == right_target
+                || direct_child(left_target, right_target)
+                || direct_child(right_target, left_target)
         }
     }
 }
 
 fn recursive_and_non_recursive_sets_overlap(
-    recursive: &ResolvedRule,
-    non_recursive: &ResolvedRule,
+    recursive_target: &Path,
+    non_recursive_target: &Path,
 ) -> bool {
     // The non-recursive set is `{target} + direct children`. It overlaps a
     // recursive subtree when either the non-recursive target is inside that
     // subtree, or the recursive subtree begins at the non-recursive target or
     // one of its direct children.
-    non_recursive.target.starts_with(&recursive.target)
-        || recursive.target == non_recursive.target
-        || direct_child(&recursive.target, &non_recursive.target)
+    non_recursive_target.starts_with(recursive_target)
+        || recursive_target == non_recursive_target
+        || direct_child(recursive_target, non_recursive_target)
 }
 
 fn direct_child(child: &Path, parent: &Path) -> bool {
@@ -201,23 +239,35 @@ impl Scope {
     }
 
     /// Convenience constructor for tests and simple setups: a single
-    /// recursive `allow(Write)` rule rooted at `root`.
+    /// recursive `allow(Write)` rule rooted at `root` with the default
+    /// resolved-target symlink policy.
     pub fn writable(root: impl AsRef<Path>) -> std::io::Result<Self> {
-        let root = root.as_ref().canonicalize()?;
+        let root = normalize_path(root.as_ref()).ok_or_else(|| {
+            std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "scope root must be an absolute path without root traversal",
+            )
+        })?;
+        let resolved_root = resolve_path(&root)?;
         Ok(Self {
             allow: vec![ResolvedRule {
-                target: root,
+                logical_target: root,
+                resolved_target: resolved_root,
                 permission: Permission::Write,
                 recursive: true,
+                symlink_policy: SymlinkPolicy::Resolved,
             }],
             deny: Vec::new(),
         })
     }
 
-    /// Resolve one rule target with the same symlink and missing-tail semantics
-    /// used by scope matching.
+    /// Return one rule target in the identity selected by its symlink policy.
     pub fn resolved_target(rule: &ScopeRule) -> Result<PathBuf, ScopeError> {
-        Ok(resolve_rule(rule)?.target)
+        let rule = resolve_rule(rule)?;
+        Ok(match rule.symlink_policy {
+            SymlinkPolicy::Resolved => rule.resolved_target,
+            SymlinkPolicy::Logical => rule.logical_target,
+        })
     }
 
     /// Return whether this effective scope fully contains a requested rule.
@@ -244,10 +294,23 @@ impl Scope {
     /// Returns `None` when `path` is outside every allow rule, or when
     /// deny rules have knocked it below `Read`.
     pub fn permission_at(&self, path: &Path) -> Option<Permission> {
-        let resolved = resolve_path(path)?;
+        let logical = normalize_path(path)?;
+        let resolved = resolve_path(&logical).ok()?;
+        self.permission_at_paths(&logical, &resolved)
+    }
+
+    /// Effective permission for a path whose logical and provider-resolved
+    /// identities were obtained inside the filesystem provider boundary.
+    pub fn permission_at_paths(&self, logical: &Path, resolved: &Path) -> Option<Permission> {
+        let logical = normalize_path(logical)?;
+        let resolved = normalize_path(resolved)?;
         let mut effective: Option<Permission> = None;
         for rule in &self.allow {
-            if rule.matches(&resolved) {
+            let candidate = match rule.symlink_policy {
+                SymlinkPolicy::Resolved => &resolved,
+                SymlinkPolicy::Logical => &logical,
+            };
+            if rule.matches(candidate, rule.symlink_policy) {
                 effective = match effective {
                     None => Some(rule.permission),
                     Some(cur) => Some(cur.max(rule.permission)),
@@ -256,11 +319,13 @@ impl Scope {
         }
         let mut effective = effective?;
 
-        // Deny: min(min_deny) dictates the cap. Effective level is capped
-        // strictly below that value, so deny(read) wipes access entirely.
+        // Deny rules always inspect both identities. This prevents a logical
+        // alias or a second symlink to the same target from bypassing a deny.
         let mut min_deny: Option<Permission> = None;
         for rule in &self.deny {
-            if rule.matches(&resolved) {
+            if rule.matches(&logical, SymlinkPolicy::Logical)
+                || rule.matches(&resolved, SymlinkPolicy::Resolved)
+            {
                 min_deny = match min_deny {
                     None => Some(rule.permission),
                     Some(cur) => Some(cur.min(rule.permission)),
@@ -293,7 +358,7 @@ impl Scope {
     /// rule, preserving declaration order. Does not account for deny
     /// rules, which only cap effective permission at query time.
     pub fn readable_paths(&self) -> impl Iterator<Item = &Path> {
-        self.allow.iter().map(|r| r.target.as_path())
+        self.allow.iter().map(|r| r.logical_target.as_path())
     }
 
     /// Allow rules with their targets resolved to absolute paths.
@@ -305,9 +370,10 @@ impl Scope {
         self.allow
             .iter()
             .map(|r| ScopeRule {
-                target: r.target.clone(),
+                target: r.logical_target.clone(),
                 permission: r.permission,
                 recursive: r.recursive,
+                symlink_policy: r.symlink_policy,
             })
             .collect()
     }
@@ -322,9 +388,10 @@ impl Scope {
         self.deny
             .iter()
             .map(|r| ScopeRule {
-                target: r.target.clone(),
+                target: r.logical_target.clone(),
                 permission: r.permission,
                 recursive: r.recursive,
+                symlink_policy: r.symlink_policy,
             })
             .collect()
     }
@@ -335,7 +402,7 @@ impl Scope {
         self.allow
             .iter()
             .filter(|r| r.permission == Permission::Write)
-            .map(|r| r.target.as_path())
+            .map(|r| r.logical_target.as_path())
     }
 
     /// Build a new [`Scope`] equal to `self` with `extra_allow` appended
@@ -412,7 +479,10 @@ impl Scope {
     pub fn summary(&self) -> String {
         fn push_rule(out: &mut String, rule: &ResolvedRule) {
             out.push_str("  - ");
-            out.push_str(&rule.target.display().to_string());
+            out.push_str(&rule.logical_target.display().to_string());
+            if rule.symlink_policy == SymlinkPolicy::Logical {
+                out.push_str(" [logical-symlinks]");
+            }
             if !rule.recursive {
                 out.push_str(" [non-recursive]");
             }
@@ -510,11 +580,15 @@ impl SharedScope {
 }
 
 impl ResolvedRule {
-    fn matches(&self, path: &Path) -> bool {
+    fn matches(&self, path: &Path, identity: SymlinkPolicy) -> bool {
+        let target = match identity {
+            SymlinkPolicy::Resolved => &self.resolved_target,
+            SymlinkPolicy::Logical => &self.logical_target,
+        };
         if self.recursive {
-            path.starts_with(&self.target)
+            path.starts_with(target)
         } else {
-            path == self.target || path.parent() == Some(self.target.as_path())
+            path == target || path.parent() == Some(target.as_path())
         }
     }
 }
@@ -523,48 +597,84 @@ fn resolve_rule(rule: &ScopeRule) -> Result<ResolvedRule, ScopeError> {
     if !rule.target.is_absolute() {
         return Err(ScopeError::RelativeTarget(rule.target.clone()));
     }
-    let target = resolve_path(&rule.target).ok_or_else(|| ScopeError::ResolveTarget {
+    let logical_target = normalize_path(&rule.target).ok_or_else(|| ScopeError::ResolveTarget {
         path: rule.target.clone(),
         source: std::io::Error::new(std::io::ErrorKind::Other, "could not absolutize target"),
     })?;
+    let resolved_target =
+        resolve_path(&logical_target).map_err(|source| ScopeError::ResolveTarget {
+            path: rule.target.clone(),
+            source,
+        })?;
     Ok(ResolvedRule {
-        target,
+        logical_target,
+        resolved_target,
         permission: rule.permission,
         recursive: rule.recursive,
+        symlink_policy: rule.symlink_policy,
     })
 }
 
-/// Convert `path` to an absolute form suitable for prefix comparison.
-///
-/// Tries `canonicalize` on the full path first (resolves symlinks). If
-/// the path doesn't exist yet, climbs to the closest existing ancestor,
-/// canonicalizes it, then rejoins the missing tail. Returns `None` for
-/// relative inputs that have no existing ancestor to anchor against.
-fn resolve_path(path: &Path) -> Option<PathBuf> {
+/// Resolve every existing path component while retaining a missing final tail.
+/// A dangling symlink is rejected rather than treated as an ordinary missing
+/// component because its resolved authority cannot be established.
+fn resolve_path(path: &Path) -> std::io::Result<PathBuf> {
+    let mut cursor = path;
+    let mut missing = Vec::<OsString>::new();
+    loop {
+        match std::fs::canonicalize(cursor) {
+            Ok(mut resolved) => {
+                for component in missing.iter().rev() {
+                    resolved.push(component);
+                }
+                return normalize_path(&resolved).ok_or_else(|| {
+                    std::io::Error::new(
+                        std::io::ErrorKind::InvalidInput,
+                        "resolved target is not an absolute normalized path",
+                    )
+                });
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                if std::fs::symlink_metadata(cursor)
+                    .is_ok_and(|metadata| metadata.file_type().is_symlink())
+                {
+                    return Err(error);
+                }
+                let name = cursor.file_name().ok_or(error)?;
+                missing.push(name.to_os_string());
+                cursor = cursor.parent().ok_or_else(|| {
+                    std::io::Error::new(
+                        std::io::ErrorKind::NotFound,
+                        "scope target has no existing ancestor",
+                    )
+                })?;
+            }
+            Err(error) => return Err(error),
+        }
+    }
+}
+
+/// Normalize an absolute path for lexical scope comparison without consulting
+/// filesystem metadata or resolving symbolic links.
+fn normalize_path(path: &Path) -> Option<PathBuf> {
     if !path.is_absolute() {
         return None;
     }
-    if let Ok(canonical) = path.canonicalize() {
-        return Some(canonical);
-    }
-    let mut tail: Vec<OsString> = Vec::new();
-    let mut cur = path.to_path_buf();
-    loop {
-        if let Ok(canonical) = cur.canonicalize() {
-            let mut out = canonical;
-            for segment in tail.iter().rev() {
-                out.push(segment);
+    let mut normalized = PathBuf::new();
+    for component in path.components() {
+        match component {
+            Component::Prefix(prefix) => normalized.push(prefix.as_os_str()),
+            Component::RootDir => normalized.push(component.as_os_str()),
+            Component::CurDir => {}
+            Component::ParentDir => {
+                if !normalized.pop() {
+                    return None;
+                }
             }
-            return Some(out);
+            Component::Normal(part) => normalized.push(part),
         }
-        let name = cur.file_name()?.to_os_string();
-        tail.push(name);
-        let parent = cur.parent()?.to_path_buf();
-        if parent == cur {
-            return None;
-        }
-        cur = parent;
     }
+    normalized.is_absolute().then_some(normalized)
 }
 
 #[cfg(test)]
@@ -577,6 +687,7 @@ mod tests {
             target: target.to_path_buf(),
             permission,
             recursive,
+            symlink_policy: Default::default(),
         }
     }
 
@@ -691,6 +802,7 @@ mod tests {
                 target: dir.path().to_path_buf(),
                 permission: Permission::Write,
                 recursive: false,
+                symlink_policy: Default::default(),
             }],
             deny: Vec::new(),
         };
@@ -790,6 +902,7 @@ mod tests {
                 target: PathBuf::from("relative/path"),
                 permission: Permission::Read,
                 recursive: true,
+                symlink_policy: Default::default(),
             }],
             deny: Vec::new(),
         };
@@ -805,6 +918,88 @@ mod tests {
         assert!(!scope.is_readable(&traversal));
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn scope_defaults_to_resolved_symlink_authority_and_logical_is_explicit() {
+        use std::os::unix::fs::symlink;
+
+        let dir = TempDir::new().unwrap();
+        let outside = TempDir::new().unwrap();
+        std::fs::write(outside.path().join("outside.txt"), "visible through link").unwrap();
+        symlink(outside.path(), dir.path().join("external")).unwrap();
+
+        let resolved = Scope::writable(dir.path()).unwrap();
+        assert!(!resolved.is_readable(&dir.path().join("external/outside.txt")));
+        assert!(!resolved.is_writable(&dir.path().join("external/new.txt")));
+
+        let logical = Scope::from_config(&ScopeConfig {
+            allow: vec![ScopeRule {
+                target: dir.path().to_path_buf(),
+                permission: Permission::Write,
+                recursive: true,
+                symlink_policy: SymlinkPolicy::Logical,
+            }],
+            deny: Vec::new(),
+        })
+        .unwrap();
+        assert!(logical.is_readable(&dir.path().join("external/outside.txt")));
+        assert!(logical.is_writable(&dir.path().join("external/new.txt")));
+        assert!(!logical.is_readable(&outside.path().join("outside.txt")));
+        assert!(!logical.is_writable(&outside.path().join("new.txt")));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn deny_rules_match_both_logical_alias_and_resolved_target() {
+        use std::os::unix::fs::symlink;
+
+        let root = TempDir::new().unwrap();
+        let secret = root.path().join("secret");
+        std::fs::create_dir(&secret).unwrap();
+        std::fs::write(secret.join("key"), "hidden").unwrap();
+        symlink(&secret, root.path().join("alias")).unwrap();
+        let scope = Scope::from_config(&ScopeConfig {
+            allow: vec![ScopeRule {
+                target: root.path().to_path_buf(),
+                permission: Permission::Write,
+                recursive: true,
+                symlink_policy: SymlinkPolicy::Logical,
+            }],
+            deny: vec![ScopeRule {
+                target: secret,
+                permission: Permission::Read,
+                recursive: true,
+                symlink_policy: SymlinkPolicy::Logical,
+            }],
+        })
+        .unwrap();
+
+        assert!(!scope.is_readable(&root.path().join("alias/key")));
+    }
+
+    #[test]
+    fn delegation_symlink_policy_is_monotonically_attenuated() {
+        let root = TempDir::new().unwrap();
+        let mut parent_rule = allow_rule(root.path(), Permission::Write);
+        parent_rule.symlink_policy = SymlinkPolicy::Logical;
+        let logical_parent = DelegationScope::from_config(&ScopeConfig {
+            allow: vec![parent_rule],
+            deny: Vec::new(),
+        })
+        .unwrap();
+        let resolved_child = allow_rule(&root.path().join("child"), Permission::Read);
+        assert!(logical_parent.allows_rule(&resolved_child).unwrap());
+
+        let resolved_parent = DelegationScope::from_config(&ScopeConfig {
+            allow: vec![allow_rule(root.path(), Permission::Write)],
+            deny: Vec::new(),
+        })
+        .unwrap();
+        let mut logical_child = resolved_child;
+        logical_child.symlink_policy = SymlinkPolicy::Logical;
+        assert!(!resolved_parent.allows_rule(&logical_child).unwrap());
+    }
+
     #[test]
     fn summary_lists_readable_and_writable() {
         let dir = TempDir::new().unwrap();
@@ -851,11 +1046,13 @@ mod tests {
                     target: docs.clone(),
                     permission: Permission::Read,
                     recursive: false,
+                    symlink_policy: Default::default(),
                 },
                 ScopeRule {
                     target: dir.path().to_path_buf(),
                     permission: Permission::Write,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 },
             ],
             deny: Vec::new(),
@@ -914,6 +1111,7 @@ mod tests {
                 target: extra.path().to_path_buf(),
                 permission: Permission::Read,
                 recursive: true,
+                symlink_policy: Default::default(),
             }])
             .unwrap();
         assert!(extended.is_readable(&extra.path().join("x")));
@@ -931,6 +1129,7 @@ mod tests {
                 target: sub.clone(),
                 permission: Permission::Write,
                 recursive: true,
+                symlink_policy: Default::default(),
             }])
             .unwrap();
         let f = sub.join("a.txt");
@@ -950,6 +1149,7 @@ mod tests {
             target: sub.clone(),
             permission: Permission::Write,
             recursive: true,
+            symlink_policy: Default::default(),
         };
         let base = Scope::writable(dir.path())
             .unwrap()
@@ -1003,6 +1203,7 @@ mod tests {
                     target: sub.clone(),
                     permission: Permission::Write,
                     recursive: true,
+                    symlink_policy: Default::default(),
                 }])
             })
             .unwrap();
@@ -1021,6 +1222,7 @@ mod tests {
                 target: extra.path().to_path_buf(),
                 permission: Permission::Read,
                 recursive: true,
+                symlink_policy: Default::default(),
             }])
         })
         .unwrap();

crates/memory/src/backend.rs

@@ -152,13 +152,10 @@ pub enum MemoryStagingAffectedMemoryOperation {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct MemoryConsolidateStagingOperation {
     #[serde(default)]
     pub force: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub threshold_files: Option<usize>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub threshold_bytes: Option<u64>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -450,10 +447,21 @@ mod tests {
     use super::*;
     use crate::extract::{CandidateKind, ExtractedCandidate};
 
+    #[test]
+    fn consolidation_operation_rejects_caller_owned_thresholds() {
+        let error =
+            serde_json::from_value::<MemoryConsolidateStagingOperation>(serde_json::json!({
+                "force": false,
+                "threshold_files": 1,
+            }))
+            .unwrap_err();
+        assert!(error.to_string().contains("threshold_files"));
+    }
+
     #[test]
     fn staging_list_read_close_records_reason_and_deletes_candidate() {
         let temp = tempfile::tempdir().unwrap();
-        let layout = WorkspaceLayout::resolve(&manifest::MemoryConfig::default(), temp.path());
+        let layout = WorkspaceLayout::resolve(temp.path());
         let source = SourceRef {
             segment_id: "segment-1".into(),
             range: [0, 1],

crates/memory/src/consolidate/staging.rs

@@ -21,8 +21,7 @@ pub struct StagingEntry {
     pub id: Uuid,
     pub path: PathBuf,
     pub record: StagingRecord,
-    /// このファイルのバイト長。閾値判定 (`consolidation_threshold_bytes`)
-    /// に使う。
+    /// このファイルのバイト長。Backendのconsolidation閾値判定に使用する。
     pub bytes: u64,
 }
 

crates/memory/src/extract/payload.rs

@@ -9,7 +9,7 @@
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::schema::{EvidenceKind, SourceEvidenceRef, SourceRef};
+use crate::schema::{EvidenceKind, EvidenceOrigin, SourceEvidenceRef, SourceRef};
 
 /// Current flat staging schema version.
 pub const STAGING_SCHEMA_VERSION: u32 = 2;
@@ -74,12 +74,15 @@ impl ExtractedPayload {
 
 /// Bounded evidence snippet copied into a flat staging record.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct StagingEvidence {
     pub id: String,
     pub kind: EvidenceKind,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub entry_range: Option<[u64; 2]>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub origin: Option<EvidenceOrigin>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub excerpt: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub summary: Option<String>,
@@ -87,6 +90,7 @@ pub struct StagingEvidence {
 
 /// One flat staging record. One record is one consolidation decision unit.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct StagingRecord {
     pub schema_version: u32,
     pub id: String,
@@ -159,6 +163,7 @@ mod tests {
             id: "E001".into(),
             kind: EvidenceKind::new(EvidenceKind::MESSAGE),
             entry_range: Some([10, 12]),
+            origin: None,
             excerpt: Some("extract candidate taxonomy".into()),
             summary: Some("User and assistant discussed staging kinds".into()),
         };

crates/memory/src/schema/common.rs

@@ -22,6 +22,7 @@ impl<'de> Deserialize<'de> for SourceRef {
         D: serde::Deserializer<'de>,
     {
         #[derive(Deserialize)]
+        #[serde(deny_unknown_fields)]
         struct RawSourceRef {
             #[serde(default)]
             segment_id: Option<String>,
@@ -67,12 +68,48 @@ impl EvidenceKind {
     }
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum EvidenceOriginKind {
+    HumanInput,
+    WorkerInput,
+    FlowInstruction,
+    BackendInstruction,
+    ModelOutput,
+    ToolOutput,
+    DerivedSummary,
+    LegacyUnknown,
+}
+
+/// Bounded origin snapshot attached to extraction evidence. This is audit
+/// metadata only and cannot authorize Workspace operations.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct EvidenceOrigin {
+    pub kind: EvidenceOriginKind,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub account_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub workspace_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub runtime_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub worker_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub flow_selector: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub flow_definition_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub flow_definition_revision: Option<u64>,
+}
+
 /// Host-resolved source/evidence metadata for an individual staging claim.
 ///
 /// This deliberately stores only bounded anchor metadata: stable ids, entry
 /// ranges, and short labels/summaries. It must not carry raw message bodies or
 /// full tool result content.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
 pub struct SourceEvidenceRef {
     /// Stable session id when the anchor crosses or disambiguates segments.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -86,6 +123,9 @@ pub struct SourceEvidenceRef {
     /// Host-assigned evidence id within the referenced evidence set.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub evidence_id: Option<String>,
+    /// Trusted typed origin snapshot for this logical evidence entry.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub origin: Option<EvidenceOrigin>,
     /// Extensible evidence kind tag.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub evidence_kind: Option<EvidenceKind>,

crates/memory/src/schema/mod.rs

@@ -10,7 +10,10 @@ mod decision;
 mod request;
 mod summary;
 
-pub use common::{EvidenceKind, Frontmatter, SourceEvidenceRef, SourceRef, split_frontmatter};
+pub use common::{
+    EvidenceKind, EvidenceOrigin, EvidenceOriginKind, Frontmatter, SourceEvidenceRef, SourceRef,
+    split_frontmatter,
+};
 pub use decision::{DecisionFrontmatter, DecisionStatus};
 pub use request::RequestFrontmatter;
 pub use summary::SummaryFrontmatter;

crates/memory/src/scope.rs

@@ -23,6 +23,7 @@ fn deny_write(target: &Path) -> ScopeRule {
         target: target.to_path_buf(),
         permission: Permission::Write,
         recursive: true,
+        symlink_policy: Default::default(),
     }
 }
 

crates/memory/src/workspace.rs

@@ -70,24 +70,12 @@ impl WorkspaceLayout {
         Self { root: root.into() }
     }
 
-    /// Resolve a layout from a `MemoryConfig`.
+    /// Resolve a layout from the nearest Memory marker.
     ///
-    /// An explicit `memory.workspace_root` is honored exactly. Without an
-    /// explicit root, resolution searches `default_root` and its ancestors for
-    /// the nearest `.yoi/memory` directory. This keeps child worktrees that
-    /// contain `.yoi` project records such as tickets from
-    /// becoming independent memory roots merely because they contain `.yoi`.
-    ///
-    /// If no memory marker exists, this falls back to `default_root` because
-    /// existing call sites require a concrete layout. That fallback is a
-    /// no-marker compatibility path, not a `.yoi` marker interpretation; it
-    /// must not be used as evidence that `.yoi` alone enables repo-local
-    /// memory.
-    pub fn resolve(cfg: &manifest::MemoryConfig, default_root: &Path) -> Self {
-        if let Some(root) = &cfg.workspace_root {
-            return Self::new(root.clone());
-        }
-
+    /// Resolution searches `default_root` and its ancestors for the nearest
+    /// `.yoi/memory` directory. This legacy local-storage helper owns its path
+    /// policy directly; resolved Worker Manifests do not carry storage paths.
+    pub fn resolve(default_root: &Path) -> Self {
         let root =
             find_memory_marker_root(default_root).unwrap_or_else(|| default_root.to_path_buf());
         Self::new(root)
@@ -335,16 +323,6 @@ mod tests {
         assert!(matches!(err, LintError::InvalidPath(_)));
     }
 
-    #[test]
-    fn resolve_uses_workspace_root_when_set() {
-        let cfg = manifest::MemoryConfig {
-            workspace_root: Some(PathBuf::from("/explicit")),
-            ..Default::default()
-        };
-        let layout = WorkspaceLayout::resolve(&cfg, Path::new("/fallback"));
-        assert_eq!(layout.root(), Path::new("/explicit"));
-    }
-
     #[test]
     fn resolve_selects_nearest_ancestor_memory_marker_when_workspace_root_missing() {
         let tmp = TempDir::new().unwrap();
@@ -353,8 +331,7 @@ mod tests {
         std::fs::create_dir_all(workspace.join(".yoi/memory")).unwrap();
         std::fs::create_dir_all(&child).unwrap();
 
-        let cfg = manifest::MemoryConfig::default();
-        let layout = WorkspaceLayout::resolve(&cfg, &child);
+        let layout = WorkspaceLayout::resolve(&child);
         assert_eq!(layout.root(), workspace.as_path());
     }
 
@@ -366,8 +343,7 @@ mod tests {
         std::fs::create_dir_all(workspace.join(".yoi/memory")).unwrap();
         std::fs::create_dir_all(child.join(".yoi/tickets")).unwrap();
 
-        let cfg = manifest::MemoryConfig::default();
-        let layout = WorkspaceLayout::resolve(&cfg, &child);
+        let layout = WorkspaceLayout::resolve(&child);
         assert_eq!(layout.root(), workspace.as_path());
     }
 
@@ -381,8 +357,7 @@ mod tests {
 
         assert_eq!(find_memory_marker_root(&child), None);
 
-        let cfg = manifest::MemoryConfig::default();
-        let layout = WorkspaceLayout::resolve(&cfg, &child);
+        let layout = WorkspaceLayout::resolve(&child);
         assert_eq!(layout.root(), child.as_path());
     }
 }

crates/merge-request/src/lib.rs

@@ -9,7 +9,6 @@ use thiserror::Error;
 use uuid::Uuid;
 
 const SCHEMA_VERSION: i64 = 12;
-const PREVIOUS_SCHEMA_VERSION: i64 = 11;
 const MAX_BODY_BYTES: usize = 16 * 1024;
 const DOMAIN_TABLES: [&str; 5] = [
     "merge_requests",
@@ -37,7 +36,7 @@ impl MergeRequestState {
 
     fn parse(v: &str) -> Result<Self, MergeRequestError> {
         match v {
-            "draft" | "open" => Ok(Self::Open),
+            "open" => Ok(Self::Open),
             "merged" => Ok(Self::Merged),
             "closed" => Ok(Self::Closed),
             _ => Err(MergeRequestError::Corrupt(format!("unknown state `{v}`"))),
@@ -274,6 +273,12 @@ pub struct RegisterReviewerChildSession {
     pub reviewer_profile: String,
     pub now: DateTime<Utc>,
 }
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ReviewSubmissionAuthorization {
+    pub workspace_id: String,
+    pub subject_ref: String,
+}
+
 #[derive(Debug, Clone)]
 pub struct SubmitMergeRequestReview {
     pub ticket_id: String,
@@ -535,6 +540,34 @@ impl MergeRequestStore {
         t.commit()?;
         Ok(RequestedMergeRequestReview { request_event: e })
     }
+    pub fn authorize_review_submission(
+        &self,
+        ticket_id: &str,
+        capability_token: &str,
+    ) -> Result<ReviewSubmissionAuthorization, MergeRequestError> {
+        let connection = self.lock()?;
+        connection
+            .query_row(
+                "SELECT g.workspace_id,g.subject_ref
+                   FROM merge_request_review_grants g
+                   JOIN merge_request_ticket_relations rel
+                     ON rel.workspace_id=g.workspace_id AND rel.merge_request_id=g.merge_request_id
+                   JOIN merge_requests mr
+                     ON mr.workspace_id=g.workspace_id AND mr.merge_request_id=g.merge_request_id
+                  WHERE g.capability_token=?1 AND rel.ticket_id=?2
+                    AND g.status='issued' AND mr.state='open'",
+                params![capability_token, ticket_id],
+                |row| {
+                    Ok(ReviewSubmissionAuthorization {
+                        workspace_id: row.get(0)?,
+                        subject_ref: row.get(1)?,
+                    })
+                },
+            )
+            .optional()?
+            .ok_or_else(|| MergeRequestError::Unauthorized("review grant invalid".into()))
+    }
+
     pub fn submit_review(
         &self,
         i: SubmitMergeRequestReview,
@@ -1321,14 +1354,9 @@ pub fn migrate(c: &Connection) -> Result<(), MergeRequestError> {
     match schema_state(c)? {
         SchemaState::Fresh => fresh(c),
         SchemaState::Current(SCHEMA_VERSION) => verify(c),
-        SchemaState::Current(PREVIOUS_SCHEMA_VERSION) => from_v11(c, PreviousSchemaMarker::Current),
-        SchemaState::Legacy(PREVIOUS_SCHEMA_VERSION) => from_v11(c, PreviousSchemaMarker::Legacy),
         SchemaState::Current(v) => Err(MergeRequestError::Operation(format!(
             "unsupported schema {v}"
         ))),
-        SchemaState::Legacy(v) => Err(MergeRequestError::Operation(format!(
-            "unsupported legacy schema {v}"
-        ))),
     }
 }
 
@@ -1336,26 +1364,14 @@ pub fn migrate(c: &Connection) -> Result<(), MergeRequestError> {
 enum SchemaState {
     Fresh,
     Current(i64),
-    Legacy(i64),
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum PreviousSchemaMarker {
-    Current,
-    Legacy,
 }
 
 fn schema_state(c: &Connection) -> Result<SchemaState, MergeRequestError> {
-    let (current, legacy): (bool, bool) = c.query_row(
-        "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name='merge_request_schema'),EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name='merge_request_schema_migrations')",
+    let current: bool = c.query_row(
+        "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name='merge_request_schema')",
         [],
-        |r| Ok((r.get(0)?, r.get(1)?)),
+        |r| r.get(0),
     )?;
-    if current && legacy {
-        return Err(MergeRequestError::Corrupt(
-            "both current and legacy schema markers exist".into(),
-        ));
-    }
     if current {
         let (count, singleton, version): (i64, Option<i64>, Option<i64>) = c.query_row(
             "SELECT COUNT(*),MIN(singleton),MAX(version) FROM merge_request_schema",
@@ -1372,22 +1388,6 @@ fn schema_state(c: &Connection) -> Result<SchemaState, MergeRequestError> {
         })?;
         return Ok(SchemaState::Current(version));
     }
-    if legacy {
-        let (count, version): (i64, Option<i64>) = c.query_row(
-            "SELECT COUNT(*),MAX(version) FROM merge_request_schema_migrations",
-            [],
-            |r| Ok((r.get(0)?, r.get(1)?)),
-        )?;
-        if count != 1 {
-            return Err(MergeRequestError::Corrupt(
-                "legacy schema marker must contain exactly one version".into(),
-            ));
-        }
-        let version = version.ok_or_else(|| {
-            MergeRequestError::Corrupt("legacy schema marker version is null".into())
-        })?;
-        return Ok(SchemaState::Legacy(version));
-    }
     let domain_tables: bool = c.query_row(
         "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name GLOB 'merge_request*')",
         [],
@@ -1402,214 +1402,20 @@ fn schema_state(c: &Connection) -> Result<SchemaState, MergeRequestError> {
 }
 fn fresh(c: &Connection) -> Result<(), MergeRequestError> {
     let t = c.unchecked_transaction()?;
-    tables(&t, true)?;
-    t.execute("INSERT INTO merge_request_schema VALUES(1,12)", [])?;
+    tables(&t)?;
+    t.execute(
+        "INSERT INTO merge_request_schema VALUES(1,?1)",
+        params![SCHEMA_VERSION],
+    )?;
     fk(&t)?;
     t.commit()?;
     Ok(())
 }
-fn tables(t: &Transaction<'_>, marker: bool) -> Result<(), MergeRequestError> {
-    if marker {
-        t.execute_batch("CREATE TABLE merge_request_schema(singleton INTEGER PRIMARY KEY CHECK(singleton=1),version INTEGER NOT NULL);")?
-    }
+fn tables(t: &Transaction<'_>) -> Result<(), MergeRequestError> {
+    t.execute_batch("CREATE TABLE merge_request_schema(singleton INTEGER PRIMARY KEY CHECK(singleton=1),version INTEGER NOT NULL);")?;
     t.execute_batch("CREATE TABLE merge_requests(workspace_id TEXT NOT NULL,merge_request_id TEXT NOT NULL,repository_id TEXT NOT NULL,state TEXT NOT NULL CHECK(state IN('open','merged','closed')),selector_from TEXT,selector_to TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL,PRIMARY KEY(workspace_id,merge_request_id),FOREIGN KEY(workspace_id,repository_id)REFERENCES repositories(workspace_id,repository_id));CREATE TABLE merge_request_ticket_relations(workspace_id TEXT NOT NULL,merge_request_id TEXT NOT NULL,ticket_id TEXT NOT NULL,relation_kind TEXT NOT NULL CHECK(relation_kind='implements'),created_at TEXT NOT NULL,PRIMARY KEY(workspace_id,merge_request_id,ticket_id),FOREIGN KEY(workspace_id,merge_request_id)REFERENCES merge_requests(workspace_id,merge_request_id)ON DELETE CASCADE,FOREIGN KEY(workspace_id,ticket_id)REFERENCES typed_tickets(workspace_id,ticket_id)ON DELETE CASCADE);CREATE TABLE merge_request_thread_events(workspace_id TEXT NOT NULL,merge_request_id TEXT NOT NULL,event_id TEXT NOT NULL,sequence INTEGER NOT NULL,kind TEXT NOT NULL CHECK(kind IN('review_requested','review','review_revoked','review_cancelled','comment','merge')),payload_json TEXT NOT NULL,operation_id TEXT,created_at TEXT NOT NULL,PRIMARY KEY(workspace_id,merge_request_id,event_id),UNIQUE(workspace_id,merge_request_id,sequence),FOREIGN KEY(workspace_id,merge_request_id)REFERENCES merge_requests(workspace_id,merge_request_id)ON DELETE CASCADE);CREATE UNIQUE INDEX merge_request_merge_operations ON merge_request_thread_events(workspace_id,operation_id)WHERE operation_id IS NOT NULL;CREATE TABLE merge_request_review_grants(workspace_id TEXT NOT NULL,merge_request_id TEXT NOT NULL,request_event_id TEXT NOT NULL,subject_ref TEXT NOT NULL,reviewer_runtime_id TEXT NOT NULL,reviewer_worker_id TEXT NOT NULL,capability_token TEXT PRIMARY KEY,issued_at TEXT NOT NULL,consumed_at TEXT,revoked_at TEXT,status TEXT NOT NULL CHECK(status IN('issued','consumed','revoked')),FOREIGN KEY(workspace_id,merge_request_id,request_event_id)REFERENCES merge_request_thread_events(workspace_id,merge_request_id,event_id)ON DELETE CASCADE);CREATE TABLE merge_request_reviewer_child_sessions(workspace_id TEXT NOT NULL,child_session_id TEXT NOT NULL,parent_runtime_id TEXT NOT NULL,parent_worker_id TEXT NOT NULL,reviewer_profile TEXT NOT NULL,registered_at TEXT NOT NULL,status TEXT NOT NULL CHECK(status IN('active','consumed')),PRIMARY KEY(workspace_id,child_session_id));")?;
     Ok(())
 }
-fn from_v11(
-    c: &Connection,
-    previous_marker: PreviousSchemaMarker,
-) -> Result<(), MergeRequestError> {
-    let t = c.unchecked_transaction()?;
-    if previous_marker == PreviousSchemaMarker::Legacy {
-        t.execute_batch("CREATE TABLE merge_request_schema(singleton INTEGER PRIMARY KEY CHECK(singleton=1),version INTEGER NOT NULL);")?;
-        t.execute(
-            "INSERT INTO merge_request_schema VALUES(1,?1)",
-            params![PREVIOUS_SCHEMA_VERSION],
-        )?;
-    }
-    t.execute_batch("ALTER TABLE merge_requests RENAME TO merge_requests_v11;ALTER TABLE merge_request_ticket_relations RENAME TO merge_request_ticket_relations_v11;ALTER TABLE merge_request_revisions RENAME TO merge_request_revisions_v11;ALTER TABLE merge_request_revision_paths RENAME TO merge_request_revision_paths_v11;ALTER TABLE merge_request_reviewer_child_sessions RENAME TO merge_request_reviewer_child_sessions_v11;ALTER TABLE merge_request_review_attempts RENAME TO merge_request_review_attempts_v11;ALTER TABLE merge_request_reviews RENAME TO merge_request_reviews_v11;ALTER TABLE merge_request_review_findings RENAME TO merge_request_review_findings_v11;ALTER TABLE merge_request_completion_operations RENAME TO merge_request_completion_operations_v11;")?;
-    tables(&t, false)?;
-    t.execute("INSERT INTO merge_requests SELECT workspace_id,merge_request_id,repository_id,CASE state WHEN 'draft'THEN'open'ELSE state END,NULL,target_ref_selector,created_at,updated_at FROM merge_requests_v11",[])?;
-    t.execute("INSERT INTO merge_request_ticket_relations SELECT * FROM merge_request_ticket_relations_v11",[])?;
-    migrate_events(&t)?;
-    if previous_marker == PreviousSchemaMarker::Legacy {
-        t.execute("DROP TABLE merge_request_schema_migrations", [])?;
-    }
-    t.execute_batch("DROP TABLE merge_request_review_findings_v11;DROP TABLE merge_request_reviews_v11;DROP TABLE merge_request_review_attempts_v11;DROP TABLE merge_request_reviewer_child_sessions_v11;DROP TABLE merge_request_revision_paths_v11;DROP TABLE merge_request_revisions_v11;DROP TABLE merge_request_completion_operations_v11;DROP TABLE merge_request_ticket_relations_v11;DROP TABLE merge_requests_v11;UPDATE merge_request_schema SET version=12 WHERE singleton=1;")?;
-    fk(&t)?;
-    t.commit()?;
-    Ok(())
-}
-fn migrate_events(t: &Transaction<'_>) -> Result<(), MergeRequestError> {
-    let attempts = {
-        let mut s=t.prepare("SELECT a.workspace_id,a.attempt_id,a.merge_request_id,a.parent_runtime_id,a.parent_worker_id,a.child_session_id,a.status,a.created_at,a.consumed_at,r.head_commit FROM merge_request_review_attempts_v11 a JOIN merge_request_revisions_v11 r ON r.workspace_id=a.workspace_id AND r.merge_request_id=a.merge_request_id AND r.revision_id=a.revision_id ORDER BY a.created_at")?;
-        s.query_map([], |r| {
-            Ok((
-                r.get::<_, String>(0)?,
-                r.get::<_, String>(1)?,
-                r.get::<_, String>(2)?,
-                r.get::<_, String>(3)?,
-                r.get::<_, String>(4)?,
-                r.get::<_, String>(5)?,
-                r.get::<_, String>(6)?,
-                r.get::<_, String>(7)?,
-                r.get::<_, Option<String>>(8)?,
-                r.get::<_, String>(9)?,
-            ))
-        })?
-        .collect::<Result<Vec<_>, _>>()?
-    };
-    for (ws, a, mr, pr, pw, child, status, created, consumed, subject) in attempts {
-        let req = ReviewRequestedEvent {
-            event_id: format!("migrated-request-{a}"),
-            sequence: next_seq(t, &ws, &mr)?,
-            subject_ref: subject.clone(),
-            requested_by: WorkerIdentity {
-                runtime_id: pr.clone(),
-                worker_id: pw,
-            },
-            reviewer: WorkerIdentity {
-                runtime_id: pr,
-                worker_id: child,
-            },
-            created_at: time(&created)?,
-        };
-        insert_event(t, &ws, &mr, "review_requested", &req, req.created_at, None)?;
-        if status == "submitted" {
-            let(row_dec,row_body,row_at):(String,String,String)=t.query_row("SELECT decision,body,submitted_at FROM merge_request_reviews_v11 WHERE workspace_id=?1 AND attempt_id=?2",params![ws,a],|r|Ok((r.get(0)?,r.get(1)?,r.get(2)?)))?;
-            let findings = {
-                let mut s=t.prepare("SELECT severity,code,path,line,body FROM merge_request_review_findings_v11 WHERE workspace_id=?1 AND attempt_id=?2 ORDER BY ordinal")?;
-                s.query_map(params![ws, a], |r| {
-                    Ok(ReviewFinding {
-                        severity: match r.get::<_, String>(0)?.as_str() {
-                            "blocker" => FindingSeverity::Blocker,
-                            "major" => FindingSeverity::Major,
-                            "minor" => FindingSeverity::Minor,
-                            _ => FindingSeverity::Note,
-                        },
-                        code: r.get(1)?,
-                        path: r.get(2)?,
-                        line: r.get(3)?,
-                        body: r.get(4)?,
-                    })
-                })?
-                .collect::<Result<Vec<_>, _>>()?
-            };
-            let rev = ReviewEvent {
-                event_id: format!("migrated-review-{a}"),
-                sequence: next_seq(t, &ws, &mr)?,
-                request_event_id: req.event_id,
-                subject_ref: subject,
-                decision: if row_dec == "approve" {
-                    ReviewDecision::Approve
-                } else {
-                    ReviewDecision::RequestChanges
-                },
-                body: row_body,
-                findings,
-                reviewer: req.reviewer,
-                created_at: time(&row_at)?,
-            };
-            insert_event(t, &ws, &mr, "review", &rev, rev.created_at, None)?
-        } else {
-            let at = consumed.as_deref().unwrap_or(&created);
-            let e = ReviewCancelledEvent {
-                event_id: format!("migrated-cancel-{a}"),
-                sequence: next_seq(t, &ws, &mr)?,
-                request_event_id: req.event_id,
-                subject_ref: subject,
-                reason: format!(
-                    "legacy `{status}` review request cancelled because its capability cannot be migrated"
-                ),
-                created_at: time(at)?,
-            };
-            insert_event(t, &ws, &mr, "review_cancelled", &e, e.created_at, None)?
-        }
-    }
-    let completed = {
-        let mut q=t.prepare("SELECT c.workspace_id,c.operation_id,c.ticket_id,c.target_commit,c.source_commit,c.result_commit,c.strategy,c.resolution,c.completion_actor_runtime_id,c.completion_actor_worker_id,c.updated_at,rel.merge_request_id FROM merge_request_completion_operations_v11 c JOIN merge_request_ticket_relations_v11 rel ON rel.workspace_id=c.workspace_id AND rel.ticket_id=c.ticket_id WHERE c.status='completed' ORDER BY c.updated_at")?;
-        q.query_map([], |r| {
-            Ok((
-                r.get::<_, String>(0)?,
-                r.get::<_, String>(1)?,
-                r.get::<_, String>(2)?,
-                r.get::<_, Option<String>>(3)?,
-                r.get::<_, Option<String>>(4)?,
-                r.get::<_, Option<String>>(5)?,
-                r.get::<_, Option<String>>(6)?,
-                r.get::<_, Option<String>>(7)?,
-                r.get::<_, Option<String>>(8)?,
-                r.get::<_, Option<String>>(9)?,
-                r.get::<_, String>(10)?,
-                r.get::<_, String>(11)?,
-            ))
-        })?
-        .collect::<Result<Vec<_>, _>>()?
-    };
-    for (
-        ws,
-        op,
-        _ticket,
-        target,
-        source,
-        result,
-        strategy,
-        resolution,
-        runtime,
-        worker,
-        updated,
-        mr,
-    ) in completed
-    {
-        let subject = source.ok_or_else(|| {
-            MergeRequestError::Operation(format!("completed operation {op} lacks source evidence"))
-        })?;
-        let approval:Option<String>=t.query_row("SELECT event_id FROM merge_request_thread_events WHERE workspace_id=?1 AND merge_request_id=?2 AND kind='review' AND json_extract(payload_json,'$.subject_ref')=?3 AND json_extract(payload_json,'$.decision')='approve' ORDER BY sequence DESC LIMIT 1",params![ws,mr,subject],|r|r.get(0)).optional()?;
-        let approval = approval.ok_or_else(|| {
-            MergeRequestError::Operation(format!(
-                "completed operation {op} lacks approval evidence"
-            ))
-        })?;
-        let e = MergeEvent {
-            event_id: format!("migrated-merge-{op}"),
-            sequence: next_seq(t, &ws, &mr)?,
-            operation_id: op,
-            approval_event_id: approval,
-            approved_source_ref: subject,
-            target_ref_before: target.ok_or_else(|| {
-                MergeRequestError::Operation("completed operation lacks target evidence".into())
-            })?,
-            target_ref_after: result.ok_or_else(|| {
-                MergeRequestError::Operation("completed operation lacks result evidence".into())
-            })?,
-            strategy: if strategy.as_deref() == Some("merge") {
-                MergeStrategy::Merge
-            } else {
-                MergeStrategy::FastForward
-            },
-            resolution: match resolution.as_deref() {
-                Some("clean") => ConflictResolution::Clean,
-                Some("conflicts_resolved") => ConflictResolution::ConflictsResolved,
-                _ => ConflictResolution::None,
-            },
-            merged_by: WorkerIdentity {
-                runtime_id: runtime.unwrap_or_else(|| "legacy".into()),
-                worker_id: worker.unwrap_or_else(|| "legacy".into()),
-            },
-            created_at: time(&updated)?,
-        };
-        insert_event(
-            t,
-            &ws,
-            &mr,
-            "merge",
-            &e,
-            e.created_at,
-            Some(&e.operation_id),
-        )?;
-    }
-    Ok(())
-}
 fn verify(c: &Connection) -> Result<(), MergeRequestError> {
     for n in DOMAIN_TABLES {
         let e: bool = c.query_row(

crates/merge-request/tests/store.rs

@@ -91,6 +91,23 @@ fn approve(s: &MergeRequestStore, subject: &str, token: &str) -> ReviewEvent {
     })
     .unwrap()
 }
+#[test]
+fn review_submission_authorization_rejects_invalid_grants_before_side_effects() {
+    let (_d, store) = fixture();
+    open(&store);
+    request(&store, "published-source", "valid-token");
+
+    let invalid = store
+        .authorize_review_submission("T", "invalid-token")
+        .unwrap_err();
+    assert!(matches!(invalid, MergeRequestError::Unauthorized(_)));
+    let authorized = store
+        .authorize_review_submission("T", "valid-token")
+        .unwrap();
+    assert_eq!(authorized.workspace_id, "W");
+    assert_eq!(authorized.subject_ref, "published-source");
+}
+
 #[test]
 fn selectors_thread_and_completion_have_no_revision_or_commit_api() {
     let (d, s) = fixture();
@@ -284,21 +301,13 @@ fn review_revocation_invalidates_readiness() {
 }
 
 #[test]
-fn legacy_v11_migration_preserves_review_events_and_replaces_marker() {
+fn fresh_schema_uses_version_12_and_reopens_as_current() {
     let c = Connection::open_in_memory().unwrap();
-    c.execute_batch("CREATE TABLE repositories(workspace_id TEXT,repository_id TEXT,PRIMARY KEY(workspace_id,repository_id));CREATE TABLE typed_tickets(workspace_id TEXT,ticket_id TEXT,PRIMARY KEY(workspace_id,ticket_id));INSERT INTO repositories VALUES('W','R');INSERT INTO typed_tickets VALUES('W','T');CREATE TABLE merge_request_schema_migrations(version INTEGER PRIMARY KEY,applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP);INSERT INTO merge_request_schema_migrations(version) VALUES(11);CREATE TABLE merge_requests(workspace_id TEXT,merge_request_id TEXT,repository_id TEXT,state TEXT,target_ref_selector TEXT,current_revision_ordinal INTEGER,current_revision_id TEXT,created_at TEXT,updated_at TEXT,merged_revision_id TEXT,merged_at TEXT);CREATE TABLE merge_request_ticket_relations(workspace_id TEXT,merge_request_id TEXT,ticket_id TEXT,relation_kind TEXT,created_at TEXT);CREATE TABLE merge_request_revisions(workspace_id TEXT,merge_request_id TEXT,revision_id TEXT,ordinal INTEGER,base_commit TEXT,head_commit TEXT,diff_digest TEXT,summary TEXT,assignment_id TEXT,created_at TEXT);CREATE TABLE merge_request_revision_paths(workspace_id TEXT,merge_request_id TEXT,revision_id TEXT,ordinal INTEGER,path TEXT);CREATE TABLE merge_request_reviewer_child_sessions(workspace_id TEXT,child_session_id TEXT,parent_runtime_id TEXT,parent_worker_id TEXT,reviewer_profile TEXT,registered_at TEXT);CREATE TABLE merge_request_review_attempts(workspace_id TEXT,attempt_id TEXT,merge_request_id TEXT,ticket_id TEXT,revision_id TEXT,revision_ordinal INTEGER,parent_assignment_id TEXT,parent_runtime_id TEXT,parent_worker_id TEXT,child_session_id TEXT,reviewer_effective_profile TEXT,capability_token TEXT,status TEXT,created_at TEXT,consumed_at TEXT);CREATE TABLE merge_request_reviews(workspace_id TEXT,attempt_id TEXT,merge_request_id TEXT,revision_id TEXT,decision TEXT,body TEXT,submitted_at TEXT);CREATE TABLE merge_request_review_findings(workspace_id TEXT,attempt_id TEXT,ordinal INTEGER,severity TEXT,code TEXT,path TEXT,line INTEGER,body TEXT);CREATE TABLE merge_request_completion_operations(workspace_id TEXT,operation_id TEXT,ticket_id TEXT,revision_id TEXT,authority_kind TEXT,implementation_assignment_id TEXT,completion_actor_runtime_id TEXT,completion_actor_worker_id TEXT,target_commit TEXT,source_commit TEXT,result_commit TEXT,strategy TEXT,resolution TEXT,fingerprint TEXT,status TEXT,result_ticket_state TEXT,created_at TEXT,updated_at TEXT);INSERT INTO merge_requests VALUES('W','MR','R','open','develop',1,'V','2026-07-26T12:00:00Z','2026-07-26T12:00:00Z',NULL,NULL);INSERT INTO merge_request_ticket_relations VALUES('W','MR','T','implements','2026-07-26T12:00:00Z');INSERT INTO merge_request_revisions VALUES('W','MR','V',1,'base','subject','digest','summary','A','2026-07-26T12:00:00Z');INSERT INTO merge_request_review_attempts VALUES('W','AT','MR','T','V',1,'A','runtime','coder','child','builtin:reviewer','token','submitted','2026-07-26T12:00:00Z','2026-07-26T12:00:01Z');INSERT INTO merge_request_reviews VALUES('W','AT','MR','V','approve','approved','2026-07-26T12:00:01Z');INSERT INTO merge_request_review_attempts VALUES('W','PENDING','MR','T','V',1,'A','runtime','coder','pending-child','builtin:reviewer','pending-token','registered','2026-07-26T12:00:02Z',NULL);").unwrap();
     c.execute_batch(
-        "CREATE TABLE unrelated_parent(left_id TEXT,right_id TEXT,PRIMARY KEY(left_id,right_id));CREATE TABLE unrelated_child(left_id TEXT REFERENCES unrelated_parent(left_id));",
+        "CREATE TABLE repositories(workspace_id TEXT,repository_id TEXT,PRIMARY KEY(workspace_id,repository_id));CREATE TABLE typed_tickets(workspace_id TEXT,ticket_id TEXT,PRIMARY KEY(workspace_id,ticket_id));",
     )
     .unwrap();
-    let unrelated_mismatch = c
-        .query_row("PRAGMA foreign_key_check", [], |_| Ok(()))
-        .unwrap_err();
-    assert!(
-        unrelated_mismatch
-            .to_string()
-            .contains("foreign key mismatch")
-    );
+
     merge_request::migrate(&c).unwrap();
     assert_eq!(
         c.query_row("SELECT version FROM merge_request_schema", [], |r| {
@@ -307,66 +316,26 @@ fn legacy_v11_migration_preserves_review_events_and_replaces_marker() {
         .unwrap(),
         12
     );
-    let legacy_marker: bool = c
-        .query_row(
-            "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name='merge_request_schema_migrations')",
-            [],
-            |r| r.get(0),
-        )
-        .unwrap();
-    assert!(!legacy_marker);
-    let selector: Option<String> = c
-        .query_row("SELECT selector_from FROM merge_requests", [], |r| r.get(0))
-        .unwrap();
-    assert!(selector.is_none());
-    let kinds: String = c
-        .query_row(
-            "SELECT group_concat(kind,',') FROM merge_request_thread_events ORDER BY sequence",
-            [],
-            |r| r.get(0),
-        )
-        .unwrap();
-    assert_eq!(
-        kinds,
-        "review_requested,review,review_requested,review_cancelled"
-    );
-    let old: bool = c
-        .query_row(
-            "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE name='merge_request_revisions')",
-            [],
-            |r| r.get(0),
-        )
-        .unwrap();
-    assert!(!old);
+    merge_request::migrate(&c).unwrap();
 }
 
 #[test]
-fn failed_legacy_v11_migration_rolls_back_marker_bridge() {
+fn current_schema_validation_rejects_missing_tables() {
     let c = Connection::open_in_memory().unwrap();
     c.execute_batch(
-        "CREATE TABLE merge_request_schema_migrations(version INTEGER PRIMARY KEY,applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP);INSERT INTO merge_request_schema_migrations(version) VALUES(11);CREATE TABLE merge_requests(merge_request_id TEXT);",
+        "CREATE TABLE repositories(workspace_id TEXT,repository_id TEXT,PRIMARY KEY(workspace_id,repository_id));CREATE TABLE typed_tickets(workspace_id TEXT,ticket_id TEXT,PRIMARY KEY(workspace_id,ticket_id));",
     )
     .unwrap();
-
-    assert!(merge_request::migrate(&c).is_err());
-    for table in ["merge_request_schema_migrations", "merge_requests"] {
-        let exists: bool = c
-            .query_row(
-                "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name=?1)",
-                [table],
-                |r| r.get(0),
-            )
-            .unwrap();
-        assert!(exists, "{table} was not rolled back");
-    }
-    let current_marker: bool = c
-        .query_row(
-            "SELECT EXISTS(SELECT 1 FROM sqlite_master WHERE type='table' AND name='merge_request_schema')",
-            [],
-            |r| r.get(0),
-        )
+    merge_request::migrate(&c).unwrap();
+    c.execute_batch("DROP TABLE merge_request_review_grants;")
         .unwrap();
-    assert!(!current_marker);
+
+    let error = merge_request::migrate(&c).unwrap_err();
+    assert!(matches!(
+        error,
+        MergeRequestError::Corrupt(message)
+            if message == "missing `merge_request_review_grants`"
+    ));
 }
 
 #[test]

crates/protocol/Cargo.toml

@@ -14,6 +14,7 @@ json-schema = ["dep:schemars"]
 schemars = { workspace = true, optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+sha2.workspace = true
 tokio = { workspace = true, features = ["io-util"], optional = true }
 ts-rs = { version = "12.0.1", optional = true }
-uuid = { workspace = true, features = ["serde"] }
+uuid = { workspace = true, features = ["serde", "v7"] }

crates/protocol/src/identity.rs

@@ -0,0 +1,132 @@
+use std::{fmt, str::FromStr};
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de};
+use sha2::{Digest, Sha256};
+use uuid::{Uuid, Version};
+
+/// Stable Worker identity independent of its current Runtime placement or
+/// conversation Session.
+///
+/// Workspace authority allocates this ID for managed Workers. A standalone
+/// Worker store allocates it locally when no Workspace authority is present.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct WorkerId(Uuid);
+
+impl WorkerId {
+    pub fn now_v7() -> Self {
+        Self(Uuid::now_v7())
+    }
+
+    /// Converts a legacy Runtime-local numeric id into a syntactically valid
+    /// migration-only UUIDv7 value. New Worker allocation must use `now_v7`.
+    pub fn from_legacy_u64(value: u64) -> Self {
+        let mut bytes = [0_u8; 16];
+        bytes[8..].copy_from_slice(&value.to_be_bytes());
+        bytes[6] = 0x70;
+        bytes[8] = (bytes[8] & 0x3f) | 0x80;
+        Self(Uuid::from_bytes(bytes))
+    }
+
+    pub fn from_legacy_binding(workspace_id: &str, runtime_id: &str, value: u64) -> Self {
+        let mut hasher = Sha256::new();
+        hasher.update(b"yoi.workspace-worker-id.v1\0");
+        hasher.update(workspace_id.as_bytes());
+        hasher.update([0]);
+        hasher.update(runtime_id.as_bytes());
+        hasher.update([0]);
+        hasher.update(value.to_be_bytes());
+        let digest = hasher.finalize();
+        let mut bytes = [0_u8; 16];
+        bytes.copy_from_slice(&digest[..16]);
+        // Migrated ids sort before normally allocated UUIDv7 values while retaining
+        // deterministic collision-resistant payload bits.
+        bytes[..6].fill(0);
+        bytes[6] = (bytes[6] & 0x0f) | 0x70;
+        bytes[8] = (bytes[8] & 0x3f) | 0x80;
+        Self(Uuid::from_bytes(bytes))
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        let value = Uuid::parse_str(value).ok()?;
+        (value.get_version() == Some(Version::SortRand)).then_some(Self(value))
+    }
+
+    pub const fn as_uuid(self) -> Uuid {
+        self.0
+    }
+
+    #[must_use]
+    pub fn short(self) -> String {
+        let simple = self.0.simple().to_string();
+        simple[simple.len() - 12..].to_string()
+    }
+}
+
+impl fmt::Display for WorkerId {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+impl FromStr for WorkerId {
+    type Err = WorkerIdParseError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        Self::parse(value).ok_or(WorkerIdParseError)
+    }
+}
+
+impl Serialize for WorkerId {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(&self.to_string())
+    }
+}
+
+impl<'de> Deserialize<'de> for WorkerId {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)?;
+        Self::parse(&value).ok_or_else(|| de::Error::custom("Worker id must be a UUIDv7"))
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct WorkerIdParseError;
+
+impl fmt::Display for WorkerIdParseError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("Worker id must be a UUIDv7")
+    }
+}
+
+impl std::error::Error for WorkerIdParseError {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn worker_id_accepts_only_uuid_v7() {
+        let worker_id = WorkerId::now_v7();
+        assert_eq!(WorkerId::parse(&worker_id.to_string()), Some(worker_id));
+        assert!(WorkerId::parse("30").is_none());
+        assert!(WorkerId::parse(&Uuid::nil().to_string()).is_none());
+    }
+
+    #[test]
+    fn legacy_worker_id_mapping_is_stable() {
+        assert_eq!(
+            WorkerId::from_legacy_binding("workspace", "runtime", 42),
+            WorkerId::from_legacy_binding("workspace", "runtime", 42)
+        );
+        assert_ne!(
+            WorkerId::from_legacy_binding("workspace", "runtime", 42),
+            WorkerId::from_legacy_binding("workspace", "runtime", 43)
+        );
+    }
+}

crates/protocol/src/subscription.rs

@@ -170,6 +170,23 @@ fn validate_identifier(
     Ok(())
 }
 
+fn validate_repository_key(value: &str) -> Result<(), SubscriptionValidationError> {
+    let bytes = value.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > 64
+        || bytes.first() == Some(&b'-')
+        || bytes.last() == Some(&b'-')
+        || !bytes
+            .iter()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || *byte == b'-')
+    {
+        return Err(SubscriptionValidationError::InvalidIdentifier {
+            field: "repository_key",
+        });
+    }
+    Ok(())
+}
+
 fn validate_rejection_message(message: &str) -> Result<(), SubscriptionValidationError> {
     if message.is_empty() {
         return Err(SubscriptionValidationError::EmptyRejectionMessage);
@@ -540,7 +557,6 @@ pub enum SubscriptionWorkerState {
     Running,
     Paused,
     Stopped,
-    Cancelled,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -557,6 +573,11 @@ pub struct SubscriptionWorker {
     pub resource_key: Option<String>,
     /// Producer-owned monotonic revision for this Worker subject.
     pub subject_revision: u64,
+    /// Latest revisioned foreground state observed from the Worker. This remains
+    /// absent until an authoritative Worker snapshot/event has been applied.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub worker_state: Option<crate::WorkerStateSnapshot>,
+    /// Runtime catalog lifecycle compatibility projection; not foreground-state authority.
     pub state: SubscriptionWorkerState,
     #[serde(default)]
     pub has_running_internal_workers: bool,
@@ -567,7 +588,12 @@ pub struct SubscriptionWorker {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub profile: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "typescript", ts(skip))]
     pub repository_id: Option<String>,
+    /// Workspace-facing Repository key. Runtime producers leave this unset and
+    /// Workspace Server projections replace `repository_id` with this field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repository_key: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub working_directory_id: Option<SubscriptionWorkdirId>,
 }
@@ -584,6 +610,14 @@ impl SubscriptionWorker {
         if let Some(repository_id) = &self.repository_id {
             validate_identifier("repository_id", repository_id, MAX_RESOURCE_ID_BYTES)?;
         }
+        if let Some(repository_key) = &self.repository_key {
+            validate_repository_key(repository_key)?;
+        }
+        if self.repository_id.is_some() && self.repository_key.is_some() {
+            return Err(SubscriptionValidationError::InvalidIdentifier {
+                field: "repository_authority",
+            });
+        }
         if let Some(working_directory_id) = &self.working_directory_id {
             working_directory_id.validate()?;
         }
@@ -595,7 +629,13 @@ impl SubscriptionWorker {
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
 pub struct SubscriptionWorkdir {
     pub working_directory_id: SubscriptionWorkdirId,
-    pub repository_id: String,
+    /// Runtime-internal Repository id. Workspace-facing TypeScript contracts
+    /// omit this field and require `repository_key` from the Server projection.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "typescript", ts(skip))]
+    pub repository_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repository_key: Option<String>,
     pub state: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub primary_worker_id: Option<SubscriptionWorkerId>,
@@ -604,7 +644,41 @@ pub struct SubscriptionWorkdir {
 impl SubscriptionWorkdir {
     pub fn validate(&self) -> Result<(), SubscriptionValidationError> {
         self.working_directory_id.validate()?;
-        validate_identifier("repository_id", &self.repository_id, MAX_RESOURCE_ID_BYTES)?;
+        match (&self.repository_id, &self.repository_key) {
+            (Some(repository_id), None) => {
+                validate_identifier("repository_id", repository_id, MAX_RESOURCE_ID_BYTES)?;
+            }
+            (None, Some(repository_key)) => validate_repository_key(repository_key)?,
+            _ => {
+                return Err(SubscriptionValidationError::InvalidIdentifier {
+                    field: "repository_authority",
+                });
+            }
+        }
+        validate_identifier("workdir_state", &self.state, MAX_RESOURCE_ID_BYTES)?;
+        if let Some(worker_id) = &self.primary_worker_id {
+            worker_id.validate()?;
+        }
+        Ok(())
+    }
+}
+
+/// Workspace-facing Workdir summary. Backend-generated Repository UUIDs never
+/// enter this DTO; Workspace Server must resolve the required Repository key.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
+pub struct WorkspaceSubscriptionWorkdir {
+    pub working_directory_id: SubscriptionWorkdirId,
+    pub repository_key: String,
+    pub state: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub primary_worker_id: Option<SubscriptionWorkerId>,
+}
+
+impl WorkspaceSubscriptionWorkdir {
+    pub fn validate(&self) -> Result<(), SubscriptionValidationError> {
+        self.working_directory_id.validate()?;
+        validate_repository_key(&self.repository_key)?;
         validate_identifier("workdir_state", &self.state, MAX_RESOURCE_ID_BYTES)?;
         if let Some(worker_id) = &self.primary_worker_id {
             worker_id.validate()?;
@@ -625,7 +699,7 @@ pub enum SubscriptionSnapshot {
         events: Vec<WorkerProtocolEvent>,
     },
     WorkspaceWorkdirs {
-        workdirs: Vec<SubscriptionWorkdir>,
+        workdirs: Vec<WorkspaceSubscriptionWorkdir>,
     },
 }
 
@@ -693,7 +767,7 @@ pub enum SubscriptionEventPayload {
         event: WorkerProtocolEvent,
     },
     WorkdirUpserted {
-        workdir: SubscriptionWorkdir,
+        workdir: WorkspaceSubscriptionWorkdir,
     },
     WorkdirRemoved {
         working_directory_id: SubscriptionWorkdirId,
@@ -805,16 +879,49 @@ mod tests {
             runtime_id: None,
             resource_key: None,
             subject_revision: 0,
+            worker_state: None,
             state: SubscriptionWorkerState::Idle,
             has_running_internal_workers: false,
             workspace_id: Some("workspace-1".to_string()),
             display_name: Some(format!("Worker {value}")),
             profile: Some("builtin:coder".to_string()),
             repository_id: None,
+            repository_key: None,
             working_directory_id: None,
         }
     }
 
+    #[test]
+    fn runtime_and_workspace_repository_identity_projections_do_not_alias() {
+        let mut runtime_worker = worker("worker-1");
+        runtime_worker.repository_id = Some("01890f47-3c22-7cc0-98c4-dc0c0c07398f".to_string());
+        runtime_worker.validate().unwrap();
+        let runtime_json = serde_json::to_value(&runtime_worker).unwrap();
+        assert_eq!(
+            runtime_json["repository_id"],
+            "01890f47-3c22-7cc0-98c4-dc0c0c07398f"
+        );
+        assert!(runtime_json.get("repository_key").is_none());
+
+        let mut workspace_worker = worker("worker-1");
+        workspace_worker.repository_key = Some("main".to_string());
+        workspace_worker.validate().unwrap();
+        let workspace_json = serde_json::to_value(&workspace_worker).unwrap();
+        assert_eq!(workspace_json["repository_key"], "main");
+        assert!(workspace_json.get("repository_id").is_none());
+
+        let workspace_workdir = WorkspaceSubscriptionWorkdir {
+            working_directory_id: SubscriptionWorkdirId::new("workdir-1").unwrap(),
+            repository_key: "main".to_string(),
+            state: "active".to_string(),
+            primary_worker_id: Some(worker_id("worker-1")),
+        };
+        workspace_workdir.validate().unwrap();
+        let workdir_json = serde_json::to_value(&workspace_workdir).unwrap();
+        assert_eq!(workdir_json["repository_key"], "main");
+        assert!(workdir_json.get("repository_id").is_none());
+    }
+
     #[test]
     fn subscribe_frame_has_stable_versioned_json_shape() {
         let frame = SubscriptionFrame::new(SubscriptionFramePayload::Request(
@@ -1008,6 +1115,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn worker_subscription_state_has_exactly_four_lifecycle_values() {
+        for (state, wire) in [
+            (SubscriptionWorkerState::Idle, "idle"),
+            (SubscriptionWorkerState::Running, "running"),
+            (SubscriptionWorkerState::Paused, "paused"),
+            (SubscriptionWorkerState::Stopped, "stopped"),
+        ] {
+            assert_eq!(
+                serde_json::to_value(state).unwrap(),
+                serde_json::json!(wire)
+            );
+        }
+        assert!(
+            serde_json::from_value::<SubscriptionWorkerState>(serde_json::json!("cancelled"))
+                .is_err()
+        );
+    }
+
     #[test]
     fn client_selector_has_no_workspace_scope_field() {
         let json = serde_json::to_value(EventSubscriptionSelector::WorkspaceWorkers).unwrap();

crates/protocol/src/typescript.rs

@@ -7,15 +7,22 @@ use crate::{
     CommandStreamSlice, CompactionLifecycle, CompactionLifecycleState, CompletionEntry,
     CompletionKind, ErrorCode, Event, Greeting, InFlightBlock, InFlightSnapshot,
     InFlightToolCallState, InternalWorkerKind, InternalWorkerRef, InternalWorkerSnapshot,
-    InvokeKind, MemoryWorkerEvent, Method, Permission, RewindSummary, RewindTarget, RewindTargetId,
-    RunResult, ScopeRule, Segment, TurnResult, WorkerEvent, WorkerStatus,
+    InvokeKind, MemoryWorkerEvent, Method, PasteArtifactAvailability, PasteArtifactMediaType,
+    PasteArtifactRef, PendingSubmissionSummary, PendingSubmissionsSnapshot, Permission,
+    RewindSummary, RewindTarget, RewindTargetId, RunResult, ScopeRule, Segment, SessionContentPart,
+    SessionEntryProvenance, SessionMessageRole, SessionSnapshot, SessionSnapshotEntry,
+    SessionSnapshotEntryData, SessionToolAttachment, SubmissionDisposition, SymlinkPolicy,
+    ToolResultDisposition, TurnResult, UploadedFileAvailability, UploadedFileRef, WorkerBusyState,
+    WorkerCommandAcknowledgement, WorkerCommandDisposition, WorkerCommandEnvelope,
+    WorkerCommandKind, WorkerEvent, WorkerMaintenanceState, WorkerRunState, WorkerState,
+    WorkerStateSnapshot, WorkerStatus,
     subscription::{
         EventSubscriptionSelector, SubscriptionEvent, SubscriptionEventPayload, SubscriptionFrame,
         SubscriptionFramePayload, SubscriptionId, SubscriptionRejectionCode, SubscriptionRequest,
         SubscriptionRequestId, SubscriptionResponse, SubscriptionSnapshot,
-        SubscriptionTerminationCode, SubscriptionWorkdir, SubscriptionWorkdirId,
-        SubscriptionWorker, SubscriptionWorkerId, SubscriptionWorkerIds,
-        SubscriptionWorkerProtocolMethod, SubscriptionWorkerState,
+        SubscriptionTerminationCode, SubscriptionWorkdirId, SubscriptionWorker,
+        SubscriptionWorkerId, SubscriptionWorkerIds, SubscriptionWorkerProtocolMethod,
+        SubscriptionWorkerState, WorkspaceSubscriptionWorkdir,
     },
 };
 
@@ -42,11 +49,22 @@ pub fn generated_protocol_types() -> String {
     push_decl::<AlertSource>(&cfg, &mut output);
     push_decl::<CompletionKind>(&cfg, &mut output);
     push_decl::<WorkerStatus>(&cfg, &mut output);
+    push_decl::<WorkerCommandEnvelope>(&cfg, &mut output);
+    push_decl::<WorkerCommandKind>(&cfg, &mut output);
+    push_decl::<WorkerCommandDisposition>(&cfg, &mut output);
+    push_decl::<WorkerCommandAcknowledgement>(&cfg, &mut output);
+    push_decl::<WorkerRunState>(&cfg, &mut output);
+    push_decl::<WorkerMaintenanceState>(&cfg, &mut output);
+    push_decl::<WorkerBusyState>(&cfg, &mut output);
+    push_decl::<WorkerState>(&cfg, &mut output);
+    push_decl::<WorkerStateSnapshot>(&cfg, &mut output);
     push_decl::<TurnResult>(&cfg, &mut output);
     push_decl::<InvokeKind>(&cfg, &mut output);
     push_decl::<RunResult>(&cfg, &mut output);
+    push_decl::<ToolResultDisposition>(&cfg, &mut output);
     push_decl::<ErrorCode>(&cfg, &mut output);
     push_decl::<Permission>(&cfg, &mut output);
+    push_decl::<SymlinkPolicy>(&cfg, &mut output);
     push_decl::<InFlightToolCallState>(&cfg, &mut output);
     push_decl::<CommandStatus>(&cfg, &mut output);
     push_decl::<CommandStream>(&cfg, &mut output);
@@ -55,6 +73,8 @@ pub fn generated_protocol_types() -> String {
     push_decl::<CommandEvent>(&cfg, &mut output);
     push_decl::<CompactionLifecycleState>(&cfg, &mut output);
     push_decl::<CompactionLifecycle>(&cfg, &mut output);
+    push_decl::<UploadedFileAvailability>(&cfg, &mut output);
+    push_decl::<UploadedFileRef>(&cfg, &mut output);
     push_decl::<ScopeRule>(&cfg, &mut output);
     push_decl::<CompletionEntry>(&cfg, &mut output);
     push_decl::<RewindTargetId>(&cfg, &mut output);
@@ -62,12 +82,25 @@ pub fn generated_protocol_types() -> String {
     push_decl::<RewindSummary>(&cfg, &mut output);
     push_decl::<InFlightBlock>(&cfg, &mut output);
     push_decl::<InFlightSnapshot>(&cfg, &mut output);
+    push_decl::<SessionEntryProvenance>(&cfg, &mut output);
+    push_decl::<SessionMessageRole>(&cfg, &mut output);
+    push_decl::<SessionContentPart>(&cfg, &mut output);
+    push_decl::<SessionToolAttachment>(&cfg, &mut output);
+    push_decl::<SessionSnapshotEntryData>(&cfg, &mut output);
+    push_decl::<SessionSnapshotEntry>(&cfg, &mut output);
+    push_decl::<PendingSubmissionSummary>(&cfg, &mut output);
+    push_decl::<PendingSubmissionsSnapshot>(&cfg, &mut output);
+    push_decl::<SubmissionDisposition>(&cfg, &mut output);
+    push_decl::<SessionSnapshot>(&cfg, &mut output);
     push_decl::<InternalWorkerKind>(&cfg, &mut output);
     push_decl::<InternalWorkerRef>(&cfg, &mut output);
     push_decl::<InternalWorkerSnapshot>(&cfg, &mut output);
     push_decl::<Greeting>(&cfg, &mut output);
     push_decl::<Alert>(&cfg, &mut output);
     push_decl::<MemoryWorkerEvent>(&cfg, &mut output);
+    push_decl::<PasteArtifactMediaType>(&cfg, &mut output);
+    push_decl::<PasteArtifactAvailability>(&cfg, &mut output);
+    push_decl::<PasteArtifactRef>(&cfg, &mut output);
     push_decl::<Segment>(&cfg, &mut output);
     push_decl::<WorkerEvent>(&cfg, &mut output);
     push_decl::<SubscriptionRequestId>(&cfg, &mut output);
@@ -78,7 +111,7 @@ pub fn generated_protocol_types() -> String {
     push_decl::<SubscriptionWorkerState>(&cfg, &mut output);
     push_decl::<EventSubscriptionSelector>(&cfg, &mut output);
     push_decl::<SubscriptionWorker>(&cfg, &mut output);
-    push_decl::<SubscriptionWorkdir>(&cfg, &mut output);
+    push_decl::<WorkspaceSubscriptionWorkdir>(&cfg, &mut output);
     push_decl::<SubscriptionSnapshot>(&cfg, &mut output);
     push_decl::<SubscriptionEventPayload>(&cfg, &mut output);
     push_decl::<SubscriptionRejectionCode>(&cfg, &mut output);
@@ -122,6 +155,14 @@ fn export_decl(decl: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn workspace_typescript_omits_runtime_repository_ids() {
+        let generated = generated_protocol_types();
+        assert!(!generated.contains("repository_id?:"), "{generated}");
+        assert!(!generated.contains("repository_id:"), "{generated}");
+        assert!(generated.contains("repository_key"), "{generated}");
+    }
+
     #[test]
     fn generated_protocol_types_are_current() {
         let expected = generated_protocol_types();

crates/session-store/Cargo.toml

@@ -8,12 +8,17 @@ license.workspace = true
 [dependencies]
 base64.workspace = true
 agen = { workspace = true }
+fs4.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+sha2.workspace = true
 uuid = { workspace = true, features = ["v7", "serde"] }
 thiserror = { workspace = true }
 protocol = { workspace = true }
 tracing.workspace = true
+unicode-normalization = "0.1.25"
+unicode-properties = { version = "0.1.4", features = ["general-category"] }
+unicode-security = "0.1.2"
 
 [dev-dependencies]
 async-trait = { workspace = true }

crates/session-store/src/fs_store.rs

@@ -16,9 +16,20 @@
 //! enumerable by the picker.
 
 use crate::event_trace::TraceEntry;
+use crate::paste_artifact::{read_from_dir, write_to_dir};
 use crate::segment_log::LogEntry;
 use crate::store::{Store, StoreError};
-use crate::{SegmentId, SessionId};
+use crate::uploaded_file::{
+    bind_uploaded_file, clear_uploaded_file_binding, copy_committed_uploaded_files,
+    delete_uncommitted_uploaded_files, delete_uploaded_file, finalize_uploaded_file_binding,
+    list_uploaded_file_refs, pin_uploaded_file, read_uploaded_file, read_uploaded_file_by_id,
+    reconcile_uploaded_file_pins, release_uploaded_file_pin, uploaded_file_has_pending_owner,
+    write_uploaded_file,
+};
+use crate::{
+    PasteArtifactLimits, SegmentId, SessionId, UploadedFileLimits, UploadedFileUploadContext,
+};
+use protocol::{PasteArtifactRef, UploadedFileRef};
 use std::fs;
 use std::io::{Read, Seek, SeekFrom, Write};
 use std::path::{Path, PathBuf};
@@ -109,6 +120,50 @@ impl FsStore {
             .join(format!("{segment_id}.trace.jsonl"))
     }
 
+    fn paste_artifact_dir(&self, session_id: SessionId) -> PathBuf {
+        self.session_dir(session_id).join("artifacts").join("paste")
+    }
+
+    fn uploaded_file_is_referenced(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+    ) -> Result<bool, StoreError> {
+        fn segments_contain(segments: &[protocol::Segment], artifact_id: &str) -> bool {
+            segments.iter().any(|segment| {
+                matches!(
+                    segment,
+                    protocol::Segment::UploadedFile { file }
+                        if file.artifact_id == artifact_id
+                )
+            })
+        }
+
+        for segment_id in self.list_segments(session_id)? {
+            for entry in self.read_all(session_id, segment_id)? {
+                let referenced = match entry {
+                    LogEntry::AnnotatedUserInput { segments, .. } => {
+                        segments_contain(&segments, artifact_id)
+                    }
+                    LogEntry::InputSegmentsCheckpoint { user_segments, .. } => user_segments
+                        .iter()
+                        .any(|segments| segments_contain(segments, artifact_id)),
+                    _ => false,
+                };
+                if referenced {
+                    return Ok(true);
+                }
+            }
+        }
+        Ok(false)
+    }
+
+    #[cfg(test)]
+    fn paste_artifact_path(&self, session_id: SessionId, artifact_id: &str) -> PathBuf {
+        self.paste_artifact_dir(session_id)
+            .join(format!("{artifact_id}.json"))
+    }
+
     fn append_line(&self, path: &Path, line: &str) -> Result<(), StoreError> {
         let _guard = self
             .append_lock
@@ -350,6 +405,231 @@ impl Store for FsStore {
         Ok(complete.lines().filter(|l| !l.trim().is_empty()).count())
     }
 
+    fn write_paste_artifact(
+        &self,
+        session_id: SessionId,
+        source_entry_id: &str,
+        content: &str,
+        limits: PasteArtifactLimits,
+    ) -> Result<PasteArtifactRef, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        write_to_dir(
+            &self.paste_artifact_dir(session_id),
+            source_entry_id,
+            content,
+            limits,
+        )
+    }
+
+    fn read_paste_artifact(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+    ) -> Result<(PasteArtifactRef, String), StoreError> {
+        read_from_dir(&self.paste_artifact_dir(session_id), artifact_id)
+    }
+
+    fn write_uploaded_file(
+        &self,
+        session_id: SessionId,
+        file_name: &str,
+        media_type: &str,
+        content: &[u8],
+        limits: UploadedFileLimits,
+    ) -> Result<UploadedFileRef, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        write_uploaded_file(
+            &self.paste_artifact_dir(session_id),
+            file_name,
+            media_type,
+            content,
+            None,
+            limits,
+        )
+    }
+
+    fn write_uploaded_file_with_context(
+        &self,
+        session_id: SessionId,
+        file_name: &str,
+        media_type: &str,
+        content: &[u8],
+        context: &UploadedFileUploadContext,
+        limits: UploadedFileLimits,
+    ) -> Result<UploadedFileRef, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        write_uploaded_file(
+            &self.paste_artifact_dir(session_id),
+            file_name,
+            media_type,
+            content,
+            Some(context),
+            limits,
+        )
+    }
+
+    fn read_uploaded_file(
+        &self,
+        session_id: SessionId,
+        reference: &UploadedFileRef,
+    ) -> Result<Vec<u8>, StoreError> {
+        read_uploaded_file(&self.paste_artifact_dir(session_id), reference)
+    }
+
+    fn read_uploaded_file_by_id(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+    ) -> Result<(UploadedFileRef, Vec<u8>), StoreError> {
+        read_uploaded_file_by_id(&self.paste_artifact_dir(session_id), artifact_id)
+    }
+
+    fn bind_uploaded_file(
+        &self,
+        session_id: SessionId,
+        reference: &UploadedFileRef,
+        source_entry_id: &str,
+    ) -> Result<UploadedFileRef, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        let dir = self.paste_artifact_dir(session_id);
+        match bind_uploaded_file(&dir, reference, source_entry_id) {
+            Err(StoreError::ArtifactAlreadyCommitted) => {
+                let (stored, _) = read_uploaded_file_by_id(&dir, &reference.artifact_id)?;
+                let previous_source = stored
+                    .source_entry_id
+                    .ok_or(StoreError::ArtifactIntegrityMismatch)?;
+                if self.uploaded_file_is_referenced(session_id, &reference.artifact_id)? {
+                    return Err(StoreError::ArtifactAlreadyCommitted);
+                }
+                clear_uploaded_file_binding(&dir, &reference.artifact_id, &previous_source)?;
+                bind_uploaded_file(&dir, reference, source_entry_id)
+            }
+            result => result,
+        }
+    }
+
+    fn pin_uploaded_file(
+        &self,
+        session_id: SessionId,
+        reference: &UploadedFileRef,
+        owner_id: &str,
+    ) -> Result<(), StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        pin_uploaded_file(&self.paste_artifact_dir(session_id), reference, owner_id)
+    }
+
+    fn release_uploaded_file_pin(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+        owner_id: &str,
+    ) -> Result<(), StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        release_uploaded_file_pin(&self.paste_artifact_dir(session_id), artifact_id, owner_id)
+    }
+
+    fn finalize_uploaded_file_binding(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+        source_entry_id: &str,
+    ) -> Result<(), StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        finalize_uploaded_file_binding(
+            &self.paste_artifact_dir(session_id),
+            artifact_id,
+            source_entry_id,
+        )
+    }
+
+    fn reconcile_uploaded_file_pins(
+        &self,
+        session_id: SessionId,
+        live_owner_ids: &[String],
+    ) -> Result<u64, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        reconcile_uploaded_file_pins(&self.paste_artifact_dir(session_id), live_owner_ids)
+    }
+
+    fn delete_uploaded_file(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+    ) -> Result<bool, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        delete_uploaded_file(&self.paste_artifact_dir(session_id), artifact_id)
+    }
+
+    fn delete_uncommitted_uploaded_files(&self, session_id: SessionId) -> Result<u64, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        let dir = self.paste_artifact_dir(session_id);
+        let mut removed = delete_uncommitted_uploaded_files(&dir)?;
+        for reference in list_uploaded_file_refs(&dir)? {
+            let Some(source_entry_id) = reference.source_entry_id.as_deref() else {
+                continue;
+            };
+            if self.uploaded_file_is_referenced(session_id, &reference.artifact_id)? {
+                finalize_uploaded_file_binding(&dir, &reference.artifact_id, source_entry_id)?;
+                continue;
+            }
+            if uploaded_file_has_pending_owner(&dir, &reference.artifact_id)? {
+                continue;
+            }
+            clear_uploaded_file_binding(&dir, &reference.artifact_id, source_entry_id)?;
+            if delete_uploaded_file(&dir, &reference.artifact_id)? {
+                removed = removed
+                    .checked_add(1)
+                    .ok_or(StoreError::ArtifactQuotaExceeded)?;
+            }
+        }
+        Ok(removed)
+    }
+
+    fn copy_committed_uploaded_files(
+        &self,
+        source_session_id: SessionId,
+        target_session_id: SessionId,
+    ) -> Result<u64, StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("session store append lock was poisoned"))?;
+        copy_committed_uploaded_files(
+            &self.paste_artifact_dir(source_session_id),
+            &self.paste_artifact_dir(target_session_id),
+        )
+    }
+
     fn append_trace(
         &self,
         session_id: SessionId,
@@ -398,4 +678,524 @@ mod tests {
         store.create_segment(session_id, segment_id, &[]).unwrap();
         assert!(store.session_modified_at(session_id).unwrap().is_some());
     }
+
+    #[test]
+    fn paste_artifacts_are_atomic_integrity_checked_and_session_scoped() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let owner = new_session_id();
+        let other = new_session_id();
+        let content = "αβγ\nsecond line\n";
+        let reference = store
+            .write_paste_artifact(owner, "entry-1", content, PasteArtifactLimits::default())
+            .unwrap();
+
+        assert_eq!(reference.byte_len, content.len() as u64);
+        assert!(reference.created_at_ms > 0);
+        assert_eq!(
+            reference.media_type,
+            protocol::PasteArtifactMediaType::TextPlainUtf8
+        );
+        assert_eq!(
+            reference.availability,
+            protocol::PasteArtifactAvailability::Available
+        );
+        assert_eq!(reference.char_count, content.chars().count() as u64);
+        assert_eq!(reference.source_entry_id, "entry-1");
+        assert_eq!(
+            store
+                .read_paste_artifact(owner, &reference.artifact_id)
+                .unwrap()
+                .1,
+            content
+        );
+        assert!(matches!(
+            store.read_paste_artifact(other, &reference.artifact_id),
+            Err(StoreError::PasteArtifactNotFound(_))
+        ));
+        assert!(
+            self::fs::read_dir(store.paste_artifact_dir(owner))
+                .unwrap()
+                .all(|entry| !entry
+                    .unwrap()
+                    .file_name()
+                    .to_string_lossy()
+                    .ends_with(".tmp"))
+        );
+        let very_large = "z".repeat(1024 * 1024);
+        let very_large_ref = store
+            .write_paste_artifact(
+                owner,
+                "entry-2",
+                &very_large,
+                PasteArtifactLimits::default(),
+            )
+            .unwrap();
+        assert_eq!(
+            store
+                .read_paste_artifact(owner, &very_large_ref.artifact_id)
+                .unwrap()
+                .1,
+            very_large
+        );
+    }
+
+    #[test]
+    fn concurrent_paste_writes_atomically_enforce_aggregate_caps() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let session_id = new_session_id();
+        let barrier = std::sync::Arc::new(std::sync::Barrier::new(3));
+        let limits = PasteArtifactLimits {
+            max_artifact_bytes: 4,
+            max_session_bytes: 8,
+            max_session_artifacts: 1,
+        };
+        let mut handles = Vec::new();
+        for entry_id in ["entry-1", "entry-2"] {
+            let root = tmp.path().to_path_buf();
+            let barrier = barrier.clone();
+            handles.push(std::thread::spawn(move || {
+                let store = FsStore::new(root).unwrap();
+                barrier.wait();
+                store.write_paste_artifact(session_id, entry_id, "1234", limits)
+            }));
+        }
+        barrier.wait();
+        let results = handles
+            .into_iter()
+            .map(|handle| handle.join().unwrap())
+            .collect::<Vec<_>>();
+        assert_eq!(results.iter().filter(|result| result.is_ok()).count(), 1);
+        assert_eq!(
+            results
+                .iter()
+                .filter(|result| matches!(result, Err(StoreError::PasteArtifactLimit(_))))
+                .count(),
+            1
+        );
+        assert_eq!(
+            std::fs::read_dir(
+                FsStore::new(tmp.path())
+                    .unwrap()
+                    .paste_artifact_dir(session_id)
+            )
+            .unwrap()
+            .filter_map(Result::ok)
+            .filter(
+                |entry| entry.path().extension().and_then(|value| value.to_str()) == Some("json")
+            )
+            .count(),
+            1
+        );
+    }
+
+    #[test]
+    fn uploaded_file_persists_trusted_upload_context_without_projecting_it() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let session_id = new_session_id();
+        let context = UploadedFileUploadContext {
+            upload_id: "upload-1".into(),
+            principal_id: "account-1".into(),
+            workspace_id: "workspace-1".into(),
+            runtime_id: "runtime-1".into(),
+            worker_id: "worker-1".into(),
+        };
+        let reference = store
+            .write_uploaded_file_with_context(
+                session_id,
+                "notes.txt",
+                "text/plain",
+                b"hello",
+                &context,
+                UploadedFileLimits::default(),
+            )
+            .unwrap();
+        let raw = fs::read_to_string(
+            store
+                .paste_artifact_dir(session_id)
+                .join(format!("{}.file.json", reference.artifact_id)),
+        )
+        .unwrap();
+        assert!(raw.contains("account-1"));
+        assert!(raw.contains("workspace-1"));
+        assert!(raw.contains("runtime-1"));
+        assert!(raw.contains("worker-1"));
+        assert!(
+            !serde_json::to_string(&reference)
+                .unwrap()
+                .contains("account-1")
+        );
+
+        let replay = store
+            .write_uploaded_file_with_context(
+                session_id,
+                "notes.txt",
+                "text/plain",
+                b"hello",
+                &context,
+                UploadedFileLimits::default(),
+            )
+            .unwrap();
+        assert_eq!(replay.artifact_id, reference.artifact_id);
+        assert!(matches!(
+            store.write_uploaded_file_with_context(
+                session_id,
+                "renamed.txt",
+                "text/plain",
+                b"hello",
+                &context,
+                UploadedFileLimits::default(),
+            ),
+            Err(StoreError::InvalidUploadedFileName)
+        ));
+    }
+
+    #[test]
+    fn uploaded_file_exact_replay_succeeds_at_session_count_limit() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let session_id = new_session_id();
+        let limits = UploadedFileLimits {
+            max_file_bytes: 1,
+            max_session_bytes: crate::DEFAULT_MAX_SESSION_UPLOADED_FILES,
+        };
+        let mut first = None;
+        for index in 0..crate::DEFAULT_MAX_SESSION_UPLOADED_FILES {
+            let reference = store
+                .write_uploaded_file(
+                    session_id,
+                    &format!("file-{index}.txt"),
+                    "text/plain",
+                    b"x",
+                    limits,
+                )
+                .unwrap();
+            first.get_or_insert(reference);
+        }
+
+        let replay = store
+            .write_uploaded_file(session_id, "file-0.txt", "text/plain", b"x", limits)
+            .unwrap();
+        assert_eq!(replay.artifact_id, first.unwrap().artifact_id);
+        assert!(matches!(
+            store.write_uploaded_file(session_id, "overflow.txt", "text/plain", b"x", limits),
+            Err(StoreError::ArtifactQuotaExceeded)
+        ));
+    }
+
+    #[test]
+    fn uploaded_files_are_session_scoped_integrity_checked_and_removable() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let owner = new_session_id();
+        let other = new_session_id();
+        let limits = UploadedFileLimits {
+            max_file_bytes: 16,
+            max_session_bytes: 16,
+        };
+        let reference = store
+            .write_uploaded_file(owner, "notes.txt", "text/plain", b"hello", limits)
+            .unwrap();
+
+        assert_eq!(reference.file_name, "notes.txt");
+        assert_eq!(reference.media_type, "text/plain");
+        assert_eq!(reference.byte_len, 5);
+        assert_eq!(reference.source_entry_id, None);
+        assert_eq!(
+            store.read_uploaded_file(owner, &reference).unwrap(),
+            b"hello"
+        );
+        assert!(store.read_uploaded_file(other, &reference).is_err());
+
+        let mut forged = reference.clone();
+        forged.file_name = "other.txt".to_string();
+        assert!(matches!(
+            store.read_uploaded_file(owner, &forged),
+            Err(StoreError::ArtifactIntegrityMismatch)
+        ));
+        assert!(
+            store
+                .delete_uploaded_file(owner, &reference.artifact_id)
+                .unwrap()
+        );
+        assert!(
+            !store
+                .delete_uploaded_file(owner, &reference.artifact_id)
+                .unwrap()
+        );
+        assert!(store.read_uploaded_file(owner, &reference).is_err());
+    }
+
+    #[test]
+    fn pending_upload_pin_survives_cleanup_until_release_or_history_binding() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let session_id = new_session_id();
+        let limits = UploadedFileLimits {
+            max_file_bytes: 64,
+            max_session_bytes: 128,
+        };
+        let pending = store
+            .write_uploaded_file(session_id, "pending.txt", "text/plain", b"pending", limits)
+            .unwrap();
+        store
+            .pin_uploaded_file(session_id, &pending, "submission-1")
+            .unwrap();
+        assert!(matches!(
+            store.pin_uploaded_file(session_id, &pending, "submission-other"),
+            Err(StoreError::ArtifactAlreadyCommitted)
+        ));
+        drop(store);
+        let store = FsStore::new(tmp.path()).unwrap();
+        assert_eq!(
+            store.delete_uncommitted_uploaded_files(session_id).unwrap(),
+            0
+        );
+        assert_eq!(
+            store
+                .read_uploaded_file_by_id(session_id, &pending.artifact_id)
+                .unwrap()
+                .1,
+            b"pending"
+        );
+
+        let fork_session_id = new_session_id();
+        assert_eq!(
+            store
+                .copy_committed_uploaded_files(session_id, fork_session_id)
+                .unwrap(),
+            0
+        );
+        assert!(
+            store
+                .read_uploaded_file_by_id(fork_session_id, &pending.artifact_id)
+                .is_err()
+        );
+
+        let committed = store
+            .bind_uploaded_file(session_id, &pending, "entry-1")
+            .unwrap();
+        assert_eq!(
+            store.delete_uncommitted_uploaded_files(session_id).unwrap(),
+            0
+        );
+        assert!(
+            store
+                .read_uploaded_file_by_id(session_id, &pending.artifact_id)
+                .is_ok()
+        );
+        store
+            .create_segment(
+                session_id,
+                new_segment_id(),
+                &[LogEntry::InputSegmentsCheckpoint {
+                    ts: 1,
+                    user_segments: vec![vec![protocol::Segment::UploadedFile {
+                        file: committed.clone(),
+                    }]],
+                }],
+            )
+            .unwrap();
+        assert_eq!(
+            store.delete_uncommitted_uploaded_files(session_id).unwrap(),
+            0
+        );
+        assert!(
+            store
+                .release_uploaded_file_pin(session_id, &pending.artifact_id, "submission-1")
+                .is_err()
+        );
+
+        let releasable = store
+            .write_uploaded_file(session_id, "cancelled.txt", "text/plain", b"cancel", limits)
+            .unwrap();
+        store
+            .pin_uploaded_file(session_id, &releasable, "submission-2")
+            .unwrap();
+        store
+            .release_uploaded_file_pin(session_id, &releasable.artifact_id, "submission-2")
+            .unwrap();
+        assert_eq!(
+            store.delete_uncommitted_uploaded_files(session_id).unwrap(),
+            1
+        );
+        assert!(
+            store
+                .read_uploaded_file_by_id(session_id, &releasable.artifact_id)
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn uploaded_file_validation_and_shared_quota_fail_closed() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let session_id = new_session_id();
+        let limits = UploadedFileLimits {
+            max_file_bytes: 8,
+            max_session_bytes: 8,
+        };
+        assert!(matches!(
+            store.write_uploaded_file(session_id, "../secret", "text/plain", b"x", limits),
+            Err(StoreError::InvalidUploadedFileName)
+        ));
+        assert!(matches!(
+            store.write_uploaded_file(session_id, "notes.txt", "not a type", b"x", limits),
+            Err(StoreError::InvalidUploadedFileMediaType)
+        ));
+        assert!(matches!(
+            store.write_uploaded_file(
+                session_id,
+                "safe\u{202e}txt.exe",
+                "text/plain",
+                b"x",
+                limits
+            ),
+            Err(StoreError::InvalidUploadedFileName)
+        ));
+        assert!(matches!(
+            store.write_uploaded_file(session_id, "image.png", "image/png", b"not a png", limits),
+            Err(StoreError::ArtifactIntegrityMismatch)
+        ));
+        let pending = store
+            .write_uploaded_file(session_id, "Readme.txt", "text/plain", b"x", limits)
+            .unwrap();
+        let replay = store
+            .write_uploaded_file(session_id, "Readme.txt", "text/plain", b"x", limits)
+            .unwrap();
+        assert_eq!(replay.artifact_id, pending.artifact_id);
+        assert!(matches!(
+            store.write_uploaded_file(session_id, "README.txt", "text/plain", b"changed", limits),
+            Err(StoreError::InvalidUploadedFileName)
+        ));
+        assert!(matches!(
+            store.write_uploaded_file(session_id, "ＲＥＡＤＭＥ.txt", "text/plain", b"y", limits),
+            Err(StoreError::InvalidUploadedFileName)
+        ));
+        store
+            .bind_uploaded_file(session_id, &pending, "entry-from-failed-submit")
+            .unwrap();
+        let bound = store
+            .bind_uploaded_file(session_id, &pending, "entry-upload")
+            .unwrap();
+        store
+            .create_segment(
+                session_id,
+                new_segment_id(),
+                &[LogEntry::InputSegmentsCheckpoint {
+                    ts: 1,
+                    user_segments: vec![vec![protocol::Segment::UploadedFile {
+                        file: bound.clone(),
+                    }]],
+                }],
+            )
+            .unwrap();
+        let other = store
+            .write_uploaded_file(session_id, "other.txt", "text/plain", b"z", limits)
+            .unwrap();
+        let stale = store
+            .write_uploaded_file(session_id, "stale.txt", "text/plain", b"s", limits)
+            .unwrap();
+        store
+            .bind_uploaded_file(session_id, &stale, "entry-never-committed")
+            .unwrap();
+        assert_eq!(
+            store.delete_uncommitted_uploaded_files(session_id).unwrap(),
+            2
+        );
+        assert!(store.read_uploaded_file(session_id, &other).is_err());
+        assert!(store.read_uploaded_file(session_id, &stale).is_err());
+        assert_eq!(store.read_uploaded_file(session_id, &bound).unwrap(), b"x");
+        let fork_session_id = new_session_id();
+        assert_eq!(
+            store
+                .copy_committed_uploaded_files(session_id, fork_session_id)
+                .unwrap(),
+            1
+        );
+        assert_eq!(
+            store.read_uploaded_file(fork_session_id, &bound).unwrap(),
+            b"x"
+        );
+        store
+            .write_paste_artifact(
+                session_id,
+                "entry-1",
+                "1234",
+                PasteArtifactLimits {
+                    max_artifact_bytes: 8,
+                    max_session_bytes: 8,
+                    max_session_artifacts: 4,
+                },
+            )
+            .unwrap();
+        assert!(matches!(
+            store.write_uploaded_file(session_id, "notes.txt", "text/plain", b"56789", limits),
+            Err(StoreError::ArtifactQuotaExceeded)
+        ));
+    }
+
+    #[test]
+    fn uploaded_file_names_reject_format_mixed_script_and_confusable_forms() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let session_id = new_session_id();
+        let limits = UploadedFileLimits::default();
+
+        for file_name in [
+            "safe\u{00ad}name.txt",
+            "safe\u{061c}name.txt",
+            "safe\u{180e}name.txt",
+            "safe\u{e0001}name.txt",
+            "p\u{0430}ypal.txt",
+            "report.\u{03c1}df",
+            "\u{0440}\u{0430}\u{0443}\u{0440}\u{0430}\u{04cf}.txt",
+            "\u{ff26}\u{ff49}\u{ff4c}\u{ff45}.txt",
+            "re\u{0301}sume\u{0301}.txt",
+        ] {
+            assert!(matches!(
+                store.write_uploaded_file(session_id, file_name, "text/plain", b"safe", limits),
+                Err(StoreError::InvalidUploadedFileName)
+            ));
+        }
+
+        for file_name in ["notes.txt", "résumé.txt", "日本語.txt", "📎.txt"] {
+            store
+                .write_uploaded_file(session_id, file_name, "text/plain", b"safe", limits)
+                .unwrap();
+        }
+    }
+
+    #[test]
+    fn paste_artifact_limits_and_corruption_fail_closed() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let store = FsStore::new(tmp.path()).unwrap();
+        let session_id = new_session_id();
+        let limits = PasteArtifactLimits {
+            max_artifact_bytes: 5,
+            max_session_bytes: 8,
+            max_session_artifacts: 2,
+        };
+        let first = store
+            .write_paste_artifact(session_id, "entry-1", "1234", limits)
+            .unwrap();
+        assert!(matches!(
+            store.write_paste_artifact(session_id, "entry-2", "56789", limits),
+            Err(StoreError::PasteArtifactLimit(_))
+        ));
+        assert!(matches!(
+            store.write_paste_artifact(session_id, "entry-2", "5678", limits),
+            Ok(_)
+        ));
+        std::fs::write(
+            store.paste_artifact_path(session_id, &first.artifact_id),
+            b"{}",
+        )
+        .unwrap();
+        assert!(matches!(
+            store.read_paste_artifact(session_id, &first.artifact_id),
+            Err(StoreError::Serde(_)) | Err(StoreError::PasteArtifactIntegrity(_))
+        ));
+    }
 }

crates/session-store/src/history.rs

@@ -0,0 +1,165 @@
+//! Serializable history entries with restore-authoritative logical identity and origin.
+
+use serde::{Deserialize, Serialize};
+
+use crate::LoggedItem;
+
+/// Stable logical identity of one model-visible history entry.
+///
+/// This value is generated at the trusted Worker session boundary and copied
+/// unchanged across fork, rewind, compaction retention, restore, and reboot.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct LoggedSessionHistoryEntryId(pub String);
+
+impl LoggedSessionHistoryEntryId {
+    pub fn new() -> Self {
+        Self(uuid::Uuid::now_v7().to_string())
+    }
+}
+
+impl Default for LoggedSessionHistoryEntryId {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Bounded subject snapshot. It is evidence, not a live authorization handle.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LoggedWorkerSubject {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub workspace_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub runtime_id: Option<String>,
+    pub worker_id: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum LoggedSessionHistoryOrigin {
+    HumanInput {
+        account_id: String,
+    },
+    WorkerInput {
+        actor: LoggedWorkerSubject,
+    },
+    FlowInstruction {
+        selector: String,
+        definition_id: String,
+        definition_revision: u64,
+        instance_id: String,
+        state_id: String,
+    },
+    BackendInstruction {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        operation_id: Option<String>,
+    },
+    ModelOutput {
+        worker: LoggedWorkerSubject,
+    },
+    ToolOutput {
+        worker: LoggedWorkerSubject,
+    },
+    DerivedSummary,
+    LegacyUnknown,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LoggedHistoryDerivation {
+    pub sources: Vec<LoggedSessionHistoryEntryId>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LoggedSessionHistoryMetadata {
+    pub entry_id: LoggedSessionHistoryEntryId,
+    pub origin: LoggedSessionHistoryOrigin,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub derivation: Option<LoggedHistoryDerivation>,
+}
+
+impl LoggedSessionHistoryMetadata {
+    pub fn legacy_unknown() -> Self {
+        Self {
+            entry_id: LoggedSessionHistoryEntryId::new(),
+            origin: LoggedSessionHistoryOrigin::LegacyUnknown,
+            derivation: None,
+        }
+    }
+}
+
+/// Persisted item and metadata are one value so transforms cannot reorder or
+/// truncate one without the other.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct LoggedHistoryEntry {
+    pub item: LoggedItem,
+    pub metadata: LoggedSessionHistoryMetadata,
+}
+
+/// Typed system-item history record. The typed system event remains available
+/// to client replay while its model-visible projection carries the same stable
+/// metadata used by live history.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LoggedSystemHistoryEntry {
+    pub item: crate::SystemItem,
+    pub metadata: LoggedSessionHistoryMetadata,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::LoggedRole;
+    use agen::llm_client::RequestConfig;
+
+    #[test]
+    fn logged_history_entry_round_trip_preserves_id_origin_and_derivation() {
+        let source_id = LoggedSessionHistoryEntryId::new();
+        let entry = LoggedHistoryEntry {
+            item: LoggedItem::Message {
+                role: LoggedRole::User,
+                content: vec![crate::LoggedContentPart::Text {
+                    text: "preference".into(),
+                }],
+            },
+            metadata: LoggedSessionHistoryMetadata {
+                entry_id: LoggedSessionHistoryEntryId::new(),
+                origin: LoggedSessionHistoryOrigin::HumanInput {
+                    account_id: "account-1".into(),
+                },
+                derivation: Some(LoggedHistoryDerivation {
+                    sources: vec![source_id.clone()],
+                }),
+            },
+        };
+        let encoded = serde_json::to_vec(&entry).unwrap();
+        let decoded: LoggedHistoryEntry = serde_json::from_slice(&encoded).unwrap();
+        assert_eq!(decoded, entry);
+        assert_eq!(
+            decoded.metadata.derivation.unwrap().sources,
+            vec![source_id]
+        );
+    }
+
+    #[test]
+    fn annotated_segment_start_is_restore_visible_without_projecting_metadata() {
+        let session_id = uuid::Uuid::now_v7();
+        let history_entry = LoggedHistoryEntry {
+            item: LoggedItem::Message {
+                role: LoggedRole::Assistant,
+                content: vec![crate::LoggedContentPart::Text {
+                    text: "answer".into(),
+                }],
+            },
+            metadata: LoggedSessionHistoryMetadata::legacy_unknown(),
+        };
+        let state = crate::collect_state(&[crate::LogEntry::AnnotatedSegmentStart {
+            ts: 1,
+            session_id,
+            system_prompt: None,
+            config: RequestConfig::default(),
+            history: vec![history_entry],
+            forked_from: None,
+            compacted_from: None,
+        }]);
+        assert_eq!(state.history[0].as_text(), Some("answer"));
+    }
+}

crates/session-store/src/legacy_session_log.rs

@@ -0,0 +1,189 @@
+//! Versioned decoder for Session schemas that predate canonical annotated history.
+//!
+//! These types are intentionally private to `session-store`. Current writers,
+//! replay, and public projections use [`crate::LogEntry`] exclusively; only the
+//! Worker Session schema migration is allowed to deserialize these shapes.
+
+use agen::llm_client::types::RequestConfig;
+use protocol::Segment;
+use serde::Deserialize;
+
+use crate::{
+    LogEntry, LoggedHistoryEntry, LoggedItem, LoggedSessionHistoryEntryId,
+    LoggedSessionHistoryMetadata, LoggedSessionHistoryOrigin, LoggedSystemHistoryEntry, SegmentId,
+    SegmentOrigin, SessionExtension, SessionId, SystemItem,
+};
+
+#[derive(Debug, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+enum LegacyHistoryLogEntry {
+    SegmentStart {
+        ts: u64,
+        session_id: SessionId,
+        system_prompt: Option<String>,
+        config: RequestConfig,
+        history: Vec<LoggedItem>,
+        #[serde(default)]
+        forked_from: Option<SegmentOrigin>,
+        #[serde(default)]
+        compacted_from: Option<SegmentOrigin>,
+    },
+    UserInput {
+        ts: u64,
+        segments: Vec<Segment>,
+        #[serde(default)]
+        extensions: Vec<SessionExtension>,
+    },
+    AssistantItem {
+        ts: u64,
+        item: LoggedItem,
+    },
+    ToolResult {
+        ts: u64,
+        item: LoggedItem,
+    },
+    SystemItem {
+        ts: u64,
+        item: SystemItem,
+    },
+}
+
+/// Schema-v1 decoder. Non-history records already had their current shape, so
+/// they pass through `LogEntry`; legacy history records are converted below.
+#[derive(Debug, Deserialize)]
+#[serde(untagged)]
+enum LegacySessionLogEntryV1 {
+    History(LegacyHistoryLogEntry),
+    Current(LogEntry),
+}
+
+/// Schema v2 retained the v1 history shapes while adding non-history records.
+/// Keep a distinct type so supported source versions remain explicit rather
+/// than turning migration compatibility into the current `LogEntry` contract.
+#[derive(Debug, Deserialize)]
+#[serde(untagged)]
+enum LegacySessionLogEntryV2 {
+    History(LegacyHistoryLogEntry),
+    Current(LogEntry),
+}
+
+pub(crate) fn decode_entry(
+    schema_version: u32,
+    line: &str,
+    session_id: SessionId,
+    segment_id: SegmentId,
+    line_index: usize,
+) -> Result<LogEntry, serde_json::Error> {
+    let entry = match schema_version {
+        1 => match serde_json::from_str::<LegacySessionLogEntryV1>(line)? {
+            LegacySessionLogEntryV1::History(entry) => Entry::History(entry),
+            LegacySessionLogEntryV1::Current(entry) => Entry::Current(entry),
+        },
+        2 => match serde_json::from_str::<LegacySessionLogEntryV2>(line)? {
+            LegacySessionLogEntryV2::History(entry) => Entry::History(entry),
+            LegacySessionLogEntryV2::Current(entry) => Entry::Current(entry),
+        },
+        _ => unreachable!("legacy decoder called for unsupported schema {schema_version}"),
+    };
+    Ok(match entry {
+        Entry::History(entry) => {
+            canonicalize_history_entry(session_id, segment_id, line_index, entry)
+        }
+        Entry::Current(entry) => entry,
+    })
+}
+
+enum Entry {
+    History(LegacyHistoryLogEntry),
+    Current(LogEntry),
+}
+
+fn legacy_metadata(
+    segment_id: SegmentId,
+    line_index: usize,
+    item_index: usize,
+) -> LoggedSessionHistoryMetadata {
+    let mut identity = Vec::with_capacity(32);
+    identity.extend_from_slice(segment_id.as_bytes());
+    identity.extend_from_slice(&(line_index as u64).to_be_bytes());
+    identity.extend_from_slice(&(item_index as u64).to_be_bytes());
+    LoggedSessionHistoryMetadata {
+        entry_id: LoggedSessionHistoryEntryId(format!(
+            "l-{}",
+            base64::Engine::encode(&base64::engine::general_purpose::URL_SAFE_NO_PAD, identity)
+        )),
+        origin: LoggedSessionHistoryOrigin::LegacyUnknown,
+        derivation: None,
+    }
+}
+
+fn canonicalize_history_entry(
+    _session_id: SessionId,
+    segment_id: SegmentId,
+    line_index: usize,
+    entry: LegacyHistoryLogEntry,
+) -> LogEntry {
+    match entry {
+        LegacyHistoryLogEntry::SegmentStart {
+            ts,
+            session_id,
+            system_prompt,
+            config,
+            history,
+            forked_from,
+            compacted_from,
+        } => LogEntry::AnnotatedSegmentStart {
+            ts,
+            session_id,
+            system_prompt,
+            config,
+            history: history
+                .into_iter()
+                .enumerate()
+                .map(|(item_index, item)| LoggedHistoryEntry {
+                    item,
+                    metadata: legacy_metadata(segment_id, line_index, item_index),
+                })
+                .collect(),
+            forked_from,
+            compacted_from,
+        },
+        LegacyHistoryLogEntry::UserInput {
+            ts,
+            segments,
+            extensions,
+        } => LogEntry::AnnotatedUserInput {
+            ts,
+            history: vec![LoggedHistoryEntry {
+                item: LoggedItem::from(agen::Item::user_message(Segment::flatten_to_text(
+                    &segments,
+                ))),
+                metadata: legacy_metadata(segment_id, line_index, 0),
+            }],
+            segments,
+            extensions,
+        },
+        LegacyHistoryLogEntry::AssistantItem { ts, item } => LogEntry::AnnotatedAssistantItem {
+            ts,
+            entry: LoggedHistoryEntry {
+                item,
+                metadata: legacy_metadata(segment_id, line_index, 0),
+            },
+        },
+        LegacyHistoryLogEntry::ToolResult { ts, item } => LogEntry::AnnotatedToolResult {
+            ts,
+            entry: LoggedHistoryEntry {
+                item,
+                metadata: legacy_metadata(segment_id, line_index, 0),
+            },
+        },
+        LegacyHistoryLogEntry::SystemItem { ts, item } => LogEntry::AnnotatedSystemItem {
+            ts,
+            entry: LoggedSystemHistoryEntry {
+                item,
+                metadata: legacy_metadata(segment_id, line_index, 0),
+            },
+            extensions: Vec::new(),
+        },
+    }
+}

crates/session-store/src/lib.rs

@@ -26,17 +26,23 @@
 //! let (session_id, segment_id) = create_segment(&store, SegmentStartState {
 //!     system_prompt: None,
 //!     config: &config,
-//!     history: &[],
+//!     history: Vec::new(),
+//!     user_segments: Vec::new(),
 //! })?;
 //! ```
 
 pub mod event_trace;
 pub mod fs_store;
+pub mod history;
+mod legacy_session_log;
 pub mod logged_item;
+mod paste_artifact;
+pub mod public_snapshot;
 pub mod segment;
 pub mod segment_log;
 pub mod store;
 pub mod system_item;
+pub mod uploaded_file;
 pub mod worker_metadata;
 pub mod worker_session_store;
 
@@ -44,9 +50,15 @@ pub use agen::UsageRecord;
 pub use agen::llm_client::types::{ContentPart, Item, Role};
 pub use event_trace::{TraceEntry, TracePayload};
 pub use fs_store::FsStore;
+pub use history::{
+    LoggedHistoryDerivation, LoggedHistoryEntry, LoggedSessionHistoryEntryId,
+    LoggedSessionHistoryMetadata, LoggedSessionHistoryOrigin, LoggedSystemHistoryEntry,
+    LoggedWorkerSubject,
+};
 pub use logged_item::{LoggedContentPart, LoggedItem, LoggedRole, from_logged, to_logged};
+pub use paste_artifact::PasteArtifactLimits;
 pub use segment::{
-    SegmentStartState, append_entry, append_system_item, classify_history_item,
+    SegmentStartState, append_entry, append_system_item, classify_logged_history_entry,
     create_compacted_segment, create_segment, create_segment_with_ids, ensure_head_or_fork, fork,
     fork_at, restore, restore_by_segment, save_config_changed, save_delta, save_extension,
     save_run_completed, save_run_errored, save_turn_end, save_usage, save_user_input,
@@ -56,6 +68,11 @@ pub use store::{Store, StoreError};
 pub use system_item::{
     PromptRenderProvenance, SystemItem, SystemReminder, SystemReminderSource, render_worker_event,
 };
+pub use uploaded_file::{
+    DEFAULT_MAX_FILES_PER_SUBMISSION, DEFAULT_MAX_SESSION_ARTIFACT_BYTES,
+    DEFAULT_MAX_SESSION_UPLOADED_FILES, DEFAULT_MAX_UPLOADED_FILE_BYTES, UploadedFileLimits,
+    UploadedFileUploadContext,
+};
 pub use worker_metadata::{
     CombinedStore, FsWorkerStore, WorkerActiveSegmentRef, WorkerAggregateStore, WorkerMetadata,
     WorkerMetadataStore, WorkerPeer, WorkerReclaimedChild, WorkerSpawnedChild,

crates/session-store/src/logged_item.rs

@@ -14,7 +14,7 @@
 
 use agen::{
     llm_client::types::{ContentPart, Item, Role},
-    tool::{Attachment, ImageAttachment},
+    tool::{Attachment, ImageAttachment, ToolResultDisposition},
 };
 use base64::{Engine as _, engine::general_purpose::STANDARD};
 use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
@@ -61,6 +61,8 @@ pub enum LoggedItem {
         content: Option<String>,
         #[serde(default, skip_serializing_if = "Vec::is_empty")]
         attachments: Vec<LoggedAttachment>,
+        #[serde(default, skip_serializing_if = "ToolResultDisposition::is_success")]
+        disposition: ToolResultDisposition,
         #[serde(default, skip_serializing_if = "is_false")]
         is_error: bool,
     },
@@ -128,6 +130,7 @@ impl From<&Item> for LoggedItem {
                 summary,
                 content,
                 attachments,
+                disposition,
                 is_error,
                 ..
             } => Self::ToolResult {
@@ -135,6 +138,7 @@ impl From<&Item> for LoggedItem {
                 summary: summary.clone(),
                 content: content.clone(),
                 attachments: attachments.iter().map(LoggedAttachment::from).collect(),
+                disposition: *disposition,
                 is_error: *is_error,
             },
             Item::Reasoning {
@@ -184,15 +188,24 @@ impl From<LoggedItem> for Item {
                 summary,
                 content,
                 attachments,
+                disposition,
                 is_error,
-            } => Item::ToolResult {
-                id: None,
-                call_id,
-                summary,
-                content,
-                is_error,
-                attachments: attachments.into_iter().map(Attachment::from).collect(),
-            },
+            } => {
+                let disposition = if is_error && disposition.is_success() {
+                    ToolResultDisposition::Error
+                } else {
+                    disposition
+                };
+                Item::ToolResult {
+                    id: None,
+                    call_id,
+                    summary,
+                    content,
+                    disposition,
+                    is_error,
+                    attachments: attachments.into_iter().map(Attachment::from).collect(),
+                }
+            }
             LoggedItem::Reasoning {
                 text,
                 summary,
@@ -430,6 +443,42 @@ mod tests {
         }
     }
 
+    #[test]
+    fn outcome_unknown_tool_result_round_trips_as_terminal() {
+        let original = Item::tool_result_item_with_disposition_and_attachments(
+            "call_unknown",
+            "outcome unknown",
+            Some("bounded progress".to_string()),
+            ToolResultDisposition::OutcomeUnknown,
+            Vec::new(),
+        );
+        let logged: LoggedItem = (&original).into();
+        let json = serde_json::to_string(&logged).unwrap();
+        assert!(json.contains(r#""disposition":"outcome_unknown""#));
+        match Item::from(serde_json::from_str::<LoggedItem>(&json).unwrap()) {
+            Item::ToolResult {
+                disposition,
+                is_error,
+                ..
+            } => {
+                assert_eq!(disposition, ToolResultDisposition::OutcomeUnknown);
+                assert!(is_error);
+            }
+            other => panic!("unexpected variant: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn legacy_error_tool_result_infers_error_disposition() {
+        let legacy = r#"{"kind":"tool_result","call_id":"call_old","summary":"failed","content":null,"is_error":true}"#;
+        match Item::from(serde_json::from_str::<LoggedItem>(legacy).unwrap()) {
+            Item::ToolResult { disposition, .. } => {
+                assert_eq!(disposition, ToolResultDisposition::Error)
+            }
+            other => panic!("unexpected variant: {other:?}"),
+        }
+    }
+
     #[test]
     fn tool_result_persistence_round_trips_binary_attachments() {
         let original = Item::tool_result_item_with_attachments(

crates/session-store/src/paste_artifact.rs

@@ -0,0 +1,205 @@
+//! Session-owned storage for large pasted-input artifacts.
+
+use std::fs;
+use std::io::Write as _;
+use std::path::Path;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use fs4::fs_std::FileExt;
+use protocol::{PasteArtifactAvailability, PasteArtifactMediaType, PasteArtifactRef};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use crate::StoreError;
+
+/// Bounded storage policy applied before a large paste becomes durable input.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct PasteArtifactLimits {
+    pub max_artifact_bytes: u64,
+    pub max_session_bytes: u64,
+    pub max_session_artifacts: u64,
+}
+
+impl Default for PasteArtifactLimits {
+    fn default() -> Self {
+        Self {
+            max_artifact_bytes: 8 * 1024 * 1024,
+            max_session_bytes: 64 * 1024 * 1024,
+            max_session_artifacts: 1_024,
+        }
+    }
+}
+
+/// Integrity-bearing on-disk record. The body and metadata are committed in one
+/// atomic file replacement so readers never observe a half-written artifact.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct StoredPasteArtifact {
+    pub reference: PasteArtifactRef,
+    pub content: String,
+}
+
+pub(crate) fn stored_paste_usage(artifact_dir: &Path) -> Result<(u64, u64), StoreError> {
+    if !artifact_dir.exists() {
+        return Ok((0, 0));
+    }
+    let mut aggregate = 0_u64;
+    let mut artifact_count = 0_u64;
+    for entry in fs::read_dir(artifact_dir)? {
+        let path = entry?.path();
+        let Some(name) = path.file_name().and_then(|value| value.to_str()) else {
+            continue;
+        };
+        if !name.ends_with(".json") || name.ends_with(".file.json") {
+            continue;
+        }
+        let stored: StoredPasteArtifact = serde_json::from_slice(&fs::read(&path)?)?;
+        verify(&stored, &stored.reference.artifact_id)?;
+        artifact_count = artifact_count.checked_add(1).ok_or_else(|| {
+            StoreError::PasteArtifactLimit("session artifact count overflow".to_string())
+        })?;
+        aggregate = aggregate
+            .checked_add(stored.reference.byte_len)
+            .ok_or_else(|| {
+                StoreError::PasteArtifactLimit("session aggregate size overflow".to_string())
+            })?;
+    }
+    Ok((aggregate, artifact_count))
+}
+
+pub(crate) fn write_to_dir(
+    artifact_dir: &Path,
+    source_entry_id: &str,
+    content: &str,
+    limits: PasteArtifactLimits,
+) -> Result<PasteArtifactRef, StoreError> {
+    let byte_len = content.len() as u64;
+    if byte_len > limits.max_artifact_bytes {
+        return Err(StoreError::PasteArtifactLimit(format!(
+            "artifact has {byte_len} bytes; maximum is {}",
+            limits.max_artifact_bytes
+        )));
+    }
+    fs::create_dir_all(artifact_dir)?;
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(artifact_dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let (paste_bytes, artifact_count) = stored_paste_usage(artifact_dir)?;
+    let (uploaded_bytes, uploaded_count) =
+        crate::uploaded_file::stored_uploaded_file_usage(artifact_dir)?;
+    let aggregate = paste_bytes.checked_add(uploaded_bytes).ok_or_else(|| {
+        StoreError::PasteArtifactLimit("session aggregate size overflow".to_string())
+    })?;
+    let artifact_count = artifact_count.checked_add(uploaded_count).ok_or_else(|| {
+        StoreError::PasteArtifactLimit("session artifact count overflow".to_string())
+    })?;
+    let projected = aggregate.checked_add(byte_len).ok_or_else(|| {
+        StoreError::PasteArtifactLimit("session aggregate size overflow".to_string())
+    })?;
+    if projected > limits.max_session_bytes {
+        return Err(StoreError::PasteArtifactLimit(format!(
+            "session artifacts would use {projected} bytes; maximum is {}",
+            limits.max_session_bytes
+        )));
+    }
+    if artifact_count >= limits.max_session_artifacts {
+        return Err(StoreError::PasteArtifactLimit(format!(
+            "session already has {artifact_count} artifacts; maximum is {}",
+            limits.max_session_artifacts
+        )));
+    }
+
+    let artifact_id = uuid::Uuid::now_v7().to_string();
+    let created_at_ms = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_err(|error| StoreError::PasteArtifactIntegrity(error.to_string()))?
+        .as_millis() as u64;
+    let reference = PasteArtifactRef {
+        artifact_id: artifact_id.clone(),
+        created_at_ms,
+        media_type: PasteArtifactMediaType::TextPlainUtf8,
+        availability: PasteArtifactAvailability::Available,
+        byte_len,
+        char_count: content.chars().count() as u64,
+        line_count: line_count(content),
+        sha256: sha256_hex(content),
+        source_entry_id: source_entry_id.to_string(),
+    };
+    let bytes = serde_json::to_vec(&StoredPasteArtifact {
+        reference: reference.clone(),
+        content: content.to_string(),
+    })?;
+    let target = artifact_dir.join(format!("{artifact_id}.json"));
+    let temporary = artifact_dir.join(format!(".{artifact_id}.tmp"));
+    let mut file = fs::OpenOptions::new()
+        .create_new(true)
+        .write(true)
+        .open(&temporary)?;
+    if let Err(error) = file.write_all(&bytes).and_then(|_| file.sync_all()) {
+        let _ = fs::remove_file(&temporary);
+        return Err(error.into());
+    }
+    if let Err(error) = fs::rename(&temporary, &target) {
+        let _ = fs::remove_file(&temporary);
+        return Err(error.into());
+    }
+    if let Ok(directory) = fs::File::open(artifact_dir) {
+        directory.sync_all()?;
+    }
+    Ok(reference)
+}
+
+pub(crate) fn read_from_dir(
+    artifact_dir: &Path,
+    artifact_id: &str,
+) -> Result<(PasteArtifactRef, String), StoreError> {
+    let parsed = uuid::Uuid::parse_str(artifact_id)
+        .map_err(|_| StoreError::PasteArtifactNotFound(artifact_id.to_string()))?;
+    if parsed.to_string() != artifact_id {
+        return Err(StoreError::PasteArtifactNotFound(artifact_id.to_string()));
+    }
+    let path = artifact_dir.join(format!("{artifact_id}.json"));
+    let bytes = match fs::read(path) {
+        Ok(bytes) => bytes,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            return Err(StoreError::PasteArtifactNotFound(artifact_id.to_string()));
+        }
+        Err(error) => return Err(error.into()),
+    };
+    let stored: StoredPasteArtifact = serde_json::from_slice(&bytes)?;
+    verify(&stored, artifact_id)?;
+    Ok((stored.reference, stored.content))
+}
+
+fn verify(stored: &StoredPasteArtifact, artifact_id: &str) -> Result<(), StoreError> {
+    let actual_digest = sha256_hex(&stored.content);
+    if stored.reference.artifact_id != artifact_id
+        || stored.reference.created_at_ms == 0
+        || stored.reference.media_type != PasteArtifactMediaType::TextPlainUtf8
+        || stored.reference.availability != PasteArtifactAvailability::Available
+        || stored.reference.byte_len != stored.content.len() as u64
+        || stored.reference.char_count != stored.content.chars().count() as u64
+        || stored.reference.line_count != line_count(&stored.content)
+        || stored.reference.sha256 != actual_digest
+    {
+        return Err(StoreError::PasteArtifactIntegrity(artifact_id.to_string()));
+    }
+    Ok(())
+}
+
+fn sha256_hex(content: &str) -> String {
+    Sha256::digest(content.as_bytes())
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
+fn line_count(content: &str) -> u64 {
+    if content.is_empty() {
+        0
+    } else {
+        content.lines().count().max(1) as u64
+    }
+}

crates/session-store/src/public_snapshot.rs

@@ -0,0 +1,562 @@
+use base64::{
+    Engine as _,
+    engine::general_purpose::{STANDARD as BASE64, URL_SAFE_NO_PAD},
+};
+use protocol::{
+    Segment, SessionContentPart, SessionEntryProvenance, SessionMessageRole, SessionSnapshot,
+    SessionSnapshotEntry, SessionSnapshotEntryData, SessionToolAttachment,
+};
+
+use crate::{
+    LogEntry, LoggedContentPart, LoggedHistoryEntry, LoggedItem, LoggedRole,
+    LoggedSessionHistoryOrigin, SessionId, SystemItem,
+};
+
+/// Project a complete current-segment log. A valid segment starts with one
+/// canonical annotated SegmentStart record; malformed partial input uses the
+/// nil session only to keep the public failure projection deterministic.
+pub fn project_current_session_snapshot(log: &[LogEntry]) -> SessionSnapshot {
+    let session_id = log.iter().find_map(|entry| match entry {
+        LogEntry::AnnotatedSegmentStart { session_id, .. } => Some(*session_id),
+        _ => None,
+    });
+    project_session_snapshot(session_id.unwrap_or_else(SessionId::nil), log)
+}
+
+/// Project the current durable segment into the only public session-history
+/// representation. Append-log records remain an internal persistence format.
+pub fn project_session_snapshot(session_id: SessionId, log: &[LogEntry]) -> SessionSnapshot {
+    let mut session_key = session_id;
+    let mut entries = Vec::new();
+
+    for (log_index, record) in log.iter().enumerate() {
+        match record {
+            LogEntry::AnnotatedSegmentStart {
+                ts,
+                session_id,
+                history,
+                ..
+            } => {
+                session_key = *session_id;
+                entries.clear();
+                extend_history(&mut entries, history, None, *ts);
+            }
+            LogEntry::InputSegmentsCheckpoint { user_segments, .. } => {
+                let mut segments = user_segments.iter();
+                for entry in &mut entries {
+                    let is_user = matches!(
+                        &entry.data,
+                        SessionSnapshotEntryData::UserInput { .. }
+                            | SessionSnapshotEntryData::Message {
+                                role: SessionMessageRole::User,
+                                ..
+                            }
+                    );
+                    if is_user && let Some(checkpoint) = segments.next() {
+                        entry.data = SessionSnapshotEntryData::UserInput {
+                            segments: checkpoint.clone(),
+                        };
+                    }
+                }
+            }
+            LogEntry::AnnotatedUserInput {
+                ts,
+                segments,
+                history,
+                ..
+            } => extend_history(&mut entries, history, Some(segments), *ts),
+            LogEntry::AnnotatedAssistantItem { ts, entry }
+            | LogEntry::AnnotatedToolResult { ts, entry } => {
+                if let Some(data) = project_item(&entry.item) {
+                    entries.push(history_entry(entry, *ts, data));
+                }
+            }
+            LogEntry::AnnotatedSystemItem { ts, entry, .. } => entries.push(system_entry(
+                &entry.item,
+                entry.metadata.entry_id.0.clone(),
+                *ts,
+                provenance(&entry.metadata.origin),
+                derivation_ids(entry),
+            )),
+            LogEntry::RunErrored { ts, message, .. } => entries.push(legacy_entry(
+                &session_key,
+                log_index,
+                0,
+                *ts,
+                SessionSnapshotEntryData::RunError {
+                    message: message.clone(),
+                },
+            )),
+            // Run checkpoints, configuration, usage, and extension state are
+            // controller/storage authority rather than committed conversation.
+            LogEntry::Invoke { .. }
+            | LogEntry::TurnEnd { .. }
+            | LogEntry::RunCompleted { .. }
+            | LogEntry::ActiveRunCheckpoint { .. }
+            | LogEntry::PausedTurnAbandoned { .. }
+            | LogEntry::ConfigChanged { .. }
+            | LogEntry::LlmUsage { .. }
+            | LogEntry::Extension { .. } => {}
+        }
+    }
+
+    SessionSnapshot {
+        pending_submissions: protocol::PendingSubmissionsSnapshot::default(),
+        entries,
+    }
+}
+
+fn extend_history(
+    output: &mut Vec<SessionSnapshotEntry>,
+    history: &[LoggedHistoryEntry],
+    input_segments: Option<&Vec<Segment>>,
+    timestamp: u64,
+) {
+    let mut attached_segments = false;
+    for entry in history {
+        let data = if !attached_segments
+            && input_segments.is_some()
+            && matches!(
+                &entry.item,
+                LoggedItem::Message {
+                    role: LoggedRole::User,
+                    ..
+                }
+            ) {
+            attached_segments = true;
+            SessionSnapshotEntryData::UserInput {
+                segments: input_segments.cloned().unwrap_or_default(),
+            }
+        } else {
+            let Some(data) = project_item(&entry.item) else {
+                continue;
+            };
+            data
+        };
+        output.push(history_entry(entry, timestamp, data));
+    }
+}
+
+fn history_entry(
+    entry: &LoggedHistoryEntry,
+    timestamp: u64,
+    data: SessionSnapshotEntryData,
+) -> SessionSnapshotEntry {
+    SessionSnapshotEntry {
+        entry_id: entry.metadata.entry_id.0.clone(),
+        timestamp,
+        provenance: provenance(&entry.metadata.origin),
+        derived_from: entry
+            .metadata
+            .derivation
+            .as_ref()
+            .map(|derivation| {
+                derivation
+                    .sources
+                    .iter()
+                    .map(|source| source.0.clone())
+                    .collect()
+            })
+            .unwrap_or_default(),
+        data,
+    }
+}
+
+fn derivation_ids(entry: &crate::LoggedSystemHistoryEntry) -> Vec<String> {
+    entry
+        .metadata
+        .derivation
+        .as_ref()
+        .map(|derivation| {
+            derivation
+                .sources
+                .iter()
+                .map(|source| source.0.clone())
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+fn legacy_entry(
+    session_key: &SessionId,
+    log_index: usize,
+    item_index: usize,
+    timestamp: u64,
+    data: SessionSnapshotEntryData,
+) -> SessionSnapshotEntry {
+    SessionSnapshotEntry {
+        entry_id: legacy_entry_id(session_key, log_index, item_index),
+        timestamp,
+        provenance: SessionEntryProvenance::LegacyUnknown,
+        derived_from: Vec::new(),
+        data,
+    }
+}
+
+fn legacy_entry_id(session_key: &SessionId, log_index: usize, item_index: usize) -> String {
+    let mut identity = Vec::with_capacity(32);
+    identity.extend_from_slice(session_key.as_bytes());
+    identity.extend_from_slice(&(log_index as u64).to_be_bytes());
+    identity.extend_from_slice(&(item_index as u64).to_be_bytes());
+    format!("l-{}", URL_SAFE_NO_PAD.encode(identity))
+}
+
+fn provenance(origin: &LoggedSessionHistoryOrigin) -> SessionEntryProvenance {
+    match origin {
+        LoggedSessionHistoryOrigin::HumanInput { .. } => SessionEntryProvenance::HumanInput,
+        LoggedSessionHistoryOrigin::WorkerInput { .. } => SessionEntryProvenance::WorkerInput,
+        LoggedSessionHistoryOrigin::FlowInstruction { .. } => {
+            SessionEntryProvenance::FlowInstruction
+        }
+        LoggedSessionHistoryOrigin::BackendInstruction { .. } => {
+            SessionEntryProvenance::BackendInstruction
+        }
+        LoggedSessionHistoryOrigin::ModelOutput { .. } => SessionEntryProvenance::ModelOutput,
+        LoggedSessionHistoryOrigin::ToolOutput { .. } => SessionEntryProvenance::ToolOutput,
+        LoggedSessionHistoryOrigin::DerivedSummary => SessionEntryProvenance::DerivedSummary,
+        LoggedSessionHistoryOrigin::LegacyUnknown => SessionEntryProvenance::LegacyUnknown,
+    }
+}
+
+fn project_item(item: &LoggedItem) -> Option<SessionSnapshotEntryData> {
+    match item {
+        LoggedItem::Message { role, content } => {
+            let role = match role {
+                LoggedRole::User => SessionMessageRole::User,
+                LoggedRole::Assistant => SessionMessageRole::Assistant,
+                // System prompts and instruction history never cross the public
+                // snapshot boundary. Typed SystemItems have separate records.
+                LoggedRole::System => return None,
+            };
+            Some(SessionSnapshotEntryData::Message {
+                role,
+                content: content
+                    .iter()
+                    .map(|part| match part {
+                        LoggedContentPart::Text { text } => {
+                            SessionContentPart::Text { text: text.clone() }
+                        }
+                        LoggedContentPart::Refusal { refusal } => SessionContentPart::Refusal {
+                            refusal: refusal.clone(),
+                        },
+                    })
+                    .collect(),
+            })
+        }
+        LoggedItem::ToolCall {
+            call_id,
+            name,
+            arguments,
+        } => Some(SessionSnapshotEntryData::ToolCall {
+            call_id: call_id.clone(),
+            name: name.clone(),
+            arguments: arguments.clone(),
+        }),
+        LoggedItem::ToolResult {
+            call_id,
+            summary,
+            content,
+            is_error,
+            attachments,
+            ..
+        } => Some(SessionSnapshotEntryData::ToolResult {
+            call_id: call_id.clone(),
+            summary: summary.clone(),
+            content: content.clone(),
+            is_error: *is_error,
+            attachments: attachments
+                .iter()
+                .map(|attachment| match attachment {
+                    crate::logged_item::LoggedAttachment::Image { mime_type, data } => {
+                        SessionToolAttachment {
+                            media_type: mime_type.clone(),
+                            data_base64: BASE64.encode(data),
+                        }
+                    }
+                })
+                .collect(),
+        }),
+        // Hidden model reasoning is never observable.
+        LoggedItem::Reasoning { .. } => None,
+    }
+}
+
+fn system_entry(
+    item: &SystemItem,
+    entry_id: String,
+    timestamp: u64,
+    provenance: SessionEntryProvenance,
+    derived_from: Vec<String>,
+) -> SessionSnapshotEntry {
+    let mut data = serde_json::to_value(item).ok();
+    if let Some(serde_json::Value::Object(object)) = data.as_mut() {
+        object.remove("prompt_provenance");
+    }
+    let item_kind = data
+        .as_ref()
+        .and_then(|value| value.get("kind"))
+        .and_then(serde_json::Value::as_str)
+        .unwrap_or("system_item")
+        .to_owned();
+    SessionSnapshotEntry {
+        entry_id,
+        timestamp,
+        provenance,
+        derived_from,
+        data: SessionSnapshotEntryData::SystemItem {
+            item_kind,
+            content: item.history_text(),
+            data,
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use agen::llm_client::RequestConfig;
+
+    use super::*;
+    use crate::{
+        LoggedHistoryDerivation, LoggedSessionHistoryEntryId, LoggedSessionHistoryMetadata,
+        LoggedWorkerSubject,
+    };
+
+    #[test]
+    fn current_projection_is_stable_and_hides_reasoning_and_system_prompts() {
+        let session_id = crate::new_session_id();
+        let log = vec![LogEntry::AnnotatedSegmentStart {
+            ts: 1,
+            session_id,
+            system_prompt: None,
+            config: RequestConfig::default(),
+            history: vec![
+                LoggedItem::Message {
+                    role: LoggedRole::System,
+                    content: vec![LoggedContentPart::Text {
+                        text: "secret prompt".into(),
+                    }],
+                },
+                LoggedItem::Reasoning {
+                    text: "secret reasoning".into(),
+                    summary: Vec::new(),
+                    encrypted_content: None,
+                    signature: None,
+                },
+                LoggedItem::Message {
+                    role: LoggedRole::Assistant,
+                    content: vec![LoggedContentPart::Text {
+                        text: "visible".into(),
+                    }],
+                },
+            ]
+            .into_iter()
+            .map(|item| LoggedHistoryEntry {
+                item,
+                metadata: LoggedSessionHistoryMetadata {
+                    entry_id: LoggedSessionHistoryEntryId::new(),
+                    origin: LoggedSessionHistoryOrigin::LegacyUnknown,
+                    derivation: None,
+                },
+            })
+            .collect(),
+            forked_from: None,
+            compacted_from: None,
+        }];
+
+        let first = project_session_snapshot(session_id, &log);
+        let second = project_session_snapshot(session_id, &log);
+        assert_eq!(first, second);
+        assert_eq!(first.entries.len(), 1);
+        assert_eq!(first.entries[0].timestamp, 1);
+        assert_eq!(
+            first.entries[0].provenance,
+            SessionEntryProvenance::LegacyUnknown
+        );
+        let json = serde_json::to_string(&first).unwrap();
+        assert!(!json.contains("secret prompt"));
+        assert!(!json.contains("secret reasoning"));
+        assert!(json.contains("visible"));
+    }
+
+    #[test]
+    fn compacted_checkpoint_restores_uploaded_file_segments() {
+        let session_id = crate::new_session_id();
+        let user_entry_id = LoggedSessionHistoryEntryId::new();
+        let file = protocol::UploadedFileRef {
+            artifact_id: "019ca7c8-57b6-7f05-8edf-524147aba7b3".into(),
+            file_name: "notes.md".into(),
+            media_type: "text/markdown".into(),
+            created_at_ms: 7,
+            availability: protocol::UploadedFileAvailability::Available,
+            byte_len: 12,
+            sha256: "a".repeat(64),
+            source_entry_id: Some(user_entry_id.0.clone()),
+        };
+        let segment = Segment::UploadedFile { file };
+        let log = vec![
+            LogEntry::AnnotatedSegmentStart {
+                ts: 10,
+                session_id,
+                system_prompt: None,
+                config: RequestConfig::default(),
+                history: vec![LoggedHistoryEntry {
+                    item: LoggedItem::Message {
+                        role: LoggedRole::User,
+                        content: vec![LoggedContentPart::Text {
+                            text: "[Attached file: notes.md]".into(),
+                        }],
+                    },
+                    metadata: LoggedSessionHistoryMetadata {
+                        entry_id: user_entry_id,
+                        origin: LoggedSessionHistoryOrigin::HumanInput {
+                            account_id: "account-1".into(),
+                        },
+                        derivation: None,
+                    },
+                }],
+                forked_from: None,
+                compacted_from: Some(crate::SegmentOrigin {
+                    segment_id: crate::new_segment_id(),
+                    at_turn_index: 1,
+                }),
+            },
+            LogEntry::InputSegmentsCheckpoint {
+                ts: 10,
+                user_segments: vec![vec![segment.clone()]],
+            },
+        ];
+
+        let snapshot = project_current_session_snapshot(&log);
+        assert_eq!(
+            snapshot.entries[0].data,
+            SessionSnapshotEntryData::UserInput {
+                segments: vec![segment]
+            }
+        );
+    }
+
+    #[test]
+    fn annotated_user_input_attaches_segments_to_first_user_role_entry_for_any_origin() {
+        let session_id = crate::new_session_id();
+        let segments = vec![Segment::Text {
+            content: "normal submit".into(),
+        }];
+
+        for origin in [
+            LoggedSessionHistoryOrigin::LegacyUnknown,
+            LoggedSessionHistoryOrigin::FlowInstruction {
+                selector: "builtin:coder-review".into(),
+                definition_id: "flow-definition".into(),
+                definition_revision: 7,
+                instance_id: "flow-instance".into(),
+                state_id: "implement".into(),
+            },
+        ] {
+            let user_entry_id = LoggedSessionHistoryEntryId::new();
+            let source_entry_id = LoggedSessionHistoryEntryId::new();
+            let log = vec![
+                LogEntry::AnnotatedSegmentStart {
+                    ts: 1,
+                    session_id,
+                    system_prompt: None,
+                    config: RequestConfig::default(),
+                    history: Vec::new(),
+                    forked_from: None,
+                    compacted_from: None,
+                },
+                LogEntry::AnnotatedUserInput {
+                    ts: 2,
+                    segments: segments.clone(),
+                    history: vec![
+                        LoggedHistoryEntry {
+                            item: LoggedItem::Message {
+                                role: LoggedRole::System,
+                                content: vec![LoggedContentPart::Text {
+                                    text: "flow instruction".into(),
+                                }],
+                            },
+                            metadata: LoggedSessionHistoryMetadata {
+                                entry_id: LoggedSessionHistoryEntryId::new(),
+                                origin: LoggedSessionHistoryOrigin::FlowInstruction {
+                                    selector: "builtin:coder-review".into(),
+                                    definition_id: "flow-definition".into(),
+                                    definition_revision: 7,
+                                    instance_id: "flow-instance".into(),
+                                    state_id: "implement".into(),
+                                },
+                                derivation: None,
+                            },
+                        },
+                        LoggedHistoryEntry {
+                            item: LoggedItem::Message {
+                                role: LoggedRole::User,
+                                content: vec![LoggedContentPart::Text {
+                                    text: "normal submit".into(),
+                                }],
+                            },
+                            metadata: LoggedSessionHistoryMetadata {
+                                entry_id: user_entry_id.clone(),
+                                origin: origin.clone(),
+                                derivation: Some(LoggedHistoryDerivation {
+                                    sources: vec![source_entry_id.clone()],
+                                }),
+                            },
+                        },
+                    ],
+                    extensions: Vec::new(),
+                },
+            ];
+
+            let snapshot = project_current_session_snapshot(&log);
+            assert_eq!(snapshot.entries.len(), 1);
+            assert_eq!(snapshot.entries[0].entry_id, user_entry_id.0);
+            assert_eq!(snapshot.entries[0].provenance, provenance(&origin));
+            assert_eq!(snapshot.entries[0].derived_from, vec![source_entry_id.0]);
+            assert_eq!(
+                snapshot.entries[0].data,
+                SessionSnapshotEntryData::UserInput {
+                    segments: segments.clone(),
+                }
+            );
+        }
+    }
+
+    #[test]
+    fn annotated_projection_preserves_identity_and_provenance() {
+        let session_id = crate::new_session_id();
+        let metadata = LoggedSessionHistoryMetadata {
+            entry_id: LoggedSessionHistoryEntryId::new(),
+            origin: LoggedSessionHistoryOrigin::ModelOutput {
+                worker: LoggedWorkerSubject {
+                    workspace_id: None,
+                    runtime_id: None,
+                    worker_id: "worker".into(),
+                },
+            },
+            derivation: None,
+        };
+        let expected_id = metadata.entry_id.0.clone();
+        let log = vec![LogEntry::AnnotatedSegmentStart {
+            ts: 1,
+            session_id,
+            system_prompt: None,
+            config: RequestConfig::default(),
+            history: vec![LoggedHistoryEntry {
+                item: LoggedItem::Message {
+                    role: LoggedRole::Assistant,
+                    content: vec![LoggedContentPart::Text { text: "ok".into() }],
+                },
+                metadata,
+            }],
+            forked_from: None,
+            compacted_from: None,
+        }];
+
+        let snapshot = project_session_snapshot(session_id, &log);
+        assert_eq!(snapshot.entries[0].entry_id, expected_id);
+        assert_eq!(
+            snapshot.entries[0].provenance,
+            SessionEntryProvenance::ModelOutput
+        );
+    }
+}

crates/session-store/src/segment.rs

@@ -4,11 +4,9 @@
 //! The caller (typically Worker) holds the Engine directly and calls these
 //! functions after state-mutating operations.
 
-use crate::logged_item::{LoggedItem, to_logged};
 use crate::segment_log::{self, LogEntry, SegmentOrigin};
 use crate::store::{Store, StoreError};
-use crate::system_item::SystemItem;
-use crate::{SegmentId, SessionId};
+use crate::{LoggedHistoryEntry, LoggedSystemHistoryEntry, SegmentId, SessionId};
 use agen::EngineResult;
 use agen::llm_client::RequestConfig;
 use agen::llm_client::types::Item;
@@ -18,7 +16,34 @@ use protocol::Segment;
 pub struct SegmentStartState<'a> {
     pub system_prompt: Option<&'a str>,
     pub config: &'a RequestConfig,
-    pub history: &'a [Item],
+    pub history: Vec<LoggedHistoryEntry>,
+    pub user_segments: Vec<Vec<Segment>>,
+}
+
+fn seed_entries(
+    ts: u64,
+    session_id: SessionId,
+    state: SegmentStartState<'_>,
+    forked_from: Option<SegmentOrigin>,
+    compacted_from: Option<SegmentOrigin>,
+) -> Vec<LogEntry> {
+    let entry = LogEntry::AnnotatedSegmentStart {
+        ts,
+        session_id,
+        system_prompt: state.system_prompt.map(String::from),
+        config: state.config.clone(),
+        history: state.history,
+        forked_from,
+        compacted_from,
+    };
+    let mut entries = vec![entry];
+    if !state.user_segments.is_empty() {
+        entries.push(LogEntry::InputSegmentsCheckpoint {
+            ts,
+            user_segments: state.user_segments,
+        });
+    }
+    entries
 }
 
 /// Create a new session + initial segment, writing the initial
@@ -44,16 +69,8 @@ pub fn create_segment_with_ids(
     segment_id: SegmentId,
     state: SegmentStartState<'_>,
 ) -> Result<(), StoreError> {
-    let entry = LogEntry::SegmentStart {
-        ts: segment_log::now_millis(),
-        session_id,
-        system_prompt: state.system_prompt.map(String::from),
-        config: state.config.clone(),
-        history: to_logged(state.history),
-        forked_from: None,
-        compacted_from: None,
-    };
-    store.append(session_id, segment_id, &entry)
+    let entries = seed_entries(segment_log::now_millis(), session_id, state, None, None);
+    store.create_segment(session_id, segment_id, &entries)
 }
 
 /// Create a compacted segment from an existing one. Inherits the source's
@@ -70,19 +87,17 @@ pub fn create_compacted_segment(
     source_turn_count: usize,
 ) -> Result<SegmentId, StoreError> {
     let segment_id = crate::new_segment_id();
-    let entry = LogEntry::SegmentStart {
-        ts: segment_log::now_millis(),
-        session_id: source_session_id,
-        system_prompt: state.system_prompt.map(String::from),
-        config: state.config.clone(),
-        history: to_logged(state.history),
-        forked_from: None,
-        compacted_from: Some(SegmentOrigin {
+    let entries = seed_entries(
+        segment_log::now_millis(),
+        source_session_id,
+        state,
+        None,
+        Some(SegmentOrigin {
             segment_id: source_segment_id,
             at_turn_index: source_turn_count,
         }),
-    };
-    store.append(source_session_id, segment_id, &entry)?;
+    );
+    store.create_segment(source_session_id, segment_id, &entries)?;
     Ok(segment_id)
 }
 
@@ -154,21 +169,19 @@ pub fn ensure_head_or_fork(
     }
     let source_segment_id = *segment_id;
     let fork_id = crate::new_segment_id();
-    let entry = LogEntry::SegmentStart {
-        ts: segment_log::now_millis(),
+    let entries = seed_entries(
+        segment_log::now_millis(),
         session_id,
-        system_prompt: state.system_prompt.map(String::from),
-        config: state.config.clone(),
-        history: to_logged(state.history),
-        forked_from: Some(SegmentOrigin {
+        state,
+        Some(SegmentOrigin {
             segment_id: source_segment_id,
             at_turn_index,
         }),
-        compacted_from: None,
-    };
-    store.create_segment(session_id, fork_id, &[entry])?;
+        None,
+    );
+    store.create_segment(session_id, fork_id, &entries)?;
     *segment_id = fork_id;
-    *entries_written = 1;
+    *entries_written = entries.len();
     Ok(())
 }
 
@@ -183,8 +196,9 @@ pub fn save_user_input(
     session_id: SessionId,
     segment_id: SegmentId,
     segments: Vec<Segment>,
+    history: Vec<LoggedHistoryEntry>,
 ) -> Result<(), StoreError> {
-    save_user_input_with_extensions(store, session_id, segment_id, segments, Vec::new())
+    save_user_input_with_extensions(store, session_id, segment_id, segments, history, Vec::new())
 }
 
 /// Atomically persist one typed user submission and Runtime-owned session
@@ -194,15 +208,17 @@ pub fn save_user_input_with_extensions(
     session_id: SessionId,
     segment_id: SegmentId,
     segments: Vec<Segment>,
+    history: Vec<LoggedHistoryEntry>,
     extensions: Vec<segment_log::SessionExtension>,
 ) -> Result<(), StoreError> {
     append_entry(
         store,
         session_id,
         segment_id,
-        LogEntry::UserInput {
+        LogEntry::AnnotatedUserInput {
             ts: segment_log::now_millis(),
             segments,
+            history,
             extensions,
         },
     )
@@ -220,64 +236,58 @@ pub fn save_delta(
     store: &impl Store,
     session_id: SessionId,
     segment_id: SegmentId,
-    new_items: &[Item],
+    new_items: &[LoggedHistoryEntry],
 ) -> Result<(), StoreError> {
     if new_items.is_empty() {
         return Ok(());
     }
 
     let ts = segment_log::now_millis();
-    for item in new_items {
+    for entry in new_items {
+        let item = Item::from(entry.item.clone());
         if item.is_user_message() {
             // Already persisted by save_user_input at submit time.
             continue;
         }
-        let entry = classify_history_item(item, ts);
+        let entry = classify_logged_history_entry(entry.clone(), ts);
         append_entry(store, session_id, segment_id, entry)?;
     }
     Ok(())
 }
 
-/// Map one history item to its singular `LogEntry` form. Used by the
-/// fallback `save_delta` path and the controller's worker-callback
-/// classifier so write classification lives in one place.
-pub fn classify_history_item(item: &Item, ts: u64) -> LogEntry {
+/// Map one annotated history entry to its singular `LogEntry` form. Used by
+/// the fallback `save_delta` path and the controller's worker-callback
+/// classifier so write classification lives in one place without discarding
+/// identity or provenance.
+/// Map one already-annotated history entry to its singular canonical record
+/// without changing its identity or provenance.
+pub fn classify_logged_history_entry(entry: LoggedHistoryEntry, ts: u64) -> LogEntry {
+    let item = Item::from(entry.item.clone());
     if item.is_tool_result() {
-        LogEntry::ToolResult {
-            ts,
-            item: LoggedItem::from(item),
-        }
-    } else if item.is_assistant_message() || item.is_tool_call() || item.is_reasoning() {
-        LogEntry::AssistantItem {
-            ts,
-            item: LoggedItem::from(item),
-        }
+        LogEntry::AnnotatedToolResult { ts, entry }
     } else {
-        // Defensive: anything else (future Item kinds) routes through
-        // AssistantItem rather than getting silently dropped.
-        LogEntry::AssistantItem {
-            ts,
-            item: LoggedItem::from(item),
-        }
+        // Assistant messages, tool calls, reasoning, and future non-user
+        // items all use the assistant-side canonical record.
+        LogEntry::AnnotatedAssistantItem { ts, entry }
     }
 }
 
-/// Append a single typed system item as `LogEntry::SystemItem`. Helper
-/// for the Worker-side interceptor commit path; mirrors the per-item
-/// commit shape used for assistant / tool result entries.
+/// Append one typed system item and its history metadata as a canonical
+/// `LogEntry::AnnotatedSystemItem`.
 pub fn append_system_item(
     store: &impl Store,
     session_id: SessionId,
     segment_id: SegmentId,
-    item: SystemItem,
+    entry: LoggedSystemHistoryEntry,
 ) -> Result<(), StoreError> {
     append_entry(
         store,
         session_id,
         segment_id,
-        LogEntry::SystemItem {
+        LogEntry::AnnotatedSystemItem {
             ts: segment_log::now_millis(),
-            item,
+            entry,
+            extensions: Vec::new(),
         },
     )
 }
@@ -426,20 +436,14 @@ pub fn save_config_changed(
 /// [`fork_at`] or [`ensure_head_or_fork`] instead.
 pub fn fork(
     store: &impl Store,
+    source_session_id: SessionId,
     state: SegmentStartState<'_>,
 ) -> Result<(SessionId, SegmentId), StoreError> {
     let session_id = crate::new_session_id();
     let fork_id = crate::new_segment_id();
-    let entry = LogEntry::SegmentStart {
-        ts: segment_log::now_millis(),
-        session_id,
-        system_prompt: state.system_prompt.map(String::from),
-        config: state.config.clone(),
-        history: to_logged(state.history),
-        forked_from: None,
-        compacted_from: None,
-    };
-    store.create_segment(session_id, fork_id, &[entry])?;
+    let entries = seed_entries(segment_log::now_millis(), session_id, state, None, None);
+    store.create_segment(session_id, fork_id, &entries)?;
+    store.copy_committed_uploaded_files(source_session_id, session_id)?;
     Ok((session_id, fork_id))
 }
 
@@ -466,11 +470,18 @@ pub fn fork_at(
 ) -> Result<SegmentId, StoreError> {
     let entries = store.read_all(source_session_id, source_id)?;
     let cut = if at_turn_index == 0 {
-        // Branch directly after the SegmentStart (or whatever opens the
-        // segment), before any turn completes.
+        // Branch from the seeded state before any new turn completes. A typed
+        // input checkpoint immediately following SegmentStart is part of that
+        // seed and must stay atomic with its annotated history.
         entries
             .iter()
-            .position(|e| !matches!(e, LogEntry::SegmentStart { .. }))
+            .position(|entry| {
+                !matches!(
+                    entry,
+                    LogEntry::AnnotatedSegmentStart { .. }
+                        | LogEntry::InputSegmentsCheckpoint { .. }
+                )
+            })
             .unwrap_or(entries.len())
     } else {
         entries
@@ -482,19 +493,27 @@ pub fn fork_at(
     let state = segment_log::collect_state(&entries[..cut]);
 
     let fork_id = crate::new_segment_id();
-    let entry = LogEntry::SegmentStart {
-        ts: segment_log::now_millis(),
+    let ts = segment_log::now_millis();
+    let entry = LogEntry::AnnotatedSegmentStart {
+        ts,
         session_id: source_session_id,
         system_prompt: state.system_prompt,
         config: state.config,
-        history: to_logged(&state.history),
+        history: state.annotated_history,
         forked_from: Some(SegmentOrigin {
             segment_id: source_id,
             at_turn_index,
         }),
         compacted_from: None,
     };
-    store.create_segment(source_session_id, fork_id, &[entry])?;
+    let mut fork_entries = vec![entry];
+    if !state.user_segments.is_empty() {
+        fork_entries.push(LogEntry::InputSegmentsCheckpoint {
+            ts,
+            user_segments: state.user_segments,
+        });
+    }
+    store.create_segment(source_session_id, fork_id, &fork_entries)?;
     Ok(fork_id)
 }
 

crates/session-store/src/segment_log.rs

@@ -14,8 +14,8 @@ use agen::{EngineResult, UsageRecord};
 use protocol::{InvokeKind, Segment};
 use serde::{Deserialize, Serialize};
 
+use crate::history::{LoggedHistoryEntry, LoggedSystemHistoryEntry};
 use crate::logged_item::LoggedItem;
-use crate::system_item::SystemItem;
 
 /// A single segment log entry, serialized as one JSONL line.
 ///
@@ -49,27 +49,28 @@ impl SessionExtension {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum LogEntry {
-    /// Segment start. Always the first entry in a segment log.
-    /// For forked segments, `history` contains the seed state from the parent.
-    SegmentStart {
+    /// Canonical segment seed. Retained entries keep their stable logical
+    /// identity and origin across fork/compaction/restore.
+    AnnotatedSegmentStart {
         ts: u64,
-        /// Session this segment belongs to. Compaction / fork inherits
-        /// the source segment's session_id; only fresh "new conversation"
-        /// segments mint a new session_id.
         session_id: crate::SessionId,
         system_prompt: Option<String>,
         config: RequestConfig,
-        history: Vec<LoggedItem>,
-        /// Origin: forked from a sibling segment at a specific turn boundary.
-        /// The referenced segment is guaranteed to share `session_id`.
+        history: Vec<LoggedHistoryEntry>,
         #[serde(default, skip_serializing_if = "Option::is_none")]
         forked_from: Option<SegmentOrigin>,
-        /// Origin: compacted from a sibling segment at a specific turn boundary.
-        /// The referenced segment is guaranteed to share `session_id`.
         #[serde(default, skip_serializing_if = "Option::is_none")]
         compacted_from: Option<SegmentOrigin>,
     },
 
+    /// Typed user-segment projection accompanying a compacted or forked
+    /// SegmentStart history snapshot. This keeps attachment identity and
+    /// metadata aligned with retained user entries without embedding bodies.
+    InputSegmentsCheckpoint {
+        ts: u64,
+        user_segments: Vec<Vec<Segment>>,
+    },
+
     /// IDLE → active marker. Records the start of a new self-driving
     /// cycle (Invoke range). The range extends implicitly until the
     /// next `Invoke` entry; this entry carries the trigger only — the
@@ -90,37 +91,31 @@ pub enum LogEntry {
     /// restore conservatively instead of re-running a dangling tool call.
     Invoke { ts: u64, trigger: InvokeKind },
 
-    /// User input accepted at submit time. Carries the original typed
-    /// `Vec<Segment>` so clients can re-render typed atoms (paste chips,
-    /// file refs) on segment restore.
-    /// Replay flattens these into a `Item::user_message` for the worker
-    /// history; the worker layer never sees segments directly.
-    UserInput {
+    /// Canonical user submission with its exact model-visible entries. Typed
+    /// Flow instructions and caller-attributed input remain separate entries.
+    AnnotatedUserInput {
         ts: u64,
         segments: Vec<Segment>,
-        /// Typed durable state committed atomically with this input record.
-        /// Runtime-owned Flow invocation uses this to avoid a Backend-instance
-        /// commit that can get ahead of Worker history.
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        extensions: Vec<SessionExtension>,
+        history: Vec<LoggedHistoryEntry>,
+    },
+
+    /// Canonical model output and metadata committed as one journal record.
+    AnnotatedAssistantItem { ts: u64, entry: LoggedHistoryEntry },
+
+    /// Canonical tool output and metadata committed as one journal record.
+    AnnotatedToolResult { ts: u64, entry: LoggedHistoryEntry },
+
+    /// Canonical typed system event and model-visible metadata committed
+    /// together.
+    AnnotatedSystemItem {
+        ts: u64,
+        entry: LoggedSystemHistoryEntry,
         #[serde(default, skip_serializing_if = "Vec::is_empty")]
         extensions: Vec<SessionExtension>,
     },
 
-    /// One assistant-side item appended to history — assistant message,
-    /// reasoning, or tool call. Singular: one entry per history item so
-    /// the wire-side `Event::*` lane and on-disk LogEntry stay 1:1.
-    AssistantItem { ts: u64, item: LoggedItem },
-
-    /// One tool-execution result appended to history.
-    ToolResult { ts: u64, item: LoggedItem },
-
-    /// One typed agent-injected system item: notification, child-Worker
-    /// lifecycle event, `@<path>` / `/<slug>` resolution payload. Each
-    /// `SystemItem` carries kind metadata that the LLM
-    /// itself never sees (the LLM gets `Item::system_message` with the
-    /// item's denormalised `body`), but live clients and replay paths
-    /// dispatch on `kind` for typed rendering.
-    SystemItem { ts: u64, item: SystemItem },
-
     /// Turn boundary. Records the turn count after increment.
     TurnEnd { ts: u64, turn_count: usize },
 
@@ -222,6 +217,10 @@ pub struct RestoredState {
     pub system_prompt: Option<String>,
     pub config: RequestConfig,
     pub history: Vec<Item>,
+    /// Canonical persisted history with stable identity and provenance. This is
+    /// the authority for rewrites, forks, and annotated restore; `history` is
+    /// retained as the model-facing item projection.
+    pub annotated_history: Vec<LoggedHistoryEntry>,
     pub turn_count: usize,
     /// AgentTurns consumed by the active paused/yielded logical run.
     pub active_run_turn_count: Option<usize>,
@@ -238,7 +237,7 @@ pub struct RestoredState {
     /// session-store は domain を不透明扱いし、各ドメインが自前で fold する。
     pub extensions: Vec<(String, serde_json::Value)>,
     /// User submissions in original typed form, in submit order.
-    /// One entry per `LogEntry::UserInput`; the K-th entry corresponds to
+    /// One entry per `LogEntry::AnnotatedUserInput`; the K-th entry corresponds to
     /// the K-th `Item::user_message` derived during replay (modulo
     /// pre-compaction history seeded via `SegmentStart.history`, whose
     /// original segments are not preserved). Used by clients to re-render
@@ -253,6 +252,7 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
         system_prompt: None,
         config: RequestConfig::default(),
         history: Vec::new(),
+        annotated_history: Vec::new(),
         turn_count: 0,
         active_run_turn_count: None,
         last_run_interrupted: false,
@@ -266,7 +266,7 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
         state.entries_count += 1;
 
         match entry {
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 session_id,
                 system_prompt,
                 config,
@@ -276,7 +276,15 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
                 state.session_id = Some(*session_id);
                 state.system_prompt = system_prompt.clone();
                 state.config = config.clone();
-                state.history = history.iter().cloned().map(Item::from).collect();
+                state.annotated_history = history.clone();
+                state.history = history
+                    .iter()
+                    .cloned()
+                    .map(|entry| Item::from(entry.item))
+                    .collect();
+            }
+            LogEntry::InputSegmentsCheckpoint { user_segments, .. } => {
+                state.user_segments = user_segments.clone();
             }
             LogEntry::Invoke { .. } => {
                 // A terminal run record below clears or refines this. If the
@@ -284,13 +292,16 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
                 state.last_run_interrupted = true;
                 state.active_run_turn_count = Some(0);
             }
-            LogEntry::UserInput {
+            LogEntry::AnnotatedUserInput {
                 segments,
                 extensions,
+                history,
                 ..
             } => {
-                let text = Segment::flatten_to_text(segments);
-                state.history.push(Item::user_message(text));
+                state.annotated_history.extend(history.iter().cloned());
+                state
+                    .history
+                    .extend(history.iter().cloned().map(|entry| Item::from(entry.item)));
                 state.user_segments.push(segments.clone());
                 state.extensions.extend(
                     extensions
@@ -298,14 +309,24 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
                         .map(|extension| (extension.domain.clone(), extension.payload.clone())),
                 );
             }
-            LogEntry::AssistantItem { item, .. } => {
-                state.history.push(Item::from(item.clone()));
+            LogEntry::AnnotatedAssistantItem { entry, .. }
+            | LogEntry::AnnotatedToolResult { entry, .. } => {
+                state.annotated_history.push(entry.clone());
+                state.history.push(Item::from(entry.item.clone()));
             }
-            LogEntry::ToolResult { item, .. } => {
-                state.history.push(Item::from(item.clone()));
-            }
-            LogEntry::SystemItem { item, .. } => {
-                state.history.push(item.to_history_item());
+            LogEntry::AnnotatedSystemItem {
+                entry, extensions, ..
+            } => {
+                state.annotated_history.push(LoggedHistoryEntry {
+                    item: LoggedItem::from(entry.item.to_history_item()),
+                    metadata: entry.metadata.clone(),
+                });
+                state.history.push(entry.item.to_history_item());
+                state.extensions.extend(
+                    extensions
+                        .iter()
+                        .map(|extension| (extension.domain.clone(), extension.payload.clone())),
+                );
             }
             LogEntry::TurnEnd { turn_count, .. } => {
                 if let Some(active_turn_count) = &mut state.active_run_turn_count {
@@ -388,6 +409,20 @@ pub fn now_millis() -> u64 {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::{
+        LoggedSessionHistoryEntryId, LoggedSessionHistoryMetadata, LoggedSessionHistoryOrigin,
+    };
+
+    fn annotated(item: Item) -> LoggedHistoryEntry {
+        LoggedHistoryEntry {
+            item: LoggedItem::from(item),
+            metadata: LoggedSessionHistoryMetadata {
+                entry_id: LoggedSessionHistoryEntryId::new(),
+                origin: LoggedSessionHistoryOrigin::LegacyUnknown,
+                derivation: None,
+            },
+        }
+    }
 
     #[test]
     fn replay_empty() {
@@ -399,12 +434,12 @@ mod tests {
 
     #[test]
     fn replay_segment_start_sets_initial_state() {
-        let state = collect_state(&[LogEntry::SegmentStart {
+        let state = collect_state(&[LogEntry::AnnotatedSegmentStart {
             ts: 1000,
             session_id: uuid::Uuid::nil(),
             system_prompt: Some("You are helpful.".into()),
             config: RequestConfig::default().with_max_tokens(1024),
-            history: vec![Item::user_message("seed").into()],
+            history: vec![annotated(Item::user_message("seed"))],
             forked_from: None,
             compacted_from: None,
         }]);
@@ -417,7 +452,7 @@ mod tests {
     #[test]
     fn replay_full_turn() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1000,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -426,14 +461,15 @@ mod tests {
                 forked_from: None,
                 compacted_from: None,
             },
-            LogEntry::UserInput {
+            LogEntry::AnnotatedUserInput {
                 ts: 2000,
                 extensions: vec![],
                 segments: vec![Segment::text("Hello")],
+                history: vec![annotated(Item::user_message("Hello"))],
             },
-            LogEntry::AssistantItem {
+            LogEntry::AnnotatedAssistantItem {
                 ts: 3000,
-                item: Item::assistant_message("Hi!").into(),
+                entry: annotated(Item::assistant_message("Hi!")),
             },
             LogEntry::TurnEnd {
                 ts: 3100,
@@ -454,7 +490,7 @@ mod tests {
     #[test]
     fn replay_incomplete_invoke_is_interrupted() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1000,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -467,14 +503,15 @@ mod tests {
                 ts: 2000,
                 trigger: InvokeKind::UserSend,
             },
-            LogEntry::UserInput {
+            LogEntry::AnnotatedUserInput {
                 ts: 2001,
                 extensions: vec![],
                 segments: vec![Segment::text("run a tool")],
+                history: vec![annotated(Item::user_message("run a tool"))],
             },
-            LogEntry::AssistantItem {
+            LogEntry::AnnotatedAssistantItem {
                 ts: 3000,
-                item: Item::tool_call("call_1", "side_effect", "{}").into(),
+                entry: annotated(Item::tool_call("call_1", "side_effect", "{}")),
             },
         ]);
 
@@ -484,7 +521,7 @@ mod tests {
     #[test]
     fn replay_with_tool_calls() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1000,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -493,22 +530,27 @@ mod tests {
                 forked_from: None,
                 compacted_from: None,
             },
-            LogEntry::UserInput {
+            LogEntry::AnnotatedUserInput {
                 ts: 2000,
                 extensions: vec![],
                 segments: vec![Segment::text("Check weather")],
+                history: vec![annotated(Item::user_message("Check weather"))],
             },
-            LogEntry::AssistantItem {
+            LogEntry::AnnotatedAssistantItem {
                 ts: 3000,
-                item: Item::tool_call("call_1", "get_weather", r#"{"city":"Tokyo"}"#).into(),
+                entry: annotated(Item::tool_call(
+                    "call_1",
+                    "get_weather",
+                    r#"{"city":"Tokyo"}"#,
+                )),
             },
-            LogEntry::ToolResult {
+            LogEntry::AnnotatedToolResult {
                 ts: 3500,
-                item: Item::tool_result("call_1", "Sunny, 25C").into(),
+                entry: annotated(Item::tool_result("call_1", "Sunny, 25C")),
             },
-            LogEntry::AssistantItem {
+            LogEntry::AnnotatedAssistantItem {
                 ts: 4000,
-                item: Item::assistant_message("It's sunny in Tokyo!").into(),
+                entry: annotated(Item::assistant_message("It's sunny in Tokyo!")),
             },
             LogEntry::TurnEnd {
                 ts: 4100,
@@ -522,9 +564,9 @@ mod tests {
 
     #[test]
     fn replay_restores_durable_tool_image_detail() {
-        let entry = LogEntry::ToolResult {
+        let entry = LogEntry::AnnotatedToolResult {
             ts: 3500,
-            item: Item::tool_result_item_with_attachments(
+            entry: annotated(Item::tool_result_item_with_attachments(
                 "call_image",
                 "attached",
                 None,
@@ -532,8 +574,7 @@ mod tests {
                 vec![agen::tool::Attachment::Image(
                     agen::tool::ImageAttachment::new("image/png", b"durable-image".to_vec()),
                 )],
-            )
-            .into(),
+            )),
         };
         let persisted = serde_json::to_string(&entry).unwrap();
         let restored_entry: LogEntry = serde_json::from_str(&persisted).unwrap();
@@ -553,7 +594,7 @@ mod tests {
     #[test]
     fn replay_config_changed() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1000,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -573,7 +614,7 @@ mod tests {
     #[test]
     fn replay_llm_usage_appends_to_usage_history() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1000,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -582,10 +623,11 @@ mod tests {
                 forked_from: None,
                 compacted_from: None,
             },
-            LogEntry::UserInput {
+            LogEntry::AnnotatedUserInput {
                 ts: 2000,
                 extensions: vec![],
                 segments: vec![Segment::text("hi")],
+                history: vec![annotated(Item::user_message("hi"))],
             },
             LogEntry::LlmUsage {
                 ts: 2100,
@@ -595,9 +637,9 @@ mod tests {
                 cache_write_tokens: 0,
                 output_tokens: 10,
             },
-            LogEntry::AssistantItem {
+            LogEntry::AnnotatedAssistantItem {
                 ts: 2200,
-                item: Item::assistant_message("yo").into(),
+                entry: annotated(Item::assistant_message("yo")),
             },
             LogEntry::LlmUsage {
                 ts: 3100,
@@ -621,7 +663,7 @@ mod tests {
     #[test]
     fn replay_without_llm_usage_keeps_usage_history_empty() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1000,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -630,10 +672,11 @@ mod tests {
                 forked_from: None,
                 compacted_from: None,
             },
-            LogEntry::UserInput {
+            LogEntry::AnnotatedUserInput {
                 ts: 2000,
                 extensions: vec![],
                 segments: vec![Segment::text("hi")],
+                history: vec![annotated(Item::user_message("hi"))],
             },
         ]);
         assert!(state.usage_history.is_empty());
@@ -694,7 +737,7 @@ mod tests {
     #[test]
     fn replay_invoke_marker_only_mutates_interrupted_state() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 0,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -707,10 +750,11 @@ mod tests {
                 ts: 100,
                 trigger: InvokeKind::UserSend,
             },
-            LogEntry::UserInput {
+            LogEntry::AnnotatedUserInput {
                 ts: 101,
                 extensions: vec![],
                 segments: vec![Segment::text("hi")],
+                history: vec![annotated(Item::user_message("hi"))],
             },
             LogEntry::TurnEnd {
                 ts: 200,
@@ -729,7 +773,7 @@ mod tests {
     #[test]
     fn replay_paused_turn_abandoned_clears_interrupted_marker() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 0,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -753,7 +797,7 @@ mod tests {
     #[test]
     fn replay_restores_active_run_budget_across_compaction_checkpoint() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 0,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -784,7 +828,7 @@ mod tests {
         }))
         .expect("legacy run-completed entry");
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 0,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -847,7 +891,7 @@ mod tests {
     #[test]
     fn replay_extension_collects_domain_payload_pairs() {
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1000,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,
@@ -906,9 +950,12 @@ mod tests {
     #[test]
     fn user_input_extensions_restore_with_the_same_committed_input() {
         let segments = vec![Segment::text("Flow instructions"), Segment::text("Ticket")];
-        let entry = LogEntry::UserInput {
+        let entry = LogEntry::AnnotatedUserInput {
             ts: 9999,
             segments: segments.clone(),
+            history: vec![annotated(Item::user_message(Segment::flatten_to_text(
+                &segments,
+            )))],
             extensions: vec![SessionExtension::new(
                 "flow.runtime.v1",
                 serde_json::json!({ "state": "implement", "revision": 0 }),
@@ -923,7 +970,7 @@ mod tests {
         assert_eq!(state.extensions[0].1["state"], "implement");
     }
 
-    /// Mixed segments survive a JSON round-trip through `LogEntry::UserInput`,
+    /// Mixed segments survive a JSON round-trip through `LogEntry::AnnotatedUserInput`,
     /// and `collect_state` derives `Item::user_message` from the flattened
     /// text while preserving the original segments separately. This covers
     /// the segments → flatten → Item replay path from the ticket.
@@ -943,16 +990,19 @@ mod tests {
                 path: "src/main.rs".into(),
             },
         ];
-        let entry = LogEntry::UserInput {
+        let entry = LogEntry::AnnotatedUserInput {
             ts: 4242,
             extensions: vec![],
             segments: segments.clone(),
+            history: vec![annotated(Item::user_message(Segment::flatten_to_text(
+                &segments,
+            )))],
         };
         // JSON round-trip preserves the variant byte-for-byte.
         let json = serde_json::to_string(&entry).unwrap();
         let parsed: LogEntry = serde_json::from_str(&json).unwrap();
         let state = collect_state(&[
-            LogEntry::SegmentStart {
+            LogEntry::AnnotatedSegmentStart {
                 ts: 1,
                 session_id: uuid::Uuid::nil(),
                 system_prompt: None,

crates/session-store/src/store.rs

@@ -13,7 +13,10 @@
 
 use crate::event_trace::TraceEntry;
 use crate::segment_log::LogEntry;
-use crate::{SegmentId, SessionId};
+use crate::{
+    PasteArtifactLimits, SegmentId, SessionId, UploadedFileLimits, UploadedFileUploadContext,
+};
+use protocol::{PasteArtifactRef, UploadedFileRef};
 
 /// Errors from the persistence store.
 #[derive(Debug, thiserror::Error)]
@@ -29,6 +32,42 @@ pub enum StoreError {
 
     #[error("log corrupted at line {line}: {message}")]
     Corrupt { line: usize, message: String },
+
+    #[error("paste artifact storage is unavailable")]
+    PasteArtifactUnsupported,
+
+    #[error("paste artifact not found: {0}")]
+    PasteArtifactNotFound(String),
+
+    #[error("paste artifact integrity check failed: {0}")]
+    PasteArtifactIntegrity(String),
+
+    #[error("paste artifact size limit exceeded: {0}")]
+    PasteArtifactLimit(String),
+
+    #[error("uploaded file is too large")]
+    ArtifactTooLarge,
+
+    #[error("session artifact aggregate quota exceeded")]
+    ArtifactQuotaExceeded,
+
+    #[error("uploaded file reference integrity check failed")]
+    ArtifactIntegrityMismatch,
+
+    #[error("uploaded file name is invalid")]
+    InvalidUploadedFileName,
+
+    #[error("uploaded file media type is invalid")]
+    InvalidUploadedFileMediaType,
+
+    #[error("uploaded file is already committed to session history")]
+    ArtifactAlreadyCommitted,
+
+    #[error("artifact id is invalid")]
+    InvalidArtifactId,
+
+    #[error("artifact timestamp is invalid")]
+    InvalidTimestamp,
 }
 
 /// Sync persistence backend for segment logs.
@@ -117,6 +156,138 @@ pub trait Store: Send + Sync {
         segment_id: SegmentId,
     ) -> Result<usize, StoreError>;
 
+    /// Store a large paste before its reference is committed to history.
+    fn write_paste_artifact(
+        &self,
+        _session_id: SessionId,
+        _source_entry_id: &str,
+        _content: &str,
+        _limits: PasteArtifactLimits,
+    ) -> Result<PasteArtifactRef, StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    /// Read and verify one artifact owned by `session_id`.
+    fn read_paste_artifact(
+        &self,
+        _session_id: SessionId,
+        _artifact_id: &str,
+    ) -> Result<(PasteArtifactRef, String), StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    /// Persist a client-local file before a submission references it.
+    fn write_uploaded_file(
+        &self,
+        _session_id: SessionId,
+        _file_name: &str,
+        _media_type: &str,
+        _content: &[u8],
+        _limits: UploadedFileLimits,
+    ) -> Result<UploadedFileRef, StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    fn write_uploaded_file_with_context(
+        &self,
+        session_id: SessionId,
+        file_name: &str,
+        media_type: &str,
+        content: &[u8],
+        _context: &UploadedFileUploadContext,
+        limits: UploadedFileLimits,
+    ) -> Result<UploadedFileRef, StoreError> {
+        self.write_uploaded_file(session_id, file_name, media_type, content, limits)
+    }
+
+    /// Read and integrity-check an uploaded file owned by `session_id`.
+    fn read_uploaded_file(
+        &self,
+        _session_id: SessionId,
+        _reference: &UploadedFileRef,
+    ) -> Result<Vec<u8>, StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    fn read_uploaded_file_by_id(
+        &self,
+        _session_id: SessionId,
+        _artifact_id: &str,
+    ) -> Result<(UploadedFileRef, Vec<u8>), StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    fn bind_uploaded_file(
+        &self,
+        _session_id: SessionId,
+        _reference: &UploadedFileRef,
+        _source_entry_id: &str,
+    ) -> Result<UploadedFileRef, StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    /// Retain an uploaded file while a durable pending operation owns it.
+    fn pin_uploaded_file(
+        &self,
+        _session_id: SessionId,
+        _reference: &UploadedFileRef,
+        _owner_id: &str,
+    ) -> Result<(), StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    /// Release a pending-operation pin without changing committed ownership.
+    fn release_uploaded_file_pin(
+        &self,
+        _session_id: SessionId,
+        _artifact_id: &str,
+        _owner_id: &str,
+    ) -> Result<(), StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    /// Complete the pending-to-history handoff after the history entry commits.
+    fn finalize_uploaded_file_binding(
+        &self,
+        _session_id: SessionId,
+        _artifact_id: &str,
+        _source_entry_id: &str,
+    ) -> Result<(), StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    /// Clear pending-operation pins that have no owner in restored durable
+    /// Worker Session state. This repairs an interrupted pin-before-checkpoint
+    /// acceptance without disturbing live queue owners or committed history.
+    fn reconcile_uploaded_file_pins(
+        &self,
+        _session_id: SessionId,
+        _live_owner_ids: &[String],
+    ) -> Result<u64, StoreError> {
+        Ok(0)
+    }
+
+    /// Delete an uncommitted uploaded file owned by `session_id`.
+    fn delete_uploaded_file(
+        &self,
+        _session_id: SessionId,
+        _artifact_id: &str,
+    ) -> Result<bool, StoreError> {
+        Err(StoreError::PasteArtifactUnsupported)
+    }
+
+    fn delete_uncommitted_uploaded_files(&self, _session_id: SessionId) -> Result<u64, StoreError> {
+        Ok(0)
+    }
+
+    fn copy_committed_uploaded_files(
+        &self,
+        _source_session_id: SessionId,
+        _target_session_id: SessionId,
+    ) -> Result<u64, StoreError> {
+        Ok(0)
+    }
+
     /// Append a trace entry to the debug event trace file.
     fn append_trace(
         &self,

crates/session-store/src/system_item.rs

@@ -8,7 +8,7 @@
 //! `kind` instead of parsing text prefixes like `[Notification] …` or
 //! `[File: …]`.
 //!
-//! Persisted as the payload of [`crate::LogEntry::SystemItem`] (one
+//! Persisted as the payload of [`crate::LogEntry::AnnotatedSystemItem`] (one
 //! entry per item), and broadcast live as the payload of
 //! `Event::SystemItem` on the wire.
 //!

crates/session-store/src/uploaded_file.rs

@@ -0,0 +1,675 @@
+use std::{
+    fs,
+    path::Path,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
+use fs4::fs_std::FileExt;
+use protocol::{UploadedFileAvailability, UploadedFileRef};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use unicode_normalization::UnicodeNormalization;
+use unicode_properties::general_category::{GeneralCategory, UnicodeGeneralCategory};
+use unicode_security::{confusable_detection::skeleton, mixed_script::MixedScript};
+use uuid::Uuid;
+
+use crate::StoreError;
+
+type Result<T> = std::result::Result<T, StoreError>;
+
+pub const DEFAULT_MAX_UPLOADED_FILE_BYTES: u64 = 10 * 1024 * 1024;
+pub const DEFAULT_MAX_SESSION_ARTIFACT_BYTES: u64 = 32 * 1024 * 1024;
+pub const DEFAULT_MAX_FILES_PER_SUBMISSION: usize = 8;
+pub const DEFAULT_MAX_SESSION_UPLOADED_FILES: u64 = 256;
+const MAX_FILE_NAME_CHARS: usize = 255;
+const MAX_MEDIA_TYPE_BYTES: usize = 127;
+fn validate_pending_owner_id(owner_id: &str) -> Result<()> {
+    if owner_id.is_empty() || owner_id.len() > 256 {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct UploadedFileLimits {
+    pub max_file_bytes: u64,
+    pub max_session_bytes: u64,
+}
+
+impl Default for UploadedFileLimits {
+    fn default() -> Self {
+        Self {
+            max_file_bytes: DEFAULT_MAX_UPLOADED_FILE_BYTES,
+            max_session_bytes: DEFAULT_MAX_SESSION_ARTIFACT_BYTES,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UploadedFileUploadContext {
+    pub upload_id: String,
+    pub principal_id: String,
+    pub workspace_id: String,
+    pub runtime_id: String,
+    pub worker_id: String,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct StoredUploadedFile {
+    file_name: String,
+    media_type: String,
+    created_at_ms: u64,
+    byte_len: u64,
+    sha256: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    source_entry_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pending_owner_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    upload_context: Option<UploadedFileUploadContext>,
+    content_base64: String,
+}
+
+pub(crate) fn validate_file_name(file_name: &str) -> Result<()> {
+    let normalized: String = file_name.nfkc().collect();
+    let has_unsafe_component = file_name
+        .split('.')
+        .filter(|part| !part.is_empty())
+        .any(|part| {
+            let confusable_skeleton: String = skeleton(part).collect();
+            let ascii_confusable = part.chars().any(|ch| !ch.is_ascii())
+                && confusable_skeleton.is_ascii()
+                && !confusable_skeleton.eq_ignore_ascii_case(part);
+            !part.is_single_script() || ascii_confusable
+        });
+
+    if file_name.is_empty()
+        || file_name.chars().count() > MAX_FILE_NAME_CHARS
+        || file_name == "."
+        || file_name == ".."
+        || normalized != file_name
+        || has_unsafe_component
+        || file_name.chars().any(|ch| {
+            ch.is_control()
+                || ch.general_category() == GeneralCategory::Format
+                || matches!(ch, '/' | '\\')
+        })
+    {
+        return Err(StoreError::InvalidUploadedFileName);
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_media_type(media_type: &str) -> Result<()> {
+    let valid = !media_type.is_empty()
+        && media_type.len() <= MAX_MEDIA_TYPE_BYTES
+        && media_type.is_ascii()
+        && !media_type
+            .bytes()
+            .any(|byte| byte.is_ascii_control() || byte == b' ')
+        && media_type.split_once('/').is_some_and(|(kind, subtype)| {
+            !kind.is_empty()
+                && !subtype.is_empty()
+                && kind.bytes().chain(subtype.bytes()).all(|byte| {
+                    byte.is_ascii_alphanumeric()
+                        || matches!(
+                            byte,
+                            b'!' | b'#' | b'$' | b'&' | b'^' | b'_' | b'.' | b'+' | b'-'
+                        )
+                })
+        });
+    let allowed = media_type.starts_with("text/")
+        || matches!(
+            media_type,
+            "application/json"
+                | "application/pdf"
+                | "image/png"
+                | "image/jpeg"
+                | "image/gif"
+                | "image/webp"
+        );
+    if !valid || !allowed {
+        return Err(StoreError::InvalidUploadedFileMediaType);
+    }
+    Ok(())
+}
+
+fn normalized_file_name(file_name: &str) -> String {
+    file_name.nfkc().flat_map(char::to_lowercase).collect()
+}
+
+fn validate_content(media_type: &str, content: &[u8]) -> Result<()> {
+    if content.is_empty() {
+        return Err(StoreError::InvalidUploadedFileMediaType);
+    }
+    let matches_declared_type = if media_type.starts_with("text/") {
+        std::str::from_utf8(content).is_ok()
+    } else {
+        match media_type {
+            "application/json" => serde_json::from_slice::<serde_json::Value>(content).is_ok(),
+            "application/pdf" => content.starts_with(b"%PDF-"),
+            "image/png" => content.starts_with(b"\x89PNG\r\n\x1a\n"),
+            "image/jpeg" => content.starts_with(&[0xff, 0xd8, 0xff]),
+            "image/gif" => content.starts_with(b"GIF87a") || content.starts_with(b"GIF89a"),
+            "image/webp" => {
+                content.len() >= 12 && content.starts_with(b"RIFF") && &content[8..12] == b"WEBP"
+            }
+            _ => false,
+        }
+    };
+    if !matches_declared_type {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    Ok(())
+}
+
+fn record_path(dir: &Path, artifact_id: &str) -> Result<std::path::PathBuf> {
+    let id = Uuid::parse_str(artifact_id).map_err(|_| StoreError::InvalidArtifactId)?;
+    Ok(dir.join(format!("{id}.file.json")))
+}
+
+fn now_ms() -> Result<u64> {
+    let value = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_err(|_| StoreError::InvalidTimestamp)?
+        .as_millis();
+    u64::try_from(value).map_err(|_| StoreError::InvalidTimestamp)
+}
+
+fn digest(bytes: &[u8]) -> String {
+    Sha256::digest(bytes)
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
+pub(crate) fn stored_uploaded_file_usage(dir: &Path) -> Result<(u64, u64)> {
+    if !dir.exists() {
+        return Ok((0, 0));
+    }
+    let mut bytes = 0_u64;
+    let mut count = 0_u64;
+    for entry in fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        if !entry.file_type()?.is_file()
+            || !path
+                .file_name()
+                .and_then(|name| name.to_str())
+                .is_some_and(|name| name.ends_with(".file.json"))
+        {
+            continue;
+        }
+        let stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+        bytes = bytes
+            .checked_add(stored.byte_len)
+            .ok_or(StoreError::ArtifactQuotaExceeded)?;
+        count = count
+            .checked_add(1)
+            .ok_or(StoreError::ArtifactQuotaExceeded)?;
+    }
+    Ok((bytes, count))
+}
+
+pub(crate) fn write_uploaded_file(
+    dir: &Path,
+    file_name: &str,
+    media_type: &str,
+    content: &[u8],
+    context: Option<&UploadedFileUploadContext>,
+    limits: UploadedFileLimits,
+) -> Result<UploadedFileRef> {
+    validate_file_name(file_name)?;
+    validate_media_type(media_type)?;
+    validate_content(media_type, content)?;
+    let byte_len = u64::try_from(content.len()).map_err(|_| StoreError::ArtifactTooLarge)?;
+    let sha256 = digest(content);
+    if byte_len > limits.max_file_bytes {
+        return Err(StoreError::ArtifactTooLarge);
+    }
+
+    fs::create_dir_all(dir)?;
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let (paste_bytes, _) = crate::paste_artifact::stored_paste_usage(dir)?;
+    let (file_bytes, file_count) = stored_uploaded_file_usage(dir)?;
+    let normalized_name = normalized_file_name(file_name);
+    for entry in fs::read_dir(dir)? {
+        let path = entry?.path();
+        if !path
+            .file_name()
+            .and_then(|name| name.to_str())
+            .is_some_and(|name| name.ends_with(".file.json"))
+        {
+            continue;
+        }
+        let stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+        let same_context = context.is_some() && stored.upload_context.as_ref() == context;
+        let same_uncommitted_name = stored.source_entry_id.is_none()
+            && normalized_file_name(&stored.file_name) == normalized_name;
+        if same_context || same_uncommitted_name {
+            if stored.file_name == file_name
+                && stored.media_type == media_type
+                && stored.byte_len == byte_len
+                && stored.sha256 == sha256
+                && stored.upload_context.as_ref() == context
+            {
+                let artifact_id = path
+                    .file_name()
+                    .and_then(|name| name.to_str())
+                    .and_then(|name| name.strip_suffix(".file.json"))
+                    .ok_or(StoreError::InvalidArtifactId)?
+                    .to_string();
+                return Ok(UploadedFileRef {
+                    artifact_id,
+                    file_name: stored.file_name,
+                    media_type: stored.media_type,
+                    created_at_ms: stored.created_at_ms,
+                    availability: UploadedFileAvailability::Available,
+                    byte_len: stored.byte_len,
+                    sha256: stored.sha256,
+                    source_entry_id: None,
+                });
+            }
+            return Err(StoreError::InvalidUploadedFileName);
+        }
+    }
+    if file_count >= DEFAULT_MAX_SESSION_UPLOADED_FILES {
+        return Err(StoreError::ArtifactQuotaExceeded);
+    }
+    if paste_bytes
+        .checked_add(file_bytes)
+        .and_then(|total| total.checked_add(byte_len))
+        .is_none_or(|total| total > limits.max_session_bytes)
+    {
+        return Err(StoreError::ArtifactQuotaExceeded);
+    }
+
+    let artifact_id = Uuid::now_v7().to_string();
+    let created_at_ms = now_ms()?;
+    let stored = StoredUploadedFile {
+        file_name: file_name.to_owned(),
+        media_type: media_type.to_owned(),
+        created_at_ms,
+        byte_len,
+        sha256: sha256.clone(),
+        source_entry_id: None,
+        pending_owner_id: None,
+        upload_context: context.cloned(),
+        content_base64: BASE64.encode(content),
+    };
+    let path = record_path(dir, &artifact_id)?;
+    let temp = dir.join(format!(".{artifact_id}.file.tmp"));
+    fs::write(&temp, serde_json::to_vec(&stored)?)?;
+    fs::rename(&temp, &path)?;
+
+    Ok(UploadedFileRef {
+        artifact_id,
+        file_name: file_name.to_owned(),
+        media_type: media_type.to_owned(),
+        created_at_ms,
+        availability: UploadedFileAvailability::Available,
+        byte_len,
+        sha256,
+        source_entry_id: None,
+    })
+}
+
+pub(crate) fn read_uploaded_file_by_id(
+    dir: &Path,
+    artifact_id: &str,
+) -> Result<(UploadedFileRef, Vec<u8>)> {
+    let stored: StoredUploadedFile =
+        serde_json::from_slice(&fs::read(record_path(dir, artifact_id)?)?)?;
+    let content = BASE64
+        .decode(&stored.content_base64)
+        .map_err(|_| StoreError::ArtifactIntegrityMismatch)?;
+    if u64::try_from(content.len()).ok() != Some(stored.byte_len)
+        || digest(&content) != stored.sha256
+    {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    let reference = UploadedFileRef {
+        artifact_id: artifact_id.to_owned(),
+        file_name: stored.file_name,
+        media_type: stored.media_type,
+        created_at_ms: stored.created_at_ms,
+        availability: UploadedFileAvailability::Available,
+        byte_len: stored.byte_len,
+        sha256: stored.sha256,
+        source_entry_id: stored.source_entry_id,
+    };
+    Ok((reference, content))
+}
+
+pub(crate) fn uploaded_file_has_pending_owner(dir: &Path, artifact_id: &str) -> Result<bool> {
+    let path = record_path(dir, artifact_id)?;
+    let stored: StoredUploadedFile = serde_json::from_slice(&fs::read(path)?)?;
+    Ok(stored.pending_owner_id.is_some())
+}
+
+pub(crate) fn read_uploaded_file(dir: &Path, reference: &UploadedFileRef) -> Result<Vec<u8>> {
+    let (stored_reference, content) = read_uploaded_file_by_id(dir, &reference.artifact_id)?;
+    if stored_reference.file_name != reference.file_name
+        || stored_reference.media_type != reference.media_type
+        || stored_reference.created_at_ms != reference.created_at_ms
+        || stored_reference.byte_len != reference.byte_len
+        || stored_reference.sha256 != reference.sha256
+        || stored_reference.source_entry_id != reference.source_entry_id
+    {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    Ok(content)
+}
+
+pub(crate) fn clear_uploaded_file_binding(
+    dir: &Path,
+    artifact_id: &str,
+    expected_source_entry_id: &str,
+) -> Result<()> {
+    fs::create_dir_all(dir)?;
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let path = record_path(dir, artifact_id)?;
+    let mut stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+    if stored.source_entry_id.as_deref() != Some(expected_source_entry_id) {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    stored.source_entry_id = None;
+    let temp = dir.join(format!(".{artifact_id}.file.unbind.tmp"));
+    fs::write(&temp, serde_json::to_vec(&stored)?)?;
+    fs::rename(temp, path)?;
+    Ok(())
+}
+
+pub(crate) fn pin_uploaded_file(
+    dir: &Path,
+    reference: &UploadedFileRef,
+    owner_id: &str,
+) -> Result<()> {
+    validate_pending_owner_id(owner_id)?;
+    if reference.source_entry_id.is_some() {
+        return Err(StoreError::ArtifactAlreadyCommitted);
+    }
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let path = record_path(dir, &reference.artifact_id)?;
+    let mut stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+    if stored.file_name != reference.file_name
+        || stored.media_type != reference.media_type
+        || stored.created_at_ms != reference.created_at_ms
+        || stored.byte_len != reference.byte_len
+        || stored.sha256 != reference.sha256
+    {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    if stored.source_entry_id.is_some() {
+        return Err(StoreError::ArtifactAlreadyCommitted);
+    }
+    if let Some(existing_owner) = stored.pending_owner_id.as_deref() {
+        return if existing_owner == owner_id {
+            Ok(())
+        } else {
+            Err(StoreError::ArtifactAlreadyCommitted)
+        };
+    }
+    stored.pending_owner_id = Some(owner_id.to_owned());
+    let temp = dir.join(format!(".{}.file.pin.tmp", reference.artifact_id));
+    fs::write(&temp, serde_json::to_vec(&stored)?)?;
+    fs::rename(temp, path)?;
+    Ok(())
+}
+
+pub(crate) fn release_uploaded_file_pin(
+    dir: &Path,
+    artifact_id: &str,
+    owner_id: &str,
+) -> Result<()> {
+    validate_pending_owner_id(owner_id)?;
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let path = record_path(dir, artifact_id)?;
+    let mut stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+    if stored.pending_owner_id.as_deref() != Some(owner_id) {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    stored.pending_owner_id = None;
+    let temp = dir.join(format!(".{artifact_id}.file.unpin.tmp"));
+    fs::write(&temp, serde_json::to_vec(&stored)?)?;
+    fs::rename(temp, path)?;
+    Ok(())
+}
+
+pub(crate) fn finalize_uploaded_file_binding(
+    dir: &Path,
+    artifact_id: &str,
+    source_entry_id: &str,
+) -> Result<()> {
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let path = record_path(dir, artifact_id)?;
+    let mut stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+    if stored.source_entry_id.as_deref() != Some(source_entry_id) {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    if stored.pending_owner_id.is_none() {
+        return Ok(());
+    }
+    stored.pending_owner_id = None;
+    let temp = dir.join(format!(".{artifact_id}.file.finalize.tmp"));
+    fs::write(&temp, serde_json::to_vec(&stored)?)?;
+    fs::rename(temp, path)?;
+    Ok(())
+}
+
+pub(crate) fn bind_uploaded_file(
+    dir: &Path,
+    reference: &UploadedFileRef,
+    source_entry_id: &str,
+) -> Result<UploadedFileRef> {
+    if source_entry_id.is_empty() || reference.source_entry_id.is_some() {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let (stored_reference, _) = read_uploaded_file_by_id(dir, &reference.artifact_id)?;
+    if stored_reference.file_name != reference.file_name
+        || stored_reference.media_type != reference.media_type
+        || stored_reference.created_at_ms != reference.created_at_ms
+        || stored_reference.byte_len != reference.byte_len
+        || stored_reference.sha256 != reference.sha256
+    {
+        return Err(StoreError::ArtifactIntegrityMismatch);
+    }
+    let path = record_path(dir, &reference.artifact_id)?;
+    let mut stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+    if stored.source_entry_id.is_some() {
+        return Err(StoreError::ArtifactAlreadyCommitted);
+    }
+    stored.source_entry_id = Some(source_entry_id.to_owned());
+    let temp = dir.join(format!(".{}.file.bind.tmp", reference.artifact_id));
+    fs::write(&temp, serde_json::to_vec(&stored)?)?;
+    fs::rename(&temp, path)?;
+    let mut bound = reference.clone();
+    bound.source_entry_id = Some(source_entry_id.to_owned());
+    Ok(bound)
+}
+
+pub(crate) fn list_uploaded_file_refs(dir: &Path) -> Result<Vec<UploadedFileRef>> {
+    if !dir.exists() {
+        return Ok(Vec::new());
+    }
+    let mut refs = Vec::new();
+    for entry in fs::read_dir(dir)? {
+        let path = entry?.path();
+        let Some(artifact_id) = path
+            .file_name()
+            .and_then(|name| name.to_str())
+            .and_then(|name| name.strip_suffix(".file.json"))
+        else {
+            continue;
+        };
+        refs.push(read_uploaded_file_by_id(dir, artifact_id)?.0);
+    }
+    Ok(refs)
+}
+
+pub(crate) fn copy_committed_uploaded_files(source_dir: &Path, target_dir: &Path) -> Result<u64> {
+    if !source_dir.exists() {
+        return Ok(0);
+    }
+    fs::create_dir_all(target_dir)?;
+    let target_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(target_dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&target_lock)?;
+    let mut copied = 0_u64;
+    for entry in fs::read_dir(source_dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+            continue;
+        };
+        if !name.ends_with(".file.json") {
+            continue;
+        }
+        let bytes = fs::read(&path)?;
+        let stored: StoredUploadedFile = serde_json::from_slice(&bytes)?;
+        if stored.source_entry_id.is_none() {
+            continue;
+        }
+        let target = target_dir.join(name);
+        if target.exists() {
+            let existing: StoredUploadedFile = serde_json::from_slice(&fs::read(&target)?)?;
+            if existing.sha256 != stored.sha256
+                || existing.file_name != stored.file_name
+                || existing.source_entry_id != stored.source_entry_id
+            {
+                return Err(StoreError::ArtifactIntegrityMismatch);
+            }
+            continue;
+        }
+        let temp = target_dir.join(format!(".{name}.copy.tmp"));
+        fs::write(&temp, &bytes)?;
+        fs::rename(temp, target)?;
+        copied = copied
+            .checked_add(1)
+            .ok_or(StoreError::ArtifactQuotaExceeded)?;
+    }
+    Ok(copied)
+}
+
+pub(crate) fn reconcile_uploaded_file_pins(dir: &Path, live_owner_ids: &[String]) -> Result<u64> {
+    fs::create_dir_all(dir)?;
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let mut reconciled = 0_u64;
+    for entry in fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        let Some(file_name) = path.file_name().and_then(|name| name.to_str()) else {
+            continue;
+        };
+        let Some(artifact_id) = file_name.strip_suffix(".file.json") else {
+            continue;
+        };
+        let mut stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+        let Some(owner_id) = stored.pending_owner_id.as_deref() else {
+            continue;
+        };
+        if live_owner_ids.iter().any(|live| live == owner_id) {
+            continue;
+        }
+        stored.pending_owner_id = None;
+        let temp = dir.join(format!(".{artifact_id}.file.reconcile.tmp"));
+        fs::write(&temp, serde_json::to_vec(&stored)?)?;
+        fs::rename(temp, path)?;
+        reconciled = reconciled.saturating_add(1);
+    }
+    Ok(reconciled)
+}
+
+pub(crate) fn delete_uncommitted_uploaded_files(dir: &Path) -> Result<u64> {
+    fs::create_dir_all(dir)?;
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let mut removed = 0_u64;
+    for entry in fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        if !path
+            .file_name()
+            .and_then(|name| name.to_str())
+            .is_some_and(|name| name.ends_with(".file.json"))
+        {
+            continue;
+        }
+        let stored: StoredUploadedFile = serde_json::from_slice(&fs::read(&path)?)?;
+        if stored.source_entry_id.is_none() && stored.pending_owner_id.is_none() {
+            fs::remove_file(path)?;
+            removed = removed
+                .checked_add(1)
+                .ok_or(StoreError::ArtifactQuotaExceeded)?;
+        }
+    }
+    Ok(removed)
+}
+
+pub(crate) fn delete_uploaded_file(dir: &Path, artifact_id: &str) -> Result<bool> {
+    fs::create_dir_all(dir)?;
+    let aggregate_lock = fs::OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .open(dir.join(".aggregate.lock"))?;
+    FileExt::lock_exclusive(&aggregate_lock)?;
+    let path = record_path(dir, artifact_id)?;
+    let stored = match fs::read(&path) {
+        Ok(bytes) => serde_json::from_slice::<StoredUploadedFile>(&bytes)?,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(false),
+        Err(error) => return Err(error.into()),
+    };
+    if stored.source_entry_id.is_some() || stored.pending_owner_id.is_some() {
+        return Err(StoreError::ArtifactAlreadyCommitted);
+    }
+    match fs::remove_file(path) {
+        Ok(()) => Ok(true),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(false),
+        Err(error) => Err(error.into()),
+    }
+}

crates/session-store/src/worker_metadata.rs

@@ -63,6 +63,8 @@ pub struct WorkerSpawnedScopeRule {
     pub target: PathBuf,
     pub permission: String,
     pub recursive: bool,
+    #[serde(default)]
+    pub symlink_policy: protocol::SymlinkPolicy,
 }
 
 /// One child Worker spawned by this Worker and persisted with the spawner's
@@ -608,6 +610,24 @@ where
     ) -> Result<usize, crate::StoreError> {
         self.session_store.read_entry_count(session_id, segment_id)
     }
+    fn write_paste_artifact(
+        &self,
+        session_id: SessionId,
+        source_entry_id: &str,
+        content: &str,
+        limits: crate::PasteArtifactLimits,
+    ) -> Result<protocol::PasteArtifactRef, crate::StoreError> {
+        self.session_store
+            .write_paste_artifact(session_id, source_entry_id, content, limits)
+    }
+    fn read_paste_artifact(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+    ) -> Result<(protocol::PasteArtifactRef, String), crate::StoreError> {
+        self.session_store
+            .read_paste_artifact(session_id, artifact_id)
+    }
     fn append_trace(
         &self,
         session_id: SessionId,
@@ -664,6 +684,25 @@ mod tests {
         assert_eq!(restored, metadata);
     }
 
+    #[test]
+    fn spawned_scope_rule_defaults_resolved_and_roundtrips_logical_policy() {
+        let legacy: WorkerSpawnedScopeRule = serde_json::from_value(serde_json::json!({
+            "target": "/workspace/src",
+            "permission": "read",
+            "recursive": true
+        }))
+        .unwrap();
+        assert_eq!(legacy.symlink_policy, protocol::SymlinkPolicy::Resolved);
+
+        let logical = WorkerSpawnedScopeRule {
+            symlink_policy: protocol::SymlinkPolicy::Logical,
+            ..legacy
+        };
+        let restored: WorkerSpawnedScopeRule =
+            serde_json::from_value(serde_json::to_value(&logical).unwrap()).unwrap();
+        assert_eq!(restored, logical);
+    }
+
     #[test]
     fn worker_aggregate_store_writes_one_fixed_metadata_identity() {
         let tmp = tempfile::tempdir().unwrap();
@@ -817,6 +856,7 @@ mod tests {
             target: std::path::Path::new("/tmp/delegated").into(),
             permission: "write".into(),
             recursive: true,
+            symlink_policy: Default::default(),
         };
         store
             .set_spawned_children(

crates/session-store/src/worker_session_store.rs

@@ -10,9 +10,11 @@
 //! every later operation must use that same ID.
 
 use crate::event_trace::TraceEntry;
+use crate::paste_artifact::{read_from_dir, write_to_dir};
 use crate::segment_log::LogEntry;
 use crate::store::{Store, StoreError};
-use crate::{SegmentId, SessionId};
+use crate::{PasteArtifactLimits, SegmentId, SessionId};
+use protocol::PasteArtifactRef;
 use serde::{Deserialize, Serialize};
 use std::fs::{self, File, OpenOptions};
 use std::io::{Read, Seek, SeekFrom, Write};
@@ -20,9 +22,12 @@ use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
 use std::time::SystemTime;
 
-const SESSION_SCHEMA_VERSION: u32 = 1;
+const SESSION_SCHEMA_VERSION: u32 = 3;
+const PREVIOUS_SESSION_SCHEMA_VERSION: u32 = 2;
+const LEGACY_SESSION_SCHEMA_VERSION: u32 = 1;
 const SESSION_FILE: &str = "session.json";
 const SEGMENTS_DIR: &str = "segments";
+const PASTE_ARTIFACTS_DIR: &str = "artifacts/paste";
 
 #[derive(Clone)]
 pub struct WorkerSessionStore {
@@ -44,15 +49,28 @@ impl WorkerSessionStore {
         fs::create_dir_all(root.join(SEGMENTS_DIR))?;
         let session_id = match fs::read(root.join(SESSION_FILE)) {
             Ok(bytes) => {
-                let manifest: SessionManifest = serde_json::from_slice(&bytes)?;
-                if manifest.schema_version != SESSION_SCHEMA_VERSION {
-                    return Err(StoreError::Corrupt {
-                        line: 0,
-                        message: format!(
-                            "unsupported Worker Session schema version {}, expected {}",
-                            manifest.schema_version, SESSION_SCHEMA_VERSION
-                        ),
-                    });
+                let mut manifest: SessionManifest = serde_json::from_slice(&bytes)?;
+                match manifest.schema_version {
+                    SESSION_SCHEMA_VERSION => {
+                        validate_canonical_segment_logs(&root)?;
+                    }
+                    PREVIOUS_SESSION_SCHEMA_VERSION | LEGACY_SESSION_SCHEMA_VERSION => {
+                        migrate_segment_logs_to_v3(
+                            &root,
+                            manifest.session_id,
+                            manifest.schema_version,
+                        )?;
+                        manifest.schema_version = SESSION_SCHEMA_VERSION;
+                        atomic_write_json(&root.join(SESSION_FILE), &manifest)?;
+                    }
+                    version => {
+                        return Err(StoreError::Corrupt {
+                            line: 0,
+                            message: format!(
+                                "unsupported Worker Session schema version {version}, expected {SESSION_SCHEMA_VERSION}"
+                            ),
+                        });
+                    }
                 }
                 Some(manifest.session_id)
             }
@@ -136,6 +154,41 @@ impl WorkerSessionStore {
             .join(format!("{segment_id}.trace.jsonl"))
     }
 
+    fn append_log_entry(&self, path: &Path, entry: &LogEntry) -> Result<(), StoreError> {
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("Worker Session append lock was poisoned"))?;
+        let mut file = OpenOptions::new()
+            .create(true)
+            .read(true)
+            .write(true)
+            .append(true)
+            .open(path)?;
+        let committed_len = truncate_uncommitted_tail(&mut file)?;
+        file.seek(SeekFrom::Start(0))?;
+        let mut existing = Vec::new();
+        file.read_to_end(&mut existing)?;
+        parse_jsonl::<LogEntry>(&existing)?;
+        let line = serde_json::to_string(entry)?;
+        let mut record = Vec::with_capacity(line.len() + 1);
+        record.extend_from_slice(line.as_bytes());
+        record.push(b'\n');
+        if let Err(write_error) = file.write_all(&record) {
+            return match file.set_len(committed_len) {
+                Ok(()) => Err(write_error.into()),
+                Err(rollback_error) => Err(std::io::Error::new(
+                    rollback_error.kind(),
+                    format!(
+                        "session append failed ({write_error}) and rollback failed: {rollback_error}"
+                    ),
+                )
+                .into()),
+            };
+        }
+        Ok(())
+    }
+
     fn append_line(&self, path: &Path, line: &str) -> Result<(), StoreError> {
         let _guard = self
             .append_lock
@@ -175,7 +228,7 @@ impl Store for WorkerSessionStore {
         entry: &LogEntry,
     ) -> Result<(), StoreError> {
         self.ensure_session(session_id, true)?;
-        self.append_line(&self.log_path(segment_id), &serde_json::to_string(entry)?)
+        self.append_log_entry(&self.log_path(segment_id), entry)
     }
 
     fn read_all(
@@ -267,6 +320,35 @@ impl Store for WorkerSessionStore {
             .count())
     }
 
+    fn write_paste_artifact(
+        &self,
+        session_id: SessionId,
+        source_entry_id: &str,
+        content: &str,
+        limits: PasteArtifactLimits,
+    ) -> Result<PasteArtifactRef, StoreError> {
+        self.ensure_session(session_id, true)?;
+        let _guard = self
+            .append_lock
+            .lock()
+            .map_err(|_| std::io::Error::other("Worker Session append lock was poisoned"))?;
+        write_to_dir(
+            &self.root.join(PASTE_ARTIFACTS_DIR),
+            source_entry_id,
+            content,
+            limits,
+        )
+    }
+
+    fn read_paste_artifact(
+        &self,
+        session_id: SessionId,
+        artifact_id: &str,
+    ) -> Result<(PasteArtifactRef, String), StoreError> {
+        self.ensure_session(session_id, false)?;
+        read_from_dir(&self.root.join(PASTE_ARTIFACTS_DIR), artifact_id)
+    }
+
     fn append_trace(
         &self,
         session_id: SessionId,
@@ -278,6 +360,138 @@ impl Store for WorkerSessionStore {
     }
 }
 
+fn segment_log_paths(root: &Path) -> Result<Vec<(SegmentId, PathBuf)>, StoreError> {
+    let segments = root.join(SEGMENTS_DIR);
+    if !segments.exists() {
+        return Ok(Vec::new());
+    }
+    let mut paths = Vec::new();
+    for entry in fs::read_dir(&segments)? {
+        let entry = entry?;
+        let path = entry.path();
+        let metadata = fs::symlink_metadata(&path)?;
+        let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+            return Err(StoreError::Corrupt {
+                line: 0,
+                message: format!("non-UTF-8 Worker Session segment path: {}", path.display()),
+            });
+        };
+        if name.ends_with(".trace.jsonl") || name.starts_with('.') {
+            continue;
+        }
+        if !name.ends_with(".jsonl") {
+            continue;
+        }
+        if !metadata.file_type().is_file() {
+            return Err(StoreError::Corrupt {
+                line: 0,
+                message: format!(
+                    "Worker Session segment is not a regular file: {}",
+                    path.display()
+                ),
+            });
+        }
+        let segment_id =
+            name.trim_end_matches(".jsonl")
+                .parse()
+                .map_err(|_| StoreError::Corrupt {
+                    line: 0,
+                    message: format!("invalid Worker Session segment name: {name}"),
+                })?;
+        paths.push((segment_id, path));
+    }
+    paths.sort_by_key(|(segment_id, _)| *segment_id);
+    Ok(paths)
+}
+
+fn migrate_segment_logs_to_v3(
+    root: &Path,
+    session_id: SessionId,
+    source_schema_version: u32,
+) -> Result<(), StoreError> {
+    struct MigrationPlan {
+        path: PathBuf,
+        source: Vec<u8>,
+        output: Vec<u8>,
+    }
+
+    // Phase 1 is strictly read-only. Every segment must parse and canonicalize
+    // successfully before the first authoritative byte is replaced.
+    let mut plans = Vec::new();
+    for (segment_id, path) in segment_log_paths(root)? {
+        let source = fs::read(&path)?;
+        let canonical = parse_legacy_jsonl(source_schema_version, session_id, segment_id, &source)
+            .map_err(|error| StoreError::Corrupt {
+                line: 0,
+                message: format!(
+                    "cannot migrate Worker Session log {}: {error}",
+                    path.display()
+                ),
+            })?;
+        let mut output = Vec::new();
+        for entry in canonical {
+            serde_json::to_writer(&mut output, &entry)?;
+            output.push(b'\n');
+        }
+        plans.push(MigrationPlan {
+            path,
+            source,
+            output,
+        });
+    }
+
+    // Fence the complete preflight snapshot before starting phase 2. Session
+    // open is the exclusive restore boundary; this additionally fails closed
+    // if an unexpected writer raced the preflight.
+    for plan in &plans {
+        if fs::read(&plan.path)? != plan.source {
+            return Err(StoreError::Corrupt {
+                line: 0,
+                message: format!(
+                    "Worker Session segment changed during migration: {}",
+                    plan.path.display()
+                ),
+            });
+        }
+    }
+
+    for plan in plans {
+        atomic_write_bytes(&plan.path, &plan.output)?;
+    }
+    Ok(())
+}
+
+fn validate_canonical_segment_logs(root: &Path) -> Result<(), StoreError> {
+    for (_, path) in segment_log_paths(root)? {
+        let _: Vec<LogEntry> = parse_jsonl(&fs::read(&path)?)?;
+    }
+    Ok(())
+}
+
+fn parse_legacy_jsonl(
+    schema_version: u32,
+    session_id: SessionId,
+    segment_id: SegmentId,
+    bytes: &[u8],
+) -> Result<Vec<LogEntry>, serde_json::Error> {
+    let text = std::str::from_utf8(bytes).map_err(|error| {
+        serde_json::Error::io(std::io::Error::new(std::io::ErrorKind::InvalidData, error))
+    })?;
+    text.lines()
+        .enumerate()
+        .filter(|(_, line)| !line.trim().is_empty())
+        .map(|(line_index, line)| {
+            crate::legacy_session_log::decode_entry(
+                schema_version,
+                line,
+                session_id,
+                segment_id,
+                line_index,
+            )
+        })
+        .collect()
+}
+
 fn atomic_write_json<T: Serialize>(path: &Path, value: &T) -> Result<(), StoreError> {
     let mut bytes = serde_json::to_vec_pretty(value)?;
     bytes.push(b'\n');
@@ -379,7 +593,21 @@ fn truncate_uncommitted_tail(file: &mut File) -> std::io::Result<u64> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::{Store, new_segment_id, new_session_id};
+    use crate::{
+        LoggedHistoryEntry, LoggedItem, LoggedSessionHistoryEntryId, LoggedSessionHistoryMetadata,
+        LoggedSessionHistoryOrigin, Store, new_segment_id, new_session_id,
+    };
+
+    fn annotated(item: agen::Item) -> LoggedHistoryEntry {
+        LoggedHistoryEntry {
+            item: LoggedItem::from(item),
+            metadata: LoggedSessionHistoryMetadata {
+                entry_id: LoggedSessionHistoryEntryId::new(),
+                origin: LoggedSessionHistoryOrigin::LegacyUnknown,
+                derivation: None,
+            },
+        }
+    }
 
     #[test]
     fn canonical_layout_and_single_session_invariant() {
@@ -405,6 +633,367 @@ mod tests {
         assert_eq!(store.list_sessions().unwrap(), vec![session_id]);
     }
 
+    #[test]
+    fn worker_session_store_keeps_paste_artifacts_inside_retention_root() {
+        let root = tempfile::tempdir().unwrap();
+        let store = WorkerSessionStore::new(root.path().join("session")).unwrap();
+        let session_id = new_session_id();
+        store
+            .create_segment(session_id, new_segment_id(), &[])
+            .unwrap();
+        let content = "large paste body\n終端\n";
+        let reference = store
+            .write_paste_artifact(
+                session_id,
+                "entry-1",
+                content,
+                PasteArtifactLimits::default(),
+            )
+            .unwrap();
+
+        assert!(
+            root.path()
+                .join(format!(
+                    "session/{PASTE_ARTIFACTS_DIR}/{}.json",
+                    reference.artifact_id
+                ))
+                .is_file()
+        );
+        assert_eq!(
+            store
+                .read_paste_artifact(session_id, &reference.artifact_id)
+                .unwrap()
+                .1,
+            content
+        );
+        assert!(matches!(
+            store.read_paste_artifact(new_session_id(), &reference.artifact_id),
+            Err(StoreError::Corrupt { .. })
+        ));
+    }
+
+    #[test]
+    fn schema_v1_logs_are_rewritten_and_promoted_to_v3() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let segment_id = new_segment_id();
+        WorkerSessionStore::new(root.path())
+            .unwrap()
+            .create_segment(session_id, segment_id, &[])
+            .unwrap();
+        let manifest_path = root.path().join(SESSION_FILE);
+        let mut manifest: SessionManifest =
+            serde_json::from_slice(&fs::read(&manifest_path).unwrap()).unwrap();
+        manifest.schema_version = LEGACY_SESSION_SCHEMA_VERSION;
+        atomic_write_json(&manifest_path, &manifest).unwrap();
+
+        let reopened = WorkerSessionStore::new(root.path()).unwrap();
+        assert_eq!(reopened.session_id().unwrap(), Some(session_id));
+        let migrated: SessionManifest =
+            serde_json::from_slice(&fs::read(&manifest_path).unwrap()).unwrap();
+        assert_eq!(migrated.schema_version, SESSION_SCHEMA_VERSION);
+    }
+
+    #[test]
+    fn schema_v1_migration_rejects_corrupt_log_before_v3_manifest_update() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let manifest = SessionManifest {
+            schema_version: LEGACY_SESSION_SCHEMA_VERSION,
+            session_id,
+        };
+        atomic_write_json(&root.path().join(SESSION_FILE), &manifest).unwrap();
+        fs::create_dir_all(root.path().join(SEGMENTS_DIR)).unwrap();
+        fs::write(
+            root.path().join(SEGMENTS_DIR).join("broken.jsonl"),
+            "{not-json}\n",
+        )
+        .unwrap();
+
+        let error = match WorkerSessionStore::new(root.path()) {
+            Ok(_) => panic!("corrupt legacy Session log must reject migration"),
+            Err(error) => error,
+        };
+        assert!(matches!(error, StoreError::Corrupt { .. }));
+        let persisted: SessionManifest =
+            serde_json::from_slice(&fs::read(root.path().join(SESSION_FILE)).unwrap()).unwrap();
+        assert_eq!(persisted.schema_version, LEGACY_SESSION_SCHEMA_VERSION);
+    }
+
+    #[test]
+    fn schema_v2_migration_rewrites_legacy_records_with_stable_unknown_provenance() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let segment_id = new_segment_id();
+        fs::create_dir_all(root.path().join(SEGMENTS_DIR)).unwrap();
+        atomic_write_json(
+            &root.path().join(SESSION_FILE),
+            &SessionManifest {
+                schema_version: PREVIOUS_SESSION_SCHEMA_VERSION,
+                session_id,
+            },
+        )
+        .unwrap();
+        let source = vec![
+            serde_json::json!({
+                "kind": "segment_start",
+                "ts": 1,
+                "session_id": session_id,
+                "system_prompt": null,
+                "config": agen::llm_client::RequestConfig::default(),
+                "history": [LoggedItem::from(agen::Item::assistant_message("prior"))],
+                "forked_from": null,
+                "compacted_from": null
+            }),
+            serde_json::json!({
+                "kind": "user_input",
+                "ts": 2,
+                "segments": [{ "kind": "text", "content": "hello" }],
+                "extensions": []
+            }),
+            serde_json::json!({
+                "kind": "assistant_item",
+                "ts": 3,
+                "item": LoggedItem::from(agen::Item::assistant_message("reply"))
+            }),
+        ];
+        let path = root
+            .path()
+            .join(SEGMENTS_DIR)
+            .join(format!("{segment_id}.jsonl"));
+        let mut bytes = Vec::new();
+        for entry in source {
+            serde_json::to_writer(&mut bytes, &entry).unwrap();
+            bytes.push(b'\n');
+        }
+        fs::write(&path, bytes).unwrap();
+
+        let store = WorkerSessionStore::new(root.path()).unwrap();
+        let first = store.read_all(session_id, segment_id).unwrap();
+        assert!(matches!(first[0], LogEntry::AnnotatedSegmentStart { .. }));
+        assert!(matches!(first[1], LogEntry::AnnotatedUserInput { .. }));
+        assert!(matches!(first[2], LogEntry::AnnotatedAssistantItem { .. }));
+        let first_bytes = fs::read(&path).unwrap();
+        drop(store);
+
+        let reopened = WorkerSessionStore::new(root.path()).unwrap();
+        assert_eq!(fs::read(&path).unwrap(), first_bytes);
+        let snapshot = crate::public_snapshot::project_current_session_snapshot(
+            &reopened.read_all(session_id, segment_id).unwrap(),
+        );
+        assert_eq!(snapshot.entries.len(), 3);
+        assert_eq!(
+            snapshot
+                .entries
+                .iter()
+                .map(|entry| entry.timestamp)
+                .collect::<Vec<_>>(),
+            vec![1, 2, 3]
+        );
+        assert!(snapshot.entries.iter().all(|entry| {
+            entry.provenance == protocol::SessionEntryProvenance::LegacyUnknown
+                && entry.entry_id.len() <= 64
+        }));
+    }
+
+    #[test]
+    fn schema_v2_preflight_keeps_earlier_segments_unchanged_when_later_is_corrupt() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let valid_segment = uuid::Uuid::from_u128(1);
+        let corrupt_segment = uuid::Uuid::from_u128(2);
+        fs::create_dir_all(root.path().join(SEGMENTS_DIR)).unwrap();
+        atomic_write_json(
+            &root.path().join(SESSION_FILE),
+            &SessionManifest {
+                schema_version: PREVIOUS_SESSION_SCHEMA_VERSION,
+                session_id,
+            },
+        )
+        .unwrap();
+        let manifest_before = fs::read(root.path().join(SESSION_FILE)).unwrap();
+
+        let valid_path = root
+            .path()
+            .join(SEGMENTS_DIR)
+            .join(format!("{valid_segment}.jsonl"));
+        let valid_entry = serde_json::json!({
+            "kind": "segment_start",
+            "ts": 1,
+            "session_id": session_id,
+            "system_prompt": null,
+            "config": agen::llm_client::RequestConfig::default(),
+            "history": [LoggedItem::from(agen::Item::assistant_message("prior"))],
+            "forked_from": null,
+            "compacted_from": null
+        });
+        let mut valid_bytes = serde_json::to_vec(&valid_entry).unwrap();
+        valid_bytes.push(b'\n');
+        fs::write(&valid_path, &valid_bytes).unwrap();
+        let corrupt_path = root
+            .path()
+            .join(SEGMENTS_DIR)
+            .join(format!("{corrupt_segment}.jsonl"));
+        fs::write(&corrupt_path, b"{not-json}\n").unwrap();
+        let corrupt_before = fs::read(&corrupt_path).unwrap();
+
+        let error = match WorkerSessionStore::new(root.path()) {
+            Ok(_) => panic!("later corrupt segment must fail migration preflight"),
+            Err(error) => error,
+        };
+        assert!(matches!(error, StoreError::Corrupt { .. }));
+        assert_eq!(fs::read(&valid_path).unwrap(), valid_bytes);
+        assert_eq!(fs::read(&corrupt_path).unwrap(), corrupt_before);
+        assert_eq!(
+            fs::read(root.path().join(SESSION_FILE)).unwrap(),
+            manifest_before
+        );
+    }
+
+    #[test]
+    fn current_jsonl_requires_annotations_across_append_rewrite_and_reopen() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let segment_id = new_segment_id();
+        let store = WorkerSessionStore::new(root.path()).unwrap();
+        store
+            .create_segment(
+                session_id,
+                segment_id,
+                &[LogEntry::AnnotatedSegmentStart {
+                    ts: 1,
+                    session_id,
+                    system_prompt: None,
+                    config: agen::llm_client::RequestConfig::default(),
+                    history: vec![annotated(agen::Item::user_message("seed"))],
+                    forked_from: None,
+                    compacted_from: None,
+                }],
+            )
+            .unwrap();
+        store
+            .append(
+                session_id,
+                segment_id,
+                &LogEntry::AnnotatedAssistantItem {
+                    ts: 2,
+                    entry: annotated(agen::Item::assistant_message("reply")),
+                },
+            )
+            .unwrap();
+
+        let before_rewrite = store.read_all(session_id, segment_id).unwrap();
+        store
+            .create_segment(session_id, segment_id, &before_rewrite)
+            .unwrap();
+        drop(store);
+
+        let reopened = WorkerSessionStore::new(root.path()).unwrap();
+        let restored = reopened.read_all(session_id, segment_id).unwrap();
+        assert_eq!(
+            serde_json::to_value(&restored).unwrap(),
+            serde_json::to_value(&before_rewrite).unwrap()
+        );
+        for entry in &restored {
+            match entry {
+                LogEntry::AnnotatedSegmentStart { history, .. } => assert!(history.iter().all(
+                    |entry| !entry.metadata.entry_id.0.is_empty()
+                        && matches!(
+                            entry.metadata.origin,
+                            LoggedSessionHistoryOrigin::LegacyUnknown
+                        )
+                )),
+                LogEntry::AnnotatedAssistantItem { entry, .. } => {
+                    assert!(!entry.metadata.entry_id.0.is_empty());
+                    assert!(matches!(
+                        entry.metadata.origin,
+                        LoggedSessionHistoryOrigin::LegacyUnknown
+                    ));
+                }
+                _ => {}
+            }
+        }
+
+        let log = fs::read_to_string(reopened.log_path(segment_id)).unwrap();
+        for line in log.lines() {
+            let value: serde_json::Value = serde_json::from_str(line).unwrap();
+            let kind = value["kind"].as_str().unwrap();
+            assert!(
+                !matches!(
+                    kind,
+                    "segment_start"
+                        | "user_input"
+                        | "assistant_item"
+                        | "tool_result"
+                        | "system_item"
+                ),
+                "current-schema JSONL contains legacy history record: {kind}"
+            );
+        }
+    }
+
+    #[test]
+    fn schema_v3_rejects_legacy_records_and_new_writes_are_canonical() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let segment_id = new_segment_id();
+        let store = WorkerSessionStore::new(root.path()).unwrap();
+        store
+            .create_segment(
+                session_id,
+                segment_id,
+                &[LogEntry::AnnotatedSegmentStart {
+                    ts: 1,
+                    session_id,
+                    system_prompt: None,
+                    config: agen::llm_client::RequestConfig::default(),
+                    history: vec![annotated(agen::Item::assistant_message("seed"))],
+                    forked_from: None,
+                    compacted_from: None,
+                }],
+            )
+            .unwrap();
+        store
+            .append(
+                session_id,
+                segment_id,
+                &LogEntry::AnnotatedUserInput {
+                    ts: 2,
+                    segments: vec![protocol::Segment::Text {
+                        content: "new".into(),
+                    }],
+                    history: vec![annotated(agen::Item::user_message("new"))],
+                    extensions: Vec::new(),
+                },
+            )
+            .unwrap();
+        let entries = store.read_all(session_id, segment_id).unwrap();
+        assert!(matches!(entries[0], LogEntry::AnnotatedSegmentStart { .. }));
+        assert!(matches!(entries[1], LogEntry::AnnotatedUserInput { .. }));
+        drop(store);
+
+        let path = root
+            .path()
+            .join(SEGMENTS_DIR)
+            .join(format!("{segment_id}.jsonl"));
+        let mut file = OpenOptions::new().append(true).open(path).unwrap();
+        serde_json::to_writer(
+            &mut file,
+            &serde_json::json!({
+                "kind": "system_item",
+                "ts": 3,
+                "item": { "kind": "legacy_ignored", "slug": "legacy" }
+            }),
+        )
+        .unwrap();
+        file.write_all(b"\n").unwrap();
+        let error = match WorkerSessionStore::new(root.path()) {
+            Ok(_) => panic!("schema v3 must reject a legacy history record"),
+            Err(error) => error,
+        };
+        assert!(matches!(error, StoreError::Corrupt { .. }));
+    }
+
     #[test]
     fn reopen_preserves_session_and_segment_ids() {
         let root = tempfile::tempdir().unwrap();

crates/session-store/tests/fs_store_test.rs

@@ -1,12 +1,25 @@
 use agen::EngineResult;
 use agen::llm_client::types::{Item, RequestConfig};
 use session_store::{
-    FsStore, LogEntry, Store, TraceEntry, collect_state, new_segment_id, new_session_id,
+    FsStore, LogEntry, LoggedHistoryEntry, LoggedItem, LoggedSessionHistoryEntryId,
+    LoggedSessionHistoryMetadata, LoggedSessionHistoryOrigin, Store, TraceEntry, collect_state,
+    new_segment_id, new_session_id,
 };
 use std::io::Write;
 
+fn annotated(item: Item) -> LoggedHistoryEntry {
+    LoggedHistoryEntry {
+        item: LoggedItem::from(item),
+        metadata: LoggedSessionHistoryMetadata {
+            entry_id: LoggedSessionHistoryEntryId::new(),
+            origin: LoggedSessionHistoryOrigin::LegacyUnknown,
+            derivation: None,
+        },
+    }
+}
+
 fn nil_session_start(ts: u64, session_id: uuid::Uuid) -> LogEntry {
-    LogEntry::SegmentStart {
+    LogEntry::AnnotatedSegmentStart {
         ts,
         session_id,
         system_prompt: None,
@@ -25,7 +38,7 @@ fn round_trip_write_and_read() {
     let segid = new_segment_id();
 
     let entries = vec![
-        LogEntry::SegmentStart {
+        LogEntry::AnnotatedSegmentStart {
             ts: 1000,
             session_id: sid,
             system_prompt: Some("You are helpful.".into()),
@@ -34,14 +47,15 @@ fn round_trip_write_and_read() {
             forked_from: None,
             compacted_from: None,
         },
-        LogEntry::UserInput {
+        LogEntry::AnnotatedUserInput {
             ts: 2000,
             extensions: vec![],
             segments: vec![protocol::Segment::text("Hello")],
+            history: vec![annotated(Item::user_message("Hello"))],
         },
-        LogEntry::AssistantItem {
+        LogEntry::AnnotatedAssistantItem {
             ts: 3000,
-            item: Item::assistant_message("Hi there!").into(),
+            entry: annotated(Item::assistant_message("Hi there!")),
         },
         LogEntry::TurnEnd {
             ts: 3100,
@@ -79,14 +93,14 @@ fn create_segment_writes_all_entries() {
     let sid = new_session_id();
     let segid = new_segment_id();
 
-    let entries = [LogEntry::SegmentStart {
+    let entries = [LogEntry::AnnotatedSegmentStart {
         ts: 1000,
         session_id: sid,
         system_prompt: None,
         config: RequestConfig::default(),
         history: vec![
-            Item::user_message("seed").into(),
-            Item::assistant_message("ok").into(),
+            annotated(Item::user_message("seed")),
+            annotated(Item::assistant_message("ok")),
         ],
         forked_from: None,
         compacted_from: None,
@@ -205,7 +219,7 @@ fn read_entry_count_matches_append_tally() {
     let segid = new_segment_id();
 
     let entries = [
-        LogEntry::SegmentStart {
+        LogEntry::AnnotatedSegmentStart {
             ts: 1000,
             session_id: sid,
             system_prompt: None,
@@ -214,10 +228,11 @@ fn read_entry_count_matches_append_tally() {
             forked_from: None,
             compacted_from: None,
         },
-        LogEntry::UserInput {
+        LogEntry::AnnotatedUserInput {
             ts: 2000,
             extensions: vec![],
             segments: vec![protocol::Segment::text("Hello")],
+            history: vec![annotated(Item::user_message("Hello"))],
         },
     ];
 
@@ -254,10 +269,11 @@ fn unterminated_utf8_tail_is_ignored_and_replaced_on_append() {
     assert_eq!(store.read_all(sid, segid).unwrap().len(), 1);
     assert_eq!(store.read_entry_count(sid, segid).unwrap(), 1);
 
-    let next = LogEntry::UserInput {
+    let next = LogEntry::AnnotatedUserInput {
         ts: 2,
         extensions: vec![],
         segments: vec![protocol::Segment::text("recovered")],
+        history: vec![annotated(Item::user_message("recovered"))],
     };
     store.append(sid, segid, &next).unwrap();
 

crates/session-store/tests/session_test.rs

@@ -1,20 +1,37 @@
 mod common;
 
+use std::ops::{Deref, DerefMut};
 use std::sync::Arc;
 
-use agen::Engine;
-use agen::interceptor::{Interceptor, TurnEndAction};
+use agen::interceptor::{AssistantTurnEndContext, Interceptor, InterceptorResult, TurnEndAction};
 use agen::llm_client::event::{Event, ResponseStatus, StatusEvent};
 use agen::llm_client::types::{Item, RequestConfig};
 use agen::tool::{Tool, ToolDefinition, ToolError, ToolMeta, ToolOutput};
+use agen::{Engine, History};
 use async_trait::async_trait;
 use common::MockLlmClient;
+use protocol::{Segment, SessionSnapshotEntryData, UploadedFileAvailability, UploadedFileRef};
 use session_store::{FsStore, LogEntry, SegmentStartState, Store, collect_state};
 
 // =============================================================================
 // Helpers
 // =============================================================================
 
+fn annotated(items: &[Item]) -> Vec<session_store::LoggedHistoryEntry> {
+    items
+        .iter()
+        .cloned()
+        .map(|item| session_store::LoggedHistoryEntry {
+            item: session_store::LoggedItem::from(item),
+            metadata: session_store::LoggedSessionHistoryMetadata {
+                entry_id: session_store::LoggedSessionHistoryEntryId::new(),
+                origin: session_store::LoggedSessionHistoryOrigin::LegacyUnknown,
+                derivation: None,
+            },
+        })
+        .collect()
+}
+
 fn simple_text_events() -> Vec<Event> {
     vec![
         Event::text_block_start(0),
@@ -83,8 +100,11 @@ struct PausePolicy;
 
 #[async_trait]
 impl Interceptor for PausePolicy {
-    async fn on_turn_end(&self, _history: &[Item]) -> TurnEndAction {
-        TurnEndAction::Pause
+    async fn on_assistant_turn_end(
+        &self,
+        _context: AssistantTurnEndContext<'_>,
+    ) -> InterceptorResult<TurnEndAction> {
+        Ok(TurnEndAction::Pause)
     }
 }
 
@@ -94,15 +114,47 @@ fn make_store() -> (tempfile::TempDir, FsStore) {
     (dir, store)
 }
 
+struct TestWorker {
+    engine: Engine<MockLlmClient>,
+    history: History,
+}
+
+impl TestWorker {
+    fn new(engine: Engine<MockLlmClient>) -> Self {
+        Self {
+            engine,
+            history: History::new(),
+        }
+    }
+
+    fn history(&self) -> Vec<Item> {
+        self.history.items_cloned()
+    }
+}
+
+impl Deref for TestWorker {
+    type Target = Engine<MockLlmClient>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.engine
+    }
+}
+
+impl DerefMut for TestWorker {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.engine
+    }
+}
+
 /// Run a worker turn and persist via session-store functions.
 /// Takes ownership of the worker (needed for lock/unlock) and returns it.
 async fn run_and_persist(
-    worker: Engine<MockLlmClient>,
+    mut worker: TestWorker,
     store: &FsStore,
     session_id: session_store::SessionId,
     segment_id: session_store::SegmentId,
     input: &str,
-) -> (Engine<MockLlmClient>, agen::EngineRunExit) {
+) -> (TestWorker, agen::EngineRunExit) {
     // Mirror Worker's run-entry contract: log the user input as segments
     // before the worker pushes its flattened user_message; save_delta
     // skips the resulting user_message item to avoid double-write.
@@ -111,17 +163,19 @@ async fn run_and_persist(
         session_id,
         segment_id,
         vec![protocol::Segment::text(input)],
+        annotated(&[Item::user_message(input)]),
     )
     .unwrap();
 
-    let history_before = worker.history().len();
+    let history_before = worker.history.len();
 
-    let mut locked = worker.lock();
-    let result = locked.run(input).await;
-    let worker = locked.unlock();
+    let mut locked = worker.engine.lock(&worker.history);
+    let result = locked.run(&mut worker.history, input).await;
+    worker.engine = locked.unlock();
 
-    let new_items = &worker.history()[history_before..];
-    session_store::save_delta(store, session_id, segment_id, new_items).unwrap();
+    let projected = worker.history();
+    let new_items = annotated(&projected[history_before..]);
+    session_store::save_delta(store, session_id, segment_id, &new_items).unwrap();
     session_store::save_turn_end(store, session_id, segment_id, worker.turn_count()).unwrap();
 
     match &result {
@@ -144,7 +198,7 @@ async fn run_and_persist(
             )
             .unwrap();
         }
-        agen::EngineRunExit::Interrupted(agen::StopReason::LimitReached) => {
+        agen::EngineRunExit::Interrupted(agen::RunInterruptionReason::LimitReached) => {
             session_store::save_run_completed(
                 store,
                 session_id,
@@ -178,14 +232,15 @@ async fn run_and_persist(
 async fn session_run_logs_entries() {
     let (_dir, store) = make_store();
     let client = MockLlmClient::new(simple_text_events());
-    let worker = Engine::new(client);
+    let worker = TestWorker::new(Engine::new(client));
 
     let (sid, segid) = session_store::create_segment(
         &store,
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -203,7 +258,10 @@ async fn session_run_logs_entries() {
     );
 
     // First entry is SegmentStart
-    assert!(matches!(&entries[0], LogEntry::SegmentStart { .. }));
+    assert!(matches!(
+        &entries[0],
+        LogEntry::AnnotatedSegmentStart { .. }
+    ));
 
     // Has a RunCompleted with Finished
     let has_finished = entries.iter().any(|e| {
@@ -222,7 +280,7 @@ async fn session_run_logs_entries() {
 async fn session_restore_round_trip() {
     let (_dir, store) = make_store();
     let client = MockLlmClient::new(simple_text_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
     worker.set_system_prompt("You are helpful.");
 
     let (sid, segid) = session_store::create_segment(
@@ -230,7 +288,8 @@ async fn session_restore_round_trip() {
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -261,7 +320,7 @@ async fn session_restore_round_trip() {
 async fn session_run_with_tool_call() {
     let (_dir, store) = make_store();
     let client = MockLlmClient::with_responses(tool_call_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
     worker.register_tool(weather_tool_definition());
 
     let (sid, segid) = session_store::create_segment(
@@ -269,7 +328,8 @@ async fn session_run_with_tool_call() {
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -280,12 +340,12 @@ async fn session_run_with_tool_call() {
 
     let has_tool_results = entries
         .iter()
-        .any(|e| matches!(e, LogEntry::ToolResult { .. }));
+        .any(|e| matches!(e, LogEntry::AnnotatedToolResult { .. }));
     assert!(has_tool_results, "should have ToolResult entry");
 
     let has_assistant = entries
         .iter()
-        .any(|e| matches!(e, LogEntry::AssistantItem { .. }));
+        .any(|e| matches!(e, LogEntry::AnnotatedAssistantItem { .. }));
     assert!(has_assistant, "should have AssistantItem entry");
 }
 
@@ -293,9 +353,10 @@ async fn session_run_with_tool_call() {
 async fn session_resume_after_pause() {
     let (_dir, store) = make_store();
 
-    // First run: tool call with pause policy → Paused
+    // First terminal assistant response requests a tool; the assistant-turn
+    // interceptor pauses before the Engine enters the tool phase.
     let client = MockLlmClient::with_responses(tool_call_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
     worker.register_tool(weather_tool_definition());
     worker.set_interceptor(PausePolicy);
 
@@ -304,7 +365,8 @@ async fn session_resume_after_pause() {
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -328,14 +390,14 @@ async fn session_resume_after_pause() {
     // Restore state and verify
     let state = session_store::restore(&store, sid, segid).unwrap();
     assert!(state.last_run_interrupted);
-    assert_eq!(state.active_run_turn_count, Some(2));
+    assert_eq!(state.active_run_turn_count, Some(1));
 }
 
 #[tokio::test]
 async fn session_fork_creates_new_session() {
     let (_dir, store) = make_store();
     let client = MockLlmClient::new(simple_text_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
     worker.set_system_prompt("System prompt");
 
     let (sid, segid) = session_store::create_segment(
@@ -343,7 +405,8 @@ async fn session_fork_creates_new_session() {
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -351,25 +414,38 @@ async fn session_fork_creates_new_session() {
     let (worker, _) = run_and_persist(worker, &store, sid, segid, "Hello").await;
 
     let original_history_len = worker.history().len();
+    let source_user_segments = session_store::restore(&store, sid, segid)
+        .unwrap()
+        .user_segments;
     let (fork_sid, fork_segid) = session_store::fork(
         &store,
+        sid,
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: source_user_segments.clone(),
         },
     )
     .unwrap();
     assert_ne!(fork_sid, sid, "`fork` mints a fresh Session");
 
-    // Fork should have a SegmentStart with the current history
+    // Fork should have an annotated seed and typed input checkpoint.
     let fork_entries = store.read_all(fork_sid, fork_segid).unwrap();
-    assert_eq!(fork_entries.len(), 1);
-    assert!(matches!(&fork_entries[0], LogEntry::SegmentStart { .. }));
+    assert_eq!(fork_entries.len(), 2);
+    assert!(matches!(
+        &fork_entries[0],
+        LogEntry::AnnotatedSegmentStart { .. }
+    ));
+    assert!(matches!(
+        &fork_entries[1],
+        LogEntry::InputSegmentsCheckpoint { .. }
+    ));
 
     let fork_state = collect_state(&fork_entries);
     assert_eq!(fork_state.session_id, Some(fork_sid));
     assert_eq!(fork_state.history.len(), original_history_len);
+    assert_eq!(fork_state.user_segments, source_user_segments);
     assert_eq!(fork_state.system_prompt.as_deref(), Some("System prompt"));
 }
 
@@ -377,14 +453,15 @@ async fn session_fork_creates_new_session() {
 async fn session_fork_at_truncates_within_session() {
     let (_dir, store) = make_store();
     let client = MockLlmClient::new(simple_text_events());
-    let worker = Engine::new(client);
+    let worker = TestWorker::new(Engine::new(client));
 
     let (sid, segid) = session_store::create_segment(
         &store,
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -398,7 +475,11 @@ async fn session_fork_at_truncates_within_session() {
     let fork_segid = session_store::fork_at(&store, sid, segid, worker.turn_count()).unwrap();
 
     let fork_entries = store.read_all(sid, fork_segid).unwrap();
-    assert_eq!(fork_entries.len(), 1); // Just the new SegmentStart
+    assert_eq!(fork_entries.len(), 2);
+    assert!(matches!(
+        &fork_entries[1],
+        LogEntry::InputSegmentsCheckpoint { .. }
+    ));
 
     let fork_state = collect_state(&fork_entries);
     assert_eq!(fork_state.session_id, Some(sid), "fork_at inherits Session");
@@ -410,7 +491,25 @@ async fn session_fork_at_truncates_within_session() {
         .position(|e| matches!(e, LogEntry::TurnEnd { turn_count, .. } if *turn_count == worker.turn_count()))
         .expect("source segment has the matching TurnEnd");
     let source_state_at_fork = collect_state(&all_entries[..=turn_end_pos]);
+    assert_eq!(fork_state.user_segments, source_state_at_fork.user_segments);
     assert_eq!(fork_state.history.len(), source_state_at_fork.history.len());
+    assert_eq!(
+        fork_state.annotated_history, source_state_at_fork.annotated_history,
+        "fork_at must preserve every retained history entry identity and provenance",
+    );
+    assert!(fork_state.annotated_history.iter().all(|entry| {
+        !entry.metadata.entry_id.0.is_empty()
+            && matches!(
+                entry.metadata.origin,
+                session_store::LoggedSessionHistoryOrigin::LegacyUnknown
+                    | session_store::LoggedSessionHistoryOrigin::HumanInput { .. }
+                    | session_store::LoggedSessionHistoryOrigin::WorkerInput { .. }
+                    | session_store::LoggedSessionHistoryOrigin::BackendInstruction { .. }
+                    | session_store::LoggedSessionHistoryOrigin::ModelOutput { .. }
+                    | session_store::LoggedSessionHistoryOrigin::ToolOutput { .. }
+                    | session_store::LoggedSessionHistoryOrigin::DerivedSummary
+            )
+    }));
 
     // list_segments should show both source and fork in the same Session.
     let segs = store.list_segments(sid).unwrap();
@@ -418,18 +517,97 @@ async fn session_fork_at_truncates_within_session() {
     assert!(segs.contains(&fork_segid));
 }
 
+#[test]
+fn rewound_fork_preserves_uploaded_file_segments_in_snapshot() {
+    let (_dir, store) = make_store();
+    let config = RequestConfig::default();
+    let (sid, segid) = session_store::create_segment(
+        &store,
+        SegmentStartState {
+            system_prompt: Some("System prompt"),
+            config: &config,
+            history: Vec::new(),
+            user_segments: Vec::new(),
+        },
+    )
+    .unwrap();
+    let uploaded = UploadedFileRef {
+        artifact_id: "uploaded-file-1".into(),
+        file_name: "notes.txt".into(),
+        media_type: "text/plain".into(),
+        created_at_ms: 123,
+        availability: UploadedFileAvailability::Available,
+        byte_len: 5,
+        sha256: "a".repeat(64),
+        source_entry_id: Some("entry-1".into()),
+    };
+    let segments = vec![Segment::UploadedFile {
+        file: uploaded.clone(),
+    }];
+    session_store::save_user_input(
+        &store,
+        sid,
+        segid,
+        segments.clone(),
+        annotated(&[Item::user_message(Segment::flatten_to_text(&segments))]),
+    )
+    .unwrap();
+    session_store::save_turn_end(&store, sid, segid, 1).unwrap();
+
+    let fork_segid = session_store::fork_at(&store, sid, segid, 1).unwrap();
+    let fork_entries = store.read_all(sid, fork_segid).unwrap();
+    let snapshot = session_store::public_snapshot::project_session_snapshot(sid, &fork_entries);
+
+    assert!(fork_entries.iter().any(|entry| matches!(
+        entry,
+        LogEntry::InputSegmentsCheckpoint { user_segments, .. }
+            if user_segments == &vec![segments.clone()]
+    )));
+    assert!(snapshot.entries.iter().any(|entry| matches!(
+        &entry.data,
+        SessionSnapshotEntryData::UserInput { segments: restored }
+            if restored == &segments
+    )));
+
+    let fork_state = collect_state(&fork_entries);
+    let (copied_session_id, copied_segment_id) = session_store::fork(
+        &store,
+        sid,
+        SegmentStartState {
+            system_prompt: fork_state.system_prompt.as_deref(),
+            config: &fork_state.config,
+            history: fork_state.annotated_history.clone(),
+            user_segments: fork_state.user_segments.clone(),
+        },
+    )
+    .unwrap();
+    let copied_entries = store
+        .read_all(copied_session_id, copied_segment_id)
+        .unwrap();
+    let copied_snapshot = session_store::public_snapshot::project_session_snapshot(
+        copied_session_id,
+        &copied_entries,
+    );
+    assert!(copied_snapshot.entries.iter().any(|entry| matches!(
+        &entry.data,
+        SessionSnapshotEntryData::UserInput { segments: restored }
+            if restored == &segments
+    )));
+}
+
 #[tokio::test]
 async fn session_config_changed_logged() {
     let (_dir, store) = make_store();
     let client = MockLlmClient::new(vec![]);
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
 
     let (sid, segid) = session_store::create_segment(
         &store,
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -455,14 +633,15 @@ async fn session_auto_forks_on_conflict() {
 
     // Create a segment
     let client_a = MockLlmClient::new(simple_text_events());
-    let worker_a = Engine::new(client_a);
+    let worker_a = TestWorker::new(Engine::new(client_a));
 
     let (sid, original_segid) = session_store::create_segment(
         &store,
         SegmentStartState {
             system_prompt: worker_a.get_system_prompt(),
             config: worker_a.request_config(),
-            history: worker_a.history(),
+            history: annotated(&worker_a.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -471,12 +650,14 @@ async fn session_auto_forks_on_conflict() {
     let mut entries_written: usize = 1;
 
     // Simulate another Worker writing to the same segment behind our back.
-    let extra_entry = LogEntry::UserInput {
-        ts: 9999,
-        extensions: vec![],
-        segments: vec![protocol::Segment::text("Interloper")],
-    };
-    store.append(sid, original_segid, &extra_entry).unwrap();
+    session_store::save_user_input(
+        &store,
+        sid,
+        original_segid,
+        vec![protocol::Segment::text("Interloper")],
+        annotated(&[Item::user_message("Interloper")]),
+    )
+    .unwrap();
 
     // Now the on-disk count exceeds our tally — ensure_head_or_fork should auto-fork.
     session_store::ensure_head_or_fork(
@@ -488,7 +669,8 @@ async fn session_auto_forks_on_conflict() {
         SegmentStartState {
             system_prompt: worker_a.get_system_prompt(),
             config: worker_a.request_config(),
-            history: worker_a.history(),
+            history: annotated(&worker_a.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -509,7 +691,7 @@ async fn session_auto_forks_on_conflict() {
     // The new segment records its lineage forward via forked_from; the
     // source segment is left immutable (no terminal marker written back).
     match &fork_entries[0] {
-        LogEntry::SegmentStart {
+        LogEntry::AnnotatedSegmentStart {
             forked_from: Some(origin),
             ..
         } => {
@@ -529,7 +711,7 @@ async fn session_auto_forks_on_conflict() {
     );
     let has_interloper = original_entries
         .iter()
-        .any(|e| matches!(e, LogEntry::UserInput { .. }));
+        .any(|e| matches!(e, LogEntry::AnnotatedUserInput { .. }));
     assert!(has_interloper);
 }
 
@@ -540,14 +722,15 @@ async fn session_auto_forks_on_conflict() {
 async fn nested_past_fork_leaves_ancestors_immutable() {
     let (_dir, store) = make_store();
     let client = MockLlmClient::new(simple_text_events());
-    let worker = Engine::new(client);
+    let worker = TestWorker::new(Engine::new(client));
 
     let (sid, root_segid) = session_store::create_segment(
         &store,
         SegmentStartState {
             system_prompt: worker.get_system_prompt(),
             config: worker.request_config(),
-            history: worker.history(),
+            history: annotated(&worker.history()),
+            user_segments: Vec::new(),
         },
     )
     .unwrap();
@@ -578,13 +761,20 @@ async fn nested_past_fork_leaves_ancestors_immutable() {
     let fork1_entries = store.read_all(sid, fork1).unwrap();
     assert_eq!(
         fork1_entries.len(),
-        1,
-        "fork1 is just its SegmentStart seed"
+        2,
+        "fork1 stores its SegmentStart and typed input checkpoint"
     );
 
-    // fork2's lineage points at fork1, not the root.
-    match &store.read_all(sid, fork2).unwrap()[0] {
-        LogEntry::SegmentStart {
+    // fork2's lineage points at fork1, not the root, and the typed seed remains
+    // intact across the nested turn-zero fork.
+    let fork2_entries = store.read_all(sid, fork2).unwrap();
+    assert_eq!(fork2_entries.len(), 2);
+    assert_eq!(
+        collect_state(&fork2_entries).user_segments,
+        collect_state(&fork1_entries).user_segments
+    );
+    match &fork2_entries[0] {
+        LogEntry::AnnotatedSegmentStart {
             forked_from: Some(origin),
             ..
         } => assert_eq!(origin.segment_id, fork1),

crates/standalone/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "standalone"
+description = "In-process standalone Worker host"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+agen.workspace = true
+client.workspace = true
+fs4.workspace = true
+manifest.workspace = true
+protocol.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+session-store.workspace = true
+thiserror.workspace = true
+tokio = { workspace = true, features = ["rt", "sync", "time"] }
+uuid = { workspace = true, features = ["v7"] }
+worker.workspace = true
+
+[dev-dependencies]
+async-trait.workspace = true
+futures.workspace = true
+tempfile.workspace = true
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "time"] }

crates/standalone/src/host.rs

@@ -0,0 +1,552 @@
+use std::path::PathBuf;
+use std::time::Duration;
+
+use agen::llm_client::client::LlmClient;
+use client::Client;
+use client::transport::in_process::{Peer as InProcessPeer, Socket as InProcessSocket};
+use manifest::ScopeRule;
+use protocol::stream::{decode_method, encode_event};
+use protocol::{Event, Method, WorkerId};
+use session_store::{
+    CombinedStore, FsStore, FsWorkerStore, WorkerActiveSegmentRef, WorkerMetadataStore,
+};
+use thiserror::Error;
+use worker::bootstrap::{
+    WorkerBootstrap, WorkerBootstrapError, WorkerBootstrapLayout, bash_output_dir_for_worker_id,
+};
+use worker::controller::WorkerControllerTransport;
+use worker::ipc::protocol_session::{
+    WorkerProtocolSessionStreams, dispatch_worker_protocol_method, live_log_entry_event,
+    subscribe_worker_protocol_session,
+};
+use worker::runtime::worker_allocation::ScopeLockError;
+use worker::{BootstrappedWorker, WorkerError, WorkerFilesystemAuthority, WorkerWorkspaceContext};
+
+use crate::launch::ResolvedStandaloneLaunch;
+use crate::store::{
+    StaleLeasePolicy, StandaloneShutdownReason, StandaloneStoreError, StandaloneWorkerLease,
+    StandaloneWorkerRecord, StandaloneWorkerStore,
+};
+
+const DEFAULT_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(10);
+type StandaloneBackingStore = CombinedStore<FsStore, FsWorkerStore>;
+
+/// One client-owned top-level Worker and its standalone Worker authority.
+///
+/// The host deliberately exposes the existing typed Worker protocol rather than owning an
+/// HTTP/WebSocket server or creating Runtime/Workspace/Ticket/Workdir domain records.
+pub struct StandaloneHost {
+    handle: worker::WorkerHandle,
+    shutdown: Option<worker::controller::ShutdownReceiver>,
+    shutdown_timeout: Duration,
+    store: StandaloneWorkerStore,
+    worker_store: FsWorkerStore,
+    record: StandaloneWorkerRecord,
+    lease: Option<StandaloneWorkerLease>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum StandaloneStartupError {
+    #[error("the standalone state store could not be opened or validated")]
+    StateStore,
+    #[error("the standalone Worker is already active")]
+    WorkerActive,
+    #[error("the standalone Worker lease cannot be observed safely; recovery is rejected")]
+    LeaseLivenessUnknown,
+    #[error("the standalone Worker working directory is unavailable or changed")]
+    WorkingDirectoryUnavailable,
+    #[error(
+        "requested scope `{}` conflicts with worker allocation `{competitor}` rule `{}`",
+        requested_rule.target.display(),
+        competitor_rule.target.display()
+    )]
+    ScopeConflict {
+        competitor: String,
+        requested_rule: ScopeRule,
+        competitor_rule: ScopeRule,
+    },
+    #[error("the resolved Worker configuration or persisted history is invalid")]
+    WorkerConfiguration,
+    #[error("the configured model provider is unavailable")]
+    ModelProvider,
+    #[error("the fixed standalone feature composition could not be installed")]
+    FeatureComposition,
+    #[error("the in-process Worker controller could not start")]
+    Controller,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum StandaloneShutdownError {
+    #[error("the standalone Worker did not stop before the shutdown deadline")]
+    DeadlineExceeded,
+    #[error("the standalone Worker shutdown confirmation was lost")]
+    ConfirmationLost,
+    #[error("the standalone Worker final state could not be committed")]
+    StateStore,
+}
+
+impl StandaloneHost {
+    pub async fn start(launch: ResolvedStandaloneLaunch) -> Result<Self, StandaloneStartupError> {
+        Self::start_with_optional_model_client(launch, None).await
+    }
+
+    pub async fn start_with_model_client<C>(
+        launch: ResolvedStandaloneLaunch,
+        model_client: C,
+    ) -> Result<Self, StandaloneStartupError>
+    where
+        C: LlmClient + 'static,
+    {
+        Self::start_with_optional_model_client(launch, Some(Box::new(model_client))).await
+    }
+
+    async fn start_with_optional_model_client(
+        launch: ResolvedStandaloneLaunch,
+        model_client: Option<Box<dyn LlmClient>>,
+    ) -> Result<Self, StandaloneStartupError> {
+        let store =
+            StandaloneWorkerStore::open(&launch.state_dir).map_err(classify_store_startup_error)?;
+        let allocation = store
+            .allocate(&launch.cwd, StaleLeasePolicy::Reject)
+            .map_err(classify_store_startup_error)?;
+        let worker_id = allocation.worker_id();
+
+        // WorkerId is the stable identity. The current Worker store remains
+        // name-keyed, so keep its derived storage key separate from the
+        // user-facing profile name.
+        let manifest = launch.profile.manifest.clone();
+        let storage_key = format!("standalone-{worker_id}");
+        let mut bootstrap_manifest = manifest.clone();
+        bootstrap_manifest.worker.name = storage_key.clone();
+        let (backing_store, worker_store) = match backing_store(&store, worker_id) {
+            Ok(stores) => stores,
+            Err(error) => {
+                let _ = store.abandon_allocation(allocation);
+                return Err(error);
+            }
+        };
+        let filesystem_authority =
+            WorkerFilesystemAuthority::local(launch.cwd.clone(), launch.cwd.clone());
+        let workspace_context = WorkerWorkspaceContext::local_filesystem(None);
+        let runtime_base = store.runtime_dir(worker_id);
+        let bash_output_dir = bash_output_dir_for_worker_id(worker_id);
+
+        let mut bootstrap = WorkerBootstrap::new(
+            bootstrap_manifest,
+            backing_store,
+            launch.prompt_catalog,
+            workspace_context,
+            filesystem_authority,
+            WorkerBootstrapLayout::Direct {
+                runtime_base,
+                bash_output_dir,
+            },
+            WorkerControllerTransport::InProcess,
+        );
+        if let Some(model_client) = model_client {
+            bootstrap = bootstrap.with_model_client(model_client);
+        }
+        let started = match bootstrap.start().await {
+            Ok(started) => started,
+            Err(error) => {
+                let _ = store.abandon_allocation(allocation);
+                return Err(classify_startup_error(error));
+            }
+        };
+        let active = match active_pointer(&worker_store, &storage_key) {
+            Ok(active) => active,
+            Err(error) => {
+                stop_started_worker(started).await;
+                let _ = store.abandon_allocation(allocation);
+                return Err(error);
+            }
+        };
+        let record = match store.commit_created(
+            &allocation,
+            manifest,
+            storage_key,
+            active.session_id,
+            active.segment_id,
+        ) {
+            Ok(record) => record,
+            Err(_) => {
+                stop_started_worker(started).await;
+                let _ = store.abandon_allocation(allocation);
+                return Err(StandaloneStartupError::StateStore);
+            }
+        };
+        Ok(Self::from_started(
+            started,
+            store,
+            worker_store,
+            record,
+            allocation.into_lease(),
+        ))
+    }
+
+    pub async fn restore(
+        state_dir: PathBuf,
+        worker_id: WorkerId,
+    ) -> Result<Self, StandaloneStartupError> {
+        Self::restore_with_optional_model_client(state_dir, worker_id, None).await
+    }
+
+    pub async fn restore_with_model_client<C>(
+        state_dir: PathBuf,
+        worker_id: WorkerId,
+        model_client: C,
+    ) -> Result<Self, StandaloneStartupError>
+    where
+        C: LlmClient + 'static,
+    {
+        Self::restore_with_optional_model_client(state_dir, worker_id, Some(Box::new(model_client)))
+            .await
+    }
+
+    async fn restore_with_optional_model_client(
+        state_dir: PathBuf,
+        worker_id: WorkerId,
+        model_client: Option<Box<dyn LlmClient>>,
+    ) -> Result<Self, StandaloneStartupError> {
+        let store = StandaloneWorkerStore::open(state_dir).map_err(classify_store_startup_error)?;
+        let record = store
+            .load(worker_id)
+            .map_err(classify_store_startup_error)?;
+        record.cwd.verify().map_err(classify_store_startup_error)?;
+        let lease = store
+            .acquire_lease(worker_id, StaleLeasePolicy::Recover)
+            .map_err(classify_store_startup_error)?;
+        let (backing_store, worker_store) = backing_store(&store, worker_id)?;
+        let storage_key = record.storage_key.clone();
+        let mut manifest = record.manifest.clone();
+        manifest.worker.name = storage_key.clone();
+        let filesystem_authority = WorkerFilesystemAuthority::local(
+            record.cwd.canonical_path.clone(),
+            record.cwd.canonical_path.clone(),
+        );
+        let workspace_context = WorkerWorkspaceContext::local_filesystem(None);
+        let runtime_base = store.runtime_dir(worker_id);
+        let bash_output_dir = bash_output_dir_for_worker_id(worker_id);
+
+        let mut bootstrap = WorkerBootstrap::new(
+            manifest,
+            backing_store,
+            worker::PromptCatalogSource::builtins_only(),
+            workspace_context,
+            filesystem_authority,
+            WorkerBootstrapLayout::Direct {
+                runtime_base,
+                bash_output_dir,
+            },
+            WorkerControllerTransport::InProcess,
+        );
+        if let Some(model_client) = model_client {
+            bootstrap = bootstrap.with_model_client(model_client);
+        }
+        let prepared = bootstrap
+            .prepare_restored(&storage_key)
+            .await
+            .map_err(classify_startup_error)?;
+        let started = prepared.start().await.map_err(classify_startup_error)?;
+        let active = match active_pointer(&worker_store, &storage_key) {
+            Ok(active) => active,
+            Err(error) => {
+                stop_started_worker(started).await;
+                return Err(error);
+            }
+        };
+        let record =
+            match store.update_active_pointer(&record, active.session_id, active.segment_id) {
+                Ok(record) => record,
+                Err(_) => {
+                    stop_started_worker(started).await;
+                    lease.retain();
+                    return Err(StandaloneStartupError::StateStore);
+                }
+            };
+        Ok(Self::from_started(
+            started,
+            store,
+            worker_store,
+            record,
+            lease,
+        ))
+    }
+
+    fn from_started(
+        started: BootstrappedWorker,
+        store: StandaloneWorkerStore,
+        worker_store: FsWorkerStore,
+        record: StandaloneWorkerRecord,
+        lease: StandaloneWorkerLease,
+    ) -> Self {
+        Self {
+            handle: started.handle,
+            shutdown: Some(started.shutdown),
+            shutdown_timeout: DEFAULT_SHUTDOWN_TIMEOUT,
+            store,
+            worker_store,
+            record,
+            lease: Some(lease),
+        }
+    }
+
+    #[must_use]
+    pub fn worker_id(&self) -> WorkerId {
+        self.record.worker_id
+    }
+
+    #[must_use]
+    pub fn record(&self) -> &StandaloneWorkerRecord {
+        &self.record
+    }
+
+    /// Open one complete client-side Worker protocol session.
+    ///
+    /// Working events, committed session entries, alert snapshots, and the
+    /// initial history snapshot are merged behind the client boundary.
+    pub fn connect(&self) -> Client<InProcessSocket> {
+        let streams = subscribe_worker_protocol_session(&self.handle);
+        let (socket, peer) = InProcessSocket::pair();
+        tokio::spawn(run_protocol_session(self.handle.clone(), streams, peer));
+        Client::new(socket)
+    }
+
+    pub fn with_shutdown_timeout(mut self, shutdown_timeout: Duration) -> Self {
+        self.shutdown_timeout = shutdown_timeout;
+        self
+    }
+
+    pub async fn shutdown(mut self) -> Result<(), StandaloneShutdownError> {
+        let command = protocol::WorkerCommandEnvelope::for_snapshot(
+            u64::MAX,
+            &self.handle.shared_state.snapshot(),
+        );
+        let _ = self.handle.send(Method::Shutdown { command }).await;
+        let Some(shutdown) = self.shutdown.take() else {
+            self.retain_lease();
+            return Err(StandaloneShutdownError::ConfirmationLost);
+        };
+        match tokio::time::timeout(self.shutdown_timeout, shutdown).await {
+            Ok(Ok(())) => {}
+            Ok(Err(_)) => {
+                self.retain_lease();
+                return Err(StandaloneShutdownError::ConfirmationLost);
+            }
+            Err(_) => {
+                self.retain_lease();
+                return Err(StandaloneShutdownError::DeadlineExceeded);
+            }
+        }
+        let active = match active_pointer(&self.worker_store, &self.record.storage_key) {
+            Ok(active) => active,
+            Err(_) => {
+                self.retain_lease();
+                return Err(StandaloneShutdownError::StateStore);
+            }
+        };
+        if self
+            .store
+            .mark_stopped(
+                &self.record,
+                active.session_id,
+                active.segment_id,
+                StandaloneShutdownReason::UserExit,
+            )
+            .is_err()
+        {
+            self.retain_lease();
+            return Err(StandaloneShutdownError::StateStore);
+        }
+        if let Some(lease) = self.lease.take() {
+            lease
+                .release()
+                .map_err(|_| StandaloneShutdownError::StateStore)?;
+        }
+        Ok(())
+    }
+
+    fn retain_lease(&mut self) {
+        if let Some(lease) = self.lease.take() {
+            lease.retain();
+        }
+    }
+}
+
+async fn run_protocol_session(
+    handle: worker::WorkerHandle,
+    streams: WorkerProtocolSessionStreams,
+    mut peer: InProcessPeer,
+) {
+    let WorkerProtocolSessionStreams {
+        snapshot_event,
+        mut log_entries,
+        alert_snapshot,
+        mut events,
+    } = streams;
+
+    if !send_protocol_snapshot(&peer, alert_snapshot, snapshot_event).await {
+        return;
+    }
+
+    loop {
+        tokio::select! {
+            message = peer.next() => {
+                let Some(message) = message else {
+                    return;
+                };
+                let Ok(method) = decode_method(&message) else {
+                    return;
+                };
+                if let Some(event) = dispatch_worker_protocol_method(&handle, method).await
+                    && !send_protocol_event(&peer, event).await
+                {
+                    return;
+                }
+            }
+            event = events.recv() => {
+                match event {
+                    Ok(event) => {
+                        if !send_protocol_event(&peer, event).await {
+                            return;
+                        }
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                        let replacement = subscribe_worker_protocol_session(&handle);
+                        let WorkerProtocolSessionStreams {
+                            snapshot_event,
+                            log_entries: replacement_log_entries,
+                            alert_snapshot,
+                            events: replacement_events,
+                        } = replacement;
+                        log_entries = replacement_log_entries;
+                        events = replacement_events;
+                        if !send_protocol_snapshot(&peer, alert_snapshot, snapshot_event).await {
+                            return;
+                        }
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => return,
+                }
+            }
+            entry = log_entries.recv() => {
+                match entry {
+                    Ok(entry) => {
+                        if let Some(event) = live_log_entry_event(entry)
+                            && !send_protocol_event(&peer, event).await
+                        {
+                            return;
+                        }
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                        let replacement = subscribe_worker_protocol_session(&handle);
+                        let WorkerProtocolSessionStreams {
+                            snapshot_event,
+                            log_entries: replacement_log_entries,
+                            alert_snapshot,
+                            events: replacement_events,
+                        } = replacement;
+                        log_entries = replacement_log_entries;
+                        events = replacement_events;
+                        if !send_protocol_snapshot(&peer, alert_snapshot, snapshot_event).await {
+                            return;
+                        }
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => return,
+                }
+            }
+        }
+    }
+}
+
+async fn send_protocol_snapshot(
+    peer: &InProcessPeer,
+    alert_snapshot: Vec<protocol::Alert>,
+    snapshot_event: Event,
+) -> bool {
+    for alert in alert_snapshot {
+        if !send_protocol_event(peer, Event::Alert(alert)).await {
+            return false;
+        }
+    }
+    send_protocol_event(peer, snapshot_event).await
+}
+
+async fn send_protocol_event(peer: &InProcessPeer, event: Event) -> bool {
+    let Ok(message) = encode_event(&event) else {
+        return false;
+    };
+    peer.send(message).await.is_ok()
+}
+
+fn backing_store(
+    store: &StandaloneWorkerStore,
+    worker_id: WorkerId,
+) -> Result<(StandaloneBackingStore, FsWorkerStore), StandaloneStartupError> {
+    let session_store = FsStore::new(store.sessions_dir(worker_id))
+        .map_err(|_| StandaloneStartupError::StateStore)?;
+    let worker_store = FsWorkerStore::new(store.worker_metadata_dir(worker_id))
+        .map_err(|_| StandaloneStartupError::StateStore)?;
+    Ok((
+        CombinedStore::new(session_store, worker_store.clone()),
+        worker_store,
+    ))
+}
+
+fn active_pointer(
+    worker_store: &FsWorkerStore,
+    storage_key: &str,
+) -> Result<WorkerActiveSegmentRef, StandaloneStartupError> {
+    worker_store
+        .read_by_name(storage_key)
+        .map_err(|_| StandaloneStartupError::StateStore)?
+        .and_then(|metadata| metadata.active)
+        .ok_or(StandaloneStartupError::StateStore)
+}
+
+async fn stop_started_worker(started: BootstrappedWorker) {
+    let command = protocol::WorkerCommandEnvelope::for_snapshot(
+        u64::MAX,
+        &started.handle.shared_state.snapshot(),
+    );
+    let _ = started.handle.send(Method::Shutdown { command }).await;
+    let _ = tokio::time::timeout(Duration::from_secs(2), started.shutdown).await;
+}
+
+fn classify_store_startup_error(error: StandaloneStoreError) -> StandaloneStartupError {
+    match error {
+        StandaloneStoreError::WorkerLeased(_) => StandaloneStartupError::WorkerActive,
+        StandaloneStoreError::LeaseLivenessUnknown(_) => {
+            StandaloneStartupError::LeaseLivenessUnknown
+        }
+        StandaloneStoreError::CwdUnavailable(_)
+        | StandaloneStoreError::CwdNotDirectory
+        | StandaloneStoreError::CwdIdentityMismatch => {
+            StandaloneStartupError::WorkingDirectoryUnavailable
+        }
+        _ => StandaloneStartupError::StateStore,
+    }
+}
+
+fn classify_startup_error(error: WorkerBootstrapError) -> StandaloneStartupError {
+    match error {
+        WorkerBootstrapError::Worker(WorkerError::ScopeLock(ScopeLockError::WriteConflict {
+            competitor,
+            rule,
+            competitor_rule,
+        })) => StandaloneStartupError::ScopeConflict {
+            competitor,
+            requested_rule: rule,
+            competitor_rule,
+        },
+        WorkerBootstrapError::Worker(WorkerError::Provider(_)) => {
+            StandaloneStartupError::ModelProvider
+        }
+        WorkerBootstrapError::Worker(_) => StandaloneStartupError::WorkerConfiguration,
+        WorkerBootstrapError::Controller { source, .. }
+            if source.kind() == std::io::ErrorKind::Other =>
+        {
+            StandaloneStartupError::FeatureComposition
+        }
+        WorkerBootstrapError::Controller { .. } => StandaloneStartupError::Controller,
+    }
+}

crates/standalone/src/launch.rs

@@ -0,0 +1,86 @@
+use std::path::{Path, PathBuf};
+
+use manifest::{
+    ProfileExecutionTarget, ProfileResolveOptions, ProfileResolver, ProfileSelector,
+    ResolvedProfile,
+};
+use thiserror::Error;
+use worker::PromptCatalogSource;
+
+/// Process launch input resolved before any Worker/session side effect occurs.
+#[derive(Debug, Clone)]
+pub struct StandaloneLaunchConfig {
+    pub cwd: PathBuf,
+    pub state_dir: PathBuf,
+    pub profile: ProfileSelector,
+    pub worker_name: String,
+}
+
+pub struct ResolvedStandaloneLaunch {
+    pub cwd: PathBuf,
+    pub state_dir: PathBuf,
+    pub profile: ResolvedProfile,
+    pub prompt_catalog: PromptCatalogSource,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum StandaloneLaunchError {
+    #[error("the standalone working directory is unavailable")]
+    WorkingDirectoryUnavailable,
+    #[error("path-based profiles are not standalone launch authority")]
+    PathProfileUnsupported,
+    #[error("the standalone profile could not be resolved")]
+    ProfileResolutionFailed,
+}
+
+impl StandaloneLaunchConfig {
+    pub fn new(
+        cwd: impl Into<PathBuf>,
+        state_dir: impl Into<PathBuf>,
+        profile: ProfileSelector,
+        worker_name: impl Into<String>,
+    ) -> Self {
+        Self {
+            cwd: cwd.into(),
+            state_dir: state_dir.into(),
+            profile,
+            worker_name: worker_name.into(),
+        }
+    }
+
+    /// Resolve only built-in/XDG profile authority and bind standalone scope
+    /// to the canonical process cwd. Repository-local profile discovery is
+    /// deliberately not part of this path.
+    pub fn resolve(self) -> Result<ResolvedStandaloneLaunch, StandaloneLaunchError> {
+        if matches!(self.profile, ProfileSelector::Path { .. }) {
+            return Err(StandaloneLaunchError::PathProfileUnsupported);
+        }
+        let cwd = canonical_directory(&self.cwd)?;
+        let profile = ProfileResolver::new()
+            .with_workspace_base(&cwd)
+            .resolve_for_target(
+                &self.profile,
+                ProfileResolveOptions {
+                    worker_name: Some(self.worker_name),
+                },
+                ProfileExecutionTarget::Standalone,
+            )
+            .map_err(|_| StandaloneLaunchError::ProfileResolutionFailed)?;
+
+        Ok(ResolvedStandaloneLaunch {
+            cwd,
+            state_dir: self.state_dir,
+            profile,
+            prompt_catalog: PromptCatalogSource::builtins_only(),
+        })
+    }
+}
+
+fn canonical_directory(path: &Path) -> Result<PathBuf, StandaloneLaunchError> {
+    let path = std::fs::canonicalize(path)
+        .map_err(|_| StandaloneLaunchError::WorkingDirectoryUnavailable)?;
+    if !path.is_dir() {
+        return Err(StandaloneLaunchError::WorkingDirectoryUnavailable);
+    }
+    Ok(path)
+}

crates/standalone/src/lib.rs

@@ -0,0 +1,17 @@
+//! In-process standalone host for one top-level Yoi Worker.
+//!
+//! The crate composes existing `worker`, `manifest`, `session-store`, and
+//! `workdir` contracts. It intentionally owns no TUI, Runtime, Workspace
+//! Server, HTTP, WebSocket, subprocess Worker, or alternative execution path.
+
+pub mod host;
+pub mod launch;
+pub mod store;
+
+pub use host::{StandaloneHost, StandaloneShutdownError, StandaloneStartupError};
+pub use launch::{ResolvedStandaloneLaunch, StandaloneLaunchConfig, StandaloneLaunchError};
+pub use protocol::WorkerId;
+pub use store::{
+    StaleLeasePolicy, StandaloneCwdIdentity, StandaloneListScope, StandaloneShutdownReason,
+    StandaloneStoreError, StandaloneWorkerRecord, StandaloneWorkerStatus, StandaloneWorkerStore,
+};

crates/standalone/src/store.rs

@@ -0,0 +1,846 @@
+use std::fs::{self, File, OpenOptions};
+use std::io::{self, Write};
+use std::path::{Path, PathBuf};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use fs4::fs_std::FileExt;
+use manifest::WorkerManifest;
+use protocol::WorkerId;
+use serde::{Deserialize, Serialize};
+use session_store::{SegmentId, SessionId};
+use thiserror::Error;
+use uuid::Uuid;
+
+const RECORD_FILE: &str = "record.json";
+const COMMIT_MARKER: &str = "commit.pending";
+const LEASE_FILE: &str = "lease.json";
+const LEASE_LOCK_FILE: &str = "lease.lock";
+const SESSIONS_DIR: &str = "sessions";
+const WORKER_DIR: &str = "worker";
+const SCHEMA_VERSION: u32 = 1;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct StandaloneCwdIdentity {
+    pub canonical_path: PathBuf,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub device: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub inode: Option<u64>,
+}
+
+impl StandaloneCwdIdentity {
+    pub fn capture(path: impl AsRef<Path>) -> Result<Self, StandaloneStoreError> {
+        let canonical_path =
+            fs::canonicalize(path).map_err(StandaloneStoreError::CwdUnavailable)?;
+        let metadata =
+            fs::metadata(&canonical_path).map_err(StandaloneStoreError::CwdUnavailable)?;
+        if !metadata.is_dir() {
+            return Err(StandaloneStoreError::CwdNotDirectory);
+        }
+        #[cfg(unix)]
+        let (device, inode) = {
+            use std::os::unix::fs::MetadataExt;
+            (Some(metadata.dev()), Some(metadata.ino()))
+        };
+        #[cfg(not(unix))]
+        let (device, inode) = (None, None);
+        Ok(Self {
+            canonical_path,
+            device,
+            inode,
+        })
+    }
+
+    pub fn verify(&self) -> Result<PathBuf, StandaloneStoreError> {
+        let current = Self::capture(&self.canonical_path)?;
+        if current != *self {
+            return Err(StandaloneStoreError::CwdIdentityMismatch);
+        }
+        Ok(current.canonical_path)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum StandaloneWorkerStatus {
+    Active,
+    Stopped,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum StandaloneShutdownReason {
+    UserExit,
+    StartupFailed,
+    ControllerError,
+    ProcessInterrupted,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct StandaloneWorkerRecord {
+    pub schema_version: u32,
+    pub revision: u64,
+    pub worker_id: WorkerId,
+    /// User-facing Worker name resolved from the profile.
+    pub worker_name: String,
+    /// Internal key used by the current name-keyed Worker store.
+    pub storage_key: String,
+    pub cwd: StandaloneCwdIdentity,
+    pub manifest: WorkerManifest,
+    pub active_session_id: SessionId,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub active_segment_id: Option<SegmentId>,
+    pub status: StandaloneWorkerStatus,
+    pub created_at_unix_ms: u64,
+    pub updated_at_unix_ms: u64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub shutdown_reason: Option<StandaloneShutdownReason>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StandaloneListScope {
+    CurrentCwd,
+    All,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StaleLeasePolicy {
+    Reject,
+    Recover,
+}
+
+#[derive(Debug, Clone)]
+pub struct StandaloneWorkerStore {
+    root: PathBuf,
+}
+
+impl StandaloneWorkerStore {
+    pub fn open(root: impl Into<PathBuf>) -> Result<Self, StandaloneStoreError> {
+        let root = root.into();
+        fs::create_dir_all(&root).map_err(StandaloneStoreError::Io)?;
+        if !fs::metadata(&root)
+            .map_err(StandaloneStoreError::Io)?
+            .is_dir()
+        {
+            return Err(StandaloneStoreError::NotDirectory);
+        }
+        Ok(Self { root })
+    }
+
+    #[must_use]
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    pub fn allocate(
+        &self,
+        cwd: impl AsRef<Path>,
+        policy: StaleLeasePolicy,
+    ) -> Result<StandaloneWorkerAllocation, StandaloneStoreError> {
+        let worker_id = WorkerId::now_v7();
+        let cwd = StandaloneCwdIdentity::capture(cwd)?;
+        let dir = self.worker_dir(worker_id);
+        fs::create_dir(&dir).map_err(StandaloneStoreError::Io)?;
+        fs::create_dir(dir.join(SESSIONS_DIR)).map_err(StandaloneStoreError::Io)?;
+        fs::create_dir(dir.join(WORKER_DIR)).map_err(StandaloneStoreError::Io)?;
+        let lease = self.acquire_lease(worker_id, policy)?;
+        Ok(StandaloneWorkerAllocation {
+            worker_id,
+            cwd,
+            lease,
+        })
+    }
+
+    pub fn commit_created(
+        &self,
+        allocation: &StandaloneWorkerAllocation,
+        manifest: WorkerManifest,
+        storage_key: String,
+        active_session_id: SessionId,
+        active_segment_id: Option<SegmentId>,
+    ) -> Result<StandaloneWorkerRecord, StandaloneStoreError> {
+        let now = now_unix_ms()?;
+        let record = StandaloneWorkerRecord {
+            schema_version: SCHEMA_VERSION,
+            revision: 1,
+            worker_id: allocation.worker_id,
+            worker_name: manifest.worker.name.clone(),
+            storage_key,
+            cwd: allocation.cwd.clone(),
+            manifest,
+            active_session_id,
+            active_segment_id,
+            status: StandaloneWorkerStatus::Active,
+            created_at_unix_ms: now,
+            updated_at_unix_ms: now,
+            shutdown_reason: None,
+        };
+        self.commit_record(None, &record)?;
+        Ok(record)
+    }
+
+    pub fn load(&self, id: WorkerId) -> Result<StandaloneWorkerRecord, StandaloneStoreError> {
+        let dir = self.worker_dir(id);
+        if dir.join(COMMIT_MARKER).exists() {
+            return Err(StandaloneStoreError::IncompleteCommit(id));
+        }
+        let bytes = fs::read(dir.join(RECORD_FILE)).map_err(|error| {
+            if error.kind() == io::ErrorKind::NotFound {
+                StandaloneStoreError::WorkerNotFound(id)
+            } else {
+                StandaloneStoreError::Io(error)
+            }
+        })?;
+        let record = decode_worker_record(id, &bytes)?;
+        if record.schema_version > SCHEMA_VERSION {
+            return Err(StandaloneStoreError::NewerSchema {
+                id,
+                found: record.schema_version,
+                supported: SCHEMA_VERSION,
+            });
+        }
+        if record.schema_version != SCHEMA_VERSION || record.worker_id != id {
+            return Err(StandaloneStoreError::InvalidRecord(id));
+        }
+        Ok(record)
+    }
+
+    pub fn list(
+        &self,
+        cwd: impl AsRef<Path>,
+        scope: StandaloneListScope,
+        limit: usize,
+    ) -> Result<Vec<StandaloneWorkerRecord>, StandaloneStoreError> {
+        let current_cwd = (scope == StandaloneListScope::CurrentCwd)
+            .then(|| StandaloneCwdIdentity::capture(cwd))
+            .transpose()?;
+        let mut records = Vec::new();
+        for entry in fs::read_dir(&self.root).map_err(StandaloneStoreError::Io)? {
+            let entry = entry.map_err(StandaloneStoreError::Io)?;
+            if !entry
+                .file_type()
+                .map_err(StandaloneStoreError::Io)?
+                .is_dir()
+            {
+                continue;
+            }
+            let Ok(id) = entry.file_name().to_string_lossy().parse() else {
+                continue;
+            };
+            let record = self.load(id)?;
+            if current_cwd.as_ref().is_none_or(|cwd| &record.cwd == cwd) {
+                records.push(record);
+            }
+        }
+        records.sort_by(|left, right| {
+            right
+                .updated_at_unix_ms
+                .cmp(&left.updated_at_unix_ms)
+                .then_with(|| right.worker_id.to_string().cmp(&left.worker_id.to_string()))
+        });
+        records.truncate(limit);
+        Ok(records)
+    }
+
+    pub fn acquire_lease(
+        &self,
+        id: WorkerId,
+        policy: StaleLeasePolicy,
+    ) -> Result<StandaloneWorkerLease, StandaloneStoreError> {
+        let dir = self.worker_dir(id);
+        let path = dir.join(LEASE_FILE);
+        let _guard = LeaseMutationGuard::acquire(&dir)?;
+        let lease = LeaseRecord::current()?;
+        loop {
+            match OpenOptions::new().write(true).create_new(true).open(&path) {
+                Ok(mut file) => {
+                    serde_json::to_writer(&mut file, &lease).map_err(StandaloneStoreError::Json)?;
+                    file.write_all(b"\n").map_err(StandaloneStoreError::Io)?;
+                    file.sync_all().map_err(StandaloneStoreError::Io)?;
+                    sync_directory(&dir)?;
+                    return Ok(StandaloneWorkerLease {
+                        path,
+                        lease_id: lease.lease_id,
+                        released: false,
+                    });
+                }
+                Err(error) if error.kind() == io::ErrorKind::AlreadyExists => {
+                    let existing = read_lease(&path, id)?;
+                    match existing.liveness() {
+                        LeaseLiveness::Live => {
+                            return Err(StandaloneStoreError::WorkerLeased(id));
+                        }
+                        LeaseLiveness::Unknown => {
+                            return Err(StandaloneStoreError::LeaseLivenessUnknown(id));
+                        }
+                        LeaseLiveness::Stale => {}
+                    }
+                    if policy == StaleLeasePolicy::Reject {
+                        return Err(StandaloneStoreError::StaleLease(id));
+                    }
+                    fs::remove_file(&path).map_err(StandaloneStoreError::Io)?;
+                    sync_directory(&dir)?;
+                }
+                Err(error) => return Err(StandaloneStoreError::Io(error)),
+            }
+        }
+    }
+
+    pub fn update_active_pointer(
+        &self,
+        record: &StandaloneWorkerRecord,
+        active_session_id: SessionId,
+        active_segment_id: Option<SegmentId>,
+    ) -> Result<StandaloneWorkerRecord, StandaloneStoreError> {
+        let mut next = record.clone();
+        next.revision = next.revision.saturating_add(1);
+        next.updated_at_unix_ms = now_unix_ms()?;
+        next.active_session_id = active_session_id;
+        next.active_segment_id = active_segment_id;
+        next.status = StandaloneWorkerStatus::Active;
+        next.shutdown_reason = None;
+        self.commit_record(Some(record.revision), &next)?;
+        Ok(next)
+    }
+
+    pub fn mark_stopped(
+        &self,
+        record: &StandaloneWorkerRecord,
+        active_session_id: SessionId,
+        active_segment_id: Option<SegmentId>,
+        reason: StandaloneShutdownReason,
+    ) -> Result<StandaloneWorkerRecord, StandaloneStoreError> {
+        let mut next = record.clone();
+        next.revision = next.revision.saturating_add(1);
+        next.updated_at_unix_ms = now_unix_ms()?;
+        next.active_session_id = active_session_id;
+        next.active_segment_id = active_segment_id;
+        next.status = StandaloneWorkerStatus::Stopped;
+        next.shutdown_reason = Some(reason);
+        self.commit_record(Some(record.revision), &next)?;
+        Ok(next)
+    }
+
+    pub fn delete(&self, id: WorkerId) -> Result<(), StandaloneStoreError> {
+        let record = self.load(id)?;
+        if record.status != StandaloneWorkerStatus::Stopped {
+            return Err(StandaloneStoreError::DeleteActive(id));
+        }
+        let worker_dir = self.worker_dir(id);
+        let _guard = LeaseMutationGuard::acquire(&worker_dir)?;
+        let lease_path = worker_dir.join(LEASE_FILE);
+        if lease_path.exists() {
+            let lease = read_lease(&lease_path, id)?;
+            return Err(match lease.liveness() {
+                LeaseLiveness::Live => StandaloneStoreError::WorkerLeased(id),
+                LeaseLiveness::Stale => StandaloneStoreError::StaleLease(id),
+                LeaseLiveness::Unknown => StandaloneStoreError::LeaseLivenessUnknown(id),
+            });
+        }
+        fs::remove_dir_all(self.worker_dir(id)).map_err(StandaloneStoreError::Io)?;
+        sync_directory(&self.root)
+    }
+
+    #[must_use]
+    pub fn sessions_dir(&self, id: WorkerId) -> PathBuf {
+        self.worker_dir(id).join(SESSIONS_DIR)
+    }
+
+    #[must_use]
+    pub fn worker_metadata_dir(&self, id: WorkerId) -> PathBuf {
+        self.worker_dir(id).join(WORKER_DIR)
+    }
+
+    #[must_use]
+    pub(crate) fn runtime_dir(&self, id: WorkerId) -> PathBuf {
+        self.worker_dir(id).join("runtime")
+    }
+
+    pub(crate) fn abandon_allocation(
+        &self,
+        allocation: StandaloneWorkerAllocation,
+    ) -> Result<(), StandaloneStoreError> {
+        let worker_id = allocation.worker_id;
+        allocation.lease.release()?;
+        fs::remove_dir_all(self.worker_dir(worker_id)).map_err(StandaloneStoreError::Io)?;
+        sync_directory(&self.root)
+    }
+
+    fn commit_record(
+        &self,
+        expected_revision: Option<u64>,
+        next: &StandaloneWorkerRecord,
+    ) -> Result<(), StandaloneStoreError> {
+        let dir = self.worker_dir(next.worker_id);
+        let marker = dir.join(COMMIT_MARKER);
+        let mut marker_file = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&marker)
+            .map_err(|error| {
+                if error.kind() == io::ErrorKind::AlreadyExists {
+                    StandaloneStoreError::IncompleteCommit(next.worker_id)
+                } else {
+                    StandaloneStoreError::Io(error)
+                }
+            })?;
+        writeln!(marker_file, "{}", next.revision).map_err(StandaloneStoreError::Io)?;
+        marker_file.sync_all().map_err(StandaloneStoreError::Io)?;
+        sync_directory(&dir)?;
+
+        if let Some(expected) = expected_revision {
+            let current = self.load_record_while_committing(next.worker_id)?;
+            if current.revision != expected {
+                let _ = fs::remove_file(&marker);
+                return Err(StandaloneStoreError::RevisionConflict {
+                    id: next.worker_id,
+                    expected,
+                    found: current.revision,
+                });
+            }
+        }
+
+        let temporary = dir.join(format!("record.{}.tmp", Uuid::now_v7()));
+        let result = (|| {
+            let mut file = OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .open(&temporary)
+                .map_err(StandaloneStoreError::Io)?;
+            write_worker_record(&mut file, next)?;
+            file.write_all(b"\n").map_err(StandaloneStoreError::Io)?;
+            file.sync_all().map_err(StandaloneStoreError::Io)?;
+            fs::rename(&temporary, dir.join(RECORD_FILE)).map_err(StandaloneStoreError::Io)?;
+            sync_directory(&dir)?;
+            fs::remove_file(&marker).map_err(StandaloneStoreError::Io)?;
+            sync_directory(&dir)
+        })();
+        if result.is_err() {
+            let _ = fs::remove_file(&temporary);
+        }
+        result
+    }
+
+    fn load_record_while_committing(
+        &self,
+        id: WorkerId,
+    ) -> Result<StandaloneWorkerRecord, StandaloneStoreError> {
+        let bytes =
+            fs::read(self.worker_dir(id).join(RECORD_FILE)).map_err(StandaloneStoreError::Io)?;
+        decode_worker_record(id, &bytes)
+    }
+
+    fn worker_dir(&self, id: WorkerId) -> PathBuf {
+        self.root.join(id.to_string())
+    }
+}
+
+#[derive(Debug)]
+pub struct StandaloneWorkerAllocation {
+    worker_id: WorkerId,
+    cwd: StandaloneCwdIdentity,
+    lease: StandaloneWorkerLease,
+}
+
+impl StandaloneWorkerAllocation {
+    #[must_use]
+    pub fn worker_id(&self) -> WorkerId {
+        self.worker_id
+    }
+
+    #[must_use]
+    pub fn cwd(&self) -> &StandaloneCwdIdentity {
+        &self.cwd
+    }
+
+    pub fn into_lease(self) -> StandaloneWorkerLease {
+        self.lease
+    }
+}
+
+#[derive(Debug)]
+pub struct StandaloneWorkerLease {
+    path: PathBuf,
+    lease_id: Uuid,
+    released: bool,
+}
+
+impl StandaloneWorkerLease {
+    pub fn release(mut self) -> Result<(), StandaloneStoreError> {
+        self.release_inner()
+    }
+
+    pub(crate) fn retain(mut self) {
+        self.released = true;
+    }
+
+    fn release_inner(&mut self) -> Result<(), StandaloneStoreError> {
+        if self.released {
+            return Ok(());
+        }
+        if self.path.exists() {
+            let parent = self.path.parent().expect("lease parent");
+            let _guard = LeaseMutationGuard::acquire(parent)?;
+            let bytes = fs::read(&self.path).map_err(StandaloneStoreError::Io)?;
+            let current: LeaseRecord =
+                serde_json::from_slice(&bytes).map_err(StandaloneStoreError::Json)?;
+            if current.lease_id != self.lease_id {
+                return Err(StandaloneStoreError::LeaseOwnershipLost);
+            }
+            fs::remove_file(&self.path).map_err(StandaloneStoreError::Io)?;
+            sync_directory(self.path.parent().expect("lease parent"))?;
+        }
+        self.released = true;
+        Ok(())
+    }
+}
+
+impl Drop for StandaloneWorkerLease {
+    fn drop(&mut self) {
+        let _ = self.release_inner();
+    }
+}
+
+struct LeaseMutationGuard {
+    file: File,
+}
+
+impl LeaseMutationGuard {
+    fn acquire(dir: &Path) -> Result<Self, StandaloneStoreError> {
+        let file = OpenOptions::new()
+            .read(true)
+            .write(true)
+            .create(true)
+            .truncate(false)
+            .open(dir.join(LEASE_LOCK_FILE))
+            .map_err(StandaloneStoreError::Io)?;
+        file.lock_exclusive().map_err(StandaloneStoreError::Io)?;
+        Ok(Self { file })
+    }
+}
+
+impl Drop for LeaseMutationGuard {
+    fn drop(&mut self) {
+        let _ = FileExt::unlock(&self.file);
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct LeaseRecord {
+    lease_id: Uuid,
+    pid: u32,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    process_start_marker: Option<u64>,
+    acquired_at_unix_ms: u64,
+}
+
+impl LeaseRecord {
+    fn current() -> Result<Self, StandaloneStoreError> {
+        Ok(Self {
+            lease_id: Uuid::now_v7(),
+            pid: std::process::id(),
+            process_start_marker: match observe_process(std::process::id()) {
+                ProcessObservation::Running { start_marker } => Some(start_marker),
+                ProcessObservation::Missing | ProcessObservation::Unobservable => None,
+            },
+            acquired_at_unix_ms: now_unix_ms()?,
+        })
+    }
+
+    fn liveness(&self) -> LeaseLiveness {
+        classify_lease_liveness(self.process_start_marker, observe_process(self.pid))
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum LeaseLiveness {
+    Live,
+    Stale,
+    Unknown,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum ProcessObservation {
+    Running { start_marker: u64 },
+    Missing,
+    Unobservable,
+}
+
+fn classify_lease_liveness(
+    recorded_start_marker: Option<u64>,
+    observation: ProcessObservation,
+) -> LeaseLiveness {
+    match (recorded_start_marker, observation) {
+        (Some(recorded), ProcessObservation::Running { start_marker })
+            if recorded == start_marker =>
+        {
+            LeaseLiveness::Live
+        }
+        (Some(_), ProcessObservation::Running { .. }) | (_, ProcessObservation::Missing) => {
+            LeaseLiveness::Stale
+        }
+        (None, ProcessObservation::Running { .. }) | (_, ProcessObservation::Unobservable) => {
+            LeaseLiveness::Unknown
+        }
+    }
+}
+
+fn read_lease(path: &Path, id: WorkerId) -> Result<LeaseRecord, StandaloneStoreError> {
+    let bytes = fs::read(path).map_err(StandaloneStoreError::Io)?;
+    serde_json::from_slice(&bytes)
+        .map_err(|source| StandaloneStoreError::CorruptLease { id, source })
+}
+
+#[cfg(target_os = "linux")]
+fn observe_process(pid: u32) -> ProcessObservation {
+    let stat = match fs::read_to_string(format!("/proc/{pid}/stat")) {
+        Ok(stat) => stat,
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {
+            return if pid != std::process::id() && linux_proc_is_observable() {
+                ProcessObservation::Missing
+            } else {
+                ProcessObservation::Unobservable
+            };
+        }
+        Err(_) => return ProcessObservation::Unobservable,
+    };
+    parse_linux_process_start_marker(&stat)
+        .map(|start_marker| ProcessObservation::Running { start_marker })
+        .unwrap_or(ProcessObservation::Unobservable)
+}
+
+#[cfg(target_os = "linux")]
+fn linux_proc_is_observable() -> bool {
+    fs::read_to_string("/proc/self/stat")
+        .ok()
+        .and_then(|stat| parse_linux_process_start_marker(&stat))
+        .is_some()
+}
+
+#[cfg(target_os = "linux")]
+fn parse_linux_process_start_marker(stat: &str) -> Option<u64> {
+    let (_, tail) = stat.rsplit_once(") ")?;
+    tail.split_whitespace().nth(19)?.parse().ok()
+}
+
+#[cfg(not(target_os = "linux"))]
+fn observe_process(pid: u32) -> ProcessObservation {
+    if pid == std::process::id() {
+        ProcessObservation::Running { start_marker: 0 }
+    } else {
+        ProcessObservation::Unobservable
+    }
+}
+
+fn decode_worker_record(
+    id: WorkerId,
+    bytes: &[u8],
+) -> Result<StandaloneWorkerRecord, StandaloneStoreError> {
+    let decode = || -> Result<StandaloneWorkerRecord, serde_json::Error> {
+        let mut snapshot: serde_json::Value = serde_json::from_slice(bytes)?;
+        let object = snapshot.as_object_mut().ok_or_else(|| {
+            serde_json::Error::io(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "standalone Worker record must be an object",
+            ))
+        })?;
+        let persisted_manifest = object.remove("manifest").ok_or_else(|| {
+            serde_json::Error::io(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "standalone Worker record is missing manifest",
+            ))
+        })?;
+        let manifest = manifest::read_persisted_worker_manifest_snapshot(persisted_manifest)?;
+        object.insert("manifest".to_string(), serde_json::to_value(manifest)?);
+        serde_json::from_value(snapshot)
+    };
+    decode().map_err(|source| StandaloneStoreError::CorruptRecord { id, source })
+}
+
+fn write_worker_record(
+    writer: &mut impl Write,
+    record: &StandaloneWorkerRecord,
+) -> Result<(), StandaloneStoreError> {
+    let mut snapshot = serde_json::to_value(record).map_err(StandaloneStoreError::Json)?;
+    let object = snapshot.as_object_mut().ok_or_else(|| {
+        StandaloneStoreError::Json(serde_json::Error::io(io::Error::new(
+            io::ErrorKind::InvalidData,
+            "standalone Worker record must be an object",
+        )))
+    })?;
+    object.insert(
+        "manifest".to_string(),
+        manifest::write_persisted_worker_manifest_snapshot(&record.manifest)
+            .map_err(StandaloneStoreError::Json)?,
+    );
+    serde_json::to_writer_pretty(writer, &snapshot).map_err(StandaloneStoreError::Json)
+}
+
+fn now_unix_ms() -> Result<u64, StandaloneStoreError> {
+    let duration = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_err(|_| StandaloneStoreError::Clock)?;
+    u64::try_from(duration.as_millis()).map_err(|_| StandaloneStoreError::Clock)
+}
+
+fn sync_directory(path: &Path) -> Result<(), StandaloneStoreError> {
+    File::open(path)
+        .and_then(|file| file.sync_all())
+        .map_err(StandaloneStoreError::Io)
+}
+
+#[derive(Debug, Error)]
+pub enum StandaloneStoreError {
+    #[error("standalone state path is not a directory")]
+    NotDirectory,
+    #[error("standalone cwd is unavailable")]
+    CwdUnavailable(#[source] io::Error),
+    #[error("standalone cwd is not a directory")]
+    CwdNotDirectory,
+    #[error("standalone cwd identity no longer matches the persisted Worker")]
+    CwdIdentityMismatch,
+    #[error("standalone Worker {0} was not found")]
+    WorkerNotFound(WorkerId),
+    #[error("standalone Worker {0} has an incomplete metadata commit")]
+    IncompleteCommit(WorkerId),
+    #[error("standalone Worker {0} has invalid metadata")]
+    InvalidRecord(WorkerId),
+    #[error("standalone Worker {id} metadata is corrupt")]
+    CorruptRecord {
+        id: WorkerId,
+        #[source]
+        source: serde_json::Error,
+    },
+    #[error("standalone Worker {id} lease is corrupt")]
+    CorruptLease {
+        id: WorkerId,
+        #[source]
+        source: serde_json::Error,
+    },
+    #[error("standalone Worker {id} uses schema {found}, newer than supported schema {supported}")]
+    NewerSchema {
+        id: WorkerId,
+        found: u32,
+        supported: u32,
+    },
+    #[error("standalone Worker {0} is already active")]
+    WorkerLeased(WorkerId),
+    #[error("standalone Worker {0} lease liveness cannot be proven; recovery is rejected")]
+    LeaseLivenessUnknown(WorkerId),
+    #[error("standalone Worker {0} has a stale lease; explicit recovery is required")]
+    StaleLease(WorkerId),
+    #[error("standalone Worker lease ownership changed")]
+    LeaseOwnershipLost,
+    #[error("standalone Worker {0} must be stopped before deletion")]
+    DeleteActive(WorkerId),
+    #[error(
+        "standalone Worker {id} metadata revision changed (expected {expected}, found {found})"
+    )]
+    RevisionConflict {
+        id: WorkerId,
+        expected: u64,
+        found: u64,
+    },
+    #[error("system clock is before the Unix epoch or out of range")]
+    Clock,
+    #[error("standalone metadata serialization failed")]
+    Json(#[source] serde_json::Error),
+    #[error("standalone state I/O failed")]
+    Io(#[source] io::Error),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_manifest() -> WorkerManifest {
+        WorkerManifest::from_toml(
+            r#"
+[worker]
+name = "standalone-test"
+
+[model]
+scheme = "anthropic"
+model_id = "claude-sonnet-4-20250514"
+
+[engine]
+
+[[scope.allow]]
+target = "/tmp"
+permission = "write"
+"#,
+        )
+        .unwrap()
+    }
+
+    #[test]
+    fn standalone_record_uses_versioned_manifest_adapter_for_legacy_memory() {
+        let worker_id = "01a05782-d5dd-78f1-b9cd-ce37535bdb9d".parse().unwrap();
+        let manifest = test_manifest();
+        let record = StandaloneWorkerRecord {
+            schema_version: SCHEMA_VERSION,
+            revision: 6,
+            worker_id,
+            worker_name: manifest.worker.name.clone(),
+            storage_key: "standalone-test".to_string(),
+            cwd: StandaloneCwdIdentity {
+                canonical_path: PathBuf::from("/tmp"),
+                device: None,
+                inode: None,
+            },
+            manifest,
+            active_session_id: "01a05782-d5dd-78f1-b9cd-ce37535bdb9e".parse().unwrap(),
+            active_segment_id: None,
+            status: StandaloneWorkerStatus::Stopped,
+            created_at_unix_ms: 1,
+            updated_at_unix_ms: 2,
+            shutdown_reason: None,
+        };
+        let mut legacy = serde_json::to_value(&record).unwrap();
+        legacy["manifest"]["feature"]["memory"] = serde_json::json!({
+            "enabled": false,
+            "staging": false,
+        });
+
+        let decoded =
+            decode_worker_record(worker_id, &serde_json::to_vec(&legacy).unwrap()).unwrap();
+        assert!(!decoded.manifest.feature.memory.profile.enabled);
+
+        let mut persisted = Vec::new();
+        write_worker_record(&mut persisted, &decoded).unwrap();
+        let persisted: serde_json::Value = serde_json::from_slice(&persisted).unwrap();
+        assert_eq!(persisted["manifest"]["schema_version"], 2);
+        assert_eq!(
+            persisted["manifest"]["manifest"]["feature"]["memory"]["profile"]["enabled"],
+            false
+        );
+    }
+
+    #[test]
+    fn lease_liveness_requires_positive_live_or_stale_evidence() {
+        assert_eq!(
+            classify_lease_liveness(Some(41), ProcessObservation::Running { start_marker: 41 }),
+            LeaseLiveness::Live
+        );
+        assert_eq!(
+            classify_lease_liveness(Some(41), ProcessObservation::Running { start_marker: 42 }),
+            LeaseLiveness::Stale
+        );
+        assert_eq!(
+            classify_lease_liveness(Some(41), ProcessObservation::Missing),
+            LeaseLiveness::Stale
+        );
+        assert_eq!(
+            classify_lease_liveness(None, ProcessObservation::Running { start_marker: 41 }),
+            LeaseLiveness::Unknown
+        );
+        assert_eq!(
+            classify_lease_liveness(Some(41), ProcessObservation::Unobservable),
+            LeaseLiveness::Unknown
+        );
+        assert_eq!(
+            classify_lease_liveness(None, ProcessObservation::Unobservable),
+            LeaseLiveness::Unknown
+        );
+    }
+}

crates/standalone/tests/host.rs

@@ -0,0 +1,622 @@
+use std::collections::VecDeque;
+use std::pin::Pin;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use agen::llm_client::client::LlmClient;
+use agen::llm_client::error::ClientError;
+use agen::llm_client::event::{Event as LlmEvent, StopReason};
+use agen::llm_client::types::Request;
+use async_trait::async_trait;
+use client::Client;
+use client::transport::in_process::Socket as InProcessSocket;
+use futures::{Stream, stream};
+use protocol::{Event, Method};
+use standalone::{
+    StaleLeasePolicy, StandaloneHost, StandaloneLaunchConfig, StandaloneListScope,
+    StandaloneStartupError, StandaloneStoreError, StandaloneWorkerStatus, StandaloneWorkerStore,
+};
+use uuid::Uuid;
+
+#[derive(Clone)]
+struct ScriptedClient {
+    responses: Arc<Mutex<VecDeque<Vec<LlmEvent>>>>,
+    requests: Arc<Mutex<Vec<Request>>>,
+}
+
+impl ScriptedClient {
+    fn new(responses: Vec<Vec<LlmEvent>>) -> Self {
+        Self {
+            responses: Arc::new(Mutex::new(responses.into())),
+            requests: Arc::new(Mutex::new(Vec::new())),
+        }
+    }
+
+    fn requests(&self) -> Vec<Request> {
+        self.requests.lock().expect("requests lock").clone()
+    }
+}
+
+#[async_trait]
+impl LlmClient for ScriptedClient {
+    async fn stream(
+        &self,
+        request: Request,
+    ) -> Result<Pin<Box<dyn Stream<Item = Result<LlmEvent, ClientError>> + Send>>, ClientError>
+    {
+        self.requests.lock().expect("requests lock").push(request);
+        let response = self
+            .responses
+            .lock()
+            .expect("responses lock")
+            .pop_front()
+            .expect("scripted response");
+        Ok(Box::pin(stream::iter(response.into_iter().map(Ok))))
+    }
+
+    fn clone_boxed(&self) -> Box<dyn LlmClient> {
+        Box::new(self.clone())
+    }
+}
+
+#[tokio::test]
+async fn in_process_host_runs_text_and_read_tool_then_shuts_down() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    std::fs::write(temp.path().join("probe.txt"), "standalone tool evidence\n")
+        .expect("write probe");
+    let worker_name = format!("standalone-{}", Uuid::now_v7());
+    let launch = StandaloneLaunchConfig::new(
+        temp.path(),
+        temp.path().join("state"),
+        manifest::ProfileSelector::Default,
+        &worker_name,
+    )
+    .resolve()
+    .expect("resolve standalone profile");
+
+    let client = ScriptedClient::new(vec![
+        vec![
+            LlmEvent::tool_use_start(0, "read-1", "Read"),
+            LlmEvent::tool_input_delta(0, r#"{"file_path":"probe.txt"}"#),
+            LlmEvent::tool_use_stop(0),
+        ],
+        vec![
+            LlmEvent::text_block_start(0),
+            LlmEvent::text_delta(0, "standalone response"),
+            LlmEvent::text_block_stop(0, Some(StopReason::EndTurn)),
+        ],
+    ]);
+    let inspection = client.clone();
+    let host = StandaloneHost::start_with_model_client(launch, client)
+        .await
+        .expect("start in-process host");
+    assert_eq!(host.record().worker_name, worker_name);
+    assert_eq!(host.record().manifest.worker.name, worker_name);
+    assert_eq!(
+        host.record().storage_key,
+        format!("standalone-{}", host.worker_id())
+    );
+    let mut protocol_client = host.connect();
+
+    protocol_client
+        .send(&Method::submit_text(
+            protocol::new_submission_request_id(),
+            "read the probe",
+        ))
+        .await
+        .expect("submit input");
+
+    tokio::time::timeout(Duration::from_secs(30), async {
+        let mut saw_user_message = false;
+        let mut saw_text = false;
+        let mut saw_tool_result = false;
+        loop {
+            match protocol_client
+                .next_event()
+                .await
+                .expect("protocol event")
+                .expect("worker event")
+            {
+                Event::UserMessage { segments }
+                    if format!("{segments:?}").contains("read the probe") =>
+                {
+                    saw_user_message = true;
+                }
+                Event::TextDelta { text } if text.contains("standalone response") => {
+                    saw_text = true;
+                }
+                Event::ToolResult { .. } => {
+                    saw_tool_result = true;
+                }
+                Event::RunEnd { .. } => {
+                    assert!(
+                        saw_user_message,
+                        "stream must expose the committed user message"
+                    );
+                    assert!(saw_text, "stream must expose the model text delta");
+                    assert!(saw_tool_result, "stream must expose the tool result");
+                    break;
+                }
+                _ => {}
+            }
+        }
+    })
+    .await
+    .expect("run completed");
+
+    let requests = inspection.requests();
+    assert_eq!(requests.len(), 2);
+    let tool_names = requests[0]
+        .tools
+        .iter()
+        .map(|tool| tool.name.as_str())
+        .collect::<Vec<_>>();
+    assert!(tool_names.contains(&"Read"));
+    assert!(tool_names.contains(&"TaskCreate"));
+    assert!(tool_names.contains(&"SubWorkerSpawn"));
+    assert!(format!("{:?}", requests[1].items).contains("standalone tool evidence"));
+    assert!(
+        !temp
+            .path()
+            .join("state/runtime")
+            .join(&worker_name)
+            .join("worker.sock")
+            .exists()
+    );
+
+    host.shutdown().await.expect("graceful shutdown");
+}
+
+#[tokio::test]
+async fn startup_preserves_occupied_scope_conflict_details() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let cwd = temp.path().join("project");
+    std::fs::create_dir(&cwd).expect("create project");
+
+    let first_launch = StandaloneLaunchConfig::new(
+        &cwd,
+        temp.path().join("first-state"),
+        manifest::ProfileSelector::Default,
+        "first-worker",
+    )
+    .resolve()
+    .expect("resolve first launch");
+    let first_host =
+        StandaloneHost::start_with_model_client(first_launch, ScriptedClient::new(Vec::new()))
+            .await
+            .expect("start first host");
+    let competitor = first_host.record().storage_key.clone();
+
+    let second_launch = StandaloneLaunchConfig::new(
+        &cwd,
+        temp.path().join("second-state"),
+        manifest::ProfileSelector::Default,
+        "second-worker",
+    )
+    .resolve()
+    .expect("resolve second launch");
+    let error =
+        StandaloneHost::start_with_model_client(second_launch, ScriptedClient::new(Vec::new()))
+            .await
+            .err()
+            .expect("occupied scope rejected");
+
+    first_host.shutdown().await.expect("shutdown first host");
+
+    let canonical_cwd = cwd.canonicalize().expect("canonical cwd");
+    match &error {
+        StandaloneStartupError::ScopeConflict {
+            competitor: actual_competitor,
+            requested_rule,
+            competitor_rule,
+        } => {
+            assert_eq!(actual_competitor, &competitor);
+            assert_eq!(requested_rule.target, canonical_cwd);
+            assert_eq!(competitor_rule.target, canonical_cwd);
+        }
+        other => panic!("expected scope conflict, got {other:?}"),
+    }
+    assert_eq!(
+        error.to_string(),
+        format!(
+            "requested scope `{}` conflicts with worker allocation `{competitor}` rule `{}`",
+            canonical_cwd.display(),
+            canonical_cwd.display()
+        )
+    );
+}
+
+#[tokio::test]
+async fn state_store_failure_is_redacted_and_starts_no_controller() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let state_path = temp.path().join("state-file-with-secret-name");
+    std::fs::write(&state_path, "not a directory").expect("write blocking file");
+    let launch = StandaloneLaunchConfig::new(
+        temp.path(),
+        &state_path,
+        manifest::ProfileSelector::Default,
+        format!("standalone-failure-{}", Uuid::now_v7()),
+    )
+    .resolve()
+    .expect("resolve launch");
+    let client = ScriptedClient::new(Vec::new());
+
+    let error = StandaloneHost::start_with_model_client(launch, client)
+        .await
+        .err()
+        .expect("state store startup rejected");
+    assert_eq!(error, standalone::StandaloneStartupError::StateStore);
+    assert_eq!(
+        error.to_string(),
+        "the standalone state store could not be opened or validated"
+    );
+    assert!(!error.to_string().contains("secret-name"));
+    assert!(
+        !temp
+            .path()
+            .join("state-file-with-secret-name/runtime")
+            .exists()
+    );
+}
+
+#[test]
+fn standalone_crate_has_no_tui_runtime_or_workspace_server_dependency() {
+    let manifest = include_str!("../Cargo.toml");
+    let dependencies = manifest
+        .split("[dependencies]")
+        .nth(1)
+        .expect("dependencies section")
+        .split("[dev-dependencies]")
+        .next()
+        .expect("dependency body");
+    for forbidden in ["tui", "worker-runtime", "yoi-workspace-server"] {
+        assert!(
+            !dependencies.lines().any(|line| {
+                line.split_once('=')
+                    .is_some_and(|(name, _)| name.trim() == forbidden)
+            }),
+            "standalone must not depend on {forbidden}"
+        );
+    }
+}
+
+#[test]
+fn launch_rejects_path_profile_before_worker_startup() {
+    let temp = tempfile::tempdir().expect("tempdir");
+    let error = StandaloneLaunchConfig::new(
+        temp.path(),
+        temp.path().join("state"),
+        manifest::ProfileSelector::Path {
+            path: temp.path().join("profile.dcdl"),
+        },
+        "standalone-path-profile",
+    )
+    .resolve()
+    .err()
+    .expect("path profile rejected");
+    assert_eq!(
+        error,
+        standalone::StandaloneLaunchError::PathProfileUnsupported
+    );
+}
+
+type TestResult = Result<(), Box<dyn std::error::Error>>;
+
+#[tokio::test]
+async fn standalone_restore_preserves_history_tasks_notifications_and_cwd_scope() -> TestResult {
+    let temp = tempfile::tempdir()?;
+    let cwd = temp.path().join("project");
+    let state_dir = temp.path().join("client").join("standalone-workers");
+    std::fs::create_dir_all(&cwd)?;
+    let launch = StandaloneLaunchConfig::new(
+        &cwd,
+        &state_dir,
+        manifest::ProfileSelector::Default,
+        "display-name-is-not-session-identity",
+    )
+    .resolve()?;
+    let first_client = ScriptedClient::new(vec![
+        vec![
+            LlmEvent::tool_use_start(0, "task-1", "TaskCreate"),
+            LlmEvent::tool_input_delta(
+                0,
+                r#"{"subject":"persisted task","description":"survives restore"}"#,
+            ),
+            LlmEvent::tool_use_stop(0),
+        ],
+        vec![
+            LlmEvent::text_block_start(0),
+            LlmEvent::text_delta(0, "first answer"),
+            LlmEvent::text_block_stop(0, Some(StopReason::EndTurn)),
+        ],
+        vec![
+            LlmEvent::text_block_start(0),
+            LlmEvent::text_delta(0, "notification acknowledged"),
+            LlmEvent::text_block_stop(0, Some(StopReason::EndTurn)),
+        ],
+    ]);
+    let host = StandaloneHost::start_with_model_client(launch, first_client).await?;
+    let worker_id = host.worker_id();
+    let mut protocol_client = host.connect();
+    protocol_client
+        .send(&Method::submit_text(
+            protocol::new_submission_request_id(),
+            "first request",
+        ))
+        .await?;
+    wait_for_run_end(&mut protocol_client).await?;
+    protocol_client
+        .send(&Method::Notify {
+            notification_request_id: protocol::new_submission_request_id(),
+            message: "persisted notification".to_string(),
+            auto_run: true,
+        })
+        .await?;
+    wait_for_run_end(&mut protocol_client).await?;
+    host.shutdown().await?;
+
+    let store = StandaloneWorkerStore::open(&state_dir)?;
+    let current = store.list(&cwd, StandaloneListScope::CurrentCwd, 100)?;
+    assert_eq!(current.len(), 1);
+    assert_eq!(current[0].worker_id, worker_id);
+    assert_eq!(current[0].status, StandaloneWorkerStatus::Stopped);
+    let other_cwd = temp.path().join("other");
+    std::fs::create_dir(&other_cwd)?;
+    assert!(
+        store
+            .list(&other_cwd, StandaloneListScope::CurrentCwd, 100)?
+            .is_empty()
+    );
+    assert_eq!(
+        store.list(&other_cwd, StandaloneListScope::All, 100)?.len(),
+        1
+    );
+
+    let second_client = ScriptedClient::new(vec![vec![
+        LlmEvent::text_block_start(0),
+        LlmEvent::text_delta(0, "second answer"),
+        LlmEvent::text_block_stop(0, Some(StopReason::EndTurn)),
+    ]]);
+    let second_inspection = second_client.clone();
+    let host =
+        StandaloneHost::restore_with_model_client(state_dir.clone(), worker_id, second_client)
+            .await?;
+    assert_eq!(
+        host.record().worker_name,
+        "display-name-is-not-session-identity"
+    );
+    assert_eq!(host.record().storage_key, format!("standalone-{worker_id}"));
+    let mut protocol_client = host.connect();
+    let snapshot = format!(
+        "{:?}",
+        protocol_client
+            .next_event()
+            .await
+            .expect("restored protocol stream")
+            .expect("restored snapshot")
+    );
+    assert!(snapshot.contains("first request"), "{snapshot}");
+    assert!(snapshot.contains("first answer"), "{snapshot}");
+    assert!(snapshot.contains("persisted task"), "{snapshot}");
+    assert!(snapshot.contains("persisted notification"), "{snapshot}");
+
+    protocol_client
+        .send(&Method::submit_text(
+            protocol::new_submission_request_id(),
+            "continue after restore",
+        ))
+        .await?;
+    wait_for_run_end(&mut protocol_client).await?;
+    let request = second_inspection
+        .requests()
+        .into_iter()
+        .next()
+        .expect("restored run request");
+    let projected = format!("{:?}", request.items);
+    assert!(projected.contains("first answer"), "{projected}");
+    assert!(projected.contains("persisted notification"), "{projected}");
+    assert!(projected.contains("persisted task"), "{projected}");
+    host.shutdown().await?;
+
+    store.delete(worker_id)?;
+    assert!(cwd.exists(), "deleting session state must not mutate cwd");
+    assert!(matches!(
+        store.load(worker_id),
+        Err(StandaloneStoreError::WorkerNotFound(_))
+    ));
+    Ok(())
+}
+
+#[tokio::test]
+async fn standalone_restore_rejects_concurrent_lease_and_missing_cwd() -> TestResult {
+    let temp = tempfile::tempdir()?;
+    let cwd = temp.path().join("project");
+    let moved = temp.path().join("moved-project");
+    let state_dir = temp.path().join("state");
+    std::fs::create_dir(&cwd)?;
+    let launch = StandaloneLaunchConfig::new(
+        &cwd,
+        &state_dir,
+        manifest::ProfileSelector::Default,
+        "standalone-lease-test",
+    )
+    .resolve()?;
+    let host =
+        StandaloneHost::start_with_model_client(launch, ScriptedClient::new(Vec::new())).await?;
+    let worker_id = host.worker_id();
+    let store = StandaloneWorkerStore::open(&state_dir)?;
+    assert!(matches!(
+        store.acquire_lease(worker_id, StaleLeasePolicy::Recover),
+        Err(StandaloneStoreError::WorkerLeased(id)) if id == worker_id
+    ));
+    let restore = StandaloneHost::restore_with_model_client(
+        state_dir.clone(),
+        worker_id,
+        ScriptedClient::new(Vec::new()),
+    )
+    .await;
+    assert!(matches!(restore, Err(StandaloneStartupError::WorkerActive)));
+    host.shutdown().await?;
+
+    std::fs::rename(&cwd, &moved)?;
+    let restore = StandaloneHost::restore_with_model_client(
+        state_dir,
+        worker_id,
+        ScriptedClient::new(Vec::new()),
+    )
+    .await;
+    assert!(matches!(
+        restore,
+        Err(StandaloneStartupError::WorkingDirectoryUnavailable)
+    ));
+    Ok(())
+}
+
+#[tokio::test]
+async fn standalone_restore_recovers_only_a_proven_stale_lease() -> TestResult {
+    let temp = tempfile::tempdir()?;
+    let state_dir = temp.path().join("state");
+    let mut launch = StandaloneLaunchConfig::new(
+        temp.path(),
+        &state_dir,
+        manifest::ProfileSelector::Default,
+        "standalone-stale-lease-test",
+    )
+    .resolve()?;
+    launch.profile.manifest.profile = Some(manifest::ProfileManifestSnapshot {
+        source: manifest::ProfileSource::Registry {
+            source: manifest::ProfileRegistrySource::User,
+            name: "user-standalone".to_string(),
+            path: None,
+            provenance: Some("user-config-revision-7".to_string()),
+        },
+        profile: Some(manifest::ProfileMetadata {
+            name: Some("User standalone".to_string()),
+            description: None,
+            format: None,
+        }),
+    });
+    let host =
+        StandaloneHost::start_with_model_client(launch, ScriptedClient::new(Vec::new())).await?;
+    let worker_id = host.worker_id();
+    host.shutdown().await?;
+    let store = StandaloneWorkerStore::open(&state_dir)?;
+    assert!(matches!(
+        store.load(worker_id)?.manifest.profile,
+        Some(manifest::ProfileManifestSnapshot {
+            source: manifest::ProfileSource::Registry {
+                source: manifest::ProfileRegistrySource::User,
+                ..
+            },
+            ..
+        })
+    ));
+    let worker_dir = state_dir.join(worker_id.to_string());
+    std::fs::write(
+        worker_dir.join("lease.json"),
+        serde_json::to_vec(&serde_json::json!({
+            "lease_id": uuid::Uuid::now_v7(),
+            "pid": u32::MAX,
+            "process_start_marker": 1,
+            "acquired_at_unix_ms": 1
+        }))?,
+    )?;
+
+    let host = StandaloneHost::restore_with_model_client(
+        state_dir,
+        worker_id,
+        ScriptedClient::new(Vec::new()),
+    )
+    .await?;
+    host.shutdown().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn standalone_restore_rejects_lease_with_missing_start_marker() -> TestResult {
+    let temp = tempfile::tempdir()?;
+    let state_dir = temp.path().join("state");
+    let launch = StandaloneLaunchConfig::new(
+        temp.path(),
+        &state_dir,
+        manifest::ProfileSelector::Default,
+        "standalone-unknown-lease-test",
+    )
+    .resolve()?;
+    let host =
+        StandaloneHost::start_with_model_client(launch, ScriptedClient::new(Vec::new())).await?;
+    let worker_id = host.worker_id();
+    host.shutdown().await?;
+    let worker_dir = state_dir.join(worker_id.to_string());
+    std::fs::write(
+        worker_dir.join("lease.json"),
+        serde_json::to_vec(&serde_json::json!({
+            "lease_id": uuid::Uuid::now_v7(),
+            "pid": std::process::id(),
+            "acquired_at_unix_ms": 1
+        }))?,
+    )?;
+
+    let store = StandaloneWorkerStore::open(&state_dir)?;
+    assert!(matches!(
+        store.acquire_lease(worker_id, StaleLeasePolicy::Recover),
+        Err(StandaloneStoreError::LeaseLivenessUnknown(id)) if id == worker_id
+    ));
+    let restore = StandaloneHost::restore_with_model_client(
+        state_dir,
+        worker_id,
+        ScriptedClient::new(Vec::new()),
+    )
+    .await;
+    assert!(matches!(
+        restore,
+        Err(StandaloneStartupError::LeaseLivenessUnknown)
+    ));
+    Ok(())
+}
+
+#[tokio::test]
+async fn standalone_metadata_fails_closed_on_incomplete_or_newer_records() -> TestResult {
+    let temp = tempfile::tempdir()?;
+    let state_dir = temp.path().join("state");
+    let launch = StandaloneLaunchConfig::new(
+        temp.path(),
+        &state_dir,
+        manifest::ProfileSelector::Default,
+        "standalone-schema-test",
+    )
+    .resolve()?;
+    let host =
+        StandaloneHost::start_with_model_client(launch, ScriptedClient::new(Vec::new())).await?;
+    let worker_id = host.worker_id();
+    host.shutdown().await?;
+    let store = StandaloneWorkerStore::open(&state_dir)?;
+    let worker_dir = state_dir.join(worker_id.to_string());
+    std::fs::write(worker_dir.join("commit.pending"), b"interrupted\n")?;
+    assert!(matches!(
+        store.load(worker_id),
+        Err(StandaloneStoreError::IncompleteCommit(id)) if id == worker_id
+    ));
+    std::fs::remove_file(worker_dir.join("commit.pending"))?;
+    let record_path = worker_dir.join("record.json");
+    let mut record: serde_json::Value = serde_json::from_slice(&std::fs::read(&record_path)?)?;
+    record["schema_version"] = serde_json::json!(u32::MAX);
+    std::fs::write(&record_path, serde_json::to_vec_pretty(&record)?)?;
+    assert!(matches!(
+        store.load(worker_id),
+        Err(StandaloneStoreError::NewerSchema { id, .. }) if id == worker_id
+    ));
+    Ok(())
+}
+
+async fn wait_for_run_end(client: &mut Client<InProcessSocket>) -> TestResult {
+    tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            if matches!(client.next_event().await, Ok(Some(Event::RunEnd { .. }))) {
+                break;
+            }
+        }
+    })
+    .await?;
+    Ok(())
+}

crates/ticket/src/latest_schema.sql

@@ -0,0 +1,122 @@
+-- Canonical standalone Ticket schema. Workspace Server composes stricter cross-domain authority.
+CREATE TABLE typed_ticket_artifacts (
+    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, relative_path TEXT NOT NULL, content BLOB NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, relative_path),
+    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_event_attributes (
+    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, event_index INTEGER NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, event_index, key),
+    FOREIGN KEY (workspace_id, ticket_id, event_index) REFERENCES typed_ticket_events(workspace_id, ticket_id, event_index) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_event_references (
+    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, event_index INTEGER NOT NULL, ordinal INTEGER NOT NULL, kind TEXT NOT NULL, target TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, event_index, ordinal),
+    FOREIGN KEY (workspace_id, ticket_id, event_index) REFERENCES typed_ticket_events(workspace_id, ticket_id, event_index) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_events (
+    workspace_id TEXT NOT NULL,
+    ticket_id TEXT NOT NULL,
+    event_index INTEGER NOT NULL,
+    kind TEXT NOT NULL,
+    author TEXT,
+    at TEXT,
+    status TEXT,
+    from_state TEXT,
+    to_state TEXT,
+    reason TEXT,
+    state_field TEXT,
+    heading TEXT,
+    body TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, event_index),
+    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_labels (
+    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, ordinal INTEGER NOT NULL, label TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, ordinal),
+    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_orchestration_plans (
+    workspace_id TEXT NOT NULL,
+    ticket_id TEXT NOT NULL,
+    record_id TEXT NOT NULL,
+    kind TEXT NOT NULL,
+    related_ticket TEXT,
+    note TEXT,
+    accepted_summary TEXT,
+    accepted_branch TEXT,
+    accepted_worktree TEXT,
+    accepted_role_plan TEXT,
+    author TEXT NOT NULL,
+    at TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, record_id),
+    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_raw_frontmatter (
+    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, key),
+    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_relations (
+    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, kind TEXT NOT NULL, target TEXT NOT NULL, note TEXT, author TEXT NOT NULL, at TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, kind, target),
+    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
+);
+CREATE TABLE typed_ticket_risk_flags (
+    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, ordinal INTEGER NOT NULL, risk_flag TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, ticket_id, ordinal),
+    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
+);
+CREATE TABLE typed_tickets (
+    workspace_id TEXT NOT NULL,
+    ticket_id TEXT NOT NULL,
+    slug TEXT NOT NULL,
+    title TEXT NOT NULL,
+    status TEXT NOT NULL,
+    kind TEXT NOT NULL,
+    priority TEXT NOT NULL,
+    body TEXT NOT NULL,
+    created_at TEXT,
+    updated_at TEXT,
+    assignee TEXT,
+    readiness TEXT,
+    workflow_state TEXT NOT NULL,
+    workflow_state_explicit INTEGER NOT NULL,
+    queued_by TEXT,
+    queued_at TEXT,
+    resolution TEXT, repository_id TEXT, ref_selector TEXT,
+    PRIMARY KEY (workspace_id, ticket_id)
+);
+CREATE TABLE "workspace_resource_key_counters" (
+            workspace_id TEXT NOT NULL,
+            resource_kind TEXT NOT NULL CHECK (resource_kind IN ('ticket', 'objective', 'worker')),
+            next_sequence INTEGER NOT NULL CHECK (next_sequence > 0),
+            PRIMARY KEY (workspace_id, resource_kind)
+        );
+CREATE TABLE "workspace_resource_keys" (
+            workspace_id TEXT NOT NULL,
+            resource_kind TEXT NOT NULL CHECK (resource_kind IN ('ticket', 'objective', 'worker')),
+            resource_id TEXT NOT NULL,
+            sequence INTEGER NOT NULL CHECK (sequence > 0),
+            resource_key TEXT NOT NULL,
+            allocated_at TEXT NOT NULL,
+            PRIMARY KEY (workspace_id, resource_kind, resource_id),
+            UNIQUE (workspace_id, resource_kind, sequence),
+            UNIQUE (workspace_id, resource_key)
+        );
+CREATE INDEX idx_workspace_resource_keys_reverse
+            ON workspace_resource_keys(workspace_id, resource_kind, resource_key);
+CREATE INDEX typed_ticket_events_workspace_kind_ticket
+            ON typed_ticket_events(workspace_id, kind, ticket_id, event_index);
+CREATE INDEX typed_ticket_relations_workspace_source_kind
+            ON typed_ticket_relations(workspace_id, ticket_id, kind, target);
+CREATE INDEX typed_ticket_relations_workspace_target_kind
+            ON typed_ticket_relations(workspace_id, target, kind, ticket_id);
+CREATE INDEX typed_tickets_workspace_created
+            ON typed_tickets(workspace_id, created_at DESC, ticket_id);
+CREATE INDEX typed_tickets_workspace_state_updated
+            ON typed_tickets(workspace_id, workflow_state, updated_at DESC, ticket_id);
+CREATE INDEX typed_tickets_workspace_title
+            ON typed_tickets(workspace_id, title COLLATE NOCASE, ticket_id);
+CREATE INDEX typed_tickets_workspace_updated
+            ON typed_tickets(workspace_id, updated_at DESC, ticket_id);

crates/ticket/src/lib.rs

@@ -26,11 +26,7 @@ pub mod config;
 mod sqlite_schema;
 pub mod tool;
 
-pub use sqlite_schema::{
-    LATEST_SQLITE_TICKET_SCHEMA_VERSION, migrate_sqlite_ticket_resource_key_schema_in_transaction,
-    migrate_sqlite_ticket_schema, migrate_sqlite_ticket_schema_through,
-    verify_sqlite_ticket_schema,
-};
+pub use sqlite_schema::{migrate_sqlite_ticket_schema, verify_sqlite_ticket_schema};
 
 const REQUIRED_FIELDS: [&str; 4] = ["title", "state", "created_at", "updated_at"];
 const MAX_STATE_CHANGE_REASON_BYTES: usize = 1024;
@@ -489,6 +485,7 @@ pub struct NewTicket {
     pub workflow_state: Option<TicketWorkflowState>,
     pub queued_by: Option<String>,
     pub queued_at: Option<String>,
+    #[serde(rename = "repository_key")]
     pub repository_id: Option<String>,
     pub ref_selector: Option<String>,
 }
@@ -519,6 +516,7 @@ impl NewTicket {
 #[serde(tag = "action", rename_all = "snake_case")]
 pub enum TicketTargetEdit {
     Set {
+        #[serde(rename = "repository_key")]
         repository_id: String,
         ref_selector: Option<String>,
     },
@@ -1610,6 +1608,7 @@ pub struct TicketMeta {
     pub workflow_state_explicit: bool,
     pub queued_by: Option<String>,
     pub queued_at: Option<String>,
+    #[serde(rename = "repository_key")]
     pub repository_id: Option<String>,
     pub ref_selector: Option<String>,
     pub raw: BTreeMap<String, String>,
@@ -2573,7 +2572,7 @@ impl SqliteTicketBackend {
         }
     }
 
-    /// Opens a standalone Ticket backend, applying all Ticket-owned migrations once.
+    /// Opens a standalone Ticket backend at the current canonical schema baseline.
     pub fn open(db_path: impl Into<PathBuf>, workspace_id: impl Into<String>) -> Result<Self> {
         let backend = Self::configured(db_path, workspace_id);
         let connection = backend.connect()?;

crates/ticket/src/sqlite_schema.rs

@@ -7,7 +7,7 @@ use crate::{Result, TicketError, sqlite_err};
 
 const MIGRATION_TABLE: &str = "ticket_schema_migrations";
 const MAX_SCHEMA_DIAGNOSTICS: usize = 32;
-pub const LATEST_SQLITE_TICKET_SCHEMA_VERSION: i64 = 6;
+const LATEST_SQLITE_TICKET_SCHEMA_VERSION: i64 = 6;
 
 #[derive(Clone, Copy)]
 struct Migration {
@@ -16,38 +16,11 @@ struct Migration {
     apply: fn(&Connection) -> Result<()>,
 }
 
-const MIGRATIONS: &[Migration] = &[
-    Migration {
-        version: 1,
-        name: "create_typed_ticket_tables",
-        apply: create_typed_ticket_tables,
-    },
-    Migration {
-        version: 2,
-        name: "add_ticket_repository_target",
-        apply: add_ticket_repository_target,
-    },
-    Migration {
-        version: 3,
-        name: "convert_legacy_reviews_to_comments",
-        apply: retire_legacy_ticket_review_events,
-    },
-    Migration {
-        version: 4,
-        name: "add_ticket_query_indexes",
-        apply: add_ticket_query_indexes,
-    },
-    Migration {
-        version: 5,
-        name: "add_workspace_human_keys",
-        apply: add_workspace_human_keys,
-    },
-    Migration {
-        version: 6,
-        name: "rename_workspace_resource_keys",
-        apply: rename_workspace_resource_keys,
-    },
-];
+const MIGRATIONS: &[Migration] = &[Migration {
+    version: LATEST_SQLITE_TICKET_SCHEMA_VERSION,
+    name: "ticket schema baseline",
+    apply: create_latest_ticket_schema,
+}];
 
 #[derive(Clone, Copy)]
 struct ExpectedColumn {
@@ -258,30 +231,12 @@ const fn column(
     }
 }
 
-/// Applies the Ticket crate's SQLite migrations and verifies the resulting schema.
+/// Creates and verifies the Ticket crate's latest SQLite schema.
 ///
 /// This is a startup/standalone-open operation. Normal Ticket request handling must
 /// use [`verify_sqlite_ticket_schema`] instead, so request paths never acquire DDL
 /// authority.
 pub fn migrate_sqlite_ticket_schema(connection: &Connection) -> Result<()> {
-    migrate_sqlite_ticket_schema_through(connection, LATEST_SQLITE_TICKET_SCHEMA_VERSION)
-}
-
-/// Applies Ticket migrations only through `target_version`.
-///
-/// This exists for the Workspace Server's ordered migration bridge: older Server
-/// migrations must materialize the Ticket schema shape they were written against
-/// before the current Ticket migration is applied at the matching Server version.
-#[doc(hidden)]
-pub fn migrate_sqlite_ticket_schema_through(
-    connection: &Connection,
-    target_version: i64,
-) -> Result<()> {
-    if !(1..=LATEST_SQLITE_TICKET_SCHEMA_VERSION).contains(&target_version) {
-        return Err(TicketError::Sqlite(format!(
-            "unsupported Ticket schema migration target {target_version}"
-        )));
-    }
     connection
         .busy_timeout(Duration::from_secs(5))
         .map_err(sqlite_err)?;
@@ -302,25 +257,10 @@ pub fn migrate_sqlite_ticket_schema_through(
         verify_table(connection, MIGRATION_TABLE, MIGRATION_COLUMNS, &[], false)?;
 
         let applied = load_applied_migrations(connection)?;
-        validate_applied_migrations(&applied)?;
-
-        if let Some(version) = applied
-            .keys()
-            .copied()
-            .find(|version| *version > target_version)
-        {
-            return Err(TicketError::Sqlite(format!(
-                "Ticket schema version {version} is newer than requested migration target {target_version}"
-            )));
-        }
-
-        for migration in MIGRATIONS
-            .iter()
-            .filter(|migration| migration.version <= target_version)
-        {
-            if applied.contains_key(&migration.version) {
-                continue;
-            }
+        if applied.is_empty() {
+            let migration = MIGRATIONS
+                .first()
+                .ok_or_else(|| TicketError::Sqlite("Ticket migration catalog is empty".into()))?;
             (migration.apply)(connection)?;
             connection
                 .execute(
@@ -333,24 +273,11 @@ pub fn migrate_sqlite_ticket_schema_through(
                     ],
                 )
                 .map_err(sqlite_err)?;
+        } else {
+            validate_applied_migrations(&applied)?;
         }
 
-        if target_version == LATEST_SQLITE_TICKET_SCHEMA_VERSION {
-            verify_sqlite_ticket_schema(connection)
-        } else {
-            let applied = load_applied_migrations(connection)?;
-            let expected = MIGRATIONS
-                .iter()
-                .filter(|migration| migration.version <= target_version)
-                .map(|migration| (migration.version, migration.name.to_string()))
-                .collect::<BTreeMap<_, _>>();
-            if applied != expected {
-                return Err(TicketError::Sqlite(format!(
-                    "Ticket schema migration history does not match target version {target_version}"
-                )));
-            }
-            Ok(())
-        }
+        verify_sqlite_ticket_schema(connection)
     })();
 
     match result {
@@ -362,47 +289,6 @@ pub fn migrate_sqlite_ticket_schema_through(
     }
 }
 
-/// Applies the resource-key Ticket migration inside a transaction owned by the
-/// Workspace Server. The caller must provide an active transaction; this function
-/// deliberately does not begin or commit one so the Ticket and Server migration
-/// markers can be persisted atomically.
-#[doc(hidden)]
-pub fn migrate_sqlite_ticket_resource_key_schema_in_transaction(
-    connection: &Connection,
-) -> Result<()> {
-    connection
-        .execute_batch(
-            "CREATE TABLE IF NOT EXISTS ticket_schema_migrations (
-                version INTEGER PRIMARY KEY,
-                name TEXT NOT NULL,
-                applied_at TEXT NOT NULL
-            );",
-        )
-        .map_err(sqlite_err)?;
-    let applied = load_applied_migrations(connection)?;
-    validate_applied_migrations(&applied)?;
-    if applied.contains_key(&LATEST_SQLITE_TICKET_SCHEMA_VERSION) {
-        return verify_sqlite_ticket_schema(connection);
-    }
-    let expected_previous = LATEST_SQLITE_TICKET_SCHEMA_VERSION - 1;
-    if applied.len() != expected_previous as usize || !applied.contains_key(&expected_previous) {
-        return Err(TicketError::Sqlite(format!(
-            "Ticket schema must be at version {expected_previous} before the resource-key migration"
-        )));
-    }
-    let migration = MIGRATIONS
-        .last()
-        .ok_or_else(|| TicketError::Sqlite("Ticket migration catalog is empty".to_string()))?;
-    (migration.apply)(connection)?;
-    connection
-        .execute(
-            "INSERT INTO ticket_schema_migrations (version, name, applied_at) VALUES (?1, ?2, datetime('now'))",
-            params![migration.version, migration.name],
-        )
-        .map_err(sqlite_err)?;
-    verify_sqlite_ticket_schema(connection)
-}
-
 /// Verifies the current Ticket-owned SQLite schema without executing DDL.
 pub fn verify_sqlite_ticket_schema(connection: &Connection) -> Result<()> {
     let mut diagnostics = Vec::new();
@@ -539,238 +425,9 @@ pub fn verify_sqlite_ticket_schema(connection: &Connection) -> Result<()> {
     }
 }
 
-fn create_typed_ticket_tables(connection: &Connection) -> Result<()> {
+fn create_latest_ticket_schema(connection: &Connection) -> Result<()> {
     connection
-        .execute_batch(
-            r#"
-CREATE TABLE IF NOT EXISTS typed_tickets (
-    workspace_id TEXT NOT NULL,
-    ticket_id TEXT NOT NULL,
-    slug TEXT NOT NULL,
-    title TEXT NOT NULL,
-    status TEXT NOT NULL,
-    kind TEXT NOT NULL,
-    priority TEXT NOT NULL,
-    body TEXT NOT NULL,
-    created_at TEXT,
-    updated_at TEXT,
-    assignee TEXT,
-    readiness TEXT,
-    workflow_state TEXT NOT NULL,
-    workflow_state_explicit INTEGER NOT NULL,
-    queued_by TEXT,
-    queued_at TEXT,
-    resolution TEXT,
-    PRIMARY KEY (workspace_id, ticket_id)
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_labels (
-    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, ordinal INTEGER NOT NULL, label TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, ordinal),
-    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_risk_flags (
-    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, ordinal INTEGER NOT NULL, risk_flag TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, ordinal),
-    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_raw_frontmatter (
-    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, key),
-    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_events (
-    workspace_id TEXT NOT NULL,
-    ticket_id TEXT NOT NULL,
-    event_index INTEGER NOT NULL,
-    kind TEXT NOT NULL,
-    author TEXT,
-    at TEXT,
-    status TEXT,
-    from_state TEXT,
-    to_state TEXT,
-    reason TEXT,
-    state_field TEXT,
-    heading TEXT,
-    body TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, event_index),
-    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_event_references (
-    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, event_index INTEGER NOT NULL, ordinal INTEGER NOT NULL, kind TEXT NOT NULL, target TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, event_index, ordinal),
-    FOREIGN KEY (workspace_id, ticket_id, event_index) REFERENCES typed_ticket_events(workspace_id, ticket_id, event_index) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_event_attributes (
-    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, event_index INTEGER NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, event_index, key),
-    FOREIGN KEY (workspace_id, ticket_id, event_index) REFERENCES typed_ticket_events(workspace_id, ticket_id, event_index) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_relations (
-    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, kind TEXT NOT NULL, target TEXT NOT NULL, note TEXT, author TEXT NOT NULL, at TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, kind, target),
-    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_orchestration_plans (
-    workspace_id TEXT NOT NULL,
-    ticket_id TEXT NOT NULL,
-    record_id TEXT NOT NULL,
-    kind TEXT NOT NULL,
-    related_ticket TEXT,
-    note TEXT,
-    accepted_summary TEXT,
-    accepted_branch TEXT,
-    accepted_worktree TEXT,
-    accepted_role_plan TEXT,
-    author TEXT NOT NULL,
-    at TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, record_id),
-    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
-);
-CREATE TABLE IF NOT EXISTS typed_ticket_artifacts (
-    workspace_id TEXT NOT NULL, ticket_id TEXT NOT NULL, relative_path TEXT NOT NULL, content BLOB NOT NULL,
-    PRIMARY KEY (workspace_id, ticket_id, relative_path),
-    FOREIGN KEY (workspace_id, ticket_id) REFERENCES typed_tickets(workspace_id, ticket_id) ON DELETE CASCADE
-);
-"#,
-        )
-        .map_err(sqlite_err)
-}
-
-fn add_ticket_repository_target(connection: &Connection) -> Result<()> {
-    add_column_if_missing(connection, "typed_tickets", "repository_id", "TEXT")?;
-    add_column_if_missing(connection, "typed_tickets", "ref_selector", "TEXT")
-}
-
-fn retire_legacy_ticket_review_events(connection: &Connection) -> Result<()> {
-    // Historical prose remains visible for audit, but it is explicitly converted to a
-    // non-authoritative comment. Approval authority now lives only in Merge Requests.
-    connection
-        .execute_batch(
-            r#"
-        INSERT OR REPLACE INTO typed_ticket_event_attributes
-            (workspace_id, ticket_id, event_index, key, value)
-        SELECT workspace_id, ticket_id, event_index, 'legacy_event_kind', 'review'
-        FROM typed_ticket_events WHERE kind = 'review';
-        UPDATE typed_ticket_events
-        SET kind = 'comment', status = NULL, heading = 'Legacy review (non-authoritative)'
-        WHERE kind = 'review';
-        DELETE FROM typed_ticket_event_attributes
-        WHERE key IN ('result', 'review_result', 'status')
-          AND EXISTS (
-            SELECT 1 FROM typed_ticket_events event
-            WHERE event.workspace_id = typed_ticket_event_attributes.workspace_id
-              AND event.ticket_id = typed_ticket_event_attributes.ticket_id
-              AND event.event_index = typed_ticket_event_attributes.event_index
-              AND event.heading = 'Legacy review (non-authoritative)'
-          );
-        "#,
-        )
-        .map_err(sqlite_err)
-}
-
-fn add_ticket_query_indexes(connection: &Connection) -> Result<()> {
-    connection
-        .execute_batch(
-            r#"
-        CREATE INDEX IF NOT EXISTS typed_tickets_workspace_state_updated
-            ON typed_tickets(workspace_id, workflow_state, updated_at DESC, ticket_id);
-        CREATE INDEX IF NOT EXISTS typed_tickets_workspace_updated
-            ON typed_tickets(workspace_id, updated_at DESC, ticket_id);
-        CREATE INDEX IF NOT EXISTS typed_tickets_workspace_created
-            ON typed_tickets(workspace_id, created_at DESC, ticket_id);
-        CREATE INDEX IF NOT EXISTS typed_tickets_workspace_title
-            ON typed_tickets(workspace_id, title COLLATE NOCASE, ticket_id);
-        CREATE INDEX IF NOT EXISTS typed_ticket_events_workspace_kind_ticket
-            ON typed_ticket_events(workspace_id, kind, ticket_id, event_index);
-        CREATE INDEX IF NOT EXISTS typed_ticket_relations_workspace_source_kind
-            ON typed_ticket_relations(workspace_id, ticket_id, kind, target);
-        CREATE INDEX IF NOT EXISTS typed_ticket_relations_workspace_target_kind
-            ON typed_ticket_relations(workspace_id, target, kind, ticket_id);
-        "#,
-        )
-        .map_err(sqlite_err)
-}
-
-fn add_workspace_human_keys(connection: &Connection) -> Result<()> {
-    connection
-        .execute_batch(
-            r#"
-        CREATE TABLE IF NOT EXISTS workspace_resource_human_keys (
-            workspace_id TEXT NOT NULL,
-            resource_kind TEXT NOT NULL CHECK (resource_kind IN ('ticket', 'objective', 'worker')),
-            resource_id TEXT NOT NULL,
-            sequence INTEGER NOT NULL CHECK (sequence > 0),
-            human_key TEXT NOT NULL,
-            allocated_at TEXT NOT NULL,
-            PRIMARY KEY (workspace_id, resource_kind, resource_id),
-            UNIQUE (workspace_id, resource_kind, sequence),
-            UNIQUE (workspace_id, human_key)
-        );
-        CREATE TABLE IF NOT EXISTS workspace_resource_human_key_counters (
-            workspace_id TEXT NOT NULL,
-            resource_kind TEXT NOT NULL CHECK (resource_kind IN ('ticket', 'objective', 'worker')),
-            next_sequence INTEGER NOT NULL CHECK (next_sequence > 0),
-            PRIMARY KEY (workspace_id, resource_kind)
-        );
-
-        INSERT OR IGNORE INTO workspace_resource_human_keys (
-            workspace_id, resource_kind, resource_id, sequence, human_key, allocated_at
-        )
-        SELECT workspace_id,
-               'ticket',
-               ticket_id,
-               ROW_NUMBER() OVER (
-                   PARTITION BY workspace_id ORDER BY created_at ASC, ticket_id ASC
-               ),
-               'T-' || ROW_NUMBER() OVER (
-                   PARTITION BY workspace_id ORDER BY created_at ASC, ticket_id ASC
-               ),
-               COALESCE(created_at, updated_at)
-        FROM typed_tickets;
-
-        INSERT INTO workspace_resource_human_key_counters (
-            workspace_id, resource_kind, next_sequence
-        )
-        SELECT workspace_id, 'ticket', MAX(sequence) + 1
-        FROM workspace_resource_human_keys
-        WHERE resource_kind = 'ticket'
-        GROUP BY workspace_id
-        ON CONFLICT(workspace_id, resource_kind) DO UPDATE SET
-            next_sequence = MAX(next_sequence, excluded.next_sequence);
-        "#,
-        )
-        .map_err(sqlite_err)
-}
-
-fn rename_workspace_resource_keys(connection: &Connection) -> Result<()> {
-    connection
-        .execute_batch(
-            r#"
-        ALTER TABLE workspace_resource_human_keys RENAME TO workspace_resource_keys;
-        ALTER TABLE workspace_resource_keys RENAME COLUMN human_key TO resource_key;
-        ALTER TABLE workspace_resource_human_key_counters RENAME TO workspace_resource_key_counters;
-        DROP INDEX IF EXISTS idx_workspace_resource_human_keys_reverse;
-        CREATE INDEX idx_workspace_resource_keys_reverse
-            ON workspace_resource_keys(workspace_id, resource_kind, resource_key);
-        "#,
-        )
-        .map_err(sqlite_err)
-}
-
-fn add_column_if_missing(
-    connection: &Connection,
-    table: &str,
-    column: &str,
-    declaration: &str,
-) -> Result<()> {
-    let columns = load_columns(connection, table)?;
-    if columns.iter().any(|found| found.name == column) {
-        return Ok(());
-    }
-    connection
-        .execute_batch(&format!(
-            "ALTER TABLE {table} ADD COLUMN {column} {declaration}"
-        ))
+        .execute_batch(include_str!("latest_schema.sql"))
         .map_err(sqlite_err)
 }
 
@@ -796,33 +453,17 @@ fn load_applied_migrations(connection: &Connection) -> Result<BTreeMap<i64, Stri
 }
 
 fn validate_applied_migrations(applied: &BTreeMap<i64, String>) -> Result<()> {
-    for (&version, name) in applied {
-        let Some(expected) = MIGRATIONS
-            .iter()
-            .find(|migration| migration.version == version)
-        else {
-            return Err(TicketError::Sqlite(format!(
-                "unsupported Ticket schema migration version {version}; latest supported version is {LATEST_SQLITE_TICKET_SCHEMA_VERSION}"
-            )));
-        };
-        if name != expected.name {
-            return Err(TicketError::Sqlite(format!(
-                "Ticket schema migration {version} is named {name:?}, expected {:?}",
-                expected.name
-            )));
-        }
+    let expected = BTreeMap::from([(
+        LATEST_SQLITE_TICKET_SCHEMA_VERSION,
+        MIGRATIONS[0].name.to_string(),
+    )]);
+    if applied == &expected {
+        Ok(())
+    } else {
+        Err(TicketError::Sqlite(format!(
+            "Ticket schema migration history must contain only the canonical version {LATEST_SQLITE_TICKET_SCHEMA_VERSION} baseline marker"
+        )))
     }
-    for migration in MIGRATIONS {
-        if applied.keys().any(|version| *version > migration.version)
-            && !applied.contains_key(&migration.version)
-        {
-            return Err(TicketError::Sqlite(format!(
-                "Ticket schema migration history has a gap at version {}",
-                migration.version
-            )));
-        }
-    }
-    Ok(())
 }
 
 #[derive(Debug)]
@@ -1189,223 +830,16 @@ mod tests {
         verify_sqlite_ticket_schema(&connection).unwrap();
 
         let versions = load_applied_migrations(&connection).unwrap();
-        assert_eq!(versions.len(), 6);
         assert_eq!(
-            versions.get(&LATEST_SQLITE_TICKET_SCHEMA_VERSION),
-            Some(&"rename_workspace_resource_keys".to_string())
+            versions,
+            BTreeMap::from([(
+                LATEST_SQLITE_TICKET_SCHEMA_VERSION,
+                "ticket schema baseline".to_string(),
+            )])
         );
-    }
-
-    #[test]
-    fn adopts_existing_current_schema_without_losing_data() {
-        let connection = Connection::open_in_memory().unwrap();
-        create_typed_ticket_tables(&connection).unwrap();
-        add_ticket_repository_target(&connection).unwrap();
-        connection
-            .execute(
-                "INSERT INTO typed_tickets (
-                    workspace_id, ticket_id, slug, title, status, kind, priority, body,
-                    workflow_state, workflow_state_explicit, repository_id, ref_selector
-                 ) VALUES ('workspace-1', 'ticket-1', 'ticket-1', 'kept', 'open',
-                    'task', 'medium', 'body', 'ready', 1, 'main', 'develop')",
-                [],
-            )
-            .unwrap();
-        connection
-            .execute_batch(
-                "INSERT INTO typed_ticket_events (
-                    workspace_id, ticket_id, event_index, kind, author, at, heading, body
-                 ) VALUES (
-                    'workspace-1', 'ticket-1', 0, 'comment', 'hare',
-                    '2026-08-10T00:00:00Z', 'Evidence', 'event kept'
-                 );
-                 INSERT INTO typed_ticket_event_references (
-                    workspace_id, ticket_id, event_index, ordinal, kind, target
-                 ) VALUES ('workspace-1', 'ticket-1', 0, 0, 'commit', 'abc123');
-                 INSERT INTO typed_ticket_relations (
-                    workspace_id, ticket_id, kind, target, note, author, at
-                 ) VALUES (
-                    'workspace-1', 'ticket-1', 'related', 'ticket-2', 'relation kept',
-                    'hare', '2026-08-10T00:00:00Z'
-                 );
-                 INSERT INTO typed_ticket_orchestration_plans (
-                    workspace_id, ticket_id, record_id, kind, note, author, at
-                 ) VALUES (
-                    'workspace-1', 'ticket-1', 'plan-1', 'waiting_capacity_note',
-                    'plan kept', 'hare', '2026-08-10T00:00:00Z'
-                 );
-                 INSERT INTO typed_ticket_artifacts (
-                    workspace_id, ticket_id, relative_path, content
-                 ) VALUES ('workspace-1', 'ticket-1', 'evidence.txt', X'6b657074');",
-            )
-            .unwrap();
 
         migrate_sqlite_ticket_schema(&connection).unwrap();
-
-        let row = connection
-            .query_row(
-                "SELECT title, repository_id, ref_selector FROM typed_tickets",
-                [],
-                |row| {
-                    Ok((
-                        row.get::<_, String>(0)?,
-                        row.get::<_, String>(1)?,
-                        row.get::<_, String>(2)?,
-                    ))
-                },
-            )
-            .unwrap();
-        assert_eq!(row, ("kept".into(), "main".into(), "develop".into()));
-        let preserved = connection
-            .query_row(
-                "SELECT
-                    (SELECT COUNT(*) FROM typed_ticket_events),
-                    (SELECT COUNT(*) FROM typed_ticket_event_references),
-                    (SELECT COUNT(*) FROM typed_ticket_relations),
-                    (SELECT COUNT(*) FROM typed_ticket_orchestration_plans),
-                    (SELECT COUNT(*) FROM typed_ticket_artifacts)",
-                [],
-                |row| {
-                    Ok((
-                        row.get::<_, i64>(0)?,
-                        row.get::<_, i64>(1)?,
-                        row.get::<_, i64>(2)?,
-                        row.get::<_, i64>(3)?,
-                        row.get::<_, i64>(4)?,
-                    ))
-                },
-            )
-            .unwrap();
-        assert_eq!(preserved, (1, 1, 1, 1, 1));
-    }
-
-    #[test]
-    fn v5_backfills_ticket_keys_and_v6_preserves_them_under_resource_key_schema() {
-        let connection = Connection::open_in_memory().unwrap();
-        migrate_sqlite_ticket_schema_through(&connection, 4).unwrap();
-        connection.execute_batch(
-            "INSERT INTO typed_tickets (
-                 workspace_id, ticket_id, slug, title, status, kind, priority, body,
-                 workflow_state, workflow_state_explicit, created_at, updated_at
-             ) VALUES
-                 ('workspace-1', 'later', 'later', 'Later', 'open', 'task', 'medium', '', 'ready', 1, '2026-01-02T00:00:00Z', '2026-01-02T00:00:00Z'),
-                 ('workspace-1', 'earlier', 'earlier', 'Earlier', 'open', 'task', 'medium', '', 'ready', 1, '2026-01-01T00:00:00Z', '2026-01-01T00:00:00Z');"
-        ).unwrap();
-
-        migrate_sqlite_ticket_schema_through(&connection, 5).unwrap();
-        let legacy_keys = connection
-            .prepare(
-                "SELECT resource_id, human_key FROM workspace_resource_human_keys
-                 WHERE workspace_id = 'workspace-1' AND resource_kind = 'ticket'
-                 ORDER BY sequence",
-            )
-            .unwrap()
-            .query_map([], |row| {
-                Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
-            })
-            .unwrap()
-            .collect::<std::result::Result<Vec<_>, _>>()
-            .unwrap();
-        assert_eq!(
-            legacy_keys,
-            vec![
-                ("earlier".into(), "T-1".into()),
-                ("later".into(), "T-2".into())
-            ]
-        );
-        let next: i64 = connection
-            .query_row(
-                "SELECT next_sequence FROM workspace_resource_human_key_counters
-                 WHERE workspace_id = 'workspace-1' AND resource_kind = 'ticket'",
-                [],
-                |row| row.get(0),
-            )
-            .unwrap();
-        assert_eq!(next, 3);
-
-        migrate_sqlite_ticket_schema(&connection).unwrap();
-        let resource_keys = connection
-            .prepare(
-                "SELECT resource_id, resource_key FROM workspace_resource_keys
-                 WHERE workspace_id = 'workspace-1' AND resource_kind = 'ticket'
-                 ORDER BY sequence",
-            )
-            .unwrap()
-            .query_map([], |row| {
-                Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?))
-            })
-            .unwrap()
-            .collect::<std::result::Result<Vec<_>, _>>()
-            .unwrap();
-        assert_eq!(resource_keys, legacy_keys);
-        assert_eq!(
-            connection
-                .query_row(
-                    "SELECT next_sequence FROM workspace_resource_key_counters
-                     WHERE workspace_id = 'workspace-1' AND resource_kind = 'ticket'",
-                    [],
-                    |row| row.get::<_, i64>(0),
-                )
-                .unwrap(),
-            3
-        );
-        for legacy_table in [
-            "workspace_resource_human_keys",
-            "workspace_resource_human_key_counters",
-        ] {
-            assert!(
-                connection
-                    .query_row(
-                        "SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = ?1",
-                        [legacy_table],
-                        |_| Ok(()),
-                    )
-                    .optional()
-                    .unwrap()
-                    .is_none(),
-                "{legacy_table} still exists"
-            );
-        }
-    }
-
-    #[test]
-    fn upgrades_legacy_schema_without_repository_target_columns() {
-        let connection = Connection::open_in_memory().unwrap();
-        create_typed_ticket_tables(&connection).unwrap();
-        connection
-            .execute(
-                "INSERT INTO typed_tickets (
-                    workspace_id, ticket_id, slug, title, status, kind, priority, body,
-                    workflow_state, workflow_state_explicit
-                 ) VALUES ('workspace-1', 'ticket-1', 'ticket-1', 'legacy', 'open',
-                    'task', 'medium', 'body', 'ready', 1)",
-                [],
-            )
-            .unwrap();
-        connection
-            .execute_batch(
-                "CREATE TABLE ticket_schema_migrations (
-                    version INTEGER PRIMARY KEY,
-                    name TEXT NOT NULL,
-                    applied_at TEXT NOT NULL
-                 );
-                 INSERT INTO ticket_schema_migrations (version, name, applied_at)
-                 VALUES (1, 'create_typed_ticket_tables', '2026-08-10T00:00:00Z');",
-            )
-            .unwrap();
-
-        migrate_sqlite_ticket_schema(&connection).unwrap();
-        verify_sqlite_ticket_schema(&connection).unwrap();
-
-        let columns = load_columns(&connection, "typed_tickets").unwrap();
-        assert!(columns.iter().any(|column| column.name == "repository_id"));
-        assert!(columns.iter().any(|column| column.name == "ref_selector"));
-        let title = connection
-            .query_row("SELECT title FROM typed_tickets", [], |row| {
-                row.get::<_, String>(0)
-            })
-            .unwrap();
-        assert_eq!(title, "legacy");
+        assert_eq!(load_applied_migrations(&connection).unwrap(), versions);
     }
 
     #[test]
@@ -1421,12 +855,32 @@ mod tests {
             .unwrap();
 
         let error = migrate_sqlite_ticket_schema(&connection).unwrap_err();
-        assert!(
-            error
-                .to_string()
-                .contains("unsupported Ticket schema migration version 99")
-        );
-        assert_eq!(load_applied_migrations(&connection).unwrap().len(), 7);
+        assert!(error.to_string().contains(
+            "migration history must contain only the canonical version 6 baseline marker"
+        ));
+        assert_eq!(load_applied_migrations(&connection).unwrap().len(), 2);
+    }
+
+    #[test]
+    fn rejects_legacy_migration_marker() {
+        let connection = Connection::open_in_memory().unwrap();
+        connection
+            .execute_batch(
+                "CREATE TABLE ticket_schema_migrations (
+                    version INTEGER PRIMARY KEY,
+                    name TEXT NOT NULL,
+                    applied_at TEXT NOT NULL
+                 );
+                 INSERT INTO ticket_schema_migrations (version, name, applied_at)
+                 VALUES (6, 'rename_workspace_resource_keys', '2026-08-10T00:00:00Z');",
+            )
+            .unwrap();
+
+        let error = migrate_sqlite_ticket_schema(&connection).unwrap_err();
+        assert!(error.to_string().contains(
+            "migration history must contain only the canonical version 6 baseline marker"
+        ));
+        assert!(!table_exists(&connection, "typed_tickets").unwrap());
     }
 
     #[test]
@@ -1509,77 +963,6 @@ mod tests {
         verify_sqlite_ticket_schema(&connection).unwrap();
     }
 
-    #[test]
-    fn migration_rejects_constraint_drift_and_rolls_back_version_adoption() {
-        let connection = Connection::open_in_memory().unwrap();
-        connection
-            .execute_batch(
-                "CREATE TABLE typed_tickets (
-                    workspace_id TEXT NOT NULL,
-                    ticket_id TEXT NOT NULL,
-                    slug TEXT NOT NULL,
-                    title TEXT NOT NULL,
-                    status TEXT NOT NULL,
-                    kind TEXT NOT NULL,
-                    priority TEXT NOT NULL,
-                    body TEXT NOT NULL,
-                    created_at TEXT,
-                    updated_at TEXT,
-                    assignee TEXT,
-                    readiness TEXT,
-                    workflow_state TEXT NOT NULL,
-                    workflow_state_explicit INTEGER NOT NULL,
-                    queued_by TEXT,
-                    queued_at TEXT,
-                    resolution TEXT,
-                    PRIMARY KEY (ticket_id, workspace_id)
-                );",
-            )
-            .unwrap();
-
-        let error = migrate_sqlite_ticket_schema(&connection).unwrap_err();
-        assert!(error.to_string().contains("primary-key position"));
-        let migration_table_exists = connection
-            .query_row(
-                "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'ticket_schema_migrations'",
-                [],
-                |_| Ok(()),
-            )
-            .optional()
-            .unwrap()
-            .is_some();
-        assert!(!migration_table_exists);
-    }
-
-    #[test]
-    fn legacy_review_upgrade_preserves_prose_as_non_authoritative_comment() {
-        let connection = Connection::open_in_memory().unwrap();
-        migrate_sqlite_ticket_schema(&connection).unwrap();
-        connection.execute("INSERT INTO typed_tickets (workspace_id,ticket_id,slug,title,status,kind,priority,body,workflow_state,workflow_state_explicit) VALUES ('workspace-1','ticket-1','ticket-1','title','open','task','medium','body','inprogress',1)",[]).unwrap();
-        connection.execute("INSERT INTO typed_ticket_events (workspace_id,ticket_id,event_index,kind,author,at,status,heading,body) VALUES ('workspace-1','ticket-1',0,'review','reviewer','2026-08-11T00:00:00Z','approve','Review','legacy evidence')",[]).unwrap();
-        connection.execute("INSERT INTO typed_ticket_event_attributes (workspace_id,ticket_id,event_index,key,value) VALUES ('workspace-1','ticket-1',0,'result','approve')",[]).unwrap();
-        connection
-            .execute_batch(
-                "DROP TABLE workspace_resource_key_counters;
-                 DROP TABLE workspace_resource_keys;
-                 DELETE FROM ticket_schema_migrations WHERE version >= 3;",
-            )
-            .unwrap();
-        migrate_sqlite_ticket_schema(&connection).unwrap();
-        let (kind,status,heading,body):(String,Option<String>,Option<String>,Option<String>)=connection.query_row("SELECT kind,status,heading,body FROM typed_ticket_events WHERE workspace_id='workspace-1' AND ticket_id='ticket-1' AND event_index=0",[],|row|Ok((row.get(0)?,row.get(1)?,row.get(2)?,row.get(3)?))).unwrap();
-        assert_eq!(kind, "comment");
-        assert_eq!(status, None);
-        assert_eq!(
-            heading.as_deref(),
-            Some("Legacy review (non-authoritative)")
-        );
-        assert_eq!(body.as_deref(), Some("legacy evidence"));
-        let attributes:i64=connection.query_row("SELECT COUNT(*) FROM typed_ticket_event_attributes WHERE workspace_id='workspace-1' AND ticket_id='ticket-1'",[],|row|row.get(0)).unwrap();
-        assert_eq!(attributes, 1);
-        let legacy:String=connection.query_row("SELECT value FROM typed_ticket_event_attributes WHERE workspace_id='workspace-1' AND ticket_id='ticket-1' AND key='legacy_event_kind'",[],|row|row.get(0)).unwrap();
-        assert_eq!(legacy, "review");
-    }
-
     #[test]
     fn concurrent_migrators_converge_on_one_version_history() {
         let directory = tempdir().unwrap();
@@ -1602,6 +985,6 @@ mod tests {
 
         let connection = Connection::open(database).unwrap();
         verify_sqlite_ticket_schema(&connection).unwrap();
-        assert_eq!(load_applied_migrations(&connection).unwrap().len(), 6);
+        assert_eq!(load_applied_migrations(&connection).unwrap().len(), 1);
     }
 }

crates/ticket/src/tool.rs

@@ -402,8 +402,8 @@ struct TicketCreateParams {
     queued_at: Option<String>,
     /// Optional target Workspace repository id.
     #[serde(default)]
-    repository_id: Option<String>,
-    /// Optional target Git ref selector. Requires `repository_id`.
+    repository_key: Option<String>,
+    /// Optional target Git ref selector. Requires `repository_key`.
     #[serde(default)]
     ref_selector: Option<String>,
 }
@@ -944,7 +944,7 @@ impl Tool for TicketCreateTool {
         input.workflow_state = params.state.map(TicketWorkflowStateParam::into_state);
         input.queued_by = None;
         input.queued_at = params.queued_at;
-        input.repository_id = params.repository_id;
+        input.repository_id = params.repository_key;
         input.ref_selector = params.ref_selector;
 
         let created = self
@@ -1173,7 +1173,7 @@ impl Tool for TicketMarkReadyTool {
             json!({
                 "ticket": ticket.meta.id,
                 "state": ticket.meta.workflow_state.as_str(),
-                "repository_id": ticket.meta.repository_id,
+                "repository_key": ticket.meta.repository_id,
                 "ref_selector": ticket.meta.ref_selector,
                 "ok": true
             }),
@@ -1206,7 +1206,7 @@ impl Tool for TicketIntakeReadyTool {
             json!({
                 "ticket": ticket.meta.id,
                 "state": ticket.meta.workflow_state.as_str(),
-                "repository_id": ticket.meta.repository_id,
+                "repository_key": ticket.meta.repository_id,
                 "ref_selector": ticket.meta.ref_selector,
                 "ok": true
             }),
@@ -1546,7 +1546,7 @@ fn model_ticket_reference(
     match ticket.meta.resource_key {
         Some(resource_key) if is_canonical_ticket_resource_key(&resource_key) => Ok(resource_key),
         Some(_) => Err(ToolError::ExecutionFailed(format!(
-            "{tool_name} failed: required Ticket human key is unavailable"
+            "{tool_name} failed: required Ticket key is unavailable"
         ))),
         None => Ok(ticket.meta.id),
     }
@@ -1940,11 +1940,11 @@ mod tests {
         fn resolve_target(
             &self,
             _workspace_id: &str,
-            repository_id: Option<&str>,
+            repository_key: Option<&str>,
             ref_selector: Option<&str>,
         ) -> crate::Result<crate::ResolvedTicketTarget> {
             Ok(crate::ResolvedTicketTarget {
-                repository_id: repository_id.unwrap_or("main").to_owned(),
+                repository_id: repository_key.unwrap_or("main").to_owned(),
                 ref_selector: ref_selector.unwrap_or("develop").to_owned(),
             })
         }

crates/tools/src/bash.rs

@@ -1,5 +1,6 @@
+use std::collections::{HashMap, HashSet};
 use std::path::PathBuf;
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 
 use agen::tool::{Tool, ToolDefinition, ToolError, ToolMeta, ToolOutput};
 use async_trait::async_trait;
@@ -20,21 +21,66 @@ struct BashParams {
 
 pub(crate) struct BashTool {
     session: WorkdirSessionHandle,
+    output_dir: PathBuf,
+    state: Arc<Mutex<BashExecutionState>>,
+}
+
+#[derive(Clone)]
+struct ActiveCommand {
+    call_id: String,
+    execution_nonce: u64,
+    handle: CommandHandle,
+}
+
+#[derive(Default)]
+struct BashExecutionState {
+    active: HashMap<String, ActiveCommand>,
+    cancellation_requested: HashSet<String>,
+    legacy_cancellation_requested: HashSet<String>,
+    next_execution_nonce: u64,
 }
 
 struct CommandGuard {
     session: WorkdirSessionHandle,
+    state: Arc<Mutex<BashExecutionState>>,
+    execution_id: String,
+    execution_nonce: u64,
     handle: Option<CommandHandle>,
 }
 
 impl Drop for CommandGuard {
     fn drop(&mut self) {
-        if let Some(handle) = self.handle.take() {
-            let workdir = self.session.clone();
-            tokio::spawn(async move {
-                let _ = workdir.cancel_command(handle).await;
-            });
-        }
+        let Some(handle) = self.handle.take() else {
+            return;
+        };
+        let workdir = self.session.clone();
+        let state = Arc::clone(&self.state);
+        let execution_id = self.execution_id.clone();
+        let execution_nonce = self.execution_nonce;
+        // A dropped provider future is not terminal confirmation. Keep the live
+        // execution registered until cleanup has both requested cancellation and
+        // observed terminal command output, so cancellation/session teardown
+        // cannot race with an apparently empty registry.
+        tokio::spawn(async move {
+            let _ = workdir.cancel_command(handle.clone()).await;
+            let _ = workdir
+                .command_output(CommandOutputRequest {
+                    handle,
+                    cursor: 0,
+                    limit: INLINE_BYTE_BUDGET,
+                    wait: true,
+                })
+                .await;
+            let mut state = state.lock().unwrap();
+            if state
+                .active
+                .get(&execution_id)
+                .is_some_and(|active| active.execution_nonce == execution_nonce)
+            {
+                state.active.remove(&execution_id);
+                state.cancellation_requested.remove(&execution_id);
+            }
+        });
     }
 }
 
@@ -52,20 +98,52 @@ impl Tool for BashTool {
             .unwrap_or(DEFAULT_TIMEOUT_SECS)
             .clamp(1, MAX_TIMEOUT_SECS);
         let cmd_summary = truncate_for_summary(&params.command);
+        let execution_id = ctx.execution_id();
+        let call_id = ctx.call_id;
+        let execution_nonce = {
+            let mut state = self.state.lock().unwrap();
+            state.next_execution_nonce = state.next_execution_nonce.wrapping_add(1);
+            state.next_execution_nonce
+        };
+        let mut guard = CommandGuard {
+            session: self.session.clone(),
+            state: self.state.clone(),
+            execution_id: execution_id.clone(),
+            execution_nonce,
+            handle: None,
+        };
         let handle = self
             .session
             .start_command(CommandRequest {
                 command: params.command,
                 timeout_secs,
                 output_limit: INLINE_BYTE_BUDGET,
-                tool_call_id: Some(ctx.call_id),
+                cwd: None,
+                spill_dir: Some(self.output_dir.clone()),
+                tool_call_id: Some(call_id.clone()),
             })
             .await
             .map_err(crate::ToolsError::from)?;
-        let mut guard = CommandGuard {
-            session: self.session.clone(),
-            handle: Some(handle.clone()),
+        let cancel_after_start = {
+            let mut state = self.state.lock().unwrap();
+            state.active.insert(
+                execution_id.clone(),
+                ActiveCommand {
+                    call_id: call_id.clone(),
+                    execution_nonce,
+                    handle: handle.clone(),
+                },
+            );
+            state.cancellation_requested.contains(&execution_id)
+                || state.legacy_cancellation_requested.contains(&call_id)
         };
+        guard.handle = Some(handle.clone());
+        if cancel_after_start {
+            self.session
+                .cancel_command(handle.clone())
+                .await
+                .map_err(crate::ToolsError::from)?;
+        }
         let output = self
             .session
             .command_output(CommandOutputRequest {
@@ -76,9 +154,27 @@ impl Tool for BashTool {
             })
             .await
             .map_err(crate::ToolsError::from)?;
+        let cancellation_requested = {
+            let mut state = self.state.lock().unwrap();
+            let owns_registration = state
+                .active
+                .get(&execution_id)
+                .is_some_and(|active| active.execution_nonce == execution_nonce);
+            let exact = if owns_registration {
+                state.active.remove(&execution_id);
+                state.cancellation_requested.remove(&execution_id)
+            } else {
+                false
+            };
+            let legacy = state.legacy_cancellation_requested.remove(&call_id);
+            exact || legacy
+        };
         guard.handle = None;
 
-        let summary = if output.timed_out {
+        let timed_out = output.timed_out;
+        let summary = if cancellation_requested {
+            format!("$ {cmd_summary} (cancelled)")
+        } else if output.timed_out {
             format!("$ {cmd_summary} (timed out after {timeout_secs}s)")
         } else {
             match output.exit_code {
@@ -90,18 +186,74 @@ impl Tool for BashTool {
         let content = if output.content.is_empty() {
             None
         } else if output.truncated {
-            Some(format!(
-                "[showing bounded WorkdirSession command output; additional output was truncated]\n{}",
-                output.content
-            ))
+            let notice = match output.output_path {
+                Some(path) => format!(
+                    "[showing bounded WorkdirSession command output; full output saved to {}]",
+                    path.display()
+                ),
+                None => "[showing bounded WorkdirSession command output; additional output was truncated]"
+                    .to_owned(),
+            };
+            Some(format!("{notice}\n{}", output.content))
         } else {
             Some(output.content)
         };
-        Ok(ToolOutput {
+        let output = ToolOutput {
             summary,
             content,
             attachments: Vec::new(),
-        })
+        };
+        if cancellation_requested {
+            Err(ToolError::Cancelled(output))
+        } else if timed_out {
+            Err(ToolError::Interrupted(output))
+        } else {
+            Ok(output)
+        }
+    }
+
+    async fn cancel(&self, call_id: &str) -> Result<(), ToolError> {
+        let handles = {
+            let mut state = self.state.lock().unwrap();
+            state
+                .legacy_cancellation_requested
+                .insert(call_id.to_string());
+            state
+                .active
+                .values()
+                .filter(|active| active.call_id == call_id)
+                .map(|active| active.handle.clone())
+                .collect::<Vec<_>>()
+        };
+        for handle in handles {
+            self.session
+                .cancel_command(handle)
+                .await
+                .map_err(crate::ToolsError::from)?;
+        }
+        Ok(())
+    }
+
+    async fn cancel_execution(
+        &self,
+        ctx: &agen::tool::ToolExecutionContext,
+    ) -> Result<(), ToolError> {
+        let execution_id = ctx.execution_id();
+        let handle = {
+            let mut state = self.state.lock().unwrap();
+            state.cancellation_requested.insert(execution_id.clone());
+            state
+                .active
+                .get(&execution_id)
+                .map(|active| active.handle.clone())
+        };
+        if let Some(handle) = handle {
+            self.session
+                .cancel_command(handle)
+                .await
+                .map_err(crate::ToolsError::from)?;
+        }
+        Ok(())
     }
 }
 
@@ -115,15 +267,139 @@ fn truncate_for_summary(command: &str) -> String {
     summary
 }
 
-pub fn bash_tool(session: WorkdirSessionHandle, _output_dir: PathBuf) -> ToolDefinition {
+pub fn bash_tool(session: WorkdirSessionHandle, output_dir: PathBuf) -> ToolDefinition {
     Arc::new(move || {
         let schema = schemars::schema_for!(BashParams);
         let meta = ToolMeta::new("Bash")
-            .description("Execute a shell command in the bound Workdir. Process start, bounded output, timeout and cancellation are owned by the WorkdirSession provider. This is not a sandbox.")
+            .description("Execute a shell command in the bound Workdir. Process start, bounded inline output, full-output spill, timeout and cancellation are owned by the WorkdirSession provider. This is not a sandbox.")
             .input_schema(serde_json::to_value(schema).expect("Bash schema serialization"));
         let tool: Arc<dyn Tool> = Arc::new(BashTool {
             session: session.clone(),
+            output_dir: output_dir.clone(),
+            state: Arc::new(Mutex::new(BashExecutionState::default())),
         });
         (meta, tool)
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use manifest::{Permission, Scope, ScopeConfig, ScopeRule};
+    use tempfile::TempDir;
+    use workdir::{LocalWorkdirSession, WorkdirSessionHandle};
+
+    use super::bash_tool;
+    use crate::{grep::grep_tool, read::read_tool, tracker::Tracker};
+
+    fn session_with_output_scope(root: &TempDir, output: &TempDir) -> WorkdirSessionHandle {
+        let scope = Scope::from_config(&ScopeConfig {
+            allow: vec![
+                ScopeRule {
+                    target: root.path().to_path_buf(),
+                    permission: Permission::Write,
+                    recursive: true,
+                    symlink_policy: Default::default(),
+                },
+                ScopeRule {
+                    target: output.path().to_path_buf(),
+                    permission: Permission::Read,
+                    recursive: true,
+                    symlink_policy: Default::default(),
+                },
+            ],
+            deny: Vec::new(),
+        })
+        .unwrap();
+        Arc::new(LocalWorkdirSession::new(scope, root.path().to_path_buf()))
+    }
+
+    #[tokio::test]
+    async fn long_output_is_spilled_and_available_to_read_and_grep() {
+        let root = TempDir::new().unwrap();
+        let output = TempDir::new().unwrap();
+        let session = session_with_output_scope(&root, &output);
+        let (_, bash) = bash_tool(session.clone(), output.path().to_path_buf())();
+        let command = "i=0; while [ $i -lt 2000 ]; do printf 'line-%04d\\n' \"$i\"; i=$((i+1)); done; printf 'FINAL-NEEDLE\\n'";
+        let result = bash
+            .execute(
+                &serde_json::json!({ "command": command }).to_string(),
+                Default::default(),
+            )
+            .await
+            .unwrap();
+        let rendered = result.content.expect("bounded Bash output");
+        let artifact = std::fs::read_dir(output.path())
+            .unwrap()
+            .next()
+            .expect("artifact entry")
+            .unwrap()
+            .path();
+
+        assert!(rendered.contains("full output saved to"));
+        assert!(rendered.contains(&artifact.display().to_string()));
+        let retained = std::fs::read_to_string(&artifact).unwrap();
+        assert!(retained.starts_with("line-0000\n"));
+        assert!(retained.ends_with("FINAL-NEEDLE\n"));
+        assert_eq!(retained.lines().count(), 2001);
+
+        let (_, read) = read_tool(session.clone(), Tracker::new())();
+        let read_result = read
+            .execute(
+                &serde_json::json!({
+                    "file_path": artifact,
+                    "offset": 2000,
+                    "limit": 1,
+                })
+                .to_string(),
+                Default::default(),
+            )
+            .await
+            .unwrap();
+        assert!(
+            read_result
+                .content
+                .expect("Read content")
+                .contains("FINAL-NEEDLE")
+        );
+
+        let (_, grep) = grep_tool(session)();
+        let grep_result = grep
+            .execute(
+                &serde_json::json!({
+                    "pattern": "FINAL-NEEDLE",
+                    "path": artifact,
+                    "output_mode": "content",
+                })
+                .to_string(),
+                Default::default(),
+            )
+            .await
+            .unwrap();
+        let grep_content = grep_result.content.expect("Grep content");
+        assert!(
+            grep_content.contains("FINAL-NEEDLE"),
+            "unexpected Grep content: {grep_content:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn short_output_does_not_leave_a_spill_artifact() {
+        let root = TempDir::new().unwrap();
+        let output = TempDir::new().unwrap();
+        let session = session_with_output_scope(&root, &output);
+        let (_, bash) = bash_tool(session, output.path().to_path_buf())();
+
+        let result = bash
+            .execute(
+                &serde_json::json!({ "command": "printf short" }).to_string(),
+                Default::default(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(result.content.as_deref(), Some("short"));
+        assert_eq!(std::fs::read_dir(output.path()).unwrap().count(), 0);
+    }
+}

crates/tools/src/error.rs

@@ -42,6 +42,7 @@ impl From<ToolsError> for ToolError {
                 workdir::WorkdirError::NotFound(_)
                 | workdir::WorkdirError::Io { .. }
                 | workdir::WorkdirError::Unavailable(_)
+                | workdir::WorkdirError::OperationFailed
                 | workdir::WorkdirError::Transport(_),
             ) => ToolError::ExecutionFailed(err.to_string()),
             ToolsError::FileSystem(_)

crates/tools/src/grep.rs

@@ -22,7 +22,7 @@ enum OutputMode {
 #[derive(Debug, Deserialize, JsonSchema)]
 struct GrepParams {
     pattern: String,
-    /// Logical Workdir-relative path to search. Defaults to the Workdir root.
+    /// Workdir-relative path, or an absolute path covered by readable scope. Defaults to the Workdir root.
     #[serde(default)]
     path: Option<String>,
     #[serde(default)]
@@ -61,7 +61,7 @@ impl Tool for GrepTool {
         let params: GrepParams = serde_json::from_str(input_json)
             .map_err(|error| ToolError::InvalidArgument(format!("invalid Grep input: {error}")))?;
         let path = match params.path {
-            Some(path) => WorkdirPath::new(&path).map_err(ToolsError::from)?,
+            Some(path) => WorkdirPath::new_scoped(&path).map_err(ToolsError::from)?,
             None => WorkdirPath::root(),
         };
         let mode = match params.output_mode.unwrap_or_default() {
@@ -129,7 +129,7 @@ pub fn grep_tool(session: WorkdirSessionHandle) -> ToolDefinition {
     Arc::new(move || {
         let schema = schemars::schema_for!(GrepParams);
         let meta = ToolMeta::new("Grep")
-            .description("Search Workdir file contents with a regex. Glob/Grep traversal executes inside the WorkdirSession provider. Results are bounded and Workdir-relative.")
+            .description("Search a Workdir file or directory with a regex. Content results group lines by file; `>` marks matching lines and unmarked lines are context. Directory traversal executes inside the WorkdirSession provider. Results are bounded and Workdir-relative.")
             .input_schema(serde_json::to_value(schema).expect("Grep schema serialization"));
         let tool: Arc<dyn Tool> = Arc::new(GrepTool {
             session: session.clone(),

crates/tools/src/read.rs

@@ -13,14 +13,14 @@ use workdir::{ReadRequest, WorkdirPath, WorkdirSessionHandle};
 const DESCRIPTION: &str = "Read a text file from the local filesystem. \
 Supports offset/limit for large files. Returns line-numbered output (1-based). \
 Directories cannot be read. The file must be read before Write or Edit can \
-modify it. Paths are relative to the bound Workdir.";
+modify it. Paths are Workdir-relative unless an absolute path is explicitly readable.";
 
 const DEFAULT_LIMIT: usize = 2000;
 const PROVIDER_BYTE_LIMIT: usize = 256 * 1024;
 
 #[derive(Debug, Deserialize, schemars::JsonSchema)]
 pub(crate) struct ReadParams {
-    /// Logical path relative to the bound Workdir root.
+    /// Workdir-relative path, or an absolute path covered by readable scope.
     pub file_path: String,
     /// 0-based line offset from the start. Defaults to 0.
     #[serde(default)]
@@ -47,7 +47,7 @@ impl Tool for ReadTool {
         let offset = params.offset.unwrap_or(0);
         let limit = params.limit.unwrap_or(DEFAULT_LIMIT).max(1);
 
-        let path = WorkdirPath::new(&params.file_path).map_err(ToolsError::from)?;
+        let path = WorkdirPath::new_scoped(&params.file_path).map_err(ToolsError::from)?;
         tracing::debug!(path = %path, offset, limit, "Read");
 
         let result = self

crates/tools/tests/edge_cases.rs

@@ -40,6 +40,7 @@ fn setup() -> (TempDir, TempDir, Registry) {
         target: spill.path().to_path_buf(),
         permission: Permission::Read,
         recursive: true,
+        symlink_policy: Default::default(),
     });
     let scope = Scope::from_config(&config).unwrap();
     let fs: WorkdirSessionHandle =
@@ -224,20 +225,23 @@ async fn very_long_single_line() {
 }
 
 #[tokio::test]
-async fn absolute_path_is_rejected() {
-    let (dir, _spill, reg) = setup();
+async fn absolute_path_requires_matching_read_scope() {
+    let (_dir, _spill, reg) = setup();
+    let outside = tempfile::tempdir().unwrap();
+    let outside_file = outside.path().join("outside.txt");
+    std::fs::write(&outside_file, "secret").unwrap();
     let read = reg.get("Read");
     let err = read
         .execute(
-            &json!({ "file_path": dir.path().join("outside.txt") }).to_string(),
+            &json!({ "file_path": outside_file }).to_string(),
             Default::default(),
         )
         .await
         .unwrap_err();
     let msg = format!("{err}");
     assert!(
-        msg.contains("invalid logical filesystem path"),
-        "absolute path was not rejected as invalid: {msg}"
+        msg.contains("outside allowed scope"),
+        "absolute path escaped readable scope: {msg}"
     );
 }