@agentunion/fastaun 0.5.19 → 0.5.20

package/dist/ownership-workflow.js

@@ -36,15 +36,15 @@ export function parseOwnershipMessage(content, context) {
         throw new ValidationError('ownership message contains unknown or missing fields');
     if (message.type !== OWNERSHIP_SDK_MESSAGE_TYPE)
         throw ownershipFailure('unsupported_protocol', 'legacy ownership control is unsupported');
-    if (!OWNERSHIP_UUID_V4_RE.test(message.operation_id))
+    if (typeof message.operation_id !== 'string' || !OWNERSHIP_UUID_V4_RE.test(message.operation_id))
         throw new ValidationError('operation_id must be a UUIDv4');
     if (!['bind', 'release', 'transfer'].includes(message.operation))
         throw new ValidationError('ownership operation is invalid');
     ownershipAid(message.sub_aid, 'sub_aid');
     ownershipAid(message.owner_aid, 'owner_aid');
     ownershipInteger(message.base_relation_version, 'base_relation_version', 0);
-    if (ownershipInteger(message.target_relation_version, 'target_relation_version') !== message.base_relation_version + 1)
-        throw new ValidationError('ownership target version must be base plus one');
+    if (ownershipInteger(message.target_relation_version, 'target_relation_version') !== message.base_relation_version + (message.operation === 'release' ? 0 : 1))
+        throw new ValidationError('ownership target version does not match the operation');
     if (message.operation === 'transfer') {
         if (ownershipAid(message.new_owner_aid, 'new_owner_aid') === message.owner_aid)
             throw new ValidationError('transfer target must differ from current owner');
@@ -107,7 +107,7 @@ export function parseOwnershipMessage(content, context) {
         if (ns.protocol !== '2.1')
             throw ownershipFailure('unsupported_protocol', 'NS ownership protocol is unavailable');
         const base = ns.relation_version === message.base_relation_version && (message.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === message.owner_aid);
-        const target = ns.relation_version === message.target_relation_version && (message.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === targetOwner(message));
+        const target = message.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === message.target_relation_version || ns.relation_version === 0) : ns.relation_version === message.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(message);
         if (['relation.confirmed', 'sub.cleaned'].includes(message.action) ? !target : !base && !target)
             throw ownershipFailure('conflict', 'ownership current NS relation does not match this task');
     }
@@ -154,7 +154,7 @@ export class OwnershipWorkflow {
         return this.start('transfer', ownershipAid(subAid, 'sub_aid'), this.local(), ownershipAid(newOwnerAid, 'new_owner_aid'));
     }
     async resumeRegistration(ownerAid, operationId) {
-        if (!OWNERSHIP_UUID_V4_RE.test(operationId))
+        if (typeof operationId !== 'string' || !OWNERSHIP_UUID_V4_RE.test(operationId))
             throw ownershipFailure('invalid', 'registration operation_id is invalid');
         return this.start('bind', this.local(), ownershipAid(ownerAid, 'owner_aid'), undefined, operationId);
     }
@@ -220,21 +220,13 @@ export class OwnershipWorkflow {
                 if (!['bind.request', 'transfer.request'].includes(message.action) && !(message.operation === 'release' && message.action === 'relation.confirmed'))
                     return true;
                 handle = { record: this.newRecord(message, from, 'pending'), revision: null };
-                if (message.operation === 'release') {
-                    const authorization = this.cleanupAuthorization(handle.record);
-                    if (authorization) {
-                        handle.record.local_decision = 'accept';
-                        handle.record.approvals[this.local()] = 'accept';
-                        handle.record.cleanup_authorization_id = authorization.operation_id;
-                    }
-                }
             }
             if (message.action === 'sub.cleaned') {
                 const began = Date.now();
                 const before = await this.readNs(message.sub_aid), after = await this.readNs(message.sub_aid);
                 if (Date.now() - began > 30_000 || before.exists !== after.exists || before.etag !== after.etag || before.relation_version !== after.relation_version || before.lock !== after.lock || before.owner_aid !== after.owner_aid || ownershipSha256(before.content) !== ownershipSha256(after.content))
                     throw ownershipFailure('unavailable', 'NS changed during sub cleanup verification', true);
-                if (!before.exists || before.relation_version !== message.target_relation_version || before.lock !== 'unlocked' || before.owner_aid || !before.etag)
+                if (!before.exists || before.relation_version !== 0 || before.lock !== 'unlocked' || before.owner_aid || !before.etag)
                     return true;
                 const file = parseOwnershipFile(before.content, 'agent', { expectedSubAid: message.sub_aid });
                 if (Object.hasOwn(file.frontmatter, 'owner') || Object.hasOwn(file.frontmatter, 'ownership'))
@@ -253,15 +245,23 @@ export class OwnershipWorkflow {
         });
     }
     async resume() {
-        for (const snapshot of this.list()) {
-            const record = this.decode(snapshot).record;
-            await this.runSerialized(record.sub_aid, async () => {
-                const handle = this.load(record.operation_id);
-                await this.drive(handle);
-                if (handle.record.request_verified && handle.record.local_decision === 'pending' && handle.record.status === 'pending' && handle.record.operation !== 'release')
-                    this.emit(handle.record, 'ownership.request');
-            });
+        const failed = [];
+        for (const snapshot of this.list(true)) {
+            try {
+                const record = this.decode(snapshot).record;
+                await this.runSerialized(record.sub_aid, async () => {
+                    const handle = this.load(record.operation_id);
+                    await this.drive(handle);
+                    if (handle.record.request_verified && handle.record.local_decision === 'pending' && handle.record.status === 'pending' && handle.record.operation !== 'release')
+                        this.emit(handle.record, 'ownership.request');
+                });
+            }
+            catch (error) {
+                failed.push(`${snapshot.operation_id}: ${error instanceof Error ? error.message : String(error)}`);
+            }
         }
+        if (failed.length)
+            throw ownershipFailure('persistence_unavailable', failed.join('; '));
     }
     local() { return ownershipAid(this.deps.currentAid(), 'local_aid'); }
     requireApplicable(subAid) {
@@ -273,9 +273,9 @@ export class OwnershipWorkflow {
             throw ownershipFailure('persistence_unavailable', 'atomic ownership task storage is unavailable');
         return this.deps.store;
     }
-    list() {
+    list(isolateErrors = false) {
         try {
-            return this.store().listOwnershipTasks(this.local());
+            return this.store().listOwnershipTasks(this.local(), isolateErrors);
         }
         catch (error) {
             throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
@@ -293,7 +293,7 @@ export class OwnershipWorkflow {
     decode(snapshot) {
         const record = snapshot.task;
         try {
-            if (record.protocol !== '2.1' || !OWNERSHIP_UUID_V4_RE.test(record.operation_id) || record.operation_id !== snapshot.operation_id || !['bind', 'release', 'transfer'].includes(record.operation) || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(record.status) || typeof record.step !== 'string')
+            if (record.protocol !== '2.1' || typeof record.operation_id !== 'string' || !OWNERSHIP_UUID_V4_RE.test(record.operation_id) || record.operation_id !== snapshot.operation_id || !['bind', 'release', 'transfer'].includes(record.operation) || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(record.status) || typeof record.step !== 'string')
                 throw new Error('invalid ownership task');
             ownershipAid(record.sub_aid, 'sub_aid');
             ownershipAid(record.owner_aid, 'owner_aid');
@@ -304,22 +304,53 @@ export class OwnershipWorkflow {
             }
             else if (record.new_owner_aid !== undefined)
                 throw new Error('unexpected transfer target');
-            if (ownershipInteger(record.target_relation_version, 'target_relation_version') !== ownershipInteger(record.base_relation_version, 'base_relation_version', 0) + 1 || !participants(record).includes(record.initiator_aid) || record.operation !== 'bind' && record.initiator_aid !== record.owner_aid)
+            if (ownershipInteger(record.target_relation_version, 'target_relation_version') !== ownershipInteger(record.base_relation_version, 'base_relation_version', 0) + (record.operation === 'release' ? 0 : 1) || !participants(record).includes(record.initiator_aid) || record.operation !== 'bind' && record.initiator_aid !== record.owner_aid)
                 throw new Error('invalid fixed ownership context');
             if (JSON.stringify(record.local_roles) !== JSON.stringify(localRoles(record, this.local())) || !record.local_roles.length || !['pending', 'accept', 'reject'].includes(record.local_decision) || !record.approvals || participants(record).some((aid) => !['pending', 'accept', 'reject'].includes(record.approvals[aid])) || record.approvals[this.local()] !== record.local_decision || !record.files || typeof record.files !== 'object' || Array.isArray(record.files) || !Array.isArray(record.inbox) || !Array.isArray(record.outbox) || !Array.isArray(record.received) || !Array.isArray(record.notices) || typeof record.request_verified !== 'boolean' || typeof record.request_notified !== 'boolean')
                 throw new Error('ownership approval or pending state is corrupt');
             if (Object.keys(record.approvals).length !== participants(record).length || record.approvals[record.initiator_aid] !== 'accept' || record.initiator_aid === this.local() && record.local_decision !== 'accept')
                 throw new Error('ownership initiator or approval participants are corrupt');
+            if (record.request_verified) {
+                const base = record.base_agent_md;
+                if (!base || base.exists !== true || typeof base.raw !== 'string' || base.sha256 !== ownershipSha256(base.raw) || typeof base.etag !== 'string' || !base.etag)
+                    throw new Error('ownership original agent.md evidence is corrupt');
+                const statement = parseOwnershipFile(base.raw, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null;
+                if (JSON.stringify(statement) !== JSON.stringify(base.statement) || (statement?.relation_version ?? 0) !== record.base_relation_version)
+                    throw new Error('ownership original statement is corrupt');
+                const owner = record.base_owner_md;
+                if (!owner || typeof owner.exists !== 'boolean' || typeof owner.raw !== 'string' || owner.sha256 !== (owner.exists ? ownershipSha256(owner.raw) : '') || !owner.exists && owner.raw !== '')
+                    throw new Error('ownership original owner.md evidence is corrupt');
+                if (owner.exists) {
+                    const declaration = parseOwnershipFile(owner.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: statement?.owner_aid ?? record.owner_aid });
+                    if (declaration.statement?.relation_version !== record.base_relation_version)
+                        throw new Error('ownership original owner statement is corrupt');
+                }
+            }
+            for (const item of record.inbox)
+                parseOwnershipMessage(item.payload, { authenticated_from_aid: item.from, local_aid: this.local(), task: record });
+            for (const key of record.received) {
+                if (typeof key !== 'string' || key.split('|').length !== 3)
+                    throw new Error('ownership received key is corrupt');
+                const [from, operationId, action] = key.split('|');
+                parseOwnershipMessage({ type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: operationId, operation: record.operation, action,
+                    sub_aid: record.sub_aid, owner_aid: record.owner_aid, ...(record.operation === 'transfer' ? { new_owner_aid: record.new_owner_aid } : {}),
+                    base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version }, { authenticated_from_aid: from, local_aid: this.local(), task: record });
+            }
+            for (const item of record.outbox)
+                this.validateOutgoing(record, item);
             if (record.status === 'completed' && (record.verified_relation_version !== record.target_relation_version || record.operation !== 'release' && record.local_decision !== 'accept'))
                 throw new Error('ownership completion evidence or local approval is corrupt');
             const transferEvidenceRequired = record.operation === 'transfer' && (record.authorization_sha256 !== undefined || record.expires_at !== undefined || (record.status === 'completed' || ['owner', 'agent'].includes(record.step) || record.files.agent || record.files.owner) && record.local_roles.some((role) => role === 'sub' || role === 'new_owner'));
             if (transferEvidenceRequired && (!/^[0-9a-f]{64}$/.test(record.authorization_sha256 ?? '') || !Number.isSafeInteger(record.expires_at) || (record.expires_at ?? 0) <= 0))
                 throw new Error('ownership transfer authorization evidence is corrupt');
             for (const [key, saved] of Object.entries(record.files)) {
-                if (!['agent', 'owner', 'release', 'transfer', 'cleanup'].includes(key) || !saved || typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !saved.condition || typeof saved.condition !== 'object' || Object.keys(saved.condition).length !== 1 || saved.published_revision !== undefined && (typeof saved.published_revision !== 'string' || !saved.published_revision))
+                if (!['agent', 'owner', 'release', 'transfer', 'cleanup'].includes(key) || !saved || typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !saved.condition || typeof saved.condition !== 'object' || Object.keys(saved.condition).length !== (key === 'agent' ? 1 : 0) || saved.published_etag !== undefined && (key !== 'agent' || typeof saved.published_etag !== 'string' || !saved.published_etag))
                     throw new Error('ownership saved file is corrupt');
-                if (key === 'agent' ? !(typeof saved.condition.if_match === 'string' && saved.condition.if_match || saved.condition.if_none_match === '*') : !(typeof saved.condition.expected_revision === 'string' && saved.condition.expected_revision))
+                if (key === 'agent' && !(typeof saved.condition.if_match === 'string' && saved.condition.if_match || saved.condition.if_none_match === '*'))
                     throw new Error('ownership original file condition is corrupt');
+                const original = saved.original_owner;
+                if (key !== 'agent' && key !== 'cleanup' && (!original || typeof original.exists !== 'boolean' || typeof original.raw !== 'string' || original.sha256 !== (original.exists ? ownershipSha256(original.raw) : '') || !original.exists && original.raw !== ''))
+                    throw new Error('ownership original owner material is corrupt');
                 const owner = ['agent', 'owner'].includes(key) ? targetOwner(record) : record.owner_aid;
                 const file = parseOwnershipFile(saved.raw, key === 'agent' ? 'agent' : 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: owner });
                 const version = ['release', 'transfer', 'cleanup'].includes(key) ? record.base_relation_version : record.target_relation_version;
@@ -339,7 +370,8 @@ export class OwnershipWorkflow {
             }
             if (record.status === 'completed') {
                 const evidence = record.completion_evidence;
-                if (!evidence || evidence.sub_aid !== record.sub_aid || evidence.relation_version !== record.target_relation_version || evidence.status !== (record.operation === 'release' ? 'released' : 'consensus') || evidence.lock !== (record.operation === 'release' ? 'unlocked' : 'locked') || evidence.owner_aid !== (record.operation === 'release' ? null : targetOwner(record)) || typeof evidence.agent_md_etag !== 'string' || !evidence.agent_md_etag || !/^[0-9a-f]{64}$/.test(evidence.agent_md_sha256) || typeof evidence.owner_md_revision !== 'string' || typeof evidence.owner_md_sha256 !== 'string' || record.operation !== 'release' && (!evidence.owner_md_revision || !/^[0-9a-f]{64}$/.test(evidence.owner_md_sha256)))
+                const cleaned = record.operation === 'release' && evidence?.status === 'unbound' && evidence.relation_version === 0 && record.cleanup_status === 'cleaned' && Boolean(this.cleanupEvidence(record, evidence));
+                if (!evidence || evidence.sub_aid !== record.sub_aid || !cleaned && (evidence.relation_version !== record.target_relation_version || evidence.status !== (record.operation === 'release' ? 'released' : 'consensus')) || evidence.lock !== (record.operation === 'release' ? 'unlocked' : 'locked') || evidence.owner_aid !== (record.operation === 'release' ? null : targetOwner(record)) || typeof evidence.agent_md_etag !== 'string' || !evidence.agent_md_etag || !/^[0-9a-f]{64}$/.test(evidence.agent_md_sha256) || typeof evidence.owner_md_sha256 !== 'string' || record.operation !== 'release' && !/^[0-9a-f]{64}$/.test(evidence.owner_md_sha256))
                     throw new Error('ownership target acceptance evidence is corrupt');
                 if (record.operation !== 'release' && (record.local_roles.includes('sub') && record.files.agent?.hash !== evidence.agent_md_sha256 || this.local() === targetOwner(record) && record.files.owner?.hash !== evidence.owner_md_sha256 || record.operation === 'transfer' && record.local_roles.includes('owner') && !record.files.transfer))
                     throw new Error('ownership target file evidence is missing');
@@ -445,8 +477,18 @@ export class OwnershipWorkflow {
                     await this.recordError(active, error);
                     return ownershipTaskResult(record);
                 }
-                const base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
-                const target = ns.relation_version === record.target_relation_version && (record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === targetOwner(record));
+                let base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
+                if (base && record.request_verified) {
+                    try {
+                        await this.assertBaseMaterial(active, ns);
+                    }
+                    catch (error) {
+                        if (!(error instanceof StateError) || error.stringCode !== 'conflict')
+                            throw error;
+                        base = false;
+                    }
+                }
+                const target = record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === record.target_relation_version || ns.relation_version === 0) : ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record);
                 if (!base && !target) {
                     await this.recordError(active, ownershipFailure('conflict', 'the operation was superseded by a different relation result'));
                     const result = ownershipTaskResult(record);
@@ -470,13 +512,16 @@ export class OwnershipWorkflow {
                 throw ownershipFailure('unavailable', 'initial agent.md is not published', true);
             if (operation === 'bind' && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: subAid }).frontmatter.type === 'human')
                 throw ownershipFailure('invalid', 'human cannot declare an owner');
+            if (operation === 'bind' && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: subAid }).statement?.owner_aid === ownerAid)
+                throw ownershipFailure('conflict', 'clear the released agent.md statement before binding the same owner');
             if (operation !== 'bind') {
                 const consensus = await this.deps.files.checkConsensus(subAid);
                 if (consensus.status !== 'consensus' || consensus.owner_aid !== ownerAid || consensus.relation_version !== ns.relation_version)
                     throw ownershipFailure(consensus.status === 'invalid' ? 'invalid' : consensus.status === 'unavailable' ? consensus.code ?? 'unavailable' : 'forbidden', 'the current original owner consensus cannot be verified', consensus.status === 'unavailable');
             }
-            ownershipInteger(ns.relation_version + 1, 'target_relation_version');
-            const record = this.newRecord({ operation_id: operationId ?? randomUUID(), operation, sub_aid: subAid, owner_aid: ownerAid, new_owner_aid: newOwnerAid, base_relation_version: ns.relation_version, target_relation_version: ns.relation_version + 1 }, this.local(), 'accept');
+            const targetVersion = ownershipInteger(ns.relation_version + (operation === 'release' ? 0 : 1), 'target_relation_version');
+            const record = this.newRecord({ operation_id: operationId ?? randomUUID(), operation, sub_aid: subAid, owner_aid: ownerAid, new_owner_aid: newOwnerAid, base_relation_version: ns.relation_version, target_relation_version: targetVersion }, this.local(), 'accept');
+            await this.captureBase(record, ns);
             if (operation !== 'release')
                 for (const to of participants(record))
                     if (to !== this.local())
@@ -509,6 +554,7 @@ export class OwnershipWorkflow {
             const ns = await this.readNs(record.sub_aid);
             if (ns.relation_version !== record.base_relation_version || (record.operation === 'bind' ? ns.lock !== 'unlocked' : ns.lock !== 'locked' || ns.owner_aid !== record.owner_aid))
                 throw ownershipFailure('conflict', 'the original relation changed before approval');
+            await this.assertBaseMaterial(handle, ns);
             record.local_decision = decision;
             record.approvals[this.local()] = decision;
             this.enqueue(record, record.initiator_aid, `${record.operation}.${decision === 'accept' ? 'accept' : 'reject'}`, reason);
@@ -540,19 +586,42 @@ export class OwnershipWorkflow {
         record.outbox.push({ to, payload });
         record.notices.push(key);
     }
+    validateOutgoing(record, item) {
+        try {
+            const message = parseOwnershipMessage(item.payload, { authenticated_from_aid: this.local(), local_aid: item.to, task: { ...record, local_decision: 'accept' } });
+            const rejected = ['bind.reject', 'transfer.reject'].includes(message.action);
+            if (message.action !== 'operation.stopped' && record.local_decision !== (rejected ? 'reject' : 'accept') || record.approvals[this.local()] !== record.local_decision)
+                throw new Error('ownership outgoing action lacks local approval');
+            if (['bind.request', 'transfer.request'].includes(message.action) && record.initiator_aid !== this.local())
+                throw new Error('ownership outgoing request is not from the initiator');
+            if ((message.action === 'transfer.ready' || message.action === 'owner.ready' && record.operation === 'bind') && !participants(record).every((aid) => record.approvals[aid] === 'accept'))
+                throw new Error('ownership outgoing action lacks participant approvals');
+        }
+        catch (error) {
+            throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
+        }
+    }
     async flush(handle) {
         while (handle.record.outbox.length) {
             const message = handle.record.outbox[0];
-            const ns = await this.readNs(handle.record.sub_aid);
+            this.validateOutgoing(handle.record, message);
             const record = handle.record;
+            if (['rejected', 'stopped', 'error'].includes(record.status) && !['bind.reject', 'transfer.reject', 'operation.stopped'].includes(message.payload.action)) {
+                record.outbox.shift();
+                await this.save(handle);
+                continue;
+            }
+            const ns = await this.readNs(record.sub_aid);
             const base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
-            const target = ns.relation_version === record.target_relation_version && (record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === targetOwner(record));
+            const target = record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === record.target_relation_version || ns.relation_version === 0) : ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record);
             const requiresTarget = ['relation.confirmed', 'sub.cleaned'].includes(message.payload.action);
             if (requiresTarget ? !target : !base) {
                 record.outbox.shift();
                 await this.save(handle);
                 continue;
             }
+            if (base && record.request_verified)
+                await this.assertBaseMaterial(handle, ns);
             if (message.payload.action === 'transfer.ready' && record.status !== 'completed') {
                 const expiresAt = record.files.transfer?.expires_at;
                 if (typeof expiresAt !== 'number' || !Number.isSafeInteger(expiresAt) || expiresAt <= 0)
@@ -567,19 +636,77 @@ export class OwnershipWorkflow {
     }
     async readNs(subAid) {
         const ns = await this.deps.files.readAgent(subAid);
-        const file = ns.exists && !(ns.lock === 'unlocked' && ns.relation_version > 0) ? await this.deps.files.verifyFile(ns.content, 'agent', subAid) : undefined;
-        if (ns.lock === 'unlocked' && ns.relation_version === 0 && file?.statement)
+        const file = ns.exists ? await this.deps.files.verifyFile(ns.content, 'agent', subAid) : undefined;
+        if (ns.relation_version !== (file?.statement?.relation_version ?? 0))
             throw ownershipFailure('unavailable', 'NS relation metadata does not match agent.md', true);
         const currentOwner = ns.lock === 'locked' ? file?.statement?.owner_aid : null;
         if (ns.lock === 'locked' && (!file?.statement || file.statement.relation_version !== ns.relation_version) || ns.owner_aid !== undefined && ns.owner_aid !== currentOwner)
             throw ownershipFailure('unavailable', 'NS owner metadata and signed agent.md do not agree', true);
         return { ...ns, owner_aid: currentOwner };
     }
+    async captureBase(record, ns) {
+        const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null;
+        record.base_agent_md = { exists: ns.exists, raw: ns.content, sha256: ownershipSha256(ns.content), etag: ns.etag, statement };
+        if (!statement) {
+            record.base_owner_md = { exists: false, raw: '', sha256: '' };
+            return;
+        }
+        const owner = await this.deps.files.readOwner(statement.owner_aid, record.sub_aid);
+        if ((record.operation === 'transfer' || record.operation === 'release' && ns.lock === 'locked') && !owner.exists)
+            throw ownershipFailure('unavailable', 'original owner.md is unavailable', true);
+        if (owner.exists)
+            await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, statement.owner_aid);
+        record.base_owner_md = { exists: owner.exists, raw: owner.content, sha256: owner.exists ? ownershipSha256(owner.content) : '' };
+    }
+    async assertBaseMaterial(handle, ns) {
+        const record = handle.record;
+        this.assertAgentBaseMaterial(record, ns);
+        const original = record.base_owner_md;
+        if (!original)
+            throw ownershipFailure('persistence_unavailable', 'original owner.md evidence is missing');
+        const originalOwnerAid = record.base_agent_md.statement?.owner_aid;
+        if (!originalOwnerAid)
+            return;
+        const current = await this.deps.files.readOwner(originalOwnerAid, record.sub_aid);
+        if (current.exists === original.exists && current.content === original.raw && (current.exists ? current.sha256 : '') === original.sha256)
+            return;
+        if (!current.exists)
+            throw ownershipFailure('conflict', 'the original owner.md was replaced');
+        const key = record.operation === 'bind' ? 'owner' : record.operation === 'release' ? 'release' : 'transfer';
+        const saved = record.files[key];
+        if (saved && saved.raw === current.content && saved.hash === current.sha256)
+            return;
+        if (record.operation !== 'bind' && this.local() !== record.owner_aid && record.local_decision === 'accept') {
+            const owner = await this.deps.files.verifyFile(current.content, 'owner', record.sub_aid, originalOwnerAid);
+            const previous = original.exists ? parseOwnershipFile(original.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: originalOwnerAid }) : undefined;
+            const sameStatement = previous?.statement && Object.keys(previous.statement).every((field) => previous.statement[field] === owner.statement?.[field]);
+            const allowed = sameStatement && (record.operation === 'release' ? owner.action === 'release' : owner.action === 'transfer_owner' && owner.transfer?.new_owner_aid === record.new_owner_aid && owner.transfer?.target_relation_version === record.target_relation_version);
+            if (allowed && !saved) {
+                if (record.operation === 'transfer')
+                    await this.deps.files.requireTransfer(this.fileTask(handle));
+                record.files[key] = { raw: current.content, hash: current.sha256, condition: {}, original_owner: original, ...(owner.transfer ? { expires_at: owner.transfer.expires_at } : {}) };
+                await this.save(handle);
+                return;
+            }
+        }
+        throw ownershipFailure('conflict', 'the original owner statement was replaced');
+    }
+    assertAgentBaseMaterial(record, ns) {
+        const base = record.base_agent_md;
+        if (!base)
+            throw ownershipFailure('persistence_unavailable', 'original agent.md evidence is missing');
+        const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null;
+        const same = base.statement ? Boolean(statement && Object.keys(base.statement).every((key) => base.statement[key] === statement[key])) : statement === null && ns.content === base.raw && ownershipSha256(ns.content) === base.sha256;
+        if (ns.exists !== base.exists || !same)
+            throw ownershipFailure('conflict', 'the original ownership statement was replaced');
+    }
     async processInbox(handle) {
         const record = handle.record;
         while (record.inbox.length) {
             const item = record.inbox[0];
             const ns = await this.readNs(record.sub_aid);
+            if (record.request_verified && ns.relation_version === record.base_relation_version && !['relation.confirmed', 'sub.cleaned'].includes(item.payload.action))
+                await this.assertBaseMaterial(handle, ns);
             try {
                 parseOwnershipMessage(item.payload, { authenticated_from_aid: item.from, local_aid: this.local(), task: record, ns });
             }
@@ -596,11 +723,60 @@ export class OwnershipWorkflow {
                 continue;
             }
             const action = item.payload.action;
-            if (['bind.request', 'transfer.request'].includes(action))
+            if (['bind.request', 'transfer.request'].includes(action)) {
+                if (!record.request_verified)
+                    await this.captureBase(record, ns);
                 record.request_verified = true;
+            }
             if (['bind.accept', 'transfer.accept', 'bind.reject', 'transfer.reject'].includes(action)) {
                 if (record.approvals[item.from] === 'pending' && record.status === 'pending') {
                     const rejected = action.endsWith('.reject');
+                    if (rejected) {
+                        try {
+                            if (await this.confirm(handle)) {
+                                record.inbox.shift();
+                                record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
+                                await this.save(handle);
+                                continue;
+                            }
+                            const observed = await this.deps.files.checkConsensus(record.sub_aid, { owner_aid: targetOwner(record), relation_version: record.target_relation_version });
+                            const targetReached = observed.status === 'consensus' && observed.owner_aid === targetOwner(record) && observed.relation_version === record.target_relation_version;
+                            if (targetReached) {
+                                record.code = 'unavailable';
+                                record.reason = 'ownership target is committed but local evidence is incomplete';
+                                record.retryable = true;
+                                record.inbox.shift();
+                                record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
+                                await this.save(handle);
+                                continue;
+                            }
+                        }
+                        catch (error) {
+                            if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
+                                throw error;
+                            try {
+                                const ns = await this.readNs(record.sub_aid);
+                                if (ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record)) {
+                                    record.code = 'unavailable';
+                                    record.reason = 'ownership target is committed but local evidence is incomplete';
+                                    record.retryable = true;
+                                    record.inbox.shift();
+                                    record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
+                                    await this.save(handle);
+                                    continue;
+                                }
+                            }
+                            catch (observationError) {
+                                if (observationError instanceof StateError && observationError.stringCode === 'persistence_unavailable')
+                                    throw observationError;
+                            }
+                            record.code = error instanceof StateError ? error.stringCode : 'unavailable';
+                            record.reason = error instanceof Error ? error.message : String(error);
+                            record.retryable = true;
+                            await this.save(handle);
+                            throw error;
+                        }
+                    }
                     record.approvals[item.from] = rejected ? 'reject' : 'accept';
                     if (rejected) {
                         record.status = 'rejected';
@@ -625,8 +801,30 @@ export class OwnershipWorkflow {
                 if (!file.statement)
                     record.cleanup_status = 'cleaned';
             }
-            if (record.operation === 'release')
+            if (record.operation === 'release' && !record.request_verified) {
+                if (ns.relation_version === 0) {
+                    const authorizationId = this.cleanupEvidence(record, { agent_md_etag: ns.etag, agent_md_sha256: ownershipSha256(ns.content), owner_md_sha256: '' }, ns.content);
+                    if (!authorizationId)
+                        throw ownershipFailure('conflict', 'no local cleanup evidence can verify the release request');
+                    const authorization = this.load(authorizationId).record;
+                    const saved = authorization.files.agent;
+                    const statement = parseOwnershipFile(saved.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+                    const etag = saved.published_etag ?? authorization.completion_evidence?.agent_md_etag;
+                    if (!etag)
+                        throw ownershipFailure('persistence_unavailable', 'historical approved agent.md ETag is missing');
+                    record.base_agent_md = { exists: true, raw: saved.raw, sha256: saved.hash, etag, statement };
+                    const owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+                    if (owner.exists)
+                        await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
+                    record.base_owner_md = { exists: owner.exists, raw: owner.content, sha256: owner.exists ? ownershipSha256(owner.content) : '' };
+                    record.cleanup_authorization_id = authorizationId;
+                    if (!(await this.confirm(handle)))
+                        throw ownershipFailure('conflict', 'no local cleanup evidence can verify the release request');
+                }
+                else
+                    await this.captureBase(record, ns);
                 record.request_verified = true;
+            }
             record.inbox.shift();
             record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
             const request = record.request_verified && record.local_decision === 'pending' && record.operation !== 'release' && !record.request_notified;
@@ -645,7 +843,7 @@ export class OwnershipWorkflow {
         const record = handle.record;
         const task = { operation_id: record.operation_id, operation: record.operation, sub_aid: record.sub_aid, owner_aid: record.owner_aid,
             new_owner_aid: record.new_owner_aid, base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version,
-            files: record.files, authorization_sha256: record.authorization_sha256, expires_at: record.expires_at,
+            files: record.files, authorization_sha256: record.authorization_sha256, expires_at: record.expires_at, base_agent_md: record.base_agent_md, base_owner_md: record.base_owner_md,
             persist: async () => {
                 record.authorization_sha256 = task.authorization_sha256;
                 record.expires_at = task.expires_at;
@@ -703,6 +901,7 @@ export class OwnershipWorkflow {
             if (ns.relation_version !== record.base_relation_version || record.operation === 'bind' && ns.lock !== 'unlocked' || record.operation === 'transfer' && (ns.lock !== 'locked' || ns.owner_aid !== record.owner_aid)) {
                 throw ownershipFailure('conflict', 'the original relation was replaced');
             }
+            await this.assertBaseMaterial(handle, ns);
             if (record.expires_at !== undefined && record.expires_at <= Math.trunc(Date.now() / 1000))
                 throw ownershipFailure('conflict', 'transfer authorization expired');
             const approved = participants(record).every((name) => record.approvals[name] === 'accept');
@@ -722,8 +921,11 @@ export class OwnershipWorkflow {
             }
             if (record.operation === 'transfer') {
                 const original = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-                if (original.exists && (await this.deps.files.verifyFile(original.content, 'owner', record.sub_aid, record.owner_aid)).action === 'declare')
+                if (original.exists && (await this.deps.files.verifyFile(original.content, 'owner', record.sub_aid, record.owner_aid)).action === 'declare') {
+                    if (record.authorization_sha256 !== undefined)
+                        throw ownershipFailure('conflict', 'transfer authorization was withdrawn');
                     return;
+                }
                 await this.deps.files.requireTransfer(this.fileTask(handle));
             }
             if (this.local() === targetOwner(record)) {
@@ -753,16 +955,67 @@ export class OwnershipWorkflow {
         const result = observed ?? await this.deps.files.checkConsensus(record.sub_aid, record.operation === 'release' ? undefined : { owner_aid: targetOwner(record), relation_version: record.target_relation_version });
         if (result.status === 'invalid' || result.status === 'unavailable')
             throw ownershipFailure(result.code ?? result.status, result.reason ?? 'ownership consensus cannot be verified', result.retryable);
-        const reached = result.relation_version === record.target_relation_version && (record.operation === 'release' ? result.status === 'released' && result.lock === 'unlocked' : result.status === 'consensus' && result.owner_aid === targetOwner(record));
+        if (record.operation === 'release' && record.status === 'completed' && result.status === 'unbound' && result.relation_version === 0)
+            return true;
+        let cleaned = false;
+        if (record.operation === 'release' && result.status === 'unbound' && result.relation_version === 0) {
+            const began = Date.now();
+            const ns = await this.readNs(record.sub_aid);
+            if (!ns.exists || !ns.etag)
+                throw ownershipFailure('conflict', 'current signed cleanup document is missing');
+            if (ns.etag !== result.agent_md_etag || ownershipSha256(ns.content) !== result.agent_md_sha256)
+                throw ownershipFailure('unavailable', 'agent.md changed during cleanup confirmation', true);
+            if (record.local_roles.includes('owner') && record.files.release) {
+                const source = record.files.release, owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+                if (owner.exists && owner.content === source.raw && owner.sha256 === source.hash) {
+                    await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
+                    const after = await this.readNs(record.sub_aid);
+                    if (after.etag !== ns.etag || after.content !== ns.content || after.relation_version !== 0 || after.lock !== 'unlocked')
+                        throw ownershipFailure('unavailable', 'agent.md changed during release confirmation', true);
+                    result.owner_md_sha256 = owner.sha256;
+                }
+            }
+            const authorization = this.cleanupEvidence(record, result, ns.content);
+            if (!authorization)
+                throw ownershipFailure('conflict', 'no local cleanup original can confirm this release task');
+            if (Date.now() - began > 30_000)
+                throw ownershipFailure('unavailable', 'cleanup confirmation verification window elapsed', true);
+            if (authorization !== record.operation_id)
+                record.cleanup_authorization_id = authorization;
+            record.local_decision = 'accept';
+            record.approvals[this.local()] = 'accept';
+            record.cleanup_status = 'cleaned';
+            cleaned = true;
+        }
+        const reached = cleaned || result.relation_version === record.target_relation_version && (record.operation === 'release' ? result.status === 'released' && result.lock === 'unlocked' : result.status === 'consensus' && result.owner_aid === targetOwner(record));
         if (!reached)
             return false;
+        if (record.operation === 'release' && !cleaned) {
+            const ns = await this.readNs(record.sub_aid);
+            const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement;
+            if (ns.etag !== result.agent_md_etag || ownershipSha256(ns.content) !== result.agent_md_sha256)
+                throw ownershipFailure('unavailable', 'agent.md changed during release confirmation', true);
+            if (statement?.owner_aid !== record.owner_aid || statement.relation_version !== record.base_relation_version)
+                return false;
+            if (record.base_agent_md)
+                this.assertAgentBaseMaterial(record, ns);
+            if (record.files.release && result.owner_md_sha256 && record.files.release.hash !== result.owner_md_sha256)
+                throw ownershipFailure('conflict', 'current release material does not belong to this task');
+        }
         if (record.operation === 'release' && record.local_roles.includes('owner') && !record.files.release)
             throw ownershipFailure('conflict', 'local release file evidence is missing');
         if (record.operation === 'transfer' && record.local_roles.includes('owner') && !record.files.transfer)
             throw ownershipFailure('conflict', 'local transfer file evidence is missing');
         if (record.operation === 'release' && this.local() === record.sub_aid && record.local_decision !== 'accept') {
+            const authorization = await this.cleanupAuthorization(record);
+            if (authorization) {
+                record.local_decision = 'accept';
+                record.approvals[this.local()] = 'accept';
+                record.cleanup_authorization_id = authorization.operation_id;
+                await this.save(handle);
+            }
             const ns = await this.deps.files.readAgent(record.sub_aid);
-            if (parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
+            if (!authorization && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
                 record.step = 'cleanup';
                 if (record.cleanup_status !== 'action_required') {
                     record.cleanup_status = 'action_required';
@@ -774,12 +1027,12 @@ export class OwnershipWorkflow {
         }
         if (record.operation !== 'release' && (record.local_decision !== 'accept' || this.local() === record.sub_aid && (!record.files.agent || record.files.agent.hash !== result.agent_md_sha256) || this.local() === targetOwner(record) && (!record.files.owner || record.files.owner.hash !== result.owner_md_sha256)))
             return false;
-        if (record.status !== 'completed' && record.operation !== 'release' && (this.local() === record.sub_aid && record.files.agent?.published_revision !== undefined && record.files.agent.published_revision !== result.agent_md_etag || this.local() === targetOwner(record) && record.files.owner?.published_revision !== undefined && record.files.owner.published_revision !== result.owner_md_revision))
-            throw ownershipFailure('conflict', 'published ownership file revision changed');
+        if (record.status !== 'completed' && record.operation !== 'release' && this.local() === record.sub_aid && record.files.agent?.published_etag !== undefined && record.files.agent.published_etag !== result.agent_md_etag)
+            throw ownershipFailure('conflict', 'published agent.md ETag changed');
         if (record.status !== 'completed') {
             record.status = 'completed';
             record.step = 'confirmed';
-            record.verified_relation_version = result.relation_version;
+            record.verified_relation_version = record.target_relation_version;
             record.completion_evidence = { ...result };
             delete record.code;
             delete record.reason;
@@ -794,15 +1047,58 @@ export class OwnershipWorkflow {
         }
         return true;
     }
+    cleanupEvidence(record, evidence, raw) {
+        const release = record.files.release;
+        if (record.local_roles.includes('owner') && release && release.hash === evidence.owner_md_sha256)
+            return record.operation_id;
+        if (!record.local_roles.includes('sub'))
+            return undefined;
+        const matches = (saved) => Boolean(saved && saved.hash === evidence.agent_md_sha256 && saved.hash === ownershipSha256(saved.raw) && (saved.published_etag === undefined || saved.published_etag === evidence.agent_md_etag) && (raw === undefined || raw === saved.raw));
+        if (matches(record.files.agent))
+            return record.operation_id;
+        for (const snapshot of this.list(true)) {
+            if (!['bind', 'transfer'].includes(String(snapshot.task.operation)) || record.cleanup_authorization_id && snapshot.operation_id !== record.cleanup_authorization_id)
+                continue;
+            let candidate;
+            try {
+                candidate = this.decode(snapshot).record;
+            }
+            catch (error) {
+                if (snapshot.task.sub_aid === record.sub_aid)
+                    throw error;
+                else
+                    continue;
+            }
+            if (candidate.local_decision !== 'accept' || !candidate.local_roles.includes('sub') || candidate.sub_aid !== record.sub_aid || targetOwner(candidate) !== record.owner_aid || candidate.target_relation_version !== record.base_relation_version || !matches(candidate.release_cleanup?.files.agent))
+                continue;
+            const statement = candidate.files.agent && parseOwnershipFile(candidate.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+            if (statement?.owner_aid === record.owner_aid && statement.relation_version === record.base_relation_version && (!record.base_agent_md?.statement || Object.keys(record.base_agent_md.statement).every((field) => record.base_agent_md.statement[field] === statement[field])))
+                return candidate.operation_id;
+        }
+        return undefined;
+    }
     async resumeSubCleanup(handle, observed) {
         const record = handle.record;
-        if (!['bind', 'transfer'].includes(record.operation) || !record.local_roles.includes('sub') || record.local_decision !== 'accept' || observed.status !== 'released' || observed.relation_version !== record.target_relation_version + 1 || record.release_cleanup?.cleaned)
+        if (!['bind', 'transfer'].includes(record.operation) || !record.local_roles.includes('sub') || record.local_decision !== 'accept' || record.release_cleanup?.cleaned)
+            return;
+        if (record.release_cleanup && observed.status === 'unbound' && observed.relation_version === 0) {
+            const saved = record.release_cleanup.files.agent;
+            const ns = await this.readNs(record.sub_aid);
+            if (!saved || saved.raw !== ns.content || saved.hash !== observed.agent_md_sha256 || saved.hash !== ownershipSha256(ns.content) || ns.etag !== observed.agent_md_etag || saved.published_etag !== undefined && saved.published_etag !== ns.etag)
+                throw ownershipFailure('conflict', 'historical cleanup original does not match current material');
+            saved.published_etag = ns.etag;
+            record.release_cleanup.cleaned = true;
+            await this.save(handle);
+            return;
+        }
+        if (observed.status !== 'released' || observed.relation_version !== record.target_relation_version)
             return;
         const ns = await this.readNs(record.sub_aid);
         if (!ns.exists || ns.lock !== 'unlocked' || ns.relation_version !== observed.relation_version || ns.etag !== observed.agent_md_etag || ownershipSha256(ns.content) !== observed.agent_md_sha256)
             throw ownershipFailure('unavailable', 'NS changed during historical cleanup observation', true);
         const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement;
-        if (statement && (statement.owner_aid !== targetOwner(record) || statement.relation_version !== record.target_relation_version))
+        const original = record.files.agent && parseOwnershipFile(record.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+        if (!statement || !original || Object.keys(original).some((field) => original[field] !== statement[field]))
             throw ownershipFailure('conflict', 'historical cleanup fields belong to another relation');
         if (!record.release_cleanup) {
             record.release_cleanup = { files: {}, cleaned: false };
@@ -810,16 +1106,26 @@ export class OwnershipWorkflow {
         }
         await this.deps.files.revokeOwneraid({ operation: 'release', sub_aid: record.sub_aid, owner_aid: targetOwner(record),
             base_relation_version: record.target_relation_version, target_relation_version: observed.relation_version,
-            files: record.release_cleanup.files, persist: () => this.save(handle) });
+            files: record.release_cleanup.files, expected_agent_statement: original, persist: () => this.save(handle) });
         record.release_cleanup.cleaned = true;
         await this.save(handle);
         this.emit(record, 'ownership.progress');
     }
-    cleanupAuthorization(task) {
-        for (const snapshot of this.list()) {
+    async cleanupAuthorization(task) {
+        const ns = await this.readNs(task.sub_aid);
+        const statement = ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: task.sub_aid }).statement : undefined;
+        if (!statement)
+            return undefined;
+        for (const snapshot of this.list(true)) {
+            if (snapshot.task.sub_aid !== task.sub_aid)
+                continue;
             const candidate = this.decode(snapshot).record;
-            if (['bind', 'transfer'].includes(candidate.operation) && candidate.local_decision === 'accept' && candidate.local_roles.includes('sub') && candidate.sub_aid === task.sub_aid && targetOwner(candidate) === task.owner_aid && candidate.target_relation_version === task.base_relation_version)
-                return candidate;
+            if (['bind', 'transfer'].includes(candidate.operation) && candidate.local_decision === 'accept' && candidate.local_roles.includes('sub') && candidate.sub_aid === task.sub_aid && targetOwner(candidate) === task.owner_aid && candidate.target_relation_version === task.base_relation_version && candidate.files.agent) {
+                const original = parseOwnershipFile(candidate.files.agent.raw, 'agent', { expectedSubAid: task.sub_aid }).statement;
+                const fixed = task.base_agent_md?.statement;
+                if (original && Object.keys(original).every((field) => original[field] === statement[field]) && (!fixed || Object.keys(fixed).every((field) => fixed[field] === original[field])))
+                    return candidate;
+            }
         }
         return undefined;
     }
@@ -829,12 +1135,14 @@ export class OwnershipWorkflow {
             return;
         if (record.operation === 'release' && this.local() === record.sub_aid && record.cleanup_status !== 'cleaned') {
             const ns = await this.readNs(record.sub_aid);
-            if (ns.exists && ns.lock === 'unlocked' && ns.relation_version === record.target_relation_version && !parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
+            if (ns.exists && ns.lock === 'unlocked' && ns.relation_version === 0 && !parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
+                if (!this.cleanupEvidence(record, { agent_md_sha256: ownershipSha256(ns.content), agent_md_etag: ns.etag, owner_md_sha256: '' }, ns.content))
+                    throw ownershipFailure('conflict', 'current cleanup does not match a locally saved original');
                 record.cleanup_status = 'cleaned';
                 await this.save(handle);
             }
             else {
-                const authorization = this.cleanupAuthorization(record);
+                const authorization = await this.cleanupAuthorization(record);
                 if (!authorization || record.cleanup_authorization_id && authorization.operation_id !== record.cleanup_authorization_id) {
                     if (record.cleanup_status !== 'action_required') {
                         record.cleanup_status = 'action_required';
@@ -845,7 +1153,9 @@ export class OwnershipWorkflow {
                 else {
                     record.cleanup_authorization_id = authorization.operation_id;
                     await this.save(handle);
-                    await this.deps.files.revokeOwneraid(this.fileTask(handle));
+                    const task = this.fileTask(handle);
+                    task.expected_agent_statement = parseOwnershipFile(authorization.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+                    await this.deps.files.revokeOwneraid(task);
                     record.cleanup_status = 'cleaned';
                     this.enqueue(record, record.owner_aid, 'sub.cleaned');
                     await this.save(handle);