@nowcrew/daemon 0.6.76 → 0.6.77-beta.10

package/dist/main.js

@@ -30,6 +30,7 @@ import { storageMigrationStatusReplay } from "./storage-status-replay.js";
 import { runStorageWorkerCommand } from "./storage-worker-command.js";
 import { probeStorageMigrationRuntime } from "./storage-runtime-readiness.js";
 import { createStorageTargetConfirmationHandler } from "./storage-target-confirmation.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 async function main() {
     const workerResult = await runStorageWorkerCommand(process.argv.slice(2));
     if (workerResult !== null) {
@@ -73,8 +74,16 @@ async function main() {
     if (values["daemon-home"])
         process.env.CREW_DAEMON_HOME = values["daemon-home"];
     let activeDaemonHome;
+    const localHome = resolveDaemonLocalStateRoot({
+        userHome: homedir(),
+        platform: process.platform,
+        explicit: process.env.NOWWORK_LOCAL_HOME,
+        mode: process.env.NOWWORK_LOCAL_HOME_MODE
+            ?? process.env.NOWWORK_STORAGE_MODE
+            ?? (values["daemon-home"] === undefined ? undefined : "legacy"),
+    });
     if (values.profile) {
-        const home = daemonHome();
+        const home = daemonHome(process.env, values.profile);
         activeDaemonHome = home;
         const profile = await loadProfile(values.profile, home);
         if (cmd === "serve") {
@@ -83,6 +92,7 @@ async function main() {
                 platform: process.platform,
                 profile: profile.name,
                 userHome: homedir(),
+                localHome,
                 uid: process.getuid?.(),
                 daemonHome: home,
                 agentsRoot: resolveAgentsRoot(profile.agentsRoot, homedir(), process.platform),
@@ -117,6 +127,23 @@ async function main() {
     }
     const provenance = daemonReleaseProvenance(daemonVersion());
     assertReleaseTagForServerUrl(config.serverUrl, provenance.releaseTag);
+    const storageRuntime = values.profile === undefined
+        ? null
+        : await loadStorageRuntime({
+            profile: values.profile,
+            serverUrl: config.serverUrl,
+            userHome: homedir(),
+            platform: process.platform,
+            environment: process.env,
+        });
+    const runtimeConfig = storageRuntime === null
+        ? config
+        : Object.freeze({
+            ...config,
+            agentsRoot: storageRuntime.layout.agentItemsRoot,
+            reposRoot: storageRuntime.layout.repoRoot,
+            qaReportRoot: storageRuntime.layout.qaReportRoot,
+        });
     if (cmd === "serve") {
         process.stdout.write(formatDaemonLogLine(`🛰️  crew-daemon v${daemonVersion()} (cli v${cliVersion()}, ${provenance.releaseChannel}/${provenance.releaseTag}) ${td("resident, connecting to")} ${config.serverUrl} ${td("control plane")}...`) + "\n");
         const installation = values.profile === undefined
@@ -124,16 +151,7 @@ async function main() {
             : daemonGlobalInstallation(builtDaemonEntry(), process.platform);
         const installationLease = installation === null
             ? null
-            : await acquireDaemonInstallationLease(installation.npmPrefix);
-        const storageRuntime = values.profile === undefined
-            ? null
-            : await loadStorageRuntime({
-                profile: values.profile,
-                serverUrl: config.serverUrl,
-                userHome: homedir(),
-                platform: process.platform,
-                environment: process.env,
-            });
+            : await acquireDaemonInstallationLease(installation.npmPrefix, { localHome });
         const migrationRuntime = values.profile === undefined || activeDaemonHome === undefined || storageRuntime !== null
             ? { ready: false, reason: "not_legacy_source" }
             : await probeStorageMigrationRuntime({
@@ -188,8 +206,9 @@ async function main() {
                 }
                 : undefined;
         await runWithDaemonInstallationLease(installationLease, async () => {
-            const service = serve(config, {
+            const service = serve(runtimeConfig, {
                 ...(values.profile === undefined ? {} : { profileName: values.profile }),
+                localHome,
                 ...(storageMigration === undefined ? {} : { storageMigration }),
             });
             await runServeLifecycle(service);
@@ -209,9 +228,9 @@ async function main() {
         gitSha: provenance.gitSha,
         artifactDigest: provenance.artifactDigest,
         ...(values.profile === undefined ? {} : { profileName: values.profile }),
-        agentsRoot: config.agentsRoot,
+        agentsRoot: runtimeConfig.agentsRoot,
     }); // 一次性 run 模式也上报 SLS(runner 里的埋点生效)
-    const result = await runAgent(config, {
+    const result = await runAgent(runtimeConfig, {
         handle: values.agent,
         channelId: values.channel,
         ...(values.wake ? { wake: values.wake } : {}),

package/dist/managed-service-diagnostics.js

@@ -16,6 +16,7 @@ export async function inspectManagedServiceDiagnostics(input) {
     const inspectLease = input.inspectInstallationLease
         ?? (() => inspectDaemonInstallationLease(input.expectedRecord.npmPrefix, {
             ...(userHome === undefined ? {} : { userHome }),
+            ...(registry.localHome === undefined ? {} : { localHome: registry.localHome }),
         }));
     let services = null;
     let registryCheck;

package/dist/managed-service-registry.js

@@ -5,6 +5,7 @@ import { homedir } from "node:os";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { z } from "zod";
 import { acquireProfileSaveLock } from "./computer-profile-lock.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 const AbsolutePathSchema = z.string().min(1).refine(isAbsolute, "must be an absolute path");
 const ManagedServiceRecordSchema = z.object({
     version: z.literal(1),
@@ -42,11 +43,15 @@ export class ManagedServiceConflictError extends ManagedServiceRegistryError {
         this.owner = owner;
     }
 }
-function registryDirectory(userHome) {
-    return resolve(userHome, ".crew", "daemon", "managed-services");
+function registryDirectory(userHome, localHome) {
+    const root = localHome ?? resolveDaemonLocalStateRoot({
+        userHome,
+        platform: process.platform,
+    });
+    return resolve(root, "daemon", "managed-services");
 }
-export function managedServiceRegistryPath(userHome = homedir()) {
-    return resolve(registryDirectory(userHome), "registry.json");
+export function managedServiceRegistryPath(userHome = homedir(), localHome) {
+    return resolve(registryDirectory(userHome, localHome), "registry.json");
 }
 export async function listManagedServiceDescriptorPaths(platform, userHome = homedir()) {
     const directory = platform === "darwin"
@@ -219,14 +224,14 @@ export function managedServiceConflict(services, candidate) {
 }
 export async function withManagedServiceRegistryLock(options, operation) {
     const userHome = options.userHome ?? homedir();
-    const directory = registryDirectory(userHome);
+    const directory = registryDirectory(userHome, options.localHome);
     const release = await acquireProfileSaveLock(directory, {
         ...(options.lockTimeoutMs === undefined ? {} : { timeoutMs: options.lockTimeoutMs }),
         ...(options.lockRetryMs === undefined ? {} : { retryMs: options.lockRetryMs }),
     });
     let operationError;
     try {
-        const path = managedServiceRegistryPath(userHome);
+        const path = managedServiceRegistryPath(userHome, options.localHome);
         const services = await readRegistryFile(path);
         return await operation({
             services,
@@ -258,7 +263,7 @@ export async function withManagedServiceRegistryLock(options, operation) {
     }
 }
 export async function readManagedServiceRegistry(options = {}) {
-    return readRegistryFile(managedServiceRegistryPath(options.userHome ?? homedir()));
+    return readRegistryFile(managedServiceRegistryPath(options.userHome ?? homedir(), options.localHome));
 }
 export async function registerManagedService(input, options = {}) {
     const candidate = normalizeManagedServiceRecord(input);

package/dist/managed-service-startup.js

@@ -17,7 +17,10 @@ export async function assertManagedServiceStartup(input) {
         ...(input.environment === undefined ? {} : { environment: input.environment }),
     });
     const readRegistry = input.readManagedServices
-        ?? (() => readManagedServiceRegistry({ userHome: input.userHome }));
+        ?? (() => readManagedServiceRegistry({
+            userHome: input.userHome,
+            ...(input.localHome === undefined ? {} : { localHome: input.localHome }),
+        }));
     const listDescriptors = input.listManagedDescriptorPaths
         ?? (() => listManagedServiceDescriptorPaths(input.platform, input.userHome));
     const readDescriptor = input.readServiceDescriptor ?? readServiceDescriptor;

package/dist/npm-command.js

@@ -0,0 +1,9 @@
+import { posix, win32 } from "node:path";
+/** Execute POSIX npm through its owning Node binary so service PATH is irrelevant. */
+export function npmInvocation(platform, nodePath = process.execPath) {
+    const paths = platform === "win32" ? win32 : posix;
+    const npmPath = paths.join(paths.dirname(nodePath), platform === "win32" ? "npm.cmd" : "npm");
+    return platform === "win32"
+        ? { command: npmPath, argsPrefix: [] }
+        : { command: nodePath, argsPrefix: [npmPath] };
+}

package/dist/project-dependencies.js

@@ -111,8 +111,8 @@ async function ensureWorktreeExclude(mainRoot) {
     const suffix = current.length === 0 || current.endsWith("\n") ? "" : "\n";
     await writeFile(excludePath, current + suffix + ".worktrees\n", "utf8");
 }
-async function ensureMainClone(git, repo, repositoryKey, reposRoot) {
-    const mainRoot = resolve(reposRoot, repositoryKey);
+async function ensureMainClone(git, repo, repositoryKey, directoryName, reposRoot) {
+    const mainRoot = resolve(reposRoot, directoryName);
     if (!isWithin(reposRoot, mainRoot) || await existingAncestorIsSymlink(reposRoot, mainRoot)) {
         throw new ProjectDependencyError("project_dependency_checkout_conflict", "repository path is unsafe", repositoryKey);
     }
@@ -123,7 +123,7 @@ async function ensureMainClone(git, repo, repositoryKey, reposRoot) {
     if (info === null) {
         await mkdir(dirname(mainRoot), { recursive: true });
         try {
-            await git.run(["clone", "--no-checkout", repo, mainRoot]);
+            await git.run(["clone", repo, mainRoot]);
         }
         catch {
             await rm(mainRoot, { recursive: true, force: true }).catch(() => { });
@@ -243,7 +243,7 @@ export function createProjectDependencyProvisioner(options = {}) {
             for (const { identity, projects } of grouped.values()) {
                 try {
                     await withProjectDependencyLock(lockRoot, identity.repositoryKey, async () => {
-                        const mainRoot = await ensureMainClone(git, projects[0].repo, identity.repositoryKey, input.reposRoot);
+                        const mainRoot = await ensureMainClone(git, projects[0].repo, identity.repositoryKey, identity.directoryName, input.reposRoot);
                         const seenVersions = new Set();
                         for (const project of projects) {
                             const branchSource = project.branch === undefined ? "remote-default" : "manifest";

package/dist/project-skills/runtime-root-bootstrap.js

@@ -16,12 +16,18 @@ export async function initializeAfterProjectSkillLeaseProtection(input) {
 /**
  * Runs only after execution-journal restart reconciliation has settled. A lease without a terminal
  * journal fact remains durable and prevents the caller from marking Project Skill v2 ready.
+ *
+ * 重连时本进程仍在跑的 execution 合法持有 lease(`liveExecutionIds`):既不释放,也不算 unresolved。
+ * 否则一次网络抖动就会让 daemon 在整条连接上摘掉 Project Skills 能力(incident: 2026-09-02,
+ * 绑定项目的 Agent 全部 execution_spec_incompatible)。
  */
 export async function recoverProjectSkillRuntimeRoots(input) {
     for (const agentRoot of input.agentRoots) {
         await input.roots.recover(agentRoot);
         let unresolvedLease = false;
         await input.leases.recover(agentRoot, async (executionId) => {
+            if (input.liveExecutionIds?.has(executionId))
+                return false;
             const entry = await input.journal.get(executionId);
             const releasable = entry?.state === "completed" || entry?.state === "interrupted";
             if (!releasable)

package/dist/project-skills/runtime-root-startup.js

@@ -22,13 +22,14 @@ export function createProjectSkillRuntimeRootStartup() {
             leases,
             initialize,
         }),
-        recover: async (agentsRoot, journal, protectedExecutionIds) => {
+        recover: async (agentsRoot, journal, protectedExecutionIds, liveExecutionIds) => {
             await recoverProjectSkillRuntimeRoots({
                 agentRoots: await agentRoots(agentsRoot),
                 journal,
                 roots,
                 leases,
                 gc,
+                ...(liveExecutionIds === undefined ? {} : { liveExecutionIds }),
                 currentRootId: async (agentRoot) => (await readAppliedProjectSkillManifest(agentRoot))?.rootId ?? null,
                 afterLeaseRecovery: async () => {
                     const remaining = await initializeAfterProjectSkillLeaseProtection({

package/dist/project-skills/serve-startup.js

@@ -1,6 +1,29 @@
 import { createExecutionJournal } from "../execution-journal.js";
 import { reconcileExecutionJournal } from "../execution-recovery.js";
 import { dslog, flushSlog } from "../slog.js";
+/**
+ * 每次连接 preflight 的 Runtime root / lease 恢复。重连时本进程仍在跑的 execution 合法持有 lease,
+ * 必须当作存活而非孤儿;失败也必须留痕,否则整条连接静默摘掉 Project Skills 能力
+ * (incident: 2026-09-02,绑定项目的 Agent 全部 execution_spec_incompatible)。
+ */
+export function createProjectSkillReconnectRecovery(startup, agentsRoot, journal, protectedExecutionIds, liveExecutionIds) {
+    return async () => {
+        const live = liveExecutionIds();
+        try {
+            await startup.recover(agentsRoot, journal(), protectedExecutionIds, live);
+            return true;
+        }
+        catch (error) {
+            dslog("project_skills.preflight_recovery_failed", "Project Skill runtime root 恢复失败,本连接不宣告 Project Skills 能力", {
+                level: "ERROR",
+                error_code: error.code ?? "unknown",
+                error_message: error.message,
+                live_execution_count: live.size,
+            });
+            return false;
+        }
+    };
+}
 export async function initializeProjectSkillProtectedExecutionJournal(input) {
     return input.startup.initializeAfterLeaseProtection(input.config.agentsRoot, async (snapshot) => {
         input.protectedExecutionIds.clear();

package/dist/repository-identity.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { AbilityRepositoryUrlSchema } from "./agent-ability/types.js";
 const SCP_REPOSITORY = /^git@([^:]+):(.+)$/u;
 const COMMIT = /^[a-f0-9]{40}$/u;
+const DIRECTORY_HASH_LENGTH = 12;
 function normalizePath(value) {
     const path = value.replace(/^\/+|\/+$/gu, "").replace(/\.git$/iu, "");
     if (!path || path.split("/").some((part) => part.length === 0 || part === "." || part === ".." || part.includes("\\"))) {
@@ -31,6 +32,7 @@ export function normalizeRepositoryIdentity(repository) {
         canonical,
         repositoryKey: `repo-${hash}`,
         displayName,
+        directoryName: `${displayName}--${hash.slice(0, DIRECTORY_HASH_LENGTH)}`,
     });
 }
 export function worktreeDirectoryName(branch, resolvedCommit) {

package/dist/runner.js

@@ -1,6 +1,7 @@
 /** Legacy agent orchestration around the business-neutral local executor. */
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
+import { resolveReposRoot } from "./config.js";
 import { mintAgentToken } from "./token.js";
 import { buildSystemPrompt, buildWakePrompt, capMemoryForInject, capWorkLogForInject } from "./prompt.js";
 import { deliverScheduledReport, } from "./scheduled-report.js";
@@ -84,6 +85,8 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             token: credential.token,
             agentId: credential.agentId,
             agentsRoot: config.agentsRoot,
+            reposRoot: resolveReposRoot(config.agentsRoot, config.reposRoot),
+            ...(config.qaReportRoot === undefined ? {} : { qaReportRoot: config.qaReportRoot }),
             cliPath: config.cliPath,
             providerConfig,
             codexHomeMode: config.codexHomeMode,

package/dist/runtime-capabilities.js

@@ -1,3 +1,4 @@
+import { ATTACHMENT_NATIVE_IMAGE_MAX_BYTES } from "./attachment-limits.js";
 export const LOCAL_EXECUTION_RUNTIMES = [
     "claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness",
 ];
@@ -46,7 +47,8 @@ export function routeRuntimeAttachments(runtime, attachments) {
     const lines = attachments.map((attachment) => `- ${JSON.stringify(attachment.path)} (${attachment.mime}, ${attachment.sizeBytes} bytes)`);
     return {
         nativeImagePaths: runtime === "codex"
-            ? attachments.filter((attachment) => attachment.mime.startsWith("image/"))
+            ? attachments.filter((attachment) => attachment.mime.startsWith("image/")
+                && attachment.sizeBytes <= ATTACHMENT_NATIVE_IMAGE_MAX_BYTES)
                 .map((attachment) => attachment.path)
             : [],
         promptSuffix: [

package/dist/serve.js

@@ -42,7 +42,7 @@ import { PROJECT_SKILLS_CAPABILITY } from "./project-skills/types.js";
 import { createAgentProjectionCoordinator } from "./project-skills/agent-projection-coordinator.js";
 import { createProjectSkillRuntimeRootStartup, } from "./project-skills/runtime-root-startup.js";
 import { createProjectSkillControllerReadiness, withProjectSkillCapabilityStatus } from "./project-skills/capability.js";
-import { initializeProjectSkillProtectedExecutionJournal } from "./project-skills/serve-startup.js";
+import { createProjectSkillReconnectRecovery, initializeProjectSkillProtectedExecutionJournal } from "./project-skills/serve-startup.js";
 import { createProjectSkillConnectionCapabilityProvider, createProjectSkillMachineHelloPublisher } from "./project-skills/serve-capability.js";
 import { createAgentAbilityRuntime } from "./agent-ability/runtime.js";
 import { createProjectSkillsReconciler, } from "./project-skills/reconciler.js";
@@ -53,6 +53,7 @@ import { handleRuntimeHealthProbeFrame } from "./runtime-health-handler.js";
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
+import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
 import { attachStorageMigrationRuntime, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
@@ -83,8 +84,10 @@ export function serve(config, opts = {}) {
     let detectedExecutionRuntimes = [], executionRuntimesKnown = false;
     let runtimeFacts = null;
     const runtimeProbe = createRuntimeProbeCoordinator();
+    const localHome = opts.localHome ?? resolveDaemonLocalStateRootFromEnv();
     const hostCoordinator = opts.execution?.hostCoordinator
         ?? createHostExecutionCoordinator({
+            localHome,
             executionSlots: config.executionLimits.maxParallelTotal,
             startupSlots: config.executionLimits.maxStartingTotal,
             startupGapMs: config.executionLimits.startupGapMs,
@@ -215,9 +218,7 @@ export function serve(config, opts = {}) {
         additionalCapabilities: () => managedDaemonCapabilities(updateEligibility),
         probeRuntimeRootStorePrimitive: projectSkillRuntimeRootStartup.probeNativePublicationPrimitiveReadiness,
         initializeController: projectSkillControllerReadiness.ensure,
-        recoverRuntimeRootsAndLeases: async () => projectSkillRuntimeRootStartup
-            .recover(config.agentsRoot, executionJournal, protectedExecutionIds)
-            .then(() => true, () => false),
+        recoverRuntimeRootsAndLeases: createProjectSkillReconnectRecovery(projectSkillRuntimeRootStartup, config.agentsRoot, () => executionJournal, protectedExecutionIds, () => new Set(executionRuns.keys())),
         applyReadiness: projectSkillControllerReadiness.applyPreflight,
     });
     const safeExecutionSend = (frame) => {
@@ -827,9 +828,9 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
-                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string") {
+                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
                     try {
-                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId });
+                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId, machineId: r.machineId });
                         machineHelloPublisher.republish();
                     }
                     catch (error) {

package/dist/slog.js

@@ -15,6 +15,7 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 const FLUSH_INTERVAL_MS = 1500;
 const BATCH_SIZE = 50;
 const SPOOL_MAX_FILES = 50; // spool 目录文件数上限,超出丢最旧(日志非关键数据,防无限膨胀)
@@ -27,6 +28,7 @@ let flushPromise = null;
 let inFlightBatch = [];
 let lastErrorAt = 0;
 let exitHookInstalled = false;
+let localStateRoot;
 function deploymentEnvironment(serverHost) {
     if (serverHost === "nowwork-in.nowcoder.com")
         return "prod";
@@ -40,12 +42,23 @@ function deploymentEnvironment(serverHost) {
     return "unknown";
 }
 function spoolDir() {
-    return process.env.CREW_SLS_SPOOL_DIR ?? join(homedir(), ".crew", "logs", "sls-spool");
+    return process.env.CREW_SLS_SPOOL_DIR ?? join(localStateRoot ?? resolveDaemonLocalStateRoot({
+        userHome: homedir(),
+        platform: process.platform,
+        explicit: process.env.NOWWORK_LOCAL_HOME,
+        mode: process.env.NOWWORK_LOCAL_HOME_MODE ?? process.env.NOWWORK_STORAGE_MODE,
+    }), "logs", "sls-spool");
 }
 /** serve/run 启动时调用一次;disabled(CREW_SLS_LOG=off)则保持 no-op。 */
 export function initSlog(serverUrl, machineToken, identity = {}) {
     if (process.env.CREW_SLS_LOG === "off" || process.env.CREW_SLS_LOG === "0")
         return;
+    localStateRoot = resolveDaemonLocalStateRoot({
+        userHome: homedir(),
+        platform: process.platform,
+        explicit: process.env.NOWWORK_LOCAL_HOME,
+        mode: process.env.NOWWORK_LOCAL_HOME_MODE ?? process.env.NOWWORK_STORAGE_MODE,
+    });
     cfg = { serverUrl: serverUrl.replace(/\/+$/, ""), token: machineToken };
     let serverHost;
     try {

package/dist/storage-control.js

@@ -5,6 +5,8 @@ const IdentitySchema = z.object({
     migrationId: z.string().uuid(),
     environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
     workspaceId: z.string().uuid(),
+    ownerEpoch: z.number().int().positive().safe().optional(),
+    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
 });
 const DoctorRequestSchema = IdentitySchema.extend({ type: z.literal("daemon:storage-doctor") }).strict();
 const MigrateRequestSchema = IdentitySchema.extend({
@@ -26,6 +28,11 @@ export function createStorageControlController(input) {
     const profile = z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u).parse(input.profile);
     const sourceStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.sourceStorageFingerprint);
     const targetStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.targetStorageFingerprint);
+    const ownership = input.ownership === undefined ? undefined : Object.freeze({
+        ownerEpoch: z.number().int().positive().safe().parse(input.ownership.ownerEpoch),
+        ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u)
+            .parse(input.ownership.ownershipClaimFingerprint),
+    });
     const preflights = new Map();
     const preflightRuns = new Map();
     const appliedMigrationIds = new Set();
@@ -39,6 +46,7 @@ export function createStorageControlController(input) {
         environment,
         workspaceId,
         profile,
+        ...(ownership === undefined ? {} : ownership),
         ...extra,
     });
     const failure = (identity, errorCode, error, reopenAdmission = false, extra = {}) => {
@@ -59,7 +67,10 @@ export function createStorageControlController(input) {
             input.onStatusError?.(error, statusFrame);
         }
     };
-    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId;
+    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId
+        && (ownership === undefined
+            || (identity.ownerEpoch === ownership.ownerEpoch
+                && identity.ownershipClaimFingerprint === ownership.ownershipClaimFingerprint));
     const preflightKey = (identity) => `${identity.migrationId}\0${identity.environment}\0${identity.workspaceId}`;
     const runPreflight = (identity, failureFallback = "doctor_failed") => {
         const key = preflightKey(identity);

package/dist/storage-identity.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { STORAGE_LAYOUT_VERSION } from "./storage-layout.js";
+import { createStorageOwnershipClaim } from "./storage-ownership.js";
 function fingerprint(namespace, value) {
     return `sha256:${createHash("sha256").update(`${namespace}\0${value}`).digest("hex")}`;
 }
@@ -14,14 +15,27 @@ export function storageHelloIdentity(input) {
         || installation.runtimeRoot !== layout.runtimeRoot) {
         throw new Error("installation storage identity does not match resolved layout");
     }
+    const workspaceRootFingerprint = fingerprint("workspace-root", layout.workspaceRoot);
+    let ownership;
+    if (input.ownership !== undefined) {
+        const { claimFingerprint: reportedFingerprint, ...claimIdentity } = input.ownership;
+        ownership = createStorageOwnershipClaim(claimIdentity);
+        if (ownership.claimFingerprint !== reportedFingerprint
+            || ownership.workspaceId !== layout.workspaceId
+            || ownership.environment !== layout.environment
+            || ownership.workspaceRootFingerprint !== workspaceRootFingerprint) {
+            throw new Error("storage ownership identity does not match resolved layout");
+        }
+    }
     return Object.freeze({
         storageLayoutVersion: STORAGE_LAYOUT_VERSION,
         storageEnvironment: layout.environment,
         storageWorkspaceId: layout.workspaceId,
         storageIdFingerprint: storageIdFingerprint(installation.storageId),
-        workspaceRootFingerprint: fingerprint("workspace-root", layout.workspaceRoot),
+        workspaceRootFingerprint,
         daemonRootFingerprint: fingerprint("daemon-root", layout.daemonRoot),
         agentRootFingerprint: fingerprint("agent-root", layout.agentItemsRoot),
+        ...(ownership === undefined ? {} : { storageOwnership: ownership }),
         ...(installation.storageMigrationId === undefined
             ? {}
             : { storageMigrationId: installation.storageMigrationId }),

package/dist/storage-layout.js

@@ -121,6 +121,7 @@ export function storageLayout(input) {
         agentItemsRoot: paths.join(workspaceRoot, "agent-items"),
         daemonRoot: paths.join(workspaceRoot, "daemon"),
         repoRoot: paths.join(workspaceRoot, "repos"),
+        qaReportRoot: paths.join(workspaceRoot, "qa-report-server-v2"),
         suiteToolsRoot: paths.join(workspaceRoot, "suite-tools"),
         migrationsRoot: paths.join(persistentRoot, "migrations"),
         runtimeRoot,
@@ -132,7 +133,7 @@ export function agentStorageRoot(layout, agentId) {
 }
 const COMPARABLE_FIELDS = [
     "layoutVersion", "environment", "workspaceId", "persistentRoot", "environmentRoot", "workspaceRoot",
-    "agentItemsRoot", "daemonRoot", "repoRoot", "suiteToolsRoot", "migrationsRoot", "runtimeRoot",
+    "agentItemsRoot", "daemonRoot", "repoRoot", "qaReportRoot", "suiteToolsRoot", "migrationsRoot", "runtimeRoot",
 ];
 export function compareStorageLayout(current, expected) {
     if (current === null || current.layoutVersion !== STORAGE_LAYOUT_VERSION)

package/dist/storage-migration-controller.js

@@ -27,6 +27,8 @@ const ReceiptSchema = z.object({
     environment: z.string().min(1),
     workspaceId: z.string().uuid(),
     profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
+    ownerEpoch: z.number().int().positive().safe().optional(),
+    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
     manifestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
     targetFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
     status: ReceiptStatusSchema,
@@ -37,13 +39,23 @@ const ReceiptSchema = z.object({
     sourceStopAttempted: z.boolean().optional(),
     sourceStopped: z.boolean().optional(),
     targetTouched: z.boolean().optional(),
-}).strict();
+}).strict().superRefine((receipt, context) => {
+    if ((receipt.ownerEpoch === undefined) !== (receipt.ownershipClaimFingerprint === undefined)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "storage receipt ownership identity must be complete" });
+    }
+});
 const MigrationLockSchema = z.object({
     version: z.literal(1),
     migrationId: z.string().uuid(),
     pid: z.number().int().positive(),
     createdAt: z.string().datetime({ offset: true }),
 }).strict();
+const REQUIRED_BACKUP_ARTIFACTS = Object.freeze([
+    "profile.json",
+    "service-descriptor",
+    "managed-service-registry.json",
+    "installations.json",
+]);
 export class StorageMigrationFailure extends Error {
     code;
     receipt;
@@ -204,6 +216,16 @@ function assertOwnedStaging(input) {
     }
 }
 async function backupArtifacts(input, receipt) {
+    const providedNames = new Set(input.backupArtifacts.map((artifact) => artifact.name));
+    const missing = REQUIRED_BACKUP_ARTIFACTS.filter((name) => !providedNames.has(name));
+    if (missing.length > 0) {
+        throw new StorageMigrationFailure("backup_artifact_missing", `required rollback artifacts are missing: ${missing.join(", ")}`);
+    }
+    for (const artifact of input.backupArtifacts) {
+        if (!(await lstat(artifact.path)).isFile()) {
+            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact must be a file");
+        }
+    }
     const directory = join(input.backupsRoot, receipt.migrationId);
     const artifactsDirectory = join(directory, "artifacts");
     await mkdir(artifactsDirectory, { recursive: true, mode: 0o700 });
@@ -217,8 +239,6 @@ async function backupArtifacts(input, receipt) {
             throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact names must be unique safe file names");
         }
         names.add(artifact.name);
-        if (!(await lstat(artifact.path)).isFile())
-            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact must be a file");
         const destination = join(artifactsDirectory, artifact.name);
         await copyFile(artifact.path, destination);
         await chmod(destination, 0o600);
@@ -271,6 +291,7 @@ export async function runStorageMigration(input, dependencies) {
         environment: input.doctor.environment,
         workspaceId: input.doctor.workspaceId,
         profile: input.doctor.profile,
+        ...(input.ownership === undefined ? {} : input.ownership),
         manifestDigest: input.doctor.manifestDigest,
         targetFingerprint: targetFingerprint(input.targetWorkspaceRoot),
         status: "preflight_passed",
@@ -301,7 +322,7 @@ export async function runStorageMigration(input, dependencies) {
         input.assertHealthy?.();
         await transition("backing_up");
         receipt = await backupArtifacts(input, receipt).catch((error) => {
-            failureCode = "backup_failed";
+            failureCode = error instanceof StorageMigrationFailure ? error.code : "backup_failed";
             throw error;
         });
         await writeReceipt(path, receipt);