@agentunion/fastaun 0.5.19 → 0.5.21

package/dist/ownership-workflow.js

@@ -3,6 +3,13 @@ import { isScalar, parseDocument } from 'yaml';
 import { StateError, ValidationError } from './errors.js';
 import { OWNERSHIP_UUID_V4_RE, ownershipAid, ownershipFailure, ownershipInteger, ownershipSha256, parseOwnershipFile, requireOwnershipApplicable } from './ownership-v21.js';
 export const OWNERSHIP_SDK_MESSAGE_TYPE = 'aun.ownership.sdk.v1';
+class OwnershipTaskDecodeError extends StateError {
+    operationId;
+    constructor(operationId, reason) {
+        super(reason, { stringCode: 'persistence_unavailable' });
+        this.operationId = operationId;
+    }
+}
 function participants(task) {
     return [...new Set([task.owner_aid, task.sub_aid, ...(task.new_owner_aid ? [task.new_owner_aid] : [])])];
 }
@@ -36,15 +43,16 @@ export function parseOwnershipMessage(content, context) {
         throw new ValidationError('ownership message contains unknown or missing fields');
     if (message.type !== OWNERSHIP_SDK_MESSAGE_TYPE)
         throw ownershipFailure('unsupported_protocol', 'legacy ownership control is unsupported');
-    if (!OWNERSHIP_UUID_V4_RE.test(message.operation_id))
+    if (typeof message.operation_id !== 'string' || !OWNERSHIP_UUID_V4_RE.test(message.operation_id))
         throw new ValidationError('operation_id must be a UUIDv4');
     if (!['bind', 'release', 'transfer'].includes(message.operation))
         throw new ValidationError('ownership operation is invalid');
     ownershipAid(message.sub_aid, 'sub_aid');
     ownershipAid(message.owner_aid, 'owner_aid');
     ownershipInteger(message.base_relation_version, 'base_relation_version', 0);
-    if (ownershipInteger(message.target_relation_version, 'target_relation_version') !== message.base_relation_version + 1)
-        throw new ValidationError('ownership target version must be base plus one');
+    const target = ownershipInteger(message.target_relation_version, 'target_relation_version');
+    if (target !== message.base_relation_version + 1 && !(message.operation === 'release' && target === message.base_relation_version))
+        throw new ValidationError('ownership target version does not match the operation');
     if (message.operation === 'transfer') {
         if (ownershipAid(message.new_owner_aid, 'new_owner_aid') === message.owner_aid)
             throw new ValidationError('transfer target must differ from current owner');
@@ -107,7 +115,7 @@ export function parseOwnershipMessage(content, context) {
         if (ns.protocol !== '2.1')
             throw ownershipFailure('unsupported_protocol', 'NS ownership protocol is unavailable');
         const base = ns.relation_version === message.base_relation_version && (message.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === message.owner_aid);
-        const target = ns.relation_version === message.target_relation_version && (message.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === targetOwner(message));
+        const target = message.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === message.base_relation_version || ns.relation_version === 0) : ns.relation_version === message.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(message);
         if (['relation.confirmed', 'sub.cleaned'].includes(message.action) ? !target : !base && !target)
             throw ownershipFailure('conflict', 'ownership current NS relation does not match this task');
     }
@@ -154,7 +162,7 @@ export class OwnershipWorkflow {
         return this.start('transfer', ownershipAid(subAid, 'sub_aid'), this.local(), ownershipAid(newOwnerAid, 'new_owner_aid'));
     }
     async resumeRegistration(ownerAid, operationId) {
-        if (!OWNERSHIP_UUID_V4_RE.test(operationId))
+        if (typeof operationId !== 'string' || !OWNERSHIP_UUID_V4_RE.test(operationId))
             throw ownershipFailure('invalid', 'registration operation_id is invalid');
         return this.start('bind', this.local(), ownershipAid(ownerAid, 'owner_aid'), undefined, operationId);
     }
@@ -166,6 +174,95 @@ export class OwnershipWorkflow {
             throw ownershipFailure('invalid', 'ownership rejection reason must be a string');
         return this.decide(operationId, 'reject', reason);
     }
+    async resetOwnershipTask() {
+        if (!this.deps.store.loadOwnershipTaskSource || !this.deps.store.resetOwnershipTask)
+            throw ownershipFailure('persistence_unavailable', 'atomic ownership task reset storage is unavailable');
+        const local = this.local(), check = () => { if (this.local() !== local)
+            throw ownershipFailure('conflict', 'ownership reset identity changed'); };
+        const reset = [], skipped = [];
+        for (const snapshot of this.list(true)) {
+            check();
+            if (!OWNERSHIP_UUID_V4_RE.test(snapshot.operation_id)) {
+                skipped.push(snapshot.operation_id);
+                continue;
+            }
+            let source = this.taskSource(snapshot.operation_id);
+            for (let attempt = 0; source; attempt++) {
+                let task;
+                try {
+                    const parsed = JSON.parse(source.source);
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                        task = parsed;
+                }
+                catch { }
+                if (task && Object.hasOwn(task, 'task_reset')) {
+                    try {
+                        this.decode({ operation_id: source.operation_id, revision: source.revision, task });
+                    }
+                    catch {
+                        skipped.push(snapshot.operation_id);
+                    }
+                    break;
+                }
+                let initiator;
+                try {
+                    initiator = ownershipAid(task?.initiator_aid, 'initiator_aid');
+                }
+                catch { }
+                if (!task || !initiator || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(task.status)) {
+                    skipped.push(snapshot.operation_id);
+                    break;
+                }
+                if (initiator !== local || ['completed', 'rejected', 'stopped'].includes(task.status))
+                    break;
+                let subject;
+                try {
+                    subject = ownershipAid(task.sub_aid, 'sub_aid');
+                }
+                catch { }
+                try {
+                    const original = source, result = await this.runSerialized(subject ?? source.operation_id, () => { check(); return this.resetSource(original, subject); });
+                    check();
+                    if (result.created)
+                        reset.push(source.operation_id);
+                    break;
+                }
+                catch (error) {
+                    check();
+                    if (attempt > 0 || !(error instanceof StateError) || error.stringCode !== 'conflict')
+                        throw error;
+                    source = this.taskSource(snapshot.operation_id);
+                }
+            }
+        }
+        check();
+        return { reset_operation_ids: [...new Set(reset)].sort(), skipped_operation_ids: [...new Set(skipped)].sort() };
+    }
+    async resetTask(operationId) {
+        if (typeof operationId !== 'string' || !OWNERSHIP_UUID_V4_RE.test(operationId))
+            throw ownershipFailure('invalid', 'ownership operation_id is invalid');
+        const source = this.taskSource(operationId);
+        if (!source)
+            throw ownershipFailure('operation_not_found', 'no local ownership task matches operation_id');
+        let task = {};
+        try {
+            const parsed = JSON.parse(source.source);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                task = parsed;
+        }
+        catch { }
+        if (Object.hasOwn(task, 'task_reset')) {
+            this.decode({ operation_id: operationId, revision: source.revision, task });
+            return { operation_id: operationId, reset: true };
+        }
+        let subject;
+        try {
+            subject = ownershipAid(task.sub_aid, 'sub_aid');
+        }
+        catch { }
+        await this.runSerialized(subject ?? operationId, () => this.resetSource(source, subject));
+        return { operation_id: operationId, reset: true };
+    }
     async checkOwnershipConsensus(subAid = this.local()) {
         return this.deps.files.checkConsensus(ownershipAid(subAid, 'sub_aid'));
     }
@@ -188,8 +285,12 @@ export class OwnershipWorkflow {
             return true;
         let message;
         try {
+            const saved = this.load(String(body.operation_id));
+            if (saved && this.isReset(saved.record))
+                return true;
+            const task = saved && !saved.record.base_agent_md && saved.record.request_verified && !['completed', 'stopped', 'rejected'].includes(saved.record.status) ? this.legacyTaskView(saved.record) : saved?.record;
             message = parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local(),
-                task: ['bind.request', 'transfer.request'].includes(String(body.action)) || body.operation === 'release' && body.action === 'relation.confirmed' ? undefined : this.load(String(body.operation_id))?.record });
+                task: task ?? (['bind.request', 'transfer.request'].includes(String(body.action)) || body.operation === 'release' && body.action === 'relation.confirmed' ? undefined : saved?.record) });
         }
         catch (error) {
             if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
@@ -209,32 +310,26 @@ export class OwnershipWorkflow {
         return this.runSerialized(message.sub_aid, async () => {
             let handle = this.load(message.operation_id);
             if (handle) {
+                const task = !handle.record.base_agent_md && handle.record.request_verified && !['completed', 'stopped', 'rejected'].includes(handle.record.status) ? this.legacyTaskView(handle.record) : handle.record;
                 try {
-                    parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local(), task: handle.record });
+                    parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local(), task });
                 }
                 catch {
                     return true;
                 }
+                await this.upgradeLegacy(handle);
             }
             else {
                 if (!['bind.request', 'transfer.request'].includes(message.action) && !(message.operation === 'release' && message.action === 'relation.confirmed'))
                     return true;
                 handle = { record: this.newRecord(message, from, 'pending'), revision: null };
-                if (message.operation === 'release') {
-                    const authorization = this.cleanupAuthorization(handle.record);
-                    if (authorization) {
-                        handle.record.local_decision = 'accept';
-                        handle.record.approvals[this.local()] = 'accept';
-                        handle.record.cleanup_authorization_id = authorization.operation_id;
-                    }
-                }
             }
             if (message.action === 'sub.cleaned') {
                 const began = Date.now();
                 const before = await this.readNs(message.sub_aid), after = await this.readNs(message.sub_aid);
                 if (Date.now() - began > 30_000 || before.exists !== after.exists || before.etag !== after.etag || before.relation_version !== after.relation_version || before.lock !== after.lock || before.owner_aid !== after.owner_aid || ownershipSha256(before.content) !== ownershipSha256(after.content))
                     throw ownershipFailure('unavailable', 'NS changed during sub cleanup verification', true);
-                if (!before.exists || before.relation_version !== message.target_relation_version || before.lock !== 'unlocked' || before.owner_aid || !before.etag)
+                if (!before.exists || before.relation_version !== 0 || before.lock !== 'unlocked' || before.owner_aid || !before.etag)
                     return true;
                 const file = parseOwnershipFile(before.content, 'agent', { expectedSubAid: message.sub_aid });
                 if (Object.hasOwn(file.frontmatter, 'owner') || Object.hasOwn(file.frontmatter, 'ownership'))
@@ -253,15 +348,27 @@ export class OwnershipWorkflow {
         });
     }
     async resume() {
-        for (const snapshot of this.list()) {
-            const record = this.decode(snapshot).record;
-            await this.runSerialized(record.sub_aid, async () => {
-                const handle = this.load(record.operation_id);
-                await this.drive(handle);
-                if (handle.record.request_verified && handle.record.local_decision === 'pending' && handle.record.status === 'pending' && handle.record.operation !== 'release')
-                    this.emit(handle.record, 'ownership.request');
-            });
+        const failed = [];
+        for (const snapshot of this.list(true)) {
+            try {
+                const record = this.decode(snapshot).record;
+                if (this.isReset(record))
+                    continue;
+                if (!record.base_agent_md && record.request_verified && ['completed', 'stopped', 'rejected'].includes(record.status))
+                    continue;
+                await this.runSerialized(record.sub_aid, async () => {
+                    const handle = this.load(record.operation_id);
+                    await this.drive(handle);
+                    if (handle.record.request_verified && handle.record.local_decision === 'pending' && handle.record.status === 'pending' && handle.record.operation !== 'release')
+                        this.emit(handle.record, 'ownership.request');
+                });
+            }
+            catch (error) {
+                failed.push(`${snapshot.operation_id}: ${error instanceof Error ? error.message : String(error)}`);
+            }
         }
+        if (failed.length)
+            throw ownershipFailure('persistence_unavailable', failed.join('; '));
     }
     local() { return ownershipAid(this.deps.currentAid(), 'local_aid'); }
     requireApplicable(subAid) {
@@ -273,9 +380,9 @@ export class OwnershipWorkflow {
             throw ownershipFailure('persistence_unavailable', 'atomic ownership task storage is unavailable');
         return this.deps.store;
     }
-    list() {
+    list(isolateErrors = false) {
         try {
-            return this.store().listOwnershipTasks(this.local());
+            return this.store().listOwnershipTasks(this.local(), isolateErrors);
         }
         catch (error) {
             throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
@@ -290,11 +397,116 @@ export class OwnershipWorkflow {
             throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
         }
     }
+    taskSource(operationId) {
+        try {
+            if (!this.deps.store.loadOwnershipTaskSource || !this.deps.store.resetOwnershipTask)
+                throw new Error('atomic ownership task reset storage is unavailable');
+            return this.deps.store.loadOwnershipTaskSource(this.local(), operationId);
+        }
+        catch (error) {
+            throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
+        }
+    }
+    async resetSource(source, subject) {
+        const task = { protocol: '2.1', operation_id: source.operation_id, local_aid: this.local(), status: 'stopped', step: 'reset',
+            ...(subject ? { sub_aid: subject } : {}), task_reset: { source: source.source, source_sha256: ownershipSha256(source.source), revision: source.revision, reset_at: Math.trunc(Date.now() / 1000) } };
+        try {
+            const saved = this.deps.store.resetOwnershipTask(this.local(), source.operation_id, source.revision, source.source, task);
+            this.decode(saved);
+            if (!this.isReset(saved.task))
+                throw new Error('ownership reset marker was not saved');
+            const committed = this.taskSource(source.operation_id);
+            if (!committed || committed.revision !== saved.revision || JSON.stringify(JSON.parse(committed.source)) !== JSON.stringify(saved.task))
+                throw new Error('ownership reset marker readback failed');
+            return { operation_id: source.operation_id, reset: true, created: true };
+        }
+        catch (error) {
+            if (!(error instanceof Error) || !/snapshot|revision conflict|already reset/.test(error.message))
+                throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
+            const winner = this.taskSource(source.operation_id);
+            if (winner) {
+                let parsed;
+                try {
+                    parsed = JSON.parse(winner.source);
+                }
+                catch { }
+                if (parsed && typeof parsed === 'object' && Object.hasOwn(parsed, 'task_reset')) {
+                    this.decode({ operation_id: winner.operation_id, revision: winner.revision, task: parsed });
+                    return { operation_id: source.operation_id, reset: true, created: false };
+                }
+            }
+            throw ownershipFailure(error instanceof Error && /revision|snapshot|conflict/.test(error.message) ? 'conflict' : 'persistence_unavailable', error instanceof Error ? error.message : String(error));
+        }
+    }
+    isReset(record) { return Object.hasOwn(record, 'task_reset'); }
+    async resetUnusableTasks(subAid, ownerAid) {
+        for (const snapshot of this.list(true)) {
+            if (this.isReset(snapshot.task)) {
+                this.decode(snapshot);
+                continue;
+            }
+            if (snapshot.task.sub_aid !== subAid)
+                continue;
+            if (!this.isReset(snapshot.task) && ['completed', 'rejected', 'stopped'].includes(snapshot.task.status))
+                continue;
+            let record;
+            let unusable = false;
+            try {
+                record = this.decode(snapshot).record;
+            }
+            catch (error) {
+                if (this.isReset(snapshot.task) || !(error instanceof OwnershipTaskDecodeError) || error.operationId !== snapshot.operation_id)
+                    throw error;
+                unusable = true;
+                record = snapshot.task;
+            }
+            if (!unusable && !this.isReset(record) && !record.base_agent_md && record.request_verified && !['completed', 'stopped', 'rejected'].includes(record.status) && record.operation === 'bind' && record.owner_aid === ownerAid && record.initiator_aid === this.local()) {
+                try {
+                    this.legacyTaskView(record);
+                }
+                catch {
+                    unusable = true;
+                }
+            }
+            if (!unusable)
+                continue;
+            const source = this.taskSource(snapshot.operation_id);
+            if (!source || source.revision !== snapshot.revision)
+                throw ownershipFailure('conflict', 'ownership task advanced before automatic reset');
+            let parsed;
+            try {
+                parsed = JSON.parse(source.source);
+            }
+            catch { }
+            if (!parsed || typeof parsed !== 'object' || parsed.sub_aid !== subAid)
+                throw ownershipFailure('persistence_unavailable', 'ownership task subject cannot be established for automatic reset');
+            if (Object.hasOwn(parsed, 'task_reset'))
+                throw ownershipFailure('persistence_unavailable', 'ownership reset marker is corrupt');
+            if (['completed', 'rejected', 'stopped'].includes(parsed.status))
+                continue;
+            await this.resetSource(source, subAid);
+        }
+    }
     decode(snapshot) {
         const record = snapshot.task;
         try {
-            if (record.protocol !== '2.1' || !OWNERSHIP_UUID_V4_RE.test(record.operation_id) || record.operation_id !== snapshot.operation_id || !['bind', 'release', 'transfer'].includes(record.operation) || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(record.status) || typeof record.step !== 'string')
+            if (this.isReset(record)) {
+                const task = snapshot.task, reset = task.task_reset;
+                if (task.protocol !== '2.1' || task.operation_id !== snapshot.operation_id || !OWNERSHIP_UUID_V4_RE.test(snapshot.operation_id) || task.local_aid !== this.local() || task.status !== 'stopped' || task.step !== 'reset' || Object.keys(task).some((key) => !['protocol', 'operation_id', 'local_aid', 'status', 'step', 'sub_aid', 'task_reset'].includes(key)) || !reset || typeof reset !== 'object' || Array.isArray(reset) || Object.keys(reset).length !== 4 || typeof reset.source !== 'string' || reset.source_sha256 !== ownershipSha256(reset.source) || !Number.isSafeInteger(reset.revision) || Number(reset.revision) < 1 || Number(reset.revision) + 1 !== snapshot.revision || !Number.isSafeInteger(reset.reset_at) || Number(reset.reset_at) <= 0)
+                    throw new Error('ownership reset marker is corrupt');
+                let subject;
+                try {
+                    subject = ownershipAid(JSON.parse(reset.source).sub_aid, 'sub_aid');
+                }
+                catch { }
+                if (task.sub_aid !== subject)
+                    throw new Error('ownership reset subject changed');
+                return { record, revision: snapshot.revision };
+            }
+            if (record.protocol !== '2.1' || typeof record.operation_id !== 'string' || !OWNERSHIP_UUID_V4_RE.test(record.operation_id) || record.operation_id !== snapshot.operation_id || !['bind', 'release', 'transfer'].includes(record.operation) || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(record.status) || typeof record.step !== 'string')
                 throw new Error('invalid ownership task');
+            if (!record.base_agent_md && record.request_verified && !record.legacy_task)
+                return { record, revision: snapshot.revision };
             ownershipAid(record.sub_aid, 'sub_aid');
             ownershipAid(record.owner_aid, 'owner_aid');
             ownershipAid(record.initiator_aid, 'initiator_aid');
@@ -304,22 +516,86 @@ export class OwnershipWorkflow {
             }
             else if (record.new_owner_aid !== undefined)
                 throw new Error('unexpected transfer target');
-            if (ownershipInteger(record.target_relation_version, 'target_relation_version') !== ownershipInteger(record.base_relation_version, 'base_relation_version', 0) + 1 || !participants(record).includes(record.initiator_aid) || record.operation !== 'bind' && record.initiator_aid !== record.owner_aid)
+            const baseVersion = ownershipInteger(record.base_relation_version, 'base_relation_version', 0), targetVersion = ownershipInteger(record.target_relation_version, 'target_relation_version');
+            if (targetVersion !== baseVersion + 1 && !(record.operation === 'release' && targetVersion === baseVersion) || !participants(record).includes(record.initiator_aid) || record.operation !== 'bind' && record.initiator_aid !== record.owner_aid)
                 throw new Error('invalid fixed ownership context');
             if (JSON.stringify(record.local_roles) !== JSON.stringify(localRoles(record, this.local())) || !record.local_roles.length || !['pending', 'accept', 'reject'].includes(record.local_decision) || !record.approvals || participants(record).some((aid) => !['pending', 'accept', 'reject'].includes(record.approvals[aid])) || record.approvals[this.local()] !== record.local_decision || !record.files || typeof record.files !== 'object' || Array.isArray(record.files) || !Array.isArray(record.inbox) || !Array.isArray(record.outbox) || !Array.isArray(record.received) || !Array.isArray(record.notices) || typeof record.request_verified !== 'boolean' || typeof record.request_notified !== 'boolean')
                 throw new Error('ownership approval or pending state is corrupt');
             if (Object.keys(record.approvals).length !== participants(record).length || record.approvals[record.initiator_aid] !== 'accept' || record.initiator_aid === this.local() && record.local_decision !== 'accept')
                 throw new Error('ownership initiator or approval participants are corrupt');
+            if (record.legacy_recovery !== undefined) {
+                const recovery = record.legacy_recovery, original = recovery.task, checkpoint = recovery.checkpoint;
+                if (!original || record.request_verified !== true || recovery.task_sha256 !== ownershipSha256(JSON.stringify(original)) || !Number.isSafeInteger(recovery.revision) || recovery.revision < 1 || recovery.revision >= snapshot.revision || !checkpoint || !Number.isSafeInteger(checkpoint.observed_at) || checkpoint.observed_at <= 0 || typeof recovery.owner_confirmed !== 'boolean')
+                    throw new Error('legacy recovery checkpoint is corrupt');
+                this.legacyView(original);
+                if (['operation_id', 'operation', 'sub_aid', 'owner_aid', 'initiator_aid', 'base_relation_version', 'target_relation_version'].some((key) => original[key] !== record[key]) || JSON.stringify(checkpoint.agent_md) !== JSON.stringify(record.base_agent_md) || original.local_decision !== 'pending' && original.local_decision !== record.local_decision || participants(record).some((name) => original.approvals[name] !== 'pending' && original.approvals[name] !== record.approvals[name]))
+                    throw new Error('legacy recovery original context or approval changed');
+                const owner = checkpoint.owner_md;
+                if (!owner || typeof owner.exists !== 'boolean' || typeof owner.raw !== 'string' || owner.sha256 !== (owner.exists ? ownershipSha256(owner.raw) : '') || !owner.exists && owner.raw !== '')
+                    throw new Error('legacy recovery owner observation is corrupt');
+                if (owner.exists) {
+                    const file = parseOwnershipFile(owner.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: record.owner_aid });
+                    if (file.action !== 'declare' || file.statement?.relation_version !== 1)
+                        throw new Error('legacy recovery owner observation changed');
+                }
+                const originalOwner = original.files.owner, pinned = record.files.owner;
+                if ((originalOwner || owner.exists) && (!pinned || pinned.raw !== (originalOwner?.raw ?? owner.raw) || pinned.hash !== (originalOwner?.hash ?? owner.sha256) || JSON.stringify(pinned.original_owner) !== JSON.stringify(owner)) || originalOwner && (!owner.exists || originalOwner.raw !== owner.raw || originalOwner.hash !== owner.sha256))
+                    throw new Error('legacy recovery owner candidate changed');
+                if (this.local() === record.owner_aid ? !recovery.owner_confirmed : recovery.owner_confirmed ? !record.received.includes(`${record.owner_aid}|${record.operation_id}|owner.ready`) : Boolean(record.files.agent) || record.status === 'completed')
+                    throw new Error('legacy recovery owner confirmation is corrupt');
+            }
+            if (record.legacy_task) {
+                const recovery = record.legacy_task, original = recovery.task;
+                if (!Number.isSafeInteger(recovery.revision) || recovery.revision < 1 || recovery.revision >= snapshot.revision || recovery.task_sha256 !== ownershipSha256(JSON.stringify(original)))
+                    throw new Error('legacy task source is corrupt');
+                this.priorView(original);
+                if (['operation_id', 'operation', 'sub_aid', 'owner_aid', 'new_owner_aid', 'initiator_aid', 'base_relation_version', 'target_relation_version'].some((key) => original[key] !== record[key]) || Object.entries(original.approvals).some(([aid, decision]) => decision !== 'pending' && record.approvals[aid] !== decision) || JSON.stringify(recovery.checkpoint.agent_md) !== JSON.stringify(record.base_agent_md ?? null) || JSON.stringify(recovery.checkpoint.owner_md) !== JSON.stringify(record.base_owner_md ?? null) || !record.base_agent_md && record.status !== 'completed')
+                    throw new Error('legacy task fixed context changed');
+                for (const [key, saved] of Object.entries(original.files))
+                    if (record.files[key]?.raw !== saved.raw || record.files[key]?.hash !== saved.hash || key === 'agent' && JSON.stringify(record.files[key]?.condition) !== JSON.stringify(saved.condition))
+                        throw new Error('legacy task signed candidate changed');
+            }
+            if (record.request_verified && (record.base_agent_md || !record.legacy_task)) {
+                const base = record.base_agent_md;
+                if (!base || typeof base.exists !== 'boolean' || typeof base.raw !== 'string' || base.sha256 !== ownershipSha256(base.raw) || typeof base.etag !== 'string' || (base.exists ? !base.etag : base.raw !== '' || base.etag !== '' || record.operation !== 'bind' || record.base_relation_version !== 0))
+                    throw new Error('ownership original agent.md evidence is corrupt');
+                const statement = base.exists ? parseOwnershipFile(base.raw, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null : null;
+                if (JSON.stringify(statement) !== JSON.stringify(base.statement) || (statement?.relation_version ?? 0) !== record.base_relation_version)
+                    throw new Error('ownership original statement is corrupt');
+                const owner = record.base_owner_md;
+                if (!owner || typeof owner.exists !== 'boolean' || typeof owner.raw !== 'string' || owner.sha256 !== (owner.exists ? ownershipSha256(owner.raw) : '') || !owner.exists && owner.raw !== '')
+                    throw new Error('ownership original owner.md evidence is corrupt');
+                if (owner.exists) {
+                    const declaration = parseOwnershipFile(owner.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: statement?.owner_aid ?? record.owner_aid });
+                    if (declaration.statement?.relation_version !== record.base_relation_version)
+                        throw new Error('ownership original owner statement is corrupt');
+                }
+            }
+            for (const item of record.inbox)
+                parseOwnershipMessage(item.payload, { authenticated_from_aid: item.from, local_aid: this.local(), task: record });
+            for (const key of record.received) {
+                if (typeof key !== 'string' || key.split('|').length !== 3)
+                    throw new Error('ownership received key is corrupt');
+                const [from, operationId, action] = key.split('|');
+                parseOwnershipMessage({ type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: operationId, operation: record.operation, action,
+                    sub_aid: record.sub_aid, owner_aid: record.owner_aid, ...(record.operation === 'transfer' ? { new_owner_aid: record.new_owner_aid } : {}),
+                    base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version }, { authenticated_from_aid: from, local_aid: this.local(), task: record });
+            }
+            for (const item of record.outbox)
+                this.validateOutgoing(record, item);
             if (record.status === 'completed' && (record.verified_relation_version !== record.target_relation_version || record.operation !== 'release' && record.local_decision !== 'accept'))
                 throw new Error('ownership completion evidence or local approval is corrupt');
             const transferEvidenceRequired = record.operation === 'transfer' && (record.authorization_sha256 !== undefined || record.expires_at !== undefined || (record.status === 'completed' || ['owner', 'agent'].includes(record.step) || record.files.agent || record.files.owner) && record.local_roles.some((role) => role === 'sub' || role === 'new_owner'));
             if (transferEvidenceRequired && (!/^[0-9a-f]{64}$/.test(record.authorization_sha256 ?? '') || !Number.isSafeInteger(record.expires_at) || (record.expires_at ?? 0) <= 0))
                 throw new Error('ownership transfer authorization evidence is corrupt');
             for (const [key, saved] of Object.entries(record.files)) {
-                if (!['agent', 'owner', 'release', 'transfer', 'cleanup'].includes(key) || !saved || typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !saved.condition || typeof saved.condition !== 'object' || Object.keys(saved.condition).length !== 1 || saved.published_revision !== undefined && (typeof saved.published_revision !== 'string' || !saved.published_revision))
+                if (!['agent', 'owner', 'release', 'transfer', 'cleanup'].includes(key) || !saved || typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !saved.condition || typeof saved.condition !== 'object' || Object.keys(saved.condition).length !== (key === 'agent' ? 1 : 0) || saved.published_etag !== undefined && (key !== 'agent' || typeof saved.published_etag !== 'string' || !saved.published_etag))
                     throw new Error('ownership saved file is corrupt');
-                if (key === 'agent' ? !(typeof saved.condition.if_match === 'string' && saved.condition.if_match || saved.condition.if_none_match === '*') : !(typeof saved.condition.expected_revision === 'string' && saved.condition.expected_revision))
+                if (key === 'agent' && !(typeof saved.condition.if_match === 'string' && saved.condition.if_match || saved.condition.if_none_match === '*'))
                     throw new Error('ownership original file condition is corrupt');
+                const original = saved.original_owner;
+                if (key !== 'agent' && key !== 'cleanup' && (!original || typeof original.exists !== 'boolean' || typeof original.raw !== 'string' || original.sha256 !== (original.exists ? ownershipSha256(original.raw) : '') || !original.exists && original.raw !== ''))
+                    throw new Error('ownership original owner material is corrupt');
                 const owner = ['agent', 'owner'].includes(key) ? targetOwner(record) : record.owner_aid;
                 const file = parseOwnershipFile(saved.raw, key === 'agent' ? 'agent' : 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: owner });
                 const version = ['release', 'transfer', 'cleanup'].includes(key) ? record.base_relation_version : record.target_relation_version;
@@ -339,7 +615,8 @@ export class OwnershipWorkflow {
             }
             if (record.status === 'completed') {
                 const evidence = record.completion_evidence;
-                if (!evidence || evidence.sub_aid !== record.sub_aid || evidence.relation_version !== record.target_relation_version || evidence.status !== (record.operation === 'release' ? 'released' : 'consensus') || evidence.lock !== (record.operation === 'release' ? 'unlocked' : 'locked') || evidence.owner_aid !== (record.operation === 'release' ? null : targetOwner(record)) || typeof evidence.agent_md_etag !== 'string' || !evidence.agent_md_etag || !/^[0-9a-f]{64}$/.test(evidence.agent_md_sha256) || typeof evidence.owner_md_revision !== 'string' || typeof evidence.owner_md_sha256 !== 'string' || record.operation !== 'release' && (!evidence.owner_md_revision || !/^[0-9a-f]{64}$/.test(evidence.owner_md_sha256)))
+                const cleaned = record.operation === 'release' && evidence?.status === 'unbound' && evidence.relation_version === 0 && record.cleanup_status === 'cleaned' && Boolean(this.cleanupEvidence(record, evidence));
+                if (!evidence || evidence.sub_aid !== record.sub_aid || !cleaned && (evidence.relation_version !== (record.operation === 'release' ? record.base_relation_version : record.target_relation_version) || evidence.status !== (record.operation === 'release' ? 'released' : 'consensus')) || evidence.lock !== (record.operation === 'release' ? 'unlocked' : 'locked') || evidence.owner_aid !== (record.operation === 'release' ? null : targetOwner(record)) || typeof evidence.agent_md_etag !== 'string' || !evidence.agent_md_etag || !/^[0-9a-f]{64}$/.test(evidence.agent_md_sha256) || typeof evidence.owner_md_sha256 !== 'string' || record.operation !== 'release' && !/^[0-9a-f]{64}$/.test(evidence.owner_md_sha256))
                     throw new Error('ownership target acceptance evidence is corrupt');
                 if (record.operation !== 'release' && (record.local_roles.includes('sub') && record.files.agent?.hash !== evidence.agent_md_sha256 || this.local() === targetOwner(record) && record.files.owner?.hash !== evidence.owner_md_sha256 || record.operation === 'transfer' && record.local_roles.includes('owner') && !record.files.transfer))
                     throw new Error('ownership target file evidence is missing');
@@ -349,8 +626,194 @@ export class OwnershipWorkflow {
             return { record, revision: snapshot.revision };
         }
         catch (error) {
-            throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
+            if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
+                throw error;
+            throw new OwnershipTaskDecodeError(snapshot.operation_id, error instanceof Error ? error.message : String(error));
+        }
+    }
+    legacyTaskView(record) {
+        return record.operation === 'bind' && record.base_relation_version === 0 && record.initiator_aid === record.sub_aid && Object.keys(record.files ?? {}).every((key) => key === 'owner') ? this.legacyView(record) : this.priorView(record);
+    }
+    legacyView(record) {
+        if (Object.hasOwn(record, 'legacy_recovery') || record.protocol !== '2.1' || record.operation !== 'bind' || record.base_relation_version !== 0 || record.target_relation_version !== 1 || record.initiator_aid !== record.sub_aid || record.request_verified !== true || record.status !== 'pending' && !(record.status === 'error' && record.retryable === true) || record.base_agent_md != null || record.base_owner_md != null || !record.files || typeof record.files !== 'object' || Array.isArray(record.files) || Object.keys(record.files).some((key) => key !== 'owner') || record.local_decision === 'reject' || Object.values(record.approvals ?? {}).includes('reject'))
+            throw ownershipFailure('unsupported_protocol', 'legacy ownership task cannot be recovered automatically');
+        const view = JSON.parse(JSON.stringify(record));
+        view.request_verified = false;
+        view.files = {};
+        view.inbox = record.inbox?.map((item) => ({ from: item.from, payload: this.legacyMessage(item.payload) }));
+        view.outbox = record.outbox?.map((item) => ({ to: item.to, payload: this.legacyMessage(item.payload) }));
+        this.decode({ operation_id: record.operation_id, revision: 1, task: view });
+        for (const notice of record.notices) {
+            if (typeof notice !== 'string' || notice.split('|').length !== 2)
+                throw ownershipFailure('unsupported_protocol', 'legacy ownership notice is corrupt');
+            const [to, action] = notice.split('|');
+            this.validateOutgoing(view, { to: to, payload: { type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: record.operation_id, operation: record.operation, action: action, sub_aid: record.sub_aid, owner_aid: record.owner_aid, base_relation_version: 0, target_relation_version: 1 } });
+        }
+        const saved = record.files.owner;
+        if (saved) {
+            if (this.local() !== record.owner_aid || record.local_decision !== 'accept' || typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !saved.condition || Object.keys(saved.condition).length !== 1 || typeof saved.condition.expected_revision !== 'string' || !saved.condition.expected_revision || saved.published_revision !== undefined && (typeof saved.published_revision !== 'string' || !saved.published_revision))
+                throw ownershipFailure('unsupported_protocol', 'legacy owner candidate cannot be recovered automatically');
+            const file = parseOwnershipFile(saved.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: record.owner_aid });
+            if (file.action !== 'declare' || file.statement?.relation_version !== 1)
+                throw ownershipFailure('unsupported_protocol', 'legacy owner candidate does not match this task');
+        }
+        return view;
+    }
+    legacyMessage(content) {
+        if (!content || typeof content !== 'object' || Array.isArray(content))
+            throw ownershipFailure('unsupported_protocol', 'legacy ownership message is corrupt');
+        return { ...content };
+    }
+    async upgradeLegacy(handle) {
+        if (Boolean(handle.record.base_agent_md) || !handle.record.request_verified || ['completed', 'stopped', 'rejected'].includes(handle.record.status))
+            return;
+        if (handle.record.operation !== 'bind' || handle.record.base_relation_version !== 0 || handle.record.initiator_aid !== handle.record.sub_aid || Object.keys(handle.record.files ?? {}).some((key) => key !== 'owner'))
+            return this.upgradePrior(handle);
+        const original = JSON.parse(JSON.stringify(handle.record));
+        const record = this.legacyView(original);
+        for (const snapshot of this.list(true)) {
+            if (snapshot.operation_id === record.operation_id || snapshot.task.sub_aid !== record.sub_aid)
+                continue;
+            const other = this.decode(snapshot).record;
+            if (!other.base_agent_md && other.request_verified && !['completed', 'stopped', 'rejected'].includes(other.status))
+                this.legacyTaskView(other);
+            if (other.status === 'pending' || other.status === 'error' && other.retryable)
+                throw ownershipFailure('conflict', 'a different active ownership intent already exists');
         }
+        const ns = await this.readNs(record.sub_aid);
+        if ((ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).frontmatter.type : record.sub_aid === this.local() ? this.deps.currentType?.() : undefined) === 'human')
+            throw ownershipFailure('invalid', 'human cannot declare an owner');
+        if (ns.lock === 'locked' && ns.owner_aid === record.owner_aid && ns.relation_version === record.target_relation_version)
+            return this.upgradePrior(handle);
+        if (ns.lock !== 'unlocked' || ns.relation_version !== 0 || ns.owner_aid || ns.exists && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement)
+            throw ownershipFailure('conflict', 'legacy ownership relation has changed');
+        const current = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+        if (current.exists) {
+            const file = await this.deps.files.verifyFile(current.content, 'owner', record.sub_aid, record.owner_aid);
+            if (file.action !== 'declare' || file.statement?.relation_version !== 1)
+                throw ownershipFailure('conflict', 'legacy owner declaration has changed');
+        }
+        const candidate = original.files.owner;
+        if (candidate) {
+            await this.deps.files.verifyFile(candidate.raw, 'owner', record.sub_aid, record.owner_aid);
+            if (!current.exists || current.content !== candidate.raw || current.sha256 !== candidate.hash)
+                throw ownershipFailure('conflict', 'legacy owner candidate was replaced');
+            if (candidate.published_revision !== undefined && current.revision !== candidate.published_revision)
+                throw ownershipFailure(current.revision ? 'conflict' : 'unavailable', 'legacy published owner revision changed', !current.revision);
+        }
+        else if (this.local() === record.owner_aid && current.exists)
+            throw ownershipFailure('unsupported_protocol', 'legacy owner declaration lacks a local task candidate');
+        const owner = { exists: current.exists, raw: current.content, sha256: current.exists ? ownershipSha256(current.content) : '', ...(candidate && current.revision ? { revision: current.revision } : {}) };
+        record.status = 'pending';
+        record.step = 'approval';
+        record.retryable = true;
+        record.request_verified = true;
+        delete record.code;
+        delete record.reason;
+        record.inbox = [];
+        record.received = [];
+        record.outbox = [];
+        record.notices = [];
+        await this.captureBase(record, ns);
+        if (candidate || current.exists && this.local() === record.sub_aid)
+            record.files.owner = { raw: candidate?.raw ?? current.content, hash: candidate?.hash ?? current.sha256, condition: {}, original_owner: owner };
+        record.legacy_recovery = { task: original, revision: handle.revision, task_sha256: ownershipSha256(JSON.stringify(original)), checkpoint: { observed_at: Math.trunc(Date.now() / 1000), agent_md: record.base_agent_md, owner_md: owner }, owner_confirmed: this.local() === record.owner_aid };
+        if (this.local() === record.sub_aid)
+            this.enqueue(record, record.owner_aid, 'bind.request');
+        else if (record.local_decision === 'accept')
+            this.enqueue(record, record.sub_aid, 'bind.accept');
+        const after = await this.readNs(record.sub_aid), afterOwner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+        if (after.exists !== ns.exists || after.content !== ns.content || after.etag !== ns.etag || after.relation_version !== 0 || after.lock !== 'unlocked' || afterOwner.exists !== current.exists || afterOwner.content !== current.content || afterOwner.sha256 !== current.sha256)
+            throw ownershipFailure('conflict', 'legacy recovery observations changed');
+        const recovered = { record, revision: handle.revision };
+        this.decode({ operation_id: record.operation_id, revision: handle.revision + 1, task: record });
+        try {
+            await this.save(recovered);
+        }
+        catch (error) {
+            if (error instanceof StateError && error.stringCode === 'persistence_unavailable' && error.message.includes('active ownership task already exists'))
+                throw ownershipFailure('conflict', 'a different active ownership intent already exists');
+            throw error;
+        }
+        handle.record = record;
+        handle.revision = recovered.revision;
+    }
+    priorView(original) {
+        if (original.base_agent_md != null || original.base_owner_md != null || original.legacy_task || original.legacy_recovery || !original.request_verified || !['pending', 'error'].includes(original.status) || original.status === 'error' && !original.retryable || Object.values(original.approvals ?? {}).includes('reject'))
+            throw ownershipFailure('unsupported_protocol', 'legacy task context cannot be recovered');
+        const record = structuredClone(original);
+        record.request_verified = false;
+        for (const [key, saved] of Object.entries(record.files ?? {})) {
+            const owner = key === 'owner' ? targetOwner(record) : record.owner_aid;
+            if (this.local() !== (key === 'agent' ? record.sub_aid : owner))
+                throw ownershipFailure('unsupported_protocol', 'legacy file local role is invalid');
+            if (key !== 'agent' && key !== 'cleanup') {
+                const condition = saved.condition;
+                if (!saved.original_owner && (!condition || Object.keys(condition).length !== 1 || typeof condition.expected_revision !== 'string' || !condition.expected_revision))
+                    throw ownershipFailure('unsupported_protocol', 'legacy owner condition is invalid');
+                saved.condition = {};
+                saved.original_owner ??= { exists: false, raw: '', sha256: '' };
+            }
+        }
+        try {
+            this.decode({ operation_id: original.operation_id, revision: 1, task: record });
+        }
+        catch (error) {
+            throw ownershipFailure('unsupported_protocol', error instanceof Error ? error.message : String(error));
+        }
+        return record;
+    }
+    async upgradePrior(handle) {
+        const original = structuredClone(handle.record), record = this.priorView(original);
+        for (const snapshot of this.list(true)) {
+            if (snapshot.operation_id === record.operation_id || snapshot.task.sub_aid !== record.sub_aid)
+                continue;
+            const other = this.decode(snapshot).record;
+            if (other.status === 'pending' || other.status === 'error' && other.retryable)
+                throw ownershipFailure('conflict', 'a different active ownership intent already exists');
+        }
+        const ns = await this.readNs(record.sub_aid);
+        if ((ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).frontmatter.type : record.sub_aid === this.local() ? this.deps.currentType?.() : undefined) === 'human')
+            throw ownershipFailure('invalid', 'human cannot declare an owner');
+        const base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
+        const released = record.operation === 'release' && ns.lock === 'unlocked' && !ns.owner_aid && ns.relation_version === record.base_relation_version;
+        const committed = record.operation !== 'release' && ns.lock === 'locked' && ns.owner_aid === targetOwner(record) && ns.relation_version === record.target_relation_version;
+        if (!base && !released && !committed)
+            throw ownershipFailure('conflict', 'legacy relationship no longer matches this task');
+        if (!committed)
+            await this.captureBase(record, ns);
+        for (const [key, saved] of Object.entries(record.files)) {
+            const owner = key === 'owner' || key === 'agent' ? targetOwner(record) : record.owner_aid;
+            await this.deps.files.verifyFile(saved.raw, key === 'agent' ? 'agent' : 'owner', record.sub_aid, owner);
+            if (key === 'agent')
+                continue;
+            const current = await this.deps.files.readOwner(owner, record.sub_aid);
+            const source = original.files[key];
+            const revision = source.condition.expected_revision;
+            if (revision && (current.content === saved.raw && source.published_revision !== undefined || !committed && current.content !== saved.raw)) {
+                if (!current.revision)
+                    throw ownershipFailure('unavailable', 'legacy owner original revision is unavailable', true);
+                if (current.revision !== (current.content === saved.raw ? source.published_revision : revision))
+                    throw ownershipFailure('conflict', 'legacy owner original revision changed');
+            }
+            const currentStatement = current.exists ? parseOwnershipFile(current.content, 'owner', { expectedSubAid: record.sub_aid }).statement : undefined;
+            const expected = parseOwnershipFile(saved.raw, 'owner', { expectedSubAid: record.sub_aid }).statement;
+            const same = expected && currentStatement && Object.keys(expected).every((field) => expected[field] === currentStatement[field]);
+            if (current.content !== saved.raw && (source.published_revision !== undefined || current.exists && (key === 'owner' || !same)) && !committed)
+                throw ownershipFailure('conflict', 'legacy signed owner file was replaced');
+            saved.original_owner = { exists: current.exists, raw: current.content, sha256: current.exists ? current.sha256 : '', ...(revision && current.revision ? { revision: current.revision } : {}) };
+        }
+        record.request_verified = true;
+        record.legacy_task = { task: original, revision: handle.revision, task_sha256: ownershipSha256(JSON.stringify(original)), checkpoint: { agent_md: record.base_agent_md ?? null, owner_md: record.base_owner_md ?? null } };
+        const recovered = { record, revision: handle.revision };
+        if (committed) {
+            if (!await this.confirm(recovered))
+                throw ownershipFailure('conflict', 'legacy committed target lacks matching local signed evidence');
+        }
+        else
+            await this.save(recovered);
+        handle.record = record;
+        handle.revision = recovered.revision;
     }
     async save(handle) {
         try {
@@ -422,17 +885,36 @@ export class OwnershipWorkflow {
     async start(operation, subAid, ownerAid, newOwnerAid, operationId) {
         this.requireApplicable(subAid);
         return this.runSerialized(subAid, async () => {
+            if (operation === 'bind' && !operationId)
+                await this.resetUnusableTasks(subAid, ownerAid);
             const existing = operationId ? this.load(operationId) : null;
             if (existing) {
+                if (this.isReset(existing.record))
+                    throw ownershipFailure('conflict', 'ownership task was reset');
+                await this.upgradeLegacy(existing);
                 const record = existing.record;
+                if (!record.base_agent_md && record.request_verified)
+                    throw ownershipFailure('unsupported_protocol', 'legacy ownership task requires explicit migration');
                 if (record.operation !== operation || record.sub_aid !== subAid || record.owner_aid !== ownerAid || record.new_owner_aid !== newOwnerAid || record.initiator_aid !== this.local())
                     throw ownershipFailure('conflict', 'saved registration task context changed');
                 await this.drive(existing);
                 return ownershipTaskResult(record);
             }
             let ns;
-            for (const snapshot of this.list()) {
-                const active = this.decode(snapshot), record = active.record;
+            for (const snapshot of this.list(true)) {
+                if (snapshot.task.sub_aid !== subAid)
+                    continue;
+                const active = this.decode(snapshot);
+                if (this.isReset(active.record))
+                    continue;
+                if (!active.record.base_agent_md && active.record.request_verified && ['completed', 'stopped', 'rejected'].includes(active.record.status))
+                    continue;
+                if (!active.record.base_agent_md && active.record.request_verified && (active.record.operation !== operation || active.record.owner_aid !== ownerAid || active.record.new_owner_aid !== newOwnerAid || active.record.initiator_aid !== this.local()))
+                    throw ownershipFailure('conflict', 'a different active ownership intent already exists');
+                await this.upgradeLegacy(active);
+                const record = active.record;
+                if (!record.base_agent_md && record.request_verified)
+                    throw ownershipFailure('unsupported_protocol', 'legacy ownership task cannot be recovered automatically');
                 if (record.sub_aid !== subAid || record.status !== 'pending' && !(record.status === 'error' && record.retryable))
                     continue;
                 const same = record.operation === operation && record.owner_aid === ownerAid && record.new_owner_aid === newOwnerAid && record.initiator_aid === this.local();
@@ -445,8 +927,18 @@ export class OwnershipWorkflow {
                     await this.recordError(active, error);
                     return ownershipTaskResult(record);
                 }
-                const base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
-                const target = ns.relation_version === record.target_relation_version && (record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === targetOwner(record));
+                let base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
+                if (base && record.request_verified) {
+                    try {
+                        await this.assertBaseMaterial(active, ns);
+                    }
+                    catch (error) {
+                        if (!(error instanceof StateError) || error.stringCode !== 'conflict')
+                            throw error;
+                        base = false;
+                    }
+                }
+                const target = record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === record.base_relation_version || ns.relation_version === 0) : ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record);
                 if (!base && !target) {
                     await this.recordError(active, ownershipFailure('conflict', 'the operation was superseded by a different relation result'));
                     const result = ownershipTaskResult(record);
@@ -466,17 +958,20 @@ export class OwnershipWorkflow {
             ns = await this.readNs(subAid);
             if (operation === 'bind' && ns.lock !== 'unlocked')
                 throw ownershipFailure('owner_locked', 'the current owner relation is locked');
-            if (!ns.exists)
-                throw ownershipFailure('unavailable', 'initial agent.md is not published', true);
-            if (operation === 'bind' && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: subAid }).frontmatter.type === 'human')
+            if (!ns.exists && operation !== 'bind')
+                throw ownershipFailure('conflict', 'original agent.md is missing');
+            if (operation === 'bind' && (ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: subAid }).frontmatter.type : subAid === this.local() ? this.deps.currentType?.() : undefined) === 'human')
                 throw ownershipFailure('invalid', 'human cannot declare an owner');
+            if (operation === 'bind' && ns.exists && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: subAid }).statement?.owner_aid === ownerAid)
+                throw ownershipFailure('conflict', 'clear the released agent.md statement before binding the same owner');
             if (operation !== 'bind') {
                 const consensus = await this.deps.files.checkConsensus(subAid);
                 if (consensus.status !== 'consensus' || consensus.owner_aid !== ownerAid || consensus.relation_version !== ns.relation_version)
                     throw ownershipFailure(consensus.status === 'invalid' ? 'invalid' : consensus.status === 'unavailable' ? consensus.code ?? 'unavailable' : 'forbidden', 'the current original owner consensus cannot be verified', consensus.status === 'unavailable');
             }
-            ownershipInteger(ns.relation_version + 1, 'target_relation_version');
-            const record = this.newRecord({ operation_id: operationId ?? randomUUID(), operation, sub_aid: subAid, owner_aid: ownerAid, new_owner_aid: newOwnerAid, base_relation_version: ns.relation_version, target_relation_version: ns.relation_version + 1 }, this.local(), 'accept');
+            const targetVersion = ownershipInteger(ns.relation_version + (operation === 'release' ? 0 : 1), 'target_relation_version');
+            const record = this.newRecord({ operation_id: operationId ?? randomUUID(), operation, sub_aid: subAid, owner_aid: ownerAid, new_owner_aid: newOwnerAid, base_relation_version: ns.relation_version, target_relation_version: targetVersion }, this.local(), 'accept');
+            await this.captureBase(record, ns);
             if (operation !== 'release')
                 for (const to of participants(record))
                     if (to !== this.local())
@@ -491,9 +986,14 @@ export class OwnershipWorkflow {
         const initial = this.load(operationId);
         if (!initial)
             throw ownershipFailure('operation_not_found', 'no local ownership request matches operation_id');
+        if (this.isReset(initial.record))
+            throw ownershipFailure('conflict', 'ownership task was reset');
         return this.runSerialized(initial.record.sub_aid, async () => {
             const handle = this.load(operationId);
+            await this.upgradeLegacy(handle);
             const record = handle.record;
+            if (!record.base_agent_md && record.request_verified)
+                throw ownershipFailure('unsupported_protocol', 'legacy ownership task requires explicit migration');
             if (record.operation === 'release' || record.initiator_aid === this.local() || !record.request_verified)
                 throw ownershipFailure('forbidden', 'this task is not a verified local approval request');
             if (record.local_decision !== 'pending') {
@@ -509,6 +1009,7 @@ export class OwnershipWorkflow {
             const ns = await this.readNs(record.sub_aid);
             if (ns.relation_version !== record.base_relation_version || (record.operation === 'bind' ? ns.lock !== 'unlocked' : ns.lock !== 'locked' || ns.owner_aid !== record.owner_aid))
                 throw ownershipFailure('conflict', 'the original relation changed before approval');
+            await this.assertBaseMaterial(handle, ns);
             record.local_decision = decision;
             record.approvals[this.local()] = decision;
             this.enqueue(record, record.initiator_aid, `${record.operation}.${decision === 'accept' ? 'accept' : 'reject'}`, reason);
@@ -540,19 +1041,42 @@ export class OwnershipWorkflow {
         record.outbox.push({ to, payload });
         record.notices.push(key);
     }
+    validateOutgoing(record, item) {
+        try {
+            const message = parseOwnershipMessage(item.payload, { authenticated_from_aid: this.local(), local_aid: item.to, task: { ...record, local_decision: 'accept' } });
+            const rejected = ['bind.reject', 'transfer.reject'].includes(message.action);
+            if (message.action !== 'operation.stopped' && record.local_decision !== (rejected ? 'reject' : 'accept') || record.approvals[this.local()] !== record.local_decision)
+                throw new Error('ownership outgoing action lacks local approval');
+            if (['bind.request', 'transfer.request'].includes(message.action) && record.initiator_aid !== this.local())
+                throw new Error('ownership outgoing request is not from the initiator');
+            if ((message.action === 'transfer.ready' || message.action === 'owner.ready' && record.operation === 'bind') && !participants(record).every((aid) => record.approvals[aid] === 'accept'))
+                throw new Error('ownership outgoing action lacks participant approvals');
+        }
+        catch (error) {
+            throw new OwnershipTaskDecodeError(record.operation_id, error instanceof Error ? error.message : String(error));
+        }
+    }
     async flush(handle) {
         while (handle.record.outbox.length) {
             const message = handle.record.outbox[0];
-            const ns = await this.readNs(handle.record.sub_aid);
+            this.validateOutgoing(handle.record, message);
             const record = handle.record;
+            if (['rejected', 'stopped', 'error'].includes(record.status) && !['bind.reject', 'transfer.reject', 'operation.stopped'].includes(message.payload.action)) {
+                record.outbox.shift();
+                await this.save(handle);
+                continue;
+            }
+            const ns = await this.readNs(record.sub_aid);
             const base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
-            const target = ns.relation_version === record.target_relation_version && (record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === targetOwner(record));
+            const target = record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === record.base_relation_version || ns.relation_version === 0) : ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record);
             const requiresTarget = ['relation.confirmed', 'sub.cleaned'].includes(message.payload.action);
             if (requiresTarget ? !target : !base) {
                 record.outbox.shift();
                 await this.save(handle);
                 continue;
             }
+            if (base && record.request_verified)
+                await this.assertBaseMaterial(handle, ns);
             if (message.payload.action === 'transfer.ready' && record.status !== 'completed') {
                 const expiresAt = record.files.transfer?.expires_at;
                 if (typeof expiresAt !== 'number' || !Number.isSafeInteger(expiresAt) || expiresAt <= 0)
@@ -560,6 +1084,7 @@ export class OwnershipWorkflow {
                 if (expiresAt <= Math.trunc(Date.now() / 1000))
                     throw ownershipFailure('conflict', 'transfer authorization expired');
             }
+            this.assertActive(handle);
             await this.deps.send(message.to, message.payload);
             handle.record.outbox.shift();
             await this.save(handle);
@@ -567,19 +1092,77 @@ export class OwnershipWorkflow {
     }
     async readNs(subAid) {
         const ns = await this.deps.files.readAgent(subAid);
-        const file = ns.exists && !(ns.lock === 'unlocked' && ns.relation_version > 0) ? await this.deps.files.verifyFile(ns.content, 'agent', subAid) : undefined;
-        if (ns.lock === 'unlocked' && ns.relation_version === 0 && file?.statement)
+        const file = ns.exists ? await this.deps.files.verifyFile(ns.content, 'agent', subAid) : undefined;
+        if (ns.relation_version !== (file?.statement?.relation_version ?? 0))
             throw ownershipFailure('unavailable', 'NS relation metadata does not match agent.md', true);
         const currentOwner = ns.lock === 'locked' ? file?.statement?.owner_aid : null;
         if (ns.lock === 'locked' && (!file?.statement || file.statement.relation_version !== ns.relation_version) || ns.owner_aid !== undefined && ns.owner_aid !== currentOwner)
             throw ownershipFailure('unavailable', 'NS owner metadata and signed agent.md do not agree', true);
         return { ...ns, owner_aid: currentOwner };
     }
+    async captureBase(record, ns) {
+        const statement = ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null : null;
+        record.base_agent_md = { exists: ns.exists, raw: ns.content, sha256: ownershipSha256(ns.content), etag: ns.etag, statement };
+        if (!statement) {
+            record.base_owner_md = { exists: false, raw: '', sha256: '' };
+            return;
+        }
+        const owner = await this.deps.files.readOwner(statement.owner_aid, record.sub_aid);
+        if ((record.operation === 'transfer' || record.operation === 'release' && ns.lock === 'locked') && !owner.exists)
+            throw ownershipFailure('unavailable', 'original owner.md is unavailable', true);
+        if (owner.exists)
+            await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, statement.owner_aid);
+        record.base_owner_md = { exists: owner.exists, raw: owner.content, sha256: owner.exists ? ownershipSha256(owner.content) : '' };
+    }
+    async assertBaseMaterial(handle, ns) {
+        const record = handle.record;
+        this.assertAgentBaseMaterial(record, ns);
+        const original = record.base_owner_md;
+        if (!original)
+            throw ownershipFailure('persistence_unavailable', 'original owner.md evidence is missing');
+        const originalOwnerAid = record.base_agent_md.statement?.owner_aid;
+        if (!originalOwnerAid)
+            return;
+        const current = await this.deps.files.readOwner(originalOwnerAid, record.sub_aid);
+        if (current.exists === original.exists && current.content === original.raw && (current.exists ? current.sha256 : '') === original.sha256)
+            return;
+        if (!current.exists)
+            throw ownershipFailure('conflict', 'the original owner.md was replaced');
+        const key = record.operation === 'bind' ? 'owner' : record.operation === 'release' ? 'release' : 'transfer';
+        const saved = record.files[key];
+        if (saved && saved.raw === current.content && saved.hash === current.sha256)
+            return;
+        if (record.operation !== 'bind' && this.local() !== record.owner_aid && record.local_decision === 'accept') {
+            const owner = await this.deps.files.verifyFile(current.content, 'owner', record.sub_aid, originalOwnerAid);
+            const previous = original.exists ? parseOwnershipFile(original.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: originalOwnerAid }) : undefined;
+            const sameStatement = previous?.statement && Object.keys(previous.statement).every((field) => previous.statement[field] === owner.statement?.[field]);
+            const allowed = sameStatement && (record.operation === 'release' ? owner.action === 'release' : owner.action === 'transfer_owner' && owner.transfer?.new_owner_aid === record.new_owner_aid && owner.transfer?.target_relation_version === record.target_relation_version);
+            if (allowed && !saved) {
+                if (record.operation === 'transfer')
+                    await this.deps.files.requireTransfer(this.fileTask(handle));
+                record.files[key] = { raw: current.content, hash: current.sha256, condition: {}, original_owner: original, ...(owner.transfer ? { expires_at: owner.transfer.expires_at } : {}) };
+                await this.save(handle);
+                return;
+            }
+        }
+        throw ownershipFailure('conflict', 'the original owner statement was replaced');
+    }
+    assertAgentBaseMaterial(record, ns) {
+        const base = record.base_agent_md;
+        if (!base || typeof base.raw !== 'string')
+            throw ownershipFailure('persistence_unavailable', 'original agent.md evidence is missing');
+        const statement = ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null : null;
+        const same = base.statement ? Boolean(statement && Object.keys(base.statement).every((key) => base.statement[key] === statement[key])) : statement === null && ns.content === base.raw && ownershipSha256(ns.content) === base.sha256;
+        if (ns.exists !== base.exists || !same)
+            throw ownershipFailure('conflict', 'the original ownership statement was replaced');
+    }
     async processInbox(handle) {
         const record = handle.record;
         while (record.inbox.length) {
             const item = record.inbox[0];
             const ns = await this.readNs(record.sub_aid);
+            if (record.request_verified && ns.relation_version === record.base_relation_version && !['relation.confirmed', 'sub.cleaned'].includes(item.payload.action))
+                await this.assertBaseMaterial(handle, ns);
             try {
                 parseOwnershipMessage(item.payload, { authenticated_from_aid: item.from, local_aid: this.local(), task: record, ns });
             }
@@ -596,11 +1179,71 @@ export class OwnershipWorkflow {
                 continue;
             }
             const action = item.payload.action;
-            if (['bind.request', 'transfer.request'].includes(action))
+            if (action === 'owner.ready' && record.legacy_recovery && record.status === 'pending') {
+                const owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+                if (!owner.exists)
+                    throw ownershipFailure(record.files.owner ? 'conflict' : 'unavailable', 'legacy owner confirmation declaration is missing', !record.files.owner);
+                const file = await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
+                if (file.action !== 'declare' || file.statement?.relation_version !== record.target_relation_version || record.files.owner && (record.files.owner.raw !== owner.content || record.files.owner.hash !== owner.sha256))
+                    throw ownershipFailure('conflict', 'legacy owner confirmation declaration changed');
+                if (!record.files.owner)
+                    record.files.owner = { raw: owner.content, hash: owner.sha256, condition: {}, original_owner: { exists: true, raw: owner.content, sha256: owner.sha256 } };
+                record.legacy_recovery.owner_confirmed = true;
+            }
+            if (['bind.request', 'transfer.request'].includes(action)) {
+                if (!record.request_verified)
+                    await this.captureBase(record, ns);
                 record.request_verified = true;
+            }
             if (['bind.accept', 'transfer.accept', 'bind.reject', 'transfer.reject'].includes(action)) {
                 if (record.approvals[item.from] === 'pending' && record.status === 'pending') {
                     const rejected = action.endsWith('.reject');
+                    if (rejected) {
+                        try {
+                            if (await this.confirm(handle)) {
+                                record.inbox.shift();
+                                record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
+                                await this.save(handle);
+                                continue;
+                            }
+                            const observed = await this.deps.files.checkConsensus(record.sub_aid, { owner_aid: targetOwner(record), relation_version: record.target_relation_version });
+                            const targetReached = observed.status === 'consensus' && observed.owner_aid === targetOwner(record) && observed.relation_version === record.target_relation_version;
+                            if (targetReached) {
+                                record.code = 'unavailable';
+                                record.reason = 'ownership target is committed but local evidence is incomplete';
+                                record.retryable = true;
+                                record.inbox.shift();
+                                record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
+                                await this.save(handle);
+                                continue;
+                            }
+                        }
+                        catch (error) {
+                            if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
+                                throw error;
+                            try {
+                                const ns = await this.readNs(record.sub_aid);
+                                if (ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record)) {
+                                    record.code = 'unavailable';
+                                    record.reason = 'ownership target is committed but local evidence is incomplete';
+                                    record.retryable = true;
+                                    record.inbox.shift();
+                                    record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
+                                    await this.save(handle);
+                                    continue;
+                                }
+                            }
+                            catch (observationError) {
+                                if (observationError instanceof StateError && observationError.stringCode === 'persistence_unavailable')
+                                    throw observationError;
+                            }
+                            record.code = error instanceof StateError ? error.stringCode : 'unavailable';
+                            record.reason = error instanceof Error ? error.message : String(error);
+                            record.retryable = true;
+                            await this.save(handle);
+                            throw error;
+                        }
+                    }
                     record.approvals[item.from] = rejected ? 'reject' : 'accept';
                     if (rejected) {
                         record.status = 'rejected';
@@ -625,8 +1268,30 @@ export class OwnershipWorkflow {
                 if (!file.statement)
                     record.cleanup_status = 'cleaned';
             }
-            if (record.operation === 'release')
+            if (record.operation === 'release' && !record.request_verified) {
+                if (ns.relation_version === 0) {
+                    const authorizationId = this.cleanupEvidence(record, { agent_md_etag: ns.etag, agent_md_sha256: ownershipSha256(ns.content), owner_md_sha256: '' }, ns.content);
+                    if (!authorizationId)
+                        throw ownershipFailure('conflict', 'no local cleanup evidence can verify the release request');
+                    const authorization = this.load(authorizationId).record;
+                    const saved = authorization.files.agent;
+                    const statement = parseOwnershipFile(saved.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+                    const etag = saved.published_etag ?? authorization.completion_evidence?.agent_md_etag;
+                    if (!etag)
+                        throw ownershipFailure('persistence_unavailable', 'historical approved agent.md ETag is missing');
+                    record.base_agent_md = { exists: true, raw: saved.raw, sha256: saved.hash, etag, statement };
+                    const owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+                    if (owner.exists)
+                        await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
+                    record.base_owner_md = { exists: owner.exists, raw: owner.content, sha256: owner.exists ? ownershipSha256(owner.content) : '' };
+                    record.cleanup_authorization_id = authorizationId;
+                    if (!(await this.confirm(handle)))
+                        throw ownershipFailure('conflict', 'no local cleanup evidence can verify the release request');
+                }
+                else
+                    await this.captureBase(record, ns);
                 record.request_verified = true;
+            }
             record.inbox.shift();
             record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
             const request = record.request_verified && record.local_decision === 'pending' && record.operation !== 'release' && !record.request_notified;
@@ -645,7 +1310,8 @@ export class OwnershipWorkflow {
         const record = handle.record;
         const task = { operation_id: record.operation_id, operation: record.operation, sub_aid: record.sub_aid, owner_aid: record.owner_aid,
             new_owner_aid: record.new_owner_aid, base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version,
-            files: record.files, authorization_sha256: record.authorization_sha256, expires_at: record.expires_at,
+            files: record.files, authorization_sha256: record.authorization_sha256, expires_at: record.expires_at, base_agent_md: record.base_agent_md, base_owner_md: record.base_owner_md,
+            assertActive: () => this.assertActive(handle),
             persist: async () => {
                 record.authorization_sha256 = task.authorization_sha256;
                 record.expires_at = task.expires_at;
@@ -655,8 +1321,18 @@ export class OwnershipWorkflow {
             } };
         return task;
     }
+    assertActive(handle) {
+        const current = this.load(handle.record.operation_id);
+        if (!current || this.isReset(current.record) || current.revision !== handle.revision)
+            throw ownershipFailure('conflict', 'ownership task changed before external action');
+    }
     async drive(handle) {
+        if (this.isReset(handle.record))
+            return;
+        await this.upgradeLegacy(handle);
         const record = handle.record;
+        if (!record.base_agent_md && record.request_verified)
+            return;
         if (record.status === 'error' && record.retryable) {
             record.status = 'pending';
             await this.save(handle);
@@ -703,11 +1379,14 @@ export class OwnershipWorkflow {
             if (ns.relation_version !== record.base_relation_version || record.operation === 'bind' && ns.lock !== 'unlocked' || record.operation === 'transfer' && (ns.lock !== 'locked' || ns.owner_aid !== record.owner_aid)) {
                 throw ownershipFailure('conflict', 'the original relation was replaced');
             }
+            await this.assertBaseMaterial(handle, ns);
             if (record.expires_at !== undefined && record.expires_at <= Math.trunc(Date.now() / 1000))
                 throw ownershipFailure('conflict', 'transfer authorization expired');
             const approved = participants(record).every((name) => record.approvals[name] === 'accept');
             if (record.operation === 'bind' && !approved || record.operation === 'transfer' && this.local() === record.owner_aid && !approved)
                 return;
+            if (record.legacy_recovery && this.local() === record.sub_aid && !record.legacy_recovery.owner_confirmed)
+                return;
             delete record.code;
             delete record.reason;
             record.retryable = true;
@@ -722,8 +1401,11 @@ export class OwnershipWorkflow {
             }
             if (record.operation === 'transfer') {
                 const original = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-                if (original.exists && (await this.deps.files.verifyFile(original.content, 'owner', record.sub_aid, record.owner_aid)).action === 'declare')
+                if (original.exists && (await this.deps.files.verifyFile(original.content, 'owner', record.sub_aid, record.owner_aid)).action === 'declare') {
+                    if (record.authorization_sha256 !== undefined)
+                        throw ownershipFailure('conflict', 'transfer authorization was withdrawn');
                     return;
+                }
                 await this.deps.files.requireTransfer(this.fileTask(handle));
             }
             if (this.local() === targetOwner(record)) {
@@ -735,6 +1417,11 @@ export class OwnershipWorkflow {
                 await this.flush(handle);
             }
             if (this.local() === record.sub_aid) {
+                if (record.legacy_recovery && record.files.owner) {
+                    const current = await this.deps.files.readOwner(record.owner_aid, record.sub_aid), pinned = record.files.owner;
+                    if (!current.exists || current.content !== pinned.raw || current.sha256 !== pinned.hash)
+                        throw ownershipFailure('conflict', 'legacy owner declaration changed before subject publication');
+                }
                 record.step = 'agent';
                 await this.save(handle);
                 await this.deps.files.declareOwneraid(this.fileTask(handle));
@@ -753,16 +1440,67 @@ export class OwnershipWorkflow {
         const result = observed ?? await this.deps.files.checkConsensus(record.sub_aid, record.operation === 'release' ? undefined : { owner_aid: targetOwner(record), relation_version: record.target_relation_version });
         if (result.status === 'invalid' || result.status === 'unavailable')
             throw ownershipFailure(result.code ?? result.status, result.reason ?? 'ownership consensus cannot be verified', result.retryable);
-        const reached = result.relation_version === record.target_relation_version && (record.operation === 'release' ? result.status === 'released' && result.lock === 'unlocked' : result.status === 'consensus' && result.owner_aid === targetOwner(record));
+        if (record.operation === 'release' && record.status === 'completed' && result.status === 'unbound' && result.relation_version === 0)
+            return true;
+        let cleaned = false;
+        if (record.operation === 'release' && result.status === 'unbound' && result.relation_version === 0) {
+            const began = Date.now();
+            const ns = await this.readNs(record.sub_aid);
+            if (!ns.exists || !ns.etag)
+                throw ownershipFailure('conflict', 'current signed cleanup document is missing');
+            if (ns.etag !== result.agent_md_etag || ownershipSha256(ns.content) !== result.agent_md_sha256)
+                throw ownershipFailure('unavailable', 'agent.md changed during cleanup confirmation', true);
+            if (record.local_roles.includes('owner') && record.files.release) {
+                const source = record.files.release, owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+                if (owner.exists && owner.content === source.raw && owner.sha256 === source.hash) {
+                    await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
+                    const after = await this.readNs(record.sub_aid);
+                    if (after.etag !== ns.etag || after.content !== ns.content || after.relation_version !== 0 || after.lock !== 'unlocked')
+                        throw ownershipFailure('unavailable', 'agent.md changed during release confirmation', true);
+                    result.owner_md_sha256 = owner.sha256;
+                }
+            }
+            const authorization = this.cleanupEvidence(record, result, ns.content);
+            if (!authorization)
+                throw ownershipFailure('conflict', 'no local cleanup original can confirm this release task');
+            if (Date.now() - began > 30_000)
+                throw ownershipFailure('unavailable', 'cleanup confirmation verification window elapsed', true);
+            if (authorization !== record.operation_id)
+                record.cleanup_authorization_id = authorization;
+            record.local_decision = 'accept';
+            record.approvals[this.local()] = 'accept';
+            record.cleanup_status = 'cleaned';
+            cleaned = true;
+        }
+        const reached = cleaned || result.relation_version === (record.operation === 'release' ? record.base_relation_version : record.target_relation_version) && (record.operation === 'release' ? result.status === 'released' && result.lock === 'unlocked' : result.status === 'consensus' && result.owner_aid === targetOwner(record));
         if (!reached)
             return false;
+        if (record.operation === 'release' && !cleaned) {
+            const ns = await this.readNs(record.sub_aid);
+            const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement;
+            if (ns.etag !== result.agent_md_etag || ownershipSha256(ns.content) !== result.agent_md_sha256)
+                throw ownershipFailure('unavailable', 'agent.md changed during release confirmation', true);
+            if (statement?.owner_aid !== record.owner_aid || statement.relation_version !== record.base_relation_version)
+                return false;
+            if (record.base_agent_md)
+                this.assertAgentBaseMaterial(record, ns);
+            if (record.files.release && result.owner_md_sha256 && record.files.release.hash !== result.owner_md_sha256)
+                throw ownershipFailure('conflict', 'current release material does not belong to this task');
+        }
         if (record.operation === 'release' && record.local_roles.includes('owner') && !record.files.release)
             throw ownershipFailure('conflict', 'local release file evidence is missing');
         if (record.operation === 'transfer' && record.local_roles.includes('owner') && !record.files.transfer)
             throw ownershipFailure('conflict', 'local transfer file evidence is missing');
         if (record.operation === 'release' && this.local() === record.sub_aid && record.local_decision !== 'accept') {
+            const authorization = await this.cleanupAuthorization(record);
+            if (authorization) {
+                record.local_decision = 'accept';
+                record.approvals[this.local()] = 'accept';
+                record.cleanup_authorization_id = authorization.operation_id;
+                await this.save(handle);
+            }
             const ns = await this.deps.files.readAgent(record.sub_aid);
-            if (parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
+            if (!authorization && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
                 record.step = 'cleanup';
                 if (record.cleanup_status !== 'action_required') {
                     record.cleanup_status = 'action_required';
@@ -774,12 +1512,12 @@ export class OwnershipWorkflow {
         }
         if (record.operation !== 'release' && (record.local_decision !== 'accept' || this.local() === record.sub_aid && (!record.files.agent || record.files.agent.hash !== result.agent_md_sha256) || this.local() === targetOwner(record) && (!record.files.owner || record.files.owner.hash !== result.owner_md_sha256)))
             return false;
-        if (record.status !== 'completed' && record.operation !== 'release' && (this.local() === record.sub_aid && record.files.agent?.published_revision !== undefined && record.files.agent.published_revision !== result.agent_md_etag || this.local() === targetOwner(record) && record.files.owner?.published_revision !== undefined && record.files.owner.published_revision !== result.owner_md_revision))
-            throw ownershipFailure('conflict', 'published ownership file revision changed');
+        if (record.status !== 'completed' && record.operation !== 'release' && this.local() === record.sub_aid && record.files.agent?.published_etag !== undefined && record.files.agent.published_etag !== result.agent_md_etag)
+            throw ownershipFailure('conflict', 'published agent.md ETag changed');
         if (record.status !== 'completed') {
             record.status = 'completed';
             record.step = 'confirmed';
-            record.verified_relation_version = result.relation_version;
+            record.verified_relation_version = record.target_relation_version;
             record.completion_evidence = { ...result };
             delete record.code;
             delete record.reason;
@@ -794,15 +1532,58 @@ export class OwnershipWorkflow {
         }
         return true;
     }
+    cleanupEvidence(record, evidence, raw) {
+        const release = record.files.release;
+        if (record.local_roles.includes('owner') && release && release.hash === evidence.owner_md_sha256)
+            return record.operation_id;
+        if (!record.local_roles.includes('sub'))
+            return undefined;
+        const matches = (saved) => Boolean(saved && saved.hash === evidence.agent_md_sha256 && saved.hash === ownershipSha256(saved.raw) && (saved.published_etag === undefined || saved.published_etag === evidence.agent_md_etag) && (raw === undefined || raw === saved.raw));
+        if (matches(record.files.agent))
+            return record.operation_id;
+        for (const snapshot of this.list(true)) {
+            if (!['bind', 'transfer'].includes(String(snapshot.task.operation)) || record.cleanup_authorization_id && snapshot.operation_id !== record.cleanup_authorization_id)
+                continue;
+            let candidate;
+            try {
+                candidate = this.decode(snapshot).record;
+            }
+            catch (error) {
+                if (snapshot.task.sub_aid === record.sub_aid)
+                    throw error;
+                else
+                    continue;
+            }
+            if (candidate.local_decision !== 'accept' || !candidate.local_roles.includes('sub') || candidate.sub_aid !== record.sub_aid || targetOwner(candidate) !== record.owner_aid || candidate.target_relation_version !== record.base_relation_version || !matches(candidate.release_cleanup?.files.agent))
+                continue;
+            const statement = candidate.files.agent && parseOwnershipFile(candidate.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+            if (statement?.owner_aid === record.owner_aid && statement.relation_version === record.base_relation_version && (!record.base_agent_md?.statement || Object.keys(record.base_agent_md.statement).every((field) => record.base_agent_md.statement[field] === statement[field])))
+                return candidate.operation_id;
+        }
+        return undefined;
+    }
     async resumeSubCleanup(handle, observed) {
         const record = handle.record;
-        if (!['bind', 'transfer'].includes(record.operation) || !record.local_roles.includes('sub') || record.local_decision !== 'accept' || observed.status !== 'released' || observed.relation_version !== record.target_relation_version + 1 || record.release_cleanup?.cleaned)
+        if (!['bind', 'transfer'].includes(record.operation) || !record.local_roles.includes('sub') || record.local_decision !== 'accept' || record.release_cleanup?.cleaned)
+            return;
+        if (record.release_cleanup && observed.status === 'unbound' && observed.relation_version === 0) {
+            const saved = record.release_cleanup.files.agent;
+            const ns = await this.readNs(record.sub_aid);
+            if (!saved || saved.raw !== ns.content || saved.hash !== observed.agent_md_sha256 || saved.hash !== ownershipSha256(ns.content) || ns.etag !== observed.agent_md_etag || saved.published_etag !== undefined && saved.published_etag !== ns.etag)
+                throw ownershipFailure('conflict', 'historical cleanup original does not match current material');
+            saved.published_etag = ns.etag;
+            record.release_cleanup.cleaned = true;
+            await this.save(handle);
+            return;
+        }
+        if (observed.status !== 'released' || observed.relation_version !== record.target_relation_version)
             return;
         const ns = await this.readNs(record.sub_aid);
         if (!ns.exists || ns.lock !== 'unlocked' || ns.relation_version !== observed.relation_version || ns.etag !== observed.agent_md_etag || ownershipSha256(ns.content) !== observed.agent_md_sha256)
             throw ownershipFailure('unavailable', 'NS changed during historical cleanup observation', true);
         const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement;
-        if (statement && (statement.owner_aid !== targetOwner(record) || statement.relation_version !== record.target_relation_version))
+        const original = record.files.agent && parseOwnershipFile(record.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+        if (!statement || !original || Object.keys(original).some((field) => original[field] !== statement[field]))
             throw ownershipFailure('conflict', 'historical cleanup fields belong to another relation');
         if (!record.release_cleanup) {
             record.release_cleanup = { files: {}, cleaned: false };
@@ -810,16 +1591,26 @@ export class OwnershipWorkflow {
         }
         await this.deps.files.revokeOwneraid({ operation: 'release', sub_aid: record.sub_aid, owner_aid: targetOwner(record),
             base_relation_version: record.target_relation_version, target_relation_version: observed.relation_version,
-            files: record.release_cleanup.files, persist: () => this.save(handle) });
+            files: record.release_cleanup.files, expected_agent_statement: original, assertActive: () => this.assertActive(handle), persist: () => this.save(handle) });
         record.release_cleanup.cleaned = true;
         await this.save(handle);
         this.emit(record, 'ownership.progress');
     }
-    cleanupAuthorization(task) {
-        for (const snapshot of this.list()) {
+    async cleanupAuthorization(task) {
+        const ns = await this.readNs(task.sub_aid);
+        const statement = ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: task.sub_aid }).statement : undefined;
+        if (!statement)
+            return undefined;
+        for (const snapshot of this.list(true)) {
+            if (snapshot.task.sub_aid !== task.sub_aid)
+                continue;
             const candidate = this.decode(snapshot).record;
-            if (['bind', 'transfer'].includes(candidate.operation) && candidate.local_decision === 'accept' && candidate.local_roles.includes('sub') && candidate.sub_aid === task.sub_aid && targetOwner(candidate) === task.owner_aid && candidate.target_relation_version === task.base_relation_version)
-                return candidate;
+            if (['bind', 'transfer'].includes(candidate.operation) && candidate.local_decision === 'accept' && candidate.local_roles.includes('sub') && candidate.sub_aid === task.sub_aid && targetOwner(candidate) === task.owner_aid && candidate.target_relation_version === task.base_relation_version && candidate.files.agent) {
+                const original = parseOwnershipFile(candidate.files.agent.raw, 'agent', { expectedSubAid: task.sub_aid }).statement;
+                const fixed = task.base_agent_md?.statement;
+                if (original && Object.keys(original).every((field) => original[field] === statement[field]) && (!fixed || Object.keys(fixed).every((field) => fixed[field] === original[field])))
+                    return candidate;
+            }
         }
         return undefined;
     }
@@ -829,12 +1620,14 @@ export class OwnershipWorkflow {
             return;
         if (record.operation === 'release' && this.local() === record.sub_aid && record.cleanup_status !== 'cleaned') {
             const ns = await this.readNs(record.sub_aid);
-            if (ns.exists && ns.lock === 'unlocked' && ns.relation_version === record.target_relation_version && !parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
+            if (ns.exists && ns.lock === 'unlocked' && ns.relation_version === 0 && !parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
+                if (!this.cleanupEvidence(record, { agent_md_sha256: ownershipSha256(ns.content), agent_md_etag: ns.etag, owner_md_sha256: '' }, ns.content))
+                    throw ownershipFailure('conflict', 'current cleanup does not match a locally saved original');
                 record.cleanup_status = 'cleaned';
                 await this.save(handle);
             }
             else {
-                const authorization = this.cleanupAuthorization(record);
+                const authorization = await this.cleanupAuthorization(record);
                 if (!authorization || record.cleanup_authorization_id && authorization.operation_id !== record.cleanup_authorization_id) {
                     if (record.cleanup_status !== 'action_required') {
                         record.cleanup_status = 'action_required';
@@ -845,7 +1638,9 @@ export class OwnershipWorkflow {
                 else {
                     record.cleanup_authorization_id = authorization.operation_id;
                     await this.save(handle);
-                    await this.deps.files.revokeOwneraid(this.fileTask(handle));
+                    const task = this.fileTask(handle);
+                    task.expected_agent_statement = parseOwnershipFile(authorization.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
+                    await this.deps.files.revokeOwneraid(task);
                     record.cleanup_status = 'cleaned';
                     this.enqueue(record, record.owner_aid, 'sub.cleaned');
                     await this.save(handle);
@@ -859,8 +1654,8 @@ export class OwnershipWorkflow {
         const payload = { ...ownershipTaskResult(record), local_roles: [...record.local_roles], ...extra };
         if (event === 'ownership.request')
             payload.requester_aid = record.initiator_aid;
-        if (record.verified_relation_version !== undefined)
-            payload.relation_version = record.verified_relation_version;
+        if (record.completion_evidence !== undefined)
+            payload.relation_version = record.completion_evidence.relation_version;
         queueMicrotask(() => { try {
             const pending = this.deps.emit(event, payload);
             if (pending)