@moondeck/station 1.0.0 → 1.0.2

package/db/migrations/0031_first_turn_receipts.sql

@@ -0,0 +1,9 @@
+-- First-turn dedup: accepted first-turn delivery ids, so a redelivery after a
+-- cloud crash is acknowledged without queueing a second opening turn.
+CREATE TABLE IF NOT EXISTS `host_first_turn_receipts` (
+	`task_id` text NOT NULL,
+	`first_turn_id` text NOT NULL,
+	`created_at` integer NOT NULL DEFAULT (unixepoch() * 1000),
+	PRIMARY KEY(`task_id`, `first_turn_id`),
+	CONSTRAINT `host_first_turn_receipts_identity` CHECK (length(`task_id`) > 0 AND length(`first_turn_id`) > 0)
+);

package/db/migrations/meta/_journal.json

@@ -218,6 +218,13 @@
       "when": 1793318400000,
       "tag": "0030_credential_cleanup_restops",
       "breakpoints": true
+    },
+    {
+      "idx": 31,
+      "version": "6",
+      "when": 1795910400000,
+      "tag": "0031_first_turn_receipts",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -848,3 +848,24 @@ export const engineAccounts = sqliteTable("host_engine_accounts", {
 
 export type EngineAccountRow = typeof engineAccounts.$inferSelect;
 export type NewEngineAccountRow = typeof engineAccounts.$inferInsert;
+
+// First-turn dedup: ids of first-turn deliveries this station has accepted, so
+// a cloud that crashed before recording its own ack can redeliver without a
+// second opening turn. Written only after the turn was accepted.
+export const hostFirstTurnReceipts = sqliteTable(
+  "host_first_turn_receipts",
+  {
+    taskId: text("task_id").notNull(),
+    firstTurnId: text("first_turn_id").notNull(),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.taskId, t.firstTurnId] }),
+    identity: check(
+      "host_first_turn_receipts_identity",
+      sql`length(${t.taskId}) > 0 AND length(${t.firstTurnId}) > 0`,
+    ),
+  }),
+);

package/images/standard/Dockerfile

@@ -51,6 +51,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       build-essential \
+      avahi-utils \
       ca-certificates \
       curl \
       direnv \
@@ -71,6 +72,7 @@ RUN apt-get update \
       openssh-client \
       pkg-config \
       procps \
+      python3-minimal \
       ripgrep \
       tk-dev \
       tmux \
@@ -89,7 +91,7 @@ RUN apt-get update \
 # uai-playwright volume (downloaded once per host); these are its deps.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
-      libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
+      libnss3 libnss3-tools libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
       libxkbcommon0 libatspi2.0-0 libxcomposite1 libxdamage1 libxfixes3 \
       libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 \
       fonts-liberation fonts-unifont \
@@ -119,7 +121,9 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/b
 # ---------------------------------------------------------------------------
 
 RUN groupadd --gid 1000 node \
- && useradd --uid 1000 --gid 1000 --create-home --home-dir /home/node --shell /bin/bash node
+ && useradd --uid 1000 --gid 1000 --create-home --home-dir /home/node --shell /bin/bash node \
+ && install -d -o node -g node -m 0755 /home/node/.local \
+ && install -d -o node -g node -m 0700 /home/node/.local/state
 
 # ---------------------------------------------------------------------------
 # 3. asdf.

package/images/standard/container/uai-create-node-data

@@ -0,0 +1,6 @@
+#!/bin/sh
+# Run only as node. Only allowlisted legacy root-owned children can be repaired separately.
+umask 077
+for path in /home/node/.local /home/node/.local/share /home/node/.local/share/opencode /home/node/.local/state; do
+  /bin/mkdir -p -m 0700 -- "$path" || printf 'node data setup: could not create %s; checking existing directory metadata\n' "$path" >&2
+done

package/images/standard/container/uai-repair-node-data.py

@@ -0,0 +1,93 @@
+# Root only: never create directories or follow a task-controlled symlink.
+import errno
+import os
+import pwd
+import stat
+import sys
+
+flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC
+node = pwd.getpwnam("node")
+
+def repair(parent, name, display, mode):
+    try:
+        fd = os.open(name, flags, dir_fd=parent)
+    except OSError as error:
+        if error.errno in (errno.ELOOP, errno.ENOTDIR, errno.ENOENT):
+            print("node data repair: skipped " + display + " (missing, symlink or not a directory)", file=sys.stderr)
+            return None
+        raise
+    try:
+        current = os.fstat(fd)
+        if current.st_uid != node.pw_uid:
+            owner = os.fstat(parent)
+            # Node already controls entries in this parent. Transfer only
+            # these legacy application directories, never their contents.
+            legacy = (
+                current.st_uid == 0
+                and owner.st_uid == node.pw_uid
+                and current.st_dev == owner.st_dev
+                and display in (
+                    "/home/node/.local/state",
+                    "/home/node/.local/share",
+                    "/home/node/.local/share/opencode",
+                )
+            )
+            if not legacy:
+                print("node data repair: skipped " + display + " (directory ownership or filesystem is not eligible; operator inspection required)", file=sys.stderr)
+                os.close(fd)
+                return None
+        os.fchown(fd, node.pw_uid, node.pw_gid)
+        os.fchmod(fd, mode)
+    except BaseException:
+        os.close(fd)
+        raise
+    return fd
+
+fds = []
+try:
+    root = os.open("/", flags)
+    fds.append(root)
+    # Pin the root-owned home chain too; no absolute-path traversal below it.
+    parent = root
+    for component in ("home", "node"):
+        try:
+            parent = os.open(component, flags, dir_fd=parent)
+        except OSError as error:
+            if error.errno not in (errno.ELOOP, errno.ENOTDIR, errno.ENOENT):
+                raise
+            print("node data repair: skipped home anchor (missing or redirected)", file=sys.stderr)
+            sys.exit(0)
+        fds.append(parent)
+    local = repair(parent, ".local", "/home/node/.local", 0o755)
+    if local is not None:
+        fds.append(local)
+        share = repair(local, "share", "/home/node/.local/share", 0o755)
+        if share is not None:
+            fds.append(share)
+            opencode = repair(share, "opencode", "/home/node/.local/share/opencode", 0o755)
+            if opencode is not None:
+                fds.append(opencode)
+                # docker cp creates root-owned credential files. Repair only
+                # these regular files through the pinned directory, never -R.
+                for name in ("auth.json", "config.json"):
+                    try:
+                        fd = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC, dir_fd=opencode)
+                    except OSError as error:
+                        if error.errno in (errno.ELOOP, errno.ENOTDIR, errno.ENOENT, errno.ENXIO):
+                            continue
+                        raise
+                    try:
+                        current = os.fstat(fd)
+                        if stat.S_ISREG(current.st_mode) and current.st_nlink == 1 and current.st_uid in (0, node.pw_uid):
+                            os.fchown(fd, node.pw_uid, node.pw_gid)
+                            os.fchmod(fd, 0o600)
+                        else:
+                            print("node data repair: skipped OpenCode " + name + " (not a single-link root/node regular file)", file=sys.stderr)
+                    finally:
+                        os.close(fd)
+        state = repair(local, "state", "/home/node/.local/state", 0o700)
+        if state is not None:
+            fds.append(state)
+finally:
+    for fd in reversed(fds):
+        os.close(fd)

package/lib/agent-cli.ts

@@ -1272,12 +1272,30 @@ async function main() {
       out(action + " #" + t.shortId + ": " + t.text);
       break;
     }
-    case "preview add": {
+    case "preview add":
+    case "preview update": {
       const name = pos[0] || flags.name;
       const port = Number(pos[1] || flags.port);
-      if (!name || !Number.isInteger(port)) { console.error("moondeck: preview add <name> <containerPort>"); process.exit(1); }
-      const r = await api("POST", "/api/agent/previews", { name, containerPort: port });
-      out("preview '" + r.name + "' on port " + r.containerPort + " — turn it on with: moondeck preview enable " + r.name);
+      if (!name || !Number.isInteger(port) || port < 1 || port > 65535) { console.error("moondeck: preview " + action + " <name> <containerPort>"); process.exit(1); }
+      if (Object.keys(flags).some(k => !["name", "port", "upstream-host", "https"].includes(k)) || (flags.https !== undefined && flags.https !== "true") || (flags["upstream-host"] !== undefined && !flagValue(flags["upstream-host"]))) {
+        console.error("moondeck: preview " + action + " <name> <port> [--upstream-host <hostname>] [--https]"); process.exit(1);
+      }
+      const upstream = {
+        ...(flags["upstream-host"] !== undefined ? { upstreamHost: flags["upstream-host"] } : {}),
+        ...(flags.https === "true" ? { upstreamTls: true } : {}),
+      };
+      const r = action === "add"
+        ? await api("POST", "/api/agent/previews", { name, containerPort: port, ...upstream })
+        : await api("PATCH", "/api/agent/previews/" + encodeURIComponent(name), { containerPort: port, ...upstream });
+      out("preview '" + r.name + "' on port " + r.containerPort + (action === "add" ? " — turn it on with: moondeck preview enable " + r.name : " — updated"));
+      if (upstream.upstreamHost || upstream.upstreamTls) console.error("Portless users: outside self tasks, start with portless proxy start --lan (or PORTLESS_LAN=1; enables mDNS). Check for LAN mode disabled; if printed, use an updated Moondeck image with avahi-utils, or ask the operator to install it and fix any reported LAN-IP problem, then restart. Use its printed LAN hostname (usually mta.local) and proxy port: HTTPS 443, HTTP 80, or your explicit -p port (e.g. 1355).");
+      break;
+    }
+    case "preview remove": {
+      const name = pos[0] || flags.name;
+      if (!name) { console.error("moondeck: preview remove <name>"); process.exit(1); }
+      await api("DELETE", "/api/agent/previews/" + encodeURIComponent(name));
+      out("removed preview '" + name + "'");
       break;
     }
     case "preview enable":
@@ -1465,7 +1483,10 @@ async function main() {
         "  moondeck review report --pr <number|URL> --head <full-sha> --must <n> --should <n> --nits <n> --verdict approve|changes [--summary text] [--assignment id] [--revision n]",
         "  moondeck crew outcome @agent accepted|reworked|failed [--note text] [--assignment id] [--revision n]",
         "      Review reports require an authorized exact-head assignment. Outcomes are Secretary assessments, never human acceptance.",
-        "  moondeck preview add <name> <containerPort>",
+        "  moondeck preview add <name> <containerPort> [--upstream-host <h>] [--https]",
+        "  moondeck preview update <name> <containerPort> [--upstream-host <h>] [--https]",
+        "  moondeck preview remove <name>",
+        "    Portless outside self: portless proxy start --lan or PORTLESS_LAN=1 (mDNS); use printed *.local Host and proxy port 443/80, or explicit -p 1355. Check for LAN mode disabled; update the image/install avahi-utils and resolve the reported LAN issue, then restart.",
         "  moondeck preview enable|disable <name>      (turn it on; prints its URL)",
         "  moondeck preview public|private <name>      (public: a link anyone can open)",
         "  moondeck project list | show <id|slug>",

package/lib/browser-testing.ts

@@ -1472,6 +1472,9 @@ export async function setupBrowserTesting(
 
     const rootWorkerEnv = {
       ...authorityEnv,
+      // HOME remains node's for asdf resolution; root-run tools must keep
+      // their XDG state out of the task user's home.
+      XDG_STATE_HOME: "/root/.local/state",
       NPM_CONFIG_CACHE: "/tmp/uai-root-npm-cache",
       npm_config_cache: "/tmp/uai-root-npm-cache",
       NPM_CONFIG_LOGS_DIR: "/tmp/uai-root-npm-cache/_logs",
@@ -1505,6 +1508,8 @@ export async function setupBrowserTesting(
           // both cases aligned so npm's case-insensitive config lookup cannot
           // fall back to node's private cache or logs directory.
           "-e",
+          "XDG_STATE_HOME=/root/.local/state",
+          "-e",
           "NPM_CONFIG_CACHE=/tmp/uai-root-npm-cache",
           "-e",
           "npm_config_cache=/tmp/uai-root-npm-cache",

package/lib/container-runtime.ts

@@ -1099,14 +1099,12 @@ async function detectPinnedRuntime(
     // id; a wiped or replaced toolchain state must fail closed exactly like a
     // replaced Docker daemon at the same socket.
     const probe = await probeAppleSystem(deps);
-    if (
-      probe === null ||
-      probe.endpoint !== host ||
-      pinnedDockerEngineId === null ||
-      probe.installationId !== pinnedDockerEngineId
-    ) {
+    if (probe === null || pinnedDockerEngineId === null) {
       return pinnedRuntimeUnavailable(preference);
     }
+    if (probe.endpoint !== host || probe.installationId !== pinnedDockerEngineId) {
+      return pinnedRuntimeUnavailable(preference, "replaced");
+    }
     applyPinnedAppleRuntimeEnvironment(pinnedAppleCliPath);
     return {
       status: "ready",
@@ -1117,13 +1115,12 @@ async function detectPinnedRuntime(
 
   applyPinnedDockerHost(host);
   const proof = await probeDocker({ host }, deps);
-  if (
-    proof === null ||
-    pinnedDockerEngineId === null ||
-    proof.engineId !== pinnedDockerEngineId
-  ) {
+  if (proof === null || pinnedDockerEngineId === null) {
     return pinnedRuntimeUnavailable(preference);
   }
+  if (proof.engineId !== pinnedDockerEngineId) {
+    return pinnedRuntimeUnavailable(preference, "replaced");
+  }
   return {
     status: "ready",
     preference: preference === "auto" ? "auto" : "docker",
@@ -1328,9 +1325,29 @@ function isLocalDockerEndpoint(host: string): boolean {
   return host.slice("unix://".length).startsWith("/");
 }
 
+/**
+ * The pinned runtime can't be used. "unresponsive": it didn't answer. "replaced":
+ * it answers, but as a different engine (Docker's daemon id, the Apple
+ * system's installation id or state root) than the one this process pinned
+ * at start, e.g. Docker or OrbStack was reset. That one used to read "not
+ * responding" too, while `docker info` answered fine (the MacBook Air
+ * station, 2026-11-03); a recheck can't adopt a new engine, only a restart.
+ */
 function pinnedRuntimeUnavailable(
   preference: RuntimePreference,
+  cause: "unresponsive" | "replaced" = "unresponsive",
 ): ContainerRuntimeState {
+  if (cause === "replaced") {
+    const what = pinnedRuntimeProvider === "apple-container" ? "Apple container runtime" : "Docker engine";
+    return {
+      status: "no-runtime",
+      preference,
+      message:
+        `A different ${what} now answers than the one this Moondeck Station process started with ` +
+        `(it was restarted, reset or replaced). Run \`${RUNTIME_RESTART_COMMAND}\` to use it.`,
+      action: RUNTIME_RESTART_COMMAND,
+    };
+  }
   return {
     status: "no-runtime",
     preference,

package/lib/env-schema.ts

@@ -16,6 +16,9 @@
  *   first item belongs to the document header.
  * - `@name` is `@name=true`. Value decorators are single-use; function calls
  *   (`@name(...)`) accumulate.
+ * - Calls and literals in decorators may continue on following `#` lines;
+ *   quoted arguments stay on one line. Continuations are bounded and reject
+ *   a new directive or block boundary before the structure closes.
  *
  * Fail closed (ADR-153): an @proxy Uai cannot fully interpret makes its key
  * `unsupported`, so the key is withheld; it never reads as no directive, which
@@ -61,6 +64,11 @@ type Failure = KnownProjectEnvSchemaUnavailableReason;
 
 /** A schema file larger than this is not read: no repository needs one. */
 export const MAX_ENV_SCHEMA_BYTES = 256 * 1024;
+/** Bounds for one continued decorator comment: physical lines, and UTF-8
+ * bytes from its initial @ through the end of its closing line, after
+ * normalizing CRLF to LF as upstream does. */
+export const MAX_ENV_SCHEMA_DECORATOR_LINES = 128;
+export const MAX_ENV_SCHEMA_DECORATOR_BYTES = 16 * 1024;
 /** A minted placeholder fills at least this many characters at random. */
 export const PLACEHOLDER_RANDOM_CHARACTERS = 32;
 
@@ -102,11 +110,13 @@ const MAX_NESTING = 16;
 
 class SyntaxFailure extends Error {}
 
-/** One line's decorators, or a value's call, list or object. Throws
+/** A comment's decorators, or a value's call, list or object. Throws
  *  SyntaxFailure on anything it cannot read. */
 class DecoratorReader {
   private pos: number;
   private depth = 0;
+  private readonly start: number;
+  private decoratorLines = 1;
   /** A value's structure: inside it, line breaks and `#` comments are blanks. */
   private readonly multiline: boolean;
 
@@ -115,18 +125,19 @@ class DecoratorReader {
     options: { start?: number; value?: boolean } = {},
   ) {
     this.pos = options.start ?? 0;
+    this.start = this.pos;
     this.multiline = options.value === true;
   }
 
   /** Decorators up to a comment. */
-  readAll(into: Decorator[]): void {
+  readAll(into: Decorator[]): number {
     for (;;) {
       this.skipSpaces();
-      if (this.done() || this.peek() === "#") return;
+      if (this.done() || this.peek() === "#" || this.peek() === "\n" || this.atCrLf()) return this.pos;
       if (this.peek() !== "@") {
         // Stray text, as upstream reads it: skipped, and the decorators after
         // it still count. It may not hold an `@` (upstream refuses that).
-        while (!this.done() && !isBlankChar(this.peek())) {
+        while (!this.done() && !isBlankChar(this.peek()) && this.peek() !== "\n" && !this.atCrLf()) {
           if (this.peek() === "@") throw new SyntaxFailure();
           this.pos += 1;
         }
@@ -148,7 +159,7 @@ class DecoratorReader {
       decorator.source = this.text.slice(start, this.pos);
       into.push(decorator);
       // Decorators end at whitespace or a comment; anything glued on is junk.
-      if (!this.done() && !isBlankChar(this.peek()) && this.peek() !== "#") throw new SyntaxFailure();
+      if (!this.done() && !isBlankChar(this.peek()) && this.peek() !== "#" && this.peek() !== "\n" && !this.atCrLf()) throw new SyntaxFailure();
     }
   }
 
@@ -182,6 +193,31 @@ class DecoratorReader {
         this.pos += char === "\n" ? 1 : 2;
       } else if (this.multiline && this.depth > 0 && char === "#") {
         while (!this.done() && this.peek() !== "\n" && !this.atCrLf()) this.pos += 1;
+      } else if (!this.multiline && this.depth > 0) {
+        // env-spec's _decWs (packages/env-spec-parser/grammar.peggy):
+        // line breaks require a fresh #, and an
+        // interior # comment must end with such a continuation. #tag is
+        // an argument, not a comment. Never strip hashes inside values.
+        if (char === "#" && !/[A-Za-z0-9]/.test(this.text[this.pos + 1] ?? "")) {
+          while (!this.done() && this.peek() !== "\n" && !this.atCrLf()) this.pos += 1;
+        }
+        if (this.peek() !== "\n" && !this.atCrLf()) return;
+        this.pos += this.peek() === "\n" ? 1 : 2;
+        // Deliberately stricter than upstream: no indented continuation
+        // comments, consistent with our standalone comment rule.
+        if (this.peek() !== "#") throw new SyntaxFailure();
+        this.pos += 1;
+        this.skipBlanks();
+        // Deliberately stricter than upstream: a later directive or
+        // divider must not become an argument of an unfinished structure.
+        // Scoped plugin names (@varlock/...) remain valid arguments.
+        const rest = this.text.slice(this.pos);
+        if ((/^@[A-Za-z]/.test(rest) && !/^@[A-Za-z0-9_-]+\//.test(rest)) || /^[-=*#]{3}/.test(rest)) throw new SyntaxFailure();
+        this.decoratorLines += 1;
+        const newline = this.text.indexOf("\n", this.pos);
+        const lineEnd = newline === -1 ? this.text.length : newline - (this.text[newline - 1] === "\r" ? 1 : 0);
+        if (this.decoratorLines > MAX_ENV_SCHEMA_DECORATOR_LINES ||
+            Buffer.byteLength(this.text.slice(this.start, lineEnd).replaceAll("\r\n", "\n"), "utf8") > MAX_ENV_SCHEMA_DECORATOR_BYTES) throw new SyntaxFailure();
       } else {
         return;
       }
@@ -253,12 +289,11 @@ class DecoratorReader {
     for (;;) {
       if (this.done()) throw new SyntaxFailure();
       const char = this.peek();
-      if (char === "\\" && this.pos + 1 < this.text.length) {
-        const escaped = this.text[this.pos + 1]!;
-        // Not even escaped: a string never spans lines. (A lone CR is text;
-        // the LF of an escaped CRLF fails below, as any line break does.)
-        if (escaped === "\n") throw new SyntaxFailure();
-        out += escaped === quote || escaped === "\\" ? escaped : `\\${escaped}`;
+      // Upstream escapes only the wrapping quote. A backslash before any
+      // other character is literal, including another backslash: the next
+      // backslash may itself escape a quote and keep this string open.
+      if (char === "\\" && this.text[this.pos + 1] === quote) {
+        out += quote;
         this.pos += 2;
         continue;
       }
@@ -345,11 +380,14 @@ class DecoratorReader {
 }
 
 /** A decorator comment's decorators, or null if any of it is unreadable. */
-function readDecorators(content: string): Decorator[] | null {
+function readDecorators(source: Source, index: number, content: string): { decorators: Decorator[]; lastLine: number } | null {
   const decorators: Decorator[] = [];
   try {
-    new DecoratorReader(content).readAll(decorators);
-    return decorators;
+    const start = source.lineStarts[index]! + source.lines[index]!.length - content.length;
+    const end = new DecoratorReader(source.text, { start }).readAll(decorators);
+    let lastLine = index;
+    while (lastLine + 1 < source.lines.length && source.lineStarts[lastLine + 1]! < end) lastLine += 1;
+    return { decorators, lastLine };
   } catch (error) {
     if (error instanceof SyntaxFailure) return null;
     throw error;
@@ -451,8 +489,8 @@ function endOfValue(
     let i = 0;
     while (i < text.length) {
       // An escaped delimiter (\" in "...", \""" in """...""") does not close.
-      if (text[i] === "\\" && (fence.length === 1 || text.startsWith(fence, i + 1))) {
-        i += 1 + (fence.length === 1 ? 1 : fence.length);
+      if (text[i] === "\\" && text.startsWith(fence, i + 1)) {
+        i += 1 + fence.length;
         continue;
       }
       if (lineIndex > index || fence.length === 1) {
@@ -507,13 +545,13 @@ function read(text: string): Reading | Failure {
     if (block.decorators.length > 0) detached.push(block);
     block = emptyBlock();
   };
-  /** False when the decorators cannot be read: upstream refuses the file,
+  /** Null when the decorators cannot be read: upstream refuses the file,
    *  and what they say about routing is unknown. */
-  const addDecorators = (into: Block, content: string): boolean => {
-    const decorators = readDecorators(content);
-    if (decorators === null) return false;
-    into.decorators.push(...decorators);
-    return true;
+  const addDecorators = (into: Block, index: number, content: string): number | null => {
+    const result = readDecorators(source, index, content);
+    if (result === null) return null;
+    into.decorators.push(...result.decorators);
+    return result.lastLine;
   };
 
   for (let index = 0; index < lines.length; index += 1) {
@@ -526,7 +564,11 @@ function read(text: string): Reading | Failure {
       const content = raw.slice(1).replace(/^[ \t]+/, "");
       // A divider, as upstream has it: three of - = * #, in any mix.
       if (/^[-=*#]{3}/.test(content)) endBlock();
-      else if (content.startsWith("@") && !addDecorators(block, content)) return "schema_malformed";
+      else if (content.startsWith("@")) {
+        const lastLine = addDecorators(block, index, content);
+        if (lastLine === null) return "schema_malformed";
+        index = lastLine;
+      }
       continue;
     }
     // Only an item may be indented, and only with spaces and tabs: upstream
@@ -549,7 +591,11 @@ function read(text: string): Reading | Failure {
       const comment = end.comment.replace(/^[ \t]+/, "");
       // Upstream refuses a divider after a value.
       if (/^[-=*#]{3}/.test(comment)) return "schema_malformed";
-      if (comment.startsWith("@") && !addDecorators(attached, comment)) return "schema_malformed";
+      if (comment.startsWith("@")) {
+        const lastLine = addDecorators(attached, index, comment);
+        if (lastLine === null) return "schema_malformed";
+        index = lastLine;
+      }
     }
     items.push({ key: item[1]!, block: attached });
   }

package/lib/first-turn-receipts.ts

@@ -0,0 +1,62 @@
+import { and, eq } from "drizzle-orm";
+
+import { getDb, schema } from "./db";
+
+/** Has this station already accepted the first-turn delivery `firstTurnId`? */
+export function hasFirstTurnReceipt(taskId: string, firstTurnId: string): boolean {
+  return (
+    getDb()
+      .select({ taskId: schema.hostFirstTurnReceipts.taskId })
+      .from(schema.hostFirstTurnReceipts)
+      .where(
+        and(
+          eq(schema.hostFirstTurnReceipts.taskId, taskId),
+          eq(schema.hostFirstTurnReceipts.firstTurnId, firstTurnId),
+        ),
+      )
+      .get() !== undefined
+  );
+}
+
+/** Remember an ACCEPTED first-turn delivery (call only after acceptance). */
+export function recordFirstTurnReceipt(taskId: string, firstTurnId: string): void {
+  getDb()
+    .insert(schema.hostFirstTurnReceipts)
+    .values({ taskId, firstTurnId })
+    .onConflictDoNothing()
+    .run();
+}
+
+const inFlight = new Map<string, Promise<unknown>>();
+
+/**
+ * Run `deliver` at most once per (task, firstTurnId): a repeat of an accepted
+ * id is acknowledged without delivering, and a repeat that arrives while the
+ * first is still being accepted waits for it, then re-checks. A failed
+ * delivery records nothing, so the cloud's retry delivers for real.
+ */
+export async function deliverFirstTurnOnce<R extends { ok: boolean }>(
+  taskId: string,
+  firstTurnId: string,
+  deliver: () => Promise<R>,
+  ackedResult: () => R,
+): Promise<R> {
+  const key = `${taskId}\u0000${firstTurnId}`;
+  for (;;) {
+    const pending = inFlight.get(key);
+    if (!pending) break;
+    await pending.catch(() => undefined);
+  }
+  if (hasFirstTurnReceipt(taskId, firstTurnId)) return ackedResult();
+  const run = (async () => {
+    const result = await deliver();
+    if (result.ok) recordFirstTurnReceipt(taskId, firstTurnId);
+    return result;
+  })();
+  inFlight.set(key, run);
+  try {
+    return await run;
+  } finally {
+    inFlight.delete(key);
+  }
+}

package/lib/machine-provider-local.ts

@@ -197,6 +197,8 @@ export function createLocalMachineProvider(
       const args = [
         "run",
         "-d",
+        "--sysctl",
+        "net.ipv4.ip_unprivileged_port_start=80",
         "--name",
         name,
         "--label",

package/lib/node-state.ts

@@ -0,0 +1,17 @@
+import { readFileSync } from "node:fs";
+
+// Task-up.sh loads these same packaged assets: no inline repair copies.
+export const NODE_STATE_SETUP_SCRIPT = readFileSync(new URL("../images/standard/container/uai-repair-node-data.py", import.meta.url), "utf8");
+export const NODE_DATA_CREATE_SCRIPT = readFileSync(new URL("../images/standard/container/uai-create-node-data", import.meta.url), "utf8");
+
+/** Normalize node-owned parents, create as node, then normalize new metadata. */
+export async function prepareNodeData(exec: (user: "root" | "node", argv: [string, ...string[]]) => Promise<number | null>): Promise<boolean> {
+  for (const [user, argv] of [
+    ["root", ["/usr/bin/python3", "-I", "-c", NODE_STATE_SETUP_SCRIPT]],
+    ["node", ["/bin/sh", "-c", NODE_DATA_CREATE_SCRIPT]],
+    ["root", ["/usr/bin/python3", "-I", "-c", NODE_STATE_SETUP_SCRIPT]],
+  ] as const) {
+    if (await exec(user, [...argv]) !== 0) return false;
+  }
+  return true;
+}