@@ -38,3 +38,23 @@ jobs:
           name: test-results
           path: '**/target/surefire-reports/'
           retention-days: 7
+
+  # Issue #14 only reproduced when the JVM was starved of cores: the agent's lock release
+  # and the client's next prompt race on one CPU. Pin the contention tests to one core so
+  # the window stays open in CI.
+  contention:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: maven
+
+      - name: Contention tests pinned to one CPU
+        run: taskset -c 0 ./mvnw -B -pl acp-core -am test -Dtest='MultiPromptSyncSessionTest,AcpAgentSessionPromptLockTest' -Dsurefire.failIfNoSpecifiedTests=false
@@ -0,0 +1,40 @@
+# ACP Java SDK Agent Instructions
+
+This public repository owns code, tests, Maven builds, releases, shipped contracts, and public
+documentation. Private planning and control state are authoritative in
+`/home/mark/projects/acp-java-steward`; read its `BINDING.md` before planning or executing work.
+
+This repository belongs to the `agentclientprotocol` organization and is maintained, not owned,
+from that steward. Repository settings, secrets, branch protection and organization membership are
+the organization's; do not plan work that assumes them.
+
+Use `./mvnw`, never `mvn`. The normal gate is `./mvnw clean verify`, which runs the unit tests and
+the `*IT` integration classes through Failsafe. Before 0.15.0 the integration tests never ran, so
+"tests pass" on older history did not include them.
+
+Releases happen only by dispatching the organization's `release.yml` workflow; a local
+`-Prelease deploy` is not a path, because the local publishing token is not entitled to the
+`com.agentclientprotocol` namespace. The workflow's release commit bumps the six `pom.xml` files and
+tags; it does not touch `CHANGELOG.md`. Keep the changelog current by hand, in the same change
+that earns the entry.
+
+The wire format is the contract. Polymorphic types write their discriminator exactly once
+(`Access.WRITE_ONLY` on the record component, `visible = true` on the type info); a duplicate JSON
+key passes Jackson-based peers and breaks strict ones. Unstable protocol methods carry
+`@UnstableAcpApi`; a method without it is a stable promise.
+
+Client-session notifications are delivered in order through a single sink drained by `concatMap`,
+and `closeGracefully()` waits for that drain, bounded by the request timeout, while `close()`
+interrupts. Sync clients always have async handlers, because every sync consumer is wrapped in
+`subscribeOn`. Keep both properties when touching `AcpClientSession` or a transport, and add the
+test that would have caught their loss.
+
+Fixtures and reproductions come from the protocol's own schema or a real peer, not from memory of
+what the schema said. The canonical spec is `agentclientprotocol/agent-client-protocol`; check the
+released schema version before adding or changing a method.
+
+The project is Apache-2.0 with the verbatim license text; `LICENSE` and `NOTICE` ship in every
+artifact. Commit messages contain no AI attribution.
+
+Do not copy private planning, current-action, roadmap, checkpoint, or dirty-tree state into public
+files. The ignored `plans/` tree in a checkout is transition material, not public authority.
@@ -9,6 +9,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **A second client on an already-connected transport now fails at construction.** A transport
+  instance carries exactly one session. `StdioAcpClientTransport.connect()` had no once-only guard
+  (the WebSocket and agent transports did), so a second `AcpClient.async(transport)` or
+  `AcpClient.sync(transport)` on the same instance subscribed the transport's unicast inbound sink a
+  second time — logged and dropped as `Sinks.many().unicast() sinks only allow a single
+  Subscriber` — and then started a second agent process, whose owner could never receive a
+  response: its first request timed out after the full `requestTimeout`. That is the Spring Boot
+  autoconfiguration failure reported in June 2026 (both an `AcpAsyncClient` and an `AcpSyncClient`
+  bean built from one transport bean); it never depended on the Reactor or Boot version. Now the
+  stdio transport refuses a second `connect()`, and `AcpClientSession` / `AcpAgentSession` surface a
+  connect or start failure instead of dropping it: construction throws `IllegalStateException` when
+  the transport refuses synchronously, and every later request fails immediately with the cause.
+
+- **Second prompt on a session could be rejected or hang under CPU contention (#14).** The agent
+  released its single-turn prompt lock in `doFinally`, *after* the response had already reached the
+  client. On a starved machine (`taskset -c 0`, busy CI runners) the client's next prompt arrived
+  before that release and was rejected with `-32000 There is already an active prompt execution`;
+  the rejection's emission then collided with the still-running response emission on the same sink
+  (`FAIL_NON_SERIALIZED`), which the shipped transports silently dropped and the in-memory test
+  transport turned into a fatal error for the agent, so `AcpSyncClient.prompt` waited out the full
+  `requestTimeout`. The lock is now released before the response is published, on the success and
+  error paths alike, and a handler that throws before returning its `Mono` no longer holds the lock
+  forever. Response emission in `StdioAcpAgentTransport`, `WebSocketAcpClientTransport`,
+  `WebSocketAcpAgentTransport` and `InMemoryTransportPair` is serialised the way `sendMessage`
+  already was, and a failed emission in the in-memory pair no longer terminates the agent. The
+  reporter's repro is now a test, and CI runs the contention tests pinned to one CPU. Reported by
+  @krickert.
+- The agent session now reads `sessionId` from typed `PromptRequest`/`CancelNotification` params as
+  well as from maps, so in-process transports get the right lock owner in logs and cancel matching.
+
+### Changed
+
+- **Unknown-field policy moved from the schema to the mapper (#10).** Every schema record carried
+  `@JsonIgnoreProperties(ignoreUnknown = true)`, which made the SDK tolerate fields it does not know
+  (deliberate: the spec adds fields between releases and a newer agent must keep working) but also
+  defeated any consumer's strict `ObjectMapper`, since a class-level annotation wins over
+  `FAIL_ON_UNKNOWN_PROPERTIES`. The annotations are gone. The default mapper,
+  `JacksonAcpJsonMapper.defaultObjectMapper()`, is lenient and logs each ignored property at DEBUG
+  so spec drift is observable; a consumer who passes a strict mapper to `JacksonAcpJsonMapper` now
+  gets strict behaviour. **If you construct `JacksonAcpJsonMapper` with a bare `new ObjectMapper()`,
+  you now get Jackson's default, which fails on unknown fields**: start from
+  `defaultObjectMapper()` instead. Unknown fields are not routed into `_meta`, which has its own
+  spec-defined meaning. Reported by @KallivdH.
+
+### Added
+
+- `AcpSyncClient(AcpAsyncClient)` is public: the supported way to have both APIs over one session.
+
+## [0.17.0] - 2026-08-28
+
+Wire-format correction. No public API change: every constructor and accessor is unchanged, and the
+ACP surface is identical to 0.16.1.
+
+### Fixed
+
 - **Duplicate discriminator on the wire.** Every polymorphic type declared its discriminator twice —
   once as Jackson's `@JsonTypeInfo` property on the interface and again as an explicit
   `@JsonProperty` record component — so both wrote it. `new TextContent("hello")` serialised to
@@ -19,6 +74,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   and is still populated on deserialization — previously it deserialised to `null`. 27 records
   across 6 hierarchies. No API change: every constructor and accessor is unchanged.
 
+## [0.16.1] - 2026-08-24
+
+Release-tooling patch. No protocol, dependency-closure or public API changes beyond a SLF4J patch
+bump: the ACP surface is identical to 0.16.0.
+
+### Build
+
+- **Consumer-scoped SBOMs.** Every module artifact now publishes a CycloneDX 1.6 SBOM (classifier
+  `cyclonedx`) rooted at that module and covering its compile and runtime scope only, so a
+  consumer's dependency closure can be checked against what the artifact actually ships.
+- The release workflow commits the release version bump before tagging, so each `vX.Y.Z` tag now
+  points at a commit whose POMs carry that version.
+
+### Changed
+
+- SLF4J 2.0.17 → **2.0.18**.
+
 ## [0.16.0] - 2026-08-24
 
 Maintenance dependency and release-tooling refresh. No protocol or public API changes: the ACP
@@ -204,5 +276,7 @@ Protocol currency: catching up to ACP spec v0.13.6 (June 2026). Supersedes the n
 - SLF4J 2.0.16
 
 [0.9.0]: https://github.com/agentclientprotocol/java-sdk/releases/tag/v0.9.0
+[0.17.0]: https://github.com/agentclientprotocol/java-sdk/releases/tag/v0.17.0
+[0.16.1]: https://github.com/agentclientprotocol/java-sdk/releases/tag/v0.16.1
 [0.16.0]: https://github.com/agentclientprotocol/java-sdk/releases/tag/v0.16.0
 [0.15.0]: https://github.com/agentclientprotocol/java-sdk/releases/tag/v0.15.0
@@ -30,7 +30,7 @@ Three API styles for building agents:
 <dependency>
     <groupId>com.agentclientprotocol</groupId>
     <artifactId>acp-core</artifactId>
-    <version>0.16.0</version>
+    <version>0.17.0</version>
 </dependency>
 ```
 
@@ -39,7 +39,7 @@ For annotation-based agent development:
 <dependency>
     <groupId>com.agentclientprotocol</groupId>
     <artifactId>acp-agent-support</artifactId>
-    <version>0.16.0</version>
+    <version>0.17.0</version>
 </dependency>
 ```
 
@@ -48,7 +48,7 @@ For WebSocket server support (agents accepting WebSocket connections):
 <dependency>
     <groupId>com.agentclientprotocol</groupId>
     <artifactId>acp-websocket-jetty</artifactId>
-    <version>0.16.0</version>
+    <version>0.17.0</version>
 </dependency>
 ```
 
@@ -476,7 +476,18 @@ If you need a stable target, pin to an exact version.
 
 ## Releases
 
-### 0.16.0 (Current — [Maven Central](https://central.sonatype.com/artifact/com.agentclientprotocol/acp-core))
+### 0.17.0 (Current — [Maven Central](https://central.sonatype.com/artifact/com.agentclientprotocol/acp-core))
+
+Wire-format correction with no API change: every polymorphic discriminator (`type`, `sessionUpdate`,
+`outcome`) was written twice, which Jackson-based peers tolerated and strict parsers rejected. It is
+now written exactly once and still populated on deserialization.
+
+### 0.16.1 ([Maven Central](https://central.sonatype.com/artifact/com.agentclientprotocol/acp-core))
+
+Release-tooling patch preserving the 0.16 protocol and public API surface: every artifact ships a
+consumer-scoped CycloneDX SBOM, and release tags point at commits carrying the released version.
+
+### 0.16.0 ([Maven Central](https://central.sonatype.com/artifact/com.agentclientprotocol/acp-core))
 
 Maintenance release preserving the 0.15 protocol and public API surface while advancing Reactor to
 3.8.7, Jackson to 2.22.2, Jetty to 12.1.12, and the compatible stable test and release toolchain.
 
@@ -158,7 +158,15 @@ private void handleIncomingMessages(Function<Mono<JSONRPCMessage>, Mono<JSONRPCM
 			.flatMap(message -> Mono.just(message).transform(handler))
 			.doOnNext(response -> {
 				if (response != null) {
-					this.outboundSink.tryEmitNext(response);
+					// Responses are emitted from the inbound thread while sendMessage emits
+					// from user threads on the same sink; both must go through the serialising
+					// busy-loop or a collision drops the response (FAIL_NON_SERIALIZED, #14).
+					try {
+						this.outboundSink.emitNext(response, Sinks.EmitFailureHandler.busyLooping(Duration.ofMillis(100)));
+					}
+					catch (Sinks.EmissionException e) {
+						logger.error("Dropped response {}: {}", response, e.getReason());
+					}
 				}
 			})
 			.doOnTerminate(() -> {
 
@@ -76,11 +76,18 @@ public class AcpSyncClient implements AutoCloseable {
 	private final AcpAsyncClient delegate;
 
 	/**
-	 * Creates a new AcpSyncClient with the given async delegate.
+	 * Creates a synchronous facade over an existing asynchronous client.
+	 *
+	 * <p>
+	 * Both clients share the one session and the one transport connection behind
+	 * {@code delegate}: use this when an application needs both APIs, because a transport
+	 * instance carries exactly one session, and building a second client on an
+	 * already-connected transport fails. Closing either client closes the shared session.
+	 * </p>
 	 * @param delegate the asynchronous client on top of which this synchronous client
 	 * provides a blocking API
 	 */
-	AcpSyncClient(AcpAsyncClient delegate) {
+	public AcpSyncClient(AcpAsyncClient delegate) {
 		Assert.notNull(delegate, "Delegate must not be null");
 		this.delegate = delegate;
 	}
 
@@ -12,6 +12,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.Executors;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.Consumer;
 import java.util.function.Function;
 
@@ -76,6 +77,13 @@ public class StdioAcpClientTransport implements AcpClientTransport {
 
 	private volatile boolean isClosing = false;
 
+	/**
+	 * A transport instance carries exactly one session. {@link #connect} subscribes the
+	 * unicast inbound and outbound sinks and starts the agent process; a second call would
+	 * subscribe them again and start a second process, so it is refused up front.
+	 */
+	private final AtomicBoolean isConnected = new AtomicBoolean(false);
+
 	// visible for tests
 	private Consumer<String> stdErrorHandler = error -> logger.info("STDERR Message received: {}", error);
 
@@ -135,39 +143,49 @@ public StdioAcpClientTransport(AgentParameters params, AcpJsonMapper jsonMapper)
 	 */
 	@Override
 	public Mono<Void> connect(Function<Mono<JSONRPCMessage>, Mono<JSONRPCMessage>> handler) {
-		return Mono.<Void>fromRunnable(() -> {
-			logger.info("ACP agent starting.");
-			handleIncomingMessages(handler);
-			handleIncomingErrors();
+		// The guard runs at subscribe time, not at assembly, so a connect publisher that is
+		// subscribed twice is refused the second time and one that is never subscribed does
+		// not consume the connection.
+		return Mono.defer(() -> {
+			if (!isConnected.compareAndSet(false, true)) {
+				return Mono.error(new IllegalStateException("StdioAcpClientTransport is already connected. "
+						+ "A transport instance carries exactly one session and cannot be reused: build one client per "
+						+ "transport, or share one AcpAsyncClient by wrapping it with new AcpSyncClient(asyncClient)."));
+			}
+			return Mono.<Void>fromRunnable(() -> {
+				logger.info("ACP agent starting.");
+				handleIncomingMessages(handler);
+				handleIncomingErrors();
 
-			// Prepare command and environment
-			List<String> fullCommand = new ArrayList<>();
-			fullCommand.add(params.getCommand());
-			fullCommand.addAll(params.getArgs());
+				// Prepare command and environment
+				List<String> fullCommand = new ArrayList<>();
+				fullCommand.add(params.getCommand());
+				fullCommand.addAll(params.getArgs());
 
-			ProcessBuilder processBuilder = this.getProcessBuilder();
-			processBuilder.command(fullCommand);
-			processBuilder.environment().putAll(params.getEnv());
+				ProcessBuilder processBuilder = this.getProcessBuilder();
+				processBuilder.command(fullCommand);
+				processBuilder.environment().putAll(params.getEnv());
 
-			// Start the process
-			try {
-				this.process = processBuilder.start();
-			}
-			catch (IOException e) {
-				throw new RuntimeException("Failed to start process with command: " + fullCommand, e);
-			}
+				// Start the process
+				try {
+					this.process = processBuilder.start();
+				}
+				catch (IOException e) {
+					throw new RuntimeException("Failed to start process with command: " + fullCommand, e);
+				}
 
-			// Validate process streams
-			if (this.process.getInputStream() == null || process.getOutputStream() == null) {
-				this.process.destroy();
-				throw new RuntimeException("Process input or output stream is null");
-			}
+				// Validate process streams
+				if (this.process.getInputStream() == null || process.getOutputStream() == null) {
+					this.process.destroy();
+					throw new RuntimeException("Process input or output stream is null");
+				}
 
-			// Start threads
-			startInboundProcessing();
-			startOutboundProcessing();
-			startErrorProcessing();
-			logger.info("ACP agent started");
+				// Start threads
+				startInboundProcessing();
+				startOutboundProcessing();
+				startErrorProcessing();
+				logger.info("ACP agent started");
+			});
 		});
 	}
 
 
@@ -167,7 +167,15 @@ private void handleIncomingMessages(Function<Mono<JSONRPCMessage>, Mono<JSONRPCM
 			.flatMap(message -> Mono.just(message).transform(handler))
 			.doOnNext(response -> {
 				if (response != null) {
-					this.outboundSink.tryEmitNext(response);
+					// Responses are emitted from the inbound thread while sendMessage emits
+					// from user threads on the same sink; both must go through the serialising
+					// busy-loop or a collision drops the response (FAIL_NON_SERIALIZED, #14).
+					try {
+						this.outboundSink.emitNext(response, Sinks.EmitFailureHandler.busyLooping(Duration.ofMillis(100)));
+					}
+					catch (Sinks.EmissionException e) {
+						logger.error("Dropped response {}: {}", response, e.getReason());
+					}
 				}
 			})
 			.doOnTerminate(() -> {