@arbiterforge/ca-pi 0.15.12 → 0.16.1

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -8,6 +8,9 @@ run_verification(...) -> dict
 observe_codex_hook(...) -> dict
 observe_claude_hook(...) -> dict
 publish_request(...) -> dict
+arm_context_preview(...) -> dict
+cancel_context_preview(...) -> dict
+capture_context_preview(...) -> dict
 
 The artifact engine owns every target binding.  Callers select only an activity
 and record; they cannot supply an authority kind, verdict, evidence payload, or
@@ -26,7 +29,7 @@ than one SubagentStop; only the first is a review result.
 
 from __future__ import annotations
 
-from contextlib import contextmanager
+from contextlib import ExitStack, contextmanager
 import base64
 import errno
 import hashlib
@@ -45,6 +48,8 @@ import time
 from typing import Any
 
 from _gitexec import git_executable, root_bound_git_env
+import _artifactpromptlib
+import _artifactlib
 
 
 OBSERVATION_DIR = Path(".codearbiter/.artifacts/observations")
@@ -72,6 +77,9 @@ MAX_STATE = 1 << 20
 # Only terminal abandonment can read a legacy inline-context review this large.
 MAX_RECOVERY_STATE = 2 << 20
 REQUEST_LOCK_WAIT_SECONDS = 5.0
+# The Claude join lock is per user, not per request: every SubagentStart waits
+# on it while any review is LAUNCHING, and the holder scans the registry.
+CLAUDE_JOIN_LOCK_WAIT_SECONDS = 30.0
 MAX_OUTPUT = 8 << 20
 MAX_DECISION = 65536
 MAX_COMPLETION_FILES = 16
@@ -79,6 +87,15 @@ MAX_COMPLETION_FILE_BYTES = 64 << 10
 MAX_COMPLETION_TOTAL_BYTES = 256 << 10
 REGISTRY_PARENT = Path(tempfile.gettempdir())
 HOSTS = frozenset({"codex", "claude"})
+CONTEXT_ROUTE = "context_approval"
+CONTEXT_PREVIEW_KEYS = frozenset({
+    "operation_id", "mode", "document_id", "target_path", "typed",
+    "selections", "expected_document_sha256", "expected_provenance_sha256",
+    "proposed_provenance",
+})
+CONTEXT_FINALIZE_KEYS = frozenset({
+    "operation_id", "mode", "document_id", "target_path", "expected",
+})
 CLAUDE_REVIEWER = "ca:authority-reviewer"
 # Claude Code 2.1.286 children report through this tool; their SubagentStop
 # then carries no last_assistant_message.
@@ -124,6 +141,40 @@ def _canonical(value: Any) -> bytes:
         raise AuthorityError("INVALID_AUTHORITY_STATE", "state is not finite JSON") from exc
 
 
+def _native_context_canonical(value: Any) -> bytes:
+    """Match the artifact engine's safe-integer, UTF-16-key-order JSON bytes."""
+    def ordered(item: Any, depth: int) -> Any:
+        if depth > 64:
+            raise ValueError("context exceeds native depth")
+        if isinstance(item, dict):
+            if any(type(key) is not str for key in item):
+                raise ValueError("context has a non-string key")
+            return {
+                key: ordered(item[key], depth + 1)
+                for key in sorted(item, key=lambda key: key.encode("utf-16-be"))
+            }
+        if isinstance(item, list):
+            return [ordered(value, depth + 1) for value in item]
+        if type(item) is int:
+            if abs(item) > 9007199254740991:
+                raise ValueError("context integer exceeds native range")
+            return item
+        if item is None or type(item) in (str, bool):
+            return item
+        raise ValueError("context value is outside native JSON")
+
+    try:
+        raw = json.dumps(
+            ordered(value, 0), ensure_ascii=False, allow_nan=False,
+            separators=(",", ":"),
+        ).encode("utf-8")
+        if len(raw) > 8 << 20:
+            raise ValueError("context exceeds native byte limit")
+        return raw
+    except (TypeError, ValueError, UnicodeError, RecursionError) as exc:
+        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context is outside native canonical JSON") from exc
+
+
 def _digest(data: bytes) -> str:
     return hashlib.sha256(data).hexdigest()
 
@@ -277,7 +328,7 @@ def _spool_root(root: Path) -> Path:
 
 
 @contextmanager
-def _request_lock(spool: Path, relative: Path):
+def _request_lock(spool: Path, relative: Path, wait: float | None = None):
     """Keep one OS-owned lock inode for all writers of this request."""
     path = spool / f"{relative.name}.lock"
     fd = None
@@ -307,7 +358,7 @@ def _request_lock(spool: Path, relative: Path):
     locked = False
     try:
         check_path()
-        deadline = time.monotonic() + REQUEST_LOCK_WAIT_SECONDS
+        deadline = time.monotonic() + (REQUEST_LOCK_WAIT_SECONDS if wait is None else wait)
         if os.name == "nt":
             import msvcrt
         else:
@@ -479,7 +530,7 @@ def _read_context(root: Path, context_ref: str, context_hash: str) -> dict[str,
         context = json.loads(raw.decode("utf-8"))
     except (OSError, UnicodeError, ValueError) as exc:
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes are unavailable") from exc
-    if not isinstance(context, dict) or _digest(raw) != context_hash or raw != _canonical(context):
+    if not isinstance(context, dict) or _digest(raw) != context_hash or raw != _native_context_canonical(context):
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes changed or are not canonical")
     return context
 
@@ -2097,7 +2148,7 @@ def capture_user_prompt(
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "prompt context is unavailable") from exc
     if (
         _digest(context_raw) != context_sha256
-        or context_raw != _canonical(context)
+        or context_raw != _native_context_canonical(context)
         or context.get("activity") != event["kind"]
         or context.get("subject") != subject
         or context.get("prompt_sha256") != prompt_sha256
@@ -2139,6 +2190,162 @@ def capture_user_prompt(
     }
 
 
+def _context_preview_context(root: Path, client: Any, preview: dict[str, Any], prompt: str):
+    operation = ("context-finalize-evidence-context" if preview.get("mode") == "finalize"
+                 else "context-evidence-context")
+    result = client.call(operation, {**preview, "prompt_sha256": _digest(prompt.encode("utf-8"))})
+    if not isinstance(result, dict):
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview issuer returned no context")
+    context_hash = _validate_hash(result.get("context_sha256"), "context_sha256")
+    context_ref = f".codearbiter/.artifacts/evidence-contexts/{context_hash}.json"
+    if result.get("context_ref") != context_ref:
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview locator is malformed")
+    try:
+        raw = (root / context_ref).read_bytes()
+        context = json.loads(raw.decode("utf-8"))
+    except (OSError, UnicodeError, ValueError) as exc:
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview issuer bytes are unavailable") from exc
+    binding = result.get("preview_binding_sha256")
+    _validate_hash(binding, "preview_binding_sha256")
+    subject = {"artifact_id": "CONTEXT-" + preview["document_id"].upper(),
+               "record_id": "CONTEXT-" + preview["document_id"].upper(),
+               "normative_sha256": binding}
+    if (
+        _digest(raw) != context_hash or raw != _canonical(context)
+        or context.get("activity") != CONTEXT_ROUTE
+        or context.get("preview") != preview
+        or context.get("subject") != subject
+        or context.get("record") != {"preview_binding_sha256": binding}
+        or context.get("record_sha256") != _digest(_canonical(context.get("record")))
+        or context.get("input_sha256") != binding
+        or context.get("prompt_sha256") != _digest(prompt.encode("utf-8"))
+        or result.get("subject") != subject
+        or not isinstance(context.get("preview_document"), str)
+        or not context["preview_document"]
+        or _digest(context["preview_document"].encode("utf-8")) != context.get("after_document_sha256")
+        or result.get("preview_document") != context["preview_document"]
+        or result.get("after_document_sha256") != context["after_document_sha256"]
+    ):
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "issued context does not bind the exact preview")
+    return context, context_ref, context_hash, binding
+
+
+def arm_context_preview(root: str | Path, client: Any, preview: dict[str, Any], *, token: str | None = None) -> dict[str, Any]:
+    """Arm an exact preview reply; this step does not assert approval."""
+    root = _real_root(root)
+    valid_content = (isinstance(preview, dict) and set(preview) == CONTEXT_PREVIEW_KEYS
+                     and isinstance(preview.get("mode"), str)
+                     and preview.get("mode") in {"create", "adopt", "update"}
+                     and isinstance(preview.get("document_id"), str)
+                     and preview.get("document_id") in {"CONTEXT", "tech-stack", "coding-standards", "security-controls", "code-map"})
+    valid_final = (isinstance(preview, dict) and set(preview) == CONTEXT_FINALIZE_KEYS
+                   and preview.get("mode") == "finalize" and preview.get("document_id") == "CONTEXT"
+                   and preview.get("target_path") == ".codearbiter/CONTEXT.md"
+                   and isinstance(preview.get("expected"), dict))
+    if not (valid_content or valid_final):
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview request contains unsupported or authority fields")
+    token = token or secrets.token_urlsafe(24)
+    if TOKEN_RE.fullmatch(token) is None:
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview token is invalid")
+    artifact_id = "CONTEXT-" + preview["document_id"].upper()
+    prompt = f"approve-context {artifact_id} {token}"
+    context, context_ref, context_hash, binding = _context_preview_context(root, client, preview, prompt)
+    _artifactpromptlib.register(root, CONTEXT_ROUTE, artifact_id, prompt, binding_sha256=context_hash)
+    return {"reply": prompt, "artifact_id": artifact_id, "preview_binding_sha256": binding,
+            "context_ref": context_ref, "context_sha256": context_hash,
+            "target_path": preview["target_path"], "preview_document": context["preview_document"],
+            "after_document_sha256": context["after_document_sha256"]}
+
+
+def cancel_context_preview(root: str | Path, document_id: str) -> dict[str, Any]:
+    """Retire one pending context reply without altering a document or receipt."""
+    if document_id not in {"CONTEXT", "tech-stack", "coding-standards", "security-controls", "code-map"}:
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "unknown context document")
+    artifact_id = "CONTEXT-" + document_id.upper()
+    _artifactpromptlib.unregister(_real_root(root), CONTEXT_ROUTE, artifact_id)
+    return {"artifact_id": artifact_id, "cancelled": True}
+
+
+def capture_context_preview(root: str | Path, client: Any, prompt: str, *, host: str, session_id: str) -> dict[str, Any]:
+    """Capture an exact host UserPromptSubmit reply for one armed context preview."""
+    root = _real_root(root)
+    if not isinstance(prompt, str):
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview reply is malformed")
+    parts = prompt.split(" ")
+    if (len(parts) != 3 or parts[0] != "approve-context" or ID_RE.fullmatch(parts[1]) is None
+            or TOKEN_RE.fullmatch(parts[2]) is None):
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview reply is unrelated")
+    artifact_id = parts[1]
+    routed = _artifactpromptlib.resolve(CONTEXT_ROUTE, prompt)
+    if routed != root:
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "context preview reply has no armed route")
+    context_hash = _artifactpromptlib.binding(root, CONTEXT_ROUTE, artifact_id)
+    context_ref = f".codearbiter/.artifacts/evidence-contexts/{context_hash}.json"
+    try:
+        raw = (root / context_ref).read_bytes()
+        context = json.loads(raw.decode("utf-8"))
+    except (OSError, UnicodeError, ValueError) as exc:
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "armed preview context is unavailable") from exc
+    preview = context.get("preview") if isinstance(context, dict) else None
+    if (not isinstance(preview, dict) or set(preview) not in
+            (CONTEXT_PREVIEW_KEYS, CONTEXT_FINALIZE_KEYS)):
+        raise AuthorityError("INVALID_CONTEXT_AUTHORITY", "armed preview context is malformed")
+    fresh, fresh_ref, fresh_hash, binding = _context_preview_context(root, client, preview, prompt)
+    if fresh_ref != context_ref or fresh_hash != context_hash or fresh != context or _digest(raw) != context_hash:
+        raise AuthorityError("STALE_CONTEXT_AUTHORITY", "context preview changed after it was armed")
+    producer_run_id = f"{_host_id(host, 'host')}:{_host_id(session_id, 'session_id')}"
+    producer_result = {"host": host, "session_id": session_id,
+                       "prompt_sha256": _digest(prompt.encode("utf-8"))}
+    payload = {"preview_binding_sha256": binding}
+    observation = {
+        "format": OBSERVATION_FORMAT, "kind": CONTEXT_ROUTE,
+        "subject": context["subject"], "context_ref": context_ref,
+        "context_sha256": context_hash, "payload_sha256": _digest(_canonical(payload)),
+        "producer_profile": "host-user-context-preview/0.1.0", "producer_run_id": producer_run_id,
+        "producer_result": producer_result, "producer_result_sha256": _digest(_canonical(producer_result)),
+    }
+    observation_raw = _canonical(observation)
+    observation_hash = _digest(observation_raw)
+    observation_ref = OBSERVATION_DIR / f"{observation_hash}.json"
+    _publish_immutable(root, observation_ref, observation_raw)
+    event = {
+        "format": EVENT_FORMAT, "kind": CONTEXT_ROUTE, "authority_kind": "user_workflow",
+        "subject": context["subject"], "actor": "interactive repository user",
+        "origin": f"{host}:UserPromptSubmit:{session_id}", "verdict": "approved",
+        "payload": payload, "source_text": prompt,
+        "observation_ref": observation_ref.as_posix(), "observation_sha256": observation_hash,
+    }
+    event_raw = _canonical(event)
+    event_hash = _digest(event_raw)
+    source_ref = SOURCE_DIR / f"{event_hash}.json"
+    _publish_immutable(root, source_ref, event_raw)
+    captured = client.call("capture-observation", {"source_ref": source_ref.as_posix(), "source_sha256": event_hash})
+    if not isinstance(captured, dict) or not isinstance(captured.get("receipt"), str):
+        raise AuthorityError("INVALID_RECEIPT", "context preview capture returned no receipt")
+    _artifactpromptlib.unregister(root, CONTEXT_ROUTE, artifact_id)
+    return {**captured, "preview_binding_sha256": binding,
+            "authority_source": source_ref.as_posix(), "observation_ref": observation_ref.as_posix()}
+
+
+def capture_context_preview_from_hook(*, root: str | Path, plugin_root: str | Path,
+                                      prompt: str, host: str, session_id: str) -> str:
+    """Route only an armed exact context reply from the host prompt seam."""
+    if not isinstance(prompt, str) or not prompt.startswith("approve-context "):
+        return ""
+    try:
+        routed = _artifactpromptlib.resolve(CONTEXT_ROUTE, prompt)
+        if routed is None:
+            return ""
+        client = _artifactlib.ArtifactClient(
+            routed, Path(plugin_root) / "helpers" / "artifacts"
+        )
+        result = capture_context_preview(routed, client, prompt, host=host, session_id=session_id)
+    except (AuthorityError, _artifactpromptlib.PromptRouteError, OSError, RuntimeError) as exc:
+        return f"codeArbiter: context preview approval capture failed: {exc}"
+    return ("codeArbiter: context preview approval recorded for "
+            f"{result['preview_binding_sha256']} (receipt {result['receipt']}).")
+
+
 def run_verification(
     root: str | Path,
     client: Any,
@@ -3012,6 +3219,91 @@ def _claude_bind_child(root: Path, request: dict[str, Any]) -> dict[str, Any]:
     return {"request_id": request["request_id"], "state": "RUNNING"}
 
 
+@contextmanager
+def _claude_join_lock():
+    """Serialize the Claude launch/child join across hook processes.
+
+    SubagentStart and an async Agent launch result fire back to back as
+    separate hook processes. Each reads the request and then writes its half
+    of the join; unserialized, either can read before the other writes and
+    both miss, leaving the review LAUNCHING with no start marker."""
+    with ExitStack() as stack:
+        try:
+            stack.enter_context(
+                _request_lock(_registry_root(), Path("claude-join"), wait=CLAUDE_JOIN_LOCK_WAIT_SECONDS)
+            )
+        except OSError as exc:
+            # Only acquisition maps here; the joined body reports its own errors.
+            raise AuthorityError("AUTHORITY_BUSY", "Claude review join is unavailable") from exc
+        yield
+
+
+def _claude_launch_result(event: dict[str, Any]) -> dict[str, Any] | None:
+    session_id = event.get("session_id")
+    tool_use_id = event.get("tool_use_id")
+    matches = [
+        (candidate_root, candidate)
+        for candidate_root, candidate in _claude_requests({"LAUNCHING"})
+        if (candidate.get("launch") or {}).get("tool_use_id") == tool_use_id
+        and candidate["launch"].get("parent_session_id") == session_id
+    ]
+    if not matches:
+        return None
+    if len(matches) != 1:
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch correlation is ambiguous")
+    root, request = matches[0]
+    response = event.get("tool_response")
+    try:
+        prompt_id = _host_id(event.get("prompt_id"), "prompt_id")
+        if request["launch"].get("parent_prompt_id") != prompt_id or request["launch"]["post_confirmed"]:
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch result is out of order")
+        if not isinstance(response, dict):
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "agent result is malformed")
+        agent_id = _host_id(response.get("agentId"), "agentId")
+        resolved = _model_id(response.get("resolvedModel"), "resolvedModel")
+    except AuthorityError:
+        _reject(root, request, "uncorrelated-launch-result")
+        raise
+    request["launch"].update(post_confirmed=True, agent_id=agent_id, resolved_model=resolved)
+    return _claude_bind_child(root, request)
+
+
+def _claude_subagent_start(event: dict[str, Any]) -> dict[str, Any] | None:
+    agent_id = _host_id(event.get("agent_id"), "agent_id")
+    agent_type = _host_id(event.get("agent_type"), "agent_type")
+    pending = _claude_requests({"LAUNCHING"})
+    for candidate_root, candidate in pending:
+        launch = candidate.get("launch") or {}
+        if launch.get("agent_id") == agent_id:
+            if agent_type != CLAUDE_REVIEWER:
+                _reject(candidate_root, candidate, "unpinned-reviewer-agent")
+                raise AuthorityError("UNSUPPORTED_HOST_SEAM", "subagent is not the pinned reviewer")
+            launch["agent_type"] = agent_type
+            candidate["state"] = "RUNNING"
+            _save(candidate_root, candidate)
+            return {"request_id": candidate["request_id"], "state": "RUNNING"}
+    if any((candidate.get("launch") or {}).get("post_confirmed") is False for _root, candidate in pending):
+        # The launch result may not have arrived yet; remember this start.
+        marker = _claude_start_marker(agent_id)
+        data = _canonical({"agent_id": agent_id, "agent_type": agent_type})
+        # Written aside and linked into place: a reader must never see an
+        # empty or partial marker.
+        temporary = marker.with_name(f".{marker.name}.{secrets.token_hex(8)}.tmp")
+        fd = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        try:
+            os.write(fd, data)
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        try:
+            os.link(temporary, marker)
+        except FileExistsError:
+            return None
+        finally:
+            temporary.unlink(missing_ok=True)
+    return None
+
+
 def observe_claude_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any] | None:
     """Correlate a Claude Code reviewer launch, child lifecycle, and first result.
 
@@ -3071,77 +3363,14 @@ def observe_claude_hook(root: str | Path, event: dict[str, Any]) -> dict[str, An
         return {"request_id": request["request_id"], "state": "LAUNCHING"}
 
     if name == "PostToolUse" and tool == "Agent":
-        session_id = event.get("session_id")
-        tool_use_id = event.get("tool_use_id")
-        matches = [
-            (candidate_root, candidate)
-            for candidate_root, candidate in _claude_requests({"LAUNCHING"})
-            if (candidate.get("launch") or {}).get("tool_use_id") == tool_use_id
-            and candidate["launch"].get("parent_session_id") == session_id
-        ]
-        if not matches:
-            return None
-        if len(matches) != 1:
-            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch correlation is ambiguous")
-        root, request = matches[0]
-        response = event.get("tool_response")
-        try:
-            prompt_id = _host_id(event.get("prompt_id"), "prompt_id")
-            if request["launch"].get("parent_prompt_id") != prompt_id or request["launch"]["post_confirmed"]:
-                raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch result is out of order")
-            if not isinstance(response, dict):
-                raise AuthorityError("UNSUPPORTED_HOST_SEAM", "agent result is malformed")
-            agent_id = _host_id(response.get("agentId"), "agentId")
-            resolved = _model_id(response.get("resolvedModel"), "resolvedModel")
-        except AuthorityError:
-            _reject(root, request, "uncorrelated-launch-result")
-            raise
-        request["launch"].update(post_confirmed=True, agent_id=agent_id, resolved_model=resolved)
-        return _claude_bind_child(root, request)
+        with _claude_join_lock():
+            return _claude_launch_result(event)
 
     if name == "SubagentStart":
         if not _claude_requests({"LAUNCHING"}):
             return None
-        agent_id = _host_id(event.get("agent_id"), "agent_id")
-        agent_type = _host_id(event.get("agent_type"), "agent_type")
-        for candidate_root, candidate in _claude_requests({"LAUNCHING"}):
-            launch = candidate.get("launch") or {}
-            if launch.get("agent_id") == agent_id:
-                if agent_type != CLAUDE_REVIEWER:
-                    _reject(candidate_root, candidate, "unpinned-reviewer-agent")
-                    raise AuthorityError("UNSUPPORTED_HOST_SEAM", "subagent is not the pinned reviewer")
-                launch["agent_type"] = agent_type
-                candidate["state"] = "RUNNING"
-                _save(candidate_root, candidate)
-                return {"request_id": candidate["request_id"], "state": "RUNNING"}
-        if any(
-            (candidate.get("launch") or {}).get("post_confirmed") is False
-            for _root, candidate in _claude_requests({"LAUNCHING"})
-        ):
-            # The launch result may not have arrived yet; remember this start.
-            marker = _claude_start_marker(agent_id)
-            data = _canonical({"agent_id": agent_id, "agent_type": agent_type})
-            # Written aside and linked into place: a concurrent launch result
-            # joining this agent must never read an empty or partial marker.
-            temporary = marker.with_name(f".{marker.name}.{secrets.token_hex(8)}.tmp")
-            fd = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
-            try:
-                os.write(fd, data)
-                os.fsync(fd)
-            finally:
-                os.close(fd)
-            try:
-                os.link(temporary, marker)
-            except FileExistsError:
-                return None
-            finally:
-                temporary.unlink(missing_ok=True)
-            # The launch result may have bound this agent while the marker was
-            # being written; finish the join now rather than strand it.
-            for candidate_root, candidate in _claude_requests({"LAUNCHING"}):
-                if (candidate.get("launch") or {}).get("agent_id") == agent_id:
-                    return _claude_bind_child(candidate_root, candidate)
-        return None
+        with _claude_join_lock():
+            return _claude_subagent_start(event)
 
     if name == "PostToolUse" and tool == CLAUDE_HANDBACK_TOOL:
         # Every child's handback lands here; only the bound reviewer's counts.
@@ -3172,8 +3401,12 @@ def observe_claude_hook(root: str | Path, event: dict[str, Any]) -> dict[str, An
             _reject(root, request, "repeated-handback")
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "reviewer reported more than once")
         if request["state"] == "LAUNCHING" and request["launch"].get("post_confirmed") is True:
-            # A start marker written late in the launch/start race.
-            _claude_bind_child(root, request)
+            # Defensive: the join lock leaves no late-marker race in this
+            # adapter, but bind any marker still waiting under the same lock.
+            with _claude_join_lock():
+                current = _load(root, request["request_id"])
+                if current["state"] == "LAUNCHING":
+                    _claude_bind_child(root, current)
             request = _load(root, request["request_id"])
         candidate = {**request, "handback": record}
         if (
@@ -3210,8 +3443,12 @@ def observe_claude_hook(root: str | Path, event: dict[str, Any]) -> dict[str, An
         root, request = matches[0]
         launch = request["launch"]
         if request["state"] == "LAUNCHING" and launch.get("post_confirmed") is True:
-            # A start marker written late in the launch/start race.
-            _claude_bind_child(root, request)
+            # Defensive: the join lock leaves no late-marker race in this
+            # adapter, but bind any marker still waiting under the same lock.
+            with _claude_join_lock():
+                current = _load(root, request["request_id"])
+                if current["state"] == "LAUNCHING":
+                    _claude_bind_child(root, current)
             request = _load(root, request["request_id"])
             launch = request["launch"]
         try: