Appendix B — Reserved ranges

1. Reserved message-ID ranges

For implementers extending the protocol:

• WORKLOAD_RESPONSE = 0x04 and WORKLOAD_CHALLENGE = 0x84 are allocated to the endpoint-neutral phux-workload/v1 profile (workload-auth.md); 0x05..=0x0F and 0x85..=0x8F remain open for connection lifecycle.
• 0x14 is allocated, 0x15 is retired, HISTORY_REQUEST = 0x16 and INPUT_TERMINAL_REPLY = 0x17 are allocated, and 0x18..=0x1F remain open. 0x91 is permanently retired. BOOTSTRAP_BEGIN..BOOTSTRAP_TOMBSTONE = 0x93..=0x97, HISTORY_TOMBSTONE = 0x98, and HISTORY_REJECTED = 0x99 are allocated; FRAME_COMPRESSED = 0x9A (proto.md §6.4) is allocated from the hot-path reserve, which it belongs in: it wraps the hot path’s largest frames. 0x9B..=0x9F remain open for hot-path messages.
• Message IDs 0x24..=0x2F and 0xA3..=0xAF: reserved for further L1 Terminal lifecycle / per-pane control frames (phux-4li.10 allocated 0x22..=0x23 C→S and 0xA1..=0xA2 S→C from these ranges).
• Message IDs 0x31..=0x3F and 0xC2..=0xCF: reserved for control plane.
• Message IDs 0x41..=0x4F and 0xB3..=0xBF: reserved for events (phux-y2t allocated SUBSCRIBE_EVENTS = 0x41 C→S and EVENT = 0xB3 S→C from these ranges; 0x42..=0x4F and 0xB4..=0xBF remain open).

2. Command-tag allocations

Commands ride the generic COMMAND envelope (L1.md §1) and carry their own one-byte tag inside it. Allocated tags:

KILL_TERMINALS at tag 0x09 reuses the slot freed by the removed CREATE_SESSION command. Per ADR-0030 (option B), the leaked session/collection lifecycle verbs are withdrawn and their tags are freed:

• 0x09 — formerly CREATE_SESSION; reallocated to KILL_TERMINALS.
• 0x0a — formerly RENAME_SESSION; freed, reserved, not reallocated. Rename is now an L3 metadata SET on phux.session.name/v1 (L3.md §3).
• 0x0b — formerly KILL_COLLECTION; freed, reserved, not reallocated. Group teardown is KILL_TERMINALS.

A freed tag SHALL NOT be reallocated to an unrelated command without a PROTOCOL_VERSION bump, so that an old client speaking a withdrawn verb fails loudly rather than invoking new behavior.

3. Reserved enum ranges

PhysicalKey enum values and ErrorCode enum values are allocated sequentially. Implementers proposing new values open a PR against this document.

ErrorCode = 5 is permanently reserved for the withdrawn OUT_OF_TIER proposal and is never reused. CODEC_UNAVAILABLE = 6 is allocated by ADR-0070.

DetachReason (proto.md §7.2) allocates sequentially from 0 — 0..=7 are taken, with workload-auth values 5..=7 still spec-only — and 255 is permanently reserved for INTERNAL_ERROR. It differs from the enums above in how an unallocated value decodes: a consumer MUST read one it does not recognise as an unstated reason rather than as a decode error, because DETACHED is the termination signal and failing it would both hide the ending and make each new value a fleet-wide break. New values are therefore additive and need no version bump.

(Earlier drafts of the SPEC reserved a DiffOp tag range here; per ADR-0013, Terminal content is now a VT byte stream and DiffOp no longer exists as a wire concept.)