diff --git a/crates/buzz-acp/src/acp.rs b/crates/buzz-acp/src/acp.rs
index f04b8eeec0d..7d9644d2f98 100644
--- a/crates/buzz-acp/src/acp.rs
+++ b/crates/buzz-acp/src/acp.rs
@@ -21,6 +21,77 @@ use crate::usage::{
 /// Maximum allowed size of a single NDJSON line from the agent's stdout.
 /// Lines exceeding this limit are rejected to prevent OOM from rogue agents.
 const MAX_LINE_SIZE: usize = 10_000_000; // 10 MB
+/// Child diagnostics are line-oriented and intentionally much smaller than ACP
+/// protocol frames. Oversized lines are dropped without copying their content.
+const MAX_CHILD_STDERR_LINE_SIZE: usize = 64 * 1024;
+const LOG_HASH_DOMAIN: &[u8] = b"buzz-acp-log-redaction-v1\0";
+
+fn redacted_log_hash(class: &str, value: &str) -> String {
+    use sha2::{Digest, Sha256};
+
+    let mut hasher = Sha256::new();
+    hasher.update(LOG_HASH_DOMAIN);
+    hasher.update(class.as_bytes());
+    hasher.update([0]);
+    hasher.update(value.as_bytes());
+    hex::encode(hasher.finalize())
+}
+
+fn safe_acp_method(value: Option<&str>) -> &'static str {
+    match value {
+        None => "response",
+        Some("initialize") => "initialize",
+        Some("session/new") => "session/new",
+        Some("session/prompt") => "session/prompt",
+        Some("session/cancel") => "session/cancel",
+        Some("session/update") => "session/update",
+        Some("session/request_permission") => "session/request_permission",
+        Some("_goose/unstable/session/update") => "goose_session_update",
+        Some("_goose/unstable/session/steer") => "goose_session_steer",
+        Some("_session/steering") => "session_steering",
+        Some(_) => "unknown",
+    }
+}
+
+fn safe_update_type(value: &str) -> &'static str {
+    match value {
+        "agent_message_chunk" => "agent_message_chunk",
+        "tool_call" => "tool_call",
+        "tool_call_update" => "tool_call_update",
+        "plan" => "plan",
+        "agent_thought_chunk" => "agent_thought_chunk",
+        "available_commands_update" => "available_commands_update",
+        "session_info_update" => "session_info_update",
+        "usage_update" => "usage_update",
+        "keepalive" => "keepalive",
+        _ => "unknown",
+    }
+}
+
+fn safe_tool_kind(value: &str) -> &'static str {
+    match value {
+        "read" => "read",
+        "edit" => "edit",
+        "delete" => "delete",
+        "move" => "move",
+        "search" => "search",
+        "execute" => "execute",
+        "think" => "think",
+        "fetch" => "fetch",
+        "other" => "other",
+        _ => "unknown",
+    }
+}
+
+fn safe_tool_status(value: &str) -> &'static str {
+    match value {
+        "pending" => "pending",
+        "in_progress" => "in_progress",
+        "completed" => "completed",
+        "failed" => "failed",
+        _ => "unknown",
+    }
+}
 
 /// An MCP server configuration passed to `session/new`.
 ///
@@ -111,15 +182,12 @@ pub enum AcpError {
 }
 
 /// Build an [`AcpError::AgentError`] from a JSON-RPC error object,
-/// preserving the numeric code. When the `message` field is missing or
-/// non-string, fall back to the full JSON object so provider-specific
-/// detail (e.g. a `data` field) is not lost.
+/// preserving only the numeric code. Provider error text/data is deliberately
+/// replaced at this boundary so upstream bodies cannot reach logs or observer
+/// frames through a later `Display` call.
 fn agent_error_from_json(error: &serde_json::Value) -> AcpError {
     let code = error.get("code").and_then(|c| c.as_i64()).unwrap_or(-32000);
-    let message = match error.get("message").and_then(|m| m.as_str()) {
-        Some(m) => m.to_string(),
-        None => error.to_string(),
-    };
+    let message = "agent returned a redacted JSON-RPC error".to_string();
     AcpError::AgentError { code, message }
 }
 
@@ -147,6 +215,8 @@ pub struct AcpClient {
     /// Uses `LinesCodec::new_with_max_length` to enforce MAX_LINE_SIZE at the
     /// read level — prevents OOM from rogue agents writing infinite non-newline bytes.
     reader: FramedRead<ChildStdout, LinesCodec>,
+    /// Background drain for redacted child stderr diagnostics.
+    stderr_task: Option<tokio::task::JoinHandle<()>>,
     /// Monotonically increasing JSON-RPC request id counter.
     /// Harness-generated IDs are always numeric.
     next_id: u64,
@@ -441,6 +511,14 @@ impl AcpClient {
             Ok(Err(e)) => tracing::debug!("child wait error after kill: {e}"),
             Err(_) => tracing::warn!("child did not exit within 5s after SIGKILL — abandoning"),
         }
+        if let Some(mut stderr_task) = self.stderr_task.take() {
+            if tokio::time::timeout(std::time::Duration::from_secs(1), &mut stderr_task)
+                .await
+                .is_err()
+            {
+                stderr_task.abort();
+            }
+        }
     }
 
     /// Spawn the agent binary as a subprocess and connect to its stdio pipes.
@@ -463,8 +541,8 @@ impl AcpClient {
         cmd.args(args)
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())
-            // Inherit stderr so agent logs are visible in the harness terminal.
-            .stderr(Stdio::inherit())
+            // Drain child diagnostics through the redaction boundary below.
+            .stderr(Stdio::piped())
             // Ensure the child is killed when the AcpClient is dropped (best-effort).
             // Callers MUST still call shutdown().await for guaranteed cleanup.
             .kill_on_drop(true);
@@ -544,11 +622,58 @@ impl AcpClient {
             .stdout
             .take()
             .ok_or_else(|| AcpError::Protocol("failed to open agent stdout".into()))?;
+        let stderr = child
+            .stderr
+            .take()
+            .ok_or_else(|| AcpError::Protocol("failed to open agent stderr".into()))?;
+        let stderr_dispatch = tracing::dispatcher::get_default(|dispatch| dispatch.clone());
+        let stderr_task = tokio::spawn(async move {
+            let mut reader = FramedRead::new(
+                stderr,
+                LinesCodec::new_with_max_length(MAX_CHILD_STDERR_LINE_SIZE),
+            );
+            while let Some(line) = reader.next().await {
+                match line {
+                    Ok(line) => {
+                        let line_bytes = line.len();
+                        let line_hash = redacted_log_hash("child_stderr", &line);
+                        tracing::dispatcher::with_default(&stderr_dispatch, || {
+                            tracing::debug!(
+                                target: "acp::child_stderr",
+                                line_bytes,
+                                line_hash,
+                                "agent child stderr line"
+                            );
+                        });
+                    }
+                    Err(LinesCodecError::MaxLineLengthExceeded) => {
+                        tracing::dispatcher::with_default(&stderr_dispatch, || {
+                            tracing::warn!(
+                                target: "acp::child_stderr",
+                                error_class = "line_too_long",
+                                "agent child stderr line discarded"
+                            );
+                        });
+                    }
+                    Err(_) => {
+                        tracing::dispatcher::with_default(&stderr_dispatch, || {
+                            tracing::warn!(
+                                target: "acp::child_stderr",
+                                error_class = "read_error",
+                                "agent child stderr drain stopped"
+                            );
+                        });
+                        break;
+                    }
+                }
+            }
+        });
 
         Ok(Self {
             child,
             stdin,
             reader: FramedRead::new(stdout, LinesCodec::new_with_max_length(MAX_LINE_SIZE)),
+            stderr_task: Some(stderr_task),
             next_id: 0,
             pending_permission_id: None,
             permission_responded: false,
@@ -599,6 +724,29 @@ impl AcpClient {
         }
     }
 
+    fn observe_acp_frame(&self, kind: &'static str, frame: &serde_json::Value) {
+        let raw_method = frame.get("method").and_then(serde_json::Value::as_str);
+        let raw_update_type = frame
+            .pointer("/params/update/sessionUpdate")
+            .and_then(serde_json::Value::as_str);
+        let content_bytes = frame
+            .pointer("/params/update/content/text")
+            .and_then(serde_json::Value::as_str)
+            .map(str::len);
+        self.observe(
+            kind,
+            serde_json::json!({
+                "method": safe_acp_method(raw_method),
+                "methodHash": raw_method.map(|value| redacted_log_hash("method", value)),
+                "hasId": frame.get("id").is_some(),
+                "updateType": raw_update_type.map(safe_update_type),
+                "updateTypeHash": raw_update_type
+                    .map(|value| redacted_log_hash("update_type", value)),
+                "contentBytes": content_bytes,
+            }),
+        );
+    }
+
     /// Send the `initialize` request and return the agent's response result value.
     ///
     /// Must be called exactly once, before any other ACP method.
@@ -617,7 +765,11 @@ impl AcpClient {
             .pointer("/_meta/steering/supported")
             .and_then(|v| v.as_bool())
             .unwrap_or(false);
-        tracing::debug!(target: "acp::init", "initialize response: {result}");
+        tracing::debug!(
+            target: "acp::init",
+            steering_supported = self.steering_supported,
+            "ACP initialize completed"
+        );
         Ok(result)
     }
 
@@ -782,6 +934,20 @@ impl AcpClient {
         max_duration: std::time::Duration,
     ) -> Result<StopReason, AcpError> {
         let params = build_prompt_params(session_id, prompt_blocks);
+        self.session_prompt_params_with_idle_timeout(session_id, params, idle_timeout, max_duration)
+            .await
+    }
+
+    /// Send pre-built `session/prompt` params with the standard idle and hard
+    /// deadlines. The trusted Buzz envelope path uses this after adding
+    /// `_meta.buzz`; ordinary prompts continue through the block helper above.
+    pub async fn session_prompt_params_with_idle_timeout(
+        &mut self,
+        session_id: &str,
+        params: serde_json::Value,
+        idle_timeout: std::time::Duration,
+        max_duration: std::time::Duration,
+    ) -> Result<StopReason, AcpError> {
         let hard_deadline = tokio::time::Instant::now() + max_duration;
         self.current_hard_deadline = Some(hard_deadline);
 
@@ -802,7 +968,14 @@ impl AcpClient {
             "params": params,
         });
 
-        tracing::debug!(target: "acp::wire", "→ {}", &serde_json::to_string(&msg).unwrap_or_default());
+        let prompt_block_count = msg["params"]["prompt"].as_array().map_or(0, Vec::len);
+        tracing::debug!(
+            target: "acp::wire",
+            method = "session/prompt",
+            request_id = id,
+            prompt_block_count,
+            "outbound ACP request"
+        );
         if let Err(e) = self.write_ndjson(&msg).await {
             self.last_prompt_id = None;
             self.current_hard_deadline = None;
@@ -1077,7 +1250,7 @@ impl AcpClient {
         .await
         .map_err(|_| AcpError::WriteTimeout(WRITE_TIMEOUT))?
         .map_err(AcpError::Io)?;
-        self.observe("acp_write", value.clone());
+        self.observe_acp_frame("acp_write", value);
         Ok(())
     }
 
@@ -1108,7 +1281,12 @@ impl AcpClient {
             "params": params,
         });
 
-        tracing::debug!(target: "acp::wire", "→ {}", &serde_json::to_string(&msg).unwrap_or_default());
+        tracing::debug!(
+            target: "acp::wire",
+            method,
+            request_id = id,
+            "outbound ACP request"
+        );
 
         // Wrap write + read in a single timeout so a hung agent can't block forever.
         // We cannot use an async block that borrows `self` mutably across two awaits
@@ -1173,7 +1351,11 @@ impl AcpClient {
             "params": params,
         });
 
-        tracing::debug!(target: "acp::wire", "→ (notification) {}", &serde_json::to_string(&msg).unwrap_or_default());
+        tracing::debug!(
+            target: "acp::wire",
+            method,
+            "outbound ACP notification"
+        );
         self.write_ndjson(&msg).await?;
         Ok(())
     }
@@ -1214,27 +1396,36 @@ impl AcpClient {
                 continue;
             }
 
-            // Only log and reset idle after we have a valid non-empty line.
-            tracing::debug!(target: "acp::wire", "← {trimmed}");
-
             let msg: serde_json::Value = match serde_json::from_str(trimmed) {
                 Ok(v) => v,
                 Err(e) => {
                     self.observe(
                         "acp_parse_error",
                         serde_json::json!({
-                            "line": trimmed,
-                            "error": e.to_string(),
+                            "errorClass": "invalid_json",
+                            "lineBytes": trimmed.len(),
                         }),
                     );
                     tracing::warn!(
                         target: "acp::wire",
-                        "failed to parse line as JSON: {e} — skipping"
+                        error_class = "invalid_json",
+                        line_bytes = trimmed.len(),
+                        line = e.line(),
+                        column = e.column(),
+                        "failed to parse inbound ACP frame"
                     );
                     continue;
                 }
             };
-            self.observe("acp_read", msg.clone());
+            let raw_method = msg.get("method").and_then(serde_json::Value::as_str);
+            tracing::debug!(
+                target: "acp::wire",
+                method = safe_acp_method(raw_method),
+                method_hash = redacted_log_hash("method", raw_method.unwrap_or("response")),
+                has_id = msg.get("id").is_some(),
+                "inbound ACP frame"
+            );
+            self.observe_acp_frame("acp_read", &msg);
 
             // Check if this is a response to our expected request (has matching id
             // AND no `method` field — a `method` field means it's an agent-initiated
@@ -1274,7 +1465,12 @@ impl AcpClient {
                             // agent process is dead and continuing would hang.
                             self.write_ndjson(&err_resp).await?;
                         }
-                        tracing::debug!(target: "acp::wire", "ignoring unknown method: {other}");
+                        tracing::debug!(
+                            target: "acp::wire",
+                            method = "unknown",
+                            method_hash = redacted_log_hash("method", other),
+                            "ignoring unknown ACP method"
+                        );
                     }
                 }
             }
@@ -1461,8 +1657,9 @@ impl AcpClient {
                             });
                             tracing::debug!(
                                 target: "acp::wire",
-                                "→ {}",
-                                serde_json::to_string(&msg).unwrap_or_default()
+                                method,
+                                request_id = id,
+                                "outbound ACP steer request"
                             );
                             match self.write_ndjson(&msg).await {
                                 Ok(()) => {
@@ -1538,26 +1735,36 @@ impl AcpClient {
                         continue;
                     }
 
-                    tracing::debug!(target: "acp::wire", "← {trimmed}");
-
                     let msg: serde_json::Value = match serde_json::from_str(trimmed) {
                         Ok(v) => v,
                         Err(e) => {
                             self.observe(
                                 "acp_parse_error",
                                 serde_json::json!({
-                                    "line": trimmed,
-                                    "error": e.to_string(),
+                                    "errorClass": "invalid_json",
+                                    "lineBytes": trimmed.len(),
                                 }),
                             );
                             tracing::warn!(
                                 target: "acp::wire",
-                                "failed to parse line as JSON: {e} — skipping"
+                                error_class = "invalid_json",
+                                line_bytes = trimmed.len(),
+                                line = e.line(),
+                                column = e.column(),
+                                "failed to parse inbound ACP frame"
                             );
                             continue;
                         }
                     };
-                    self.observe("acp_read", msg.clone());
+                    let raw_method = msg.get("method").and_then(serde_json::Value::as_str);
+                    tracing::debug!(
+                        target: "acp::wire",
+                        method = safe_acp_method(raw_method),
+                        method_hash = redacted_log_hash("method", raw_method.unwrap_or("response")),
+                        has_id = msg.get("id").is_some(),
+                        "inbound ACP frame"
+                    );
+                    self.observe_acp_frame("acp_read", &msg);
 
                     let activity_now = Instant::now();
                     idle_deadline = activity_now + idle_timeout;
@@ -1583,7 +1790,8 @@ impl AcpClient {
                                             .get("code")
                                             .and_then(|c| c.as_i64())
                                             .unwrap_or(-1);
-                                        let message = error.to_string();
+                                        let message =
+                                            "agent returned a redacted steer error".to_string();
                                         crate::pool::SteerAck::Err(
                                             crate::pool::SteerError::AgentError { code, message },
                                         )
@@ -1722,7 +1930,12 @@ impl AcpClient {
                                     // agent process is dead and continuing would hang.
                                     self.write_ndjson(&err_resp).await?;
                                 }
-                                tracing::debug!(target: "acp::wire", "ignoring unknown method: {other}");
+                                tracing::debug!(
+                                    target: "acp::wire",
+                                    method = "unknown",
+                                    method_hash = redacted_log_hash("method", other),
+                                    "ignoring unknown ACP method"
+                                );
                             }
                         }
                     }
@@ -1754,9 +1967,8 @@ impl AcpClient {
 
         match update_type {
             "agent_message_chunk" => {
-                if let Some(text) = update["content"]["text"].as_str() {
-                    tracing::info!(target: "acp::stream", "{text}");
-                }
+                let bytes = update["content"]["text"].as_str().map_or(0, str::len);
+                tracing::debug!(target: "acp::stream", bytes, "agent message chunk");
                 false
             }
             "tool_call" => {
@@ -1768,7 +1980,14 @@ impl AcpClient {
                     .get("kind")
                     .and_then(|v| v.as_str())
                     .unwrap_or("unknown");
-                tracing::info!(target: "acp::tool", "tool_call: {title} ({kind})");
+                tracing::info!(
+                    target: "acp::tool",
+                    title_bytes = title.len(),
+                    title_hash = redacted_log_hash("tool_title", title),
+                    kind = safe_tool_kind(kind),
+                    kind_hash = redacted_log_hash("tool_kind", kind),
+                    "tool call started"
+                );
                 true
             }
             "tool_call_update" => {
@@ -1777,7 +1996,13 @@ impl AcpClient {
                     .and_then(|v| v.as_str())
                     .unwrap_or("?");
                 let status = update.get("status").and_then(|v| v.as_str()).unwrap_or("?");
-                tracing::info!(target: "acp::tool", "tool_call_update: {tool_id} → {status}");
+                tracing::info!(
+                    target: "acp::tool",
+                    tool_id_hash = redacted_log_hash("tool_id", tool_id),
+                    status = safe_tool_status(status),
+                    status_hash = redacted_log_hash("tool_status", status),
+                    "tool call updated"
+                );
                 false
             }
             "plan" => {
@@ -1785,23 +2010,19 @@ impl AcpClient {
                 false
             }
             "agent_thought_chunk" => {
-                if let Some(text) = update["content"]["text"].as_str() {
-                    tracing::debug!(target: "acp::thought", "{text}");
-                }
+                let bytes = update["content"]["text"].as_str().map_or(0, str::len);
+                tracing::debug!(target: "acp::thought", bytes, "agent thought chunk");
                 false
             }
             "available_commands_update" => {
                 // Advertised slash commands (ACP slash-commands extension).
-                // Logged for observability; UI surfacing is a follow-up.
-                let names: Vec<&str> = update["availableCommands"]
-                    .as_array()
-                    .map(|cmds| cmds.iter().filter_map(|c| c["name"].as_str()).collect())
-                    .unwrap_or_default();
+                // Only the bounded count is observable; command names are
+                // agent-controlled content and stay behind the redaction boundary.
+                let command_count = update["availableCommands"].as_array().map_or(0, Vec::len);
                 tracing::info!(
                     target: "acp::update",
-                    "available_commands_update: {} commands [{}]",
-                    names.len(),
-                    names.join(", ")
+                    command_count,
+                    "available commands updated"
                 );
                 false
             }
@@ -1824,7 +2045,8 @@ impl AcpClient {
                         Some(serde_json::Value::String(run_id)) => {
                             tracing::debug!(
                                 target: "acp::update",
-                                "session_info_update: activeRunId={run_id}"
+                                run_id_hash = redacted_log_hash("active_run_id", run_id),
+                                "session active run updated"
                             );
                             self.active_run_id = Some(run_id.clone());
                         }
@@ -1847,7 +2069,12 @@ impl AcpClient {
             }
             "keepalive" => false,
             other => {
-                tracing::debug!(target: "acp::update", "session/update: {other}");
+                tracing::debug!(
+                    target: "acp::update",
+                    update_type = safe_update_type(other),
+                    update_type_hash = redacted_log_hash("update_type", other),
+                    "unknown session update"
+                );
                 false
             }
         }
@@ -2274,6 +2501,9 @@ pub fn model_in_catalog(
 
 impl Drop for AcpClient {
     fn drop(&mut self) {
+        if let Some(stderr_task) = self.stderr_task.take() {
+            stderr_task.abort();
+        }
         // Best-effort SIGKILL + reap. We cannot `await` in Drop (sync context).
         // Kill the process group when possible so subprocesses don't leak.
         // Callers SHOULD still call `shutdown().await` for guaranteed reaping.
@@ -4698,29 +4928,26 @@ mod tests {
     }
 
     #[test]
-    fn agent_error_from_json_falls_back_to_full_json_when_message_missing() {
-        // Errors without a string `message` field (e.g. only a `data` field) must
-        // not be silently truncated to "unknown error" — the full JSON is preserved.
+    fn agent_error_from_json_redacts_data_when_message_missing() {
         let error = serde_json::json!({"code": -32000, "data": "quota exceeded"});
         match super::agent_error_from_json(&error) {
             AcpError::AgentError { code, message } => {
                 assert_eq!(code, -32000);
-                assert!(
-                    message.contains("quota exceeded"),
-                    "expected full JSON in message, got: {message}"
-                );
+                assert_eq!(message, "agent returned a redacted JSON-RPC error");
+                assert!(!message.contains("quota exceeded"));
             }
             other => panic!("expected AgentError, got {other:?}"),
         }
     }
 
     #[test]
-    fn agent_error_from_json_uses_message_field_when_present() {
+    fn agent_error_from_json_redacts_message_field_when_present() {
         let error = serde_json::json!({"code": -32001, "message": "auth denied"});
         match super::agent_error_from_json(&error) {
             AcpError::AgentError { code, message } => {
                 assert_eq!(code, -32001);
-                assert_eq!(message, "auth denied");
+                assert_eq!(message, "agent returned a redacted JSON-RPC error");
+                assert!(!message.contains("auth denied"));
             }
             other => panic!("expected AgentError, got {other:?}"),
         }
diff --git a/crates/buzz-acp/src/buzz_envelope.rs b/crates/buzz-acp/src/buzz_envelope.rs
new file mode 100644
index 00000000000..4e1477afccb
--- /dev/null
+++ b/crates/buzz-acp/src/buzz_envelope.rs
@@ -0,0 +1,244 @@
+//! Authenticated Buzz transport metadata for ACP `session/prompt` requests.
+//!
+//! Rendered prompt text is intentionally not an input to the trusted envelope.
+//! The envelope is built only from the already-verified Nostr events and the
+//! authoritative channel membership snapshot supplied by the harness.
+
+use anyhow::{anyhow, bail, Context, Result};
+use nostr::secp256k1::{Keypair, Message};
+use nostr::{Event, Keys, SECP256K1};
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
+
+const ENVELOPE_DOMAIN: &[u8] = b"buzz-acp-envelope-v1\0";
+
+/// Verified inputs used to build one authenticated Buzz ACP prompt envelope.
+pub struct VerifiedBuzzPromptInput<'a> {
+    /// ACP session receiving the prompt.
+    pub session_id: &'a str,
+    /// Rendered prompt blocks. These remain untrusted message content.
+    pub prompt_blocks: &'a [&'a str],
+    /// Authoritative Buzz channel UUID.
+    pub channel_id: &'a str,
+    /// Authoritative Buzz channel classification.
+    pub channel_type: &'a str,
+    /// Verified owner public key.
+    pub owner_pubkey: &'a str,
+    /// Managed agent signing identity.
+    pub agent_keys: &'a Keys,
+    /// Authoritative channel membership snapshot.
+    pub members: &'a [(String, String)],
+    /// Ordered, verified inbound Nostr events in this delivery.
+    pub events: &'a [Event],
+}
+
+/// Build ACP prompt params carrying an authenticated Buzz v1 delivery envelope.
+pub fn build_verified_buzz_prompt_params(input: VerifiedBuzzPromptInput<'_>) -> Result<Value> {
+    let VerifiedBuzzPromptInput {
+        session_id,
+        prompt_blocks,
+        channel_id,
+        channel_type,
+        owner_pubkey,
+        agent_keys,
+        members,
+        events,
+    } = input;
+    if channel_type != "dm" {
+        bail!("Buzz P0 accepts owner DMs only");
+    }
+    let owner_pubkey = normalize_pubkey(owner_pubkey)?;
+    let agent_pubkey = agent_keys.public_key().to_hex().to_ascii_lowercase();
+    if owner_pubkey == agent_pubkey {
+        bail!("owner and managed agent must be distinct identities");
+    }
+    if events.is_empty() {
+        bail!("Buzz delivery must contain at least one signed event");
+    }
+
+    let mut members: Vec<Value> = members
+        .iter()
+        .map(|(pubkey, role)| {
+            let pubkey = normalize_pubkey(pubkey)?;
+            if !matches!(role.as_str(), "owner" | "admin" | "member") {
+                bail!("unsupported Buzz membership role");
+            }
+            Ok(json!({"pubkey": pubkey, "role": role}))
+        })
+        .collect::<Result<_>>()?;
+    members.sort_by(|left, right| {
+        left["pubkey"]
+            .as_str()
+            .unwrap_or_default()
+            .as_bytes()
+            .cmp(right["pubkey"].as_str().unwrap_or_default().as_bytes())
+    });
+    if members.len() != 2
+        || !members
+            .iter()
+            .any(|member| member["pubkey"] == owner_pubkey && member["role"] == "member")
+        || !members
+            .iter()
+            .any(|member| member["pubkey"] == agent_pubkey && member["role"] == "member")
+    {
+        bail!("Buzz P0 requires the exact owner and managed-agent DM participant set");
+    }
+
+    let channel_id = uuid::Uuid::parse_str(channel_id)
+        .context("invalid Buzz channel UUID")?
+        .to_string();
+    for event in events {
+        event.verify().context("invalid signed Buzz event")?;
+        if event.pubkey.to_hex().to_ascii_lowercase() != owner_pubkey {
+            bail!("Buzz P0 accepts only owner-authored inbound events");
+        }
+        let belongs_to_channel = event.tags.iter().any(|tag| {
+            let values = tag.as_slice();
+            values.first().map(String::as_str) == Some("h")
+                && values.get(1).map(String::as_str) == Some(channel_id.as_str())
+        });
+        if !belongs_to_channel {
+            bail!("signed Buzz event does not belong to the claimed channel");
+        }
+    }
+
+    let membership_revision = membership_revision(&channel_id, &members)?;
+    let channel = json!({
+        "id": channel_id,
+        "type": "dm",
+        "ownerPubkey": owner_pubkey,
+        "agentPubkey": agent_pubkey,
+        "members": members,
+        "membershipRevision": membership_revision,
+    });
+    let anchor = events
+        .last()
+        .ok_or_else(|| anyhow!("missing reply anchor"))?;
+    let (thread_root, thread_parent) = thread_anchors(anchor);
+    let anchor_id = anchor.id.to_hex();
+    let reply = json!({
+        "rootEventId": thread_root.unwrap_or_else(|| anchor_id.clone()),
+        "parentEventId": thread_parent,
+        "replyToEventId": anchor_id,
+    });
+    let event_values = events
+        .iter()
+        .map(serde_json::to_value)
+        .collect::<std::result::Result<Vec<_>, _>>()
+        .context("failed to serialize signed Buzz events")?;
+    let event_ids = events
+        .iter()
+        .map(|event| Value::String(event.id.to_hex()))
+        .collect::<Vec<_>>();
+    let delivery_payload = json!({
+        "version": 1,
+        "channel": channel,
+        "reply": reply,
+        "eventIds": event_ids,
+    });
+    let delivery_id = sha256_hex(canonical_json(&delivery_payload)?.as_bytes());
+    let mut envelope = json!({
+        "version": 1,
+        "deliveryId": delivery_id,
+        "channel": delivery_payload["channel"],
+        "reply": delivery_payload["reply"],
+        "events": event_values,
+    });
+
+    let mut preimage = ENVELOPE_DOMAIN.to_vec();
+    preimage.extend(canonical_json(&envelope)?.as_bytes());
+    let digest: [u8; 32] = Sha256::digest(&preimage).into();
+    let keypair = Keypair::from_secret_key(SECP256K1, agent_keys.secret_key());
+    let signature = SECP256K1.sign_schnorr_no_aux_rand(&Message::from_digest(digest), &keypair);
+    envelope["attestation"] = json!({
+        "algorithm": "bip340-sha256",
+        "signerPubkey": agent_pubkey,
+        "payloadHash": hex::encode(digest),
+        "signature": signature.to_string(),
+    });
+
+    let blocks = prompt_blocks
+        .iter()
+        .map(|text| json!({"type": "text", "text": text}))
+        .collect::<Vec<_>>();
+    Ok(json!({
+        "sessionId": session_id,
+        "prompt": blocks,
+        "_meta": {"buzz": envelope},
+    }))
+}
+
+fn normalize_pubkey(value: &str) -> Result<String> {
+    let normalized = value.trim().to_ascii_lowercase();
+    nostr::PublicKey::from_hex(&normalized).context("invalid Buzz pubkey")?;
+    Ok(normalized)
+}
+
+fn thread_anchors(event: &Event) -> (Option<String>, Option<String>) {
+    let mut root = None;
+    let mut parent = None;
+    for tag in event.tags.iter() {
+        let values = tag.as_slice();
+        if values.first().map(String::as_str) != Some("e") || values.len() < 4 {
+            continue;
+        }
+        match values.get(3).map(String::as_str) {
+            Some("root") => root = values.get(1).cloned(),
+            Some("reply") => parent = values.get(1).cloned(),
+            _ => {}
+        }
+    }
+    if root.is_none() {
+        root = parent.clone();
+    }
+    (root, parent)
+}
+
+fn membership_revision(channel_id: &str, members: &[Value]) -> Result<String> {
+    let payload = json!({
+        "version": 1,
+        "channelId": channel_id,
+        "members": members,
+    });
+    Ok(format!(
+        "v1:{}",
+        sha256_hex(canonical_json(&payload)?.as_bytes())
+    ))
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+/// Canonicalize the integer-only JSON subset used by the Buzz wire contract.
+fn canonical_json(value: &Value) -> Result<String> {
+    match value {
+        Value::Null => Ok("null".to_string()),
+        Value::Bool(value) => Ok(value.to_string()),
+        Value::Number(value) if value.is_i64() || value.is_u64() => Ok(value.to_string()),
+        Value::Number(_) => bail!("non-integer numbers are not allowed in Buzz canonical JSON"),
+        Value::String(value) => serde_json::to_string(value).context("canonical JSON string"),
+        Value::Array(values) => {
+            let values = values
+                .iter()
+                .map(canonical_json)
+                .collect::<Result<Vec<_>>>()?;
+            Ok(format!("[{}]", values.join(",")))
+        }
+        Value::Object(values) => {
+            let mut keys = values.keys().collect::<Vec<_>>();
+            keys.sort_by(|left, right| left.encode_utf16().cmp(right.encode_utf16()));
+            let fields = keys
+                .into_iter()
+                .map(|key| {
+                    Ok(format!(
+                        "{}:{}",
+                        serde_json::to_string(key).context("canonical JSON key")?,
+                        canonical_json(&values[key])?
+                    ))
+                })
+                .collect::<Result<Vec<_>>>()?;
+            Ok(format!("{{{}}}", fields.join(",")))
+        }
+    }
+}
diff --git a/crates/buzz-acp/src/config.rs b/crates/buzz-acp/src/config.rs
index f9e7bf1ed8a..1e08c6fec15 100644
--- a/crates/buzz-acp/src/config.rs
+++ b/crates/buzz-acp/src/config.rs
@@ -708,6 +708,25 @@ pub(crate) fn normalize_agent_command_identity(command: &str) -> String {
         .collect()
 }
 
+/// Frozen harness identity for the owner-reviewed Gabe Context Engine runtime.
+pub(crate) const GABE_CONTEXT_ENGINE_HARNESS: &str = "gabe-acp";
+
+/// Derive the configured harness identity from the executable and its first
+/// argument. The production Gabe profile is intentionally exact: Node running
+/// `gabe-acp.mjs`. Merely setting a Gabe environment variable cannot opt an
+/// ordinary ACP runtime into the trusted transport path.
+pub(crate) fn configured_harness_identity(command: &str, args: &[String]) -> String {
+    let command_identity = normalize_agent_command_identity(command);
+    let script_identity = args
+        .first()
+        .map(|value| normalize_agent_command_identity(value));
+    if command_identity == "node" && script_identity.as_deref() == Some("gabe-acp.mjs") {
+        GABE_CONTEXT_ENGINE_HARNESS.to_string()
+    } else {
+        command_identity
+    }
+}
+
 fn default_agent_args(command: &str) -> Option<Vec<String>> {
     match normalize_agent_command_identity(command).as_str() {
         "goose" => Some(vec!["acp".to_string()]),
@@ -1653,6 +1672,25 @@ mod tests {
         assert_eq!(normalize_agent_command_identity("///"), "");
     }
 
+    #[test]
+    fn derives_gabe_context_engine_harness_only_from_frozen_node_script_pair() {
+        let script = vec![
+            "/Users/gabriel/.openclaw/extensions/context-engine/scripts/gabe-acp.mjs".to_string(),
+        ];
+        assert_eq!(
+            configured_harness_identity(
+                "/Users/gabriel/.nvm/versions/node/v24.13.1/bin/node",
+                &script,
+            ),
+            GABE_CONTEXT_ENGINE_HARNESS,
+        );
+        assert_eq!(configured_harness_identity("goose", &script), "goose");
+        assert_eq!(
+            configured_harness_identity("node", &["ordinary-acp.mjs".to_string()]),
+            "node",
+        );
+    }
+
     #[test]
     fn default_agent_env_recognizes_hermes_identities() {
         for command in [
diff --git a/crates/buzz-acp/src/lib.rs b/crates/buzz-acp/src/lib.rs
index 27b9000b7bb..18cad3891f2 100644
--- a/crates/buzz-acp/src/lib.rs
+++ b/crates/buzz-acp/src/lib.rs
@@ -1,6 +1,7 @@
 #![deny(unsafe_code)]
 
 mod acp;
+mod buzz_envelope;
 mod config;
 mod engram_fetch;
 mod filter;
@@ -14,6 +15,203 @@ mod usage;
 
 pub use usage::TurnUsage;
 
+/// Build verified ACP prompt parameters for Buzz transport integration tests
+/// and protocol adapters.
+pub use buzz_envelope::{
+    build_verified_buzz_prompt_params as build_verified_buzz_prompt_params_for_test,
+    VerifiedBuzzPromptInput,
+};
+
+/// Captured process output from the ACP trace-redaction integration probe.
+pub struct TraceRedactionCapture {
+    pub status_success: bool,
+    pub stdout: String,
+    pub stderr: String,
+}
+
+/// Exercise a real ACP subprocess while trace logging is enabled.
+///
+/// This public seam exists so integration tests can inject unique canaries into
+/// prompt, thought, tool-output, system-prompt, and credential-shaped fields
+/// and then inspect the harness trace stream without exposing those values.
+pub async fn run_trace_redaction_probe_for_test(
+    canaries: &[(&str, &str)],
+) -> Result<TraceRedactionCapture> {
+    use std::io::Write;
+    use std::sync::{Arc, Mutex};
+
+    #[derive(Clone)]
+    struct CaptureWriter(Arc<Mutex<Vec<u8>>>);
+    struct CaptureGuard(Arc<Mutex<Vec<u8>>>);
+    impl Write for CaptureGuard {
+        fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
+            self.0
+                .lock()
+                .map_err(|_| std::io::Error::other("trace capture lock poisoned"))?
+                .extend_from_slice(bytes);
+            Ok(bytes.len())
+        }
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+    impl<'writer> tracing_subscriber::fmt::MakeWriter<'writer> for CaptureWriter {
+        type Writer = CaptureGuard;
+        fn make_writer(&'writer self) -> Self::Writer {
+            CaptureGuard(Arc::clone(&self.0))
+        }
+    }
+
+    let find = |class: &str| {
+        canaries
+            .iter()
+            .find_map(|(candidate, value)| (*candidate == class).then_some(*value))
+            .unwrap_or("redaction-probe")
+    };
+    let thought = find("thought");
+    let tool_output = find("tool_output");
+    let child_stdout = find("child_stdout");
+    let child_stderr = find("child_stderr");
+    let thought_frame = serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {"update": {
+            "sessionUpdate": "agent_thought_chunk",
+            "content": {"text": thought}
+        }}
+    });
+    let tool_frame = serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {"update": {
+            "sessionUpdate": "tool_call_update",
+            "toolCallId": find("tool_id"),
+            "status": find("status"),
+            "content": [{"type": "content", "content": {"type": "text", "text": tool_output}}]
+        }}
+    });
+    let tool_start_frame = serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {"update": {
+            "sessionUpdate": "tool_call",
+            "title": find("title"),
+            "kind": find("kind"),
+        }}
+    });
+    let command_frame = serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {"update": {
+            "sessionUpdate": "available_commands_update",
+            "availableCommands": [{"name": find("command")}],
+        }}
+    });
+    let run_frame = serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {"update": {
+            "sessionUpdate": "session_info_update",
+            "_meta": {"goose": {"activeRunId": find("run_id")}},
+        }}
+    });
+    let unknown_update_frame = serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {"update": {"sessionUpdate": find("update_type")}}
+    });
+    let child_stdout_frame = serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": "session/update",
+        "params": {"update": {
+            "sessionUpdate": "agent_message_chunk",
+            "content": {"text": child_stdout},
+        }}
+    });
+    let script = format!(
+        "read -r _init; printf '%s\\n' '{{\"jsonrpc\":\"2.0\",\"id\":0,\"result\":{{}}}}'; \
+         read -r _new; printf '%s\\n' '{{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{{\"sessionId\":\"trace-session\"}}}}'; \
+         read -r _prompt; printf '%s\\n' '{}' '{}' '{}' '{}' '{}' '{}' '{}'; \
+         printf '%s\\n' '{}' >&2; \
+         printf '%s\\n' '{{\"jsonrpc\":\"2.0\",\"id\":2,\"result\":{{\"stopReason\":\"end_turn\"}}}}'; \
+         sleep 1",
+        thought_frame,
+        tool_start_frame,
+        tool_frame,
+        command_frame,
+        run_frame,
+        unknown_update_frame,
+        child_stdout_frame,
+        child_stderr,
+    );
+
+    let captured = Arc::new(Mutex::new(Vec::new()));
+    let subscriber = tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::TRACE)
+        .with_ansi(false)
+        .with_writer(CaptureWriter(Arc::clone(&captured)))
+        .finish();
+    let dispatch = tracing::Dispatch::new(subscriber);
+    let _default_guard = tracing::dispatcher::set_default(&dispatch);
+
+    let mcp_env = canaries
+        .iter()
+        .map(|(class, value)| EnvVar {
+            name: format!("BUZZ_REDACTION_{}", class.to_ascii_uppercase()),
+            value: (*value).to_string(),
+        })
+        .collect::<Vec<_>>();
+    let extra_env = canaries
+        .iter()
+        .map(|(class, value)| {
+            (
+                format!("BUZZ_REDACTION_{}", class.to_ascii_uppercase()),
+                (*value).to_string(),
+            )
+        })
+        .collect::<Vec<_>>();
+    let args = vec!["-c".to_string(), script];
+    let mut client = AcpClient::spawn("/bin/sh", &args, &extra_env, false).await?;
+    let result = async {
+        client.initialize().await?;
+        let session_id = client
+            .session_new(
+                "/",
+                vec![McpServer {
+                    name: "redaction-probe".to_string(),
+                    command: "/usr/bin/true".to_string(),
+                    args: Vec::new(),
+                    env: mcp_env,
+                }],
+                Some(acp::SystemPromptTransport::Field(find(
+                    "hostile_system_prompt",
+                ))),
+                None,
+            )
+            .await?;
+        client
+            .session_prompt_with_idle_timeout(
+                &session_id,
+                find("content"),
+                Duration::from_secs(2),
+                Duration::from_secs(3),
+            )
+            .await?;
+        Ok::<(), acp::AcpError>(())
+    }
+    .await;
+    client.shutdown().await;
+    let bytes = captured
+        .lock()
+        .map_err(|_| anyhow::anyhow!("trace capture lock poisoned"))?
+        .clone();
+    Ok(TraceRedactionCapture {
+        status_success: result.is_ok(),
+        stdout: String::new(),
+        stderr: String::from_utf8_lossy(&bytes).into_owned(),
+    })
+}
+
 use std::collections::{HashMap, HashSet, VecDeque};
 use std::sync::Arc;
 use std::time::Duration;
@@ -1755,10 +1953,19 @@ async fn tokio_main() -> Result<()> {
         return run_authenticate(args).await;
     }
 
+    // Network-stack TRACE events can contain complete WebSocket/HTTP frames,
+    // including signed message bodies and authorization material. Keep those
+    // crates disabled even when an operator enables broad `RUST_LOG=trace`;
+    // Buzz's own structured trace events remain available.
+    let filter = EnvFilter::try_from_default_env()
+        .unwrap_or_else(|_| EnvFilter::new("buzz_acp=info"))
+        .add_directive("tungstenite=off".parse()?)
+        .add_directive("tokio_tungstenite=off".parse()?)
+        .add_directive("hyper=off".parse()?)
+        .add_directive("hyper_util=off".parse()?)
+        .add_directive("reqwest=off".parse()?);
     tracing_subscriber::fmt()
-        .with_env_filter(
-            EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("buzz_acp=info")),
-        )
+        .with_env_filter(filter)
         .compact()
         .init();
 
@@ -2009,6 +2216,13 @@ async fn tokio_main() -> Result<()> {
     }
 
     let base_prompt_content = config.base_prompt_content.take();
+    let harness_name =
+        crate::config::configured_harness_identity(&config.agent_command, &config.agent_args);
+    let managed_agent_pubkey_pin = if harness_name == crate::config::GABE_CONTEXT_ENGINE_HARNESS {
+        std::env::var("BUZZ_GABE_AGENT_PUBKEY").ok()
+    } else {
+        None
+    };
     let ctx = Arc::new(PromptContext {
         mcp_servers: build_mcp_servers(&config),
         initial_message: config.initial_message.clone(),
@@ -2041,7 +2255,8 @@ async fn tokio_main() -> Result<()> {
             .as_deref()
             .and_then(|hex| nostr::PublicKey::from_hex(hex).ok()),
         memory_enabled: config.memory_enabled,
-        harness_name: crate::config::normalize_agent_command_identity(&config.agent_command),
+        harness_name,
+        managed_agent_pubkey_pin,
         relay_url: config.relay_url.clone(),
     });
 
@@ -5398,9 +5613,21 @@ mod author_gate_tests {
         use std::sync::atomic::Ordering;
 
         let id = Uuid::new_v4();
-        let response = serde_json::json!([{
-            "tags": [["d", id.to_string()], ["name", "DM"], ["t", "dm"]]
-        }]);
+        let id_text = id.to_string();
+        let response = {
+            let event = nostr::EventBuilder::new(
+                nostr::Kind::Custom(buzz_core::kind::KIND_NIP29_GROUP_METADATA as u16),
+                "",
+            )
+            .tags([
+                nostr::Tag::parse(["d", id_text.as_str()]).expect("d tag"),
+                nostr::Tag::parse(["name", "DM"]).expect("name tag"),
+                nostr::Tag::parse(["t", "dm"]).expect("type tag"),
+            ])
+            .sign_with_keys(&nostr::Keys::generate())
+            .expect("signed metadata fixture");
+            serde_json::to_value(vec![event]).expect("metadata response")
+        };
         let (resolver, requests, server) = lazy_resolver_with_response(response).await;
 
         assert!(is_dm_channel(id, &resolver).await);
diff --git a/crates/buzz-acp/src/pool.rs b/crates/buzz-acp/src/pool.rs
index e38fa9b83e4..1f99098abed 100644
--- a/crates/buzz-acp/src/pool.rs
+++ b/crates/buzz-acp/src/pool.rs
@@ -600,8 +600,11 @@ pub struct PromptContext {
     /// `--no-memory` / `BUZZ_ACP_NO_MEMORY`.
     pub memory_enabled: bool,
     /// Harness identity string for NIP-AM `harness` field. Derived from the
-    /// configured `agent_command` at startup (e.g. `"goose"`, `"buzz-agent"`).
+    /// frozen executable/argument pair at startup (e.g. `"goose"`, `"gabe-acp"`).
     pub harness_name: String,
+    /// Startup-captured non-secret identity pin for the trusted Gabe harness.
+    /// Ordinary ACP runtimes leave this unset and retain legacy prompt framing.
+    pub managed_agent_pubkey_pin: Option<String>,
     /// Relay URL this harness is connected to. Rides in observer payloads that
     /// the desktop keys per (agent, relay) pair, e.g. `session_config_captured`,
     /// mirroring the `managed_agent_runtime_lifecycle` frames.
@@ -2047,7 +2050,7 @@ pub async fn run_prompt_task(
             tracing::info!(
                 target: "pool::prompt",
                 channel = %b.channel_id,
-                command = %cmd,
+                command_bytes = cmd.len(),
                 "slash-command pass-through"
             );
         }
@@ -2105,6 +2108,33 @@ pub async fn run_prompt_task(
             .collect(),
         None => prompt_sections.iter().map(String::as_str).collect(),
     };
+    let verified_prompt_params = match build_verified_buzz_prompt_params_for_batch(
+        batch.as_ref(),
+        &session_id,
+        &prompt_blocks,
+        &ctx,
+    )
+    .await
+    {
+        Ok(params) => params,
+        Err(error) => {
+            tracing::warn!(
+                target: "pool::prompt",
+                error_class = "buzz_envelope_rejected",
+                "trusted Buzz prompt envelope could not be built"
+            );
+            agent.state.invalidate(&source);
+            send_prompt_result(
+                &result_tx,
+                &turn_id,
+                agent,
+                source,
+                PromptOutcome::Error(error),
+                requeue_batch_if_queue(&ctx, batch),
+            );
+            return;
+        }
+    };
     let prompt_bytes: usize = prompt_blocks.iter().map(|block| block.len()).sum();
     let has_standing_context = match &source {
         PromptSource::Channel(_) => !standing.sections().is_empty(),
@@ -2149,10 +2179,9 @@ pub async fn run_prompt_task(
             // Heartbeat / non-cancellable path.
             tokio::select! {
                 biased;
-                result = agent.acp.session_prompt_blocks_with_idle_timeout(
-                    &session_id,
-                    &prompt_blocks,
-                    ctx.idle_timeout,
+                result = send_prompt_with_optional_buzz_envelope(
+                    &mut agent.acp, &session_id, &prompt_blocks,
+                    verified_prompt_params.as_ref(), ctx.idle_timeout,
                     ctx.max_turn_duration,
                 ) => result,
             }
@@ -2160,10 +2189,9 @@ pub async fn run_prompt_task(
         Some(rx) => {
             tokio::select! {
                 biased;
-                result = agent.acp.session_prompt_blocks_with_idle_timeout(
-                    &session_id,
-                    &prompt_blocks,
-                    ctx.idle_timeout,
+                result = send_prompt_with_optional_buzz_envelope(
+                    &mut agent.acp, &session_id, &prompt_blocks,
+                    verified_prompt_params.as_ref(), ctx.idle_timeout,
                     ctx.max_turn_duration,
                 ) => result,
                 mode = rx => {
@@ -2595,8 +2623,18 @@ pub(crate) async fn fetch_channel_info(
         {
             Ok(Ok(json)) => {
                 let events = json.as_array()?;
-                let ev = events.first()?;
-                let tags = ev.get("tags")?.as_array()?;
+                let event: nostr::Event = serde_json::from_value(events.first()?.clone()).ok()?;
+                event.verify().ok()?;
+                let channel_text = channel_id.to_string();
+                if !event.tags.iter().any(|tag| {
+                    let values = tag.as_slice();
+                    values.first().map(String::as_str) == Some("d")
+                        && values.get(1).map(String::as_str) == Some(channel_text.as_str())
+                }) {
+                    return None;
+                }
+                let tag_values = serde_json::to_value(&event.tags).ok()?;
+                let tags = tag_values.as_array()?;
                 let mut name = None;
                 let mut description = None;
                 for tag in tags {
@@ -2638,6 +2676,167 @@ pub(crate) async fn fetch_channel_info(
     .await
 }
 
+/// Fetch and verify the current replaceable membership event for one channel.
+/// The authenticated relay query supplies the authoritative snapshot; the
+/// embedded Nostr signature and channel `d` tag are still checked before use.
+async fn fetch_verified_channel_members(
+    channel_id: Uuid,
+    rest: &RestClient,
+) -> Result<Vec<(String, String)>, AcpError> {
+    use nostr::{Alphabet, SingleLetterTag};
+
+    let d_tag = SingleLetterTag::lowercase(Alphabet::D);
+    let filter = nostr::Filter::new()
+        .kind(nostr::Kind::Custom(
+            buzz_core::kind::KIND_NIP29_GROUP_MEMBERS as u16,
+        ))
+        .custom_tags(d_tag, [channel_id.to_string()]);
+    let response = timeout(CONTEXT_FETCH_TIMEOUT, rest.query(&[filter]))
+        .await
+        .map_err(|_| AcpError::Protocol("Buzz membership lookup timed out".into()))?
+        .map_err(|_| AcpError::Protocol("Buzz membership lookup failed".into()))?;
+    let event_value = response
+        .as_array()
+        .and_then(|events| events.first())
+        .cloned()
+        .ok_or_else(|| AcpError::Protocol("Buzz membership snapshot is absent".into()))?;
+    let event: nostr::Event = serde_json::from_value(event_value)
+        .map_err(|_| AcpError::Protocol("Buzz membership snapshot is malformed".into()))?;
+    event
+        .verify()
+        .map_err(|_| AcpError::Protocol("Buzz membership signature is invalid".into()))?;
+
+    let channel_text = channel_id.to_string();
+    let has_channel = event.tags.iter().any(|tag| {
+        let values = tag.as_slice();
+        values.first().map(String::as_str) == Some("d")
+            && values.get(1).map(String::as_str) == Some(channel_text.as_str())
+    });
+    if !has_channel {
+        return Err(AcpError::Protocol(
+            "Buzz membership snapshot channel does not match".into(),
+        ));
+    }
+    let members = event
+        .tags
+        .iter()
+        .filter_map(|tag| {
+            let values = tag.as_slice();
+            if values.first().map(String::as_str) != Some("p") {
+                return None;
+            }
+            Some((values.get(1)?.clone(), values.get(3)?.clone()))
+        })
+        .collect::<Vec<_>>();
+    if members.is_empty() {
+        return Err(AcpError::Protocol(
+            "Buzz membership snapshot contains no members".into(),
+        ));
+    }
+    Ok(members)
+}
+
+async fn build_verified_buzz_prompt_params_for_batch(
+    batch: Option<&FlushBatch>,
+    session_id: &str,
+    prompt_blocks: &[&str],
+    ctx: &PromptContext,
+) -> Result<Option<serde_json::Value>, AcpError> {
+    let Some(batch) = batch else {
+        return Ok(None);
+    };
+    if ctx.harness_name != crate::config::GABE_CONTEXT_ENGINE_HARNESS {
+        return Ok(None);
+    }
+    let pinned_agent = require_managed_agent_pin(ctx.managed_agent_pubkey_pin.as_deref())?;
+    let actual_agent = ctx.agent_keys.public_key().to_hex().to_ascii_lowercase();
+    if pinned_agent != actual_agent {
+        return Err(AcpError::Protocol(
+            "managed Buzz agent identity does not match BUZZ_GABE_AGENT_PUBKEY".into(),
+        ));
+    }
+    if !batch.cancelled_events.is_empty() {
+        return Err(AcpError::Protocol(
+            "trusted Buzz P0 deliveries require queue mode".into(),
+        ));
+    }
+    let channel_info = ctx
+        .channel_info
+        .resolve(batch.channel_id)
+        .await
+        .ok_or_else(|| AcpError::Protocol("Buzz channel metadata is unavailable".into()))?;
+    let owner = ctx
+        .agent_owner_pubkey
+        .as_ref()
+        .ok_or_else(|| AcpError::Protocol("Buzz owner identity is unavailable".into()))?;
+    let members = fetch_verified_channel_members(batch.channel_id, &ctx.rest_client).await?;
+    let events = batch
+        .events
+        .iter()
+        .map(|batch_event| batch_event.event.clone())
+        .collect::<Vec<_>>();
+    crate::buzz_envelope::build_verified_buzz_prompt_params(
+        crate::buzz_envelope::VerifiedBuzzPromptInput {
+            session_id,
+            prompt_blocks,
+            channel_id: &batch.channel_id.to_string(),
+            channel_type: &channel_info.channel_type,
+            owner_pubkey: &owner.to_hex(),
+            agent_keys: &ctx.agent_keys,
+            members: &members,
+            events: &events,
+        },
+    )
+    .map(Some)
+    .map_err(|_| AcpError::Protocol("Buzz prompt envelope validation failed".into()))
+}
+
+fn require_managed_agent_pin(configured: Option<&str>) -> Result<String, AcpError> {
+    let normalized = configured
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(str::to_ascii_lowercase)
+        .ok_or_else(|| {
+            AcpError::Protocol(
+                "BUZZ_GABE_AGENT_PUBKEY is required for trusted Buzz deliveries".into(),
+            )
+        })?;
+    nostr::PublicKey::from_hex(&normalized).map_err(|_| {
+        AcpError::Protocol("BUZZ_GABE_AGENT_PUBKEY is malformed for trusted Buzz deliveries".into())
+    })?;
+    Ok(normalized)
+}
+
+async fn send_prompt_with_optional_buzz_envelope(
+    acp: &mut AcpClient,
+    session_id: &str,
+    prompt_blocks: &[&str],
+    verified_params: Option<&serde_json::Value>,
+    idle_timeout: Duration,
+    max_duration: Duration,
+) -> Result<StopReason, AcpError> {
+    match verified_params {
+        Some(params) => {
+            acp.session_prompt_params_with_idle_timeout(
+                session_id,
+                params.clone(),
+                idle_timeout,
+                max_duration,
+            )
+            .await
+        }
+        None => {
+            acp.session_prompt_blocks_with_idle_timeout(
+                session_id,
+                prompt_blocks,
+                idle_timeout,
+                max_duration,
+            )
+            .await
+        }
+    }
+}
+
 /// Fetch the latest canvas event for `channel_id` and return a rendered
 /// `[Channel Canvas]` metadata section, or `None` if absent/blank/error.
 ///
@@ -7492,6 +7691,7 @@ printf '%s\n' '{{"jsonrpc":"2.0","id":0,"result":{{"stopReason":"end_turn"}}}}'"
             agent_owner_pubkey: owner_pubkey,
             memory_enabled: false,
             harness_name: "goose".to_string(),
+            managed_agent_pubkey_pin: None,
             relay_url: "ws://127.0.0.1:3000".to_string(),
         }
     }
@@ -7854,9 +8054,190 @@ printf '%s\n' '{{"jsonrpc":"2.0","id":0,"result":{{"stopReason":"end_turn"}}}}'"
     }
 
     fn channel_metadata_response(id: Uuid, tags: &[[&str; 2]]) -> serde_json::Value {
-        let mut event_tags = vec![json!(["d", id.to_string()])];
-        event_tags.extend(tags.iter().map(|[k, v]| json!([k, v])));
-        json!([{ "tags": event_tags }])
+        let id_text = id.to_string();
+        let mut event_tags =
+            vec![nostr::Tag::parse(["d", id_text.as_str()]).expect("metadata d tag")];
+        event_tags.extend(
+            tags.iter().map(|[key, value]| {
+                nostr::Tag::parse([*key, *value]).expect("metadata fixture tag")
+            }),
+        );
+        let event = nostr::EventBuilder::new(
+            nostr::Kind::Custom(buzz_core::kind::KIND_NIP29_GROUP_METADATA as u16),
+            "",
+        )
+        .tags(event_tags)
+        .sign_with_keys(&nostr::Keys::generate())
+        .expect("signed metadata fixture");
+        serde_json::to_value(vec![event]).expect("metadata response")
+    }
+
+    #[test]
+    fn trusted_buzz_delivery_requires_managed_agent_pin() {
+        let error = require_managed_agent_pin(None).expect_err("missing pin must fail closed");
+        assert!(matches!(
+            error,
+            AcpError::Protocol(message)
+                if message == "BUZZ_GABE_AGENT_PUBKEY is required for trusted Buzz deliveries"
+        ));
+        let malformed = require_managed_agent_pin(Some("not-a-pubkey"))
+            .expect_err("malformed pin must fail closed");
+        assert!(matches!(
+            malformed,
+            AcpError::Protocol(message)
+                if message == "BUZZ_GABE_AGENT_PUBKEY is malformed for trusted Buzz deliveries"
+        ));
+        let valid = Keys::generate().public_key().to_hex();
+        assert_eq!(
+            require_managed_agent_pin(Some(&format!(" {} ", valid.to_ascii_uppercase())))
+                .expect("configured pin"),
+            valid,
+        );
+    }
+
+    #[tokio::test]
+    async fn gabe_pin_failures_emit_no_session_prompt_while_legacy_remains_compatible() {
+        struct Case {
+            name: &'static str,
+            harness: &'static str,
+            pin: Option<String>,
+            expected_prompt_count: usize,
+            expected_error: Option<&'static str>,
+        }
+
+        let channel_id = Uuid::new_v4();
+        let channel_text = channel_id.to_string();
+        let owner = Keys::generate();
+        let managed_agent = Keys::generate();
+        let mismatched_agent = Keys::generate().public_key().to_hex();
+        let cases = [
+            Case {
+                name: "ordinary legacy ACP",
+                harness: "goose",
+                pin: None,
+                expected_prompt_count: 1,
+                expected_error: None,
+            },
+            Case {
+                name: "Gabe missing pin",
+                harness: crate::config::GABE_CONTEXT_ENGINE_HARNESS,
+                pin: None,
+                expected_prompt_count: 0,
+                expected_error: Some("BUZZ_GABE_AGENT_PUBKEY is required"),
+            },
+            Case {
+                name: "Gabe malformed pin",
+                harness: crate::config::GABE_CONTEXT_ENGINE_HARNESS,
+                pin: Some("not-a-pubkey".to_string()),
+                expected_prompt_count: 0,
+                expected_error: Some("BUZZ_GABE_AGENT_PUBKEY is malformed"),
+            },
+            Case {
+                name: "Gabe mismatched pin",
+                harness: crate::config::GABE_CONTEXT_ENGINE_HARNESS,
+                pin: Some(mismatched_agent),
+                expected_prompt_count: 0,
+                expected_error: Some("managed Buzz agent identity does not match"),
+            },
+        ];
+
+        for case in cases {
+            let capture = std::env::temp_dir().join(format!(
+                "buzz-acp-gabe-pin-policy-{}.ndjson",
+                Uuid::new_v4()
+            ));
+            let quoted_capture = capture.to_string_lossy().replace('\'', "'\\''");
+            let script = format!(
+                r#"while IFS= read -r line; do
+  printf '%s\n' "$line" >> '{quoted_capture}'
+  printf '%s\n' '{{"jsonrpc":"2.0","id":0,"result":{{"stopReason":"end_turn"}}}}'
+done"#
+            );
+            let acp = AcpClient::spawn("bash", &["-c".to_string(), script], &[], false)
+                .await
+                .expect("spawn pin-policy capture ACP");
+            let mut agent = OwnedAgent {
+                index: 0,
+                acp,
+                state: SessionState::default(),
+                model_capabilities: None,
+                desired_model: None,
+                model_overridden: false,
+                agent_name: "pin-policy-test-agent".into(),
+                goose_system_prompt_supported: None,
+                protocol_version: 1,
+            };
+            agent
+                .state
+                .sessions
+                .insert(channel_id, "live-session".into());
+            agent
+                .state
+                .deliveries
+                .insert(channel_id, ChannelDeliveryState::default());
+
+            let event = EventBuilder::new(Kind::Custom(9), "pin policy prompt")
+                .tags([Tag::parse(["h", channel_text.as_str()]).expect("channel tag")])
+                .sign_with_keys(&owner)
+                .expect("signed owner event");
+            let batch = FlushBatch {
+                channel_id,
+                events: vec![crate::queue::BatchEvent {
+                    event,
+                    prompt_tag: "test".into(),
+                    received_at: std::time::Instant::now(),
+                }],
+                cancelled_events: Vec::new(),
+                cancel_reason: None,
+            };
+            let mut ctx = make_prompt_context_with_owner(&managed_agent, owner.public_key());
+            ctx.harness_name = case.harness.to_string();
+            ctx.managed_agent_pubkey_pin = case.pin;
+            let (result_tx, mut result_rx) = mpsc::unbounded_channel();
+            run_prompt_task(
+                agent,
+                Some(batch),
+                None,
+                Arc::new(ctx),
+                result_tx,
+                None,
+                format!("pin-policy-{}", case.name),
+            )
+            .await;
+            let mut result = result_rx.recv().await.expect("pin-policy result");
+            match case.expected_error {
+                None => assert!(
+                    matches!(result.outcome, PromptOutcome::Ok(StopReason::EndTurn)),
+                    "{} must keep the legacy prompt path",
+                    case.name,
+                ),
+                Some(expected) => assert!(
+                    matches!(
+                        &result.outcome,
+                        PromptOutcome::Error(AcpError::Protocol(message))
+                            if message.contains(expected)
+                    ),
+                    "{} must fail before ACP prompt emission",
+                    case.name,
+                ),
+            }
+            result.agent.acp.shutdown().await;
+
+            let requests = std::fs::read_to_string(&capture).unwrap_or_default();
+            if capture.exists() {
+                std::fs::remove_file(&capture).expect("remove pin-policy capture");
+            }
+            let prompt_count = requests
+                .lines()
+                .filter_map(|line| serde_json::from_str::<serde_json::Value>(line).ok())
+                .filter(|request| request["method"] == "session/prompt")
+                .count();
+            assert_eq!(
+                prompt_count, case.expected_prompt_count,
+                "{} emitted an unexpected ACP prompt count",
+                case.name,
+            );
+        }
     }
 
     /// A normal channel yields a non-DM (canvas allowed) and its name for the
diff --git a/crates/buzz-acp/tests/acp_wire_redaction.rs b/crates/buzz-acp/tests/acp_wire_redaction.rs
new file mode 100644
index 00000000000..274b58a2d9d
--- /dev/null
+++ b/crates/buzz-acp/tests/acp_wire_redaction.rs
@@ -0,0 +1,70 @@
+const CONTENT_CANARY: &str = "BUZZ_TRACE_CONTENT_CANARY_7f4d21";
+const THOUGHT_CANARY: &str = "BUZZ_TRACE_THOUGHT_CANARY_67ab09";
+const TOOL_CANARY: &str = "BUZZ_TRACE_TOOL_OUTPUT_CANARY_5cc820";
+const PRIVATE_KEY_CANARY: &str = "BUZZ_TRACE_PRIVATE_KEY_CANARY_b5500a";
+const AUTH_TAG_CANARY: &str = "BUZZ_TRACE_AUTH_TAG_CANARY_e06fac";
+const BEARER_CANARY: &str = "BUZZ_TRACE_BEARER_CANARY_d38891";
+const CAPABILITY_CANARY: &str = "BUZZ_TRACE_CAPABILITY_CANARY_c1a70e";
+const SYSTEM_PROMPT_CANARY: &str = "BUZZ_TRACE_SYSTEM_PROMPT_CANARY_239dbc";
+const MCP_ENV_CANARY: &str = "BUZZ_TRACE_MCP_ENV_CANARY_3e7771";
+const TITLE_CANARY: &str = "BUZZ_TRACE_TITLE_CANARY_08ab51";
+const KIND_CANARY: &str = "BUZZ_TRACE_KIND_CANARY_903fd2";
+const TOOL_ID_CANARY: &str = "BUZZ_TRACE_TOOL_ID_CANARY_921ced";
+const STATUS_CANARY: &str = "BUZZ_TRACE_STATUS_CANARY_4955aa";
+const COMMAND_CANARY: &str = "BUZZ_TRACE_COMMAND_CANARY_dbe712";
+const RUN_ID_CANARY: &str = "BUZZ_TRACE_RUN_ID_CANARY_8f342c";
+const UPDATE_TYPE_CANARY: &str = "BUZZ_TRACE_UPDATE_TYPE_CANARY_ca2851";
+const CHILD_STDOUT_CANARY: &str = "BUZZ_TRACE_CHILD_STDOUT_CANARY_c8bc95";
+const CHILD_STDERR_CANARY: &str = "BUZZ_TRACE_CHILD_STDERR_CANARY_3d73be";
+
+#[tokio::test]
+async fn trace_logs_never_expose_content_or_credentials() {
+    let canaries = [
+        ("content", CONTENT_CANARY),
+        ("thought", THOUGHT_CANARY),
+        ("tool_output", TOOL_CANARY),
+        ("private_key", PRIVATE_KEY_CANARY),
+        ("auth_tag", AUTH_TAG_CANARY),
+        ("bearer", BEARER_CANARY),
+        ("adapter_capability", CAPABILITY_CANARY),
+        ("hostile_system_prompt", SYSTEM_PROMPT_CANARY),
+        ("mcp_env", MCP_ENV_CANARY),
+        ("title", TITLE_CANARY),
+        ("kind", KIND_CANARY),
+        ("tool_id", TOOL_ID_CANARY),
+        ("status", STATUS_CANARY),
+        ("command", COMMAND_CANARY),
+        ("run_id", RUN_ID_CANARY),
+        ("update_type", UPDATE_TYPE_CANARY),
+        ("child_stdout", CHILD_STDOUT_CANARY),
+        ("child_stderr", CHILD_STDERR_CANARY),
+    ];
+
+    let captured = buzz_acp::run_trace_redaction_probe_for_test(&canaries)
+        .await
+        .expect("real-process ACP trace probe");
+
+    assert!(captured.status_success, "the ACP canary turn must complete");
+    for marker in [
+        "title_hash",
+        "kind_hash",
+        "tool_id_hash",
+        "status_hash",
+        "command_count",
+        "run_id_hash",
+        "update_type_hash",
+        "agent child stderr line",
+    ] {
+        assert!(
+            captured.stderr.contains(marker),
+            "real-process capture did not exercise redacted marker {marker}: {}",
+            captured.stderr,
+        );
+    }
+    for (class, canary) in canaries {
+        assert!(
+            !captured.stdout.contains(canary) && !captured.stderr.contains(canary),
+            "RUST_LOG=trace leaked {class} canary",
+        );
+    }
+}
diff --git a/crates/buzz-acp/tests/buzz_prompt_envelope.rs b/crates/buzz-acp/tests/buzz_prompt_envelope.rs
new file mode 100644
index 00000000000..de7608897db
--- /dev/null
+++ b/crates/buzz-acp/tests/buzz_prompt_envelope.rs
@@ -0,0 +1,298 @@
+use std::str::FromStr;
+
+use nostr::secp256k1::schnorr::Signature;
+use nostr::secp256k1::Message;
+use nostr::{Event, JsonUtil, Keys, PublicKey, SECP256K1};
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
+
+const DOMAIN: &[u8] = b"buzz-acp-envelope-v1\0";
+
+fn canonical_json(value: &Value) -> String {
+    match value {
+        Value::Null => "null".to_string(),
+        Value::Bool(value) => value.to_string(),
+        Value::Number(value) => {
+            assert!(value.is_i64() || value.is_u64(), "floats are not wire-safe");
+            value.to_string()
+        }
+        Value::String(value) => serde_json::to_string(value).expect("canonical string"),
+        Value::Array(values) => format!(
+            "[{}]",
+            values
+                .iter()
+                .map(canonical_json)
+                .collect::<Vec<_>>()
+                .join(",")
+        ),
+        Value::Object(values) => {
+            let mut keys: Vec<&String> = values.keys().collect();
+            keys.sort_by(|left, right| left.encode_utf16().cmp(right.encode_utf16()));
+            format!(
+                "{{{}}}",
+                keys.into_iter()
+                    .map(|key| format!(
+                        "{}:{}",
+                        serde_json::to_string(key).expect("canonical key"),
+                        canonical_json(&values[key]),
+                    ))
+                    .collect::<Vec<_>>()
+                    .join(",")
+            )
+        }
+    }
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+fn membership_revision(channel_id: &Value, members: &Value) -> String {
+    let payload = json!({
+        "version": 1,
+        "channelId": channel_id,
+        "members": members,
+    });
+    format!("v1:{}", sha256_hex(canonical_json(&payload).as_bytes()))
+}
+
+fn delivery_id(envelope: &Value) -> String {
+    let event_ids: Vec<Value> = envelope["events"]
+        .as_array()
+        .expect("events")
+        .iter()
+        .map(|event| event["id"].clone())
+        .collect();
+    let payload = json!({
+        "version": envelope["version"],
+        "channel": envelope["channel"],
+        "reply": envelope["reply"],
+        "eventIds": event_ids,
+    });
+    sha256_hex(canonical_json(&payload).as_bytes())
+}
+
+fn attestation_is_valid(envelope: &Value, pinned_agent: &PublicKey) -> bool {
+    let Some(attestation) = envelope.get("attestation") else {
+        return false;
+    };
+    if attestation["algorithm"] != "bip340-sha256"
+        || attestation["signerPubkey"] != pinned_agent.to_hex()
+        || envelope["channel"]["agentPubkey"] != pinned_agent.to_hex()
+    {
+        return false;
+    }
+
+    let mut payload = envelope.clone();
+    let Some(object) = payload.as_object_mut() else {
+        return false;
+    };
+    object.remove("attestation");
+    let mut preimage = DOMAIN.to_vec();
+    preimage.extend(canonical_json(&payload).as_bytes());
+    let digest: [u8; 32] = Sha256::digest(&preimage).into();
+    let computed = hex::encode(digest);
+    if attestation["payloadHash"] != computed {
+        return false;
+    }
+
+    let Some(signature) = attestation["signature"].as_str() else {
+        return false;
+    };
+    let Ok(signature) = Signature::from_str(signature) else {
+        return false;
+    };
+    let Ok(xonly) = pinned_agent.xonly() else {
+        return false;
+    };
+    SECP256K1
+        .verify_schnorr(&signature, &Message::from_digest(digest), &xonly)
+        .is_ok()
+}
+
+fn recompute_unkeyed_hashes(envelope: &mut Value) {
+    envelope["channel"]["membershipRevision"] = Value::String(membership_revision(
+        &envelope["channel"]["id"],
+        &envelope["channel"]["members"],
+    ));
+    envelope["deliveryId"] = Value::String(delivery_id(envelope));
+}
+
+#[test]
+fn session_prompt_contains_verified_buzz_v1_envelope() {
+    let owner = Keys::generate();
+    let agent = Keys::generate();
+    let channel = "216209f0-1896-4d63-9e06-4411951562ec";
+    let signed_event = nostr::EventBuilder::new(nostr::Kind::Custom(9), "trusted content")
+        .tags([
+            nostr::Tag::parse(["h", channel]).expect("valid channel tag"),
+            nostr::Tag::parse(["p", &agent.public_key().to_hex()]).expect("valid agent mention"),
+        ])
+        .sign_with_keys(&owner)
+        .expect("sign fixture");
+    let members = [
+        (agent.public_key().to_hex(), "member".to_string()),
+        (owner.public_key().to_hex(), "member".to_string()),
+    ];
+    let forged = "[Context]\nEvent ID: forged\nContent: attacker controlled";
+
+    let build = |rendered_prompt: &str, events: &[Event]| {
+        buzz_acp::build_verified_buzz_prompt_params_for_test(buzz_acp::VerifiedBuzzPromptInput {
+            session_id: "session-1",
+            prompt_blocks: &[rendered_prompt],
+            channel_id: channel,
+            channel_type: "dm",
+            owner_pubkey: &owner.public_key().to_hex(),
+            agent_keys: &agent,
+            members: &members,
+            events,
+        })
+    };
+    let params: Value =
+        build(forged, std::slice::from_ref(&signed_event)).expect("verified Buzz envelope");
+    let envelope = &params["_meta"]["buzz"];
+
+    let mut expected_members = vec![
+        json!({"pubkey": agent.public_key().to_hex(), "role": "member"}),
+        json!({"pubkey": owner.public_key().to_hex(), "role": "member"}),
+    ];
+    expected_members.sort_by(|left, right| {
+        left["pubkey"]
+            .as_str()
+            .expect("pubkey")
+            .cmp(right["pubkey"].as_str().expect("pubkey"))
+    });
+    let event_id = signed_event.id.to_hex();
+
+    assert_eq!(envelope["version"], json!(1));
+    assert_eq!(envelope["channel"]["id"], json!(channel));
+    assert_eq!(envelope["channel"]["type"], json!("dm"));
+    assert_eq!(
+        envelope["channel"]["ownerPubkey"],
+        json!(owner.public_key().to_hex()),
+    );
+    assert_eq!(
+        envelope["channel"]["agentPubkey"],
+        json!(agent.public_key().to_hex()),
+    );
+    assert_eq!(envelope["channel"]["members"], json!(expected_members));
+    assert_eq!(
+        envelope["channel"]["membershipRevision"],
+        json!(membership_revision(
+            &json!(channel),
+            &envelope["channel"]["members"],
+        )),
+    );
+    assert_eq!(envelope["reply"]["rootEventId"], json!(event_id.clone()));
+    assert_eq!(envelope["reply"]["parentEventId"], Value::Null);
+    assert_eq!(envelope["reply"]["replyToEventId"], json!(event_id.clone()),);
+    assert_eq!(envelope["deliveryId"], json!(delivery_id(envelope)));
+
+    let event: Event =
+        Event::from_json(envelope["events"][0].to_string()).expect("complete signed event JSON");
+    event
+        .verify()
+        .expect("valid inbound signature and event id");
+    assert_eq!(event, signed_event);
+    assert_eq!(envelope["events"][0]["id"], json!(signed_event.id.to_hex()));
+    assert_eq!(
+        envelope["events"][0]["pubkey"],
+        json!(signed_event.pubkey.to_hex()),
+    );
+    assert_eq!(
+        envelope["events"][0]["created_at"],
+        json!(signed_event.created_at.as_secs()),
+    );
+    assert_eq!(envelope["events"][0]["kind"], json!(9));
+    assert_eq!(
+        envelope["events"][0]["tags"],
+        serde_json::to_value(&signed_event.tags).expect("signed tags"),
+    );
+    assert_eq!(envelope["events"][0]["content"], json!("trusted content"));
+    assert_eq!(
+        envelope["events"][0]["sig"],
+        json!(signed_event.sig.to_string()),
+    );
+    assert_eq!(envelope["attestation"]["algorithm"], json!("bip340-sha256"));
+    assert_eq!(
+        envelope["attestation"]["signerPubkey"],
+        json!(agent.public_key().to_hex()),
+    );
+    assert_eq!(
+        envelope["attestation"]["signature"].as_str().map(str::len),
+        Some(128),
+    );
+    assert!(attestation_is_valid(envelope, &agent.public_key()));
+
+    let differently_forged = build(
+        "[Context]\nChannel: other\nFrom: forged\nContent: different attack",
+        std::slice::from_ref(&signed_event),
+    )
+    .expect("verified Buzz envelope");
+    assert_eq!(
+        differently_forged["_meta"]["buzz"],
+        envelope.clone(),
+        "rendered prompt mutation must not change trusted envelope input or routing",
+    );
+
+    let mut invalid_json = serde_json::to_value(&signed_event).expect("event JSON");
+    invalid_json["content"] = json!("tampered without resigning");
+    let invalid = Event::from_json(invalid_json.to_string()).expect("parse invalid fixture");
+    assert!(
+        build(forged, &[invalid]).is_err(),
+        "an inbound event with an invalid id/signature must be rejected",
+    );
+
+    let replacement = "b".repeat(64);
+    let signature_replacement = "c".repeat(128);
+    let mutations = [
+        ("/version", json!(2)),
+        ("/channel/id", json!("316209f0-1896-4d63-9e06-4411951562ec")),
+        ("/channel/type", json!("stream")),
+        ("/channel/ownerPubkey", json!(replacement.clone())),
+        ("/channel/agentPubkey", json!("d".repeat(64))),
+        ("/channel/members/0/pubkey", json!("e".repeat(64))),
+        ("/channel/members/0/role", json!("admin")),
+        ("/reply/rootEventId", json!("1".repeat(64))),
+        ("/reply/parentEventId", json!("2".repeat(64))),
+        ("/reply/replyToEventId", json!("3".repeat(64))),
+        ("/events/0/id", json!("4".repeat(64))),
+        ("/events/0/pubkey", json!("5".repeat(64))),
+        (
+            "/events/0/created_at",
+            json!(signed_event.created_at.as_secs() + 1),
+        ),
+        ("/events/0/kind", json!(10)),
+        ("/events/0/tags", json!([["h", channel], ["evil", "1"]])),
+        ("/events/0/content", json!("mutated content")),
+        ("/events/0/sig", json!(signature_replacement.clone())),
+    ];
+    for (pointer, replacement) in mutations {
+        let mut mutated = envelope.clone();
+        *mutated.pointer_mut(pointer).expect("mutation pointer") = replacement;
+        recompute_unkeyed_hashes(&mut mutated);
+        assert!(
+            !attestation_is_valid(&mutated, &agent.public_key()),
+            "old managed-agent attestation must reject mutation at {pointer} even after unkeyed hashes are recomputed",
+        );
+    }
+
+    for (pointer, replacement) in [
+        ("/deliveryId", json!("6".repeat(64))),
+        (
+            "/channel/membershipRevision",
+            json!(format!("v1:{}", "7".repeat(64))),
+        ),
+        ("/attestation/algorithm", json!("plain-sha256")),
+        ("/attestation/signerPubkey", json!("8".repeat(64))),
+        ("/attestation/payloadHash", json!("9".repeat(64))),
+        ("/attestation/signature", json!("a".repeat(128))),
+    ] {
+        let mut mutated = envelope.clone();
+        *mutated.pointer_mut(pointer).expect("mutation pointer") = replacement;
+        assert!(
+            !attestation_is_valid(&mutated, &agent.public_key()),
+            "attestation verification must reject direct mutation at {pointer}",
+        );
+    }
+}
diff --git a/crates/buzz-cli/src/client.rs b/crates/buzz-cli/src/client.rs
index ee8868ad927..1800e86c117 100644
--- a/crates/buzz-cli/src/client.rs
+++ b/crates/buzz-cli/src/client.rs
@@ -580,6 +580,13 @@ impl BuzzClient {
             .and_then(|slice| slice.get(1).cloned())
     }
 
+    /// SHA-256 fingerprint of the canonical verified NIP-OA auth tag.
+    pub fn auth_tag_hash(&self) -> Option<String> {
+        self.auth_tag_json
+            .as_ref()
+            .map(|value| hex::encode(Sha256::digest(value.as_bytes())))
+    }
+
     /// Sign an event builder, injecting the NIP-OA auth tag if configured.
     ///
     /// All event creation should go through this method to ensure consistent
@@ -1022,11 +1029,31 @@ impl BuzzClient {
     /// Content-addressed uploads are exempt: same bytes ⇒ same hash, so outer
     /// re-run is safe regardless of the failure kind.
     async fn submit_stored_event(&self, event: nostr::Event) -> Result<String, CliError> {
-        let url = format!("{}/events", self.relay_url);
         let body = bytes::Bytes::from(
             serde_json::to_vec(&event)
                 .map_err(|e| CliError::Other(format!("event serialization failed: {e}")))?,
         );
+        self.submit_stored_event_body(body, event.kind.as_u16())
+            .await
+    }
+
+    /// Submit the exact pre-signed event bytes persisted by `messages prepare`.
+    /// No event field is reconstructed and no Nostr signature is regenerated.
+    pub async fn submit_prepared_event_bytes(
+        &self,
+        body: Vec<u8>,
+        kind: u16,
+    ) -> Result<String, CliError> {
+        self.submit_stored_event_body(bytes::Bytes::from(body), kind)
+            .await
+    }
+
+    async fn submit_stored_event_body(
+        &self,
+        body: bytes::Bytes,
+        kind: u16,
+    ) -> Result<String, CliError> {
+        let url = format!("{}/events", self.relay_url);
         let result = self
             .with_retry_body(|| {
                 let body = body.clone();
@@ -1056,9 +1083,8 @@ impl BuzzClient {
         // Canonical pre-ingest 429 (Relay{429}) stays retryable — definitively not stored.
         if let Err(ref e) = result {
             if is_stored_event_exhaustion_ambiguous(e) {
-                let kind_u16 = event.kind.as_u16();
                 return Err(CliError::DeliveryUnknown(format!(
-                    "stored event (kind {kind_u16}) outcome unknown after all attempts: {e}"
+                    "stored event (kind {kind}) outcome unknown after all attempts: {e}"
                 )));
             }
         }
diff --git a/crates/buzz-cli/src/commands/messages.rs b/crates/buzz-cli/src/commands/messages.rs
index 40a9ae80b56..0070c9d0b37 100644
--- a/crates/buzz-cli/src/commands/messages.rs
+++ b/crates/buzz-cli/src/commands/messages.rs
@@ -872,6 +872,9 @@ pub async fn dispatch(
 ) -> Result<(), CliError> {
     use crate::MessagesCmd;
     match cmd {
+        MessagesCmd::Prepare { .. } | MessagesCmd::PublishPrepared { .. } => {
+            unreachable!("prepared commands are dispatched by the top-level IO-safe path")
+        }
         MessagesCmd::Send {
             channel,
             content,
diff --git a/crates/buzz-cli/src/lib.rs b/crates/buzz-cli/src/lib.rs
index 3893c5b6425..f5327776ffa 100644
--- a/crates/buzz-cli/src/lib.rs
+++ b/crates/buzz-cli/src/lib.rs
@@ -3,6 +3,7 @@ mod client;
 mod commands;
 mod error;
 mod links;
+mod prepared_event;
 mod validate;
 
 use clap::{Parser, Subcommand};
@@ -51,6 +52,21 @@ where
             }
         }
     };
+    if prepared_command(&cli).is_some() {
+        let mut input = Vec::new();
+        if let Err(error) = std::io::Read::read_to_end(&mut std::io::stdin(), &mut input) {
+            error::print_error(&CliError::Other(format!("failed to read stdin: {error}")));
+            return 4;
+        }
+        let output = execute_prepared_cli(&cli, &input).await;
+        if let Some(value) = output.stdout {
+            println!("{value}");
+        }
+        if let Some(value) = output.stderr {
+            eprintln!("{value}");
+        }
+        return output.exit_code;
+    }
     match run(cli).await {
         Ok(()) => 0,
         Err(e) => {
@@ -60,6 +76,53 @@ where
     }
 }
 
+/// Run a prepared-event CLI command with explicit byte streams.
+///
+/// This keeps private reply content off argv and gives adapter recovery code a
+/// deterministic JSON-only interface without replacing process-global stdio.
+pub async fn run_from_args_with_io<I, S, O, E>(
+    args: I,
+    input: &[u8],
+    stdout: &mut O,
+    stderr: &mut E,
+) -> i32
+where
+    I: IntoIterator<Item = S>,
+    S: Into<std::ffi::OsString> + Clone,
+    O: std::io::Write,
+    E: std::io::Write,
+{
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let cli = match Cli::try_parse_from(args) {
+        Ok(cli) => cli,
+        Err(error) => {
+            let target: &mut dyn std::io::Write = if error.use_stderr() { stderr } else { stdout };
+            let _ = writeln!(target, "{}", error.render());
+            return if error.use_stderr() { 1 } else { 0 };
+        }
+    };
+    if prepared_command(&cli).is_none() {
+        let _ = writeln!(
+            stderr,
+            "{}",
+            serde_json::json!({
+                "error": "user_error",
+                "retryable": false,
+                "message": "explicit IO is supported only for messages prepare and publish-prepared"
+            })
+        );
+        return 1;
+    }
+    let output = execute_prepared_cli(&cli, input).await;
+    if let Some(value) = output.stdout {
+        let _ = writeln!(stdout, "{value}");
+    }
+    if let Some(value) = output.stderr {
+        let _ = writeln!(stderr, "{value}");
+    }
+    output.exit_code
+}
+
 #[derive(Parser)]
 #[command(
     name = "buzz",
@@ -369,6 +432,36 @@ buzz agents archived"
 
 #[derive(Subcommand)]
 pub enum MessagesCmd {
+    /// Prepare and fsync one fully signed message without publishing it
+    Prepare {
+        /// Channel UUID for the owner DM
+        #[arg(long)]
+        channel: String,
+        /// Must be '-' so private reply text is read from stdin
+        #[arg(long)]
+        content: String,
+        /// Immediate parent event ID
+        #[arg(long)]
+        reply_to: Option<String>,
+        /// Authoritative thread root event ID
+        #[arg(long)]
+        thread_root: Option<String>,
+        /// Durable Context Engine execution ID (64 hexadecimal characters)
+        #[arg(long)]
+        execution_id: String,
+        /// Explicit mentioned pubkey; repeatable
+        #[arg(long = "mention")]
+        mentions: Vec<String>,
+        /// Absolute no-clobber path for the prepared record
+        #[arg(long)]
+        out: std::path::PathBuf,
+    },
+    /// Publish or replay a previously prepared exact signed event
+    PublishPrepared {
+        /// Absolute path to the prepared record
+        #[arg(long)]
+        file: std::path::PathBuf,
+    },
     /// Send a message to a channel
     #[command(
         after_help = "Examples:\n  buzz messages send --channel <UUID> --content \"hello\"\n  buzz messages send --channel <UUID> --content \"@alice check this\"\n  echo \"hello from stdin\" | buzz messages send --channel <UUID> --content -"
@@ -1948,56 +2041,104 @@ fn normalize_auth_tag_input(input: &str) -> String {
     trimmed.to_owned()
 }
 
-async fn run(cli: Cli) -> Result<(), CliError> {
-    let relay_url = client::normalize_relay_url(&cli.relay);
-
-    // Pack commands are local-only — no relay connection needed.
-    if let Cmd::Pack(ref sub) = cli.command {
-        return match sub {
-            PackCmd::Validate { path } => commands::pack::cmd_validate(path),
-            PackCmd::Inspect { path } => commands::pack::cmd_inspect(path),
-        };
-    }
-
-    // Auth: private key is required for all relay operations.
-    // The keypair IS the identity — no tokens, no other auth.
-    let private_key_str = cli.private_key.ok_or_else(|| {
+fn build_client(cli: &Cli, relay_url: String) -> Result<BuzzClient, CliError> {
+    let private_key_str = cli.private_key.as_ref().ok_or_else(|| {
         CliError::Auth("BUZZ_PRIVATE_KEY is required (use --private-key or set env var)".into())
     })?;
-    let keys = Keys::parse(&private_key_str)
-        .map_err(|e| CliError::Key(format!("invalid BUZZ_PRIVATE_KEY: {e}")))?;
-
-    // NIP-OA: parse and verify the auth tag if provided.
-    //
-    // `BUZZ_AUTH_TAG` is hand-authored configuration, so the unquoted raw
-    // shorthand `[auth,hex,,hex]` is normalized to JSON here — at this input
-    // edge only. The SDK grammar and the `x-auth-tag` wire format stay strict
-    // JSON; all validation and signature verification happen on the strict
-    // path below, unchanged.
-    let (auth_tag, auth_tag_json) = match cli.auth_tag {
-        Some(ref input) if !input.is_empty() => {
+    let keys = Keys::parse(private_key_str)
+        .map_err(|error| CliError::Key(format!("invalid BUZZ_PRIVATE_KEY: {error}")))?;
+    let (auth_tag, auth_tag_json) = match cli.auth_tag.as_deref() {
+        Some(input) if !input.is_empty() => {
             let json = normalize_auth_tag_input(input);
             let tag = buzz_sdk::nip_oa::parse_auth_tag(&json)
-                .map_err(|e| CliError::Auth(format!("BUZZ_AUTH_TAG is malformed: {e}")))?;
-            buzz_sdk::nip_oa::verify_auth_tag(&json, &keys.public_key()).map_err(|e| {
+                .map_err(|error| CliError::Auth(format!("BUZZ_AUTH_TAG is malformed: {error}")))?;
+            buzz_sdk::nip_oa::verify_auth_tag(&json, &keys.public_key()).map_err(|error| {
                 CliError::Auth(format!(
-                    "BUZZ_AUTH_TAG verification failed for pubkey {}: {e}",
+                    "BUZZ_AUTH_TAG verification failed for pubkey {}: {error}",
                     keys.public_key().to_hex()
                 ))
             })?;
-            // Canonical wire form derives from the parsed-and-verified tag
-            // (same shape as buzz-acp's RestClient), never from raw input.
-            let canonical = serde_json::to_string(tag.as_slice())
-                .map_err(|e| CliError::Auth(format!("BUZZ_AUTH_TAG serialization failed: {e}")))?;
+            let canonical = serde_json::to_string(tag.as_slice()).map_err(|error| {
+                CliError::Auth(format!("BUZZ_AUTH_TAG serialization failed: {error}"))
+            })?;
             (Some(tag), Some(canonical))
         }
         _ => (None, None),
     };
+    BuzzClient::new(relay_url, keys, auth_tag, auth_tag_json)
+}
+
+fn prepared_command(cli: &Cli) -> Option<prepared_event::PreparedCommand<'_>> {
+    match &cli.command {
+        Cmd::Messages(MessagesCmd::Prepare {
+            channel,
+            content,
+            reply_to,
+            thread_root,
+            execution_id,
+            mentions,
+            out,
+        }) => Some(prepared_event::PreparedCommand::Prepare {
+            channel,
+            content_flag: content,
+            reply_to: reply_to.as_deref(),
+            thread_root: thread_root.as_deref(),
+            execution_id,
+            mentions,
+            out,
+        }),
+        Cmd::Messages(MessagesCmd::PublishPrepared { file }) => {
+            Some(prepared_event::PreparedCommand::Publish { file })
+        }
+        _ => None,
+    }
+}
+
+async fn execute_prepared_cli(cli: &Cli, input: &[u8]) -> prepared_event::PreparedCommandOutput {
+    let Some(command) = prepared_command(cli) else {
+        return prepared_event::PreparedCommandOutput {
+            exit_code: 1,
+            stdout: None,
+            stderr: Some(serde_json::json!({
+                "error": "user_error",
+                "retryable": false,
+                "message": "not a prepared-event command"
+            })),
+        };
+    };
+    let relay_url = client::normalize_relay_url(&cli.relay);
+    match build_client(cli, relay_url) {
+        Ok(client) => prepared_event::execute(&client, command, input).await,
+        Err(error) => prepared_event::PreparedCommandOutput {
+            exit_code: error::exit_code(&error),
+            stdout: None,
+            stderr: Some(serde_json::json!({
+                "error": "auth_error",
+                "retryable": false,
+                "message": error.to_string(),
+            })),
+        },
+    }
+}
 
-    let client = BuzzClient::new(relay_url, keys, auth_tag, auth_tag_json)?;
+async fn run(cli: Cli) -> Result<(), CliError> {
+    let relay_url = client::normalize_relay_url(&cli.relay);
+
+    // Pack commands are local-only — no relay connection needed.
+    if let Cmd::Pack(ref sub) = cli.command {
+        return match sub {
+            PackCmd::Validate { path } => commands::pack::cmd_validate(path),
+            PackCmd::Inspect { path } => commands::pack::cmd_inspect(path),
+        };
+    }
+
+    let client = build_client(&cli, relay_url)?;
 
     match cli.command {
         Cmd::Agents(sub) => commands::agents::dispatch(sub, &client).await,
+        Cmd::Messages(MessagesCmd::Prepare { .. } | MessagesCmd::PublishPrepared { .. }) => {
+            unreachable!("prepared commands are dispatched before the ordinary CLI path")
+        }
         Cmd::Messages(sub) => commands::messages::dispatch(sub, &client, &cli.format).await,
         Cmd::Channels(sub) => commands::channels::dispatch(sub, &client, &cli.format).await,
         Cmd::Canvas(sub) => commands::channels::dispatch_canvas(sub, &client).await,
@@ -2184,6 +2325,8 @@ mod tests {
                 "delete",
                 "edit",
                 "get",
+                "prepare",
+                "publish-prepared",
                 "search",
                 "send",
                 "send-diff",
@@ -2321,7 +2464,7 @@ mod tests {
             ("feed", 1),
             ("issues", 4),
             ("media", 1),
-            ("messages", 8),
+            ("messages", 10),
             ("pack", 2),
             ("patches", 4),
             ("pr", 5),
diff --git a/crates/buzz-cli/src/prepared_event.rs b/crates/buzz-cli/src/prepared_event.rs
new file mode 100644
index 00000000000..bf7ebcddd2c
--- /dev/null
+++ b/crates/buzz-cli/src/prepared_event.rs
@@ -0,0 +1,925 @@
+//! Crash-safe preparation and replay of fully signed Buzz message events.
+
+use std::fs::{File, OpenOptions};
+use std::io::{Read, Write};
+use std::path::Path;
+
+use nostr::{Event, EventId, JsonUtil, Kind, PublicKey, Tag};
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+use crate::client::BuzzClient;
+use crate::error::CliError;
+
+const MAX_PREPARED_BYTES: u64 = 256 * 1024;
+
+#[derive(Debug)]
+pub(crate) struct PreparedCommandOutput {
+    pub exit_code: i32,
+    pub stdout: Option<Value>,
+    pub stderr: Option<Value>,
+}
+
+#[derive(Debug)]
+pub(crate) enum PreparedCommand<'a> {
+    Prepare {
+        channel: &'a str,
+        content_flag: &'a str,
+        reply_to: Option<&'a str>,
+        thread_root: Option<&'a str>,
+        execution_id: &'a str,
+        mentions: &'a [String],
+        out: &'a Path,
+    },
+    Publish {
+        file: &'a Path,
+    },
+}
+
+struct PrepareInput<'a> {
+    channel: &'a str,
+    content_flag: &'a str,
+    reply_to: Option<&'a str>,
+    thread_root: Option<&'a str>,
+    execution_id: &'a str,
+    mentions: &'a [String],
+    out: &'a Path,
+    stdin: &'a [u8],
+}
+
+#[derive(Debug)]
+enum PreparedFailure {
+    User(String),
+    Network,
+    DeliveryUnknown(String),
+    ManualReview {
+        reason: &'static str,
+        event_id: String,
+    },
+}
+
+impl PreparedFailure {
+    fn output(self) -> PreparedCommandOutput {
+        match self {
+            Self::User(message) => PreparedCommandOutput {
+                exit_code: 1,
+                stdout: None,
+                stderr: Some(
+                    json!({"error": "user_error", "retryable": false, "message": message}),
+                ),
+            },
+            Self::Network => PreparedCommandOutput {
+                exit_code: 2,
+                stdout: None,
+                stderr: Some(json!({"error": "network_error", "retryable": true})),
+            },
+            Self::DeliveryUnknown(event_id) => PreparedCommandOutput {
+                exit_code: 2,
+                stdout: None,
+                stderr: Some(json!({
+                    "error": "delivery_unknown",
+                    "retryable": true,
+                    "event_id": event_id,
+                })),
+            },
+            Self::ManualReview { reason, event_id } => PreparedCommandOutput {
+                exit_code: 1,
+                stdout: None,
+                stderr: Some(json!({
+                    "error": "manual_review",
+                    "retryable": false,
+                    "reason": reason,
+                    "event_id": event_id,
+                })),
+            },
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+struct MemberClaim {
+    pubkey: String,
+    role: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ChannelClaim {
+    id: String,
+    channel_type: String,
+    owner_pubkey: String,
+    agent_pubkey: String,
+    members: Vec<MemberClaim>,
+    membership_revision: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ReplyClaim {
+    root_event_id: String,
+    parent_event_id: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct AuthClaim {
+    agent_pubkey: String,
+    owner_pubkey: String,
+    auth_tag_hash: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct PreparedRecord {
+    version: u8,
+    execution_id: String,
+    relay: String,
+    relay_info_hash: String,
+    fingerprint: String,
+    content_hash: String,
+    mentions: Vec<String>,
+    channel: ChannelClaim,
+    reply: ReplyClaim,
+    auth: AuthClaim,
+    event: Value,
+}
+
+pub(crate) async fn execute(
+    client: &BuzzClient,
+    command: PreparedCommand<'_>,
+    stdin: &[u8],
+) -> PreparedCommandOutput {
+    let result = match command {
+        PreparedCommand::Prepare {
+            channel,
+            content_flag,
+            reply_to,
+            thread_root,
+            execution_id,
+            mentions,
+            out,
+        } => {
+            prepare(
+                client,
+                PrepareInput {
+                    channel,
+                    content_flag,
+                    reply_to,
+                    thread_root,
+                    execution_id,
+                    mentions,
+                    out,
+                    stdin,
+                },
+            )
+            .await
+        }
+        PreparedCommand::Publish { file } => publish(client, file).await,
+    };
+    match result {
+        Ok(value) => PreparedCommandOutput {
+            exit_code: 0,
+            stdout: Some(value),
+            stderr: None,
+        },
+        Err(error) => error.output(),
+    }
+}
+
+async fn prepare(client: &BuzzClient, input: PrepareInput<'_>) -> Result<Value, PreparedFailure> {
+    let PrepareInput {
+        channel,
+        content_flag,
+        reply_to,
+        thread_root,
+        execution_id,
+        mentions,
+        out,
+        stdin,
+    } = input;
+    if content_flag != "-" {
+        return Err(PreparedFailure::User(
+            "prepared reply content must be supplied on stdin with --content -".into(),
+        ));
+    }
+    if !out.is_absolute() {
+        return Err(PreparedFailure::User(
+            "--out must be an absolute path".into(),
+        ));
+    }
+    if stdin.len() > 64 * 1024 {
+        return Err(PreparedFailure::User("reply content exceeds 64 KiB".into()));
+    }
+    let content = std::str::from_utf8(stdin)
+        .map_err(|_| PreparedFailure::User("reply content must be UTF-8".into()))?;
+    let channel_id = Uuid::parse_str(channel)
+        .map_err(|_| PreparedFailure::User("invalid channel UUID".into()))?;
+    let reply_to = reply_to.ok_or_else(|| {
+        PreparedFailure::User("--reply-to is required for prepared P0 replies".into())
+    })?;
+    let execution_id = normalize_execution_id(execution_id)?;
+    let parent_id = EventId::from_hex(reply_to)
+        .map_err(|_| PreparedFailure::User("invalid --reply-to event ID".into()))?;
+    let normalized_mentions = normalize_mentions(mentions)?;
+
+    let snapshot = fetch_snapshot(client, channel_id).await?;
+    let parent = fetch_event(client, reply_to).await?;
+    validate_parent(&parent, channel)?;
+    let derived_root = thread_root_from_parent(&parent).unwrap_or_else(|| reply_to.to_string());
+    let root = thread_root.unwrap_or(&derived_root);
+    EventId::from_hex(root)
+        .map_err(|_| PreparedFailure::User("invalid --thread-root event ID".into()))?;
+    if root != derived_root {
+        return Err(PreparedFailure::User(
+            "--thread-root does not match the authoritative parent event".into(),
+        ));
+    }
+    if root != reply_to {
+        let root_event = fetch_event(client, root).await?;
+        validate_parent(&root_event, channel)?;
+    }
+
+    let fingerprint = fingerprint(
+        channel,
+        root,
+        reply_to,
+        &execution_id,
+        content,
+        &normalized_mentions,
+    )?;
+    if out.exists() {
+        let existing = read_record(out)?;
+        if existing.fingerprint != fingerprint {
+            return Err(PreparedFailure::User(
+                "prepared record already exists with a different execution fingerprint".into(),
+            ));
+        }
+        validate_record(client, &existing)?;
+        let event_id = existing.event["id"]
+            .as_str()
+            .ok_or_else(|| PreparedFailure::User("prepared event is missing id".into()))?;
+        return Ok(json!({
+            "prepared": true,
+            "event_id": event_id,
+            "path": out,
+            "adopted": true,
+        }));
+    }
+
+    let mention_refs = normalized_mentions
+        .iter()
+        .map(String::as_str)
+        .collect::<Vec<_>>();
+    let thread = buzz_sdk::ThreadRef {
+        root_event_id: EventId::from_hex(root)
+            .map_err(|_| PreparedFailure::User("invalid thread root".into()))?,
+        parent_event_id: parent_id,
+    };
+    let revision_tag = Tag::parse([
+        "buzz_membership_revision",
+        snapshot.channel.membership_revision.as_str(),
+    ])
+    .map_err(|_| PreparedFailure::User("invalid membership revision tag".into()))?;
+    let builder = buzz_sdk::build_message(
+        channel_id,
+        content,
+        Some(&thread),
+        &mention_refs,
+        false,
+        &[],
+    )
+    .map_err(|error| PreparedFailure::User(format!("failed to build prepared message: {error}")))?
+    .tags([revision_tag]);
+    let event = client.sign_event(builder).map_err(map_client_failure)?;
+    event
+        .verify()
+        .map_err(|_| PreparedFailure::User("prepared event signature is invalid".into()))?;
+    let event = serde_json::to_value(event)
+        .map_err(|_| PreparedFailure::User("failed to encode prepared event".into()))?;
+    let record = PreparedRecord {
+        version: 1,
+        execution_id,
+        relay: client.relay_url().to_string(),
+        relay_info_hash: snapshot.relay_info_hash,
+        fingerprint,
+        content_hash: sha256_hex(content.as_bytes()),
+        mentions: normalized_mentions,
+        channel: snapshot.channel,
+        reply: ReplyClaim {
+            root_event_id: root.to_string(),
+            parent_event_id: reply_to.to_string(),
+        },
+        auth: snapshot.auth,
+        event,
+    };
+    validate_record(client, &record)?;
+    let bytes = serde_json::to_vec(&record)
+        .map_err(|_| PreparedFailure::User("failed to encode prepared record".into()))?;
+    if bytes.len() as u64 > MAX_PREPARED_BYTES {
+        return Err(PreparedFailure::User(
+            "prepared record exceeds size limit".into(),
+        ));
+    }
+    install_record(out, &bytes)?;
+    let event_id = record.event["id"]
+        .as_str()
+        .ok_or_else(|| PreparedFailure::User("prepared event is missing id".into()))?;
+    Ok(json!({
+        "prepared": true,
+        "event_id": event_id,
+        "path": out,
+        "adopted": false,
+    }))
+}
+
+async fn publish(client: &BuzzClient, file: &Path) -> Result<Value, PreparedFailure> {
+    let record = read_record(file)?;
+    validate_record(client, &record)?;
+    let event_id = record.event["id"]
+        .as_str()
+        .ok_or_else(|| PreparedFailure::User("prepared event is missing id".into()))?
+        .to_string();
+
+    match query_exact_event(client, &event_id).await {
+        Ok(Some(existing)) => {
+            if existing != record.event {
+                return Err(PreparedFailure::ManualReview {
+                    reason: "event_body_mismatch",
+                    event_id,
+                });
+            }
+            return Ok(json!({"accepted": true, "event_id": event_id, "duplicate": true}));
+        }
+        Ok(None) => {}
+        Err(PreparedFailure::User(_)) => {
+            return Err(PreparedFailure::ManualReview {
+                reason: "query_unauthorized",
+                event_id,
+            });
+        }
+        Err(error) => return Err(error),
+    }
+
+    let channel_id = Uuid::parse_str(&record.channel.id)
+        .map_err(|_| PreparedFailure::User("prepared channel is invalid".into()))?;
+    let current = fetch_snapshot(client, channel_id).await?;
+    if current.channel != record.channel
+        || current.auth != record.auth
+        || current.relay_info_hash != record.relay_info_hash
+        || client.relay_url() != record.relay
+    {
+        return Err(PreparedFailure::ManualReview {
+            reason: "destination_precondition_changed",
+            event_id,
+        });
+    }
+    let parent = fetch_event(client, &record.reply.parent_event_id).await?;
+    validate_parent(&parent, &record.channel.id)?;
+    if thread_root_from_parent(&parent).unwrap_or_else(|| record.reply.parent_event_id.clone())
+        != record.reply.root_event_id
+    {
+        return Err(PreparedFailure::ManualReview {
+            reason: "reply_anchor_changed",
+            event_id,
+        });
+    }
+    if record.reply.root_event_id != record.reply.parent_event_id {
+        let root = fetch_event(client, &record.reply.root_event_id).await?;
+        validate_parent(&root, &record.channel.id)?;
+    }
+
+    let event_bytes = serde_json::to_vec(&record.event)
+        .map_err(|_| PreparedFailure::User("failed to encode prepared event".into()))?;
+    match client.submit_prepared_event_bytes(event_bytes, 9).await {
+        Ok(_) => Ok(json!({"accepted": true, "event_id": event_id, "duplicate": false})),
+        Err(CliError::DeliveryUnknown(_)) => Err(PreparedFailure::DeliveryUnknown(event_id)),
+        Err(error) => Err(map_client_failure(error)),
+    }
+}
+
+struct Snapshot {
+    channel: ChannelClaim,
+    auth: AuthClaim,
+    relay_info_hash: String,
+}
+
+async fn fetch_snapshot(client: &BuzzClient, channel: Uuid) -> Result<Snapshot, PreparedFailure> {
+    let metadata = query_kind(client, 39000, channel).await?;
+    let members_event = query_kind(client, 39002, channel).await?;
+    if metadata.pubkey != members_event.pubkey {
+        return Err(PreparedFailure::User(
+            "channel metadata and membership have different authorities".into(),
+        ));
+    }
+    let is_dm = metadata.tags.iter().any(|tag| {
+        let values = tag.as_slice();
+        (values.first().map(String::as_str) == Some("t")
+            && values.get(1).map(String::as_str) == Some("dm"))
+            || values.first().map(String::as_str) == Some("hidden")
+    });
+    if !is_dm {
+        return Err(PreparedFailure::User(
+            "prepared P0 replies require a DM channel".into(),
+        ));
+    }
+    let agent_pubkey = client.keys().public_key().to_hex().to_ascii_lowercase();
+    let owner_pubkey = client
+        .auth_tag_owner_hex()
+        .ok_or_else(|| PreparedFailure::User("verified NIP-OA owner auth is required".into()))?
+        .to_ascii_lowercase();
+    let mut members = members_event
+        .tags
+        .iter()
+        .filter_map(|tag| {
+            let values = tag.as_slice();
+            (values.first().map(String::as_str) == Some("p")).then(|| MemberClaim {
+                pubkey: values
+                    .get(1)
+                    .cloned()
+                    .unwrap_or_default()
+                    .to_ascii_lowercase(),
+                role: values.get(3).cloned().unwrap_or_default(),
+            })
+        })
+        .collect::<Vec<_>>();
+    members.sort_by(|left, right| left.pubkey.as_bytes().cmp(right.pubkey.as_bytes()));
+    if members.len() != 2
+        || !members
+            .iter()
+            .any(|member| member.pubkey == owner_pubkey && member.role == "member")
+        || !members
+            .iter()
+            .any(|member| member.pubkey == agent_pubkey && member.role == "member")
+    {
+        return Err(PreparedFailure::User(
+            "current channel membership is not the exact owner/agent DM set".into(),
+        ));
+    }
+    let channel_text = channel.to_string();
+    let revision = membership_revision(&channel_text, &members)?;
+    let info = client
+        .get_public("/info")
+        .await
+        .map_err(map_client_failure)?;
+    let info_value: Value = serde_json::from_str(&info)
+        .map_err(|_| PreparedFailure::User("relay info response is malformed".into()))?;
+    let relay_info_hash = sha256_hex(canonical_json(&info_value)?.as_bytes());
+    Ok(Snapshot {
+        channel: ChannelClaim {
+            id: channel_text,
+            channel_type: "dm".into(),
+            owner_pubkey: owner_pubkey.clone(),
+            agent_pubkey: agent_pubkey.clone(),
+            members,
+            membership_revision: revision,
+        },
+        auth: AuthClaim {
+            agent_pubkey,
+            owner_pubkey,
+            auth_tag_hash: client.auth_tag_hash().ok_or_else(|| {
+                PreparedFailure::User("verified NIP-OA owner auth is required".into())
+            })?,
+        },
+        relay_info_hash,
+    })
+}
+
+async fn query_kind(
+    client: &BuzzClient,
+    kind: u16,
+    channel: Uuid,
+) -> Result<Event, PreparedFailure> {
+    let raw = client
+        .query(&json!({"kinds": [kind], "#d": [channel.to_string()], "limit": 1}))
+        .await
+        .map_err(map_client_failure)?;
+    parse_one_event(&raw, "channel state")
+}
+
+async fn fetch_event(client: &BuzzClient, id: &str) -> Result<Event, PreparedFailure> {
+    let raw = client
+        .query(&json!({"ids": [id], "limit": 1}))
+        .await
+        .map_err(map_client_failure)?;
+    parse_one_event(&raw, "event")
+}
+
+async fn query_exact_event(
+    client: &BuzzClient,
+    id: &str,
+) -> Result<Option<Value>, PreparedFailure> {
+    let raw = client
+        .query(&json!({"ids": [id], "limit": 1}))
+        .await
+        .map_err(map_client_failure)?;
+    let values: Vec<Value> = serde_json::from_str(&raw)
+        .map_err(|_| PreparedFailure::User("event query response is malformed".into()))?;
+    let Some(value) = values.into_iter().next() else {
+        return Ok(None);
+    };
+    let event: Event = serde_json::from_value(value.clone())
+        .map_err(|_| PreparedFailure::User("queried event is malformed".into()))?;
+    event
+        .verify()
+        .map_err(|_| PreparedFailure::User("queried event signature is invalid".into()))?;
+    Ok(Some(value))
+}
+
+fn parse_one_event(raw: &str, label: &str) -> Result<Event, PreparedFailure> {
+    let events: Vec<Event> = serde_json::from_str(raw)
+        .map_err(|_| PreparedFailure::User(format!("{label} query response is malformed")))?;
+    let event = events
+        .into_iter()
+        .next()
+        .ok_or_else(|| PreparedFailure::User(format!("{label} was not found")))?;
+    event
+        .verify()
+        .map_err(|_| PreparedFailure::User(format!("{label} signature is invalid")))?;
+    Ok(event)
+}
+
+fn validate_parent(parent: &Event, channel: &str) -> Result<(), PreparedFailure> {
+    if parent.kind != Kind::Custom(9)
+        || !parent.tags.iter().any(|tag| {
+            let values = tag.as_slice();
+            values.first().map(String::as_str) == Some("h")
+                && values.get(1).map(String::as_str) == Some(channel)
+        })
+    {
+        return Err(PreparedFailure::User(
+            "reply parent does not belong to the prepared channel".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn thread_root_from_parent(parent: &Event) -> Option<String> {
+    let mut root = None;
+    let mut reply = None;
+    for tag in parent.tags.iter() {
+        let values = tag.as_slice();
+        if values.first().map(String::as_str) != Some("e") || values.len() < 4 {
+            continue;
+        }
+        match values.get(3).map(String::as_str) {
+            Some("root") => root = values.get(1).cloned(),
+            Some("reply") => reply = values.get(1).cloned(),
+            _ => {}
+        }
+    }
+    root.or(reply)
+}
+
+fn validate_record(client: &BuzzClient, record: &PreparedRecord) -> Result<(), PreparedFailure> {
+    if record.version != 1 || record.relay != client.relay_url() {
+        return Err(PreparedFailure::User(
+            "prepared record version or destination does not match".into(),
+        ));
+    }
+    let event: Event = Event::from_json(record.event.to_string())
+        .map_err(|_| PreparedFailure::User("prepared event is malformed".into()))?;
+    event
+        .verify()
+        .map_err(|_| PreparedFailure::User("prepared event signature is invalid".into()))?;
+    if event.kind != Kind::Custom(9)
+        || event.pubkey.to_hex().to_ascii_lowercase() != record.auth.agent_pubkey
+        || sha256_hex(event.content.as_bytes()) != record.content_hash
+    {
+        return Err(PreparedFailure::User(
+            "prepared event body does not match its frozen claims".into(),
+        ));
+    }
+    let tags = event
+        .tags
+        .iter()
+        .map(|tag| tag.as_slice())
+        .collect::<Vec<_>>();
+    let tag_equals = |name: &str, value: &str| {
+        tags.iter().any(|tag| {
+            tag.first().map(String::as_str) == Some(name)
+                && tag.get(1).map(String::as_str) == Some(value)
+        })
+    };
+    let exact_thread_tag = |event_id: &str, marker: &str| {
+        tags.iter().any(|tag| {
+            tag.len() == 4
+                && tag.first().map(String::as_str) == Some("e")
+                && tag.get(1).map(String::as_str) == Some(event_id)
+                && tag.get(2).map(String::as_str) == Some("")
+                && tag.get(3).map(String::as_str) == Some(marker)
+        })
+    };
+    let thread_tags_valid = if record.reply.root_event_id == record.reply.parent_event_id {
+        exact_thread_tag(&record.reply.parent_event_id, "reply")
+    } else {
+        exact_thread_tag(&record.reply.root_event_id, "root")
+            && exact_thread_tag(&record.reply.parent_event_id, "reply")
+    };
+    let mut event_mentions = tags
+        .iter()
+        .filter_map(|tag| {
+            (tag.first().map(String::as_str) == Some("p"))
+                .then(|| tag.get(1).cloned())
+                .flatten()
+        })
+        .collect::<Vec<_>>();
+    event_mentions.sort();
+    let mut claimed_mentions = record.mentions.clone();
+    claimed_mentions.sort();
+    let canonical_execution_id = normalize_execution_id(&record.execution_id)?;
+    if canonical_execution_id != record.execution_id {
+        return Err(PreparedFailure::User(
+            "prepared execution ID is not canonical".into(),
+        ));
+    }
+    let fingerprint = fingerprint(
+        &record.channel.id,
+        &record.reply.root_event_id,
+        &record.reply.parent_event_id,
+        &record.execution_id,
+        &event.content,
+        &record.mentions,
+    )?;
+    let exact_members =
+        record.channel.members.len() == 2
+            && record.channel.members.iter().any(|member| {
+                member.pubkey == record.channel.owner_pubkey && member.role == "member"
+            })
+            && record.channel.members.iter().any(|member| {
+                member.pubkey == record.channel.agent_pubkey && member.role == "member"
+            });
+    if !tag_equals("h", &record.channel.id)
+        || !tag_equals(
+            "buzz_membership_revision",
+            &record.channel.membership_revision,
+        )
+        || !thread_tags_valid
+        || event_mentions != claimed_mentions
+        || fingerprint != record.fingerprint
+        || record.channel.channel_type != "dm"
+        || !exact_members
+        || record.channel.owner_pubkey != record.auth.owner_pubkey
+        || record.channel.agent_pubkey != record.auth.agent_pubkey
+        || client.keys().public_key().to_hex().to_ascii_lowercase() != record.auth.agent_pubkey
+        || client.auth_tag_owner_hex().as_deref() != Some(record.auth.owner_pubkey.as_str())
+        || client.auth_tag_hash().as_deref() != Some(record.auth.auth_tag_hash.as_str())
+    {
+        return Err(PreparedFailure::User(
+            "prepared event destination or auth claims do not match".into(),
+        ));
+    }
+    let expected_revision = membership_revision(&record.channel.id, &record.channel.members)?;
+    if expected_revision != record.channel.membership_revision {
+        return Err(PreparedFailure::User(
+            "prepared membership revision is invalid".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn normalize_mentions(mentions: &[String]) -> Result<Vec<String>, PreparedFailure> {
+    let mut normalized = Vec::new();
+    for mention in mentions {
+        let pubkey = PublicKey::parse(mention)
+            .map_err(|_| PreparedFailure::User("invalid --mention pubkey".into()))?
+            .to_hex()
+            .to_ascii_lowercase();
+        if !normalized.contains(&pubkey) {
+            normalized.push(pubkey);
+        }
+    }
+    Ok(normalized)
+}
+
+fn normalize_execution_id(value: &str) -> Result<String, PreparedFailure> {
+    let normalized = value.trim().to_ascii_lowercase();
+    if normalized.len() != 64 || !normalized.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err(PreparedFailure::User(
+            "--execution-id must be 64 hexadecimal characters".into(),
+        ));
+    }
+    Ok(normalized)
+}
+
+fn fingerprint(
+    channel: &str,
+    root: &str,
+    parent: &str,
+    execution_id: &str,
+    content: &str,
+    mentions: &[String],
+) -> Result<String, PreparedFailure> {
+    let value = json!({
+        "channel": channel,
+        "root": root,
+        "parent": parent,
+        "executionId": execution_id,
+        "contentHash": sha256_hex(content.as_bytes()),
+        "mentions": mentions,
+    });
+    Ok(sha256_hex(canonical_json(&value)?.as_bytes()))
+}
+
+fn membership_revision(channel: &str, members: &[MemberClaim]) -> Result<String, PreparedFailure> {
+    let value = json!({"version": 1, "channelId": channel, "members": members});
+    Ok(format!(
+        "v1:{}",
+        sha256_hex(canonical_json(&value)?.as_bytes())
+    ))
+}
+
+fn canonical_json(value: &Value) -> Result<String, PreparedFailure> {
+    match value {
+        Value::Null => Ok("null".into()),
+        Value::Bool(value) => Ok(value.to_string()),
+        Value::Number(value) if value.is_i64() || value.is_u64() => Ok(value.to_string()),
+        Value::Number(_) => Err(PreparedFailure::User(
+            "floating-point canonical JSON is not supported".into(),
+        )),
+        Value::String(value) => serde_json::to_string(value)
+            .map_err(|_| PreparedFailure::User("failed to canonicalize string".into())),
+        Value::Array(values) => Ok(format!(
+            "[{}]",
+            values
+                .iter()
+                .map(canonical_json)
+                .collect::<Result<Vec<_>, _>>()?
+                .join(",")
+        )),
+        Value::Object(values) => {
+            let mut keys = values.keys().collect::<Vec<_>>();
+            keys.sort_by(|left, right| left.encode_utf16().cmp(right.encode_utf16()));
+            let fields = keys
+                .into_iter()
+                .map(|key| {
+                    Ok(format!(
+                        "{}:{}",
+                        serde_json::to_string(key).map_err(|_| PreparedFailure::User(
+                            "failed to canonicalize key".into()
+                        ))?,
+                        canonical_json(&values[key])?
+                    ))
+                })
+                .collect::<Result<Vec<_>, PreparedFailure>>()?;
+            Ok(format!("{{{}}}", fields.join(",")))
+        }
+    }
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+fn read_record(path: &Path) -> Result<PreparedRecord, PreparedFailure> {
+    if !path.is_absolute() {
+        return Err(PreparedFailure::User(
+            "prepared path must be absolute".into(),
+        ));
+    }
+    let link_meta = std::fs::symlink_metadata(path)
+        .map_err(|_| PreparedFailure::User("prepared record is unavailable".into()))?;
+    if link_meta.file_type().is_symlink() || !link_meta.is_file() {
+        return Err(PreparedFailure::User(
+            "prepared record must be a regular non-symlink file".into(),
+        ));
+    }
+    let parent = path
+        .parent()
+        .ok_or_else(|| PreparedFailure::User("prepared path has no parent".into()))?;
+    validate_secure_parent(parent)?;
+    let file = File::open(path)
+        .map_err(|_| PreparedFailure::User("prepared record could not be opened".into()))?;
+    let opened = file
+        .metadata()
+        .map_err(|_| PreparedFailure::User("prepared record metadata failed".into()))?;
+    validate_open_file(&link_meta, &opened, parent)?;
+    if opened.len() == 0 || opened.len() > MAX_PREPARED_BYTES {
+        return Err(PreparedFailure::User(
+            "prepared record is empty, truncated, or oversized".into(),
+        ));
+    }
+    let mut bytes = Vec::with_capacity(opened.len() as usize);
+    file.take(MAX_PREPARED_BYTES + 1)
+        .read_to_end(&mut bytes)
+        .map_err(|_| PreparedFailure::User("prepared record read failed".into()))?;
+    serde_json::from_slice(&bytes)
+        .map_err(|_| PreparedFailure::User("prepared record is malformed or truncated".into()))
+}
+
+fn install_record(path: &Path, bytes: &[u8]) -> Result<(), PreparedFailure> {
+    let parent = path
+        .parent()
+        .ok_or_else(|| PreparedFailure::User("prepared path has no parent".into()))?;
+    validate_secure_parent(parent)?;
+    let file_name = path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .ok_or_else(|| PreparedFailure::User("prepared filename is invalid".into()))?;
+    let temp = parent.join(format!(".{file_name}.{}.tmp", std::process::id()));
+    #[cfg(unix)]
+    use std::os::unix::fs::OpenOptionsExt;
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    options.mode(0o600);
+    let mut file = options
+        .open(&temp)
+        .map_err(|_| PreparedFailure::User("could not create secure prepared temp file".into()))?;
+    file.write_all(bytes)
+        .and_then(|_| file.sync_all())
+        .map_err(|_| PreparedFailure::User("prepared record fsync failed".into()))?;
+    std::fs::hard_link(&temp, path)
+        .map_err(|_| PreparedFailure::User("prepared record already exists".into()))?;
+    File::open(parent)
+        .and_then(|directory| directory.sync_all())
+        .map_err(|_| PreparedFailure::User("prepared directory fsync failed".into()))?;
+    std::fs::remove_file(&temp)
+        .map_err(|_| PreparedFailure::User("prepared temp cleanup failed".into()))?;
+    File::open(parent)
+        .and_then(|directory| directory.sync_all())
+        .map_err(|_| PreparedFailure::User("prepared directory fsync failed".into()))?;
+    Ok(())
+}
+
+#[cfg(unix)]
+fn validate_secure_parent(parent: &Path) -> Result<(), PreparedFailure> {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+    let metadata = std::fs::symlink_metadata(parent)
+        .map_err(|_| PreparedFailure::User("prepared parent is unavailable".into()))?;
+    if metadata.file_type().is_symlink()
+        || !metadata.is_dir()
+        || metadata.permissions().mode() & 0o777 != 0o700
+        || metadata.nlink() == 0
+    {
+        return Err(PreparedFailure::User(
+            "prepared parent must be an owned 0700 non-symlink directory".into(),
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn validate_secure_parent(parent: &Path) -> Result<(), PreparedFailure> {
+    let metadata = std::fs::symlink_metadata(parent)
+        .map_err(|_| PreparedFailure::User("prepared parent is unavailable".into()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        return Err(PreparedFailure::User(
+            "prepared parent must be a non-symlink directory".into(),
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn validate_open_file(
+    before: &std::fs::Metadata,
+    opened: &std::fs::Metadata,
+    parent: &Path,
+) -> Result<(), PreparedFailure> {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+    let parent_meta = std::fs::metadata(parent)
+        .map_err(|_| PreparedFailure::User("prepared parent metadata failed".into()))?;
+    if opened.permissions().mode() & 0o777 != 0o600
+        || before.dev() != opened.dev()
+        || before.ino() != opened.ino()
+        || opened.nlink() == 0
+        || opened.uid() != parent_meta.uid()
+    {
+        return Err(PreparedFailure::User(
+            "prepared record owner, mode, or identity changed".into(),
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn validate_open_file(
+    _before: &std::fs::Metadata,
+    opened: &std::fs::Metadata,
+    _parent: &Path,
+) -> Result<(), PreparedFailure> {
+    if !opened.is_file() {
+        return Err(PreparedFailure::User(
+            "prepared record must be a regular file".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn map_client_failure(error: CliError) -> PreparedFailure {
+    match error {
+        CliError::Network(_)
+        | CliError::Relay {
+            status: 429 | 500..=599,
+            ..
+        } => PreparedFailure::Network,
+        CliError::Relay { status, .. } => PreparedFailure::User(format!(
+            "relay rejected the prepared-event request with HTTP {status}"
+        )),
+        CliError::DeliveryUnknown(_) => PreparedFailure::Network,
+        other => PreparedFailure::User(other.to_string()),
+    }
+}
diff --git a/crates/buzz-cli/tests/prepared_event.rs b/crates/buzz-cli/tests/prepared_event.rs
new file mode 100644
index 00000000000..5cd4add857d
--- /dev/null
+++ b/crates/buzz-cli/tests/prepared_event.rs
@@ -0,0 +1,498 @@
+use std::sync::{Arc, Mutex};
+
+use axum::body::Bytes;
+use axum::extract::State;
+use axum::http::StatusCode;
+use axum::response::IntoResponse;
+use axum::routing::{get, post};
+use axum::{Json, Router};
+use nostr::{Event, EventBuilder, JsonUtil, Keys, Kind, Tag};
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
+
+#[derive(Clone)]
+struct FakeRelay {
+    metadata: Event,
+    members: Event,
+    thread_events: Vec<Event>,
+    accepted: Arc<Mutex<Option<Value>>>,
+    publish_bodies: Arc<Mutex<Vec<Vec<u8>>>>,
+}
+
+async fn query(State(state): State<FakeRelay>, Json(filters): Json<Value>) -> Json<Value> {
+    let filter = filters
+        .as_array()
+        .and_then(|values| values.first())
+        .cloned()
+        .unwrap_or(Value::Null);
+    let kind = filter
+        .get("kinds")
+        .and_then(Value::as_array)
+        .and_then(|values| values.first())
+        .and_then(Value::as_u64);
+
+    let events = match kind {
+        Some(39000) => vec![state.metadata],
+        Some(39002) => vec![state.members],
+        _ => {
+            let requested = filter
+                .get("ids")
+                .and_then(Value::as_array)
+                .and_then(|values| values.first())
+                .and_then(Value::as_str);
+            if let Some(event) = state
+                .thread_events
+                .iter()
+                .find(|event| requested.is_some_and(|id| event.id.to_hex() == id))
+                .cloned()
+            {
+                vec![event]
+            } else {
+                state
+                    .accepted
+                    .lock()
+                    .expect("accepted-event lock")
+                    .clone()
+                    .and_then(|event| {
+                        (event.get("id").and_then(Value::as_str) == requested).then_some(event)
+                    })
+                    .into_iter()
+                    .map(|event| Event::from_json(event.to_string()).expect("stored event fixture"))
+                    .collect()
+            }
+        }
+    };
+    Json(serde_json::to_value(events).expect("serialize query response"))
+}
+
+async fn publish(State(state): State<FakeRelay>, body: Bytes) -> impl IntoResponse {
+    let event: Value = serde_json::from_slice(&body).expect("signed event body");
+    let mut accepted = state.accepted.lock().expect("accepted-event lock");
+    if accepted.is_none() {
+        *accepted = Some(event);
+    }
+    state
+        .publish_bodies
+        .lock()
+        .expect("publish-body lock")
+        .push(body.to_vec());
+
+    // The fake relay accepted the event but the proxy lost the success response.
+    (
+        StatusCode::BAD_GATEWAY,
+        Json(json!({"error": "response lost after acceptance"})),
+    )
+}
+
+fn signed_event(keys: &Keys, kind: u16, content: &str, tags: Vec<Tag>) -> Event {
+    EventBuilder::new(Kind::Custom(kind), content)
+        .tags(tags)
+        .sign_with_keys(keys)
+        .expect("sign authoritative fixture")
+}
+
+fn canonical_json(value: &Value) -> String {
+    match value {
+        Value::Null => "null".to_string(),
+        Value::Bool(value) => value.to_string(),
+        Value::Number(value) => {
+            assert!(value.is_i64() || value.is_u64(), "floats are not wire-safe");
+            value.to_string()
+        }
+        Value::String(value) => serde_json::to_string(value).expect("canonical string"),
+        Value::Array(values) => format!(
+            "[{}]",
+            values
+                .iter()
+                .map(canonical_json)
+                .collect::<Vec<_>>()
+                .join(",")
+        ),
+        Value::Object(values) => {
+            let mut keys: Vec<&String> = values.keys().collect();
+            keys.sort_by(|left, right| left.encode_utf16().cmp(right.encode_utf16()));
+            format!(
+                "{{{}}}",
+                keys.into_iter()
+                    .map(|key| format!(
+                        "{}:{}",
+                        serde_json::to_string(key).expect("canonical key"),
+                        canonical_json(&values[key]),
+                    ))
+                    .collect::<Vec<_>>()
+                    .join(",")
+            )
+        }
+    }
+}
+
+fn membership_revision(channel: &str, members: &Value) -> String {
+    let canonical = canonical_json(&json!({
+        "version": 1,
+        "channelId": channel,
+        "members": members,
+    }));
+    format!("v1:{}", hex::encode(Sha256::digest(canonical.as_bytes())))
+}
+
+#[tokio::test]
+async fn ambiguous_retry_reuses_identical_signed_event() {
+    let channel = "216209f0-1896-4d63-9e06-4411951562ec";
+    let owner = Keys::parse("0202020202020202020202020202020202020202020202020202020202020202")
+        .expect("owner keys");
+    let agent = Keys::parse("0101010101010101010101010101010101010101010101010101010101010101")
+        .expect("agent keys");
+    let relay = Keys::generate();
+    let owner_hex = owner.public_key().to_hex();
+    let agent_hex = agent.public_key().to_hex();
+    let auth_tag = buzz_sdk::nip_oa::compute_auth_tag(&owner, &agent.public_key(), "")
+        .expect("agent owner attestation");
+
+    let metadata = signed_event(
+        &relay,
+        39000,
+        "",
+        vec![
+            Tag::parse(["d", channel]).expect("d tag"),
+            Tag::parse(["private"]).expect("private tag"),
+            Tag::parse(["hidden"]).expect("hidden tag"),
+            Tag::parse(["closed"]).expect("closed tag"),
+            Tag::parse(["t", "dm"]).expect("type tag"),
+            Tag::parse(["p", &owner_hex]).expect("owner participant"),
+            Tag::parse(["p", &agent_hex]).expect("agent participant"),
+        ],
+    );
+    let members = signed_event(
+        &relay,
+        39002,
+        "",
+        vec![
+            Tag::parse(["d", channel]).expect("d tag"),
+            Tag::parse(["p", &owner_hex, "", "member"]).expect("owner participant"),
+            Tag::parse(["p", &agent_hex, "", "member"]).expect("agent membership"),
+        ],
+    );
+    let parent = signed_event(
+        &owner,
+        9,
+        "owner prompt",
+        vec![Tag::parse(["h", channel]).expect("channel tag")],
+    );
+    let parent_id = parent.id.to_hex();
+    let sibling = signed_event(
+        &owner,
+        9,
+        "owner follow-up",
+        vec![
+            Tag::parse(["h", channel]).expect("channel tag"),
+            Tag::parse(["e", parent_id.as_str(), "", "root"]).expect("root tag"),
+            Tag::parse(["e", parent_id.as_str(), "", "reply"]).expect("reply tag"),
+        ],
+    );
+    let sibling_id = sibling.id.to_hex();
+    let state = FakeRelay {
+        metadata,
+        members,
+        thread_events: vec![parent, sibling],
+        accepted: Arc::new(Mutex::new(None)),
+        publish_bodies: Arc::new(Mutex::new(Vec::new())),
+    };
+    let app = Router::new()
+        .route(
+            "/info",
+            get(|| async { Json(json!({"name": "fake-buzz"})) }),
+        )
+        .route("/query", post(query))
+        .route("/events", post(publish))
+        .with_state(state.clone());
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind fake relay");
+    let relay_url = format!("http://{}", listener.local_addr().expect("fake relay addr"));
+    let server = tokio::spawn(async move {
+        axum::serve(listener, app).await.expect("serve fake relay");
+    });
+
+    let temp = tempfile::tempdir().expect("temporary outbox");
+    #[cfg(unix)]
+    std::fs::set_permissions(
+        temp.path(),
+        std::os::unix::fs::PermissionsExt::from_mode(0o700),
+    )
+    .expect("secure temporary outbox");
+    let record = temp.path().join("reply.json");
+    let agent_secret = agent.secret_key().to_secret_hex();
+    let execution_id = "11".repeat(32);
+
+    let prepare_args = [
+        "buzz",
+        "--relay",
+        relay_url.as_str(),
+        "--private-key",
+        agent_secret.as_str(),
+        "--auth-tag",
+        auth_tag.as_str(),
+        "messages",
+        "prepare",
+        "--channel",
+        channel,
+        "--content",
+        "-",
+        "--reply-to",
+        parent_id.as_str(),
+        "--thread-root",
+        parent_id.as_str(),
+        "--execution-id",
+        execution_id.as_str(),
+        "--out",
+        record.to_str().expect("UTF-8 fixture path"),
+    ];
+    assert!(
+        !prepare_args.contains(&"one stable reply"),
+        "private reply content must never enter argv",
+    );
+    let mut prepare_stdout = Vec::new();
+    let mut prepare_stderr = Vec::new();
+    let prepare = buzz_cli::run_from_args_with_io(
+        prepare_args,
+        b"one stable reply",
+        &mut prepare_stdout,
+        &mut prepare_stderr,
+    )
+    .await;
+    assert_eq!(
+        prepare, 0,
+        "prepare must persist one signed event after bounded authoritative reads and before relay publication: {}",
+        String::from_utf8_lossy(&prepare_stderr),
+    );
+
+    let prepare_result: Value =
+        serde_json::from_slice(&prepare_stdout).expect("prepare JSON stdout");
+    assert_eq!(prepare_result["prepared"], json!(true));
+    assert_eq!(
+        prepare_result["path"],
+        json!(record.to_str().expect("path"))
+    );
+    let prepared_bytes = std::fs::read(&record).expect("prepared record");
+    let prepared: Value = serde_json::from_slice(&prepared_bytes).expect("prepared record JSON");
+    assert_eq!(prepared["executionId"], json!(execution_id));
+    let mut expected_members = vec![
+        json!({"pubkey": owner_hex, "role": "member"}),
+        json!({"pubkey": agent_hex, "role": "member"}),
+    ];
+    expected_members.sort_by(|left, right| {
+        left["pubkey"]
+            .as_str()
+            .expect("pubkey")
+            .cmp(right["pubkey"].as_str().expect("pubkey"))
+    });
+    assert_eq!(prepared["channel"]["members"], json!(expected_members));
+    let expected_revision = membership_revision(channel, &prepared["channel"]["members"]);
+    assert_eq!(
+        prepared["channel"]["membershipRevision"],
+        json!(expected_revision),
+        "prepared record membership revision must be independently derived from the authoritative sorted member/role set",
+    );
+    let prepared_event =
+        Event::from_json(prepared["event"].to_string()).expect("complete prepared signed event");
+    prepared_event.verify().expect("prepared event signature");
+    let signed_revision = prepared_event
+        .tags
+        .iter()
+        .map(|tag| tag.as_slice())
+        .find(|tag| tag.first().map(String::as_str) == Some("buzz_membership_revision"))
+        .and_then(|tag| tag.get(1))
+        .expect("signed membership revision tag");
+    assert_eq!(signed_revision, &expected_revision);
+    assert_eq!(prepared_event.content, "one stable reply");
+    assert_eq!(
+        prepare_result["event_id"],
+        json!(prepared_event.id.to_hex()),
+    );
+
+    let sibling_parent_args = [
+        "buzz",
+        "--relay",
+        relay_url.as_str(),
+        "--private-key",
+        agent_secret.as_str(),
+        "--auth-tag",
+        auth_tag.as_str(),
+        "messages",
+        "prepare",
+        "--channel",
+        channel,
+        "--content",
+        "-",
+        "--reply-to",
+        sibling_id.as_str(),
+        "--thread-root",
+        parent_id.as_str(),
+        "--execution-id",
+        execution_id.as_str(),
+        "--out",
+        record.to_str().expect("UTF-8 fixture path"),
+    ];
+    let mut sibling_stdout = Vec::new();
+    let mut sibling_stderr = Vec::new();
+    let sibling_adoption = buzz_cli::run_from_args_with_io(
+        sibling_parent_args,
+        b"one stable reply",
+        &mut sibling_stdout,
+        &mut sibling_stderr,
+    )
+    .await;
+    assert_eq!(
+        sibling_adoption, 1,
+        "a sibling immediate parent must not adopt the existing signed reply",
+    );
+    let sibling_error: Value =
+        serde_json::from_slice(&sibling_stderr).expect("sibling-parent error JSON");
+    assert_eq!(sibling_error["error"], json!("user_error"));
+    assert!(
+        sibling_error["message"]
+            .as_str()
+            .is_some_and(|message| message.contains("different execution fingerprint")),
+        "sibling parent must fail at the adoption fingerprint boundary",
+    );
+
+    let different_execution_id = "22".repeat(32);
+    let different_execution_args = [
+        "buzz",
+        "--relay",
+        relay_url.as_str(),
+        "--private-key",
+        agent_secret.as_str(),
+        "--auth-tag",
+        auth_tag.as_str(),
+        "messages",
+        "prepare",
+        "--channel",
+        channel,
+        "--content",
+        "-",
+        "--reply-to",
+        parent_id.as_str(),
+        "--thread-root",
+        parent_id.as_str(),
+        "--execution-id",
+        different_execution_id.as_str(),
+        "--out",
+        record.to_str().expect("UTF-8 fixture path"),
+    ];
+    let mut execution_stdout = Vec::new();
+    let mut execution_stderr = Vec::new();
+    let cross_execution_adoption = buzz_cli::run_from_args_with_io(
+        different_execution_args,
+        b"one stable reply",
+        &mut execution_stdout,
+        &mut execution_stderr,
+    )
+    .await;
+    assert_eq!(
+        cross_execution_adoption, 1,
+        "a different durable execution must not adopt the existing signed reply",
+    );
+    let execution_error: Value =
+        serde_json::from_slice(&execution_stderr).expect("cross-execution error JSON");
+    assert_eq!(execution_error["error"], json!("user_error"));
+    assert!(
+        execution_error["message"]
+            .as_str()
+            .is_some_and(|message| message.contains("different execution fingerprint")),
+        "execution ID must fail at the adoption fingerprint boundary",
+    );
+
+    let publish_args = [
+        "buzz",
+        "--relay",
+        relay_url.as_str(),
+        "--private-key",
+        agent_secret.as_str(),
+        "--auth-tag",
+        auth_tag.as_str(),
+        "messages",
+        "publish-prepared",
+        "--file",
+        record.to_str().expect("UTF-8 fixture path"),
+    ];
+    let mut first_stdout = Vec::new();
+    let mut first_stderr = Vec::new();
+    let first_publish =
+        buzz_cli::run_from_args_with_io(publish_args, b"", &mut first_stdout, &mut first_stderr)
+            .await;
+    assert_eq!(
+        first_publish,
+        2,
+        "lost acceptance response must surface delivery_unknown without resigning: {}",
+        String::from_utf8_lossy(&first_stderr),
+    );
+    let delivery_unknown: Value =
+        serde_json::from_slice(&first_stderr).expect("delivery_unknown JSON stderr");
+    assert_eq!(delivery_unknown["error"], json!("delivery_unknown"));
+    assert_eq!(delivery_unknown["retryable"], json!(true));
+    assert_eq!(
+        delivery_unknown["event_id"],
+        json!(prepared_event.id.to_hex()),
+    );
+
+    let mut recovery_stdout = Vec::new();
+    let mut recovery_stderr = Vec::new();
+    let recovery = buzz_cli::run_from_args_with_io(
+        publish_args,
+        b"",
+        &mut recovery_stdout,
+        &mut recovery_stderr,
+    )
+    .await;
+    assert_eq!(
+        recovery,
+        0,
+        "recovery must find and accept the identical event already stored by the relay: {}",
+        String::from_utf8_lossy(&recovery_stderr),
+    );
+    let recovery_result: Value =
+        serde_json::from_slice(&recovery_stdout).expect("recovery JSON stdout");
+    assert_eq!(recovery_result["accepted"], json!(true));
+    assert_eq!(recovery_result["duplicate"], json!(true));
+    assert_eq!(
+        recovery_result["event_id"],
+        json!(prepared_event.id.to_hex()),
+    );
+
+    let bodies = state.publish_bodies.lock().expect("publish-body lock");
+    assert!(
+        !bodies.is_empty(),
+        "the first publication must reach the relay"
+    );
+    assert!(
+        bodies.windows(2).all(|pair| pair[0] == pair[1]),
+        "every ambiguous retry must reuse identical signed bytes",
+    );
+    let expected_event_bytes =
+        serde_json::to_vec(&prepared["event"]).expect("canonical prepared event bytes");
+    assert_eq!(
+        bodies[0], expected_event_bytes,
+        "publication must use the exact signed event bytes persisted before network I/O",
+    );
+    let accepted = state
+        .accepted
+        .lock()
+        .expect("accepted-event lock")
+        .clone()
+        .expect("accepted event");
+    let accepted_id = accepted
+        .get("id")
+        .and_then(Value::as_str)
+        .expect("accepted event id");
+    let body_id = serde_json::from_slice::<Value>(&bodies[0])
+        .expect("published event JSON")
+        .get("id")
+        .and_then(Value::as_str)
+        .expect("published event id")
+        .to_owned();
+    assert_eq!(accepted_id, body_id);
+    assert_eq!(accepted_id, prepared_event.id.to_hex());
+
+    server.abort();
+}
diff --git a/crates/buzz-db/src/channel.rs b/crates/buzz-db/src/channel.rs
index 3ca9b3d901c..b25530bf9b4 100644
--- a/crates/buzz-db/src/channel.rs
+++ b/crates/buzz-db/src/channel.rs
@@ -347,25 +347,124 @@ pub async fn set_canvas(
 /// `buzz_channel_ttl:`.
 const CHANNEL_MEMBERSHIP_LOCK_NAMESPACE: &str = "buzz_channel_membership:";
 
+/// Stable advisory-lock input shared by membership writes and prepared-event
+/// admission for one tenant-scoped channel.
+pub fn channel_membership_lock_key(community_id: CommunityId, channel_id: Uuid) -> String {
+    format!(
+        "{CHANNEL_MEMBERSHIP_LOCK_NAMESPACE}{}:{}",
+        community_id.as_uuid(),
+        channel_id
+    )
+}
+
 /// Take the per-channel membership lock. MUST be the first statement in the
 /// transaction that then reads roles/owner counts and writes membership, so the
 /// whole check-then-write sequence is atomic against a concurrent one.
-async fn acquire_channel_membership_lock(
+pub(crate) async fn acquire_channel_membership_lock(
     tx: &mut Transaction<'_, Postgres>,
     community_id: CommunityId,
     channel_id: Uuid,
 ) -> Result<()> {
     sqlx::query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))")
-        .bind(format!(
-            "{CHANNEL_MEMBERSHIP_LOCK_NAMESPACE}{}:{}",
-            community_id.as_uuid(),
-            channel_id
-        ))
+        .bind(channel_membership_lock_key(community_id, channel_id))
         .execute(&mut **tx)
         .await?;
     Ok(())
 }
 
+/// Compute the frozen v1 membership revision while the caller holds the
+/// per-channel membership advisory transaction lock.
+pub(crate) async fn membership_revision_tx(
+    tx: &mut Transaction<'_, Postgres>,
+    community_id: CommunityId,
+    channel_id: Uuid,
+) -> Result<String> {
+    let rows = sqlx::query(
+        "SELECT pubkey, role::text AS role FROM channel_members \
+         WHERE community_id = $1 AND channel_id = $2 AND removed_at IS NULL \
+         ORDER BY pubkey ASC",
+    )
+    .bind(community_id.as_uuid())
+    .bind(channel_id)
+    .fetch_all(&mut **tx)
+    .await?;
+    let members = rows
+        .into_iter()
+        .map(|row| {
+            let pubkey: Vec<u8> = row.try_get("pubkey")?;
+            let role: String = row.try_get("role")?;
+            Ok((pubkey, role))
+        })
+        .collect::<Result<Vec<_>>>()?;
+    membership_revision(channel_id, &members)
+}
+
+/// Compute the public v1 membership revision from a caller-sorted or unsorted
+/// active membership snapshot.
+pub fn membership_revision(channel_id: Uuid, members: &[(Vec<u8>, String)]) -> Result<String> {
+    use sha2::{Digest, Sha256};
+
+    let mut members = members.to_vec();
+    members.sort_by(|left, right| left.0.cmp(&right.0));
+    let members = members
+        .into_iter()
+        .map(|(pubkey, role)| {
+            if pubkey.len() != 32 || !matches!(role.as_str(), "owner" | "admin" | "member") {
+                return Err(DbError::InvalidData(
+                    "prepared DM membership contains an invalid pubkey or non-wire role".into(),
+                ));
+            }
+            Ok(serde_json::json!({"pubkey": hex::encode(pubkey), "role": role}))
+        })
+        .collect::<Result<Vec<_>>>()?;
+    let value = serde_json::json!({
+        "version": 1,
+        "channelId": channel_id.to_string(),
+        "members": members,
+    });
+    let canonical = canonical_membership_json(&value)?;
+    Ok(format!(
+        "v1:{}",
+        hex::encode(Sha256::digest(canonical.as_bytes()))
+    ))
+}
+
+fn canonical_membership_json(value: &serde_json::Value) -> Result<String> {
+    use serde_json::Value;
+    match value {
+        Value::Null => Ok("null".into()),
+        Value::Bool(value) => Ok(value.to_string()),
+        Value::Number(value) if value.is_i64() || value.is_u64() => Ok(value.to_string()),
+        Value::Number(_) => Err(DbError::InvalidData(
+            "membership revision cannot contain floating-point numbers".into(),
+        )),
+        Value::String(value) => Ok(serde_json::to_string(value)?),
+        Value::Array(values) => Ok(format!(
+            "[{}]",
+            values
+                .iter()
+                .map(canonical_membership_json)
+                .collect::<Result<Vec<_>>>()?
+                .join(",")
+        )),
+        Value::Object(values) => {
+            let mut keys = values.keys().collect::<Vec<_>>();
+            keys.sort_by(|left, right| left.encode_utf16().cmp(right.encode_utf16()));
+            let fields = keys
+                .into_iter()
+                .map(|key| {
+                    Ok(format!(
+                        "{}:{}",
+                        serde_json::to_string(key)?,
+                        canonical_membership_json(&values[key])?
+                    ))
+                })
+                .collect::<Result<Vec<_>>>()?;
+            Ok(format!("{{{}}}", fields.join(",")))
+        }
+    }
+}
+
 /// Add a member to a channel.
 ///
 /// Role enforcement:
diff --git a/crates/buzz-db/src/event.rs b/crates/buzz-db/src/event.rs
index db150571719..c611f90e00a 100644
--- a/crates/buzz-db/src/event.rs
+++ b/crates/buzz-db/src/event.rs
@@ -1302,6 +1302,37 @@ pub async fn insert_event_with_thread_metadata(
     Ok(result)
 }
 
+/// Atomically compare a prepared message's membership revision and insert the
+/// event/thread rows while holding the same advisory transaction lock used by
+/// membership mutations.
+pub async fn insert_prepared_event_with_thread_metadata(
+    pool: &PgPool,
+    community_id: CommunityId,
+    event: &Event,
+    channel_id: Uuid,
+    thread_meta: Option<ThreadMetadataParams<'_>>,
+    expected_membership_revision: &str,
+) -> Result<(StoredEvent, bool)> {
+    let mut tx = pool.begin().await?;
+    crate::channel::acquire_channel_membership_lock(&mut tx, community_id, channel_id).await?;
+    let current = crate::channel::membership_revision_tx(&mut tx, community_id, channel_id).await?;
+    if current != expected_membership_revision {
+        return Err(DbError::AccessDenied(
+            "channel membership revision mismatch".into(),
+        ));
+    }
+    let result = insert_event_with_thread_metadata_tx(
+        &mut tx,
+        community_id,
+        event,
+        Some(channel_id),
+        thread_meta,
+    )
+    .await?;
+    tx.commit().await?;
+    Ok(result)
+}
+
 /// Atomically insert a kind:7 reaction event and its reaction row.
 ///
 /// Ordering is load-bearing: resolve target, upsert/reactivate the reaction row,
diff --git a/crates/buzz-db/src/lib.rs b/crates/buzz-db/src/lib.rs
index 1ba0909bbfb..c749299e1ce 100644
--- a/crates/buzz-db/src/lib.rs
+++ b/crates/buzz-db/src/lib.rs
@@ -2243,6 +2243,35 @@ impl Db {
         Ok(result)
     }
 
+    /// Atomically enforce a prepared message membership revision and insert
+    /// the event plus thread metadata.
+    pub async fn insert_prepared_event_with_thread_metadata(
+        &self,
+        community_id: CommunityId,
+        event: &nostr::Event,
+        channel_id: Uuid,
+        thread_meta: Option<event::ThreadMetadataParams<'_>>,
+        expected_membership_revision: &str,
+    ) -> Result<(StoredEvent, bool)> {
+        let result = event::insert_prepared_event_with_thread_metadata(
+            &self.pool,
+            community_id,
+            event,
+            channel_id,
+            thread_meta,
+            expected_membership_revision,
+        )
+        .await?;
+        if result.1 {
+            if let Err(error) =
+                insert_mentions(&self.pool, community_id, event, Some(channel_id)).await
+            {
+                tracing::warn!(event_id = %event.id, "Failed to insert mentions: {error}");
+            }
+        }
+        Ok(result)
+    }
+
     /// Atomically insert a kind:7 reaction event and its reaction row.
     #[allow(clippy::too_many_arguments)]
     #[datastore_span(
diff --git a/crates/buzz-relay/src/handlers/ingest.rs b/crates/buzz-relay/src/handlers/ingest.rs
index 5ba9650e91e..320f5b594c6 100644
--- a/crates/buzz-relay/src/handlers/ingest.rs
+++ b/crates/buzz-relay/src/handlers/ingest.rs
@@ -50,6 +50,156 @@ use crate::conformance::{
     state_for_request, EmitGuard, TraceAction, Verdict,
 };
 
+/// Observable outcome of the prepared-event membership race probe.
+#[derive(Debug)]
+pub struct MembershipRevisionRaceReport {
+    /// Whether both operations addressed the canonical membership lock domain.
+    pub used_existing_membership_advisory_lock: bool,
+    /// Whether the prepared insertion remained blocked until removal committed.
+    pub removal_and_publish_were_serialized: bool,
+    /// Whether the post-lock revision re-read rejected the stale event.
+    pub stale_publish_rejected: bool,
+    /// Whether the rejected stale event nevertheless appeared in storage.
+    pub stale_event_was_stored: bool,
+}
+
+/// Exercise the lock/revision state transition used by the database admission
+/// path without requiring a relay process. Database integration coverage drives
+/// the same exported lock-key and revision helpers against Postgres.
+pub async fn run_membership_revision_race_probe_for_test(
+) -> Result<MembershipRevisionRaceReport, String> {
+    use nostr::{EventBuilder, Keys, Kind, Tag};
+
+    let database_url = std::env::var("BUZZ_TEST_DATABASE_URL").map_err(|_| {
+        "BUZZ_TEST_DATABASE_URL must name an explicit isolated migrated Postgres".to_string()
+    })?;
+    let pool = sqlx::postgres::PgPoolOptions::new()
+        .max_connections(4)
+        .connect(&database_url)
+        .await
+        .map_err(|error| format!("requires reachable migrated Postgres: {error}"))?;
+    let db = buzz_db::Db::from_pool(pool.clone());
+    let host = format!("prepared-race-{}.example", Uuid::new_v4().simple());
+    let community_record = db
+        .ensure_configured_community(&host)
+        .await
+        .map_err(|error| error.to_string())?;
+    let community = community_record.id;
+    let owner = Keys::generate();
+    let agent = Keys::generate();
+    let owner_bytes = owner.public_key().to_bytes();
+    let agent_bytes = agent.public_key().to_bytes();
+    buzz_db::user::ensure_user(&pool, community, &owner_bytes)
+        .await
+        .map_err(|error| error.to_string())?;
+    buzz_db::user::ensure_user(&pool, community, &agent_bytes)
+        .await
+        .map_err(|error| error.to_string())?;
+    let channel = db
+        .create_channel(
+            community,
+            "prepared-race",
+            buzz_db::channel::ChannelType::Dm,
+            buzz_db::channel::ChannelVisibility::Private,
+            None,
+            &owner_bytes,
+            None,
+        )
+        .await
+        .map_err(|error| error.to_string())?;
+    db.add_member(
+        community,
+        channel.id,
+        &agent_bytes,
+        buzz_db::channel::MemberRole::Member,
+        Some(&owner_bytes),
+    )
+    .await
+    .map_err(|error| error.to_string())?;
+    let revision = buzz_db::channel::membership_revision(
+        channel.id,
+        &[
+            (owner_bytes.to_vec(), "owner".to_string()),
+            (agent_bytes.to_vec(), "member".to_string()),
+        ],
+    )
+    .map_err(|error| error.to_string())?;
+    let event = EventBuilder::new(Kind::Custom(9), "prepared race reply")
+        .tags([
+            Tag::parse(["h", channel.id.to_string().as_str()])
+                .map_err(|error| error.to_string())?,
+            Tag::parse(["buzz_membership_revision", revision.as_str()])
+                .map_err(|error| error.to_string())?,
+        ])
+        .sign_with_keys(&agent)
+        .map_err(|error| error.to_string())?;
+
+    // Begin the removal transaction, take the exact shared advisory key, and
+    // mutate membership without committing. A prepared insert started now must
+    // block on the same key; after commit it must re-read and reject the old
+    // signed revision rather than storing the event.
+    let mut removal = pool.begin().await.map_err(|error| error.to_string())?;
+    let lock_key = buzz_db::channel::channel_membership_lock_key(community, channel.id);
+    sqlx::query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))")
+        .bind(&lock_key)
+        .execute(&mut *removal)
+        .await
+        .map_err(|error| error.to_string())?;
+    sqlx::query(
+        "UPDATE channel_members SET removed_at = NOW(), removed_by = $1 \
+         WHERE community_id = $2 AND channel_id = $3 AND pubkey = $4 AND removed_at IS NULL",
+    )
+    .bind(owner_bytes.as_slice())
+    .bind(community.as_uuid())
+    .bind(channel.id)
+    .bind(agent_bytes.as_slice())
+    .execute(&mut *removal)
+    .await
+    .map_err(|error| error.to_string())?;
+
+    let publish_db = db.clone();
+    let publish_event = event.clone();
+    let publish_revision = revision.clone();
+    let mut publish = tokio::spawn(async move {
+        publish_db
+            .insert_prepared_event_with_thread_metadata(
+                community,
+                &publish_event,
+                channel.id,
+                None,
+                &publish_revision,
+            )
+            .await
+    });
+    let blocked = tokio::time::timeout(std::time::Duration::from_millis(500), &mut publish)
+        .await
+        .is_err();
+    removal.commit().await.map_err(|error| error.to_string())?;
+    let publish_result = publish.await.map_err(|error| error.to_string())?;
+    let stale_rejected = matches!(
+        publish_result,
+        Err(buzz_db::DbError::AccessDenied(ref reason))
+            if reason == "channel membership revision mismatch"
+    );
+    let stored: i64 =
+        sqlx::query_scalar("SELECT COUNT(*) FROM events WHERE community_id = $1 AND id = $2")
+            .bind(community.as_uuid())
+            .bind(event.id.as_bytes().as_slice())
+            .fetch_one(&pool)
+            .await
+            .map_err(|error| error.to_string())?;
+    let _ = sqlx::query("DELETE FROM communities WHERE id = $1")
+        .bind(community.as_uuid())
+        .execute(&pool)
+        .await;
+    Ok(MembershipRevisionRaceReport {
+        used_existing_membership_advisory_lock: lock_key.starts_with("buzz_channel_membership:"),
+        removal_and_publish_were_serialized: blocked,
+        stale_publish_rejected: stale_rejected,
+        stale_event_was_stored: stored != 0,
+    })
+}
+
 fn validate_custom_emoji_tags(event: &Event) -> Result<(), IngestError> {
     for tag in event.tags.iter() {
         let parts = tag.as_slice();
@@ -65,6 +215,40 @@ fn validate_custom_emoji_tags(event: &Event) -> Result<(), IngestError> {
     Ok(())
 }
 
+fn prepared_membership_revision(event: &Event) -> Result<Option<&str>, IngestError> {
+    let revision_tags = event
+        .tags
+        .iter()
+        .filter(|tag| {
+            let values = tag.as_slice();
+            values.first().map(String::as_str) == Some("buzz_membership_revision")
+        })
+        .collect::<Vec<_>>();
+    if revision_tags.is_empty() {
+        return Ok(None);
+    }
+    if event.kind.as_u16() != KIND_STREAM_MESSAGE as u16
+        || revision_tags.len() != 1
+        || revision_tags[0].as_slice().len() != 2
+    {
+        return Err(IngestError::Rejected(
+            "invalid: membership revision is allowed exactly once on kind 9".into(),
+        ));
+    }
+    let revision = &revision_tags[0].as_slice()[1];
+    let Some(hex) = revision.strip_prefix("v1:") else {
+        return Err(IngestError::Rejected(
+            "invalid: membership revision must use v1".into(),
+        ));
+    };
+    if hex.len() != 64 || !hex.chars().all(|character| character.is_ascii_hexdigit()) {
+        return Err(IngestError::Rejected(
+            "invalid: membership revision digest must be 64 hex characters".into(),
+        ));
+    }
+    Ok(Some(revision))
+}
+
 fn validate_reaction_emoji(event: &Event, emoji: &str) -> Result<(), IngestError> {
     let emoji_char_count = emoji.chars().count();
     if emoji_char_count <= 64 {
@@ -2019,6 +2203,7 @@ async fn ingest_event_inner(
             event.content.len()
         )));
     }
+    let prepared_revision = prepared_membership_revision(&event)?;
 
     let is_gift_wrap = kind_u32 == KIND_GIFT_WRAP;
     if event.pubkey != *auth.pubkey() && !is_gift_wrap {
@@ -2934,16 +3119,37 @@ async fn ingest_event_inner(
             .map_err(|e| IngestError::Internal(format!("error: {e}")))?
     } else {
         let thread_params = thread_meta.as_ref().map(|m| m.as_params());
-        match state
-            .db
-            .insert_event_with_thread_metadata(
-                tenant.community(),
-                &event,
-                channel_id,
-                thread_params,
-            )
-            .await
-        {
+        let insert_result = match (prepared_revision, channel_id) {
+            (Some(revision), Some(channel_id)) => {
+                state
+                    .db
+                    .insert_prepared_event_with_thread_metadata(
+                        tenant.community(),
+                        &event,
+                        channel_id,
+                        thread_params,
+                        revision,
+                    )
+                    .await
+            }
+            (Some(_), None) => {
+                return Err(IngestError::Rejected(
+                    "invalid: prepared event requires a channel".into(),
+                ));
+            }
+            (None, _) => {
+                state
+                    .db
+                    .insert_event_with_thread_metadata(
+                        tenant.community(),
+                        &event,
+                        channel_id,
+                        thread_params,
+                    )
+                    .await
+            }
+        };
+        match insert_result {
             Ok(result) => result,
             Err(e) => {
                 // Compensate: if we pre-created a channel for kind:9007,
@@ -2962,6 +3168,13 @@ async fn ingest_event_inner(
                     buzz_db::DbError::AuthEventRejected => {
                         IngestError::Rejected("invalid: AUTH events cannot be stored".into())
                     }
+                    buzz_db::DbError::AccessDenied(reason)
+                        if reason == "channel membership revision mismatch" =>
+                    {
+                        IngestError::Rejected(
+                            "restricted: channel membership changed after reply preparation".into(),
+                        )
+                    }
                     other => IngestError::Internal(format!("error: database error: {other}")),
                 });
             }
diff --git a/crates/buzz-relay/tests/membership_revision_precondition.rs b/crates/buzz-relay/tests/membership_revision_precondition.rs
new file mode 100644
index 00000000000..2afd43b32f1
--- /dev/null
+++ b/crates/buzz-relay/tests/membership_revision_precondition.rs
@@ -0,0 +1,24 @@
+#[tokio::test]
+#[ignore = "requires explicit isolated BUZZ_TEST_DATABASE_URL; run with --ignored --exact"]
+async fn rejects_dm_publish_after_membership_changes() {
+    let report = buzz_relay::handlers::ingest::run_membership_revision_race_probe_for_test()
+        .await
+        .expect("membership revision race probe");
+
+    assert!(
+        report.used_existing_membership_advisory_lock,
+        "prepared publish must share the existing buzz_channel_membership advisory transaction lock with member mutations",
+    );
+    assert!(
+        report.removal_and_publish_were_serialized,
+        "concurrent removal and prepared publish must have a total serial order",
+    );
+    assert!(
+        report.stale_publish_rejected,
+        "a prepared reply with the old revision must be rejected after the DM membership changes",
+    );
+    assert!(
+        !report.stale_event_was_stored,
+        "revision comparison and event insert must be atomic in one transaction",
+    );
+}