@agentsdock/server 1.0.10-beta.1 → 1.0.10-beta.6

package/server/claude_goals.py

@@ -138,13 +138,19 @@ class ClaudeGoalProjection:
     def consume(self, event: Any) -> bool:
         """Fold one native JSONL record; return whether visible goal changed."""
         if not isinstance(event, dict) or (
-            event.get("type") != "attachment"
+            event.get("type") not in {"attachment", "system"}
             or event.get("sessionId") != self.provider_session_id
             or event.get("isSidechain") is not False
         ):
             return False
         attachment = event.get("attachment")
-        if not isinstance(attachment, dict) or attachment.get("type") != "goal_status":
+        content = event.get("content")
+        stopped = (event.get("type") == "system" and event.get("subtype") == "informational"
+                   and event.get("level") == "warning" and isinstance(content, str)
+                   and re.match(r"\AA hook blocked the turn from ending [0-9]+ consecutive times [—-] overriding and ending turn\.", content))
+        if stopped:
+            attachment = {"type": "goal_status", "condition": (self.goal or {}).get("condition"), "met": False}
+        elif not isinstance(attachment, dict) or attachment.get("type") != "goal_status":
             return False
         event_id = event.get("uuid")
         if not isinstance(event_id, str) or len(event_id) != 36:
@@ -175,10 +181,16 @@ class ClaudeGoalProjection:
                 return False
             goal = dict(previous)
             goal["status"] = "cleared" if sentinel else "achieved" if met else "active"
+            if stopped:
+                goal["execution_stop_reason"] = "continuation_limit"
+                goal["execution_stopped_at"] = timestamp
+            else:
+                goal.pop("execution_stop_reason", None)
+                goal.pop("execution_stopped_at", None)
             if sentinel:
                 for field in ("iterations", "duration_ms", "tokens"):
                     goal.pop(field, None)
-            if not sentinel:
+            if not sentinel and not stopped:
                 reason = attachment.get("reason")
                 if isinstance(reason, str) and reason:
                     goal["last_reason"] = reason[:8192]
@@ -233,7 +245,7 @@ class ClaudeGoalProjection:
             if self._discard_line:
                 self._discard_line = False
                 continue
-            if len(line) > MAX_GOAL_RECORD_BYTES or b'"goal_status"' not in line:
+            if len(line) > MAX_GOAL_RECORD_BYTES or not (b'"goal_status"' in line or b"A hook blocked the turn from ending" in line):
                 continue
             try:
                 self.consume(json.loads(line))

package/server/codex_app_server.py

@@ -1088,6 +1088,8 @@ class CodexAppServerClient:
         self._next_id += 1
         request_id = self._next_id
         future: asyncio.Future[Any] = loop.create_future()
+        # Preserve request ownership for per-chat process handoff.
+        future._codex_thread_id = str((params or {}).get("threadId") or (params or {}).get("ancestorThreadId") or "")
         self._pending[request_id] = (
             method,
             future,
@@ -1557,6 +1559,7 @@ class CodexAppServerClient:
                         previous,
                     )
                 )
+            task._codex_thread_id = thread_id
             self._callback_tails[owner] = task
             self._callback_tasks.add(task)
             task.add_done_callback(
@@ -1619,6 +1622,7 @@ class CodexAppServerClient:
             self._handle_server_request(request_id, method, params),
             name=f"codex-app-server-request-{request_id}",
         )
+        task._codex_thread_id = str(params.get("threadId") or "")
         self._server_request_tasks[request_id] = task
         task.add_done_callback(
             lambda done, rid=request_id: self._finish_server_request(rid, done)

package/server/codex_auth.py

@@ -28,6 +28,37 @@ HANDOFF_MESSAGE = (
 )
 _REVISION_KEY = secrets.token_bytes(32)
 _MAX_AUTH_BYTES = 128 * 1024
+HANDOFF_PROBE_FAILURES = frozenset({"thread_list_unavailable", "goal_state_unavailable",
+    "terminal_state_unavailable", "ownership_deadline", "native_unsubscribe_incomplete", "writer_release_failed"})
+
+
+def handoff_detail(reason: str) -> dict:
+    """Content-free admission status, distinct from a native auth rejection."""
+    reasons = {
+        "active_turn": "this chat still has a running turn",
+        "maintenance": "this chat is finishing a provider operation",
+        "approval": "this chat has an unanswered approval or question",
+        "side_chat": "this chat has a running Side chat",
+        "active_goal": "this chat has an active goal",
+        "native_goal_active": "Codex reports an active goal for this chat",
+        "subagents": "this chat has running subagents",
+        "callback": "this chat is finishing a provider notification",
+        "runtime_request": "a provider request for this chat is still finishing",
+        "native_thread_in_use": "Codex still has work using this thread",
+        "background_terminals": "this chat has a running background terminal",
+        "thread_list_unavailable": "Codex could not report which threads it owns",
+        "goal_state_unavailable": "Codex could not report this chat's goal state",
+        "terminal_state_unavailable": "Codex could not report this chat's background terminals",
+        "ownership_deadline": "Codex took too long to report this chat's state",
+        "native_unsubscribe_incomplete": "Codex has not released this thread yet",
+        "writer_release_failed": "Codex could not release the old connection to this thread",
+    }
+    reason = reason if reason in reasons else "runtime_request"
+    action = ("Retry the message to check again." if reason in HANDOFF_PROBE_FAILURES
+              else "Retry after that operation finishes.")
+    return {"code": "codex_login_handoff", "reason": reason, "retryable": True,
+            "message": f"Codex sign-in handoff is waiting: {reasons[reason]}. "
+                       f"Your message has not been sent. {action}"}
 
 
 @dataclass(frozen=True)

package/server/codex_history_repair.py

@@ -202,10 +202,26 @@ def _native_records(path: Path, expected: tuple[int, int, int, int], budget: _Na
 
 def _native_event_identity(event: dict) -> dict:
     """Keep bounded public identity, never retain tool bodies or message text."""
-    return {key: event[key] for key in ("id", "seq", "type", "phase", "item_id")
+    return {key: event[key] for key in ("id", "seq", "type", "phase", "item_id", "provider_thread_id", "provider_turn_id")
             if key in event and (type(event[key]) is int or isinstance(event[key], str) and len(event[key]) <= 256)}
 
 
+def _native_goal_steer_turn(event: dict) -> str | None:
+    """Accepted goal follow-ups already have a user bubble in this chat.
+
+    Keep their exact native turn: one goal run can span many provider turns,
+    including later genuine messages with identical text.
+    """
+    turn = event.get("provider_turn_id")
+    if (event.get("type") == "turn_steered" and event.get("backend") == "codex"
+        and event.get("purpose") == "codex_goal_resume"
+        and event.get("native_goal_steer") is True and event.get("native_steer") is True
+        and event.get("provider_user_authored") is True
+        and isinstance(turn, str) and 0 < len(turn) <= 256):
+        return turn
+    return None
+
+
 def _native_import_batch(event: dict) -> dict:
     result = {key: event.get(key) for key in ("seq", "provider_session_id", "source_path")}
     checkpoint = event.get("_history_sync_checkpoint")
@@ -242,10 +258,13 @@ def _native_owned_turn_ids(event: dict) -> set[str]:
             if isinstance(value := event.get(field), str) and 0 < len(value) <= 256}
 
 
-def _native_assistant_item_owners(assistant_items: dict, completed_runs: set[str]) -> dict:
+def _native_assistant_item_owners(assistant_items: dict, completed_runs: set[str], provider_id: str) -> dict:
     owners: dict = {}
-    for run, item_id, body_key in assistant_items:
-        if run in completed_runs:
+    for (run, item_id, body_key), event in assistant_items.items():
+        # A restart or Stop can omit the completion receipt. An exact public
+        # item already delivered by this provider thread still identifies its
+        # native run; source reconciliation below supplies the matching turn.
+        if run in completed_runs or event.get("provider_thread_id") == provider_id:
             owners.setdefault((item_id, body_key), set()).add(run)
     return owners
 
@@ -856,7 +875,7 @@ def _prove_native_replays(session_id: str, provider_id: str, events: Path, sourc
                         owned = owners.setdefault((thread, turn), set())
                         retained += run not in owned
                         owned.add(run)
-            kind = "user" if event.get("type") == "turn_started" else "assistant" if event.get("type") in ("assistant_text", "reasoning_summary", "turn_finished") else None
+            kind = "user" if event.get("type") == "turn_started" or _native_goal_steer_turn(event) else "assistant" if event.get("type") in ("assistant_text", "reasoning_summary", "turn_finished") else None
             body = event.get("prompt") if kind == "user" else event.get("result_text") if event.get("type") == "turn_finished" else event.get("text")
             if kind and isinstance(body, str) and body and len(body) <= 4 * 1024 * 1024:
                 native.setdefault((run, kind, _text_key(body)), []).append(_native_event_identity(event))
@@ -935,14 +954,14 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
     assistant_native_keys = {}
     compactions, candidate_assistants = {}, set()
     compaction_tracker = CodexCompactionSummaryTracker(thread)
-    delivery_bodies, delivery_source_ids = {}, {}
+    delivery_bodies, delivery_source_ids, full_user_keys = {}, {}, {}
     completed_runs = {run for (owner_thread, _turn), runs in owners.items()
                       if owner_thread == thread for run in runs}
     assistant_item_owners = _native_assistant_item_owners({
         (run, item_id, body_key): event
         for (run, kind, body_key), events in native.items() if kind == "assistant"
         for event in events if (item_id := _public_assistant_item_id(event)) is not None
-    }, completed_runs)
+    }, completed_runs, thread)
     assistant_owner_evidence: dict = {}
     assistant_source_turns: dict = {}
     allowed_header_owners, header_parents = {thread}, {}
@@ -1016,6 +1035,21 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
                 raise _Unproven()
         if (item["kind"], key[2], key[3]) not in candidate_keys:
             continue
+        if item["kind"] == "user" and key[3] is not None:
+            # A display-trimmed input still has its complete source in this
+            # checkpoint-verified record. Compare those bytes to the original
+            # native input, never a shared preview or an unverified hash.
+            full_text = None
+            if record.get("type") == "event_msg" and payload.get("type") == "user_message":
+                full_text = payload.get("message")
+            elif record.get("type") == "response_item" and payload.get("role") == "user":
+                blocks = payload.get("content")
+                if (isinstance(blocks, list) and len(blocks) == 1 and isinstance(blocks[0], dict)
+                    and blocks[0].get("type") == "input_text"):
+                    full_text = blocks[0].get("text")
+            if (isinstance(full_text, str) and full_text
+                and _text_key(" ".join(full_text.split())) == key[3]):
+                full_user_keys[key] = _text_key(full_text)
         if item["kind"] == "user" and (body := _async_delivery_body(item["text"])):
             delivery_bodies[key] = body
         if item["kind"] == "assistant":
@@ -1073,9 +1107,7 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
             if len(proofs) > MAX_TARGETS:
                 raise _Unproven()
             continue
-        if len(source_ids) != 1 or source_hash is not None:
-            # Truncated source hashes need a separately retained native full-body
-            # hash. Until one exists, the bounded preview cannot prove equality.
+        if len(source_ids) != 1 or source_hash is not None and key not in full_user_keys:
             continue
         source_origin = next(iter(source_ids.values()))
         if source_origin.get("kind") in ("subagent_notification", "turn_aborted", "provider_notice"):
@@ -1087,8 +1119,10 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
         if len(owned_runs) != 1:
             continue
         native_run = next(iter(owned_runs))
-        native_matches = native.get((native_run, kind, body_key), [])
-        if not native_matches and kind == "user":
+        native_body_key = full_user_keys.get(key, body_key)
+        native_matches = [event for event in native.get((native_run, kind, native_body_key), [])
+                          if event.get("type") != "turn_steered" or event.get("provider_turn_id") == key[0]]
+        if not native_matches and kind == "user" and source_hash is None:
             delivery = deliveries.match(session_id, thread, native_run, source_origin,
                                         delivery_bodies.get(key), delivery_source_ids.get(key[0], set()), body_key)
             if delivery is not None:
@@ -1105,7 +1139,7 @@ def _prove_native_source(thread: str, source: Path, root: Path, batches: dict, c
         if not native_matches:
             continue
         representative = min(native_matches, key=lambda event: event["seq"])
-        proofs[target] = {**next(iter(source_ids.values())), "native_event_id": representative["id"], "source_text_sha256": body_key}
+        proofs[target] = {**next(iter(source_ids.values())), "native_event_id": representative["id"], "source_text_sha256": native_body_key}
         if len(proofs) > MAX_TARGETS:
             raise _Unproven()
     budget.check()
@@ -1183,10 +1217,10 @@ class CodexNativeHistoryRepairCache(CodexGoalHistoryRepairCache):
                 **({"_agentsdock_imported_prompt_hidden": True} if event["type"] == "turn_started" else {})}
 
 
-def _prove_pending_async_deliveries(session_id: str, provider_id: str, items: list[dict],
+def _prove_pending_native_inputs(session_id: str, provider_id: str, items: list[dict],
                                     source: Path, root: Path, checkpoint: dict, parse_item: Callable,
                                     previous_seq: int, owners: dict, deliveries: _AsyncDeliveryIndex,
-                                    budget: _NativeReadBudget) -> dict:
+                                    budget: _NativeReadBudget, native_inputs: dict | None = None) -> dict:
     """Reuse pinned-prefix proof before broadcast; the synthetic batch is never stored."""
     cursor = checkpoint.get("cursor")
     if (checkpoint.get("version") != 1 or not isinstance(cursor, dict) or cursor.get("version") != 1
@@ -1195,16 +1229,21 @@ def _prove_pending_async_deliveries(session_id: str, provider_id: str, items: li
         raise _Unproven()
     run = "import_pending_native_delivery_proof"
     candidates, indexes = [], {}
+    steer_keys = {key[2] for key, events in (native_inputs or {}).items()
+                  if key[1] == "user" and any(event.get("type") == "turn_steered" for event in events)}
     for index, item in enumerate(items):
         budget.check()
         origin = item.get("provider_origin")
         if (item.get("kind") != "user" or not isinstance(item.get("text"), str)
             or not isinstance(origin, dict) or origin.get("provider") != "codex" or origin.get("kind") != "user"
-            or origin.get("session_id", provider_id) != provider_id or item.get("source_text_sha256") is not None
-            or not (_async_delivery_body(item["text"]) or _text_key(item["text"]) in deliveries.status_body_keys)):
+            or origin.get("session_id", provider_id) != provider_id
+            or not (item.get("source_text_sha256") is not None
+                    or _async_delivery_body(item["text"]) or _text_key(item["text"]) in deliveries.status_body_keys
+                    or _text_key(item["text"]) in steer_keys)):
             continue
         candidate = _replay_target({"seq": previous_seq + index + 2, "id": f"pending:{index}", "run_id": run,
             "type": "turn_started", "backend": "codex", "imported": True, "prompt": item["text"],
+            "source_text_sha256": item.get("source_text_sha256"),
             "ts": origin.get("timestamp"), "provider_user_authored": _runtime_human_provenance(item)})
         if candidate is not None:
             candidates.append(candidate)
@@ -1214,7 +1253,7 @@ def _prove_pending_async_deliveries(session_id: str, provider_id: str, items: li
     if not candidates:
         return {}
     proof = _prove_native_source(provider_id, source, root,
-        {run: (previous_seq + 1, previous_seq + len(items) + 2, checkpoint)}, candidates, {},
+        {run: (previous_seq + 1, previous_seq + len(items) + 2, checkpoint)}, candidates, native_inputs or {},
         {(provider_id, turn): runs for turn, runs in owners.items()}, parse_item, budget,
         session_id=session_id, deliveries=deliveries, require_verified_checkpoint=True)
     result = {}
@@ -1234,10 +1273,10 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
                                       parse_item: Callable[[dict], dict | None] | None = None) -> list[dict]:
     """An existing verified import boundary can omit exact completed native copies.
 
-    Exact native bodies need only the ledger. Legacy async wrappers additionally
-    require the caller's source/checkpoint/parser and one verified source-prefix
-    scan: a delta range alone cannot disambiguate a later same-turn human quote.
-    Missing source context leaves those wrappers visible for later read repair.
+    Exact native bodies need only the ledger. Legacy async wrappers and trimmed
+    user inputs additionally require the caller's source/checkpoint/parser and
+    one verified source-prefix scan. A preview alone never proves equality.
+    Missing source context leaves those inputs visible for later read repair.
     Incomplete proof raises; the caller must defer import and its cursor commit.
     """
     if not items:
@@ -1248,6 +1287,7 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
         budget = _NativeReadBudget(cancelled, deadline)
         stamp = _native_stamp(events)
         owners, native, assistant_items, wake_keys, native_count = {}, {}, {}, set(), 0
+        native_inputs, steered_inputs = {}, {}
         deliveries = _AsyncDeliveryIndex()
         prove_deliveries = (source_path is not None and root is not None
             and isinstance(sync_checkpoint, dict) and callable(parse_item)
@@ -1273,24 +1313,31 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
                     owned = owners.setdefault(turn_id, set())
                     owner_count += run not in owned
                     owned.add(run)
-            kind = "user" if event.get("type") == "turn_started" else "assistant" if event.get("type") in ("assistant_text", "reasoning_summary", "turn_finished") else None
+            steer_turn = _native_goal_steer_turn(event)
+            kind = "user" if event.get("type") == "turn_started" or steer_turn else "assistant" if event.get("type") in ("assistant_text", "reasoning_summary", "turn_finished") else None
             body = event.get("prompt") if kind == "user" else event.get("result_text") if event.get("type") == "turn_finished" else event.get("text")
             wake_hash = _native_mailbox_wake_hash(event) if kind == "user" else None
             if kind and (isinstance(body, str) and body or wake_hash):
-                keys = native.setdefault(run, {})
+                keys = steered_inputs.setdefault((run, steer_turn), {}) if steer_turn else native.setdefault(run, {})
                 key = (kind, wake_hash or _text_key(body))
                 native_count += key not in keys
                 if isinstance(event.get("id"), str) and 0 < len(event["id"]) <= 256:
                     keys.setdefault(key, event["id"])
+                    if prove_deliveries and kind == "user" and isinstance(body, str) and body:
+                        inputs = native_inputs.setdefault((run, kind, key[1]), [])
+                        if not any(prior.get("type") == event.get("type")
+                                   and prior.get("provider_turn_id") == event.get("provider_turn_id") for prior in inputs):
+                            inputs.append(_native_event_identity(event))
+                            native_count += 1
                     if wake_hash:
                         wake_keys.add((run, wake_hash))
                     item_id = _public_assistant_item_id(event)
                     if item_id is not None:
-                        assistant_items[(run, item_id, key[1])] = event["id"]
+                        assistant_items[(run, item_id, key[1])] = _native_event_identity(event)
             if native_count + owner_count + len(assistant_items) + deliveries.count > MAX_KEYS:
                 raise _Unproven()
         assistant_item_owners = _native_assistant_item_owners(
-            assistant_items, {run for runs in owners.values() for run in runs},
+            assistant_items, {run for runs in owners.values() for run in runs}, provider_id,
         )
         assistant_source_turns: dict = {}
         for item in items:
@@ -1308,10 +1355,17 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
         for item_key, turns in assistant_source_turns.items():
             if len(turns) == 1:
                 owners.setdefault(next(iter(turns)), set()).update(assistant_item_owners[item_key])
-        delivery_proofs = _prove_pending_async_deliveries(
+        if prove_deliveries and steered_inputs:
+            # The unmatched import can contain only follow-ups: its assistant
+            # messages were already reconciled. Preserve public item identities
+            # for the source scan to recover earlier turns of a long goal run.
+            for (run, _item_id, body_key), event in assistant_items.items():
+                native_inputs.setdefault((run, "assistant", body_key), []).append(event)
+        delivery_proofs = _prove_pending_native_inputs(
             session_id, provider_id, items, source_path, root, sync_checkpoint, parse_item,
-            previous_seq, owners, deliveries, budget,
-        ) if prove_deliveries and deliveries.starts else {}
+            previous_seq, owners, deliveries, budget, native_inputs,
+        ) if prove_deliveries and (deliveries.starts or steered_inputs or any(
+            item.get("kind") == "user" and item.get("source_text_sha256") is not None for item in items)) else {}
         # A hidden wake has no public prompt body. Require a single exact source
         # item in this verified import range, in addition to native turn ownership.
         wake_source_ids = {}
@@ -1332,9 +1386,15 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
                      and origin.get("session_id", provider_id) == provider_id and len(runs) == 1
                      and item.get("source_text_sha256") is None and isinstance(item.get("text"), str))
             known = owned and (item["kind"], _text_key(item["text"])) in native.get(next(iter(runs)), {})
-            delivery = delivery_proofs.get(index) if owned else None
+            # Steers never use delta-local text equality as proof. An equal
+            # source item can precede this delta's checkpoint in the same
+            # native turn. Only the full verified prefix can establish that
+            # this source occurrence is the already-shown follow-up.
+            # This proof already established exact source bytes, native owner,
+            # original event and checkpoint even when the display is trimmed.
+            delivery = delivery_proofs.get(index)
             known = known or delivery is not None
-            if known and (next(iter(runs)), _text_key(item["text"])) in wake_keys:
+            if known and runs and (next(iter(runs)), _text_key(item["text"])) in wake_keys:
                 known = (bool(origin.get("event_id")) and bool(origin.get("timestamp"))
                          and len(wake_source_ids.get((origin.get("turn_id"), _text_key(item["text"])), set())) == 1)
             if owned and not known and item["kind"] == "assistant":
@@ -1350,7 +1410,7 @@ def filter_native_codex_history_items(session_id: str, provider_id: str, events:
                     "provider_history_repair": "source_proven_native_replay",
                     "provider_origin": {**origin, "session_id": provider_id,
                         "native_event_id": delivery["native_event_id"] if delivery else native[next(iter(runs))][key],
-                        "source_text_sha256": key[1]}})
+                        "source_text_sha256": delivery["source_text_sha256"] if delivery else key[1]}})
         budget.check()
         return result
     except (OSError, ValueError, TypeError, KeyError, RuntimeError) as exc:

package/server/codex_provider.py

@@ -814,6 +814,17 @@ def safe_model_label(label, model):
     return label.strip() if isinstance(label, str) and label.strip() and len(label) <= 160 and all(ord(c) >= 32 and ord(c) != 127 for c in label) else model
 
 
+def endpoint_api_base_url(base: str, protocol: str) -> str:
+    """Resolve the API prefix, retaining the gateway's path and saved identity.
+
+    Anthropic settings accept either a root or its /v1 API prefix. AI SDK
+    adapters append /messages, unlike Claude Code which appends /v1/messages.
+    OpenAI-compatible settings already specify their complete API prefix.
+    """
+    base = base.rstrip("/")
+    return base + "/v1" if protocol == "anthropic" and not base.endswith("/v1") else base
+
+
 def endpoint_model_catalog(selected: dict, *, protocol="responses") -> dict:
     """Read only this endpoint's inventory. Never use CLI models or infer a default.
 
@@ -823,8 +834,7 @@ def endpoint_model_catalog(selected: dict, *, protocol="responses") -> dict:
     base = selected["base_url"].rstrip("/")
     parsed = urlsplit(base)
     router = parsed.scheme == "https" and parsed.netloc in {"openrouter.ai", "eu.openrouter.ai"} and parsed.path in {"/api", "/api/v1"}
-    target = (base.removesuffix("/v1") + "/v1/models/user") if router else base + (
-        "/v1/models" if protocol == "anthropic" and not base.endswith("/v1") else "/models")
+    target = (base.removesuffix("/v1") + "/v1/models/user") if router else endpoint_api_base_url(base, protocol) + "/models"
     headers = {"Accept": "application/json", "anthropic-version": "2023-06-01"}
     header = selected.get("auth_header", "bearer")
     headers["x-api-key" if header == "x-api-key" else "Authorization"] = selected["api_key"] if header == "x-api-key" else "Bearer " + selected["api_key"]

package/server/execution_activation.py

@@ -249,7 +249,7 @@ def require_retired_legacy_intent(layout: files.ExecutionLayout, previous: Any,
 
     root = layout.install_root
     def no_journal():
-        for name in (".activation-transaction", ".execution-transaction", ".execution-uninstall.json"):
+        for name in (".activation-transaction", ".execution-transaction", ".execution-uninstall.json", ".execution-lifecycle.json"):
             if (root / name).exists() or (root / name).is_symlink():
                 raise RuntimeError("a lifecycle journal still owns the previous recovery intent")
     no_journal()

package/server/execution_control.py

@@ -186,6 +186,10 @@ class ExecutionControl:
                 if length not in {None, 0}:
                     raise ExecutionControlError(400, "Status requests do not accept a body")
                 result = await self.status_callback()
+                # This running worker understands execution-lifecycle startup
+                # holds. New CLIs must not stop an older retained worker and
+                # discover only after restart that its queue was not held.
+                result = {**result, "native_lifecycle_protocol": 1}
             else:
                 content_types = _header_values(headers, b"content-type")
                 if (len(content_types) != 1 or content_types[0].lower()

package/server/execution_install.py

@@ -329,6 +329,36 @@ def layout_manifest(layout: ExecutionLayout) -> dict[str, Any]:
             "retained_releases": sorted({str(layout.worker_release), str(layout.gateway_release)})}
 
 
+def installed_layout(root: Path) -> ExecutionLayout:
+    """Validate authoritative bindings without discarding retained rollback history."""
+    root = _path(root)
+    data, _mode = _read_file(root / LAYOUT_NAME, private=True)
+    value = json.loads(data)
+    if not isinstance(value, dict):
+        raise ValueError("installed execution layout is invalid")
+    layout = ExecutionLayout.from_dict(value.get("layout"))
+    expected = layout_manifest(layout)
+    retained = value.get("retained_releases")
+    if (layout.install_root != root or set(value) != set(expected)
+            or {key: item for key, item in value.items() if key != "retained_releases"}
+            != {key: item for key, item in expected.items() if key != "retained_releases"}
+            or not isinstance(retained, list) or not all(isinstance(item, str) for item in retained)
+            or len(retained) != len(set(retained))
+            or not set(expected["retained_releases"]).issubset(retained)):
+        raise ValueError("installed execution layout does not match its runtime")
+    # Old monolith releases may have no execution_service.py. Retention is not
+    # activation authority, but every advisory entry must be an owned, real
+    # version directory inside this installation (never an arbitrary path).
+    for item in retained:
+        path = _path(item)
+        if path.parent != root / "releases" or path.name.startswith("."):
+            raise ValueError("retained release is outside the installation")
+        _owned_directory(path)
+        version, _mode = _read_file(path / "VERSION")
+        _text(version.decode().strip())
+    return layout
+
+
 def prepare_runtime(layout: ExecutionLayout) -> None:
     """Create private IPC state; never rotate an existing control token."""
     from execution_transport import ensure_execution_secret
@@ -399,6 +429,10 @@ def stage(layout: ExecutionLayout, *, scope: str, prior_services: dict[str, Any]
     legacy = layout.install_root / ".activation-transaction"
     if legacy.exists() or legacy.is_symlink():
         raise RuntimeError("legacy activation recovery must finish before execution activation")
+    for name in (".execution-lifecycle.json", ".execution-uninstall.json"):
+        marker = layout.install_root / name
+        if marker.exists() or marker.is_symlink():
+            raise RuntimeError("native lifecycle ownership must finish before execution activation")
     if layout.transaction_dir.exists() or layout.transaction_dir.is_symlink():
         raise FileExistsError("an execution activation is already pending")
     prior_layout = _snapshot(layout.manifest_path)
@@ -674,6 +708,19 @@ def pending_worker_operation(root: Path, runtime_root: Path) -> str | None:
     journal = root / TRANSACTION_NAME
     outer = root / ".activation-transaction"
     uninstall = root / ".execution-uninstall.json"
+    lifecycle = root / ".execution-lifecycle.json"
+    if lifecycle.exists() or lifecycle.is_symlink():
+        if any(path.exists() or path.is_symlink() for path in (outer, journal)):
+            raise RuntimeError("activation and lifecycle both claim execution ownership")
+        from execution_manage import pending_lifecycle_operation
+        operation = pending_lifecycle_operation(root, runtime_root)
+        if uninstall.exists() or uninstall.is_symlink():
+            # An interrupted owned-stop -> uninstall adoption may retain both
+            # journals, but they must describe the very same sealed operation.
+            from execution_uninstall import pending_uninstall_operation
+            if pending_uninstall_operation(root, runtime_root) != operation:
+                raise RuntimeError("uninstall and lifecycle ownership conflict")
+        return operation
     if uninstall.exists() or uninstall.is_symlink():
         if outer.exists() or outer.is_symlink() or journal.exists() or journal.is_symlink():
             raise RuntimeError("activation and uninstall both claim execution ownership")
@@ -714,13 +761,7 @@ def active_worker_release(root: Path) -> Path | None:
         data, _mode = _read_file(root / LAYOUT_NAME, private=True)
     except FileNotFoundError:
         return None
-    value = json.loads(data)
-    if not isinstance(value, dict) or value.get("format") != FORMAT:
-        raise ValueError("installed execution layout is invalid")
-    layout = ExecutionLayout.from_dict(value.get("layout"))
-    if layout.install_root != root or value != layout_manifest(layout):
-        raise ValueError("installed execution layout no longer matches its runtime")
-    return layout.worker_release
+    return installed_layout(root).worker_release
 
 
 def main(argv: list[str] | None = None) -> None: