@kontextmind/kxm 0.7.49 → 0.7.51

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.49",
+      "version": "0.7.51",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -53,6 +53,48 @@ All notable user-facing changes are documented here. The project follows [Semant
   arrival order, so a backdated timestamp cannot jump the queue; persisted records
   are cross-checked against every duplicated column on read; and the intake schema
   no longer admits contradictory states.
+- **A coordinator rebind could widen a tool ceiling by clearing its allow list.**
+  An absent or empty allow list imposes no restriction, so dropping a populated one
+  is now refused (`coordinator_rebind_clears_allowlist`). Resume drains held intent
+  to exhaustion instead of stopping at a page cap, and fails loudly rather than
+  half-resuming. Coordinator fingerprints are computed over the normalised
+  authority, so identities bound by 0.7.46 with unordered effect lists no longer
+  require a policy rebind after upgrade — and the equivalence test is shared, so a
+  row written by 0.7.46 is not a `coordinator_write_lost` conflict just because it
+  was found by losing an insert race instead of reading the slot.
+- **A failed `BEGIN` poisoned the database connection.** The transaction marker was
+  claimed before `BEGIN` and the statement sat outside the `try/finally`, so a
+  `BEGIN` that gave up on a busy writer left every later transaction failing with a
+  misleading "nested transactions are not allowed". The marker is now claimed only
+  after a successful `BEGIN`, genuine lock contention surfaces as
+  `runtime_transaction_busy` — decided by SQLite's **result code**, on both runtimes
+  this ships on: Node's `errcode` and `bun:sqlite`'s `errno` (extended codes land on
+  their primaries, so `SQLITE_BUSY_RECOVERY`, `SQLITE_BUSY_SNAPSHOT` and
+  `SQLITE_LOCKED_SHAREDCACHE` all count), then a symbolic `SQLITE_BUSY*` /
+  `SQLITE_LOCKED*` / `SQLITE_PROTOCOL*` name, with anchored message text used only
+  when an error carries neither. A code **or** a SQLite result name wins over the text
+  in both directions, so a permanent error — `SQLITE_FULL`, `SQLITE_CANTOPEN` — quoting
+  "database is locked" is not mistaken for contention, and `bun:sqlite`'s symbolic
+  `code` is read as the result name it is while Node's own `ERR_SQLITE_ERROR` is not.
+  Any other `BEGIN` failure keeps its own error instead of looking retryable. A contended connection then refuses further write-mode `BEGIN`s for one
+  second (`TRANSACTION_BUSY_BACKOFF_MS`), so retries **inside that window** fail fast
+  rather than paying the 5-second busy timeout once per attempt; a retry after the
+  window can pay it again. The window is measured with `process.hrtime` and belongs to
+  the clock that armed it, so neither a system clock change nor an injected test clock
+  can extend, shorten or clear another caller's throttle, and a clock that returns a
+  non-finite number is refused rather than trusted (`runtime_transaction_clock_invalid`)
+  wherever a reading is taken — checking a pending deadline, and arming a fresh one. The
+  clock is read at two call sites, not on every `BEGIN`. Zero reads are limited to
+  successful write-mode transactions with no pending deadline, successful `DEFERRED`
+  transactions with or without one, permanent `BEGIN` failures with no pending deadline, and
+  a nested-transaction rejection; a `DEFERRED` transaction skips the deadline check, but a
+  contended `BEGIN DEFERRED` failure still reads the clock and arms a deadline. Two further
+  cases are measured rather than asserted by the committed suite — a clean success, and a
+  permanent failure, each following an expired deadline, read it once. So this guards the
+  seam rather than every transaction, and the counts we assert are named separately from the
+  counts we observed. The throttle is per connection
+  object in this process — it is not cross-process, and it does not leak to another
+  connection to the same database.
 
 ## 0.7.0 - 2026-09-11
 

package/docs/kb/qa-authentik-authentication.md

@@ -8,18 +8,24 @@ status: "draft"
 owner: "@operator"
 created: "2026-09-17"
 updated: "2026-09-18"
-authority: "instruction"
-confidence: "reviewed"
-summary: "Yes, but not by swapping the hub's checks for OIDC — the safest hook is a token broker that exchanges Authentik identity for the kxm tokens the hub already understands."
+authority: "hypothesis"
+confidence: "uncertain"
+summary: "Authentik authenticates browsers at the reverse proxy and the tenant portal's backend calls the loopback hub with existing machine tokens. KXM does not interpret browser identity headers, and the hub-side JWT verification and token broker once recommended here are rejected, not deferred."
 tags: ["hub", "authentik", "oidc", "auth"]
-related: ["docs/operations.md", "docs/kb/qa-hub-on-a-public-host.md"]
+related: ["docs/operations.md", "docs/kb/qa-hub-on-a-public-host.md", "plans/plan-per-tenant-hosting.md", "plans/implementation-plan.md"]
 ---
 
 # Q&A: Authentik (OIDC) for user/role/agent authentication
 
 > Researched by `claude --model fable` (planner, read-only) · 2026-09-17 · task_c0bb05339e15 · root review: pending
 
-**Short answer:** Yes, but not by swapping the hub's checks for OIDC. The hub has one shared-secret model, and the safest hook is a token broker that exchanges Authentik identity for the kxm tokens the hub already understands. Proxy forward-auth is the zero-code first step for humans; hub-side JWT validation is a later, additive gate.
+**Short answer, as of 2026-09-20: no hub-side identity subsystem at all.** Authentik
+authenticates browsers at the tenant's reverse proxy and the portal's own backend calls the
+loopback hub with the machine tokens that already work. The token-broker and JWT
+recommendations that used to sit in this answer are **rejected**, not deferred; they were
+plausible for a shared multi-tenant hub, which is not what we are deploying. Option 1 below —
+forward-auth at the existing proxy, hub unchanged — is the **selected** shape; options 2 and 3
+are rejections, not stages.
 
 ## What exists today
 
@@ -35,30 +41,57 @@ The hub knows about three credentials. None of them carries a user identity, a r
 
 ## Integration options
 
-### 1. Reverse-proxy forward-auth (Authentik outpost at the proxy; hub unchanged)
+### 1. Reverse-proxy forward-auth (Authentik outpost at the proxy; hub unchanged) — **selected shape at the edge**
 
-Authentik's proxy outpost authenticates browser sessions and passes headers upstream. The hub ignores those headers today, so the proxy must still inject the hub bearer token, or clients must still send it. Covers: Studio, `/v1/ops/*` dashboards, human CLI users via a browser-capable flow. Does not cover: agents (they present `x-kxm-agent-*` headers plus a bearer, not a cookie), and it gives the hub no per-user identity for logging. Effort: low, config only. Risk: low if the hub keeps its token check; medium if someone sets the proxy to add the admin token for every authenticated user, which flattens all Authentik users to admin. Non-loopback bind already requires a token (`hub.ts:468`), so the proxy cannot make the hub anonymous.
+Authentik's proxy outpost authenticates browser sessions and passes headers upstream. The hub ignores those headers today, and under the per-tenant decision it keeps ignoring
+them: the **portal's own backend** holds the hub bearer server-side and calls loopback, while
+the proxy's job is to keep the hub's routes off the public interface entirely. Do not
+configure the proxy to inject the admin token on behalf of every user — that flattens all
+Authentik users to hub admin. What this option does **not** give the hub is per-user identity
+for logging, which is the portal's to record. Effort: low, config only. Risk: low if the hub keeps its token check; medium if someone sets the proxy to add the admin token for every authenticated user, which flattens all Authentik users to admin. Non-loopback bind already requires a token (`hub.ts:468`), so the proxy cannot make the hub anonymous.
 
-### 2. Hub validates Authentik-issued JWTs (OIDC discovery + JWKS)
+### 2. Hub validates Authentik-issued JWTs (OIDC discovery + JWKS) — **rejected 2026-09-20; a new decision is required to revisit**
 
 Add a second accepted credential in `bearerToken`'s callers: if the bearer parses as a JWT, verify `iss`, `aud`, `exp`, and signature against a cached JWKS from `<issuer>/.well-known/openid-configuration`; else fall through to the existing `safeTokenEqual` path. Code changes: a new `oidc.ts` (discovery, JWKS cache, verify via `node:crypto` `createPublicKey` from JWK, or add `jose`), new `MeshHubOptions.oidc` and `KXM_OIDC_ISSUER` / `KXM_OIDC_AUDIENCE` env in `server.ts` and `hub-env.ts`, and changes to `requireAdminAuth` and `requireProjectAuth` to accept a verified claim set. Mapping: `groups` claim to admin (e.g. `kxm-admin`) and to project scope (e.g. `kxm-project:<name>`). Client side: `HubClient.authToken` (`client.ts:539`) already sends any string as bearer, so a client can pass an Authentik access token unchanged. Effort: medium, roughly 300 to 500 lines plus tests. Risk: medium. New network dependency at auth time (JWKS fetch must fail closed, never skip), clock skew, and the hub must reject `alg: none` and HS256. Agent registration would gain a real principal to store on the agent record (`sub`, `preferred_username`), which the schema can absorb since records are opaque JSON (`store.ts:26`).
 
-### 3. Token-broker mapping (Authentik users/groups mint per-user or per-agent kxm tokens)
+### 3. Token-broker mapping (Authentik users/groups mint per-user or per-agent kxm tokens) — **rejected 2026-09-20; a new decision is required to revisit**
 
 A small broker (could be a new hub route or a sidecar) accepts an Authentik ID token, verifies it as in option 2, then issues the tokens the runtime already consumes: a project token entry for `requireProjectAuth`, and a `kxm.session-token.v1` with a `toolPolicy` derived from the user's group (`mintSessionToken`, `commands.ts:944`). Mapping table: Authentik group to kxm role id (`role.ts:63` ids `writer`, `planner`, `critic-*`, `verifier`), role `tools` block to `ToolPolicy`, and group to project list to `projectTokens`. Today project tokens are a static map read at startup (`hub.ts:385`), so per-user project tokens need either a dynamic token store in `MeshStore` or short-lived tokens the hub can look up. Session tokens are unsigned (`commands.ts:977`), so a broker-issued one only means something if `parseSessionToken` gains signature verification; otherwise any local process can forge the same payload. Effort: medium to high, because it touches token storage, signing, and revocation. Risk: medium. Benefit: agents and humans converge on one identity source without changing every hub route.
 
-## Recommendation
-
-Phased, honoring the fail-closed rules:
-
-1. **Phase 1, now: forward-auth for human surfaces only.** Put Authentik in front of Studio and `/v1/ops/*` on any non-loopback deployment. Keep `KXM_AUTH_TOKEN` mandatory; the proxy never substitutes for it. This adds SSO without touching `hub.ts`. Fix the plain-string compare in `studio-layout.ts:350` to use `timingSafeStringCompare` while there.
-2. **Phase 2: hub-side JWT verification as an additive gate.** Implement option 2 with a hard rule: if `KXM_OIDC_ISSUER` is set and discovery or JWKS fetch fails, the JWT path returns 401, and the static-token path still works. Never let loopback plus OIDC config produce anonymous admin. Record the verified `sub` on the agent record at registration for provenance.
-3. **Phase 3 (defer): broker-issued signed session and attempt tokens.** Sign `kxm.session-token.v1` and `kxm.attempt-token.v1` payloads and verify in `enforceToolPolicy` before mapping Authentik groups to `ToolPolicy`. Until tokens are signed, group-to-policy mapping is advisory, not enforcement, because the check is client-side and forgeable.
-
-Defer any attempt to remove the static token entirely; it is the only credential the auto-start path (`hub-autostart.ts:175`) and the persisted client resolver (`hub-env.ts:203`) know how to pass.
+## Recommendation (replaced 2026-09-20)
+
+Options **2 and 3**, and the staged recommendation that used to sit in this section, are
+**superseded** — option 1 above is the selected shape, not a rejected one. They stay visible
+because they were the plausible answer for a month and someone will meet them again: **do not build a hub-side JWT verifier, a
+token broker, per-user project tokens, or signed session/attempt token issuance as hosting
+prerequisites.** They were a reasonable answer to "one hub, many users"; they are the wrong
+answer to the deployment we actually have, which is **one tenant per box**.
+
+1. **Now:** Authentik authenticates and authorizes browsers at the tenant's existing reverse
+   proxy, on the **portal's** routes. The portal's server-side backend calls the loopback hub
+   and supervisor using the machine credentials that already work (`KXM_AUTH_TOKEN`,
+   `KXM_PROJECT_TOKENS`, the persisted hub env record). The hub binds loopback and exposes no
+   public listener. Nothing in `hub.ts` changes, and no browser identity header reaches it.
+2. **What stays as-is, unmodified:** the admin-token requirement for non-loopback binding, the
+   generated-and-persisted token, project tokens read at startup, and the local loopback
+   convenience. A browser-path outage denies browsers; it must not stop authorized machine
+   clients.
+3. **Rejected, not deferred:** hub-side JWT verification, group-to-`ToolPolicy` mapping,
+   token signing, dynamic per-user token stores, and OAuth2 client-credentials or
+   device-flow login for agents. These are not waiting for a trigger; they are the wrong
+   shape for a per-tenant hub, and reopening any of them needs a **new written decision**
+   that says what the portal boundary cannot do — for example genuine per-user attribution
+   of hub writes inside KXM itself, which per-box tenancy does not need. Until such a
+   decision exists, treat every mention of them in this file as history.
+
+The technical observations underneath remain accurate and are the reason the option is *cheap to
+reject*: unsigned session tokens (`commands.ts:977`), static project tokens read at startup
+(`hub.ts:385`), a fixed-string `HubClient.authToken`, and a plain-string compare in
+`studio-layout.ts:350`. **One item is kept as a live hardening note, not a hosting
+prerequisite:** make that Studio compare timing-safe.
 
 ## Agent auth specifically
 
 Running agents today authenticate non-interactively with whatever string lands in `HubClient.authToken`, resolved by `resolveClientHubAuthToken` (`hub-env.ts:203`): `KXM_AUTH_TOKEN` env, else the persisted project token, else the persisted admin token. The MCP server (`mcp-server.ts:84`) and the Pi extension (`extension.ts:709`) both use this. Pi worker children inherit `process.env` unchanged (`pi-producer.ts:504`), so they get the same token as the supervisor. Tool policy for workers comes from `KXM_ATTEMPT_TOKEN`, which is minted only in tests today (`test/core/commands-policy.test.ts:60`); no runtime path in `plugins/kxm/src` calls `mintAttemptToken`, so engine issuance is planned but not wired.
 
-With Authentik, agents should use the OAuth2 client-credentials grant (one Authentik application per agent class, or per role such as `writer` and `verifier`), obtain an access token at spawn, and pass it as `KXM_AUTH_TOKEN` to the child. This needs option 2 in the hub so the token verifies, and a refresh hook in `HubClient` since `headers()` reads a fixed string (`client.ts:539`) and access tokens expire. Device-code flow is the fallback for Claude Code sessions that start from a human terminal. Whether Authentik's client-credentials tokens carry `groups` claims by default is unknown from this repo; it must be confirmed against the Authentik provider config before mapping roles from claims.
+**Superseded paragraph, kept for the record (see the recommendation above):** with Authentik, agents should use the OAuth2 client-credentials grant (one Authentik application per agent class, or per role such as `writer` and `verifier`), obtain an access token at spawn, and pass it as `KXM_AUTH_TOKEN` to the child. This needs option 2 in the hub so the token verifies, and a refresh hook in `HubClient` since `headers()` reads a fixed string (`client.ts:539`) and access tokens expire. Device-code flow is the fallback for Claude Code sessions that start from a human terminal. Whether Authentik's client-credentials tokens carry `groups` claims by default is unknown from this repo; it must be confirmed against the Authentik provider config before mapping roles from claims.

package/docs/kb/qa-hub-on-a-public-host.md

@@ -10,7 +10,7 @@ created: "2026-09-17"
 updated: "2026-09-18"
 authority: "instruction"
 confidence: "reviewed"
-summary: "One hub is one process and one SQLite database behind a TLS proxy; it is not multi-tenant and must never be exposed directly to the public internet."
+summary: "One hub is one process and one state set per tenant box behind a TLS proxy; it is not multi-tenant and must never be exposed directly to the public internet. Hosting tenancy is the machine plus the portal, and the hub binds loopback."
 tags: ["hub", "deployment", "security"]
 related: ["docs/operations.md", "docs/kb/qa-authentik-authentication.md", "docs/kb/qa-what-the-hub-stores.md"]
 ---

package/docs/operations.md

@@ -146,6 +146,14 @@ Recommended alerts:
 
 ## Backup and restore
 
+> **Hub-only today, and labelled as such.** The recipe below stops the hub and copies
+> `.kxm/state/kxm.db`. That is not the whole tenant state set: the Runtime keeps its own
+> `registry.db`, per-project event stores under the user state root, prompt sidecars,
+> bindings and configuration. A restore that follows only these steps can bring the hub back
+> while losing Runtime history. Queue step **S1** replaces this section with a stopped-state
+> procedure covering the full set, and **S5** proves it with one deployed restore before real
+> use; until S1 lands, treat this as the hub database only.
+
 SQLite runs in WAL mode. The safest simple backup is a coordinated copy while the hub is stopped:
 
 1. Stop the hub gracefully.
@@ -233,5 +241,5 @@ place from v0.4 databases.
 - [What is all stored on the hub?](kb/qa-what-the-hub-stores.md)
 - [Storage engine — SQLite vs DuckDB](kb/qa-sqlite-vs-duckdb.md)
 - [Hub on a public host — multiple users and projects?](kb/qa-hub-on-a-public-host.md)
-- [Authentik (OIDC) for user/role/agent authentication](kb/qa-authentik-authentication.md)
+- [Authentik at the edge: why the hub owns no browser identity](kb/qa-authentik-authentication.md)
 - [Extension install → kxm CLI bootstrap + hub auto-connect](kb/qa-extension-install-and-hub-bootstrap.md)

package/docs/operator-pi-packages.md

@@ -43,8 +43,9 @@ commands for RTK independently of `rtk.ts`.
 - The antigravity provider is bundled inside `plugins/kxm` (vendored from
   pi-antigravity, MIT); remove any standalone pi-antigravity Pi extension to
   avoid the double-registration warning. `pi-antigravity` and
-  `@tian.zuo/pi-antigravity` are different Pi providers. They do not replace
-  the native `agy` harness used by the assignment runner.
+  `@tian.zuo/pi-antigravity` are different Pi providers. For Google, this bundled
+  provider **is** the admitted route (Tracking → Decided, 2026-09-15); `agy` stays a
+  catalog/helper entry rather than the admission path.
 - For KXM development loads, prefer the working tree:
   `pi --no-extensions -e ./plugins/kxm/src/extension.ts`. Add every required
   provider extension with another `-e`; otherwise Pi discovery is disabled.

package/docs/workflow-guide.md

@@ -30,7 +30,9 @@ Existing claims inside preserved candidate lines are research claims, not dispat
 
 ## Selection Policy
 
-Candidate selection is measured per role. Filter stages are optional and are not mandatory Tier-0 gating. Prefer a provider-native authenticated subscription when Tracking says that harness is eligible. For Gemini candidates (`google/*`), the admitted native subscription harness on this runner is `agy` (Antigravity CLI, `agy -p`), not the OpenRouter provider id, when Tracking lists agy as eligible. Do not change the candidate ids themselves (they are dated research). Evidence and review remain workflow-specific. Both the Fable architecture critic and the Sol CLI critic remain required for this developer assignment runner.
+Candidate selection is measured per role. Filter stages are optional and are not mandatory Tier-0 gating. Prefer a provider-native authenticated subscription when Tracking says that harness is eligible. For Gemini candidates (`google/*`), the admitted route is the bundled `antigravity` **Pi
+provider** (Tracking → Decided, 2026-09-15) — not the OpenRouter provider id, and not a
+shell-out to `agy`, which stays a catalog/helper entry. Do not change the candidate ids themselves (they are dated research). Evidence and review remain workflow-specific. Both the Fable architecture critic and the Sol CLI critic remain required for this developer assignment runner.
 
 ### Cost band reference (dated candidates)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.49",
+  "version": "0.7.51",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.49",
+  "version": "0.7.51",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -34732,8 +34732,9 @@ Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
 [\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).
 
 You are the **planner / architecture critic** unless the human explicitly asks
-you to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`).
-If \`grok\` is logged out, fail closed; do not fall back to Pi. Your reviews are
+you to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`) \u2014 a starting
+rotation, not a sole writer. If \`grok\` is logged out, never bill Grok through another harness;
+use a relief route Tracking **admits**, or stop and name the limits hit. Your reviews are
 artifacts, not hub \`peer-reply\` evidence.
 `;
   const claudeExisted = existsSync25(claudePath);
@@ -34747,8 +34748,10 @@ artifacts, not hub \`peer-reply\` evidence.
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
 [\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).
 
-Google / Antigravity CLI (\`agy\`) is an admitted native writer and experiment edit route
-for Gemini models. Starting rotation remains Grok.
+Google goes through the \`antigravity\` **Pi provider** (Tracking \u2192 Decided,
+2026-09-15); \`agy\` stays a harness catalog/helper entry, not the admission path.
+Current admissions come from Tracking and \`kxm harness list\`. Starting rotation
+remains Grok.
 `;
   const geminiExisted = existsSync25(geminiPath);
   if (updateHarnessDocument(geminiPath, block, geminiHeader)) {

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.49";
+var VERSION = "0.7.51";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime-supervisor.js

@@ -17645,12 +17645,76 @@ function openDatabase(file, description, spec) {
   }
 }
 var activeTransactions = /* @__PURE__ */ new WeakSet();
-function withDatabaseTransaction(database, work, mode = "IMMEDIATE") {
+var TRANSACTION_BUSY_BACKOFF_MS = 1e3;
+function monotonicNowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+var transactionThrottles = /* @__PURE__ */ new WeakMap();
+function finiteNow(clock, label) {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`
+    );
+  }
+  return now;
+}
+var CONTENTION_PRIMARY_CODES = [5, 6, 15];
+var CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+var SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+var CONTENTION_MESSAGES = /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+function isTransactionContention(error) {
+  const carrier = error;
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 255);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+function withDatabaseTransaction(database, work, mode = "IMMEDIATE", clock = monotonicNowMs) {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== void 0) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === void 0) {
+      deadlines = /* @__PURE__ */ new WeakMap();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");
@@ -18558,7 +18622,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
+  /**
+   * Intake rows in the given dispatch states, in arrival order (replay-safe).
+   *
+   * `rowid` gives same-store arrival order, which is what queue priority needs
+   * here. It is **not** a durable sequence: this repository backs stores up with
+   * `VACUUM INTO`, and a vacuum may renumber implicit rowids. An explicit
+   * immutable arrival sequence is tracked in the plan's schema-v6 follow-ups.
+   */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");

package/plugins/kxm/dist/runtime.js

@@ -17816,12 +17816,76 @@ function openDatabase(file, description, spec) {
   }
 }
 var activeTransactions = /* @__PURE__ */ new WeakSet();
-function withDatabaseTransaction(database, work, mode = "IMMEDIATE") {
+var TRANSACTION_BUSY_BACKOFF_MS = 1e3;
+function monotonicNowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+var transactionThrottles = /* @__PURE__ */ new WeakMap();
+function finiteNow(clock, label) {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`
+    );
+  }
+  return now;
+}
+var CONTENTION_PRIMARY_CODES = [5, 6, 15];
+var CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+var SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+var CONTENTION_MESSAGES = /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+function isTransactionContention(error) {
+  const carrier = error;
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 255);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+function withDatabaseTransaction(database, work, mode = "IMMEDIATE", clock = monotonicNowMs) {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== void 0) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === void 0) {
+      deadlines = /* @__PURE__ */ new WeakMap();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");
@@ -18998,7 +19062,14 @@ var KxmRunEventStore = class {
     `).get(projectId, coordinatorId, idempotencyKey);
     return row ? intakeFromRow(row) : void 0;
   }
-  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
+  /**
+   * Intake rows in the given dispatch states, in arrival order (replay-safe).
+   *
+   * `rowid` gives same-store arrival order, which is what queue priority needs
+   * here. It is **not** a durable sequence: this repository backs stores up with
+   * `VACUUM INTO`, and a vacuum may renumber implicit rowids. An explicit
+   * immutable arrival sequence is tracked in the plan's schema-v6 follow-ups.
+   */
   intakeInStates(projectId, states, limit = 100) {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");
@@ -30289,6 +30360,7 @@ export {
   SUBAGENT_TYPES,
   SteelClient,
   SubagentManager,
+  TRANSACTION_BUSY_BACKOFF_MS,
   VIEWPORT_PRESETS,
   WIN_NPM_INNER_EXE,
   acceptKxmRun,
@@ -30344,6 +30416,7 @@ export {
   hashKxmTokenProof,
   isKnownHarnessId,
   isKxmRuntimeContextClosed,
+  isTransactionContention,
   isWindowsHarnessShim,
   kxmDeclaredExecutorIds,
   kxmDeclaredRepositoryIds,

package/plugins/kxm/dist/server.js

@@ -11537,12 +11537,76 @@ function openDatabase(file, description, spec) {
   }
 }
 var activeTransactions = /* @__PURE__ */ new WeakSet();
-function withDatabaseTransaction(database, work, mode = "IMMEDIATE") {
+var TRANSACTION_BUSY_BACKOFF_MS = 1e3;
+function monotonicNowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+var transactionThrottles = /* @__PURE__ */ new WeakMap();
+function finiteNow(clock, label) {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`
+    );
+  }
+  return now;
+}
+var CONTENTION_PRIMARY_CODES = [5, 6, 15];
+var CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+var SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+var CONTENTION_MESSAGES = /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+function isTransactionContention(error) {
+  const carrier = error;
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 255);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+function withDatabaseTransaction(database, work, mode = "IMMEDIATE", clock = monotonicNowMs) {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== void 0) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === void 0) {
+      deadlines = /* @__PURE__ */ new WeakMap();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.49",
+  "version": "0.7.51",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/database.ts

@@ -213,21 +213,226 @@ export function openDatabase(file: string, description: string, spec: DatabaseSc
 
 const activeTransactions = new WeakSet<DatabaseSync>();
 
+/**
+ * How long a connection refuses to retry a `BEGIN` that lost the write race.
+ *
+ * SQLite's busy timeout is per connection, so a `BEGIN` against a locked
+ * database waits the full timeout before failing. Callers that recover from a
+ * lost write open several transactions in a row; without this window each of
+ * them pays the timeout, and a suite run showed that turning one 4-second test
+ * into 17 minutes. The old code got that speed by accident — it left the
+ * connection permanently marked as in-transaction after a failed `BEGIN`, which
+ * is the defect fixed below — so the backoff replaces the fast-fail without
+ * re-introducing the poison.
+ *
+ * Two limits, both deliberate:
+ * - It is a **throttle, not a queue**. A caller whose lock cleared 1 ms later is
+ *   still refused for the rest of the window; the refusal is explicit
+ *   (`runtime_transaction_busy`, message says `retry deferred`) and bounded by
+ *   this constant. A retry after the window may pay the busy timeout again.
+ * - It is **per connection object, in this process**. It is not a cross-process
+ *   backoff and does not leak to another connection to the same file.
+ */
+export const TRANSACTION_BUSY_BACKOFF_MS = 1_000;
+
+/**
+ * Monotonic elapsed time, deliberately not `Date.now()`.
+ *
+ * A wall-clock step backwards would otherwise keep a long-gone write lock
+ * refusing transactions until real time caught up, and a step forward would end
+ * the throttle early. `hrtime.bigint()` is relative to an arbitrary past origin
+ * and never moves backwards, so the window is bounded by
+ * {@link TRANSACTION_BUSY_BACKOFF_MS} no matter what the system clock does.
+ *
+ * Injectable: production callers never pass it, and a test drives it directly so
+ * the window is stepped rather than raced or slept through.
+ */
+export type MonotonicClock = () => number;
+
+function monotonicNowMs(): number {
+  return Number(process.hrtime.bigint() / 1_000_000n);
+}
+
+/**
+ * Pending throttle per connection, **keyed by the clock that armed it**.
+ *
+ * The nesting is the fix, not tidiness. A deadline is a number from *some* clock,
+ * and the injectable `clock` exists only so a test can step the window; comparing
+ * a deadline armed by one clock against a reading taken from another is how an
+ * injected "one hour from now" throttles a production caller that never passed a
+ * clock at all — and how that same caller could clear a deadline it never armed.
+ * Each clock domain therefore gets its own deadline and can only read, expire or
+ * replace its own. The inner map is **weak in the clock**: it keeps no otherwise
+ * unreachable clock function alive, so an attempt that builds a fresh closure per
+ * call leaves nothing behind once that closure is collected. A clock that *is*
+ * retained keeps its entry until it expires or is replaced — collection is neither
+ * immediate nor size-bounded, and no committed test measures any of this, because no
+ * production caller passes a clock.
+ */
+const transactionThrottles = new WeakMap<DatabaseSync, WeakMap<MonotonicClock, number>>();
+
+/**
+ * A clock reading this helper can reason about.
+ *
+ * Scope, stated as measured rather than as a slogan. The clock is read at **two call
+ * sites**: checking an existing deadline on a non-`DEFERRED` attempt, and arming after a
+ * contended `BEGIN` failure. Reads per call, each reproduced by an assertion in
+ * `test/core/intake.test.ts`: clean success with no pending entry 0; successful
+ * `DEFERRED`, pending entry present or not, 0; fresh contention 1; refusal inside a window
+ * 1; an expired deadline followed by renewed contention 2 in that call; a permanent
+ * `BEGIN` failure with no pending entry 0; a nested-transaction rejection 0.
+ *
+ * Which means it is wrong in both directions to say either "every `BEGIN` validates the
+ * clock" or "the *only* transaction that skips it is a clean uncontended success" — the
+ * second was mine, twice, and the second correction to it was still a slogan. The tests
+ * count; the prose only points at them. Production cannot reach the guard at all, because
+ * the default is `hrtime`; it exists so the injectable seam cannot become a silent
+ * bypass.
+ */
+function finiteNow(clock: MonotonicClock, label: string): number {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`,
+    );
+  }
+  return now;
+}
+
+/**
+ * Is this `BEGIN` failure contention for the write lock, as opposed to a
+ * programming or environment error?
+ *
+ * Only contention may be retried, and only contention earns the throttle window.
+ * Anything else — "cannot start a transaction within a transaction", a closed
+ * connection, a miscompiled statement — must surface unchanged, or a permanent
+ * bug looks like a transient one and the caller retries forever.
+ *
+ * SQLite's **numeric result code decides** where one exists, because it is stable
+ * across versions while message text is not: the primary code is `code & 0xff`, so
+ * extended forms land on their primaries — `SQLITE_BUSY_RECOVERY` (261) and
+ * `SQLITE_BUSY_SNAPSHOT` (517) on `SQLITE_BUSY` (5), `SQLITE_LOCKED_SHAREDCACHE`
+ * (262) on `SQLITE_LOCKED` (6). `SQLITE_PROTOCOL` (15) is included deliberately:
+ * SQLite raises it when repeated attempts to start a transaction under WAL exhaust
+ * the retry count, which is a lock-acquisition retry condition, not a broken
+ * database.
+ *
+ * Where both runtimes expose one, **the number wins over the text**: Node spells it
+ * `errcode`, `bun:sqlite` spells it `errno` (verified on Bun 1.3.14, where a shared-
+ * cache `BEGIN` arrives as `errno: 262`, `code: "SQLITE_LOCKED_SHAREDCACHE"`,
+ * message "database schema is locked: shared"). A symbolic `code`/`name` of the form
+ * `SQLITE_BUSY*`/`SQLITE_LOCKED*`/`SQLITE_PROTOCOL*` is accepted next, and bare
+ * message matching is the last resort — applied only when neither exists, so a
+ * wrapper that merely quotes "database is locked" alongside a permanent code is not
+ * mistaken for contention.
+ *
+ * Deliberately **not** contention: `SQLITE_FULL` / "database or disk is full",
+ * "unable to open database file", and WAL shared-memory I/O failures. Those stay
+ * broken until something outside this connection changes.
+ */
+/** Node: `errcode`. Bun: `errno`. Both spell the extended code as a number. */
+const CONTENTION_PRIMARY_CODES: readonly number[] = [5, 6, 15];
+/** `bun:sqlite` puts the symbolic name in `code`; Node puts its own kind there. */
+const CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+/** Any SQLite result name. If one is present it decides, so text cannot argue. */
+const SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+const CONTENTION_MESSAGES =
+  /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
+
+export function isTransactionContention(error: unknown): boolean {
+  const carrier = error as { errcode?: unknown; errCode?: unknown; errno?: unknown; code?: unknown; name?: unknown }
+    | undefined;
+  // A numeric code wins first, then a symbolic result name, and both win **over the
+  // message**: `errno` is what `bun:sqlite` exposes for the extended result code while
+  // its `code` field holds the symbolic name, and Node spells the number `errcode`.
+  // All three properties are read; what the list orders is which **integer value
+  // decides** — a present `errcode` outranks `errCode`, which outranks `errno`, and a
+  // later number is never consulted. Text is consulted only when the error carries
+  // neither a number nor a SQLite result name, so no wrapper quoting an older
+  // "database is locked" can outvote a code on either runtime.
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 0xff);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    // A result **name** is as authoritative as a number, and in both directions:
+    // `SQLITE_FULL` wearing a "database is locked" message is not contention. Node
+    // spells its own error kind `ERR_SQLITE_ERROR`, which is deliberately not a
+    // SQLite result name and so never reaches a verdict here.
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+
 export function withDatabaseTransaction<T>(
   database: DatabaseSync,
   work: () => T,
   mode: "IMMEDIATE" | "DEFERRED" | "EXCLUSIVE" = "IMMEDIATE",
+  clock: MonotonicClock = monotonicNowMs,
 ): T {
   if (activeTransactions.has(database)) {
     throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
   }
+  // A DEFERRED BEGIN takes no write lock, so it is exempt from the *check*: refusing
+  // it would deny legitimate work over a contention it did not ask for. Exempt from
+  // the check only — shared-cache schema locks can still make a deferred `BEGIN`
+  // fail, and that failure arms a deadline like any other, because the next attempt
+  // would stall the same way.
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== undefined) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`,
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  // Claim the marker only once BEGIN has succeeded. If BEGIN throws — another
+  // writer held the database past the busy timeout — a connection that never
+  // entered a transaction must not be left permanently marked as inside one,
+  // which would fail every later transaction on it with a misleading
+  // "nested" error. `finally` cannot cover this: it only runs after the try.
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === undefined) {
+      deadlines = new WeakMap<MonotonicClock, number>();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
   activeTransactions.add(database);
-  database.exec(`BEGIN ${mode}`);
+  // A successful write-mode BEGIN means this connection is holding the slot, so any
+  // earlier contention is over. A DEFERRED success proves nothing about the write
+  // lock and must not clear a throttle that another caller's contention armed.
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
   try {
     const result = work();
     database.exec("COMMIT");
     return result;
   } catch (error) {
+    // A failed ROLLBACK usually means the connection is gone. Clearing the marker
+    // is bookkeeping, not proof: it does **not** show SQLite exited the
+    // transaction, and nothing here invalidates a handle whose rollback failed.
+    // Pre-existing, named rather than papered over — the caller receives the
+    // original error.
     try { database.exec("ROLLBACK"); } catch { /* ignore rollback error if connection dead */ }
     throw error;
   } finally {

package/plugins/kxm/src/intake.ts

@@ -98,7 +98,45 @@ const ACTOR_ID_RE = /^.{1,200}$/;
 
 /** Canonical SHA-256 over the authority ceiling — the coordinator's fingerprint. */
 export function kxmCeilingHash(authority: KxmCoordinatorAuthority): string {
-  return `sha256:${createHash("sha256").update(stableStringify(authority), "utf8").digest("hex")}`;
+  return `sha256:${createHash("sha256").update(stableStringify(normalizeAuthority(authority)), "utf8").digest("hex")}`;
+}
+
+/**
+ * Does an already-stored coordinator express this ceiling?
+ *
+ * A row written before set normalisation existed carries a fingerprint that
+ * `kxmCeilingHash` no longer reproduces, so comparing the stored hash alone is
+ * not enough: recompute over the authority it kept. Every path that asks this
+ * question — the initial slot lookup and **both** lost-write read-backs — must
+ * go through here, or an upgrade makes the same row equivalent on lookup and a
+ * `coordinator_write_lost` conflict on the race path.
+ *
+ * A legacy row is returned as stored, so its `ceilingHash` is historical: a
+ * caller must not assume every persisted hash uses today's algorithm.
+ */
+function ceilingsMatch(stored: KxmCoordinatorRecord, ceilingHash: string): boolean {
+  return stored.ceilingHash === ceilingHash || kxmCeilingHash(stored.authority) === ceilingHash;
+}
+
+function normalizeAuthority(authority: KxmCoordinatorAuthority): KxmCoordinatorAuthority {
+  const tools = authority.tools;
+  return {
+    repositoryAccess: authority.repositoryAccess,
+    effects: canonicalSet(authority.effects ?? []),
+    ...(tools !== undefined
+      ? {
+          tools: {
+            ...(tools.preset !== undefined ? { preset: tools.preset } : {}),
+            ...(tools.allow !== undefined ? { allow: canonicalSet(tools.allow) } : {}),
+            ...(tools.deny !== undefined ? { deny: canonicalSet(tools.deny) } : {}),
+          },
+        }
+      : {}),
+  };
+}
+
+function canonicalSet(values: readonly string[]): string[] {
+  return [...new Set(values)].sort();
 }
 
 /**
@@ -131,7 +169,7 @@ export function bindKxmCoordinator(
 
   if (existing) {
     const current = JSON.parse(existing.record) as KxmCoordinatorRecord;
-    if (current.ceilingHash === ceilingHash) {
+    if (ceilingsMatch(current, ceilingHash)) {
       return { coordinator: current, created: false };
     }
     if (!input.rebind) {
@@ -169,11 +207,11 @@ export function bindKxmCoordinator(
       record: kxmCanonicalJson(record as unknown as JsonValue),
     });
     if (!replaced) {
-      // Another process got the same policy through. Return its identity when it
-      // reached the ceiling we asked for; anything else is a real conflict.
+      // Another process reached the same ceiling first. Return its identity when it
+      // is the ceiling we asked for; anything else is a real conflict.
       const winner = context.eventStore.coordinatorInSlot(context.projectId, role, channel);
       const record2 = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
-      if (record2 && record2.ceilingHash === ceilingHash) {
+      if (record2 && ceilingsMatch(record2, ceilingHash)) {
         return { coordinator: record2, created: false };
       }
       throw runtimeError("coordinator_write_lost", existing.coordinatorId, "the coordinator slot changed underneath this rebind");
@@ -196,7 +234,7 @@ export function bindKxmCoordinator(
     configRevision: context.configRevision,
     ceilingHash,
   };
-  return { ...persistCoordinator(context, record), created: true };
+  return persistCoordinator(context, record);
 }
 
 /** Resolve a coordinator by id; unknown identity fails closed. */
@@ -210,10 +248,15 @@ export function resolveKxmCoordinator(context: KxmRuntimeContext, coordinatorId:
  * Accept one internal message at the intake boundary.
  *
  * Duplicate ingress (same idempotency key, same content) returns the original
- * record and cannot create another task. The same key with **different** content
+ * record and cannot produce a second admission record. This layer deduplicates
+ * *intake and admission*; creating a task is the M2 consumer's job, so nothing here can
+ * promise anything about tasks. The same key with **different** content
  * is rejected: a reused key must not smuggle a different payload. Payloads
- * classified `secret` are never persisted — only their hash, so intake cannot
- * become a secret store. While the project is paused the message is durable with
+ * classified `secret` are never persisted — only their hash, so a caller that
+ * classifies honestly gets a store that will not hold that payload. The scope is
+ * exactly that: classification is caller-asserted, so this is a storage decision
+ * under a label, not secret detection, and intake is still not a place to keep
+ * credentials. While the project is paused the message is durable with
  * a held dispatch intent instead of being dropped.
  */
 export function acceptKxmIntakeMessage(
@@ -429,28 +472,45 @@ export function isKxmProjectPaused(context: KxmRuntimeContext): boolean {
   return context.eventStore.projectControl(context.projectId)?.paused === true;
 }
 
+/** How many held rows one drain page reads. Bounds a page, not the whole drain. */
+const INTAKE_DRAIN_PAGE_ROWS = 500;
+
 function releaseHeldIntake(context: KxmRuntimeContext, now: string): KxmIntakeMessage[] {
   const released: KxmIntakeMessage[] = [];
   // Drain every held row. A paging loop, not a single capped page: stranding the
   // 501st message behind a "resume releases held intent" claim is a lie of omission.
-  for (let page = 0; page < 1000; page += 1) {
-    const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 500);
-    if (held.length === 0) break;
+  //
+  // What is still true after that fix: the loop holds one write transaction and
+  // retains every released message, so total work and memory grow with the held
+  // backlog even though each read is bounded. Measured on an in-memory store: 150k
+  // held rows with 64-byte payloads took 4.5 s synchronously and ~95 MiB of heap;
+  // 500k maximum-size payloads would retain ~7.6 GiB before any database overhead,
+  // and an allocation failure will not reliably arrive as `intake_drain_stalled`.
+  // Resume is finite because the write lock keeps ingress out of the loop, so this
+  // is a throughput and memory limit, not a correctness hole. Bounding it is a
+  // pre-condition of M2 sustained traffic, not of this contract — see "Still open".
+  for (;;) {
+    const held = context.eventStore.intakeInStates(context.projectId, ["held_paused"], INTAKE_DRAIN_PAGE_ROWS);
+    if (held.length === 0) return released;
+    let progressed = false;
     for (const row of held) {
       const message = JSON.parse(row.record) as KxmIntakeMessage;
       const next: KxmIntakeMessage = { ...message, dispatch: { state: "ready", updatedAt: now } };
       validateIntakeMessage(next, next.messageId);
       if (context.eventStore.updateIntakeDispatch(row.messageId, "held_paused", { state: "ready", record: kxmCanonicalJson(next as unknown as JsonValue) })) {
         released.push(next);
+        progressed = true;
       }
     }
-    const stillHeld = context.eventStore.intakeInStates(context.projectId, ["held_paused"], 1).length;
-    if (stillHeld === 0) break;
+    if (!progressed) {
+      // Cannot move anything: fail loudly inside the caller's transaction, which
+      // rolls the resume back, rather than half-resuming and leaving rows held.
+      throw runtimeError("intake_drain_stalled", context.projectId, `held intake did not drain; ${String(held.length)} row(s) still held`);
+    }
   }
-  return released;
 }
 
-function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): { coordinator: KxmCoordinatorRecord } {
+function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRecord): { coordinator: KxmCoordinatorRecord; created: boolean } {
   validateCoordinator(record, record.coordinatorId);
   const inserted = context.eventStore.insertCoordinatorIfAbsent({
     coordinatorId: record.coordinatorId,
@@ -462,13 +522,13 @@ function persistCoordinator(context: KxmRuntimeContext, record: KxmCoordinatorRe
     boundAt: record.boundAt,
     record: kxmCanonicalJson(record as unknown as JsonValue),
   });
-  if (inserted) return { coordinator: record };
+  if (inserted) return { coordinator: record, created: true };
   // Lost the race for an empty slot: binding is create-once, so the winner is the
   // answer whenever it reached the same ceiling. Only a different ceiling is a
-  // conflict worth reporting.
+  // conflict worth reporting. The loser must not report that it created anything.
   const winner = context.eventStore.coordinatorInSlot(record.projectId, record.role, record.channel);
   const won = winner ? (JSON.parse(winner.record) as KxmCoordinatorRecord) : undefined;
-  if (won && won.ceilingHash === record.ceilingHash) return { coordinator: won };
+  if (won && ceilingsMatch(won, record.ceilingHash)) return { coordinator: won, created: false };
   throw runtimeError("coordinator_write_lost", record.coordinatorId, "the coordinator slot was claimed by a different ceiling");
 }
 
@@ -502,6 +562,12 @@ function assertCeilingNotWidened(
     if (newlyAllowed.length > 0) {
       throw runtimeError("coordinator_rebind_widens_tools", coordinatorId, `a rebind may not allow new tools: ${newlyAllowed.join(", ")}`);
     }
+    // Tool evaluation applies no allowlist restriction when the list is empty or
+    // absent (`commands.ts` gates only on a non-empty allow list), so dropping a
+    // populated list is a widening even though every entry it named is gone.
+    if (allowedBefore.size > 0 && (nextTools.allow ?? []).length === 0) {
+      throw runtimeError("coordinator_rebind_clears_allowlist", coordinatorId, "a rebind may not drop or empty a populated allow list; an absent allow list imposes no restriction");
+    }
     const deniedBefore = new Set(previousTools.deny ?? []);
     const undenied = [...deniedBefore].filter((tool) => !(nextTools.deny ?? []).includes(tool));
     if (undenied.length > 0) {
@@ -540,24 +606,9 @@ function validateAuthority(authority: KxmCoordinatorAuthority): KxmCoordinatorAu
   }
   // Sets are stored canonically: order and repeats carry no authority, and leaving
   // them as supplied would let an equivalent ceiling masquerade as a rebind.
-  return {
-    repositoryAccess: authority.repositoryAccess,
-    effects: canonicalSet(effects),
-    ...(tools !== undefined
-      ? {
-          tools: {
-            ...(tools.preset !== undefined ? { preset: tools.preset } : {}),
-            ...(tools.allow !== undefined ? { allow: canonicalSet(tools.allow) } : {}),
-            ...(tools.deny !== undefined ? { deny: canonicalSet(tools.deny) } : {}),
-          },
-        }
-      : {}),
-  };
+  return normalizeAuthority(authority);
 }
 
-function canonicalSet(values: readonly string[]): string[] {
-  return [...new Set(values)].sort();
-}
 
 function validateActor<T extends { kind: KxmCoordinatorRecord["boundBy"]["kind"]; id: string }>(actor: T, field: string): T {
   const kinds: string[] = ["human", "runtime", "hub", "agent", "adapter"];

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.49";
+const VERSION = "0.7.51";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/memory.ts

@@ -365,7 +365,7 @@ export function syncHarnessMemory(repoRoot: string): { updated: string[]; create
 
   // 2. CLAUDE.md
   const claudePath = join(root, "CLAUDE.md");
-  const claudeHeader = `# KXM (Claude)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nYou are the **planner / architecture critic** unless the human explicitly asks\nyou to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`).\nIf \`grok\` is logged out, fail closed; do not fall back to Pi. Your reviews are\nartifacts, not hub \`peer-reply\` evidence.\n`;
+  const claudeHeader = `# KXM (Claude)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nYou are the **planner / architecture critic** unless the human explicitly asks\nyou to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`) — a starting\nrotation, not a sole writer. If \`grok\` is logged out, never bill Grok through another harness;\nuse a relief route Tracking **admits**, or stop and name the limits hit. Your reviews are\nartifacts, not hub \`peer-reply\` evidence.\n`;
   const claudeExisted = existsSync(claudePath);
   if (updateHarnessDocument(claudePath, block, claudeHeader)) {
     if (claudeExisted) updated.push("CLAUDE.md");
@@ -374,7 +374,7 @@ export function syncHarnessMemory(repoRoot: string): { updated: string[]; create
 
   // 3. GEMINI.md
   const geminiPath = join(root, "GEMINI.md");
-  const geminiHeader = `# KXM (Gemini / Antigravity)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nGoogle / Antigravity CLI (\`agy\`) is an admitted native writer and experiment edit route\nfor Gemini models. Starting rotation remains Grok.\n`;
+  const geminiHeader = `# KXM (Gemini / Antigravity)\n\nFollow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:\n[\`plans/implementation-plan.md\`](plans/implementation-plan.md#tracking-working-tree-not-a-release).\n\nGoogle goes through the \`antigravity\` **Pi provider** (Tracking \u2192 Decided,\n2026-09-15); \`agy\` stays a harness catalog/helper entry, not the admission path.\nCurrent admissions come from Tracking and \`kxm harness list\`. Starting rotation\nremains Grok.\n`;
   const geminiExisted = existsSync(geminiPath);
   if (updateHarnessDocument(geminiPath, block, geminiHeader)) {
     if (geminiExisted) updated.push("GEMINI.md");

package/plugins/kxm/src/runtime-store.ts

@@ -1255,7 +1255,14 @@ export class KxmRunEventStore {
     return row ? intakeFromRow(row) : undefined;
   }
 
-  /** Intake rows in the given dispatch states, in arrival order (replay-safe). */
+  /**
+   * Intake rows in the given dispatch states, in arrival order (replay-safe).
+   *
+   * `rowid` gives same-store arrival order, which is what queue priority needs
+   * here. It is **not** a durable sequence: this repository backs stores up with
+   * `VACUUM INTO`, and a vacuum may renumber implicit rowids. An explicit
+   * immutable arrival sequence is tracked in the plan's schema-v6 follow-ups.
+   */
   intakeInStates(projectId: string, states: readonly KxmIntakeMessageRow["dispatchState"][], limit = 100): KxmIntakeMessageRow[] {
     if (states.length === 0) return [];
     const placeholders = states.map(() => "?").join(", ");