@aiwg/cli 2026.10.5 → 2026.10.7

package/tools/ralph-external/session-launcher.mjs

@@ -34,9 +34,9 @@
 import { StringDecoder } from 'node:string_decoder';
 import { spawn } from 'child_process';
 import { createWriteStream, mkdirSync, existsSync, readFileSync, copyFileSync, constants } from 'fs';
-import { open, mkdir, rename, unlink, lstat, readdir, realpath, link } from 'node:fs/promises';
+import { open, mkdir, rename, unlink, lstat, readdir, realpath, link, access } from 'node:fs/promises';
 import { randomUUID, createHash } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { basename, dirname, join, relative, isAbsolute } from 'path';
 import { EventEmitter } from 'events';
 import { homedir, constants as osConstants } from 'os';
@@ -49,7 +49,7 @@ import { ScopedFailureBreaker, attributeFailureScope } from './lib/consecutive-f
 import { buildSessionEnvironment } from './lib/session-environment.mjs';
 import { launcherRecoveryEvidence, observeLauncherRecoveryOutcome, recordLauncherRecoveryHint } from './lib/launcher-recovery-evidence.mjs';
 export { observeLauncherRecoveryOutcome } from './lib/launcher-recovery-evidence.mjs';
-import { checkWorkerDispatch, detectWorkerIsolation, launchIsolatedWorker, getWorkerIsolationStatus, stopWorkerUnit, readUnitControlGroup } from './lib/worker-isolation.mjs';
+import { workerNeedsNativeNamespaces, probeWorkerNativeSandbox, nativeSandboxFailure, nativeSandboxProbeMessage, NATIVE_SANDBOX_UNAVAILABLE, checkWorkerDispatch, detectWorkerIsolation, launchIsolatedWorker, getWorkerIsolationStatus, stopWorkerUnit, readUnitControlGroup } from './lib/worker-isolation.mjs';
 const { signalChild } = await importImpl(import.meta.url, 'process/signal-child.mjs');
 
 // Resolve the same installation owner as CLI/MCP inputs in source and packaged layouts.
@@ -413,6 +413,84 @@ function subscribeWorkerRecovery(owner, breaker) {
   _workerRecoverySubscriptions.set(owner, () => reporter.owners.delete(owner));
 }
 
+/** Reuse the MC authority and its registered one-shot identity at every spawn boundary. */
+export async function assertManagedWorkerLaunch(options, invocation, inputs, projectRoot = process.cwd()) {
+  if (!options.managedAdmission || invocation.mode !== 'managed'
+    || inputs.snapshot.config.parallelism?.worker_mode !== 'managed') throw new Error('Managed worker admission is required');
+  const { createMcAdmissionScheduler } = await importImpl(import.meta.url, 'cli/handlers/mc.js');
+  const { loadLauncherRegistry } = await importImpl(import.meta.url, 'cli/handlers/ralph-launcher.js');
+  const { workerModelKey } = await importImpl(import.meta.url, 'models/provider-policy.js');
+  const scheduler = await createMcAdmissionScheduler(projectRoot, inputs.snapshot.config);
+  const { requestId, generation } = options.managedAdmission;
+  const snapshot = scheduler.snapshot();
+  const record = snapshot.records[requestId];
+  const deadlineAtMs = Math.min(...[record?.accounting?.runKey, record?.accounting?.taskKey]
+    .map(key => snapshot.allowances?.[key]?.deadlineAt).filter(Boolean).map(Date.parse));
+  const registered = loadLauncherRegistry(projectRoot).loops[process.env.RALPH_LOOP_ID];
+  const worker = record?.managed;
+  const reservation = record?.accounting?.reservation;
+  if (!record || record.state !== 'admitted' || record.leaseGeneration !== generation
+    || !record.launchClaimedAt || !record.metadata?.invocationId || Date.parse(record.leaseExpiresAt ?? '') <= Date.now()
+    || deadlineAtMs <= Date.now()
+    || worker?.kind !== 'external' || worker.group !== invocation.selected.group
+    || worker.member !== invocation.selected.member || worker.cli !== invocation.selected.cli
+    || worker.model !== workerModelKey(invocation.selected.inferenceProvider, invocation.selected.model)
+    || reservation?.tokens != null && !(invocation.limits.tokens <= reservation.tokens)
+    || reservation?.costUsd != null && !(invocation.limits.costUsd !== null && invocation.limits.costUsd <= reservation.costUsd)
+    || registered?.managedAdmission?.requestId !== requestId || registered.managedAdmission.generation !== generation
+    || registered.managedWorker?.invocationPath !== options.invocationPath
+    || registered.managedWorker?.runDir !== options.runDir) {
+    throw new Error('Managed worker launch differs from the current claimed admission');
+  }
+  if (record.execution) {
+    const identity = sampleWorkerIdentity(process.pid);
+    if (record.execution.pid !== process.pid || !identity?.bootId || !identity.startTicks
+      || record.execution.startedAt !== `${identity.bootId}:${identity.startTicks}:${identity.uid}`) {
+      throw new Error('Managed worker supervisor identity differs');
+    }
+  }
+  return { ...record, deadlineAtMs };
+}
+
+async function workerDispatchPath(filename) {
+  let candidate = filename;
+  while (dirname(candidate) !== candidate) {
+    try {
+      if (!(await lstat(candidate)).isDirectory()) return filename;
+      await access(candidate, constants.R_OK | constants.X_OK);
+      return candidate;
+    } catch (error) {
+      if (error.code !== 'ENOENT') return filename;
+      candidate = dirname(candidate);
+    }
+  }
+  // Keep an unusable path for fail-closed sampling rather than falling back to /.
+  return filename;
+}
+
+function workerDispatchRefusal(gate) {
+  const bounded = value => String(value ?? '').replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 256);
+  const reasons = (gate.failures ?? []).slice(0, 8)
+    .map(failure => `${bounded(failure.signal)}: ${bounded(failure.reason)}`).join('; ').slice(0, 1024);
+  return new Error(`Worker dispatch resource gate refused launch${reasons ? `: ${reasons}` : ''}`);
+}
+
+function workerLaunchRefusal(outcome) {
+  const bounded = value => String(value ?? '').replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 256);
+  const reasons = (outcome?.failures ?? []).slice(0, 8)
+    .map(failure => `${bounded(failure.signal)}: ${bounded(failure.reason)}`);
+  for (const detail of [outcome?.diagnostic, outcome?.error]) {
+    if (detail) reasons.push(bounded(detail));
+  }
+  return new Error(reasons.length
+    ? `Worker launch refused: ${reasons.join('; ').slice(0, 1024)}`
+    : 'Worker launch did not return an attached child');
+}
+
+// Only the admitted direct owner can supply inputs for an automatic correction.
+// Neither worker output nor a caller-supplied result can populate this context.
+const directStartupCorrectionContext = new WeakMap();
+
 async function launchOneWorker(owner, options) {
   const { inspectWorkerPath: inspect, revalidateWorkerInvocationPlan: validate } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
   const { qualificationDigest } = await importImpl(import.meta.url, 'models/qualification-digest.mjs');
@@ -425,6 +503,11 @@ async function launchOneWorker(owner, options) {
   const clock = () => typeof options.now === 'function' ? options.now() : options.now ?? new Date().toISOString();
   const now = clock();
   const invocation = await validate(saved, inputs.snapshot, inputs.drivers, now);
+  if (invocation.mode === 'managed' || options.managedAdmission) {
+    const admitted = await assertManagedWorkerLaunch(options, invocation, inputs);
+    options = { ...options, scopedBreaker: null, managedInvocationId: admitted.metadata.invocationId,
+      managedDeadlineAtMs: admitted.deadlineAtMs };
+  }
   if (invocation.transport !== 'shell') throw new Error('One-shot capture requires shell transport; use the qualified MCP descriptor directly');
   if (process.platform !== 'linux') throw new Error('One-shot worker capture requires qualified Linux process identity');
   const runDir = options.runDir;
@@ -475,9 +558,24 @@ async function launchOneWorker(owner, options) {
   // document on the stdin pipe, never brief text in argv (#2911).
   const { workerStdinBytes } = await importImpl(import.meta.url, 'serve/worker-stdin-frame.mjs');
   const stdinBytes = workerStdinBytes(invocation, brief, inputs.drivers[invocation.selected.cli]);
-  let gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config });
-  if (!gate.ok) throw new Error('Worker dispatch resource gate refused launch');
-  const isolation = options.isolation ?? detectWorkerIsolation();
+  let gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
+    paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
+  if (!gate.ok) throw workerDispatchRefusal(gate);
+  const { WorkerPolicyError, assertWorkerLaunchMode } = await importImpl(import.meta.url, 'models/provider-policy.js');
+  const permissions = inputs.snapshot.config.parallelism?.groups?.[invocation.selected.group]?.execution ?? {};
+  const adapter = inputs.drivers[invocation.selected.cli].qualification.adapter;
+  assertWorkerLaunchMode(adapter, permissions);
+  if (options.isolation?.mode === 'native-sandbox' && invocation.isolation !== 'native-sandbox') {
+    throw new WorkerPolicyError('OG_POLICY_RELAXATION', 'native-sandbox requires the pinned project execution policy');
+  }
+  const isolation = invocation.isolation === 'native-sandbox' ? { mode: 'native-sandbox' }
+    : options.isolation ?? detectWorkerIsolation();
+  if (isolation.mode === 'systemd-unit' && workerNeedsNativeNamespaces(adapter, permissions)) {
+    const probe = await (options.probeNativeSandbox ?? probeWorkerNativeSandbox)({ cwd: invocation.cwd,
+      envNames: invocation.envNames, env: Object.fromEntries(invocation.envNames.filter(name => process.env[name] !== undefined)
+        .map(name => [name, process.env[name]])) });
+    if (!probe.ok) throw new WorkerPolicyError(NATIVE_SANDBOX_UNAVAILABLE, nativeSandboxProbeMessage(probe));
+  }
   if (isolation.mode === 'degraded' && !options.allowDegraded) {
     throw new Error('Worker isolation unavailable; explicitly select --allow-degraded-worker or use manual observation');
   }
@@ -570,6 +668,7 @@ async function launchOneWorker(owner, options) {
   // worker-writable captureRoot fell back to the in-process ledger) is
   // folded in up front so every exit path reports it.
   const ledgerDiagnostics = admission.ledgerDiagnostic ? [admission.ledgerDiagnostic] : [];
+  const startupQualification = structuredClone(inputs.drivers[invocation.selected.cli].qualification);
   const settleLedger = async (outcome) => {
     const diagnostic = await settleDirectWorker(admission, outcome);
     if (diagnostic) ledgerDiagnostics.push(diagnostic);
@@ -653,11 +752,22 @@ async function launchOneWorker(owner, options) {
   // writes; `.catch(() => {})` keeps a prior failure from poisoning it, and
   // the per-call promise returned to the caller still reflects this write's
   // own outcome.
+  let latestProcessRecord = null;
   const publish = (name, value) => {
+    if (name === 'process.json') {
+      value = { ...value, recovery: { ...admission.breaker.recoveryStatus(), observedAt: new Date().toISOString() } };
+      if (options.startupCorrectionRecord) value.startupCorrection = options.startupCorrectionRecord;
+      latestProcessRecord = value;
+    }
     const write = publishing.catch(() => {}).then(() => writeRecord(runDir, name, value, inspect));
     publishing = write.catch(error => { publishFailures.push({ name, error: error?.message ?? String(error) }); });
     return write;
   };
+  const publishRecovery = () => {
+    if (latestProcessRecord) return publish('process.json', latestProcessRecord);
+  };
+  const onScopeTransition = () => { publishRecovery()?.catch(() => {}); };
+  admission.breaker.on('transition', onScopeTransition);
   const handles = [];
   let outcome;
   let artifacts;
@@ -692,7 +802,7 @@ async function launchOneWorker(owner, options) {
       prompt: { path: invocation.briefPath, digest: invocation.briefDigest }, cwd: invocation.cwd,
       worktree: { path: invocation.cwd, baseRevision: null }, paths, captures, outputFraming: profile.health?.outputFraming ?? 'opaque',
       health: invocation.health ?? null, transport: invocation.transport,
-      isolation: { mode: isolation.mode, memoryMaxGb: options.memoryMaxGb ?? 4 },
+      isolation: { mode: isolation.mode, memoryMaxGb: isolation.mode === 'native-sandbox' ? null : options.memoryMaxGb ?? 4 },
       limits: invocation.limits, maxOutputBytes: Math.min(invocation.maxOutputBytes ?? 10485760, 10485760) });
     await publish('process.json', { invocationId, origin: 'launcher', supervisor, worker: null,
       launchTime, monotonicStart, ownership: 'unknown', isolation: isolation.mode });
@@ -704,8 +814,9 @@ async function launchOneWorker(owner, options) {
     // Recheck policy, prompt, installation and exact bindings after file preparation.
     inputs = await loadInputs();
     await validate(saved, inputs.snapshot, inputs.drivers, clock());
-    gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config });
-    if (!gate.ok) throw new Error('Worker dispatch resource gate refused launch');
+    gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
+      paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
+    if (!gate.ok) throw workerDispatchRefusal(gate);
     if (bytesDigest(await boundedPrivateRead(invocation.briefPath, 262144, inspect)) !== invocation.briefDigest) throw new Error('Worker prompt changed before spawn');
     const environment = Object.fromEntries(invocation.envNames.filter(name => process.env[name] !== undefined)
       .map(name => [name, process.env[name]]));
@@ -766,12 +877,12 @@ async function launchOneWorker(owner, options) {
     // would in production).
     const launchResult = (options.launchIsolated ?? launchIsolatedWorker)({ name: invocationId,
       command: artifacts.argv[0], args: artifacts.argv.slice(1), cwd: invocation.cwd,
-      memoryMaxGb: options.memoryMaxGb ?? 4, gate, config: inputs.snapshot.config, isolation,
+      memoryMaxGb: options.memoryMaxGb ?? 4, gate, config: inputs.snapshot.config, isolation, workerGroup: invocation.selected.group,
       allowDegraded: !!options.allowDegraded, attached: true, ownedGroup: true,
       env: environment, envNames: invocation.envNames, stdin: invocation.stdin, runDir,
       ...(onDispatchCommit ? { onDispatchCommit } : {}) });
     outcome = typeof launchResult?.then === 'function' ? await launchResult : launchResult;
-    if (!outcome.child) throw new Error('Worker launch did not return an attached child');
+    if (!outcome?.child) throw workerLaunchRefusal(outcome);
     // #2915 review 4 (finding 3): when THIS attempt is the admitted canary
     // for one or more covering scopes, execution itself must be clipped to
     // the canary's own deadline (min(task deadline, admission+300s)) — not
@@ -819,6 +930,8 @@ async function launchOneWorker(owner, options) {
     // accumulated across this attempt's lifecycle on the returned result,
     // mirroring `publishFailures` — never silently discarded.
     if (ledgerDiagnostics.length && result) result.ledgerDiagnostics = ledgerDiagnostics.slice();
+    directStartupCorrectionContext.set(owner, { saved, invocation, loadInputs, clock, dispatchGuard,
+      ledger: admission.ledger, inspect, qualification: startupQualification });
     return result;
   } catch (error) {
     if (!outcome?.child) {
@@ -831,7 +944,7 @@ async function launchOneWorker(owner, options) {
       // canary deadline.
       await settleLedger({ kind: 'uncertain', confirmedStop: true });
       await publish('exit.json', { invocationId, exitCode: null, signal: null,
-        endedAt: new Date().toISOString(), termination: 'confirmed', descendants: 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
+        endedAt: new Date().toISOString(), isolation: isolation.mode, termination: 'confirmed', descendants: 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
     } else if (admission.gated) {
       // #2915 review 5 (finding 2a, "leaked capacity"), hardened by #2915
       // review 6 (finding 4, "capture-setup exception after spawn"): a
@@ -890,6 +1003,8 @@ async function launchOneWorker(owner, options) {
     if (ledgerDiagnostics.length) error.ledgerDiagnostics = ledgerDiagnostics;
     throw error;
   } finally {
+    admission.breaker.removeListener('transition', onScopeTransition);
+    await publishing;
     try { await artifacts?.cleanup(); } finally {
       // Never chmod a worker-replaced pathname; only the inodes we opened.
       for (const handle of handles) { await handle.chmod(0o600).catch(() => {}); await handle.close().catch(() => {}); }
@@ -900,6 +1015,38 @@ async function launchOneWorker(owner, options) {
   }
 }
 
+// #3489: process exit/close notification can be observed before the final
+// pipe bytes are delivered as stream 'data' events (the same class as #3488,
+// which waited for IPC disconnect as well as exit). The child 'data'
+// handlers are the ONLY path that feeds the health observer and accumulates
+// the `output` buffer adapter extraction consumes, so settling health on
+// the process-level event alone classifies a completed exit-0 run as
+// `failed` (missing terminal event, FINAL_INVALID) whenever it wins the
+// race under load. Drain any already-buffered stdout/stderr bytes — bounded
+// by the termination grace — before destroying the source streams and
+// snapshotting output/observer state. Streams with no buffered bytes
+// resolve immediately, so never-ending stdio (timer-faked stand-ins, held
+// pipes) never delays settle; the bound only covers genuinely in-flight
+// data. The timer stays referenced so a bounded drain always completes,
+// mirroring the already-referenced exit-grace `later()` timer.
+function drainChildStdio(child, timeoutMs) {
+  const pending = [];
+  for (const stream of [child?.stdout, child?.stderr]) {
+    if (!stream || typeof stream.once !== 'function' || stream.readableEnded || stream.destroyed) continue;
+    if (!(stream.readableLength > 0)) continue;
+    try { stream.resume?.(); } catch { continue; }
+    pending.push(new Promise(resolve => {
+      const done = () => { clearTimeout(timer); resolve(); };
+      const timer = setTimeout(done, Math.max(0, timeoutMs ?? 0));
+      stream.once('end', done);
+      stream.once('close', done);
+      stream.once('error', done);
+    }));
+  }
+  if (!pending.length) return Promise.resolve();
+  return Promise.all(pending);
+}
+
 async function captureOneWorker(owner, ctx) {
   const { child, outcome, invocation, invocationId, supervisor, launchTime, monotonicStart, publish, paths, handles, options,
     canaryDeadlineMs = null, canaryNowMs = () => Date.now(), recoveryGated = false } = ctx;
@@ -968,7 +1115,16 @@ async function captureOneWorker(owner, ctx) {
   };
   const graceMs = (invocation.health?.terminateGraceSeconds ?? 5) * 1000;
   const signal = value => {
-    if (settled || !signalOwnedWorker(identity, value, { supervisor })) return false;
+    if (settled) return false;
+    let delivered = signalOwnedWorker(identity, value, { supervisor });
+    // Startup can consume the whole deadline before the transport spawns
+    // its worker or publishes an owned group. We still own this attached
+    // ChildProcess: stop it before it can launch work after finalization.
+    // This proves no descendant termination; degraded mode stays uncertain.
+    if (!delivered && !identity && hasTransport && outcome.mode !== 'systemd-unit' && !sawExit) {
+      try { delivered = signalChild(child, value); } catch { /* already exited or no child handle */ }
+    }
+    if (!delivered) return false;
     deliveredSignal = value;
     return true;
   };
@@ -1007,8 +1163,19 @@ async function captureOneWorker(owner, ctx) {
     }
     signal('SIGTERM');
     const remainingGrace = Math.min(graceMs, hardRemaining());
-    if (remainingGrace === 0) { signal('SIGKILL'); later(() => finish(), 100); }
-    else later(() => { signal('SIGKILL'); later(() => finish(), 100); }, remainingGrace);
+    const escalate = () => {
+      signal('SIGKILL');
+      // Startup may have no worker identity yet. Wait for our transport's
+      // exit status before settling: TERM can have killed it even if KILL
+      // was also delivered before Node observes exit (#3532). Use the unused
+      // grace plus the existing 100ms settle tick, keeping the total
+      // termination budget at graceMs + 100 on the tracked launcher timers.
+      const exitWaitMs = !identity && hasTransport && outcome.mode !== 'systemd-unit'
+        ? graceMs - remainingGrace + 100 : 100;
+      later(() => finish(), exitWaitMs);
+    };
+    if (remainingGrace === 0) escalate();
+    else later(escalate, remainingGrace);
   };
   owner.currentProcess = child;
   owner.workerStop = stop;
@@ -1023,9 +1190,15 @@ async function captureOneWorker(owner, ctx) {
     owner.emit('stdout', chunk);
   });
   let stderrBytes = 0;
+  let sandboxStderrTail = '';
   let recoveryReason = null;
   child.stderr.on('data', chunk => {
     observer.feed(chunk, { kind: 'stderr', id: 'stderr', generation: 0, offset: stderrOffset }); stderrOffset += chunk.length;
+    if (workerNeedsNativeNamespaces(driver.qualification.adapter, ctx.inputs.snapshot.config.parallelism?.groups?.[invocation.selected.group]?.execution)) {
+      const observedStderr = sandboxStderrTail + chunk.toString('utf8');
+      if (nativeSandboxFailure(observedStderr)) errorCode = NATIVE_SANDBOX_UNAVAILABLE;
+      sandboxStderrTail = observedStderr.slice(-1024);
+    }
     const hint = classifyWorkerHealthFailure(chunk.toString('utf8'), { source: { kind: 'stderr' } })?.reasonCode;
     if (['RATE_LIMIT', 'NETWORK'].includes(hint)) recoveryReason = hint;
     const remaining = Math.max(0, 10485760 - stderrBytes);
@@ -1055,6 +1228,10 @@ async function captureOneWorker(owner, ctx) {
     timers.clear();
     process.off('SIGTERM', onSignal); process.off('SIGINT', onSignal);
     owner.currentProcess = null; owner.workerStop = null;
+    // #3489: drain in-flight stdio before destroying the source streams —
+    // destroying first discards bytes never delivered as 'data', settling
+    // health on a partial stream (exit observed before drain).
+    await drainChildStdio(child, graceMs);
     child.stdout.destroy(); child.stderr.destroy(); child.stdin?.destroy(); child.unref();
     for (const stream of streams) await new Promise(resolve => { if (stream.destroyed) resolve(); else stream.end(resolve); });
     const native = outcome.mode === 'systemd-unit' ? readNative() : null;
@@ -1415,12 +1592,15 @@ async function captureOneWorker(owner, ctx) {
 
 // ===========================================================================
 // BASED ON a4085b86a (#2915 round 8, D6).
-// Exception: finish() snapshots timeout classification before cleanup and
-// respects the winning stop cause, matching captureOneWorker's race fix.
+// Shared lifecycle fixes: finish() snapshots timeout classification before
+// cleanup and respects the winning stop cause; stop() can signal the owned
+// transport before worker identity is available, and then uses the unused
+// termination grace to observe its exit before falling back to the last
+// delivered signal (#3532).
 // The test/fixtures frozen reference remains unchanged.
 //
 // `launchOneWorkerBaseline` and `captureOneWorkerBaseline` reproduce
-// `launchOneWorker`/`captureOneWorker`, apart from the timeout race fix above,
+// `launchOneWorker`/`captureOneWorker`, apart from the lifecycle fixes above,
 // as they existed at base commit `a4085b86a` (`git show
 // a4085b86a:tools/ralph-external/session-launcher.mjs`) — before any
 // #2915 direct-recovery code existed in this file. `launchOneWorker`
@@ -1472,7 +1652,7 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
   if (runStat.uid !== process.getuid()) throw new Error('Worker run directory must be conductor-owned');
   await withWorkerPath(runDir, async target => { const handle = await open(target, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
     try { await handle.chmod(0o700); } finally { await handle.close(); } });
-  const invocationId = randomUUID();
+  const invocationId = options.managedAdmission ? options.managedInvocationId : randomUUID();
   const reservation = await withWorkerPath(join(runDir, '.launch-owner'), target => open(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600));
   try { await reservation.writeFile(invocationId); await reservation.sync(); } finally { await reservation.close(); }
   const supervisor = sampleWorkerIdentity(process.pid);
@@ -1492,11 +1672,12 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
   const handles = [];
   let outcome;
   let artifacts;
+  let managedSpawnAttempted = false;
   try {
     artifacts = await materializeWorkerArtifacts(invocation, runDir);
     const displayArgv = artifacts.argv.map((token, i) => i === 0 ? token : `<argument:${bytesDigest(token)}>`);
     await publish('invocation.json', { version: 1, origin: 'launcher', invocationId, attemptId: invocationId,
-      previousAttemptId: verifiedPreviousAttemptId ?? null, requestId: invocationId, taskDigest: qualificationDigest(saved.request), role: saved.request.role,
+      previousAttemptId: verifiedPreviousAttemptId ?? null, requestId: options.managedAdmission?.requestId ?? invocationId, taskDigest: qualificationDigest(saved.request), role: saved.request.role,
       selected: invocation.selected, planDigest: qualificationDigest(saved), invocationDigest: qualificationDigest(invocation),
       policyDigest: invocation.policyDigest, catalogDigest: invocation.catalogDigest, profileDigest: invocation.profileDigest,
       expiresAt: invocation.expiresAt, argv: displayArgv, commandDisplay: displayArgv.map(token => JSON.stringify(token)).join(' '),
@@ -1509,7 +1690,7 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
       prompt: { path: invocation.briefPath, digest: invocation.briefDigest }, cwd: invocation.cwd,
       worktree: { path: invocation.cwd, baseRevision: null }, paths, captures, outputFraming: profile.health?.outputFraming ?? 'opaque',
       health: invocation.health ?? null, transport: invocation.transport,
-      isolation: { mode: isolation.mode, memoryMaxGb: options.memoryMaxGb ?? 4 },
+      isolation: { mode: isolation.mode, memoryMaxGb: isolation.mode === 'native-sandbox' ? null : options.memoryMaxGb ?? 4 },
       limits: invocation.limits, maxOutputBytes: Math.min(invocation.maxOutputBytes ?? 10485760, 10485760) });
     await publish('process.json', { invocationId, origin: 'launcher', supervisor, worker: null,
       launchTime, monotonicStart, ownership: 'unknown', isolation: isolation.mode });
@@ -1521,8 +1702,9 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     // Recheck policy, prompt, installation and exact bindings after file preparation.
     inputs = await loadInputs();
     await validate(saved, inputs.snapshot, inputs.drivers, clock());
-    localGate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config });
-    if (!localGate.ok) throw new Error('Worker dispatch resource gate refused launch');
+    localGate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
+      paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
+    if (!localGate.ok) throw workerDispatchRefusal(localGate);
     if (bytesDigest(await boundedPrivateRead(invocation.briefPath, 262144, inspect)) !== invocation.briefDigest) throw new Error('Worker prompt changed before spawn');
     const environment = Object.fromEntries(invocation.envNames.filter(name => process.env[name] !== undefined)
       .map(name => [name, process.env[name]]));
@@ -1539,16 +1721,24 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     const launchResult = (options.launchIsolated ?? launchIsolatedWorker)({ name: invocationId,
       command: artifacts.argv[0], args: artifacts.argv.slice(1), cwd: invocation.cwd,
       memoryMaxGb: options.memoryMaxGb ?? 4, gate: localGate, config: inputs.snapshot.config, isolation,
+      workerGroup: invocation.selected.group,
       allowDegraded: !!options.allowDegraded, attached: true, ownedGroup: true,
+      ...(options.managedAdmission ? { onDispatchCommit: async () => {
+        const admitted = await assertManagedWorkerLaunch(options, invocation, inputs);
+        options.managedDeadlineAtMs = Math.min(options.managedDeadlineAtMs, admitted.deadlineAtMs);
+      } } : {}),
+      ...(options.managedAdmission ? { onSpawnAttempt: () => { managedSpawnAttempted = true; } } : {}),
       env: environment, envNames: invocation.envNames, stdin: invocation.stdin, runDir });
     outcome = typeof launchResult?.then === 'function' ? await launchResult : launchResult;
-    if (!outcome.child) throw new Error('Worker launch did not return an attached child');
+    if (!outcome?.child) throw workerLaunchRefusal(outcome);
     return await captureOneWorkerBaseline(owner, { child: outcome.child, outcome, invocation, invocationId, supervisor,
       launchTime, monotonicStart, publish, publishFailures, paths, handles, inspect, inputs, profile, baselineContent, options,
       brief: ctx.brief, stdinBytes: ctx.stdinBytes, runDir });
   } catch (error) {
     if (!outcome?.child) await publish('exit.json', { invocationId, exitCode: null, signal: null,
-      endedAt: new Date().toISOString(), termination: 'confirmed', descendants: 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
+      ...(options.managedAdmission ? { managedAdmission: options.managedAdmission } : {}),
+      endedAt: new Date().toISOString(), isolation: isolation.mode, termination: managedSpawnAttempted ? 'uncertain' : 'confirmed',
+      descendants: managedSpawnAttempted ? 'unknown' : 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
     throw error;
   } finally {
     try { await artifacts?.cleanup(); } finally {
@@ -1588,9 +1778,13 @@ async function captureOneWorkerBaseline(owner, ctx) {
   let sawClose = false;
   const driver = ctx.inputs.drivers[invocation.selected.cli];
   const observationOptions = { provider: driver.qualification.adapter.provider, profile: ctx.profile,
-    effectiveHealth: invocation.health, invocationId, startedAt: Number(BigInt(monotonicStart)) / 1e6,
+    effectiveHealth: options.managedAdmission ? { ...invocation.health,
+      hardTimeoutSeconds: Math.min(invocation.health?.hardTimeoutSeconds ?? invocation.limits.wallSeconds,
+        (options.managedDeadlineAtMs - Date.parse(launchTime)) / 1000) } : invocation.health,
+    invocationId, startedAt: Number(BigInt(monotonicStart)) / 1e6,
     launchTime, contentDigest: ctx.baselineContent, sessionId: options.healthSessionLog?.sessionId ?? null,
-    runId: options.healthSessionLog?.runId ?? null, maxOutputBytes: invocation.maxOutputBytes };
+    runId: options.healthSessionLog?.runId ?? null, maxOutputBytes: invocation.maxOutputBytes,
+    ...(options.managedAdmission ? { observerGeneration: options.managedAdmission.generation, requestId: options.managedAdmission.requestId } : {}) };
   const observer = driver.createHealthObserver?.(observationOptions) ?? createWorkerHealthObserver(observationOptions);
   const tickRate = qualifyWorkerCpuTickRate();
   let previousCpu = null;
@@ -1611,7 +1805,16 @@ async function captureOneWorkerBaseline(owner, ctx) {
   };
   const graceMs = (invocation.health?.terminateGraceSeconds ?? 5) * 1000;
   const signal = value => {
-    if (settled || !signalOwnedWorker(identity, value, { supervisor })) return false;
+    if (settled) return false;
+    let delivered = signalOwnedWorker(identity, value, { supervisor });
+    // Startup can consume the whole deadline before the transport spawns
+    // its worker or publishes an owned group. We still own this attached
+    // ChildProcess: stop it before it can launch work after finalization.
+    // This proves no descendant termination; degraded mode stays uncertain.
+    if (!delivered && !identity && hasTransport && outcome.mode !== 'systemd-unit' && !sawExit) {
+      try { delivered = signalChild(child, value); } catch { /* already exited or no child handle */ }
+    }
+    if (!delivered) return false;
     deliveredSignal = value;
     return true;
   };
@@ -1640,8 +1843,19 @@ async function captureOneWorkerBaseline(owner, ctx) {
     }
     signal('SIGTERM');
     const remainingGrace = Math.min(graceMs, hardRemaining());
-    if (remainingGrace === 0) { signal('SIGKILL'); later(() => finish(), 100); }
-    else later(() => { signal('SIGKILL'); later(() => finish(), 100); }, remainingGrace);
+    const escalate = () => {
+      signal('SIGKILL');
+      // Startup may have no worker identity yet. Wait for our transport's
+      // exit status before settling: TERM can have killed it even if KILL
+      // was also delivered before Node observes exit (#3532). Use the unused
+      // grace plus the existing 100ms settle tick, keeping the total
+      // termination budget at graceMs + 100 on the tracked launcher timers.
+      const exitWaitMs = !identity && hasTransport && outcome.mode !== 'systemd-unit'
+        ? graceMs - remainingGrace + 100 : 100;
+      later(() => finish(), exitWaitMs);
+    };
+    if (remainingGrace === 0) escalate();
+    else later(escalate, remainingGrace);
   };
   owner.currentProcess = child;
   owner.workerStop = stop;
@@ -1656,8 +1870,14 @@ async function captureOneWorkerBaseline(owner, ctx) {
     owner.emit('stdout', chunk);
   });
   let stderrBytes = 0;
+  let sandboxStderrTail = '';
   child.stderr.on('data', chunk => {
     observer.feed(chunk, { kind: 'stderr', id: 'stderr', generation: 0, offset: stderrOffset }); stderrOffset += chunk.length;
+    if (workerNeedsNativeNamespaces(driver.qualification.adapter, ctx.inputs.snapshot.config.parallelism?.groups?.[invocation.selected.group]?.execution)) {
+      const observedStderr = sandboxStderrTail + chunk.toString('utf8');
+      if (nativeSandboxFailure(observedStderr)) errorCode = NATIVE_SANDBOX_UNAVAILABLE;
+      sandboxStderrTail = observedStderr.slice(-1024);
+    }
     const remaining = Math.max(0, 10485760 - stderrBytes);
     streams[1].write(chunk.subarray(0, remaining)); streams[3].write(chunk.subarray(0, remaining)); stderrBytes += chunk.length;
     if (stderrBytes > 10485760) { errorCode = 'OUTPUT_LIMIT'; stop(); }
@@ -1685,6 +1905,11 @@ async function captureOneWorkerBaseline(owner, ctx) {
     timers.clear();
     process.off('SIGTERM', onSignal); process.off('SIGINT', onSignal);
     owner.currentProcess = null; owner.workerStop = null;
+    // #3489: drain in-flight stdio before destroying the source streams —
+    // destroying first discards bytes never delivered as 'data', settling
+    // health on a partial stream (exit observed before drain). Ordering-only;
+    // recovery semantics in this frozen baseline are unchanged.
+    await drainChildStdio(child, graceMs);
     child.stdout.destroy(); child.stderr.destroy(); child.stdin?.destroy(); child.unref();
     for (const stream of streams) await new Promise(resolve => { if (stream.destroyed) resolve(); else stream.end(resolve); });
     const native = outcome.mode === 'systemd-unit' ? readNative() : null;
@@ -1707,6 +1932,7 @@ async function captureOneWorkerBaseline(owner, ctx) {
     const exitCode = resultSignal ? null
       : outcome.mode === 'systemd-unit' && native?.execMainCode === 1 ? native.execMainStatus : waitCode;
     const result = { invocationId, exitCode, signal: resultSignal,
+      ...(options.managedAdmission ? { managedAdmission: options.managedAdmission } : {}),
       endedAt: new Date().toISOString(), termination: confirmed ? 'confirmed' : 'uncertain',
       descendants: confirmed ? 'stopped' : 'unknown', timedOut: resultTimedOut,
       cancelled: stopReason === 'CANCELLED', stopReason, errorCode: errorCode ?? null, capturedBytes: Math.min(total, output.length),
@@ -1772,8 +1998,11 @@ async function captureOneWorkerBaseline(owner, ctx) {
     sawExit = true; waitCode = code; waitSignal = sig; later(() => finish(), graceMs);
   });
   child.once('close', () => { sawClose = true; finish(); });
-  const hardRemaining = () => Math.max(0, Math.min(invocation.health?.hardTimeoutSeconds ?? invocation.limits.wallSeconds,
-    invocation.limits.wallSeconds) * 1000 - (Number(process.hrtime.bigint() - BigInt(monotonicStart)) / 1e6));
+  const hardRemaining = () => Math.max(0, Math.min(
+    Math.min(invocation.health?.hardTimeoutSeconds ?? invocation.limits.wallSeconds, invocation.limits.wallSeconds,
+      options.managedAdmission ? (options.managedDeadlineAtMs - Date.parse(launchTime)) / 1000 : Infinity) * 1000
+      - (Number(process.hrtime.bigint() - BigInt(monotonicStart)) / 1e6),
+    options.managedAdmission ? options.managedDeadlineAtMs - Date.now() : Infinity));
   later(() => {
     observer.check();
     reportHealth(); stop('HARD_DEADLINE');
@@ -3707,6 +3936,102 @@ export function classifyAttemptForSettlement(invocation, result, { quotaAccount
     inferenceProvider: selected.inferenceProvider ?? null, quotaAccount, installationQualifier };
 }
 
+/** Refresh only a demonstrated stale executable binding. Installation, login,
+ * permissions, models, working directories and policy are never repaired here.
+ * One retry shares the original task clock and the existing atomic ledgers. */
+async function correctDirectWorkerStartup(owner, options, previous) {
+  const context = directStartupCorrectionContext.get(owner);
+  if (!context || options.correctStartup !== undefined || previous?.errorCode !== 'ENOENT'
+    || previous.termination !== 'confirmed' || previous.exitCode != null || previous.signal != null
+    || previous.cancelled || previous.timedOut || previous.publishFailures?.length
+    || classifyLaunchOutcomeForRecovery(previous).reasonCode !== 'NOT_FOUND') return previous;
+  const { saved, invocation, loadInputs, clock, dispatchGuard, ledger, inspect, qualification } = context;
+  const record = { action: 'refresh-executable-binding', reasonCode: 'NOT_FOUND', state: 'stopped',
+    previousInvocationId: previous.invocationId };
+  const recordAt = async (runDir, invocationId) => {
+    const processRecord = JSON.parse((await boundedPrivateRead(join(runDir, 'process.json'), 65536, inspect)).toString('utf8'));
+    if (processRecord.origin !== 'launcher' || processRecord.invocationId !== invocationId) throw new Error('Correction record identity changed');
+    await (options.publishRecord ?? publishWorkerRecord)(runDir, 'process.json', { ...processRecord, startupCorrection: { ...record } }, inspect);
+  };
+  const stop = async code => {
+    record.stopCode = code;
+    previous.startupCorrection = { ...record };
+    await recordAt(options.runDir, previous.invocationId);
+    return previous;
+  };
+  const guardStop = () => dispatchGuard?.isCancelled?.() === true ? 'CANCELLED'
+    : dispatchGuard?.deadlineAtMs != null && (dispatchGuard.nowMs?.() ?? Date.now()) >= dispatchGuard.deadlineAtMs ? 'DEADLINE' : null;
+  if (ledger?.n >= ledger?.maxAttempts) return stop('ATTEMPT_LIMIT');
+  if (guardStop()) return stop(guardStop());
+  let inputs;
+  let plan;
+  const retryId = randomUUID();
+  const finalPath = `${invocation.finalPath}.recovery-${retryId}`;
+  try {
+    inputs = await loadInputs();
+    const { resolveWorkerInvocation } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
+    plan = await resolveWorkerInvocation(inputs.snapshot, { ...saved.request, final_output: finalPath }, inputs.drivers, clock());
+  } catch { return stop('QUALIFICATION_REFUSED'); }
+  if (guardStop()) return stop(guardStop());
+  if (plan?.status !== 'eligible' || plan.mode !== 'direct' || plan.invocation?.readiness !== 'launchable') return stop('QUALIFICATION_REFUSED');
+  if (plan.invocation.argv[0] === invocation.argv[0]) return stop('UNCHANGED_EXECUTABLE');
+  // A freshly requalified installation may have new binary/proof digests.
+  // Preserve every effective adapter declaration and installation boundary.
+  const effectiveQualification = value => {
+    const copy = structuredClone(value);
+    const stripEvidence = evidence => {
+      if (evidence) for (const key of ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef']) delete evidence[key];
+    };
+    stripEvidence(copy.adapter?.qualification);
+    for (const profile of Object.values(copy.adapter?.invocationProfiles ?? {})) stripEvidence(profile.installationQualification);
+    if (copy.installation) {
+      delete copy.installation.executable;
+      delete copy.installation.evidence;
+    }
+    if (copy.stdinFramerBinding) delete copy.stdinFramerBinding.storeDigest;
+    return JSON.stringify(copy);
+  };
+  if (effectiveQualification(qualification) !== effectiveQualification(inputs.drivers[invocation.selected.cli]?.qualification)) return stop('BINDING_CHANGED');
+  // The resolver is authoritative for the replacement executable. Everything
+  // else must remain identical, including qualified selection, policy, limits,
+  // framing, environment, controls, prompt digest and workspace. Only fresh
+  // output names and expiration are expected to differ between attempts.
+  const binding = value => {
+    const copy = structuredClone(value);
+    const replacements = ['stderrPath', 'stdoutPath', 'finalPath'].map(key => [copy[key], `<${key}>`]);
+    const normalize = value => replacements.find(([path]) => path === value)?.[1] ?? value;
+    copy.argv = copy.argv.map((value, index) => index === 0 ? '<executable>' : normalize(value));
+    delete copy.selected.qualificationDigest;
+    for (const key of ['stdoutPath', 'stderrPath', 'finalPath', 'expiresAt', 'shellCommand', 'profileDigest']) delete copy[key];
+    return JSON.stringify(copy);
+  };
+  if (binding(plan.invocation) !== binding(invocation)) return stop('BINDING_CHANGED');
+  const invocationPath = join(options.runDir, `recovery-plan-${retryId}.json`);
+  const runDir = `${options.runDir}.recovery-${retryId}`;
+  if (guardStop()) return stop(guardStop());
+  let retry;
+  try {
+    const planHandle = await withWorkerPath(invocationPath, target => open(target,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600));
+    try { await planHandle.writeFile(JSON.stringify(plan)); await planHandle.sync(); } finally { await planHandle.close(); }
+    // Publication happens before any retry launch. A record failure stops work.
+    record.state = 'applied';
+    await recordAt(options.runDir, previous.invocationId);
+    retry = await launchOneWorker(owner, { ...options, invocationPath, runDir, dispatchGuard,
+      inputs: undefined, loadInputs, retryOf: { invocationId: previous.invocationId, runDir: options.runDir },
+      correctStartup: { reasonCode: 'NOT_FOUND' }, startupCorrectionRecord: { ...record } });
+  } catch {
+    record.state = 'stopped';
+    return stop(guardStop() ?? 'RETRY_REFUSED');
+  }
+  record.retryInvocationId = retry.invocationId;
+  if (retry.attemptOutcome !== 'succeeded') { record.state = 'stopped'; record.stopCode = 'RETRY_FAILED'; }
+  retry.startupCorrection = { ...record };
+  await recordAt(options.runDir, previous.invocationId);
+  await recordAt(runDir, retry.invocationId);
+  return retry;
+}
+
 // #2915 round 8 (D6, "lazy public fields still differ after mixed use"):
 // `lastAttemptResult`/`lastAttemptInvocationId` are informational
 // bookkeeping only (#2915 step 4 — the retry gate no longer reads them;
@@ -3778,8 +4103,9 @@ export class SessionLauncher extends EventEmitter {
    * `options.correctStartup: { reasonCode, correctionsUsed }` enforces the
    * one-qualified-startup-correction budget on a conductor-declared
    * correction retry (startupCorrectionGate): unqualified causes and second
-   * corrections are refused, within the task's existing allowance. There is
-   * no automatic correction loop.
+   * corrections are refused, within the task's existing allowance. The only
+   * automatic correction refreshes a changed qualified executable binding
+   * after a launcher-observed ENOENT with confirmed stop, once per task chain.
    *
    * Both checks are gated recovery behavior, not a general launch
    * precondition: enforcement happens entirely INSIDE `launchOneWorker`,
@@ -3806,8 +4132,13 @@ export class SessionLauncher extends EventEmitter {
     // `options.retryOf`-driven and disk-verified every time) is set inside
     // `launchOneWorker` itself, gated on whether recovery actually admitted
     // this attempt (#2915 review 6, finding 6) — never here unconditionally.
-    try { return await launchOneWorker(this, options); }
+    directStartupCorrectionContext.delete(this);
+    try {
+      const result = await launchOneWorker(this, options);
+      return await correctDirectWorkerStartup(this, options, result);
+    }
     finally {
+      directStartupCorrectionContext.delete(this);
       _workerRecoverySubscriptions.get(this)?.();
       _workerRecoverySubscriptions.delete(this);
       this.workerLaunchPending = false;
@@ -5055,3 +5386,42 @@ export function planDirectWorkerLaunch({
 }
 
 export default SessionLauncher;
+
+/** The packaged session owner accepts only the parent-bound managed one-shot contract. */
+export function parseManagedWorkerLaunchArgs(args) {
+  const result = {};
+  const seen = new Set();
+  for (let index = 0; index < args.length; index++) {
+    const flag = args[index];
+    if (seen.has(flag)) throw new Error(`Duplicate managed worker option: ${flag}`);
+    seen.add(flag);
+    if (flag === '--launch-worker') continue;
+    const key = { '--invocation': 'invocationPath', '--run-dir': 'runDir',
+      '--managed-request': 'requestId', '--managed-generation': 'generation' }[flag];
+    if (!key) throw new Error(`Unsupported managed worker option: ${flag}`);
+    const value = args[++index];
+    if (!value || value.startsWith('--')) throw new Error(`${flag} requires a value`);
+    result[key] = value;
+  }
+  if (!seen.has('--launch-worker') || !result.invocationPath || !result.runDir || !result.requestId || !result.generation) {
+    throw new Error('Managed worker launch requires invocation, run directory and fenced admission');
+  }
+  const generation = Number(result.generation);
+  if (!Number.isSafeInteger(generation) || generation < 1) throw new Error('Invalid managed admission generation');
+  return { invocationPath: result.invocationPath, runDir: result.runDir,
+    managedAdmission: { requestId: result.requestId, generation } };
+}
+
+async function runManagedWorkerEntry() {
+  const result = await new SessionLauncher().launchWorker(parseManagedWorkerLaunchArgs(process.argv.slice(2)));
+  console.log(JSON.stringify(result));
+  process.exitCode = result.termination !== 'confirmed' ? 2
+    : result.errorCode || result.timedOut || result.exitCode !== 0 ? 1 : 0;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  runManagedWorkerEntry().catch(error => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+}