@kontextmind/kxm 0.7.47 → 0.7.49

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.47",
+      "version": "0.7.49",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -41,6 +41,18 @@ All notable user-facing changes are documented here. The project follows [Semant
 - **`kxm hub start` no longer generates and persists an admin token when it is
   about to refuse** because another hub already owns the claim. A refused start
   used to leave behind credentials the running hub never issued.
+- **Runtime intake contract fixes (released in 0.7.46, found in review):**
+  a lost intake insert race accepted different content under an already-used
+  idempotency key; resume drained only one page, so held intent beyond 500
+  messages was stranded; pause, ingress and admission were not atomic, which could
+  strand a message as `held_paused` in an unpaused project; a coordinator rebind
+  could widen a tool ceiling by lifting a denial, changing the preset, or dropping
+  the tool policy; relabelling a stored message's classification on a duplicate is
+  now refused; coordinators now record the real loaded configuration revision
+  instead of a hash of project path and runtime id; dispatch order is Runtime
+  arrival order, so a backdated timestamp cannot jump the queue; persisted records
+  are cross-checked against every duplicated column on read; and the intake schema
+  no longer admits contradictory states.
 
 ## 0.7.0 - 2026-09-11
 

package/docs/assignment-runner.md

@@ -57,6 +57,16 @@ and models are admitted with strict permission and vendor boundaries:
 
 ## 2. The developer loop
 
+> **Environment.** These recipes do **not** auto-load a `.env` from the working
+> directory, and neither the source text nor `just --dump` is allowed to enable it. An
+> untracked, gitignored file must not be able to set `NODE_OPTIONS`
+> and execute code before the runner validates anything — `just --dotenv-path /abs/.env assign …` is the explicit
+> opt-in (`--dotenv-path` both selects and locates the file in `just` 1.58). Arguments are passed
+> positionally and quoted, so a path is never re-read as shell source; the runner's
+> absolute-path requirement is a separate validation rule, not what makes quoting
+> safe. `accept` prints JSON by default but takes no `--json` flag, and its optional
+> `--observed-pr` / `--observed-ci` need the direct script form shown in Step 5.
+
 The standard progression follows a slim four-step lifecycle:
 
 ```text

package/docs/test-matrix.md

@@ -85,7 +85,7 @@ exercised from `node_modules`.
 | Quorum parser boundaries and definition identity | `plugins/kxm/src/workflow.ts`, `test/core/workflow-quorum.test.ts`, `test/core/workflow-definition-hash.test.ts` | Rejects impossible peer pools, verifies degradation bounds, and proves secret-free semantic hash stamping plus credential-rotation invariance |
 | Artifact existence and containment gate | `plugins/kxm/src/artifacts-exist.ts`, `test/core/artifacts-exist.test.ts` | Non-empty regular files pass; missing, empty, non-file, lexical escape, and real-path escape cases fail closed (host-permitted symlink coverage) |
 | Harness inventory probe | `plugins/kxm/src/harness.ts`, `test/core/harness.test.ts` | Detect/auth/dispatch for the builtin catalog; win32 `.exe` / inner npm-package `.exe` / `.cmd` candidate order for npm shims (issue #168); `windows_shim` issue only when the shim answered; allowlisted `name.cmd` shell spawn only; rejected metacharacter commands; Linux still `not_detected` when the bare command is missing. |
-| Headless harness helper | `scripts/harness-run.mjs`, `justfile`, `test/core/harness-run.test.ts` | Offline auth success/logout/garbage, role/mode/pair/provider refusals before spawn, missing brief/schema fail closed with zero spawn, invocation-cwd relative `prompt_file`/`output_schema` vs `request.cwd` (absolute argv tokens; Claude/Codex stdin matches the brief), Pi JSONL multi-`message_end` sums, Claude auxiliary usage, native error-on-exit-0, timeout/empty payload, sidecar-only stderr/answer/error, shell:false argv metacharacters, win32 `.cmd` rejection, and win32 npm inner `claude.exe` / Pi `node.exe`+`cli.js` unwrap. Result v2 transport vs closed model claims, dispatch-before-spawn, grok/codex isolation flags, `max_turns` validation, obsolete v1 diagnosis without rewrite or unknown-schema echo, partial usage on fail/interrupt, signaled null `exitCode` plus exact `signal`, exit-before-stdio-close drain vs bounded linger, type-closed usage/cost (no object leak or zero-coercion), malformed optional text as run-stage failure with retained spend, stdin/pid-record write failures not completed, bounded timeout settle without descendant-death claims, spawn/write-failure stage and spend, and capability-fixture parser evidence (Codex `--ignore-user-config` is not invented in top-level help; captured help bytes are not rescrubbed). Recipe quoting is covered from the justfile body without a just binary (POSIX `sh` + positional argv; Windows uses the recipe's `node -e` / argv shape). Real just integration is optional and skipped when the binary is absent. No live paid smoke. |
+| Headless harness helper | `scripts/harness-run.mjs`, `justfile`, `test/core/harness-run.test.ts` | Offline auth success/logout/garbage, role/mode/pair/provider refusals before spawn, missing brief/schema fail closed with zero spawn, invocation-cwd relative `prompt_file`/`output_schema` vs `request.cwd` (absolute argv tokens; Claude/Codex stdin matches the brief), Pi JSONL multi-`message_end` sums, Claude auxiliary usage, native error-on-exit-0, timeout/empty payload, sidecar-only stderr/answer/error, shell:false argv metacharacters, win32 `.cmd` rejection, and win32 npm inner `claude.exe` / Pi `node.exe`+`cli.js` unwrap. Result v2 transport vs closed model claims, dispatch-before-spawn, grok/codex isolation flags, `max_turns` validation, obsolete v1 diagnosis without rewrite or unknown-schema echo, partial usage on fail/interrupt, signaled null `exitCode` plus exact `signal`, exit-before-stdio-close drain vs bounded linger, type-closed usage/cost (no object leak or zero-coercion), malformed optional text as run-stage failure with retained spend, stdin/pid-record write failures not completed, bounded timeout settle without descendant-death claims, spawn/write-failure stage and spend, and capability-fixture parser evidence (Codex `--ignore-user-config` is not invented in top-level help; captured help bytes are not rescrubbed). Recipe quoting is covered from the justfile body without a just binary (POSIX `sh` + positional argv; Windows uses the recipe's `node -e` / argv shape). The developer entry points are gated three ways: docs-to-recipe parity (a documented `just` verb in command form, across inline code or a fenced line with an optional `#`, tolerant of stray whitespace, pipe-separated alternations, leading interpreter options and `~~~` fences, reading a shell pipe as one command rather than an alternation, skipping a glob family like `review-*` instead of demanding a recipe, and *not* parsing prose, headings or captured listing output); per-recipe boundaries (**the load-bearing gate parses nothing**: every line that mentions `assignment-run.mjs` must be one of the seven pinned proof bodies and there must be exactly seven, so a header form no parser recognises still cannot hide a call site; column-0 comments are documentation and excluded), plus a normalized-text pass (`\`-continuations folded, comments stripped) and a second pass over `just --dump`, the interpreter's own rendering, skipped with a visible reason without the binary; the recipe name set must equal a pinned list, duplicate headers and duplicate `run :=` bindings are refused, `set allow-duplicate*`, `import`/`mod` in any spelling and `alias` are refused, `run :=` and `dispatch` are asserted exactly, and non-proof bodies are token-checked against raw text because comment-stripping first hid an executable suffix that `--dump` reproduced verbatim. Stated limit: drift protection, not a sandbox — a body can assemble its command at runtime, and anyone who can edit the file can already do what it does. Auto-loading a working-directory dotenv file is refused by a brake on any `set dotenv*` spelling, plus a real-`just` probe whose preload module writes a marker file itself — so the assertion is that injected code executed — paired with controls on the same entry point: explicit `--dotenv-path`, a justfile with the setting re-added, and a real `witness` recipe run both ways. Real just integration is optional and skipped when the binary is absent. No live paid smoke. |
 | Long-lived headless coordinator | `scripts/kxm-worker.mjs` | Restart limits, spawn failure, collision-resistant ownership, exact resource and tool loading, raw-output isolation, bounded RPC framing, bounded drain, hung-tool recovery, provider/model fallback, and `--continue` fallback are automated; the opt-in real-Pi gate verifies two workers, discovery, request/reply, fanout, durable restart/resume, journal, and checkpoint |
 | GitHub check signal adapter | `plugins/kxm/src/github-watch.ts` | Deterministic pagination, conclusion, retry, and per-wait delivery-generation states in `test/core/github-watch.test.ts` |
 | Operator CLI | `scripts/kxm.mjs` | Isolated workspace commands in `test/core/cli.test.ts`; the packed artifact is installed locally and with the documented global `--omit=peer` path by `test/core/package-install.test.ts` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.47",
+  "version": "0.7.49",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.47",
+  "version": "0.7.49",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.47";
+var VERSION = "0.7.49";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime-supervisor.js

@@ -18558,14 +18558,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, oldest first (stable, replay-safe order). */
+  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
     const rows = this.database.prepare(`
       SELECT * FROM intake_messages
       WHERE project_id = ? AND dispatch_state IN (${placeholders})
-      ORDER BY received_at ASC, message_id ASC
+      ORDER BY rowid ASC
       LIMIT ?
     `).all(projectId, ...states, limit);
     return rows.map(intakeFromRow);
@@ -18839,8 +18839,11 @@ var KxmRunEventStore = class {
 };
 function coordinatorFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.coordinator.v1") {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, `unexpected coordinator schema ${row.schema}`);
+  }
   validateCoordinator(parsed, row.coordinator_id);
-  if (parsed.coordinatorId !== row.coordinator_id || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
+  if (parsed.coordinatorId !== row.coordinator_id || parsed.projectId !== row.project_id || parsed.role !== row.role || parsed.channel !== row.channel || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
     throw runtimeError("coordinator_record_divergent", row.coordinator_id, "coordinator columns do not match the persisted record");
   }
   return {
@@ -18856,8 +18859,11 @@ function coordinatorFromRow(row) {
 }
 function intakeFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.intake-message.v1") {
+    throw runtimeError("intake_record_divergent", row.message_id, `unexpected intake schema ${row.schema}`);
+  }
   validateIntakeMessage(parsed, row.message_id);
-  if (parsed.messageId !== row.message_id || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
+  if (parsed.messageId !== row.message_id || parsed.projectId !== row.project_id || parsed.coordinatorId !== row.coordinator_id || parsed.idempotencyKey !== row.idempotency_key || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
     throw runtimeError("intake_record_divergent", row.message_id, "intake columns do not match the persisted record");
   }
   return {
@@ -22191,6 +22197,7 @@ function openKxmRuntimeContext(projectRoot, options) {
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
       eventStore,
+      configRevision: bundle.configRevision,
       ...options.budgetClock ? { budgetClock: options.budgetClock } : {}
     };
   } catch (error) {

package/plugins/kxm/dist/runtime.js

@@ -18998,14 +18998,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, oldest first (stable, replay-safe order). */
+  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
     const rows = this.database.prepare(`
       SELECT * FROM intake_messages
       WHERE project_id = ? AND dispatch_state IN (${placeholders})
-      ORDER BY received_at ASC, message_id ASC
+      ORDER BY rowid ASC
       LIMIT ?
     `).all(projectId, ...states, limit);
     return rows.map(intakeFromRow);
@@ -19279,8 +19279,11 @@ var KxmRunEventStore = class {
 };
 function coordinatorFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.coordinator.v1") {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, `unexpected coordinator schema ${row.schema}`);
+  }
   validateCoordinator(parsed, row.coordinator_id);
-  if (parsed.coordinatorId !== row.coordinator_id || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
+  if (parsed.coordinatorId !== row.coordinator_id || parsed.projectId !== row.project_id || parsed.role !== row.role || parsed.channel !== row.channel || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
     throw runtimeError("coordinator_record_divergent", row.coordinator_id, "coordinator columns do not match the persisted record");
   }
   return {
@@ -19296,8 +19299,11 @@ function coordinatorFromRow(row) {
 }
 function intakeFromRow(row) {
   const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.intake-message.v1") {
+    throw runtimeError("intake_record_divergent", row.message_id, `unexpected intake schema ${row.schema}`);
+  }
   validateIntakeMessage(parsed, row.message_id);
-  if (parsed.messageId !== row.message_id || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
+  if (parsed.messageId !== row.message_id || parsed.projectId !== row.project_id || parsed.coordinatorId !== row.coordinator_id || parsed.idempotencyKey !== row.idempotency_key || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
     throw runtimeError("intake_record_divergent", row.message_id, "intake columns do not match the persisted record");
   }
   return {
@@ -22634,6 +22640,7 @@ function openKxmRuntimeContext(projectRoot, options) {
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
       eventStore,
+      configRevision: bundle.configRevision,
       ...options.budgetClock ? { budgetClock: options.budgetClock } : {}
     };
   } catch (error) {

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.47",
+  "version": "0.7.49",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/intake.ts

@@ -169,6 +169,13 @@ export function bindKxmCoordinator(
       record: kxmCanonicalJson(record as unknown as JsonValue),
     });
     if (!replaced) {
+      // Another process got the same policy through. Return its identity when it
+      // reached the ceiling we asked for; anything else is a real conflict.
+      const winner = context.eventStore.coordinatorInSlot(context.projectId, role, channel);
+      const record2 = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
+      if (record2 && record2.ceilingHash === ceilingHash) {
+        return { coordinator: record2, created: false };
+      }
       throw runtimeError("coordinator_write_lost", existing.coordinatorId, "the coordinator slot changed underneath this rebind");
     }
     return { coordinator: record, created: true };
@@ -186,11 +193,10 @@ export function bindKxmCoordinator(
     authority,
     boundAt: now,
     boundBy: actor,
-    configRevision: contextConfigRevision(context),
+    configRevision: context.configRevision,
     ceilingHash,
   };
-  persistCoordinator(context, record);
-  return { coordinator: record, created: true };
+  return { ...persistCoordinator(context, record), created: true };
 }
 
 /** Resolve a coordinator by id; unknown identity fails closed. */
@@ -239,65 +245,92 @@ export function acceptKxmIntakeMessage(
   const bytes = Buffer.byteLength(input.content, "utf8");
   const contentHash = `sha256:${createHash("sha256").update(input.content, "utf8").digest("hex")}`;
 
-  const existingRow = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
-  if (existingRow) {
-    const existing = JSON.parse(existingRow.record) as KxmIntakeMessage;
-    if (existing.contentHash !== contentHash) {
+  // One transaction covers the slot probe, the pause read and the write, so a
+  // concurrent resume cannot strand this row in an unpaused project and a racing
+  // writer with different content cannot be mistaken for a duplicate.
+  return context.eventStore.transaction(() => {
+    const existingRow = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
+    if (existingRow) {
+      return { message: requireSamePayload(existingRow, contentHash, classification, key), duplicate: true };
+    }
+
+    if (bytes > MAX_INTAKE_CONTENT_BYTES) {
       throw runtimeError(
-        "intake_payload_conflict",
-        existing.messageId,
-        `idempotency key ${key} was already used with different content`,
+        "intake_content_too_large",
+        coordinator.coordinatorId,
+        `intake content is ${bytes} bytes; the limit is ${MAX_INTAKE_CONTENT_BYTES}`,
       );
     }
-    return { message: existing, duplicate: true };
-  }
 
-  if (bytes > MAX_INTAKE_CONTENT_BYTES) {
+    // Only secrets are withheld, and that guarantee is about *this layer's* storage
+    // decision: classification is supplied by the caller, so an untrusted adapter
+    // can still label a credential "project" and have it persisted here. Widening
+    // this to detection is a separate, reviewed slice.
+    const persistContent = classification !== "secret";
+    const paused = isKxmProjectPaused(context);
+    const message: KxmIntakeMessage = {
+      schema: "kxm.intake-message.v1",
+      messageId: newId("msg"),
+      projectId: context.projectId,
+      coordinatorId: coordinator.coordinatorId,
+      receivedAt: now,
+      source: { kind: sourceKind, id: sourceId },
+      idempotencyKey: key,
+      contentHash,
+      ...(persistContent ? { content: input.content } : { contentOmittedReason: "secret-classified" as const }),
+      classification,
+      dispatch: paused
+        ? { state: "held_paused", reason: "project_paused", updatedAt: now }
+        : { state: "ready" },
+    };
+    validateIntakeMessage(message, message.messageId);
+
+    const inserted = context.eventStore.insertIntakeMessageIfAbsent({
+      messageId: message.messageId,
+      projectId: message.projectId,
+      coordinatorId: message.coordinatorId,
+      idempotencyKey: message.idempotencyKey,
+      contentHash: message.contentHash,
+      receivedAt: message.receivedAt,
+      dispatchState: message.dispatch.state,
+      record: kxmCanonicalJson(message as unknown as JsonValue),
+    });
+    if (!inserted) {
+      // Lost the race for the slot. The winner is only a duplicate if it carried
+      // the same content; anything else is the same conflict we refuse serially.
+      const winner = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
+      if (!winner) throw runtimeError("intake_write_lost", coordinator.coordinatorId, "intake write lost its slot and left no record");
+      return { message: requireSamePayload(winner, contentHash, classification, key), duplicate: true };
+    }
+    return { message, duplicate: false };
+  });
+}
+
+function requireSamePayload(
+  row: { record: string },
+  contentHash: string,
+  classification: KxmIntakeClassification,
+  key: string,
+): KxmIntakeMessage {
+  const message = JSON.parse(row.record) as KxmIntakeMessage;
+  if (message.contentHash !== contentHash) {
     throw runtimeError(
-      "intake_content_too_large",
-      coordinator.coordinatorId,
-      `intake content is ${bytes} bytes; the limit is ${MAX_INTAKE_CONTENT_BYTES}`,
+      "intake_payload_conflict",
+      message.messageId,
+      `idempotency key ${key} was already used with different content`,
     );
   }
-
-  // Only secrets are withheld. Everything else is the project's own bounded,
-  // owner-only store; omitting project content would just lose the work.
-  const persistContent = classification !== "secret";
-  const paused = isKxmProjectPaused(context);
-  const message: KxmIntakeMessage = {
-    schema: "kxm.intake-message.v1",
-    messageId: newId("msg"),
-    projectId: context.projectId,
-    coordinatorId: coordinator.coordinatorId,
-    receivedAt: now,
-    source: { kind: sourceKind, id: sourceId },
-    idempotencyKey: key,
-    contentHash,
-    ...(persistContent ? { content: input.content } : { contentOmittedReason: "secret-classified" as const }),
-    classification,
-    dispatch: paused
-      ? { state: "held_paused", reason: "project_paused", updatedAt: now }
-      : { state: "ready" },
-  };
-  validateIntakeMessage(message, message.messageId);
-
-  const inserted = context.eventStore.insertIntakeMessageIfAbsent({
-    messageId: message.messageId,
-    projectId: message.projectId,
-    coordinatorId: message.coordinatorId,
-    idempotencyKey: message.idempotencyKey,
-    contentHash: message.contentHash,
-    receivedAt: message.receivedAt,
-    dispatchState: message.dispatch.state,
-    record: kxmCanonicalJson(message as unknown as JsonValue),
-  });
-  if (!inserted) {
-    // Lost the race against an identical key: report the winner as the duplicate.
-    const winner = context.eventStore.intakeBySlot(context.projectId, coordinator.coordinatorId, key);
-    if (!winner) throw runtimeError("intake_write_lost", coordinator.coordinatorId, "intake write lost its slot and left no record");
-    return { message: JSON.parse(winner.record) as KxmIntakeMessage, duplicate: true };
+  // Re-labelling the same payload is not a no-op: a retry marked `secret` must not
+  // quietly hand back a stored plaintext record, and a retry marked `project` must
+  // not launder a row that was withheld.
+  if (message.classification !== classification) {
+    throw runtimeError(
+      "intake_classification_conflict",
+      message.messageId,
+      `idempotency key ${key} was already recorded as ${message.classification}, not ${classification}`,
+    );
   }
-  return { message, duplicate: false };
+  return message;
 }
 
 /** Pending intake that may be dispatched, oldest first. Empty while paused. */
@@ -322,29 +355,33 @@ export function admitKxmIntakeRun(
   const runId = requireText(input.runId, "runId", 144);
   if (!COORDINATOR_ID_RE.test(runId)) throw runtimeError("intake_run_id_invalid", id, "runId is not a well-formed opaque id");
   const now = requireTimestamp(input.now ?? new Date().toISOString(), "now");
-  if (isKxmProjectPaused(context)) {
-    throw runtimeError("intake_paused", id, "the project is paused; no fresh dispatch may be admitted");
-  }
-  const row = context.eventStore.intakeMessage(id);
-  if (!row) throw runtimeError("intake_message_unknown", id, "no such intake message in this project");
-  const message = JSON.parse(row.record) as KxmIntakeMessage;
-  if (message.dispatch.state === "admitted") {
-    if (message.dispatch.runId === runId) return message;
-    throw runtimeError("intake_second_admission", id, `message already admitted as ${message.dispatch.runId}`);
-  }
-  if (message.dispatch.state !== "ready") {
-    throw runtimeError("intake_not_dispatchable", id, `intake state ${message.dispatch.state} cannot be admitted`);
-  }
-  const next: KxmIntakeMessage = { ...message, dispatch: { state: "admitted", runId, updatedAt: now } };
-  validateIntakeMessage(next, next.messageId);
-  const updated = context.eventStore.updateIntakeDispatch(id, "ready", { state: "admitted", record: kxmCanonicalJson(next as unknown as JsonValue) });
-  if (!updated) {
-    const racer = context.eventStore.intakeMessage(id);
-    const current = racer ? (JSON.parse(racer.record) as KxmIntakeMessage) : undefined;
-    if (current?.dispatch.state === "admitted" && current.dispatch.runId === runId) return current;
-    throw runtimeError("intake_dispatch_race", id, "the intake record changed underneath this admission");
-  }
-  return next;
+  // The pause read, the state read and the guarded transition commit together, so
+  // a pause cannot slip in between "not paused" and "admitted".
+  return context.eventStore.transaction(() => {
+    if (isKxmProjectPaused(context)) {
+      throw runtimeError("intake_paused", id, "the project is paused; no fresh dispatch may be admitted");
+    }
+    const row = context.eventStore.intakeMessage(id);
+    if (!row) throw runtimeError("intake_message_unknown", id, "no such intake message in this project");
+    const message = JSON.parse(row.record) as KxmIntakeMessage;
+    if (message.dispatch.state === "admitted") {
+      if (message.dispatch.runId === runId) return message;
+      throw runtimeError("intake_second_admission", id, `message already admitted as ${message.dispatch.runId}`);
+    }
+    if (message.dispatch.state !== "ready") {
+      throw runtimeError("intake_not_dispatchable", id, `intake state ${message.dispatch.state} cannot be admitted`);
+    }
+    const next: KxmIntakeMessage = { ...message, dispatch: { state: "admitted", runId, updatedAt: now } };
+    validateIntakeMessage(next, next.messageId);
+    const updated = context.eventStore.updateIntakeDispatch(id, "ready", { state: "admitted", record: kxmCanonicalJson(next as unknown as JsonValue) });
+    if (!updated) {
+      const racer = context.eventStore.intakeMessage(id);
+      const current = racer ? (JSON.parse(racer.record) as KxmIntakeMessage) : undefined;
+      if (current?.dispatch.state === "admitted" && current.dispatch.runId === runId) return current;
+      throw runtimeError("intake_dispatch_race", id, "the intake record changed underneath this admission");
+    }
+    return next;
+  });
 }
 
 /**
@@ -378,9 +415,13 @@ export function setKxmProjectPause(
     actor: record.actor,
     record: kxmCanonicalJson(record as unknown as JsonValue),
   };
-  context.eventStore.putProjectControl(control);
-  const released = input.paused ? [] : releaseHeldIntake(context, now);
-  return { control, released };
+  // Control write and the held-intent release are one transaction: a crash leaves
+  // either a paused project with held rows, or a resumed project with none.
+  return context.eventStore.transaction(() => {
+    context.eventStore.putProjectControl(control);
+    const released = input.paused ? [] : releaseHeldIntake(context, now);
+    return { control, released };
+  });
 }
 
 /** Whether fresh dispatch is currently blocked for this project. */
@@ -389,20 +430,27 @@ export function isKxmProjectPaused(context: KxmRuntimeContext): boolean {
 }
 
 function releaseHeldIntake(context: KxmRuntimeContext, now: string): KxmIntakeMessage[] {
-  const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 500);
   const released: KxmIntakeMessage[] = [];
-  for (const row of held) {
-    const message = JSON.parse(row.record) as KxmIntakeMessage;
-    const next: KxmIntakeMessage = { ...message, dispatch: { state: "ready", updatedAt: now } };
-    validateIntakeMessage(next, next.messageId);
-    if (context.eventStore.updateIntakeDispatch(row.messageId, "held_paused", { state: "ready", record: kxmCanonicalJson(next as unknown as JsonValue) })) {
-      released.push(next);
+  // Drain every held row. A paging loop, not a single capped page: stranding the
+  // 501st message behind a "resume releases held intent" claim is a lie of omission.
+  for (let page = 0; page < 1000; page += 1) {
+    const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 500);
+    if (held.length === 0) break;
+    for (const row of held) {
+      const message = JSON.parse(row.record) as KxmIntakeMessage;
+      const next: KxmIntakeMessage = { ...message, dispatch: { state: "ready", updatedAt: now } };
+      validateIntakeMessage(next, next.messageId);
+      if (context.eventStore.updateIntakeDispatch(row.messageId, "held_paused", { state: "ready", record: kxmCanonicalJson(next as unknown as JsonValue) })) {
+        released.push(next);
+      }
     }
+    const stillHeld = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 1).length;
+    if (stillHeld === 0) break;
   }
   return released;
 }
 
-function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): void {
+function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): { coordinator: KxmCoordinatorRecord } {
   validateCoordinator(record, record.coordinatorId);
   const inserted = context.eventStore.insertCoordinatorIfAbsent({
     coordinatorId: record.coordinatorId,
@@ -414,9 +462,14 @@ function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRe
     boundAt: record.boundAt,
     record: kxmCanonicalJson(record as unknown as JsonValue),
   });
-  if (!inserted) {
-    throw runtimeError("coordinator_write_lost", record.coordinatorId, "the coordinator slot was claimed underneath this bind");
-  }
+  if (inserted) return { coordinator: record };
+  // Lost the race for an empty slot: binding is create-once, so the winner is the
+  // answer whenever it reached the same ceiling. Only a different ceiling is a
+  // conflict worth reporting.
+  const winner = context.eventStore.coordinatorInSlot(record.projectId, record.role, record.channel);
+  const won = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
+  if (won && won.ceilingHash === record.ceilingHash) return { coordinator: won };
+  throw runtimeError("coordinator_write_lost", record.coordinatorId, "the coordinator slot was claimed by a different ceiling");
 }
 
 function assertCeilingNotWidened(
@@ -432,10 +485,28 @@ function assertCeilingNotWidened(
   if (added.length > 0) {
     throw runtimeError("coordinator_rebind_widens_effects", coordinatorId, `a rebind may not add effects: ${added.join(", ")}`);
   }
-  const allowedBefore = new Set(previous.tools?.allow ?? []);
-  const newlyAllowed = (next.tools?.allow ?? []).filter((tool) => !allowedBefore.has(tool));
-  if (newlyAllowed.length > 0) {
-    throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, `a rebind may not allow new tools: ${newlyAllowed.join(", ")}`);
+  // Tool ceilings are only narrowing-safe if every restriction is checked. An
+  // omitted list or a changed preset can select a broader default, so those moves
+  // are refused outright until their semantics are defined here.
+  if ((previous.tools === undefined) !== (next.tools === undefined)) {
+    throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, "a rebind may not add or remove the tool policy");
+  }
+  if (previous.tools && next.tools) {
+    const previousTools = previous.tools;
+    const nextTools = next.tools;
+    if (previousTools.preset !== nextTools.preset) {
+      throw runtimeError("coordinator_rebind_changes_preset", coordinatorId, "a rebind may not change the tool preset; its default is not defined here");
+    }
+    const allowedBefore = new Set(previousTools.allow ?? []);
+    const newlyAllowed = (nextTools.allow ?? []).filter((tool) => !allowedBefore.has(tool));
+    if (newlyAllowed.length > 0) {
+      throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, `a rebind may not allow new tools: ${newlyAllowed.join(", ")}`);
+    }
+    const deniedBefore = new Set(previousTools.deny ?? []);
+    const undenied = [...deniedBefore].filter((tool) => !(nextTools.deny ?? []).includes(tool));
+    if (undenied.length > 0) {
+      throw runtimeError("coordinator_rebind_removes_denials", coordinatorId, `a rebind may not lift denials: ${undenied.join(", ")}`);
+    }
   }
 }
 
@@ -459,16 +530,35 @@ function validateAuthority(authority: KxmCoordinatorAuthority): KxmCoordinatorAu
   const tools = authority.tools;
   if (tools !== undefined) {
     const lists = [tools.allow ?? [], tools.deny ?? []];
-    for (const list of lists) for (const tool of list) requireIdentifier(tool, "tools");
+    for (const list of lists) {
+      for (const tool of list) requireIdentifier(tool, "tools");
+      if (new Set(list).size !== list.length) {
+        throw runtimeError("coordinator_authority_invalid", "tools", "tool lists must not repeat");
+      }
+    }
     if (tools.preset !== undefined) requireIdentifier(tools.preset, "tools.preset");
   }
+  // Sets are stored canonically: order and repeats carry no authority, and leaving
+  // them as supplied would let an equivalent ceiling masquerade as a rebind.
   return {
     repositoryAccess: authority.repositoryAccess,
-    effects,
-    ...(tools !== undefined ? { tools } : {}),
+    effects: canonicalSet(effects),
+    ...(tools !== undefined
+      ? {
+          tools: {
+            ...(tools.preset !== undefined ? { preset: tools.preset } : {}),
+            ...(tools.allow !== undefined ? { allow: canonicalSet(tools.allow) } : {}),
+            ...(tools.deny !== undefined ? { deny: canonicalSet(tools.deny) } : {}),
+          },
+        }
+      : {}),
   };
 }
 
+function canonicalSet(values: readonly string[]): string[] {
+  return [...new Set(values)].sort();
+}
+
 function validateActor<T extends { kind: KxmCoordinatorRecord["boundBy"]["kind"]; id: string }>(actor: T, field: string): T {
   const kinds: string[] = ["human", "runtime", "hub", "agent", "adapter"];
   if (!actor || typeof actor !== "object" || !kinds.includes(actor.kind)) {
@@ -506,18 +596,6 @@ function requireTimestamp(value: string, field: string): string {
   return value;
 }
 
-function contextConfigRevision(context: KxmRuntimeContext): string {
-  const revision = (context as { configRevision?: string }).configRevision;
-  if (typeof revision === "string" && /^sha256:[a-f0-9]{64}$/.test(revision)) return revision;
-  // The context does not carry one: fingerprint its own identity inputs instead of
-  // inventing a revision, so drift across a reopen is still detectable.
-  return `sha256:${createHash("sha256").update(stableStringify({
-    projectId: context.projectId,
-    projectRoot: context.projectRoot,
-    homeRuntimeId: context.homeRuntimeId,
-  }), "utf8").digest("hex")}`;
-}
-
 function stableStringify(value: unknown): string {
   return JSON.stringify(sortDeep(value));
 }

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.47";
+const VERSION = "0.7.49";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/runtime-service.ts

@@ -234,6 +234,8 @@ export interface KxmRuntimeContext {
   projectId: string;
   homeRuntimeId: string;
   eventStore: KxmRunEventStore;
+  /** Deterministic revision of the loaded project configuration (`sha256:...`). */
+  readonly configRevision: string;
   /**
    * Optional clock for **run-duration budget accounting only**. Budgets are
    * measured from the log's `runningSince`; this answers "what time is it now"
@@ -306,6 +308,7 @@ export function openKxmRuntimeContext(
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
       eventStore,
+      configRevision: bundle.configRevision,
       ...(options.budgetClock ? { budgetClock: options.budgetClock } : {}),
     };
   } catch (error) {

package/plugins/kxm/src/runtime-store.ts

@@ -1255,14 +1255,14 @@ export class KxmRunEventStore {
     return row ? intakeFromRow(row) : undefined;
   }
 
-  /** Intake rows in the given dispatch states, oldest first (stable, replay-safe order). */
+  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
   intakeInStates(projectId: string, states: readonly KxmIntakeMessageRow["dispatchState"][], limit = 100): KxmIntakeMessageRow[] {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
     const rows = this.database.prepare(`
       SELECT * FROM intake_messages
       WHERE project_id = ? AND dispatch_state IN (${placeholders})
-      ORDER BY received_at ASC, message_id ASC
+      ORDER BY rowid ASC
       LIMIT ?
     `).all(projectId, ...states, limit) as unknown as IntakeSqlRow[];
     return rows.map(intakeFromRow);
@@ -1554,10 +1554,19 @@ interface ControlSqlRow {
  * whose index and payload disagree fails closed instead of trusting either.
  */
 function coordinatorFromRow(row: CoordinatorSqlRow): KxmCoordinatorRow {
-  const parsed = JSON.parse(row.record) as { coordinatorId?: string; ceilingHash?: string; configRevision?: string; boundAt?: string };
+  const parsed = JSON.parse(row.record) as {
+    coordinatorId?: string; projectId?: string; role?: string; channel?: string;
+    ceilingHash?: string; configRevision?: string; boundAt?: string;
+  };
+  if (row.schema !== "kxm.coordinator.v1") {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, `unexpected coordinator schema ${row.schema}`);
+  }
   validateCoordinator(parsed, row.coordinator_id);
   if (
     parsed.coordinatorId !== row.coordinator_id
+    || parsed.projectId !== row.project_id
+    || parsed.role !== row.role
+    || parsed.channel !== row.channel
     || parsed.ceilingHash !== row.ceiling_hash
     || parsed.configRevision !== row.config_revision
     || parsed.boundAt !== row.bound_at
@@ -1577,10 +1586,19 @@ function coordinatorFromRow(row: CoordinatorSqlRow): KxmCoordinatorRow {
 }
 
 function intakeFromRow(row: IntakeSqlRow): KxmIntakeMessageRow {
-  const parsed = JSON.parse(row.record) as { messageId?: string; contentHash?: string; receivedAt?: string; dispatch?: { state?: string } };
+  const parsed = JSON.parse(row.record) as {
+    messageId?: string; projectId?: string; coordinatorId?: string; idempotencyKey?: string;
+    contentHash?: string; receivedAt?: string; dispatch?: { state?: string };
+  };
+  if (row.schema !== "kxm.intake-message.v1") {
+    throw runtimeError("intake_record_divergent", row.message_id, `unexpected intake schema ${row.schema}`);
+  }
   validateIntakeMessage(parsed, row.message_id);
   if (
     parsed.messageId !== row.message_id
+    || parsed.projectId !== row.project_id
+    || parsed.coordinatorId !== row.coordinator_id
+    || parsed.idempotencyKey !== row.idempotency_key
     || parsed.contentHash !== row.content_hash
     || parsed.receivedAt !== row.received_at
     || parsed.dispatch?.state !== row.dispatch_state

package/schemas/intake-message.schema.json

@@ -41,9 +41,9 @@
   "additionalProperties": false,
   "allOf": [
     {
-      "if": { "properties": { "classification": { "enum": ["public", "project", "sensitive"] } }, "required": ["classification"] },
-      "then": { "required": ["content"] },
-      "else": { "not": { "required": ["content"] } }
+      "if": { "properties": { "classification": { "const": "secret" } }, "required": ["classification"] },
+      "then": { "required": ["contentOmittedReason"], "not": { "required": ["content"] } },
+      "else": { "required": ["content"], "not": { "required": ["contentOmittedReason"] } }
     }
   ],
   "$defs": {
@@ -62,6 +62,10 @@
           "if": { "properties": { "state": { "const": "admitted" } }, "required": ["state"] },
           "then": { "required": ["runId", "updatedAt"] }
         },
+        {
+          "if": { "properties": { "state": { "not": { "const": "admitted" } } }, "required": ["state"] },
+          "then": { "not": { "required": ["runId"] } }
+        },
         {
           "if": { "properties": { "state": { "enum": ["held_paused", "refused"] } }, "required": ["state"] },
           "then": { "required": ["reason"] }