@agentunion/fastaun 0.5.23 → 0.5.24

package/dist/ownership-workflow.js

@@ -3,13 +3,6 @@ import { isScalar, parseDocument } from 'yaml';
 import { StateError, ValidationError } from './errors.js';
 import { OWNERSHIP_UUID_V4_RE, ownershipAid, ownershipFailure, ownershipInteger, ownershipSha256, parseOwnershipFile, requireOwnershipApplicable } from './ownership-v21.js';
 export const OWNERSHIP_SDK_MESSAGE_TYPE = 'aun.ownership.sdk.v1';
-class OwnershipTaskDecodeError extends StateError {
-    operationId;
-    constructor(operationId, reason) {
-        super(reason, { stringCode: 'persistence_unavailable' });
-        this.operationId = operationId;
-    }
-}
 function participants(task) {
     return [...new Set([task.owner_aid, task.sub_aid, ...(task.new_owner_aid ? [task.new_owner_aid] : [])])];
 }
@@ -108,8 +101,6 @@ export function parseOwnershipMessage(content, context) {
     }
     if (!direction)
         throw ownershipFailure('forbidden', 'ownership action has an invalid authenticated direction');
-    if (['owner.ready', 'transfer.ready'].includes(message.action) && task?.local_decision !== 'accept')
-        throw ownershipFailure('forbidden', 'ownership local approval is required');
     if (context.ns) {
         const ns = context.ns;
         if (ns.protocol !== '2.1')
@@ -121,1703 +112,305 @@ export function parseOwnershipMessage(content, context) {
     }
     return message;
 }
-function localRoles(task, local) {
-    const roles = [];
-    if (task.owner_aid === local)
-        roles.push('owner');
-    if (task.sub_aid === local)
-        roles.push('sub');
-    if (task.new_owner_aid === local)
-        roles.push('new_owner');
-    return roles;
-}
-export function ownershipTaskResult(task) {
-    const result = {
-        operation_id: task.operation_id, operation: task.operation, sub_aid: task.sub_aid, owner_aid: task.owner_aid,
-        base_relation_version: task.base_relation_version, target_relation_version: task.target_relation_version, status: task.status, step: task.step,
-    };
-    if (task.operation === 'transfer')
-        result.new_owner_aid = task.new_owner_aid;
-    for (const field of ['code', 'reason', 'retryable'])
-        if (task[field] !== undefined)
-            Object.assign(result, { [field]: task[field] });
-    return result;
-}
+export function ownershipTaskResult(task) { return { ...task }; }
 export class OwnershipWorkflow {
     deps;
-    static serial = new Map();
+    requests = new Map();
     constructor(deps) {
         this.deps = deps;
     }
-    async bindOwneraid(ownerAid) {
-        return this.start('bind', this.local(), ownershipAid(ownerAid, 'owner_aid'));
-    }
-    async bindSubaid(subAid) {
-        return this.start('bind', ownershipAid(subAid, 'sub_aid'), this.local());
-    }
-    async releaseSubaid(subAid) {
-        return this.start('release', ownershipAid(subAid, 'sub_aid'), this.local());
-    }
-    async transferSubaid(subAid, newOwnerAid) {
-        return this.start('transfer', ownershipAid(subAid, 'sub_aid'), this.local(), ownershipAid(newOwnerAid, 'new_owner_aid'));
-    }
-    async resumeRegistration(ownerAid, operationId) {
-        if (typeof operationId !== 'string' || !OWNERSHIP_UUID_V4_RE.test(operationId))
-            throw ownershipFailure('invalid', 'registration operation_id is invalid');
-        return this.start('bind', this.local(), ownershipAid(ownerAid, 'owner_aid'), undefined, operationId);
+    local() { this.deps.assertCurrent?.(); return ownershipAid(this.deps.currentAid(), 'local_aid'); }
+    fileTask(record, stage = false) {
+        const task = record;
+        task.assertActive = () => this.deps.assertCurrent?.();
+        task.persist = async () => { this.deps.assertCurrent?.(); };
+        task.stage = stage;
+        return task;
     }
-    async acceptOwnershipRequest(operationId) {
-        return this.decide(operationId, 'accept');
+    result(record, status, error) {
+        const result = { operation_id: record.operation_id, operation: record.operation, sub_aid: record.sub_aid, owner_aid: record.owner_aid, ...(record.new_owner_aid ? { new_owner_aid: record.new_owner_aid } : {}), base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version, status, step: 'local_actions' };
+        if (error)
+            Object.assign(result, { code: error instanceof StateError ? error.stringCode : 'unavailable', reason: error instanceof Error ? error.message : String(error), retryable: true });
+        return result;
+    }
+    context(record) {
+        return { operation_id: record.operation_id, operation: record.operation, sub_aid: record.sub_aid, owner_aid: record.owner_aid, ...(record.new_owner_aid ? { new_owner_aid: record.new_owner_aid } : {}), initiator_aid: record.initiator_aid, base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version };
+    }
+    notify(record, to, action, reason) {
+        const { initiator_aid: _initiator, ...context } = this.context(record);
+        record.notifications.push({ to, message_id: randomUUID(), payload: { type: OWNERSHIP_SDK_MESSAGE_TYPE, ...context, action, ...(reason ? { reason } : {}) } });
+    }
+    async capture(record) {
+        const agent = await this.deps.files.readAgent(record.sub_aid);
+        const parsed = agent.exists ? await this.deps.files.verifyFile(agent.content, 'agent', record.sub_aid) : undefined;
+        record.base_agent_md = { exists: agent.exists, raw: agent.content, sha256: ownershipSha256(agent.content), etag: agent.etag, statement: parsed?.statement ?? null, ...(agent.pending || agent.ownership_status === 'pending' ? { pending: true } : {}) };
+        if ((agent.pending || agent.ownership_status === 'pending') && parsed?.statement?.owner_aid === targetOwner(record) && parsed.statement.relation_version === record.target_relation_version)
+            record.pending_agent_md = { raw: agent.content, sha256: ownershipSha256(agent.content), etag: agent.etag };
+        const owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
+        if (owner.exists)
+            await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
+        record.base_owner_md = { exists: owner.exists, raw: owner.content, sha256: owner.exists ? ownershipSha256(owner.content) : '' };
+        if (record.operation === 'bind' && owner.exists) {
+            const declaration = parseOwnershipFile(owner.content, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: record.owner_aid });
+            if (declaration.action === 'declare' && declaration.statement?.owner_aid === record.owner_aid && declaration.statement.relation_version === record.target_relation_version)
+                record.owner_proposal = { raw: owner.content, sha256: ownershipSha256(owner.content) };
+        }
     }
-    async rejectOwnershipRequest(operationId, reason) {
-        if (reason !== undefined && typeof reason !== 'string')
-            throw ownershipFailure('invalid', 'ownership rejection reason must be a string');
-        return this.decide(operationId, 'reject', reason);
+    async hasLocalDeclaration(record, role) {
+        const current = role === 'agent' ? await this.deps.files.readAgent(record.sub_aid, record.operation === 'transfer') : await this.deps.files.readOwner(targetOwner(record), record.sub_aid);
+        if (!current.exists)
+            return false;
+        const saved = record.files[role];
+        if (saved && (current.content !== saved.raw || ownershipSha256(current.content) !== saved.hash))
+            return false;
+        const file = await this.deps.files.verifyFile(current.content, role, record.sub_aid, role === 'owner' ? targetOwner(record) : undefined), statement = file.statement;
+        return (role === 'agent' || file.action === 'declare') && statement?.sub_aid === record.sub_aid && statement.owner_aid === targetOwner(record) && statement.relation_version === record.target_relation_version;
     }
-    async resetOwnershipTask() {
-        if (!this.deps.store.loadOwnershipTaskSource || !this.deps.store.resetOwnershipTask)
-            throw ownershipFailure('persistence_unavailable', 'atomic ownership task reset storage is unavailable');
-        const local = this.local(), check = () => { if (this.local() !== local)
-            throw ownershipFailure('conflict', 'ownership reset identity changed'); };
-        const reset = [], skipped = [];
-        for (const snapshot of this.list(true)) {
-            check();
-            if (!OWNERSHIP_UUID_V4_RE.test(snapshot.operation_id)) {
-                skipped.push(snapshot.operation_id);
-                continue;
-            }
-            let source = this.taskSource(snapshot.operation_id);
-            for (let attempt = 0; source; attempt++) {
-                let task;
-                try {
-                    const parsed = JSON.parse(source.source);
-                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
-                        task = parsed;
-                }
-                catch { }
-                if (task && Object.hasOwn(task, 'task_reset')) {
-                    try {
-                        this.decode({ operation_id: source.operation_id, revision: source.revision, task });
+    async execute(record) {
+        const local = this.local();
+        try {
+            if (record.command === 'cleanup')
+                await this.deps.files.cleanupOwnerFile(this.fileTask(record));
+            else if (record.command !== 'reject') {
+                const task = this.fileTask(record, local === record.sub_aid && record.command === 'request' && record.operation === 'bind' || local === record.sub_aid && record.command === 'accept' && record.operation === 'transfer');
+                if (record.operation === 'bind') {
+                    if (local === record.owner_aid && !await this.hasLocalDeclaration(record, 'owner')) {
+                        if (local === record.sub_aid)
+                            task.stage = false;
+                        await this.deps.files.declareSubaid(task);
                     }
-                    catch {
-                        skipped.push(snapshot.operation_id);
+                    if (local === record.sub_aid && !await this.hasLocalDeclaration(record, 'agent'))
+                        await this.deps.files.declareOwneraid(task);
+                }
+                else if (record.operation === 'transfer') {
+                    if (local === record.owner_aid)
+                        await this.deps.files.transferOwneraid(task);
+                    if (local === record.new_owner_aid && !await this.hasLocalDeclaration(record, 'owner'))
+                        await this.deps.files.declareSubaid(task);
+                    if (local === record.sub_aid && !await this.hasLocalDeclaration(record, 'agent')) {
+                        task.stage = true;
+                        await this.deps.files.declareOwneraid(task);
                     }
-                    break;
-                }
-                let initiator;
-                try {
-                    initiator = ownershipAid(task?.initiator_aid, 'initiator_aid');
-                }
-                catch { }
-                if (!task || !initiator || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(task.status)) {
-                    skipped.push(snapshot.operation_id);
-                    break;
-                }
-                if (initiator !== local || ['completed', 'rejected', 'stopped'].includes(task.status))
-                    break;
-                let subject;
-                try {
-                    subject = ownershipAid(task.sub_aid, 'sub_aid');
-                }
-                catch { }
-                try {
-                    const original = source, result = await this.runSerialized(subject ?? source.operation_id, () => { check(); return this.resetSource(original, subject); });
-                    check();
-                    if (result.created)
-                        reset.push(source.operation_id);
-                    break;
                 }
-                catch (error) {
-                    check();
-                    if (attempt > 0 || !(error instanceof StateError) || error.stringCode !== 'conflict')
-                        throw error;
-                    source = this.taskSource(snapshot.operation_id);
-                }
-            }
-        }
-        check();
-        return { reset_operation_ids: [...new Set(reset)].sort(), skipped_operation_ids: [...new Set(skipped)].sort() };
-    }
-    async resetTask(operationId) {
-        if (typeof operationId !== 'string' || !OWNERSHIP_UUID_V4_RE.test(operationId))
-            throw ownershipFailure('invalid', 'ownership operation_id is invalid');
-        const source = this.taskSource(operationId);
-        if (!source)
-            throw ownershipFailure('operation_not_found', 'no local ownership task matches operation_id');
-        let task = {};
-        try {
-            const parsed = JSON.parse(source.source);
-            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
-                task = parsed;
-        }
-        catch { }
-        if (Object.hasOwn(task, 'task_reset')) {
-            this.decode({ operation_id: operationId, revision: source.revision, task });
-            return { operation_id: operationId, reset: true };
-        }
-        let subject;
-        try {
-            subject = ownershipAid(task.sub_aid, 'sub_aid');
+                else {
+                    if (local === record.owner_aid)
+                        await this.deps.files.revokeSubaid(task);
+                    if (local === record.sub_aid)
+                        await this.deps.files.revokeOwneraid(task);
+                }
+            }
+            for (const notification of record.notifications) {
+                this.deps.assertCurrent?.();
+                await this.deps.send(notification.to, notification.payload, notification.message_id);
+                this.deps.assertCurrent?.();
+            }
+            const result = this.result(record, record.command === 'reject' ? 'rejected' : 'completed');
+            const verification = await this.deps.files.checkConsensus(record.sub_aid, { owner_aid: targetOwner(record), relation_version: record.target_relation_version });
+            this.deps.assertCurrent?.();
+            if (verification.status === 'unavailable' || verification.status === 'invalid' || verification.status === 'not_applicable')
+                throw ownershipFailure(verification.code ?? verification.status, verification.reason ?? 'ownership verification request failed', true);
+            if (verification.status === 'consensus')
+                this.deps.emit('ownership.completed', result);
+            return result;
         }
-        catch { }
-        await this.runSerialized(subject ?? operationId, () => this.resetSource(source, subject));
-        return { operation_id: operationId, reset: true };
-    }
-    async checkOwnershipConsensus(subAid = this.local()) {
-        return this.deps.files.checkConsensus(ownershipAid(subAid, 'sub_aid'));
+        catch (error) {
+            if (error instanceof StateError && ['conflict', 'owner_locked'].includes(error.stringCode))
+                throw error;
+            return this.result(record, 'error', error);
+        }
+    }
+    async start(operation, subAid, ownerAid, newOwnerAid) {
+        requireOwnershipApplicable(this.deps.currentType?.());
+        if (newOwnerAid === ownerAid)
+            throw ownershipFailure('forbidden', 'transfer target must differ from the current owner');
+        const agent = await this.deps.files.readAgent(subAid), parsed = agent.exists ? await this.deps.files.verifyFile(agent.content, 'agent', subAid) : undefined;
+        if (operation === 'bind' && parsed?.frontmatter.type === 'human')
+            throw ownershipFailure('owner_locked', 'binding requires a non-human identity');
+        if (operation !== 'bind') {
+            const consensus = await this.deps.files.checkConsensus(subAid);
+            if (consensus.status !== 'consensus' || consensus.owner_aid !== ownerAid)
+                throw ownershipFailure('conflict', 'operation requires current owner consensus');
+        }
+        const baseVersion = operation === 'bind' && agent.lock === 'unlocked' && (agent.pending || agent.ownership_status === 'pending') && parsed?.statement ? parsed.statement.relation_version - 1 : agent.relation_version;
+        const record = { operation_id: randomUUID(), operation, sub_aid: subAid, owner_aid: ownerAid, ...(newOwnerAid ? { new_owner_aid: newOwnerAid } : {}), initiator_aid: this.local(), base_relation_version: baseVersion, target_relation_version: operation === 'release' ? baseVersion : baseVersion + 1, command: 'request', files: {}, notifications: [] };
+        if (operation === 'bind' && agent.lock === 'locked') {
+            if (parsed?.statement?.owner_aid !== ownerAid)
+                throw ownershipFailure('owner_locked', 'ownership is locked; release or transfer is required');
+            return this.result({ ...record, base_relation_version: agent.relation_version - 1, target_relation_version: agent.relation_version }, 'completed');
+        }
+        await this.capture(record);
+        if (operation === 'bind' && subAid !== ownerAid)
+            this.notify(record, this.local() === subAid ? ownerAid : subAid, 'bind.request');
+        else if (operation === 'transfer') {
+            for (const recipient of new Set([subAid, newOwnerAid]))
+                if (recipient !== this.local())
+                    this.notify(record, recipient, 'transfer.request');
+        }
+        else if (operation === 'release' && subAid !== ownerAid)
+            this.notify(record, subAid, 'relation.confirmed');
+        return this.execute(record);
+    }
+    async bindOwneraid(ownerAid) { return this.start('bind', this.local(), ownershipAid(ownerAid, 'owner_aid')); }
+    async bindSubaid(subAid) { return this.start('bind', ownershipAid(subAid, 'sub_aid'), this.local()); }
+    async transferSubaid(subAid, newOwnerAid) { return this.start('transfer', ownershipAid(subAid, 'sub_aid'), this.local(), ownershipAid(newOwnerAid, 'new_owner_aid')); }
+    async releaseSubaid(subAid) { return this.start('release', ownershipAid(subAid, 'sub_aid'), this.local()); }
+    async acceptOwnershipRequest(operationId) { return this.decide(operationId, 'accept'); }
+    async rejectOwnershipRequest(operationId, reason = '') { return this.decide(operationId, 'reject', reason); }
+    async decide(operationId, decision, reason = '') {
+        let request = this.requests.get(operationId);
+        if (!request && this.deps.recoverRequest) {
+            const recovered = await this.deps.recoverRequest(operationId);
+            if (recovered) {
+                await this.receive(recovered.from, recovered.payload);
+                request = this.requests.get(operationId);
+            }
+        }
+        if (!request)
+            throw ownershipFailure('operation_not_found', 'original authenticated ownership request is required');
+        const message = request.payload;
+        const record = { operation_id: message.operation_id, operation: message.operation, sub_aid: message.sub_aid, owner_aid: message.owner_aid, ...(message.new_owner_aid ? { new_owner_aid: message.new_owner_aid } : {}), base_relation_version: message.base_relation_version, target_relation_version: message.target_relation_version, initiator_aid: request.from, command: decision, files: {}, notifications: [] };
+        const consensus = await this.deps.files.checkConsensus(message.sub_aid);
+        if (consensus.status === 'unavailable' || consensus.status === 'invalid' || consensus.status === 'not_applicable')
+            throw ownershipFailure(consensus.code ?? consensus.status, consensus.reason ?? 'ownership verification request failed', true);
+        if (consensus.lock === 'locked') {
+            if (consensus.owner_aid === targetOwner(record) && consensus.relation_version === record.target_relation_version) {
+                if (decision === 'reject')
+                    throw ownershipFailure('owner_locked', 'ownership is locked; release or transfer is required');
+                return this.result(record, 'completed');
+            }
+            if (record.operation !== 'transfer' || consensus.owner_aid !== record.owner_aid || consensus.relation_version !== record.base_relation_version)
+                throw ownershipFailure('conflict', 'ownership current NS relation does not match this request');
+        }
+        await this.capture(record);
+        this.notify(record, request.from, message.operation === 'bind' ? decision === 'accept' ? 'bind.accept' : 'bind.reject' : decision === 'accept' ? 'transfer.accept' : 'transfer.reject', reason || undefined);
+        return this.execute(record);
     }
     async receive(from, content) {
-        let body = content;
+        let value;
         if (typeof content === 'string') {
             try {
-                body = JSON.parse(content);
+                value = JSON.parse(content);
             }
             catch {
                 return false;
             }
         }
-        if (!body || typeof body !== 'object' || Array.isArray(body))
-            return false;
-        const type = body.type;
-        if (typeof type !== 'string' || !type.startsWith('aun.ownership.'))
+        else
+            value = content;
+        if (!value || typeof value.type !== 'string' || !value.type.startsWith('aun.ownership.'))
             return false;
-        if (type !== OWNERSHIP_SDK_MESSAGE_TYPE)
+        if (value.type !== OWNERSHIP_SDK_MESSAGE_TYPE)
             return true;
-        let message;
-        try {
-            const saved = this.load(String(body.operation_id));
-            if (saved && this.isReset(saved.record))
-                return true;
-            const task = saved && !saved.record.base_agent_md && saved.record.request_verified && !['completed', 'stopped', 'rejected'].includes(saved.record.status) ? this.legacyTaskView(saved.record) : saved?.record;
-            message = parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local(),
-                task: task ?? (['bind.request', 'transfer.request'].includes(String(body.action)) || body.operation === 'release' && body.action === 'relation.confirmed' ? undefined : saved?.record) });
-        }
-        catch (error) {
-            if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
-                throw error;
+        const request = value?.action === 'bind.request' || value?.action === 'transfer.request';
+        if (request) {
+            const message = parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local() });
+            const previous = this.requests.get(message.operation_id);
+            if (previous && (previous.from !== from || Object.keys(message).some((key) => message[key] !== previous.payload[key])))
+                throw ownershipFailure('conflict', 'original ownership request context changed');
+            this.requests.set(message.operation_id, { from, payload: structuredClone(message) });
+            await this.deps.emit('ownership.request', { ...message, requester_aid: from });
             return true;
         }
-        let observationError;
-        try {
-            this.requireApplicable(message.sub_aid);
-            await this.deps.files.readAgent(message.sub_aid);
-        }
-        catch (error) {
-            if (error instanceof StateError && error.stringCode === 'not_applicable')
+        if (!value || value.type !== OWNERSHIP_SDK_MESSAGE_TYPE || !OWNERSHIP_UUID_V4_RE.test(value.operation_id) || !participants(value).includes(from) || !participants(value).includes(this.local()) || from === this.local())
+            throw ownershipFailure('forbidden', 'invalid ownership notification sender');
+        parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local(), task: { ...value, initiator_aid: this.local() } });
+        if (value.action === 'bind.reject' || value.action === 'transfer.reject')
+            await this.deps.emit('ownership.rejected', { ...value });
+        if (value.operation === 'transfer' && value.action === 'transfer.accept' && this.local() === value.owner_aid) {
+            const consensus = await this.deps.files.checkConsensus(value.sub_aid);
+            if (consensus.status !== 'consensus' || consensus.owner_aid !== value.new_owner_aid || consensus.relation_version !== value.target_relation_version)
                 return true;
-            observationError = error;
-        }
-        return this.runSerialized(message.sub_aid, async () => {
-            let handle = this.load(message.operation_id);
-            if (handle) {
-                const task = !handle.record.base_agent_md && handle.record.request_verified && !['completed', 'stopped', 'rejected'].includes(handle.record.status) ? this.legacyTaskView(handle.record) : handle.record;
-                try {
-                    parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local(), task });
-                }
-                catch {
-                    return true;
-                }
-                await this.upgradeLegacy(handle);
-            }
-            else {
-                if (!['bind.request', 'transfer.request'].includes(message.action) && !(message.operation === 'release' && message.action === 'relation.confirmed'))
-                    return true;
-                handle = { record: this.newRecord(message, from, 'pending'), revision: null };
-            }
-            if (message.action === 'sub.cleaned') {
-                const began = Date.now();
-                const before = await this.readNs(message.sub_aid), after = await this.readNs(message.sub_aid);
-                if (Date.now() - began > 30_000 || before.exists !== after.exists || before.etag !== after.etag || before.relation_version !== after.relation_version || before.lock !== after.lock || before.owner_aid !== after.owner_aid || ownershipSha256(before.content) !== ownershipSha256(after.content))
-                    throw ownershipFailure('unavailable', 'NS changed during sub cleanup verification', true);
-                if (!before.exists || before.relation_version !== 0 || before.lock !== 'unlocked' || before.owner_aid || !before.etag)
-                    return true;
-                const file = parseOwnershipFile(before.content, 'agent', { expectedSubAid: message.sub_aid });
-                if (Object.hasOwn(file.frontmatter, 'owner') || Object.hasOwn(file.frontmatter, 'ownership'))
-                    return true;
-            }
-            const key = `${from}|${message.operation_id}|${message.action}`;
-            if (!handle.record.received.includes(key) && !handle.record.inbox.some((item) => `${item.from}|${item.payload.operation_id}|${item.payload.action}` === key)) {
-                handle.record.inbox.push({ from, payload: message });
-                await this.save(handle);
-            }
-            if (observationError)
-                await this.recordError(handle, observationError);
-            else
-                await this.drive(handle);
-            return true;
-        });
-    }
-    async resume() {
-        const failed = [];
-        for (const snapshot of this.list(true)) {
-            try {
-                const record = this.decode(snapshot).record;
-                if (this.isReset(record))
-                    continue;
-                if (!record.base_agent_md && record.request_verified && ['completed', 'stopped', 'rejected'].includes(record.status))
-                    continue;
-                await this.runSerialized(record.sub_aid, async () => {
-                    const handle = this.load(record.operation_id);
-                    await this.drive(handle);
-                    if (handle.record.request_verified && handle.record.local_decision === 'pending' && handle.record.status === 'pending' && handle.record.operation !== 'release')
-                        this.emit(handle.record, 'ownership.request');
-                });
-            }
-            catch (error) {
-                failed.push(`${snapshot.operation_id}: ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        if (failed.length)
-            throw ownershipFailure('persistence_unavailable', failed.join('; '));
-    }
-    local() { return ownershipAid(this.deps.currentAid(), 'local_aid'); }
-    requireApplicable(subAid) {
-        if (subAid === this.local())
-            requireOwnershipApplicable(this.deps.currentType?.());
-    }
-    store() {
-        if (!this.deps.store.loadOwnershipTask || !this.deps.store.listOwnershipTasks || !this.deps.store.compareAndSwapOwnershipTask)
-            throw ownershipFailure('persistence_unavailable', 'atomic ownership task storage is unavailable');
-        return this.deps.store;
-    }
-    list(isolateErrors = false) {
-        try {
-            return this.store().listOwnershipTasks(this.local(), isolateErrors);
-        }
-        catch (error) {
-            throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
-        }
-    }
-    load(operationId) {
-        try {
-            const snapshot = this.store().loadOwnershipTask(this.local(), operationId);
-            return snapshot ? this.decode(snapshot) : null;
-        }
-        catch (error) {
-            throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
-        }
-    }
-    taskSource(operationId) {
-        try {
-            if (!this.deps.store.loadOwnershipTaskSource || !this.deps.store.resetOwnershipTask)
-                throw new Error('atomic ownership task reset storage is unavailable');
-            return this.deps.store.loadOwnershipTaskSource(this.local(), operationId);
-        }
-        catch (error) {
-            throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
-        }
-    }
-    async resetSource(source, subject) {
-        const task = { protocol: '2.1', operation_id: source.operation_id, local_aid: this.local(), status: 'stopped', step: 'reset',
-            ...(subject ? { sub_aid: subject } : {}), task_reset: { source: source.source, source_sha256: ownershipSha256(source.source), revision: source.revision, reset_at: Math.trunc(Date.now() / 1000) } };
-        try {
-            const saved = this.deps.store.resetOwnershipTask(this.local(), source.operation_id, source.revision, source.source, task);
-            this.decode(saved);
-            if (!this.isReset(saved.task))
-                throw new Error('ownership reset marker was not saved');
-            const committed = this.taskSource(source.operation_id);
-            if (!committed || committed.revision !== saved.revision || JSON.stringify(JSON.parse(committed.source)) !== JSON.stringify(saved.task))
-                throw new Error('ownership reset marker readback failed');
-            return { operation_id: source.operation_id, reset: true, created: true };
-        }
-        catch (error) {
-            if (!(error instanceof Error) || !/snapshot|revision conflict|already reset/.test(error.message))
-                throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
-            const winner = this.taskSource(source.operation_id);
-            if (winner) {
-                let parsed;
-                try {
-                    parsed = JSON.parse(winner.source);
-                }
-                catch { }
-                if (parsed && typeof parsed === 'object' && Object.hasOwn(parsed, 'task_reset')) {
-                    this.decode({ operation_id: winner.operation_id, revision: winner.revision, task: parsed });
-                    return { operation_id: source.operation_id, reset: true, created: false };
-                }
-            }
-            throw ownershipFailure(error instanceof Error && /revision|snapshot|conflict/.test(error.message) ? 'conflict' : 'persistence_unavailable', error instanceof Error ? error.message : String(error));
-        }
-    }
-    isReset(record) { return Object.hasOwn(record, 'task_reset'); }
-    async resetUnusableTasks(subAid, ownerAid) {
-        for (const snapshot of this.list(true)) {
-            if (this.isReset(snapshot.task)) {
-                this.decode(snapshot);
-                continue;
-            }
-            if (snapshot.task.sub_aid !== subAid)
-                continue;
-            if (!this.isReset(snapshot.task) && ['completed', 'rejected', 'stopped'].includes(snapshot.task.status))
-                continue;
-            let record;
-            let unusable = false;
-            try {
-                record = this.decode(snapshot).record;
-            }
-            catch (error) {
-                if (this.isReset(snapshot.task) || !(error instanceof OwnershipTaskDecodeError) || error.operationId !== snapshot.operation_id)
-                    throw error;
-                unusable = true;
-                record = snapshot.task;
-            }
-            if (!unusable && !this.isReset(record) && !record.base_agent_md && record.request_verified && !['completed', 'stopped', 'rejected'].includes(record.status) && record.operation === 'bind' && record.owner_aid === ownerAid && record.initiator_aid === this.local()) {
-                try {
-                    this.legacyTaskView(record);
-                }
-                catch {
-                    unusable = true;
-                }
-            }
-            if (!unusable)
-                continue;
-            const source = this.taskSource(snapshot.operation_id);
-            if (!source || source.revision !== snapshot.revision)
-                throw ownershipFailure('conflict', 'ownership task advanced before automatic reset');
-            let parsed;
-            try {
-                parsed = JSON.parse(source.source);
-            }
-            catch { }
-            if (!parsed || typeof parsed !== 'object' || parsed.sub_aid !== subAid)
-                throw ownershipFailure('persistence_unavailable', 'ownership task subject cannot be established for automatic reset');
-            if (Object.hasOwn(parsed, 'task_reset'))
-                throw ownershipFailure('persistence_unavailable', 'ownership reset marker is corrupt');
-            if (['completed', 'rejected', 'stopped'].includes(parsed.status))
-                continue;
-            await this.resetSource(source, subAid);
-        }
-    }
-    decode(snapshot) {
-        const record = snapshot.task;
-        try {
-            if (this.isReset(record)) {
-                const task = snapshot.task, reset = task.task_reset;
-                if (task.protocol !== '2.1' || task.operation_id !== snapshot.operation_id || !OWNERSHIP_UUID_V4_RE.test(snapshot.operation_id) || task.local_aid !== this.local() || task.status !== 'stopped' || task.step !== 'reset' || Object.keys(task).some((key) => !['protocol', 'operation_id', 'local_aid', 'status', 'step', 'sub_aid', 'task_reset'].includes(key)) || !reset || typeof reset !== 'object' || Array.isArray(reset) || Object.keys(reset).length !== 4 || typeof reset.source !== 'string' || reset.source_sha256 !== ownershipSha256(reset.source) || !Number.isSafeInteger(reset.revision) || Number(reset.revision) < 1 || Number(reset.revision) + 1 !== snapshot.revision || !Number.isSafeInteger(reset.reset_at) || Number(reset.reset_at) <= 0)
-                    throw new Error('ownership reset marker is corrupt');
-                let subject;
-                try {
-                    subject = ownershipAid(JSON.parse(reset.source).sub_aid, 'sub_aid');
-                }
-                catch { }
-                if (task.sub_aid !== subject)
-                    throw new Error('ownership reset subject changed');
-                return { record, revision: snapshot.revision };
-            }
-            if (record.protocol !== '2.1' || typeof record.operation_id !== 'string' || !OWNERSHIP_UUID_V4_RE.test(record.operation_id) || record.operation_id !== snapshot.operation_id || !['bind', 'release', 'transfer'].includes(record.operation) || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(record.status) || typeof record.step !== 'string')
-                throw new Error('invalid ownership task');
-            if (!record.base_agent_md && record.request_verified && !record.legacy_task)
-                return { record, revision: snapshot.revision };
-            ownershipAid(record.sub_aid, 'sub_aid');
-            ownershipAid(record.owner_aid, 'owner_aid');
-            ownershipAid(record.initiator_aid, 'initiator_aid');
-            if (record.operation === 'transfer') {
-                if (ownershipAid(record.new_owner_aid, 'new_owner_aid') === record.owner_aid)
-                    throw new Error('invalid transfer task');
-            }
-            else if (record.new_owner_aid !== undefined)
-                throw new Error('unexpected transfer target');
-            const baseVersion = ownershipInteger(record.base_relation_version, 'base_relation_version', 0), targetVersion = ownershipInteger(record.target_relation_version, 'target_relation_version');
-            if (targetVersion !== baseVersion + 1 && !(record.operation === 'release' && targetVersion === baseVersion) || !participants(record).includes(record.initiator_aid) || record.operation !== 'bind' && record.initiator_aid !== record.owner_aid)
-                throw new Error('invalid fixed ownership context');
-            if (JSON.stringify(record.local_roles) !== JSON.stringify(localRoles(record, this.local())) || !record.local_roles.length || !['pending', 'accept', 'reject'].includes(record.local_decision) || !record.approvals || participants(record).some((aid) => !['pending', 'accept', 'reject'].includes(record.approvals[aid])) || record.approvals[this.local()] !== record.local_decision || !record.files || typeof record.files !== 'object' || Array.isArray(record.files) || !Array.isArray(record.inbox) || !Array.isArray(record.outbox) || !Array.isArray(record.received) || !Array.isArray(record.notices) || typeof record.request_verified !== 'boolean' || typeof record.request_notified !== 'boolean')
-                throw new Error('ownership approval or pending state is corrupt');
-            if (Object.keys(record.approvals).length !== participants(record).length || record.approvals[record.initiator_aid] !== 'accept' || record.initiator_aid === this.local() && record.local_decision !== 'accept')
-                throw new Error('ownership initiator or approval participants are corrupt');
-            if (record.legacy_recovery !== undefined) {
-                const recovery = record.legacy_recovery, original = recovery.task, checkpoint = recovery.checkpoint;
-                if (!original || record.request_verified !== true || recovery.task_sha256 !== ownershipSha256(JSON.stringify(original)) || !Number.isSafeInteger(recovery.revision) || recovery.revision < 1 || recovery.revision >= snapshot.revision || !checkpoint || !Number.isSafeInteger(checkpoint.observed_at) || checkpoint.observed_at <= 0 || typeof recovery.owner_confirmed !== 'boolean')
-                    throw new Error('legacy recovery checkpoint is corrupt');
-                this.legacyView(original);
-                if (['operation_id', 'operation', 'sub_aid', 'owner_aid', 'initiator_aid', 'base_relation_version', 'target_relation_version'].some((key) => original[key] !== record[key]) || JSON.stringify(checkpoint.agent_md) !== JSON.stringify(record.base_agent_md) || original.local_decision !== 'pending' && original.local_decision !== record.local_decision || participants(record).some((name) => original.approvals[name] !== 'pending' && original.approvals[name] !== record.approvals[name]))
-                    throw new Error('legacy recovery original context or approval changed');
-                const owner = checkpoint.owner_md;
-                if (!owner || typeof owner.exists !== 'boolean' || typeof owner.raw !== 'string' || owner.sha256 !== (owner.exists ? ownershipSha256(owner.raw) : '') || !owner.exists && owner.raw !== '')
-                    throw new Error('legacy recovery owner observation is corrupt');
-                if (owner.exists) {
-                    const file = parseOwnershipFile(owner.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: record.owner_aid });
-                    if (file.action !== 'declare' || file.statement?.relation_version !== 1)
-                        throw new Error('legacy recovery owner observation changed');
-                }
-                const originalOwner = original.files.owner, pinned = record.files.owner;
-                if ((originalOwner || owner.exists) && (!pinned || pinned.raw !== (originalOwner?.raw ?? owner.raw) || pinned.hash !== (originalOwner?.hash ?? owner.sha256) || JSON.stringify(pinned.original_owner) !== JSON.stringify(owner)) || originalOwner && (!owner.exists || originalOwner.raw !== owner.raw || originalOwner.hash !== owner.sha256))
-                    throw new Error('legacy recovery owner candidate changed');
-                if (this.local() === record.owner_aid ? !recovery.owner_confirmed : recovery.owner_confirmed ? !record.received.includes(`${record.owner_aid}|${record.operation_id}|owner.ready`) : Boolean(record.files.agent) || record.status === 'completed')
-                    throw new Error('legacy recovery owner confirmation is corrupt');
-            }
-            if (record.legacy_task) {
-                const recovery = record.legacy_task, original = recovery.task;
-                if (!Number.isSafeInteger(recovery.revision) || recovery.revision < 1 || recovery.revision >= snapshot.revision || recovery.task_sha256 !== ownershipSha256(JSON.stringify(original)))
-                    throw new Error('legacy task source is corrupt');
-                this.priorView(original);
-                if (['operation_id', 'operation', 'sub_aid', 'owner_aid', 'new_owner_aid', 'initiator_aid', 'base_relation_version', 'target_relation_version'].some((key) => original[key] !== record[key]) || Object.entries(original.approvals).some(([aid, decision]) => decision !== 'pending' && record.approvals[aid] !== decision) || JSON.stringify(recovery.checkpoint.agent_md) !== JSON.stringify(record.base_agent_md ?? null) || JSON.stringify(recovery.checkpoint.owner_md) !== JSON.stringify(record.base_owner_md ?? null) || !record.base_agent_md && record.status !== 'completed')
-                    throw new Error('legacy task fixed context changed');
-                for (const [key, saved] of Object.entries(original.files))
-                    if (record.files[key]?.raw !== saved.raw || record.files[key]?.hash !== saved.hash || key === 'agent' && JSON.stringify(record.files[key]?.condition) !== JSON.stringify(saved.condition))
-                        throw new Error('legacy task signed candidate changed');
-            }
-            if (record.request_verified && (record.base_agent_md || !record.legacy_task)) {
-                const base = record.base_agent_md;
-                if (!base || typeof base.exists !== 'boolean' || typeof base.raw !== 'string' || base.sha256 !== ownershipSha256(base.raw) || typeof base.etag !== 'string' || (base.exists ? !base.etag : base.raw !== '' || base.etag !== '' || record.operation !== 'bind' || record.base_relation_version !== 0))
-                    throw new Error('ownership original agent.md evidence is corrupt');
-                const statement = base.exists ? parseOwnershipFile(base.raw, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null : null;
-                if (JSON.stringify(statement) !== JSON.stringify(base.statement) || (statement?.relation_version ?? 0) !== record.base_relation_version && !(base.pending && statement?.relation_version === record.target_relation_version && statement.owner_aid === record.owner_aid) || base.pending && record.operation !== 'bind')
-                    throw new Error('ownership original statement is corrupt');
-                const owner = record.base_owner_md;
-                if (!owner || typeof owner.exists !== 'boolean' || typeof owner.raw !== 'string' || owner.sha256 !== (owner.exists ? ownershipSha256(owner.raw) : '') || !owner.exists && owner.raw !== '')
-                    throw new Error('ownership original owner.md evidence is corrupt');
-                if (owner.exists) {
-                    const declaration = parseOwnershipFile(owner.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: statement?.owner_aid ?? record.owner_aid });
-                    if (!base.pending && declaration.statement?.relation_version !== record.base_relation_version)
-                        throw new Error('ownership original owner statement is corrupt');
-                }
-            }
-            if (record.pending_agent_md) {
-                const pending = record.pending_agent_md;
-                const statement = parseOwnershipFile(pending.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
-                if (record.operation !== 'bind' || pending.sha256 !== ownershipSha256(pending.raw) || !pending.etag || statement?.owner_aid !== record.owner_aid || statement.relation_version !== record.target_relation_version)
-                    throw new Error('ownership pending original is corrupt');
-            }
-            if (record.owner_proposal) {
-                const proposal = record.owner_proposal, file = parseOwnershipFile(proposal.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: record.owner_aid });
-                if (!this.ownerFirst(record) || proposal.sha256 !== ownershipSha256(proposal.raw) || file.action !== 'declare' || file.statement?.relation_version !== record.target_relation_version)
-                    throw new Error('ownership owner proposal is corrupt');
-            }
-            if (record.owner_first !== undefined && (record.owner_first !== true || record.operation !== 'bind' || record.initiator_aid !== record.owner_aid || record.sub_aid === record.owner_aid) || record.owner_first && record.request_verified && this.local() === record.sub_aid && !record.owner_proposal)
-                throw new Error('ownership owner-first context is corrupt');
-            if (record.rejection_cleanup) {
-                const cleanup = record.rejection_cleanup;
-                if (record.operation !== 'bind' || record.status !== 'rejected' || !record.local_roles.includes('sub') || !record.files.agent || typeof cleanup.cleaned !== 'boolean' || !cleanup.files || Object.keys(cleanup.files).some((key) => key !== 'agent'))
-                    throw new Error('ownership rejection cleanup is corrupt');
-                const file = cleanup.files.agent;
-                if (file && (file.hash !== ownershipSha256(file.raw) || file.condition.if_match !== record.files.agent.published_etag || Object.keys(file.condition).length !== 1 || parseOwnershipFile(file.raw, 'agent', { expectedSubAid: record.sub_aid }).statement))
-                    throw new Error('ownership rejection cleanup original is corrupt');
-            }
-            for (const item of record.inbox)
-                parseOwnershipMessage(item.payload, { authenticated_from_aid: item.from, local_aid: this.local(), task: record });
-            for (const key of record.received) {
-                if (typeof key !== 'string' || key.split('|').length !== 3)
-                    throw new Error('ownership received key is corrupt');
-                const [from, operationId, action] = key.split('|');
-                parseOwnershipMessage({ type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: operationId, operation: record.operation, action,
-                    sub_aid: record.sub_aid, owner_aid: record.owner_aid, ...(record.operation === 'transfer' ? { new_owner_aid: record.new_owner_aid } : {}),
-                    base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version }, { authenticated_from_aid: from, local_aid: this.local(), task: record });
-            }
-            for (const item of record.outbox)
-                this.validateOutgoing(record, item);
-            if (record.status === 'completed' && (record.verified_relation_version !== record.target_relation_version || record.operation !== 'release' && record.local_decision !== 'accept'))
-                throw new Error('ownership completion evidence or local approval is corrupt');
-            const transferEvidenceRequired = record.operation === 'transfer' && (record.authorization_sha256 !== undefined || record.expires_at !== undefined || (record.status === 'completed' || ['owner', 'agent'].includes(record.step) || record.files.agent || record.files.owner) && record.local_roles.some((role) => role === 'sub' || role === 'new_owner'));
-            if (transferEvidenceRequired && (!/^[0-9a-f]{64}$/.test(record.authorization_sha256 ?? '') || !Number.isSafeInteger(record.expires_at) || (record.expires_at ?? 0) <= 0))
-                throw new Error('ownership transfer authorization evidence is corrupt');
-            for (const [key, saved] of Object.entries(record.files)) {
-                if (!['agent', 'owner', 'release', 'transfer', 'cleanup'].includes(key) || !saved || typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !saved.condition || typeof saved.condition !== 'object' || Object.keys(saved.condition).length !== (key === 'agent' ? 1 : 0) || saved.published_etag !== undefined && (key !== 'agent' || typeof saved.published_etag !== 'string' || !saved.published_etag))
-                    throw new Error('ownership saved file is corrupt');
-                if (key === 'agent' && !(typeof saved.condition.if_match === 'string' && saved.condition.if_match || saved.condition.if_none_match === '*'))
-                    throw new Error('ownership original file condition is corrupt');
-                const original = saved.original_owner;
-                if (key !== 'agent' && key !== 'cleanup' && (!original || typeof original.exists !== 'boolean' || typeof original.raw !== 'string' || original.sha256 !== (original.exists ? ownershipSha256(original.raw) : '') || !original.exists && original.raw !== ''))
-                    throw new Error('ownership original owner material is corrupt');
-                const owner = ['agent', 'owner'].includes(key) ? targetOwner(record) : record.owner_aid;
-                const file = parseOwnershipFile(saved.raw, key === 'agent' ? 'agent' : 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: owner });
-                const version = ['release', 'transfer', 'cleanup'].includes(key) ? record.base_relation_version : record.target_relation_version;
-                if (key === 'agent' && record.operation === 'release' ? Boolean(file.statement) : file.statement?.relation_version !== version)
-                    throw new Error('ownership saved file relation is corrupt');
-                if (key === 'owner' && file.action !== 'declare' || key === 'release' && file.action !== 'release' || key === 'transfer' && (file.action !== 'transfer_owner' || file.transfer?.new_owner_aid !== record.new_owner_aid || file.transfer?.target_relation_version !== record.target_relation_version || file.transfer?.expires_at !== saved.expires_at))
-                    throw new Error('ownership saved file action is corrupt');
-            }
-            if (record.release_cleanup !== undefined) {
-                const cleanup = record.release_cleanup;
-                if (!['bind', 'transfer'].includes(record.operation) || record.status !== 'completed' || !record.local_roles.includes('sub') || record.local_decision !== 'accept' || typeof cleanup.cleaned !== 'boolean' || !cleanup.files || typeof cleanup.files !== 'object' || Array.isArray(cleanup.files))
-                    throw new Error('ownership historical cleanup context is corrupt');
-                for (const [key, saved] of Object.entries(cleanup.files)) {
-                    if (key !== 'agent' || !saved || saved.hash !== ownershipSha256(saved.raw) || typeof saved.condition?.if_match !== 'string' || !saved.condition.if_match || Object.keys(saved.condition).length !== 1 || parseOwnershipFile(saved.raw, 'agent', { expectedSubAid: record.sub_aid }).statement)
-                        throw new Error('ownership historical cleanup file is corrupt');
-                }
-            }
-            if (record.status === 'completed') {
-                const evidence = record.completion_evidence;
-                const cleaned = record.operation === 'release' && evidence?.status === 'unbound' && evidence.relation_version === 0 && record.cleanup_status === 'cleaned' && Boolean(this.cleanupEvidence(record, evidence));
-                if (!evidence || evidence.sub_aid !== record.sub_aid || !cleaned && (evidence.relation_version !== (record.operation === 'release' ? record.base_relation_version : record.target_relation_version) || evidence.status !== (record.operation === 'release' ? 'released' : 'consensus')) || evidence.lock !== (record.operation === 'release' ? 'unlocked' : 'locked') || evidence.owner_aid !== (record.operation === 'release' ? null : targetOwner(record)) || typeof evidence.agent_md_etag !== 'string' || !evidence.agent_md_etag || !/^[0-9a-f]{64}$/.test(evidence.agent_md_sha256) || typeof evidence.owner_md_sha256 !== 'string' || record.operation !== 'release' && !/^[0-9a-f]{64}$/.test(evidence.owner_md_sha256))
-                    throw new Error('ownership target acceptance evidence is corrupt');
-                if (record.operation !== 'release' && (record.local_roles.includes('sub') && record.files.agent?.hash !== evidence.agent_md_sha256 || this.local() === targetOwner(record) && record.files.owner?.hash !== evidence.owner_md_sha256 || record.operation === 'transfer' && record.local_roles.includes('owner') && !record.files.transfer))
-                    throw new Error('ownership target file evidence is missing');
-                if (record.operation === 'release' && record.local_roles.includes('owner') && !record.files.release)
-                    throw new Error('ownership release file evidence is missing');
-            }
-            return { record, revision: snapshot.revision };
-        }
-        catch (error) {
-            if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
-                throw error;
-            throw new OwnershipTaskDecodeError(snapshot.operation_id, error instanceof Error ? error.message : String(error));
-        }
-    }
-    legacyTaskView(record) {
-        return record.operation === 'bind' && record.base_relation_version === 0 && record.initiator_aid === record.sub_aid && Object.keys(record.files ?? {}).every((key) => key === 'owner') ? this.legacyView(record) : this.priorView(record);
-    }
-    legacyView(record) {
-        if (Object.hasOwn(record, 'legacy_recovery') || record.protocol !== '2.1' || record.operation !== 'bind' || record.base_relation_version !== 0 || record.target_relation_version !== 1 || record.initiator_aid !== record.sub_aid || record.request_verified !== true || record.status !== 'pending' && !(record.status === 'error' && record.retryable === true) || record.base_agent_md != null || record.base_owner_md != null || !record.files || typeof record.files !== 'object' || Array.isArray(record.files) || Object.keys(record.files).some((key) => key !== 'owner') || record.local_decision === 'reject' || Object.values(record.approvals ?? {}).includes('reject'))
-            throw ownershipFailure('unsupported_protocol', 'legacy ownership task cannot be recovered automatically');
-        const view = JSON.parse(JSON.stringify(record));
-        view.request_verified = false;
-        view.files = {};
-        view.inbox = record.inbox?.map((item) => ({ from: item.from, payload: this.legacyMessage(item.payload) }));
-        view.outbox = record.outbox?.map((item) => ({ to: item.to, payload: this.legacyMessage(item.payload) }));
-        this.decode({ operation_id: record.operation_id, revision: 1, task: view });
-        for (const notice of record.notices) {
-            if (typeof notice !== 'string' || notice.split('|').length !== 2)
-                throw ownershipFailure('unsupported_protocol', 'legacy ownership notice is corrupt');
-            const [to, action] = notice.split('|');
-            this.validateOutgoing(view, { to: to, payload: { type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: record.operation_id, operation: record.operation, action: action, sub_aid: record.sub_aid, owner_aid: record.owner_aid, base_relation_version: 0, target_relation_version: 1 } });
-        }
-        const saved = record.files.owner;
-        if (saved) {
-            if (this.local() !== record.owner_aid || record.local_decision !== 'accept' || typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !saved.condition || Object.keys(saved.condition).length !== 1 || typeof saved.condition.expected_revision !== 'string' || !saved.condition.expected_revision || saved.published_revision !== undefined && (typeof saved.published_revision !== 'string' || !saved.published_revision))
-                throw ownershipFailure('unsupported_protocol', 'legacy owner candidate cannot be recovered automatically');
-            const file = parseOwnershipFile(saved.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: record.owner_aid });
-            if (file.action !== 'declare' || file.statement?.relation_version !== 1)
-                throw ownershipFailure('unsupported_protocol', 'legacy owner candidate does not match this task');
-        }
-        return view;
-    }
-    legacyMessage(content) {
-        if (!content || typeof content !== 'object' || Array.isArray(content))
-            throw ownershipFailure('unsupported_protocol', 'legacy ownership message is corrupt');
-        return { ...content };
-    }
-    async upgradeLegacy(handle) {
-        if (Boolean(handle.record.base_agent_md) || !handle.record.request_verified || ['completed', 'stopped', 'rejected'].includes(handle.record.status))
-            return;
-        if (handle.record.operation !== 'bind' || handle.record.base_relation_version !== 0 || handle.record.initiator_aid !== handle.record.sub_aid || Object.keys(handle.record.files ?? {}).some((key) => key !== 'owner'))
-            return this.upgradePrior(handle);
-        const original = JSON.parse(JSON.stringify(handle.record));
-        const record = this.legacyView(original);
-        for (const snapshot of this.list(true)) {
-            if (snapshot.operation_id === record.operation_id || snapshot.task.sub_aid !== record.sub_aid)
-                continue;
-            const other = this.decode(snapshot).record;
-            if (!other.base_agent_md && other.request_verified && !['completed', 'stopped', 'rejected'].includes(other.status))
-                this.legacyTaskView(other);
-            if (other.status === 'pending' || other.status === 'error' && other.retryable)
-                throw ownershipFailure('conflict', 'a different active ownership intent already exists');
-        }
-        const ns = await this.readNs(record.sub_aid);
-        if ((ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).frontmatter.type : record.sub_aid === this.local() ? this.deps.currentType?.() : undefined) === 'human')
-            throw ownershipFailure('invalid', 'human cannot declare an owner');
-        if (ns.lock === 'locked' && ns.owner_aid === record.owner_aid && ns.relation_version === record.target_relation_version)
-            return this.upgradePrior(handle);
-        if (ns.lock !== 'unlocked' || ns.relation_version !== 0 || ns.owner_aid || ns.exists && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement)
-            throw ownershipFailure('conflict', 'legacy ownership relation has changed');
-        const current = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-        if (current.exists) {
-            const file = await this.deps.files.verifyFile(current.content, 'owner', record.sub_aid, record.owner_aid);
-            if (file.action !== 'declare' || file.statement?.relation_version !== 1)
-                throw ownershipFailure('conflict', 'legacy owner declaration has changed');
-        }
-        const candidate = original.files.owner;
-        if (candidate) {
-            await this.deps.files.verifyFile(candidate.raw, 'owner', record.sub_aid, record.owner_aid);
-            if (!current.exists || current.content !== candidate.raw || current.sha256 !== candidate.hash)
-                throw ownershipFailure('conflict', 'legacy owner candidate was replaced');
-            if (candidate.published_revision !== undefined && current.revision !== candidate.published_revision)
-                throw ownershipFailure(current.revision ? 'conflict' : 'unavailable', 'legacy published owner revision changed', !current.revision);
-        }
-        else if (this.local() === record.owner_aid && current.exists)
-            throw ownershipFailure('unsupported_protocol', 'legacy owner declaration lacks a local task candidate');
-        const owner = { exists: current.exists, raw: current.content, sha256: current.exists ? ownershipSha256(current.content) : '', ...(candidate && current.revision ? { revision: current.revision } : {}) };
-        record.status = 'pending';
-        record.step = 'approval';
-        record.retryable = true;
-        record.request_verified = true;
-        delete record.code;
-        delete record.reason;
-        record.inbox = [];
-        record.received = [];
-        record.outbox = [];
-        record.notices = [];
-        await this.captureBase(record, ns);
-        if (candidate || current.exists && this.local() === record.sub_aid)
-            record.files.owner = { raw: candidate?.raw ?? current.content, hash: candidate?.hash ?? current.sha256, condition: {}, original_owner: owner };
-        record.legacy_recovery = { task: original, revision: handle.revision, task_sha256: ownershipSha256(JSON.stringify(original)), checkpoint: { observed_at: Math.trunc(Date.now() / 1000), agent_md: record.base_agent_md, owner_md: owner }, owner_confirmed: this.local() === record.owner_aid };
-        if (this.local() === record.sub_aid)
-            this.enqueue(record, record.owner_aid, 'bind.request');
-        else if (record.local_decision === 'accept')
-            this.enqueue(record, record.sub_aid, 'bind.accept');
-        const after = await this.readNs(record.sub_aid), afterOwner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-        if (after.exists !== ns.exists || after.content !== ns.content || after.etag !== ns.etag || after.relation_version !== 0 || after.lock !== 'unlocked' || afterOwner.exists !== current.exists || afterOwner.content !== current.content || afterOwner.sha256 !== current.sha256)
-            throw ownershipFailure('conflict', 'legacy recovery observations changed');
-        const recovered = { record, revision: handle.revision };
-        this.decode({ operation_id: record.operation_id, revision: handle.revision + 1, task: record });
-        try {
-            await this.save(recovered);
-        }
-        catch (error) {
-            if (error instanceof StateError && error.stringCode === 'persistence_unavailable' && error.message.includes('active ownership task already exists'))
-                throw ownershipFailure('conflict', 'a different active ownership intent already exists');
-            throw error;
-        }
-        handle.record = record;
-        handle.revision = recovered.revision;
-    }
-    priorView(original) {
-        if (original.base_agent_md != null || original.base_owner_md != null || original.legacy_task || original.legacy_recovery || !original.request_verified || !['pending', 'error'].includes(original.status) || original.status === 'error' && !original.retryable || Object.values(original.approvals ?? {}).includes('reject'))
-            throw ownershipFailure('unsupported_protocol', 'legacy task context cannot be recovered');
-        const record = structuredClone(original);
-        record.request_verified = false;
-        for (const [key, saved] of Object.entries(record.files ?? {})) {
-            const owner = key === 'owner' ? targetOwner(record) : record.owner_aid;
-            if (this.local() !== (key === 'agent' ? record.sub_aid : owner))
-                throw ownershipFailure('unsupported_protocol', 'legacy file local role is invalid');
-            if (key !== 'agent' && key !== 'cleanup') {
-                const condition = saved.condition;
-                if (!saved.original_owner && (!condition || Object.keys(condition).length !== 1 || typeof condition.expected_revision !== 'string' || !condition.expected_revision))
-                    throw ownershipFailure('unsupported_protocol', 'legacy owner condition is invalid');
-                saved.condition = {};
-                saved.original_owner ??= { exists: false, raw: '', sha256: '' };
-            }
-        }
-        try {
-            this.decode({ operation_id: original.operation_id, revision: 1, task: record });
-        }
-        catch (error) {
-            throw ownershipFailure('unsupported_protocol', error instanceof Error ? error.message : String(error));
-        }
-        return record;
-    }
-    async upgradePrior(handle) {
-        const original = structuredClone(handle.record), record = this.priorView(original);
-        for (const snapshot of this.list(true)) {
-            if (snapshot.operation_id === record.operation_id || snapshot.task.sub_aid !== record.sub_aid)
-                continue;
-            const other = this.decode(snapshot).record;
-            if (other.status === 'pending' || other.status === 'error' && other.retryable)
-                throw ownershipFailure('conflict', 'a different active ownership intent already exists');
-        }
-        const ns = await this.readNs(record.sub_aid);
-        if ((ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).frontmatter.type : record.sub_aid === this.local() ? this.deps.currentType?.() : undefined) === 'human')
-            throw ownershipFailure('invalid', 'human cannot declare an owner');
-        const base = ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
-        const released = record.operation === 'release' && ns.lock === 'unlocked' && !ns.owner_aid && ns.relation_version === record.base_relation_version;
-        const committed = record.operation !== 'release' && ns.lock === 'locked' && ns.owner_aid === targetOwner(record) && ns.relation_version === record.target_relation_version;
-        const pending = record.operation === 'bind' && ns.lock === 'unlocked' && (ns.pending || ns.ownership_status === 'pending') && ns.relation_version === record.target_relation_version && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement?.owner_aid === record.owner_aid;
-        if (!base && !released && !committed && !pending)
-            throw ownershipFailure('conflict', 'legacy relationship no longer matches this task');
-        if (!committed)
-            await this.captureBase(record, ns);
-        for (const [key, saved] of Object.entries(record.files)) {
-            const owner = key === 'owner' || key === 'agent' ? targetOwner(record) : record.owner_aid;
-            await this.deps.files.verifyFile(saved.raw, key === 'agent' ? 'agent' : 'owner', record.sub_aid, owner);
-            if (key === 'agent')
-                continue;
-            const current = await this.deps.files.readOwner(owner, record.sub_aid);
-            const source = original.files[key];
-            const revision = source.condition.expected_revision;
-            if (revision && (current.content === saved.raw && source.published_revision !== undefined || !committed && current.content !== saved.raw)) {
-                if (!current.revision)
-                    throw ownershipFailure('unavailable', 'legacy owner original revision is unavailable', true);
-                if (current.revision !== (current.content === saved.raw ? source.published_revision : revision))
-                    throw ownershipFailure('conflict', 'legacy owner original revision changed');
-            }
-            const currentStatement = current.exists ? parseOwnershipFile(current.content, 'owner', { expectedSubAid: record.sub_aid }).statement : undefined;
-            const expected = parseOwnershipFile(saved.raw, 'owner', { expectedSubAid: record.sub_aid }).statement;
-            const same = expected && currentStatement && Object.keys(expected).every((field) => expected[field] === currentStatement[field]);
-            if (current.content !== saved.raw && (source.published_revision !== undefined || current.exists && (key === 'owner' || !same)) && !committed)
-                throw ownershipFailure('conflict', 'legacy signed owner file was replaced');
-            saved.original_owner = { exists: current.exists, raw: current.content, sha256: current.exists ? current.sha256 : '', ...(revision && current.revision ? { revision: current.revision } : {}) };
-        }
-        record.request_verified = true;
-        record.legacy_task = { task: original, revision: handle.revision, task_sha256: ownershipSha256(JSON.stringify(original)), checkpoint: { agent_md: record.base_agent_md ?? null, owner_md: record.base_owner_md ?? null } };
-        const recovered = { record, revision: handle.revision };
-        if (committed) {
-            if (!await this.confirm(recovered))
-                throw ownershipFailure('conflict', 'legacy committed target lacks matching local signed evidence');
-        }
-        else
-            await this.save(recovered);
-        handle.record = record;
-        handle.revision = recovered.revision;
-    }
-    async save(handle) {
-        try {
-            const snapshot = this.store().compareAndSwapOwnershipTask(this.local(), handle.record.operation_id, handle.revision, handle.record);
-            handle.revision = snapshot.revision;
-        }
-        catch (error) {
-            throw ownershipFailure('persistence_unavailable', error instanceof Error ? error.message : String(error));
-        }
-    }
-    async recordError(handle, error) {
-        if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
-            throw error;
-        const record = handle.record;
-        if (record.status === 'error' && record.retryable)
-            record.status = 'pending';
-        let code = error instanceof ValidationError ? 'invalid' : error instanceof StateError && error.stringCode ? error.stringCode : 'unavailable';
-        if (record.status === 'pending' && ['conflict', 'owner_locked', 'forbidden'].includes(code)) {
-            try {
-                if (await this.confirm(handle)) {
-                    await this.flush(handle);
-                    await this.cleanup(handle);
-                    return;
-                }
-            }
-            catch (confirmationError) {
-                if (confirmationError instanceof StateError && confirmationError.stringCode === 'persistence_unavailable')
-                    throw confirmationError;
-                error = confirmationError;
-                code = error instanceof ValidationError ? 'invalid' : error instanceof StateError && error.stringCode ? error.stringCode : 'unavailable';
-            }
-        }
-        record.code = code;
-        record.reason = error instanceof Error ? error.message : String(error);
-        record.retryable = record.status === 'pending' && ['unavailable', 'unsupported_protocol'].includes(code);
-        if (record.status === 'pending' && code === 'invalid')
-            record.status = 'error';
-        else if (record.status === 'pending' && ['conflict', 'owner_locked', 'forbidden'].includes(code))
-            record.status = 'stopped';
-        await this.save(handle);
-        this.emit(record, record.status === 'stopped' ? 'ownership.stopped' : 'ownership.error');
-    }
-    async runSerialized(subAid, work) {
-        const key = `${this.local()}|${subAid}`;
-        const before = OwnershipWorkflow.serial.get(key) ?? Promise.resolve();
-        const next = before.catch(() => { }).then(work);
-        OwnershipWorkflow.serial.set(key, next);
-        try {
-            return await next;
-        }
-        finally {
-            if (OwnershipWorkflow.serial.get(key) === next)
-                OwnershipWorkflow.serial.delete(key);
-        }
-    }
-    newRecord(context, initiator, decision) {
-        const record = {
-            protocol: '2.1', operation_id: context.operation_id, operation: context.operation, sub_aid: context.sub_aid, owner_aid: context.owner_aid,
-            base_relation_version: context.base_relation_version, target_relation_version: context.target_relation_version, status: 'pending', step: 'approval', retryable: true,
-            initiator_aid: initiator, local_roles: localRoles(context, this.local()), local_decision: decision,
-            approvals: Object.fromEntries(participants(context).map((name) => [name, name === initiator ? 'accept' : 'pending'])),
-            files: {}, inbox: [], received: [], outbox: [], notices: [], request_verified: initiator === this.local(), request_notified: false,
-        };
-        if (context.operation === 'transfer')
-            record.new_owner_aid = context.new_owner_aid;
-        if (context.operation === 'bind' && initiator === context.owner_aid && context.owner_aid !== context.sub_aid)
-            record.owner_first = true;
-        record.approvals[this.local()] = decision;
-        return record;
-    }
-    async start(operation, subAid, ownerAid, newOwnerAid, operationId) {
-        this.requireApplicable(subAid);
-        return this.runSerialized(subAid, async () => {
-            if (operation === 'bind' && !operationId)
-                await this.resetUnusableTasks(subAid, ownerAid);
-            const existing = operationId ? this.load(operationId) : null;
-            if (existing) {
-                if (this.isReset(existing.record))
-                    throw ownershipFailure('conflict', 'ownership task was reset');
-                await this.upgradeLegacy(existing);
-                const record = existing.record;
-                if (!record.base_agent_md && record.request_verified)
-                    throw ownershipFailure('unsupported_protocol', 'legacy ownership task requires explicit migration');
-                if (record.operation !== operation || record.sub_aid !== subAid || record.owner_aid !== ownerAid || record.new_owner_aid !== newOwnerAid || record.initiator_aid !== this.local())
-                    throw ownershipFailure('conflict', 'saved registration task context changed');
-                await this.drive(existing);
-                return ownershipTaskResult(record);
-            }
-            let ns;
-            for (const snapshot of this.list(true)) {
-                if (snapshot.task.sub_aid !== subAid)
-                    continue;
-                const active = this.decode(snapshot);
-                if (this.isReset(active.record))
-                    continue;
-                if (!active.record.base_agent_md && active.record.request_verified && ['completed', 'stopped', 'rejected'].includes(active.record.status))
-                    continue;
-                if (!active.record.base_agent_md && active.record.request_verified && (active.record.operation !== operation || active.record.owner_aid !== ownerAid || active.record.new_owner_aid !== newOwnerAid || active.record.initiator_aid !== this.local()))
-                    throw ownershipFailure('conflict', 'a different active ownership intent already exists');
-                await this.upgradeLegacy(active);
-                const record = active.record;
-                if (!record.base_agent_md && record.request_verified)
-                    throw ownershipFailure('unsupported_protocol', 'legacy ownership task cannot be recovered automatically');
-                if (record.sub_aid !== subAid || record.status !== 'pending' && !(record.status === 'error' && record.retryable))
-                    continue;
-                const same = record.operation === operation && record.owner_aid === ownerAid && record.new_owner_aid === newOwnerAid && record.initiator_aid === this.local();
-                try {
-                    ns = await this.readNs(subAid);
-                }
-                catch (error) {
-                    if (!same)
-                        throw error;
-                    await this.recordError(active, error);
-                    return ownershipTaskResult(record);
-                }
-                let base = this.isBase(record, ns);
-                if (base && record.request_verified) {
-                    try {
-                        await this.assertBaseMaterial(active, ns);
-                    }
-                    catch (error) {
-                        if (!(error instanceof StateError) || error.stringCode !== 'conflict')
-                            throw error;
-                        base = false;
-                    }
-                }
-                const target = record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === record.base_relation_version || ns.relation_version === 0) : ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record);
-                if (!base && !target) {
-                    await this.recordError(active, ownershipFailure('conflict', 'the operation was superseded by a different relation result'));
-                    const result = ownershipTaskResult(record);
-                    if (same && result.status !== 'stopped')
-                        return result;
-                    if (result.status !== 'stopped' && result.status !== 'completed')
-                        throw ownershipFailure(record.code ?? 'unavailable', record.reason ?? 'the original target cannot be confirmed', record.retryable);
-                    continue;
-                }
-                if (!same || operationId && operationId !== record.operation_id)
-                    throw ownershipFailure('conflict', 'a different active ownership intent already exists');
-                await this.drive(active);
-                return ownershipTaskResult(record);
-            }
-            if (operation === 'transfer' && newOwnerAid === ownerAid)
-                throw ownershipFailure('invalid', 'new owner must differ from original owner');
-            ns = await this.readNs(subAid);
-            if (operation === 'bind' && ns.lock !== 'unlocked')
-                throw ownershipFailure('owner_locked', 'the current owner relation is locked');
-            if (operation === 'bind' && subAid !== this.local() && (ns.pending || ns.ownership_status === 'pending'))
-                throw ownershipFailure('conflict', 'pending ownership must resume its original operation');
-            if (!ns.exists && operation !== 'bind')
-                throw ownershipFailure('conflict', 'original agent.md is missing');
-            if (operation === 'bind' && (ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: subAid }).frontmatter.type : subAid === this.local() ? this.deps.currentType?.() : undefined) === 'human')
-                throw ownershipFailure('invalid', 'human cannot declare an owner');
-            if (operation === 'bind' && ns.exists && !(ns.pending || ns.ownership_status === 'pending') && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: subAid }).statement?.owner_aid === ownerAid)
-                throw ownershipFailure('conflict', 'clear the released agent.md statement before binding the same owner');
-            if (operation !== 'bind') {
-                const consensus = await this.deps.files.checkConsensus(subAid);
-                if (consensus.status !== 'consensus' || consensus.owner_aid !== ownerAid || consensus.relation_version !== ns.relation_version)
-                    throw ownershipFailure(consensus.status === 'invalid' ? 'invalid' : consensus.status === 'unavailable' ? consensus.code ?? 'unavailable' : 'forbidden', 'the current original owner consensus cannot be verified', consensus.status === 'unavailable');
-            }
-            const targetVersion = ownershipInteger(ns.relation_version + (operation === 'release' ? 0 : 1), 'target_relation_version');
-            const record = this.newRecord({ operation_id: operationId ?? randomUUID(), operation, sub_aid: subAid, owner_aid: ownerAid, new_owner_aid: newOwnerAid, base_relation_version: ns.relation_version, target_relation_version: targetVersion }, this.local(), 'accept');
-            await this.captureBase(record, ns);
-            if (operation !== 'release')
-                for (const to of participants(record))
-                    if (to !== this.local())
-                        this.enqueue(record, to, operation === 'bind' ? 'bind.request' : 'transfer.request');
-            const handle = { record, revision: null };
-            await this.save(handle);
-            await this.drive(handle);
-            return ownershipTaskResult(record);
-        });
-    }
-    async decide(operationId, decision, reason) {
-        const initial = this.load(operationId);
-        if (!initial)
-            throw ownershipFailure('operation_not_found', 'no local ownership request matches operation_id');
-        if (this.isReset(initial.record))
-            throw ownershipFailure('conflict', 'ownership task was reset');
-        return this.runSerialized(initial.record.sub_aid, async () => {
-            const handle = this.load(operationId);
-            await this.upgradeLegacy(handle);
-            const record = handle.record;
-            if (!record.base_agent_md && record.request_verified)
-                throw ownershipFailure('unsupported_protocol', 'legacy ownership task requires explicit migration');
-            if (record.operation === 'release' || record.initiator_aid === this.local() || !record.request_verified)
-                throw ownershipFailure('forbidden', 'this task is not a verified local approval request');
-            if (record.local_decision !== 'pending') {
-                if (record.local_decision !== decision)
-                    throw ownershipFailure('conflict', 'the persisted local approval cannot be changed');
-                if (decision === 'accept' && record.status === 'stopped' && record.operation === 'transfer' && this.local() === record.sub_aid && record.step === 'agent' && record.code === 'conflict' && record.reason === 'conflict: target owner declaration does not match this task' && !await this.recoverTargetDeclaration(handle))
-                    return ownershipTaskResult(record);
-                await this.drive(handle);
-                return ownershipTaskResult(record);
-            }
-            if (record.status === 'error' && record.retryable)
-                record.status = 'pending';
-            if (record.status !== 'pending')
-                throw ownershipFailure('conflict', 'ownership approval stage has ended');
-            const ns = await this.readNs(record.sub_aid);
-            if (!this.isBase(record, ns))
-                throw ownershipFailure('conflict', 'the original relation changed before approval');
-            await this.assertBaseMaterial(handle, ns);
-            record.local_decision = decision;
-            record.approvals[this.local()] = decision;
-            if (decision !== 'accept' || !this.ownerFirst(record))
-                this.enqueue(record, record.initiator_aid, `${record.operation}.${decision === 'accept' ? 'accept' : 'reject'}`, reason);
-            if (decision === 'reject') {
-                record.status = 'rejected';
-                record.step = 'approval';
-                record.retryable = false;
-                if (reason !== undefined)
-                    record.reason = reason;
-            }
-            await this.save(handle);
-            this.emit(record, decision === 'reject' ? 'ownership.rejected' : 'ownership.progress');
-            await this.drive(handle);
-            return ownershipTaskResult(record);
-        });
-    }
-    async recoverTargetDeclaration(handle) {
-        const record = handle.record, local = this.local(), base = record.base_agent_md;
-        if (!base || record.new_owner_aid === local || record.files.agent || record.files.owner || record.owner_proposal || record.legacy_task || record.legacy_recovery || record.approvals[local] !== 'accept' || record.authorization_sha256 === undefined || record.expires_at === undefined)
-            return false;
-        const began = Date.now();
-        const sameBase = (ns) => this.isBase(record, ns) && ns.exists === base.exists && ns.content === base.raw && ownershipSha256(ns.content) === base.sha256 && ns.etag === base.etag;
-        try {
-            if (!sameBase(await this.readNs(record.sub_aid)))
-                return false;
-            await this.deps.files.requireTransfer(this.fileTask(handle));
-            const target = await this.deps.files.readOwner(targetOwner(record), record.sub_aid);
-            if (!target.exists)
-                return false;
-            const declaration = await this.deps.files.verifyFile(target.content, 'owner', record.sub_aid, targetOwner(record));
-            if (declaration.action !== 'declare' || declaration.statement.relation_version !== record.target_relation_version)
-                return false;
-            if (!sameBase(await this.readNs(record.sub_aid)))
-                return false;
-            await this.deps.files.requireTransfer(this.fileTask(handle));
-            const after = await this.deps.files.readOwner(targetOwner(record), record.sub_aid);
-            if (!after.exists || after.content !== target.content || after.sha256 !== target.sha256 || after.version !== target.version || after.revision !== target.revision || Date.now() - began > 30_000 || this.local() !== local)
-                return false;
-            this.assertActive(handle);
-        }
-        catch (error) {
-            if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
-                throw error;
-            return false;
+            const agent = await this.deps.files.readAgent(value.sub_aid), target = await this.deps.files.verifyFile(agent.content, 'agent', value.sub_aid);
+            if (target.statement?.owner_aid !== value.new_owner_aid || target.statement.relation_version !== value.target_relation_version)
+                throw ownershipFailure('conflict', 'transfer notification does not match current signed relation');
+            const original = await this.deps.files.readOwner(value.owner_aid, value.sub_aid);
+            if (!original.exists)
+                return true;
+            const authorization = await this.deps.files.verifyFile(original.content, 'owner', value.sub_aid, value.owner_aid);
+            if (authorization.action !== 'transfer_owner' || authorization.statement?.relation_version !== value.base_relation_version || authorization.transfer?.new_owner_aid !== value.new_owner_aid || authorization.transfer?.target_relation_version !== value.target_relation_version)
+                throw ownershipFailure('conflict', 'old owner transfer authorization changed');
+            const record = { operation_id: value.operation_id, operation: value.operation, sub_aid: value.sub_aid, owner_aid: value.owner_aid, new_owner_aid: value.new_owner_aid, base_relation_version: value.base_relation_version, target_relation_version: value.target_relation_version, initiator_aid: this.local(), command: 'cleanup', files: { transfer: { raw: original.content, hash: ownershipSha256(original.content), condition: {}, original_owner: { exists: true, raw: original.content, sha256: ownershipSha256(original.content) } } }, notifications: [] };
+            await this.execute(record);
+        }
+        if (value.operation === 'release' && value.action === 'relation.confirmed' && from === value.owner_aid && this.local() === value.sub_aid) {
+            const current = await this.deps.files.readAgent(value.sub_aid);
+            parseOwnershipMessage(content, { authenticated_from_aid: from, local_aid: this.local(), ns: current });
+            const record = { operation_id: value.operation_id, operation: value.operation, sub_aid: value.sub_aid, owner_aid: value.owner_aid, base_relation_version: value.base_relation_version, target_relation_version: value.target_relation_version, initiator_aid: from, command: 'accept', files: {}, notifications: [] };
+            await this.capture(record);
+            await this.execute(record);
         }
-        record.status = 'pending';
-        record.retryable = true;
-        delete record.code;
-        delete record.reason;
-        await this.save(handle);
         return true;
     }
-    enqueue(record, to, action, reason) {
-        if (to === this.local())
-            return;
-        const key = `${to}|${action}`;
-        if (record.notices.includes(key))
-            return;
-        const payload = { type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: record.operation_id, operation: record.operation, action,
-            sub_aid: record.sub_aid, owner_aid: record.owner_aid, base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version };
-        if (record.operation === 'transfer')
-            payload.new_owner_aid = record.new_owner_aid;
-        if (reason !== undefined)
-            payload.reason = reason;
-        record.outbox.push({ to, payload, message_id: `m-${randomUUID().replace(/-/g, '')}` });
-        record.notices.push(key);
-    }
-    validateOutgoing(record, item) {
-        try {
-            if (item.message_id !== undefined && (typeof item.message_id !== 'string' || !/^m-[0-9a-f]{32}$/.test(item.message_id)))
-                throw new Error('ownership outgoing message_id is corrupt');
-            const message = parseOwnershipMessage(item.payload, { authenticated_from_aid: this.local(), local_aid: item.to, task: { ...record, local_decision: 'accept' } });
-            const rejected = ['bind.reject', 'transfer.reject'].includes(message.action);
-            if (message.action !== 'operation.stopped' && record.local_decision !== (rejected ? 'reject' : 'accept') || record.approvals[this.local()] !== record.local_decision)
-                throw new Error('ownership outgoing action lacks local approval');
-            if (['bind.request', 'transfer.request'].includes(message.action) && record.initiator_aid !== this.local())
-                throw new Error('ownership outgoing request is not from the initiator');
-            if ((message.action === 'transfer.ready' || message.action === 'owner.ready' && record.operation === 'bind') && !participants(record).every((aid) => record.approvals[aid] === 'accept'))
-                throw new Error('ownership outgoing action lacks participant approvals');
-        }
-        catch (error) {
-            throw new OwnershipTaskDecodeError(record.operation_id, error instanceof Error ? error.message : String(error));
-        }
-    }
-    async flush(handle) {
-        while (handle.record.outbox.length) {
-            const message = handle.record.outbox[0];
-            this.validateOutgoing(handle.record, message);
-            const record = handle.record;
-            if (['rejected', 'stopped', 'error'].includes(record.status) && !['bind.reject', 'transfer.reject', 'operation.stopped'].includes(message.payload.action)) {
-                record.outbox.shift();
-                await this.save(handle);
-                continue;
-            }
-            const ns = await this.readNs(record.sub_aid);
-            const base = this.isBase(record, ns);
-            const target = record.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid && (ns.relation_version === record.base_relation_version || ns.relation_version === 0) : ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record);
-            const requiresTarget = ['relation.confirmed', 'sub.cleaned'].includes(message.payload.action);
-            if (requiresTarget ? !target : !base && !(record.operation === 'bind' && target && ['owner.ready', 'bind.accept'].includes(message.payload.action))) {
-                record.outbox.shift();
-                await this.save(handle);
-                continue;
-            }
-            if (base && record.request_verified)
-                await this.assertBaseMaterial(handle, ns);
-            if (message.payload.action === 'transfer.ready' && record.status !== 'completed') {
-                const expiresAt = record.files.transfer?.expires_at;
-                if (typeof expiresAt !== 'number' || !Number.isSafeInteger(expiresAt) || expiresAt <= 0)
-                    throw ownershipFailure('persistence_unavailable', 'persisted transfer authorization expiry is missing or invalid');
-                if (expiresAt <= Math.trunc(Date.now() / 1000))
-                    throw ownershipFailure('conflict', 'transfer authorization expired');
-            }
-            if (!message.message_id) {
-                message.message_id = `m-${randomUUID().replace(/-/g, '')}`;
-                await this.save(handle);
-            }
-            this.assertActive(handle);
-            await this.deps.send(message.to, message.payload, message.message_id);
-            handle.record.outbox.shift();
-            await this.save(handle);
-        }
-    }
-    async readNs(subAid) {
-        const ns = await this.deps.files.readAgent(subAid);
-        const file = ns.exists ? await this.deps.files.verifyFile(ns.content, 'agent', subAid) : undefined;
-        if (ns.relation_version !== (file?.statement?.relation_version ?? 0))
-            throw ownershipFailure('unavailable', 'NS relation metadata does not match agent.md', true);
-        const currentOwner = ns.lock === 'locked' ? file?.statement?.owner_aid : null;
-        if (ns.lock === 'locked' && (!file?.statement || file.statement.relation_version !== ns.relation_version) || ns.owner_aid !== undefined && ns.owner_aid !== currentOwner)
-            throw ownershipFailure('unavailable', 'NS owner metadata and signed agent.md do not agree', true);
-        if (!file?.statement)
-            return { ...ns, owner_aid: currentOwner };
-        const consensus = await this.deps.files.checkConsensus(subAid);
-        if (consensus.status === 'invalid' || consensus.status === 'unavailable' || consensus.status === 'not_applicable')
-            throw ownershipFailure(consensus.code ?? consensus.status, consensus.reason ?? 'ownership materials cannot be verified', consensus.retryable);
-        if (consensus.relation_version !== ns.relation_version || consensus.agent_md_etag !== ns.etag || consensus.agent_md_sha256 !== ownershipSha256(ns.content))
-            throw ownershipFailure('unavailable', 'agent.md changed during ownership verification', true);
-        return { ...ns, lock: consensus.lock, owner_aid: consensus.owner_aid };
-    }
-    isPending(record, ns) {
-        if (record.operation !== 'bind' || ns.lock !== 'unlocked' || !(ns.pending || ns.ownership_status === 'pending') || ns.relation_version !== record.target_relation_version)
-            return false;
-        const saved = record.files.agent;
-        const candidate = saved ? { raw: saved.raw, sha256: saved.hash, etag: saved.published_etag } : record.pending_agent_md ?? (record.base_agent_md?.pending ? record.base_agent_md : undefined);
-        return Boolean(candidate && ns.content === candidate.raw && ownershipSha256(ns.content) === candidate.sha256 && (!candidate.etag || ns.etag === candidate.etag));
-    }
-    isPendingBase(record, ns) {
-        const base = record.base_agent_md;
-        return record.operation === 'bind' && Boolean(base?.pending) && ns.lock === 'unlocked' && (ns.pending || ns.ownership_status === 'pending') && ns.relation_version === record.base_relation_version && ns.content === base.raw && ns.etag === base.etag && ownershipSha256(ns.content) === base.sha256;
-    }
-    isBase(record, ns) {
-        return this.isPending(record, ns) || this.isPendingBase(record, ns) || ns.relation_version === record.base_relation_version && (record.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === record.owner_aid);
-    }
-    async captureBase(record, ns) {
-        const statement = ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null : null;
-        const pending = record.operation === 'bind' && (ns.pending || ns.ownership_status === 'pending') && ns.relation_version === record.target_relation_version && statement?.owner_aid === record.owner_aid;
-        record.base_agent_md = { exists: ns.exists, raw: ns.content, sha256: ownershipSha256(ns.content), etag: ns.etag, statement, ...(record.operation === 'bind' && (ns.pending || ns.ownership_status === 'pending') ? { pending: true } : {}) };
-        if (pending)
-            record.pending_agent_md = { raw: ns.content, sha256: ownershipSha256(ns.content), etag: ns.etag };
-        if (!statement) {
-            record.base_owner_md = { exists: false, raw: '', sha256: '' };
-            return;
-        }
-        const owner = await this.deps.files.readOwner(statement.owner_aid, record.sub_aid);
-        if ((record.operation === 'transfer' || record.operation === 'release' && ns.lock === 'locked') && !owner.exists)
-            throw ownershipFailure('unavailable', 'original owner.md is unavailable', true);
-        if (owner.exists)
-            await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, statement.owner_aid);
-        record.base_owner_md = { exists: owner.exists, raw: owner.content, sha256: owner.exists ? ownershipSha256(owner.content) : '' };
-    }
-    async assertBaseMaterial(handle, ns) {
-        const record = handle.record;
-        this.assertAgentBaseMaterial(record, ns);
-        if (record.owner_proposal) {
-            const current = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-            if (!current.exists || current.content !== record.owner_proposal.raw || current.sha256 !== record.owner_proposal.sha256)
-                throw ownershipFailure('conflict', 'owner binding proposal changed');
-            await this.deps.files.verifyFile(current.content, 'owner', record.sub_aid, record.owner_aid);
-        }
-        const original = record.base_owner_md;
-        if (!original)
-            throw ownershipFailure('persistence_unavailable', 'original owner.md evidence is missing');
-        const originalOwnerAid = record.base_agent_md.statement?.owner_aid;
-        if (!originalOwnerAid)
-            return;
-        const current = await this.deps.files.readOwner(originalOwnerAid, record.sub_aid);
-        if (current.exists === original.exists && current.content === original.raw && (current.exists ? current.sha256 : '') === original.sha256)
-            return;
-        if (!current.exists)
-            throw ownershipFailure('conflict', 'the original owner.md was replaced');
-        const key = record.operation === 'bind' ? 'owner' : record.operation === 'release' ? 'release' : 'transfer';
-        const saved = record.files[key];
-        if (saved && saved.raw === current.content && saved.hash === current.sha256)
-            return;
-        if (record.operation !== 'bind' && this.local() !== record.owner_aid && record.local_decision === 'accept') {
-            const owner = await this.deps.files.verifyFile(current.content, 'owner', record.sub_aid, originalOwnerAid);
-            const previous = original.exists ? parseOwnershipFile(original.raw, 'owner', { expectedSubAid: record.sub_aid, expectedOwnerAid: originalOwnerAid }) : undefined;
-            const sameStatement = previous?.statement && Object.keys(previous.statement).every((field) => previous.statement[field] === owner.statement?.[field]);
-            const allowed = sameStatement && (record.operation === 'release' ? owner.action === 'release' : owner.action === 'transfer_owner' && owner.transfer?.new_owner_aid === record.new_owner_aid && owner.transfer?.target_relation_version === record.target_relation_version);
-            if (allowed && !saved) {
-                if (record.operation === 'transfer')
-                    await this.deps.files.requireTransfer(this.fileTask(handle));
-                record.files[key] = { raw: current.content, hash: current.sha256, condition: {}, original_owner: original, ...(owner.transfer ? { expires_at: owner.transfer.expires_at } : {}) };
-                await this.save(handle);
-                return;
-            }
-        }
-        throw ownershipFailure('conflict', 'the original owner statement was replaced');
-    }
-    assertAgentBaseMaterial(record, ns) {
-        if (this.isPending(record, ns))
-            return;
-        const base = record.base_agent_md;
-        if (!base || typeof base.raw !== 'string')
-            throw ownershipFailure('persistence_unavailable', 'original agent.md evidence is missing');
-        if (base.pending && (ns.content !== base.raw || ns.etag !== base.etag))
-            throw ownershipFailure('conflict', 'the pending ownership original was replaced');
-        const statement = ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement ?? null : null;
-        const same = base.statement ? Boolean(statement && Object.keys(base.statement).every((key) => base.statement[key] === statement[key])) : statement === null && ns.content === base.raw && ownershipSha256(ns.content) === base.sha256;
-        if (ns.exists !== base.exists || !same)
-            throw ownershipFailure('conflict', 'the original ownership statement was replaced');
-    }
-    async processInbox(handle) {
-        const record = handle.record;
-        while (record.inbox.length) {
-            const item = record.inbox[0];
-            const ns = await this.readNs(record.sub_aid);
-            if (record.operation === 'bind' && record.request_verified && !record.pending_agent_md && item.payload.action === 'bind.accept' && item.from === record.sub_aid && (ns.pending || ns.ownership_status === 'pending') && ns.lock === 'unlocked' && ns.relation_version === record.target_relation_version && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement?.owner_aid === record.owner_aid) {
-                record.pending_agent_md = { raw: ns.content, sha256: ownershipSha256(ns.content), etag: ns.etag };
-                await this.save(handle);
-            }
-            if (record.request_verified && ns.relation_version === record.base_relation_version && !['relation.confirmed', 'sub.cleaned'].includes(item.payload.action))
-                await this.assertBaseMaterial(handle, ns);
-            try {
-                parseOwnershipMessage(item.payload, { authenticated_from_aid: item.from, local_aid: this.local(), task: record, ns });
-            }
-            catch (error) {
-                record.inbox.shift();
-                record.received.push(`${item.from}|${item.payload.operation_id}|${item.payload.action}`);
-                if (record.status === 'pending' && ['bind.request', 'transfer.request'].includes(item.payload.action)) {
-                    record.status = 'stopped';
-                    record.step = 'conflict';
-                    record.retryable = false;
-                }
-                await this.save(handle);
-                this.emit(record, 'ownership.error', { code: error instanceof StateError ? error.stringCode : 'invalid', reason: error instanceof Error ? error.message : String(error), retryable: false });
-                continue;
-            }
-            const action = item.payload.action;
-            if (action === 'owner.ready' && record.legacy_recovery && record.status === 'pending') {
-                const owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-                if (!owner.exists)
-                    throw ownershipFailure(record.files.owner ? 'conflict' : 'unavailable', 'legacy owner confirmation declaration is missing', !record.files.owner);
-                const file = await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
-                if (file.action !== 'declare' || file.statement?.relation_version !== record.target_relation_version || record.files.owner && (record.files.owner.raw !== owner.content || record.files.owner.hash !== owner.sha256))
-                    throw ownershipFailure('conflict', 'legacy owner confirmation declaration changed');
-                if (!record.files.owner)
-                    record.files.owner = { raw: owner.content, hash: owner.sha256, condition: {}, original_owner: { exists: true, raw: owner.content, sha256: owner.sha256 } };
-                record.legacy_recovery.owner_confirmed = true;
-            }
-            if (['bind.request', 'transfer.request'].includes(action)) {
-                if (this.ownerFirst(record)) {
-                    if (ns.lock !== 'unlocked' || ns.pending || ns.ownership_status === 'pending')
-                        throw ownershipFailure('conflict', 'owner binding requires the original unlocked relation');
-                    const proposal = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-                    if (!proposal.exists)
-                        throw ownershipFailure('unavailable', 'owner binding proposal is missing', true);
-                    const file = await this.deps.files.verifyFile(proposal.content, 'owner', record.sub_aid, record.owner_aid);
-                    if (file.action !== 'declare' || file.statement?.relation_version !== record.target_relation_version || record.owner_proposal && (record.owner_proposal.raw !== proposal.content || record.owner_proposal.sha256 !== proposal.sha256))
-                        throw ownershipFailure('conflict', 'owner binding proposal does not match this operation');
-                    record.owner_proposal = { raw: proposal.content, sha256: proposal.sha256 };
-                }
-                if (!record.request_verified)
-                    await this.captureBase(record, ns);
-                record.request_verified = true;
-            }
-            if (['bind.accept', 'transfer.accept', 'bind.reject', 'transfer.reject'].includes(action)) {
-                if (record.approvals[item.from] === 'pending' && record.status === 'pending') {
-                    const rejected = action.endsWith('.reject');
-                    if (rejected) {
-                        try {
-                            if (await this.confirm(handle)) {
-                                record.inbox.shift();
-                                record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
-                                await this.save(handle);
-                                continue;
-                            }
-                            const observed = await this.deps.files.checkConsensus(record.sub_aid, { owner_aid: targetOwner(record), relation_version: record.target_relation_version });
-                            const targetReached = observed.status === 'consensus' && observed.owner_aid === targetOwner(record) && observed.relation_version === record.target_relation_version;
-                            if (targetReached) {
-                                record.code = 'unavailable';
-                                record.reason = 'ownership target is committed but local evidence is incomplete';
-                                record.retryable = true;
-                                record.inbox.shift();
-                                record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
-                                await this.save(handle);
-                                continue;
-                            }
-                        }
-                        catch (error) {
-                            if (error instanceof StateError && error.stringCode === 'persistence_unavailable')
-                                throw error;
-                            try {
-                                const ns = await this.readNs(record.sub_aid);
-                                if (ns.relation_version === record.target_relation_version && ns.lock === 'locked' && ns.owner_aid === targetOwner(record)) {
-                                    record.code = 'unavailable';
-                                    record.reason = 'ownership target is committed but local evidence is incomplete';
-                                    record.retryable = true;
-                                    record.inbox.shift();
-                                    record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
-                                    await this.save(handle);
-                                    continue;
-                                }
-                            }
-                            catch (observationError) {
-                                if (observationError instanceof StateError && observationError.stringCode === 'persistence_unavailable')
-                                    throw observationError;
-                            }
-                            record.code = error instanceof StateError ? error.stringCode : 'unavailable';
-                            record.reason = error instanceof Error ? error.message : String(error);
-                            record.retryable = true;
-                            await this.save(handle);
-                            throw error;
-                        }
-                    }
-                    record.approvals[item.from] = rejected ? 'reject' : 'accept';
-                    if (rejected) {
-                        record.status = 'rejected';
-                        record.step = 'approval';
-                        record.retryable = false;
-                        if (item.payload.reason !== undefined)
-                            record.reason = item.payload.reason;
-                        if (record.operation === 'transfer')
-                            for (const to of participants(record))
-                                if (to !== item.from)
-                                    this.enqueue(record, to, 'operation.stopped', item.payload.reason);
-                    }
-                }
-            }
-            if (action === 'operation.stopped' && record.status === 'pending' && !(await this.confirm(handle))) {
-                record.status = 'stopped';
-                record.step = 'stopped';
-                record.retryable = false;
-            }
-            if (action === 'sub.cleaned') {
-                const file = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid });
-                if (!file.statement)
-                    record.cleanup_status = 'cleaned';
-            }
-            if (record.operation === 'release' && !record.request_verified) {
-                if (ns.relation_version === 0) {
-                    const authorizationId = this.cleanupEvidence(record, { agent_md_etag: ns.etag, agent_md_sha256: ownershipSha256(ns.content), owner_md_sha256: '' }, ns.content);
-                    if (!authorizationId)
-                        throw ownershipFailure('conflict', 'no local cleanup evidence can verify the release request');
-                    const authorization = this.load(authorizationId).record;
-                    const saved = authorization.files.agent;
-                    const statement = parseOwnershipFile(saved.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
-                    const etag = saved.published_etag ?? authorization.completion_evidence?.agent_md_etag;
-                    if (!etag)
-                        throw ownershipFailure('persistence_unavailable', 'historical approved agent.md ETag is missing');
-                    record.base_agent_md = { exists: true, raw: saved.raw, sha256: saved.hash, etag, statement };
-                    const owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-                    if (owner.exists)
-                        await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
-                    record.base_owner_md = { exists: owner.exists, raw: owner.content, sha256: owner.exists ? ownershipSha256(owner.content) : '' };
-                    record.cleanup_authorization_id = authorizationId;
-                    if (!(await this.confirm(handle)))
-                        throw ownershipFailure('conflict', 'no local cleanup evidence can verify the release request');
-                }
-                else
-                    await this.captureBase(record, ns);
-                record.request_verified = true;
-            }
-            record.inbox.shift();
-            record.received.push(`${item.from}|${item.payload.operation_id}|${action}`);
-            const request = record.request_verified && record.local_decision === 'pending' && record.operation !== 'release' && !record.request_notified;
-            if (request)
-                record.request_notified = true;
-            await this.save(handle);
-            if (request)
-                this.emit(record, 'ownership.request');
-            if (record.status === 'rejected')
-                this.emit(record, 'ownership.rejected');
-            if (record.status === 'stopped')
-                this.emit(record, 'ownership.stopped');
-        }
-    }
-    fileTask(handle) {
-        const record = handle.record;
-        const task = { operation_id: record.operation_id, operation: record.operation, sub_aid: record.sub_aid, owner_aid: record.owner_aid,
-            stage: record.operation === 'bind' && record.initiator_aid === record.sub_aid && !record.legacy_recovery && !record.legacy_task,
-            new_owner_aid: record.new_owner_aid, base_relation_version: record.base_relation_version, target_relation_version: record.target_relation_version,
-            files: record.files, authorization_sha256: record.authorization_sha256, expires_at: record.expires_at, base_agent_md: record.base_agent_md, base_owner_md: record.base_owner_md, pending_agent_md: record.pending_agent_md, owner_proposal: record.owner_proposal,
-            assertActive: () => this.assertActive(handle),
-            persist: async () => {
-                record.authorization_sha256 = task.authorization_sha256;
-                record.expires_at = task.expires_at;
-                if (record.operation === 'transfer' && task.authorization_sha256 !== undefined && task.expires_at !== undefined && record.step === 'approval')
-                    record.step = this.local() === targetOwner(record) ? 'owner' : 'agent';
-                await this.save(handle);
-            } };
-        return task;
-    }
-    assertActive(handle) {
-        const current = this.load(handle.record.operation_id);
-        if (!current || this.isReset(current.record) || current.revision !== handle.revision)
-            throw ownershipFailure('conflict', 'ownership task changed before external action');
-    }
-    ownerFirst(record) {
-        return record.operation === 'bind' && record.initiator_aid === record.owner_aid && record.owner_aid !== record.sub_aid && Boolean(record.owner_first || record.owner_proposal) && !record.legacy_recovery && !record.legacy_task;
-    }
-    async drive(handle) {
-        if (this.isReset(handle.record))
-            return;
-        await this.upgradeLegacy(handle);
-        const record = handle.record;
-        if (!record.base_agent_md && record.request_verified)
-            return;
-        if (record.status === 'error' && record.retryable) {
-            record.status = 'pending';
-            await this.save(handle);
-        }
+    async checkOwnershipConsensus(subAid = this.local()) { return this.deps.files.checkConsensus(subAid); }
+    async bindLocalSubaid(sub) { return this.localSubaid(sub); }
+    async transferLocalSubaid(sub, next) { return this.localSubaid(sub, next); }
+    async localSubaid(sub, next) {
+        const actors = [this, sub, ...(next ? [next] : [])], aids = actors.map((actor) => actor.local()), [ownerAid, subAid, nextAid] = aids;
+        const guard = () => { for (const [index, actor] of actors.entries()) {
+            actor.deps.assertCurrent?.();
+            if (actor.local() !== aids[index] || actor.deps.currentType?.() !== 'agent')
+                throw ownershipFailure('conflict', 'local operation source identity changed');
+        } };
+        if (new Set(aids).size !== aids.length || actors.some((actor) => actor.deps.currentType?.() !== 'agent'))
+            throw ownershipFailure('forbidden', 'local ownership requires distinct agent identities');
+        guard();
+        const operation = next ? 'transfer' : 'bind';
+        const consensus = await this.deps.files.checkConsensus(subAid, { owner_aid: nextAid ?? ownerAid, relation_version: 1 });
+        guard();
+        const agent = await this.deps.files.readAgent(subAid);
+        guard();
+        const parsed = agent.exists ? await this.deps.files.verifyFile(agent.content, 'agent', subAid) : undefined;
+        const committed = consensus.status === 'consensus' && consensus.owner_aid === (nextAid ?? ownerAid) && Boolean(parsed?.statement);
+        const pending = agent.lock === 'unlocked' && (agent.pending || agent.ownership_status === 'pending') && parsed?.statement;
+        if (!committed && (operation === 'bind' ? !agent.exists || parsed?.frontmatter.type !== 'agent' || agent.lock !== 'unlocked' || Boolean(parsed.statement) && !pending : consensus.status !== 'consensus' || consensus.owner_aid !== ownerAid))
+            throw ownershipFailure('conflict', 'local ownership base does not match');
+        const baseVersion = committed ? parsed.statement.relation_version - 1 : pending ? parsed.statement.relation_version - 1 : agent.relation_version;
+        const record = { operation_id: randomUUID(), operation, sub_aid: subAid, owner_aid: ownerAid, ...(nextAid ? { new_owner_aid: nextAid } : {}), initiator_aid: ownerAid, base_relation_version: baseVersion, target_relation_version: baseVersion + 1, command: 'local', files: {}, notifications: [] };
+        await this.capture(record);
+        guard();
+        const task = () => {
+            const value = this.fileTask(record);
+            value.assertActive = guard;
+            value.persist = async () => { guard(); };
+            return value;
+        };
         try {
-            await this.processInbox(handle);
-            if (this.ownerFirst(record) && record.status === 'pending' && record.request_verified && this.local() === record.owner_aid) {
-                const ns = await this.readNs(record.sub_aid);
-                if (this.isBase(record, ns)) {
-                    await this.assertBaseMaterial(handle, ns);
-                    record.step = 'owner';
-                    await this.save(handle);
-                    await this.deps.files.declareSubaid(this.fileTask(handle));
-                }
-            }
-            if (record.operation === 'bind' && (record.initiator_aid === record.sub_aid || this.ownerFirst(record)) && record.status === 'pending' && record.request_verified && record.local_decision === 'accept' && this.local() === record.sub_aid && !record.legacy_recovery && !record.legacy_task) {
-                record.step = 'agent';
-                await this.save(handle);
-                await this.deps.files.declareOwneraid(this.fileTask(handle));
-            }
-            await this.flush(handle);
-            if (this.ownerFirst(record) && record.status === 'rejected' && this.local() === record.owner_aid && record.files.owner)
-                await this.deps.files.cancelOwnerProposal(this.fileTask(handle));
-            if (record.operation === 'bind' && record.status === 'rejected' && this.local() === record.sub_aid && record.files.agent && !record.rejection_cleanup?.cleaned) {
-                if (!record.rejection_cleanup) {
-                    record.rejection_cleanup = { files: {}, cleaned: false };
-                    await this.save(handle);
-                }
-                const task = this.fileTask(handle);
-                task.files = record.rejection_cleanup.files;
-                await this.deps.files.cancelPendingBind(task, record.files.agent);
-                record.rejection_cleanup.cleaned = true;
-                await this.save(handle);
-            }
-            if (record.status === 'rejected' || record.status === 'stopped' || record.status === 'error')
-                return;
-            if (!record.request_verified)
-                return;
-            if (record.status === 'completed') {
-                const observed = await this.deps.files.checkConsensus(record.sub_aid);
-                await this.resumeSubCleanup(handle, observed);
-                if (await this.confirm(handle, observed))
-                    await this.cleanup(handle);
-                await this.flush(handle);
-                return;
-            }
-            if (record.operation === 'release') {
-                if (await this.confirm(handle)) {
-                    await this.cleanup(handle);
-                    await this.flush(handle);
-                    return;
+            if (!committed) {
+                if (next) {
+                    await this.deps.files.transferOwneraid(task());
+                    guard();
                 }
-                if (this.local() === record.owner_aid) {
-                    record.step = 'release';
-                    await this.save(handle);
-                    await this.deps.files.revokeSubaid(this.fileTask(handle));
+                if (!await (next ?? this).hasLocalDeclaration(record, 'owner')) {
+                    await (next ?? this).deps.files.declareSubaid(task());
+                    guard();
                 }
-                if (await this.confirm(handle))
-                    await this.cleanup(handle);
-                await this.flush(handle);
-                return;
-            }
-            if (record.local_decision !== 'accept')
-                return;
-            if (await this.confirm(handle)) {
-                await this.cleanup(handle);
-                await this.flush(handle);
-                return;
-            }
-            const ns = await this.readNs(record.sub_aid);
-            if (!this.isBase(record, ns)) {
-                throw ownershipFailure('conflict', 'the original relation was replaced');
-            }
-            await this.assertBaseMaterial(handle, ns);
-            if (record.expires_at !== undefined && record.expires_at <= Math.trunc(Date.now() / 1000))
-                throw ownershipFailure('conflict', 'transfer authorization expired');
-            const approved = participants(record).every((name) => record.approvals[name] === 'accept');
-            if (record.operation === 'bind' && !approved || record.operation === 'transfer' && this.local() === record.owner_aid && !approved)
-                return;
-            if (record.legacy_recovery && this.local() === record.sub_aid && !record.legacy_recovery.owner_confirmed)
-                return;
-            delete record.code;
-            delete record.reason;
-            record.retryable = true;
-            if (record.operation === 'transfer' && this.local() === record.owner_aid) {
-                record.step = 'transfer';
-                await this.save(handle);
-                await this.deps.files.transferOwneraid(this.fileTask(handle));
-                for (const to of participants(record))
-                    this.enqueue(record, to, 'transfer.ready');
-                await this.save(handle);
-                await this.flush(handle);
-            }
-            if (record.operation === 'transfer') {
-                const original = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-                if (original.exists && (await this.deps.files.verifyFile(original.content, 'owner', record.sub_aid, record.owner_aid)).action === 'declare') {
-                    if (record.authorization_sha256 !== undefined)
-                        throw ownershipFailure('conflict', 'transfer authorization was withdrawn');
-                    return;
+                if (!await sub.hasLocalDeclaration(record, 'agent')) {
+                    await sub.deps.files.declareOwneraid(task());
+                    guard();
                 }
-                await this.deps.files.requireTransfer(this.fileTask(handle));
             }
-            if (this.local() === targetOwner(record)) {
-                record.step = 'owner';
-                await this.save(handle);
-                await this.deps.files.declareSubaid(this.fileTask(handle));
-                if (!this.ownerFirst(record))
-                    this.enqueue(record, record.sub_aid, 'owner.ready');
-                await this.save(handle);
-                await this.flush(handle);
+            else if (next && record.base_owner_md?.exists) {
+                const raw = record.base_owner_md.raw, authorization = await this.deps.files.verifyFile(raw, 'owner', subAid, ownerAid);
+                guard();
+                if (authorization.action !== 'transfer_owner' || authorization.statement?.relation_version !== record.base_relation_version || authorization.transfer?.new_owner_aid !== nextAid || authorization.transfer.target_relation_version !== record.target_relation_version)
+                    throw ownershipFailure('conflict', 'old owner transfer authorization changed');
+                record.files.transfer = { raw, hash: ownershipSha256(raw), condition: {}, original_owner: { exists: true, raw, sha256: ownershipSha256(raw) } };
             }
-            if (this.local() === record.sub_aid) {
-                if (record.legacy_recovery && record.files.owner) {
-                    const current = await this.deps.files.readOwner(record.owner_aid, record.sub_aid), pinned = record.files.owner;
-                    if (!current.exists || current.content !== pinned.raw || current.sha256 !== pinned.hash)
-                        throw ownershipFailure('conflict', 'legacy owner declaration changed before subject publication');
-                }
-                record.step = 'agent';
-                await this.save(handle);
-                await this.deps.files.declareOwneraid(this.fileTask(handle));
+            const confirmed = await this.deps.files.checkConsensus(subAid, { owner_aid: nextAid ?? ownerAid, relation_version: record.target_relation_version });
+            guard();
+            if (confirmed.status !== 'consensus' || confirmed.owner_aid !== (nextAid ?? ownerAid) || confirmed.relation_version !== record.target_relation_version)
+                throw ownershipFailure('unavailable', 'local files do not yet confirm ownership', true);
+            if (next && record.files.transfer) {
+                await this.deps.files.cleanupOwnerFile(task());
+                guard();
             }
-            const completed = await this.confirm(handle);
-            await this.flush(handle);
-            if (completed)
-                await this.cleanup(handle);
+            return this.result(record, 'completed');
         }
         catch (error) {
-            await this.recordError(handle, error);
-        }
-    }
-    async confirm(handle, observed) {
-        const record = handle.record;
-        const result = observed ?? await this.deps.files.checkConsensus(record.sub_aid, record.operation === 'release' ? undefined : { owner_aid: targetOwner(record), relation_version: record.target_relation_version });
-        if (result.status === 'invalid' || result.status === 'unavailable')
-            throw ownershipFailure(result.code ?? result.status, result.reason ?? 'ownership consensus cannot be verified', result.retryable);
-        if (record.operation === 'release' && record.status === 'completed' && result.status === 'unbound' && result.relation_version === 0)
-            return true;
-        let cleaned = false;
-        if (record.operation === 'release' && result.status === 'unbound' && result.relation_version === 0) {
-            const began = Date.now();
-            const ns = await this.readNs(record.sub_aid);
-            if (!ns.exists || !ns.etag)
-                throw ownershipFailure('conflict', 'current signed cleanup document is missing');
-            if (ns.etag !== result.agent_md_etag || ownershipSha256(ns.content) !== result.agent_md_sha256)
-                throw ownershipFailure('unavailable', 'agent.md changed during cleanup confirmation', true);
-            if (record.local_roles.includes('owner') && record.files.release) {
-                const source = record.files.release, owner = await this.deps.files.readOwner(record.owner_aid, record.sub_aid);
-                if (owner.exists && owner.content === source.raw && owner.sha256 === source.hash) {
-                    await this.deps.files.verifyFile(owner.content, 'owner', record.sub_aid, record.owner_aid);
-                    const after = await this.readNs(record.sub_aid);
-                    if (after.etag !== ns.etag || after.content !== ns.content || after.relation_version !== 0 || after.lock !== 'unlocked')
-                        throw ownershipFailure('unavailable', 'agent.md changed during release confirmation', true);
-                    result.owner_md_sha256 = owner.sha256;
-                }
-            }
-            const authorization = this.cleanupEvidence(record, result, ns.content);
-            if (!authorization)
-                throw ownershipFailure('conflict', 'no local cleanup original can confirm this release task');
-            if (Date.now() - began > 30_000)
-                throw ownershipFailure('unavailable', 'cleanup confirmation verification window elapsed', true);
-            if (authorization !== record.operation_id)
-                record.cleanup_authorization_id = authorization;
-            record.local_decision = 'accept';
-            record.approvals[this.local()] = 'accept';
-            record.cleanup_status = 'cleaned';
-            cleaned = true;
-        }
-        const reached = cleaned || result.relation_version === (record.operation === 'release' ? record.base_relation_version : record.target_relation_version) && (record.operation === 'release' ? result.status === 'released' && result.lock === 'unlocked' : result.status === 'consensus' && result.owner_aid === targetOwner(record));
-        if (!reached)
-            return false;
-        if (record.operation === 'release' && !cleaned) {
-            const ns = await this.readNs(record.sub_aid);
-            const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement;
-            if (ns.etag !== result.agent_md_etag || ownershipSha256(ns.content) !== result.agent_md_sha256)
-                throw ownershipFailure('unavailable', 'agent.md changed during release confirmation', true);
-            if (statement?.owner_aid !== record.owner_aid || statement.relation_version !== record.base_relation_version)
-                return false;
-            if (record.base_agent_md)
-                this.assertAgentBaseMaterial(record, ns);
-            if (record.files.release && result.owner_md_sha256 && record.files.release.hash !== result.owner_md_sha256)
-                throw ownershipFailure('conflict', 'current release material does not belong to this task');
-        }
-        if (record.operation === 'release' && record.local_roles.includes('owner') && !record.files.release)
-            throw ownershipFailure('conflict', 'local release file evidence is missing');
-        if (record.operation === 'transfer' && record.local_roles.includes('owner') && !record.files.transfer)
-            throw ownershipFailure('conflict', 'local transfer file evidence is missing');
-        if (record.operation === 'release' && this.local() === record.sub_aid && record.local_decision !== 'accept') {
-            const authorization = await this.cleanupAuthorization(record);
-            if (authorization) {
-                record.local_decision = 'accept';
-                record.approvals[this.local()] = 'accept';
-                record.cleanup_authorization_id = authorization.operation_id;
-                await this.save(handle);
-            }
-            const ns = await this.deps.files.readAgent(record.sub_aid);
-            if (!authorization && parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
-                record.step = 'cleanup';
-                if (record.cleanup_status !== 'action_required') {
-                    record.cleanup_status = 'action_required';
-                    await this.save(handle);
-                    this.emit(record, 'ownership.action_required');
-                }
-                return false;
-            }
-        }
-        if (record.operation !== 'release' && (record.local_decision !== 'accept' || this.local() === record.sub_aid && (!record.files.agent || record.files.agent.hash !== result.agent_md_sha256) || this.local() === targetOwner(record) && (!record.files.owner || record.files.owner.hash !== result.owner_md_sha256)))
-            return false;
-        if (record.owner_proposal && record.owner_proposal.sha256 !== result.owner_md_sha256)
-            throw ownershipFailure('conflict', 'owner binding proposal changed before acceptance');
-        if (record.operation === 'bind' && record.pending_agent_md && (record.pending_agent_md.sha256 !== result.agent_md_sha256 || record.pending_agent_md.etag !== result.agent_md_etag))
-            throw ownershipFailure('conflict', 'pending ownership original changed before acceptance');
-        if (record.status !== 'completed' && record.operation !== 'release' && this.local() === record.sub_aid && record.files.agent?.published_etag !== undefined && record.files.agent.published_etag !== result.agent_md_etag)
-            throw ownershipFailure('conflict', 'published agent.md ETag changed');
-        if (record.status !== 'completed') {
-            record.status = 'completed';
-            record.step = 'confirmed';
-            record.verified_relation_version = record.target_relation_version;
-            record.completion_evidence = { ...result };
-            delete record.code;
-            delete record.reason;
-            record.retryable = false;
-            if (record.operation === 'release' && this.local() === record.owner_aid)
-                this.enqueue(record, record.sub_aid, 'relation.confirmed');
-            else if (record.operation !== 'release' && this.local() === record.sub_aid)
-                for (const to of participants(record))
-                    this.enqueue(record, to, 'relation.confirmed');
-            await this.save(handle);
-            this.emit(record, 'ownership.completed');
-        }
-        return true;
-    }
-    cleanupEvidence(record, evidence, raw) {
-        const release = record.files.release;
-        if (record.local_roles.includes('owner') && release && release.hash === evidence.owner_md_sha256)
-            return record.operation_id;
-        if (!record.local_roles.includes('sub'))
-            return undefined;
-        const matches = (saved) => Boolean(saved && saved.hash === evidence.agent_md_sha256 && saved.hash === ownershipSha256(saved.raw) && (saved.published_etag === undefined || saved.published_etag === evidence.agent_md_etag) && (raw === undefined || raw === saved.raw));
-        if (matches(record.files.agent))
-            return record.operation_id;
-        for (const snapshot of this.list(true)) {
-            if (!['bind', 'transfer'].includes(String(snapshot.task.operation)) || record.cleanup_authorization_id && snapshot.operation_id !== record.cleanup_authorization_id)
-                continue;
-            let candidate;
-            try {
-                candidate = this.decode(snapshot).record;
-            }
-            catch (error) {
-                if (snapshot.task.sub_aid === record.sub_aid)
-                    throw error;
-                else
-                    continue;
-            }
-            if (candidate.local_decision !== 'accept' || !candidate.local_roles.includes('sub') || candidate.sub_aid !== record.sub_aid || targetOwner(candidate) !== record.owner_aid || candidate.target_relation_version !== record.base_relation_version || !matches(candidate.release_cleanup?.files.agent))
-                continue;
-            const statement = candidate.files.agent && parseOwnershipFile(candidate.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
-            if (statement?.owner_aid === record.owner_aid && statement.relation_version === record.base_relation_version && (!record.base_agent_md?.statement || Object.keys(record.base_agent_md.statement).every((field) => record.base_agent_md.statement[field] === statement[field])))
-                return candidate.operation_id;
-        }
-        return undefined;
-    }
-    async resumeSubCleanup(handle, observed) {
-        const record = handle.record;
-        if (!['bind', 'transfer'].includes(record.operation) || !record.local_roles.includes('sub') || record.local_decision !== 'accept' || record.release_cleanup?.cleaned)
-            return;
-        if (record.release_cleanup && observed.status === 'unbound' && observed.relation_version === 0) {
-            const saved = record.release_cleanup.files.agent;
-            const ns = await this.readNs(record.sub_aid);
-            if (!saved || saved.raw !== ns.content || saved.hash !== observed.agent_md_sha256 || saved.hash !== ownershipSha256(ns.content) || ns.etag !== observed.agent_md_etag || saved.published_etag !== undefined && saved.published_etag !== ns.etag)
-                throw ownershipFailure('conflict', 'historical cleanup original does not match current material');
-            saved.published_etag = ns.etag;
-            record.release_cleanup.cleaned = true;
-            await this.save(handle);
-            return;
-        }
-        if (observed.status !== 'released' || observed.relation_version !== record.target_relation_version)
-            return;
-        const ns = await this.readNs(record.sub_aid);
-        if (!ns.exists || ns.lock !== 'unlocked' || ns.relation_version !== observed.relation_version || ns.etag !== observed.agent_md_etag || ownershipSha256(ns.content) !== observed.agent_md_sha256)
-            throw ownershipFailure('unavailable', 'NS changed during historical cleanup observation', true);
-        const statement = parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement;
-        const original = record.files.agent && parseOwnershipFile(record.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
-        if (!statement || !original || Object.keys(original).some((field) => original[field] !== statement[field]))
-            throw ownershipFailure('conflict', 'historical cleanup fields belong to another relation');
-        if (!record.release_cleanup) {
-            record.release_cleanup = { files: {}, cleaned: false };
-            await this.save(handle);
-        }
-        await this.deps.files.revokeOwneraid({ operation: 'release', sub_aid: record.sub_aid, owner_aid: targetOwner(record),
-            base_relation_version: record.target_relation_version, target_relation_version: observed.relation_version,
-            files: record.release_cleanup.files, expected_agent_statement: original, assertActive: () => this.assertActive(handle), persist: () => this.save(handle) });
-        record.release_cleanup.cleaned = true;
-        await this.save(handle);
-        this.emit(record, 'ownership.progress');
-    }
-    async cleanupAuthorization(task) {
-        const ns = await this.readNs(task.sub_aid);
-        const statement = ns.exists ? parseOwnershipFile(ns.content, 'agent', { expectedSubAid: task.sub_aid }).statement : undefined;
-        if (!statement)
-            return undefined;
-        for (const snapshot of this.list(true)) {
-            if (snapshot.task.sub_aid !== task.sub_aid)
-                continue;
-            const candidate = this.decode(snapshot).record;
-            if (['bind', 'transfer'].includes(candidate.operation) && candidate.local_decision === 'accept' && candidate.local_roles.includes('sub') && candidate.sub_aid === task.sub_aid && targetOwner(candidate) === task.owner_aid && candidate.target_relation_version === task.base_relation_version && candidate.files.agent) {
-                const original = parseOwnershipFile(candidate.files.agent.raw, 'agent', { expectedSubAid: task.sub_aid }).statement;
-                const fixed = task.base_agent_md?.statement;
-                if (original && Object.keys(original).every((field) => original[field] === statement[field]) && (!fixed || Object.keys(fixed).every((field) => fixed[field] === original[field])))
-                    return candidate;
-            }
-        }
-        return undefined;
-    }
-    async cleanup(handle) {
-        const record = handle.record;
-        if (record.operation === 'bind')
-            return;
-        if (record.operation === 'release' && this.local() === record.sub_aid && record.cleanup_status !== 'cleaned') {
-            const ns = await this.readNs(record.sub_aid);
-            if (ns.exists && ns.lock === 'unlocked' && ns.relation_version === 0 && !parseOwnershipFile(ns.content, 'agent', { expectedSubAid: record.sub_aid }).statement) {
-                if (!this.cleanupEvidence(record, { agent_md_sha256: ownershipSha256(ns.content), agent_md_etag: ns.etag, owner_md_sha256: '' }, ns.content))
-                    throw ownershipFailure('conflict', 'current cleanup does not match a locally saved original');
-                record.cleanup_status = 'cleaned';
-                await this.save(handle);
-            }
-            else {
-                const authorization = await this.cleanupAuthorization(record);
-                if (!authorization || record.cleanup_authorization_id && authorization.operation_id !== record.cleanup_authorization_id) {
-                    if (record.cleanup_status !== 'action_required') {
-                        record.cleanup_status = 'action_required';
-                        await this.save(handle);
-                        this.emit(record, 'ownership.action_required');
-                    }
-                }
-                else {
-                    record.cleanup_authorization_id = authorization.operation_id;
-                    await this.save(handle);
-                    const task = this.fileTask(handle);
-                    task.expected_agent_statement = parseOwnershipFile(authorization.files.agent.raw, 'agent', { expectedSubAid: record.sub_aid }).statement;
-                    await this.deps.files.revokeOwneraid(task);
-                    record.cleanup_status = 'cleaned';
-                    this.enqueue(record, record.owner_aid, 'sub.cleaned');
-                    await this.save(handle);
-                }
-            }
-        }
-        if (this.local() === record.owner_aid && !record.files.cleanup?.deleted)
-            await this.deps.files.cleanupOwnerFile(this.fileTask(handle));
-    }
-    emit(record, event, extra = {}) {
-        const payload = { ...ownershipTaskResult(record), local_roles: [...record.local_roles], ...extra };
-        if (event === 'ownership.request')
-            payload.requester_aid = record.initiator_aid;
-        if (record.completion_evidence !== undefined)
-            payload.relation_version = record.completion_evidence.relation_version;
-        queueMicrotask(() => { try {
-            const pending = this.deps.emit(event, payload);
-            if (pending)
-                void pending.catch(() => { });
+            if (error instanceof StateError && ['conflict', 'owner_locked'].includes(error.stringCode))
+                throw error;
+            return this.result(record, 'error', error);
         }
-        catch { } });
     }
 }
 //# sourceMappingURL=ownership-workflow.js.map