@runuai/host 0.9.13 → 0.9.42

package/lib/orchestrator.ts

@@ -15,10 +15,18 @@
  * instead of leaking a second orchestrator.
  */
 
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import {
+  existsSync,
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import { inArray } from "drizzle-orm";
 
@@ -33,15 +41,52 @@ import {
   type Roster,
   type RosterAgent,
 } from "./agents/types";
-import { ACTIVE_STATUSES } from "./task-status";
+import { ACTIVE_STATUSES, isActive, isOnDashboard } from "./task-status";
+import { isSafeHostTaskId } from "./task-identity";
 import { getHostTask, upsertHostTask } from "./runtime-state";
 import { clearRefresh, reconcileTaskGitAuth } from "./github-tokens";
 import { ensureTaskSshIdentity, setupTaskGitIdentity } from "./git-identity";
 import { dockerCli } from "./docker-exec";
+import {
+  taskContainerBackend,
+  taskContainerCli,
+} from "./task-container-cli";
+import {
+  RUNTIME_AUTHORITY_ENV,
+  runtimeAuthorityDockerExecArgs,
+} from "./runtime-authority";
+import {
+  backgroundContainerWorkAllowed,
+  ContainerRuntimeUnavailableError,
+} from "./runtime-guard";
+import {
+  appleContainerRuntimeBinding,
+  initializeContainerRuntime,
+  pinnedContainerRuntimeProvider,
+  suspendContainerRuntime,
+} from "./container-runtime";
+import {
+  reconstructPersistedTaskEnvironment,
+  setAppleTaskEnvironmentRecoveryDriver,
+  setDockerTaskEnvironmentRecoveryDriver,
+} from "./task-environment";
+import {
+  appleCliRunner,
+  appleTaskContainerName,
+  parseAppleTaskEnvironmentLocator,
+} from "./task-environment/apple-container";
+import { parseDockerTaskEnvironmentLocator } from "./task-environment/docker";
+import type {
+  TaskEnvironmentDescriptor,
+  TaskEnvironmentHandle,
+  TaskEnvironmentRecoveryContext,
+  TaskEnvironmentRecoveryResult,
+} from "./task-environment/types";
 import {
   containerSkillFile,
   installedSkillPath,
   installPackageSkills,
+  type SkillExec,
   writeAgentSkills,
 } from "./skills";
 import {
@@ -67,6 +112,11 @@ import {
 } from "./engine-accounts";
 import { clearTaskGatewayAcl, setupMcpTaskConfig } from "./mcp-gateway";
 import { stopPreviewSidecars } from "./preview-sidecar";
+import {
+  agentClisReady,
+  standardImageCorepackVersionPath,
+  standardImageRuntimeMaterializerPath,
+} from "./standard-image";
 import { env } from "./env";
 import type {
   ChannelEnsureInput,
@@ -102,6 +152,11 @@ interface Channel {
   sessions: Map<string, AgentSession>;
   /** Session-spawn inputs, kept so sessions can be started lazily. */
   containerName: string;
+  /** Opaque provider-owned boundary used only for agent process creation. */
+  agentEnvironment: Promise<TaskEnvironmentHandle<unknown>> | null;
+  /** Settled handle for later config/setup passes; avoids a new await on
+   * legacy/bootstrap paths. */
+  agentHandle: TaskEnvironmentHandle<unknown> | null;
   /** Per-agent system preamble (channel briefing + assembled persona). */
   preambles: Map<string, string>;
   /** Per-agent first-turn message — only agents whose `initialPrompt` is
@@ -167,11 +222,20 @@ interface Channel {
   /** Agents with a delivered turn that has not reached a terminal event yet.
    *  Unlike openTurns, this covers thinking/tool/permission time before text. */
   activeTurns: Map<string, number>;
+  /** Exact accepted prompts still owned by each runner generation, in send
+   * order. Open mode deliberately permits more than one; a process-level
+   * daemon-loss event must replay all of them rather than only `lastPrompt`. */
+  acceptedPrompts: Map<string, AcceptedPrompt[]>;
   /** Crew replies waiting for the designated Secretary's current turn
    *  boundary. Adapters do not share one mid-turn input contract, so only this
    *  cross-lane role is serialized at the host boundary; open mode keeps its
    *  legacy immediate-concurrent delivery behavior. */
   pendingPrompts: Map<string, string[]>;
+  /** Prompts accepted by channelDeliver whose final session boundary rejected
+   * specifically because the container runtime became unavailable. */
+  runtimeDeferredPrompts: Map<string, string[]>;
+  /** Missing/blocked sessions to reconcile exactly once after runtime ready. */
+  runtimeDeferredAgents: Set<string>;
   /** Agents whose current turn was interrupted (ESC) — their next
    *  turn_complete is flagged `aborted` so the cloud DISCARDS the buffered
    *  half-turn instead of delivering it to @-mentioned peers. */
@@ -230,6 +294,10 @@ interface Channel {
   rotations: Map<string, number>;
 }
 
+interface AcceptedPrompt {
+  text: string;
+}
+
 /** Hard cap on automatic respawns per agent per channel lifetime. */
 const MAX_RESPAWNS_PER_AGENT = 5;
 /** ADR-076: hard cap on account rotations per agent between successful turns. */
@@ -241,6 +309,43 @@ const RESPAWN_COOLDOWN_MS = 10 * 60_000;
  *  retry would spin npx continuously for the life of a broken task. */
 const BROWSER_RETRY_COOLDOWN_MS = 60_000;
 
+/**
+ * A runner can be the first observable casualty of a daemon loss, before any
+ * command/tunnel path invalidates the cached ready verdict. Prove the daemon
+ * before classifying a terminal agent event as an agent crash. A failed proof
+ * poisons the runtime generation synchronously; normal detection/recovery owns
+ * the eventual ready edge and deferred-prompt replay.
+ */
+async function agentTerminationLostContainerRuntime(): Promise<boolean> {
+  if (!backgroundContainerWorkAllowed()) return true;
+  let reachable = false;
+  try {
+    // Backend-aware liveness: `docker` does not exist on an apple host, and
+    // an ENOENT here would poison the generation on EVERY abnormal agent
+    // termination (found in the 2026-08-18 spawn-docker-ENOENT sweep).
+    const proof = taskContainerBackend().apple
+      ? await taskContainerCli(["system", "status"], { timeoutMs: 10_000 })
+      : await dockerCli(["info", "--format", "{{.ServerVersion}}"], {
+          timeoutMs: 10_000,
+        });
+    reachable = proof.status === 0;
+  } catch {
+    reachable = false;
+  }
+  if (!backgroundContainerWorkAllowed()) return true;
+  if (reachable) return false;
+
+  suspendContainerRuntime(true);
+  void initializeContainerRuntime().catch((err) =>
+    console.warn(
+      `[orchestrator] container runtime recheck after agent termination failed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    ),
+  );
+  return true;
+}
+
 /** Substrings in an agent's error output that mean "config was
  *  unlinked between runs" — repair-and-respawn covers the common
  *  Docker-Desktop-macOS race where Claude's atomic writes briefly
@@ -530,6 +635,8 @@ export class Orchestrator {
       secretaryAgentId: spec.secretaryAgentId,
       sessions: new Map(),
       containerName: `task-${taskId.toLowerCase()}-app-1`,
+      agentEnvironment: null,
+      agentHandle: null,
       preambles,
       firstTurns,
       sessionsReady: null,
@@ -547,7 +654,10 @@ export class Orchestrator {
       closed: false,
       openTurns: new Set(),
       activeTurns: new Map(),
+      acceptedPrompts: new Map(),
       pendingPrompts: new Map(),
+      runtimeDeferredPrompts: new Map(),
+      runtimeDeferredAgents: new Set(),
       interrupted: new Set(),
       respawns: new Map(),
       respawnLastAt: new Map(),
@@ -587,6 +697,7 @@ export class Orchestrator {
     // copy cannot land after browser/MCP materialization and erase config.
     await taskRecoveryComplete(channel.taskId);
     if (!this.isActiveChannel(channel)) return false;
+    if (!backgroundContainerWorkAllowed()) return false;
     // Memoized: every caller awaits the SAME in-flight start, so a concurrent
     // deliver() can't observe "ready" while the sessions map is still empty
     // (startSessions awaits docker work before populating it — the old boolean
@@ -632,6 +743,7 @@ export class Orchestrator {
       await this.ensureMcpConfig(channel);
       if (!this.isActiveChannel(channel)) return false;
       await this.reconcileSessions(channel);
+      this.drainRuntimeDeferredAgentWork(channel);
     }
     // The initial-start promise stays memoized after a healthy boot. A later
     // fatal exit can therefore leave the designated Secretary missing even
@@ -735,6 +847,10 @@ export class Orchestrator {
       changed: false,
     };
     if (!this.isActiveChannel(channel)) return unavailable;
+    if (!backgroundContainerWorkAllowed()) {
+      this.scheduleBrowserRetry(channel);
+      return unavailable;
+    }
     const requestedBrowser = channel.browserTesting;
     const requestedHasCodex =
       hasCodex || channel.roster.some((agent) => agent.kind === "codex");
@@ -818,10 +934,17 @@ export class Orchestrator {
           }
           let copiedOrUnknown = false;
           try {
-            const provisioned = await provisionEngineAccounts(
-              channel.containerName,
-              requestedKinds,
-            );
+            const provisioned = channel.agentHandle
+              ? await provisionEngineAccounts(
+                  channel.containerName,
+                  requestedKinds,
+                  {},
+                  channel.agentHandle,
+                )
+              : await provisionEngineAccounts(
+                  channel.containerName,
+                  requestedKinds,
+                );
             copiedOrUnknown =
               provisioned.copied > 0 || provisioned.mayHaveMutated;
             if (provisioned.failed > 0) {
@@ -873,12 +996,20 @@ export class Orchestrator {
           return unavailable;
         }
         coverage.browserAttempted = true;
-        setup = await setupBrowserTesting(
-          channel.taskId,
-          channel.containerName,
-          requestedHasCodex,
-          requestedHomes,
-        );
+        setup = channel.agentHandle
+          ? await setupBrowserTesting(
+              channel.taskId,
+              channel.containerName,
+              requestedHasCodex,
+              requestedHomes,
+              channel.agentHandle,
+            )
+          : await setupBrowserTesting(
+              channel.taskId,
+              channel.containerName,
+              requestedHasCodex,
+              requestedHomes,
+            );
       } catch (err) {
         console.warn(
           `[browser] task ${channel.taskId}: setup failed: ${
@@ -977,6 +1108,10 @@ export class Orchestrator {
         channel.browserRetryTimer = null;
       }
       if (!this.isActiveChannel(channel)) return;
+      if (!backgroundContainerWorkAllowed()) {
+        this.scheduleBrowserRetry(channel);
+        return;
+      }
       const forceProvision = Boolean(channel.provisionRetryFingerprint);
       void this.ensureBrowserSetup(
         channel,
@@ -1063,13 +1198,28 @@ export class Orchestrator {
       engineKinds.filter((kind) => !previous?.engineKinds?.includes(kind)),
     );
     const hadLiveSessions = channel.sessions.size > 0;
-    const configured = await setupMcpTaskConfig(
-      channel.taskId,
-      channel.containerName,
-      connections,
-      engineKinds,
-      codexHomes,
-    );
+    // Once a provider-neutral handle has already been reconstructed for this
+    // channel, keep subsequent config writes on that same environment. The
+    // first legacy/bootstrap pass intentionally retains its Docker fallback;
+    // it must not introduce an eager reconstruction dependency before the
+    // channel has a durable provider locator.
+    const providerEnvironment = channel.agentHandle ?? undefined;
+    const configured = providerEnvironment
+      ? await setupMcpTaskConfig(
+          channel.taskId,
+          channel.containerName,
+          connections,
+          engineKinds,
+          codexHomes,
+          providerEnvironment,
+        )
+      : await setupMcpTaskConfig(
+          channel.taskId,
+          channel.containerName,
+          connections,
+          engineKinds,
+          codexHomes,
+        );
     if (!configured || !this.isActiveChannel(channel)) return;
     channel.configGeneration += 1;
     channel.mcpConfigFingerprint = fingerprint;
@@ -1219,7 +1369,12 @@ export class Orchestrator {
         // Same per-agent materialisation the initial start does. Browser setup
         // is awaited before EVERY missing-session spawn: that reasserts configs
         // clobbered by resume/auth injection and covers roster generation.
-        await installPackageSkills(channel.taskId, missing);
+        const skillExec = this.providerSkillExec(channel);
+        if (skillExec) {
+          await installPackageSkills(channel.taskId, missing, skillExec);
+        } else {
+          await installPackageSkills(channel.taskId, missing);
+        }
         if (!this.isActiveChannel(channel)) return;
 
         // One materialization gate owns provisioning and (when enabled)
@@ -1270,7 +1425,6 @@ export class Orchestrator {
             {
               taskId: channel.taskId,
               agent,
-              containerName: channel.containerName,
               systemPreamble: channel.preambles.get(agent.id) ?? "",
               executionProfile: this.executionProfileFor(channel, agent.id),
               attachCompatibilityKey: this.attachCompatibilityKeyFor(
@@ -1366,7 +1520,7 @@ export class Orchestrator {
     }
     channel.accountByAgent.set(agent.id, account.id);
     noteEngineAccountUsed(account.id);
-    return { ...base, ...account.execEnv };
+    return { ...account.execEnv, ...base };
   }
 
   /** Install a session with an event handler scoped to this exact generation. */
@@ -1376,6 +1530,11 @@ export class Orchestrator {
     session: AgentSession,
   ): void {
     channel.sessions.set(agentId, session);
+    // Adapters may synchronously emit `error` followed by `turn_complete` (or
+    // `exit`). Terminal classification now awaits a daemon proof, so preserve
+    // transport emission order across that await; otherwise the later boundary
+    // can consume/reorder prompt state while the earlier error still owns it.
+    let eventTail: Promise<void> = Promise.resolve();
     session.onEvent((event) => {
       // Recycle/teardown deletes the old session before calling close().
       // Adapters deliberately emit a final exit event; without this identity
@@ -1386,15 +1545,27 @@ export class Orchestrator {
       ) {
         return;
       }
-      const operation = this.handleAgentEvent(channel, agentId, event).catch(
-        (err: unknown) => {
+      const operation = eventTail
+        .catch(() => {})
+        .then(async () => {
+          // The session may have been retired while an earlier event awaited.
+          // Recheck identity at execution time, not only emission time.
+          if (
+            !this.isActiveChannel(channel) ||
+            channel.sessions.get(agentId) !== session
+          ) {
+            return;
+          }
+          await this.handleAgentEvent(channel, agentId, session, event);
+        })
+        .catch((err: unknown) => {
           console.warn(
             `[orchestrator] ${channel.taskId}/${agentId}: event handling failed: ${
               err instanceof Error ? (err.stack ?? err.message) : String(err)
             }`,
           );
-        },
-      );
+        });
+      eventTail = operation;
       channel.eventOperations.add(operation);
       operation.then(
         () => channel.eventOperations.delete(operation),
@@ -1412,7 +1583,7 @@ export class Orchestrator {
   private createAndBindStableSession(
     channel: Channel,
     agentId: string,
-    args: Parameters<AgentSessionFactory["create"]>[0],
+    args: Omit<Parameters<AgentSessionFactory["create"]>[0], "environment">,
   ): Promise<AgentSession | null> {
     const operation = this.createAndBindStableSessionCore(
       channel,
@@ -1430,11 +1601,12 @@ export class Orchestrator {
   private async createAndBindStableSessionCore(
     channel: Channel,
     agentId: string,
-    args: Parameters<AgentSessionFactory["create"]>[0],
+    args: Omit<Parameters<AgentSessionFactory["create"]>[0], "environment">,
   ): Promise<AgentSession | null> {
+    const environment = await this.agentEnvironment(channel);
     while (this.isActiveChannel(channel)) {
       const generation = channel.configGeneration;
-      const session = await this.factory.create(args);
+      const session = await this.factory.create({ ...args, environment });
       if (!this.isActiveChannel(channel)) {
         await session.close().catch(() => {});
         return null;
@@ -1455,6 +1627,59 @@ export class Orchestrator {
     return null;
   }
 
+  private agentEnvironment(
+    channel: Channel,
+  ): Promise<TaskEnvironmentHandle<unknown>> {
+    const existing = channel.agentEnvironment;
+    if (existing) return existing;
+    const created = (async () => {
+      const task = getHostTask(channel.taskId);
+      if (!task) throw new Error("task environment is not persisted");
+      const environment = await reconstructPersistedTaskEnvironment(task);
+      if (!environment) throw new Error("task environment is not available");
+      if (environment.descriptor.taskId !== channel.taskId) {
+        throw new Error("task environment belongs to a different task");
+      }
+      return environment;
+    })();
+    const tracked = created.then((environment) => {
+      if (this.isActiveChannel(channel)) channel.agentHandle = environment;
+      return environment;
+    });
+    channel.agentEnvironment = tracked;
+    tracked.catch(() => {
+      if (this.isActiveChannel(channel)) {
+        channel.agentEnvironment = null;
+        channel.agentHandle = null;
+      }
+    });
+    return tracked;
+  }
+
+  /** Provider-neutral skill installation for a settled task environment. The
+   * legacy path remains the default until the first environment handle has
+   * actually been reconstructed, avoiding a new await during cold admission.
+   */
+  private providerSkillExec(channel: Channel): SkillExec | undefined {
+    const environment = channel.agentHandle;
+    if (!environment) return undefined;
+    return async (_container, cmd, cwd) => {
+      const argv = cmd as [string, ...string[]];
+      const result = await environment.exec({
+        argv,
+        cwd,
+        user: "node",
+        env: RUNTIME_AUTHORITY_ENV,
+        timeoutMs: 120_000,
+        maxOutputBytes: 256 * 1024,
+      });
+      return {
+        status: result.exitCode,
+        stderr: Buffer.from(result.stderr).toString("utf8"),
+      };
+    };
+  }
+
   private async startSessions(channel: Channel): Promise<boolean> {
     const task = getHostTask(channel.taskId);
     if (
@@ -1464,6 +1689,11 @@ export class Orchestrator {
     ) {
       return false;
     }
+    // Every initial in-container materialization step shares the same boot
+    // fence as the real agent factory. Gate before identity, auth, skills,
+    // browser/MCP configuration, or runner creation can execute in Docker.
+    await agentClisReady;
+    if (!this.isActiveChannel(channel)) return false;
     // Freeze the generation before any slow docker work. A roster add while
     // setup awaits must reconcile under its own engine-aware browser pass,
     // not slip into this factory loop under the old generation's config.
@@ -1474,7 +1704,13 @@ export class Orchestrator {
     // task-up.sh using the creator's per-user key. Best-effort. Awaited but
     // async (docker exec via dockerCli) so it doesn't block the event loop —
     // this runs on every channel ensure, including each post-restart reconnect.
-    await setupTaskGitIdentity(channel.taskId, task.ownerName, task.ownerEmail);
+    await setupTaskGitIdentity(
+      channel.taskId,
+      task.ownerName,
+      task.ownerEmail,
+      undefined,
+      channel.agentHandle ?? undefined,
+    );
     if (!this.isActiveChannel(channel)) return false;
 
     // GitHub auth for both `gh` and HTTPS Git (ADR-027): inject the token,
@@ -1482,7 +1718,11 @@ export class Orchestrator {
     // serialized reconcile so agents cannot race their first fetch/push after
     // task creation, reconnect, or host recovery.
     if (task.ownerUserId) {
-      await reconcileTaskGitAuth(channel.taskId, task.ownerUserId);
+      await reconcileTaskGitAuth(channel.taskId, task.ownerUserId, {
+        setupDeps: {
+          environment: () => channel.agentHandle,
+        },
+      });
     }
 
     // SSH signing identity, re-asserted independently of transport. Connected
@@ -1501,7 +1741,12 @@ export class Orchestrator {
     // turn. Idempotent + best-effort (returns fast when there are none); a slow
     // clone/install briefly delays start, which is acceptable for skill-bearing
     // tasks. Never throws.
-    await installPackageSkills(channel.taskId, initialRoster);
+    const skillExec = this.providerSkillExec(channel);
+    if (skillExec) {
+      await installPackageSkills(channel.taskId, initialRoster, skillExec);
+    } else {
+      await installPackageSkills(channel.taskId, initialRoster);
+    }
     if (!this.isActiveChannel(channel)) return false;
 
     // ADR-053: wire the Playwright MCP browser before agents spawn — configs
@@ -1559,7 +1804,6 @@ export class Orchestrator {
           {
             taskId: channel.taskId,
             agent,
-          containerName: channel.containerName,
           systemPreamble: channel.preambles.get(agent.id) ?? "",
           executionProfile: this.executionProfileFor(channel, agent.id),
           attachCompatibilityKey: this.attachCompatibilityKeyFor(
@@ -1608,6 +1852,61 @@ export class Orchestrator {
     return channel ? this.ensureSessions(channel) : false;
   }
 
+  /** Recreate sessions lost with the daemon and replay only prompts whose
+   * adapter boundary explicitly rejected for runtime unavailability. */
+  async resumeRuntimeDeferredAgentWork(): Promise<void> {
+    if (!backgroundContainerWorkAllowed()) return;
+    await Promise.all(
+      [...this.channels.values()].map(async (channel) => {
+        if (
+          !this.isActiveChannel(channel) ||
+          channel.runtimeDeferredAgents.size === 0
+        ) {
+          return;
+        }
+        try {
+          await this.reconcileSessions(channel);
+          this.drainRuntimeDeferredAgentWork(channel);
+        } catch (err) {
+          // A single ready edge fans out across channels. One broken task must
+          // neither abort the others nor consume its own retryable prompts;
+          // the next ordinary ensure/poll retries and drains this channel.
+          console.warn(
+            `[orchestrator] ${channel.taskId}: deferred runtime work remains queued: ${
+              err instanceof Error ? err.message : String(err)
+            }`,
+          );
+        }
+      }),
+    );
+  }
+
+  private drainRuntimeDeferredAgentWork(channel: Channel): void {
+    if (
+      !this.isActiveChannel(channel) ||
+      !backgroundContainerWorkAllowed()
+    ) {
+      return;
+    }
+    for (const agentId of [...channel.runtimeDeferredAgents]) {
+      const session = channel.sessions.get(agentId);
+      if (!session) continue;
+
+      // Clear ownership before sending. If runtime drops at the same last hop,
+      // startPrompt's typed catch atomically re-adds the exact work.
+      channel.runtimeDeferredAgents.delete(agentId);
+      if (this.isSecretary(channel, agentId)) {
+        this.startNextPendingPrompt(channel, agentId);
+        continue;
+      }
+      const prompts = channel.runtimeDeferredPrompts.get(agentId) ?? [];
+      channel.runtimeDeferredPrompts.delete(agentId);
+      for (const prompt of prompts) {
+        this.startPrompt(channel, agentId, session, prompt);
+      }
+    }
+  }
+
   private incrementActiveTurns(channel: Channel, agentId: string): void {
     channel.activeTurns.set(
       agentId,
@@ -1645,6 +1944,7 @@ export class Orchestrator {
   private retireRunnerGeneration(channel: Channel, agentId: string): void {
     const aborted = channel.interrupted.delete(agentId);
     channel.activeTurns.delete(agentId);
+    channel.acceptedPrompts.delete(agentId);
     channel.openTurns.delete(agentId);
     if (aborted) {
       channel.lastPrompt.delete(agentId);
@@ -1666,9 +1966,14 @@ export class Orchestrator {
     // ADR-076: this is the prompt actually in flight. A queued follow-up must
     // not replace it or account rotation would replay the wrong turn.
     channel.lastPrompt.set(agentId, prompt);
+    const accepted = { text: prompt };
+    const acceptedForAgent = channel.acceptedPrompts.get(agentId) ?? [];
+    acceptedForAgent.push(accepted);
+    channel.acceptedPrompts.set(agentId, acceptedForAgent);
     this.incrementActiveTurns(channel, agentId);
     void session.send(prompt).catch((err: unknown) => {
       if (channel.sessions.get(agentId) === session) {
+        this.removeAcceptedPrompt(channel, agentId, accepted);
         const remaining = this.decrementActiveTurns(channel, agentId);
         if (
           remaining === 0 &&
@@ -1676,7 +1981,11 @@ export class Orchestrator {
         ) {
           channel.lastPrompt.delete(agentId);
         }
-        this.startNextPendingPrompt(channel, agentId);
+        if (err instanceof ContainerRuntimeUnavailableError) {
+          this.deferPromptUntilRuntimeReady(channel, agentId, prompt);
+        } else {
+          this.startNextPendingPrompt(channel, agentId);
+        }
       }
       console.warn(
         `[orchestrator] ${channel.taskId}/${agentId}: send failed: ${
@@ -1686,6 +1995,49 @@ export class Orchestrator {
     });
   }
 
+  private removeAcceptedPrompt(
+    channel: Channel,
+    agentId: string,
+    accepted: AcceptedPrompt,
+  ): void {
+    const prompts = channel.acceptedPrompts.get(agentId);
+    if (!prompts) return;
+    const index = prompts.indexOf(accepted);
+    if (index >= 0) prompts.splice(index, 1);
+    if (prompts.length === 0) channel.acceptedPrompts.delete(agentId);
+  }
+
+  private completeNextAcceptedPrompt(
+    channel: Channel,
+    agentId: string,
+  ): void {
+    const prompts = channel.acceptedPrompts.get(agentId);
+    if (!prompts) return;
+    prompts.shift();
+    if (prompts.length === 0) channel.acceptedPrompts.delete(agentId);
+  }
+
+  private deferPromptUntilRuntimeReady(
+    channel: Channel,
+    agentId: string,
+    prompt: string,
+  ): void {
+    channel.runtimeDeferredAgents.add(agentId);
+    if (this.isSecretary(channel, agentId)) {
+      // Secretary delivery is serialized. Put the failed in-flight prompt in
+      // front of crew replies that were accepted behind it.
+      const pending = channel.pendingPrompts.get(agentId) ?? [];
+      pending.unshift(prompt);
+      channel.pendingPrompts.set(agentId, pending);
+      return;
+    }
+    // Open-mode sends are intentionally concurrent. Promise rejection handlers
+    // run in submission order, so append preserves that accepted order.
+    const deferred = channel.runtimeDeferredPrompts.get(agentId) ?? [];
+    deferred.push(prompt);
+    channel.runtimeDeferredPrompts.set(agentId, deferred);
+  }
+
   /** Start at most one queued prompt after the previous turn is terminal. */
   private startNextPendingPrompt(channel: Channel, agentId: string): boolean {
     if (
@@ -1804,7 +2156,11 @@ export class Orchestrator {
     // Cancel any armed auto-retry chain so this manual attempt runs fresh
     // (setup's duplicate-chain guard would otherwise no-op it).
     clearRefresh(taskId);
-    const ok = await reconcileTaskGitAuth(taskId, owner);
+    const ok = await reconcileTaskGitAuth(taskId, owner, {
+      setupDeps: {
+        environment: () => this.channels.get(taskId)?.agentHandle ?? null,
+      },
+    });
     this.emitSystemNote(
       taskId,
       ok
@@ -1818,6 +2174,7 @@ export class Orchestrator {
   private async handleAgentEvent(
     channel: Channel,
     agentId: string,
+    session: AgentSession,
     event: AgentEvent,
   ): Promise<void> {
     if (!this.isActiveChannel(channel)) return;
@@ -1901,6 +2258,18 @@ export class Orchestrator {
         break;
       }
       case "error": {
+        if (await agentTerminationLostContainerRuntime()) {
+          // `error` and `exit` can arrive back-to-back while the daemon probe
+          // is pending. Only the first terminal event still owns this session.
+          if (channel.sessions.get(agentId) !== session) break;
+          await this.retireSessionForRuntimeLoss(
+            channel,
+            agentId,
+            session,
+          );
+          break;
+        }
+        if (channel.sessions.get(agentId) !== session) break;
         // The turn died with the session — drop its turn-state flags so a
         // respawned session starts clean.
         this.retireRunnerGeneration(channel, agentId);
@@ -1972,6 +2341,7 @@ export class Orchestrator {
         // An interrupted (ESC'd) turn goes out `aborted`: it's a half-turn, so
         // the cloud discards the buffer instead of handing it to peers.
         const aborted = channel.interrupted.delete(agentId);
+        this.completeNextAcceptedPrompt(channel, agentId);
         const remainingTurns = this.decrementActiveTurns(channel, agentId);
         channel.openTurns.delete(agentId);
         // ADR-076: a turn that completed means the current account is healthy —
@@ -2005,6 +2375,16 @@ export class Orchestrator {
         break;
       }
       case "exit":
+        if (await agentTerminationLostContainerRuntime()) {
+          if (channel.sessions.get(agentId) !== session) break;
+          await this.retireSessionForRuntimeLoss(
+            channel,
+            agentId,
+            session,
+          );
+          break;
+        }
+        if (channel.sessions.get(agentId) !== session) break;
         // Same zombie hazard as the error path — a session whose process
         // ended (even cleanly) can never carry another turn.
         this.retireRunnerGeneration(channel, agentId);
@@ -2019,6 +2399,35 @@ export class Orchestrator {
     }
   }
 
+  /** A daemon loss is infrastructure recovery, not an agent crash. Preserve
+   * accepted work, drop the dead generation, and leave respawn/exit accounting
+   * untouched; the runtime-ready hook recreates it deterministically. */
+  private async retireSessionForRuntimeLoss(
+    channel: Channel,
+    agentId: string,
+    session: AgentSession,
+  ): Promise<void> {
+    const accepted = [
+      ...(channel.acceptedPrompts.get(agentId) ?? []),
+    ];
+    const interrupted = channel.interrupted.has(agentId);
+    this.retireRunnerGeneration(channel, agentId);
+    channel.lastPrompt.delete(agentId);
+    if (accepted.length > 0 && !interrupted) {
+      for (const prompt of accepted) {
+        this.deferPromptUntilRuntimeReady(channel, agentId, prompt.text);
+      }
+    } else {
+      // Recreate even an idle session after readiness, without fabricating a
+      // prompt or requiring another human delivery to discover the dead slot.
+      channel.runtimeDeferredAgents.add(agentId);
+    }
+    channel.sessions.delete(agentId);
+    channel.browserStaleSessions.delete(agentId);
+    channel.browserPendingStaleSessions.delete(agentId);
+    await session.close().catch(() => {});
+  }
+
   // -- session recovery -----------------------------------------------------
 
   /**
@@ -2054,7 +2463,10 @@ export class Orchestrator {
 
     channel.spawning.add(agentId);
     try {
-      const restored = repairClaudeConfigInContainer(channel.containerName);
+      const restored = await repairClaudeConfigInContainer(
+        channel.containerName,
+        channel.agentHandle ?? undefined,
+      );
 
       // Delete the old generation before awaiting close. Its adapter emits a
       // terminal event during teardown; bindSession's identity guard must see
@@ -2097,7 +2509,6 @@ export class Orchestrator {
       const session = await this.createAndBindStableSession(channel, agentId, {
         taskId: channel.taskId,
         agent,
-        containerName: channel.containerName,
         systemPreamble: channel.preambles.get(agentId) ?? "",
         executionProfile: this.executionProfileFor(channel, agentId),
         attachCompatibilityKey: this.attachCompatibilityKeyFor(
@@ -2105,7 +2516,7 @@ export class Orchestrator {
           agentId,
         ),
         agentEnv: boundAccount
-          ? { ...base, ...boundAccount.execEnv }
+          ? { ...boundAccount.execEnv, ...base }
           : this.accountAgentEnv(channel, agent, base),
       });
       if (!session) return;
@@ -2226,14 +2637,13 @@ export class Orchestrator {
         {
           taskId: channel.taskId,
           agent,
-          containerName: channel.containerName,
           systemPreamble: channel.preambles.get(agentId) ?? "",
           executionProfile: this.executionProfileFor(channel, agentId),
           attachCompatibilityKey: this.attachCompatibilityKeyFor(
             channel,
             agentId,
           ),
-          agentEnv: { ...base, ...next.execEnv },
+          agentEnv: { ...next.execEnv, ...base },
         },
       );
       if (!replacement) return true;
@@ -2341,14 +2751,13 @@ export class Orchestrator {
       replacement = await this.createAndBindStableSession(channel, agentId, {
         taskId: channel.taskId,
         agent,
-        containerName: channel.containerName,
         systemPreamble: channel.preambles.get(agentId) ?? "",
         executionProfile: this.executionProfileFor(channel, agentId),
         attachCompatibilityKey: this.attachCompatibilityKeyFor(
           channel,
           agentId,
         ),
-        agentEnv: { ...base, ...account.execEnv },
+        agentEnv: { ...account.execEnv, ...base },
       });
       if (!replacement) return true;
 
@@ -2487,7 +2896,10 @@ export class Orchestrator {
     ch.browserStaleSessions.clear();
     ch.browserPendingStaleSessions.clear();
     ch.activeTurns.clear();
+    ch.acceptedPrompts.clear();
     ch.pendingPrompts.clear();
+    ch.runtimeDeferredPrompts.clear();
+    ch.runtimeDeferredAgents.clear();
     ch.openTurns.clear();
     ch.interrupted.clear();
     ch.reconcileAgain = false;
@@ -2527,6 +2939,18 @@ export class Orchestrator {
     return this.channelClosures.get(taskId) ?? Promise.resolve();
   }
 
+  /** Quarantine a live channel before recovery stops its app container.
+   * Preserve the latest channel spec so a successful recovery can reopen the
+   * task without waiting for another cloud message, while the ordinary close
+   * tombstone prevents any agent process from respawning during maintenance. */
+  async quarantineChannelForRecovery(taskId: string): Promise<void> {
+    const currentSpec = this.channelSpecs.get(taskId);
+    await this.closeChannel(taskId);
+    if (currentSpec && !this.channelSpecs.has(taskId)) {
+      this.channelSpecs.set(taskId, currentSpec);
+    }
+  }
+
   /** A successful task-up is the only transition that reopens a tombstoned
    *  task id after stop/teardown. */
   allowChannel(taskId: string): void {
@@ -2553,6 +2977,9 @@ export class Orchestrator {
   private async stopTaskWithinLifecycle(
     taskId: string,
   ): Promise<{ ok: boolean; error?: string }> {
+    if (!backgroundContainerWorkAllowed()) {
+      return { ok: false, error: "container runtime is not operational" };
+    }
     const task = getHostTask(taskId);
     if (!task) return { ok: false, error: "unknown task" };
     const project = task.composeProject;
@@ -2568,33 +2995,27 @@ export class Orchestrator {
         }`,
       );
     }
-    const ps = await dockerCli([
-      "ps",
-      "-q",
-      "--filter",
-      `label=com.docker.compose.project=${project}`,
-    ]);
-    if (ps.status !== 0) {
-      // An empty stdout is not evidence that the stack is gone when docker
-      // itself failed. Reopen the channel and leave the runtime mirror alone
-      // so cloud reconciliation cannot turn a live container into "stopped".
+    // Provider-neutral resumable stop. A row that reaches this point with
+    // runtime resources always carries a proven locator (legacy rows cross
+    // the adoption fence before the runtime becomes operational), so a
+    // reconstruction failure is a stop failure, never a fallback hint. An
+    // environment failure reopens the channel and leaves the runtime mirror
+    // alone so cloud reconciliation cannot turn a live container into
+    // "stopped".
+    try {
+      const environment = await reconstructPersistedTaskEnvironment(task);
+      if (!environment) {
+        this.allowChannel(taskId);
+        return { ok: false, error: "task has no persisted environment" };
+      }
+      await environment.stop();
+    } catch (err) {
       this.allowChannel(taskId);
       return {
         ok: false,
-        error: ps.stderr.trim().slice(0, 200) || "docker ps failed",
+        error: (err instanceof Error ? err.message : String(err)).slice(0, 200),
       };
     }
-    const ids = ps.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
-    if (ids.length > 0) {
-      const stopped = await dockerCli(["stop", ...ids], { timeoutMs: 60_000 });
-      if (stopped.status !== 0) {
-        this.allowChannel(taskId);
-        return {
-          ok: false,
-          error: stopped.stderr.trim().slice(0, 200) || "docker stop failed",
-        };
-      }
-    }
     upsertHostTask(taskId, { statusMirror: "stopped" });
     clearTaskGatewayAcl(taskId);
     return { ok: true };
@@ -2688,7 +3109,10 @@ export function resolveAddressing(
  *
  * Returns true when the file actually made it into the container.
  */
-function repairClaudeConfigInContainer(containerName: string): boolean {
+async function repairClaudeConfigInContainer(
+  containerName: string,
+  environment?: Pick<TaskEnvironmentHandle, "exec">,
+): Promise<boolean> {
   // Operator can override the source path via UAI_OWNER_HOME so the
   // server doesn't have to guess. Useful when Next.js's dev process
   // env diverges from `os.homedir()` for any reason.
@@ -2733,25 +3157,44 @@ function repairClaudeConfigInContainer(containerName: string): boolean {
   // bounces. `rm -f` punches through it (or no-ops on a genuine
   // missing file). Then `cat >` creates the fresh inode. Both steps
   // run in one `sh -c` so a partial failure leaves a clean state.
-  const write = spawnSync(
-    "docker",
+  const repairScript =
+    "rm -f /home/node/.claude.json && cat > /home/node/.claude.json";
+  if (environment) {
+    const write = await environment.exec({
+      argv: ["/bin/sh", "-c", repairScript],
+      env: RUNTIME_AUTHORITY_ENV,
+      stdin: content,
+      timeoutMs: 30_000,
+      maxOutputBytes: 64 * 1024,
+    });
+    if (write.exitCode !== 0) {
+      console.error(
+        "[orchestrator] repair: in-place write to .claude.json failed: " +
+          Buffer.from(write.stderr).toString("utf8").trim(),
+      );
+      return false;
+    }
+    return true;
+  }
+  const write = await taskContainerCli(
     [
       "exec",
       "-i",
-      containerName,
-      "sh",
+      ...runtimeAuthorityDockerExecArgs(),
+      // The channel carries the Docker replica name; the apple container
+      // drops the replica suffix (2026-08-18 spawn-docker-ENOENT sweep).
+      taskContainerBackend().apple
+        ? containerName.replace(/-app-1$/, "-app")
+        : containerName,
+      "/bin/sh",
       "-c",
-      "rm -f /home/node/.claude.json && cat > /home/node/.claude.json",
+      repairScript,
     ],
-    { input: content, encoding: "buffer" },
+    { input: content.toString("utf8"), timeoutMs: 30_000 },
   );
   if (write.status !== 0) {
-    const stderr =
-      write.stderr instanceof Buffer
-        ? write.stderr.toString("utf8")
-        : String(write.stderr ?? "");
     console.error(
-      `[orchestrator] repair: in-place write to .claude.json failed: ${stderr.trim()}`,
+      `[orchestrator] repair: in-place write to .claude.json failed: ${write.stderr.trim()}`,
     );
     return false;
   }
@@ -3083,7 +3526,9 @@ export function buildSystemPreamble(
         "You are one agent in a uai task chat channel, shared with the human",
         "and the other agents. To hand work to or ask another agent, mention",
         "it by id at the start of a line — e.g. `@codex please review the",
-        "diff`. uai routes that message into that agent's input.",
+        "diff`. uai buffers the handoff and routes your complete turn into that",
+        "agent's input only after your current turn ends. The mention does NOT",
+        "wake the peer while you continue using tools in the same turn.",
         ];
   const collaborationBrief = isSecretary
     ? [
@@ -3107,8 +3552,9 @@ export function buildSystemPreamble(
         "Collaborate with your peers — divide up the work, review each other's",
         "changes, share concrete ideas, and debate approach decisions by",
         "@-mentioning them. That is how the team gets things done, and you",
-        "should do it freely whenever it moves the work forward. But mentioning",
-        "a peer WAKES it and costs a turn, so make each one count: a message to",
+        "should do it freely whenever it moves the work forward. But a peer",
+        "@mention WAKES it after your turn ends and costs a turn, so make each",
+        "one count: a message to",
         "a peer should ADVANCE the work — a real proposal, a question you need",
         "answered, a hand-off, or a review with specific findings. Do NOT",
         "@-mention a peer just to greet, thank, agree, acknowledge, or say",
@@ -3267,7 +3713,7 @@ export function buildSystemPreamble(
               ? ", `memory search <query>`"
               : "") +
             (agent.permissions?.includes("todo.write")
-              ? ", `todo list|add|claim|done`"
+              ? ", `todo list|add|edit|remove|claim|done`"
               : "") +
             (agent.permissions?.includes("previews.write")
               ? ", `preview add <name> <port>`"
@@ -3327,7 +3773,9 @@ export function buildSystemPreamble(
                 "**`todo claim <#id>` BEFORE you start** an item so two agents",
                 "don't do the same work — and `todo done <#id>` when it's",
                 "complete. Check `todo list` before picking up work. The human",
-                "watches the same list in the task UI.",
+                "watches the same list in the task UI. Use `todo edit <#id>",
+                "<text>` to correct an item and `todo remove <#id>` to delete",
+                "one; both refuse an item another agent is actively claiming.",
               ]
             : []),
           ...(agent.permissions?.includes("tasks.history")
@@ -3402,19 +3850,60 @@ export function getOrchestrator(): Orchestrator {
     const factory = mode === "real" ? realAgentFactory : mockAgentFactory;
     globalForOrchestrator.__uaiOrchestrator = new Orchestrator(factory);
   }
-  if (!globalForOrchestrator.__uaiRecoverRan) {
-    globalForOrchestrator.__uaiRecoverRan = true;
-    // Fire-and-forget — the orchestrator is usable while recovery runs.
-    // The promise is kept so boot steps that must NOT race recovery (the
-    // Codex credential reinject) can sequence behind it via
-    // recoveryComplete(). recoverRunningTasks never rejects.
-    recoveryPromise = recoverRunningTasks();
-    void recoveryPromise;
-  }
   return globalForOrchestrator.__uaiOrchestrator;
 }
 
-let recoveryPromise: Promise<void> = Promise.resolve();
+/** Runtime activation publication hook. Do not construct an orchestrator just
+ * to run it: deferred work can only exist on the already-live singleton. */
+export function resumeRuntimeDeferredAgentWork(): void {
+  const orchestrator = globalForOrchestrator.__uaiOrchestrator;
+  if (!orchestrator) return;
+  void orchestrator.resumeRuntimeDeferredAgentWork().catch((err) =>
+    console.warn(
+      `[orchestrator] deferred agent work resume failed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    ),
+  );
+}
+
+let recoveryPromise: Promise<boolean> = Promise.resolve(true);
+let recoveryInFlight: Promise<boolean> | null = null;
+
+/** Start or join one recovery sweep. A runtime-ready recheck can call this
+ * after the original boot window gave up, without racing an active sweep. */
+function beginRuntimeRecovery(
+  lifecycle?: Orchestrator,
+  isCurrent: () => boolean = () => true,
+): Promise<boolean> {
+  // A caller that only wants the boot barrier joins it. A live-runtime request
+  // is stronger: chain a fresh lifecycle-sequenced pass behind any active
+  // scan. Promise-tail sequencing has no "last queue read vs finally" gap, so
+  // a readiness request arriving in that microtask window cannot be lost.
+  if (recoveryInFlight && !lifecycle) return recoveryInFlight;
+  const predecessor = recoveryInFlight;
+  const sweep = async (): Promise<boolean> => {
+    try {
+      return await recoverRunningTasks({ lifecycle, isCurrent });
+    } catch (error) {
+      console.error(
+        "[orchestrator] recovery: unhandled failure",
+        error instanceof Error ? error.message : error,
+      );
+      return false;
+    }
+  };
+  let running!: Promise<boolean>;
+  running = (predecessor
+    ? predecessor.catch(() => false).then(sweep)
+    : sweep()
+  ).finally(() => {
+    if (recoveryInFlight === running) recoveryInFlight = null;
+  });
+  recoveryInFlight = running;
+  recoveryPromise = running;
+  return running;
+}
 
 interface TaskRecoveryBarrier {
   promise: Promise<void>;
@@ -3451,13 +3940,73 @@ export function taskRecoveryComplete(taskId: string): Promise<void> {
 
 /**
  * Resolves once boot-time recovery has finished (starting the orchestrator —
- * and with it recovery — if that hasn't happened yet). Never rejects.
+ * and with it recovery — if that hasn't happened yet). Never rejects; false
+ * means one or more active tasks remain unresolved.
  */
-export function recoveryComplete(): Promise<void> {
+export function recoveryComplete(
+  isCurrent: () => boolean = () => true,
+): Promise<boolean> {
   getOrchestrator();
+  if (!globalForOrchestrator.__uaiRecoverRan) {
+    globalForOrchestrator.__uaiRecoverRan = true;
+    // Fire-and-forget — the orchestrator is usable while recovery runs. Main
+    // calls this only after the selected container runtime is ready.
+    void beginRuntimeRecovery(undefined, isCurrent);
+  }
   return recoveryPromise;
 }
 
+/**
+ * Re-run boot recovery after a container runtime transitions to ready.
+ *
+ * `recoveryComplete()` is a one-boot barrier; this is the explicit recovery
+ * trigger for ADR-101 runtime rechecks. It joins an active boot sweep, or
+ * starts a new sweep after the prior bounded retry window completed.
+ */
+export function requestRuntimeRecovery(
+  isCurrent: () => boolean = () => true,
+): Promise<boolean> {
+  const orchestrator = getOrchestrator();
+  globalForOrchestrator.__uaiRecoverRan = true;
+  return beginRuntimeRecovery(orchestrator, isCurrent);
+}
+
+/** Join only work that is already mutating/reconciling runtime state. This is
+ * used before image maintenance so an explicit recheck cannot overlap a
+ * reconnect sweep on the shared daemon/CLI volume. */
+export function waitForRuntimeRecovery(): Promise<void> {
+  return recoveryInFlight?.then(() => undefined) ?? Promise.resolve();
+}
+
+export type RuntimeRecoveryVerdict = "clean" | "needed" | "unknown";
+
+/** Cheap reconnect proof. Each active environment provider reports whether
+ * its durable workload is still running; ordinary cloud/network flaps avoid
+ * the heavier repair path, while an unseen runtime restart still forces full
+ * lifecycle-sequenced recovery before commands reopen. */
+export async function runtimeRecoveryVerdict(): Promise<RuntimeRecoveryVerdict> {
+  const activeRows = getDb()
+    .select()
+    .from(schema.hostTasks)
+    .where(inArray(schema.hostTasks.statusMirror, [...ACTIVE_STATUSES]))
+    .all();
+  for (const task of activeRows) {
+    try {
+      const environment = await reconstructPersistedTaskEnvironment(task);
+      // A pre-provision row has no provider-owned runtime to inventory.
+      if (environment === null) continue;
+      const status = await environment.status();
+      if (status.state === "unknown") return "unknown";
+      if (status.state !== "running") return "needed";
+    } catch {
+      // An unavailable provider, malformed locator, or backend mismatch is
+      // unknown—not evidence that the selected runtime is clean or absent.
+      return "unknown";
+    }
+  }
+  return "clean";
+}
+
 // ---------------------------------------------------------------------------
 // Boot-time recovery
 //
@@ -3476,8 +4025,10 @@ export function recoveryComplete(): Promise<void> {
 //                                   id (task-up is idempotent).
 //   container gone, worktree gone → mark `error`. Data loss.
 //
-// Idempotent per process — guarded by `__uaiRecoverRan` on globalThis
-// so a Next.js HMR rebuild doesn't trigger it twice.
+// Idempotent per process — recoveryComplete/requestRuntimeRecovery mark
+// `__uaiRecoverRan` on globalThis so a Next.js HMR rebuild cannot trigger the
+// boot sweep twice. Merely constructing the orchestrator is deliberately not
+// enough: a degraded host must not probe an unrelated ambient daemon.
 // ---------------------------------------------------------------------------
 
 /**
@@ -3524,63 +4075,1207 @@ async function dockerListContainersByLabel(
     .filter((x): x is DockerPs => x !== null);
 }
 
-async function dockerStart(containerName: string): Promise<boolean> {
+type DockerStartResult = "started" | "failed" | "unreachable";
+
+async function dockerDaemonReachable(): Promise<boolean> {
+  const probe = await dockerCli(["info", "--format", "{{.ServerVersion}}"], {
+    timeoutMs: 10_000,
+  });
+  return probe.status === 0 && probe.stdout.trim().length > 0;
+}
+
+async function dockerStart(containerName: string): Promise<DockerStartResult> {
   // Starting a big dev container can legitimately take a while — give it far
   // more than dockerCli's 30s default before declaring the task stopped.
   const res = await dockerCli(["start", containerName], { timeoutMs: 120_000 });
-  if (res.status !== 0) {
-    console.error(
-      `[orchestrator] docker start ${containerName} failed: ${res.stderr.trim()}`,
-    );
-    return false;
-  }
-  return true;
-}
-
-/**
- * Repair the shared node data root before any recovered-container init.
- * Older task-up versions created the OpenCode leaf as root and accidentally
- * left this parent root-owned, which prevented code-server from creating its
- * managed User profile. `install -d` creates or repairs the exact directory
- * without recursively changing unrelated application state beneath it.
- */
-async function repairNodeDataRoot(containerName: string): Promise<boolean> {
-  const res = await dockerCli([
-    "exec",
-    "-u",
-    "root",
+  if (res.status === 0) return "started";
+  // A timeout is ambiguous: Docker may have completed the start after our CLI
+  // was killed. Inspect the exact container, then prove the daemon still
+  // exists before deciding a non-inspectable container is a terminal failure.
+  const inspected = await dockerCli([
+    "inspect",
+    "--format",
+    "{{.State.Running}}",
     containerName,
-    "/usr/bin/install",
-    "-d",
-    "-o",
-    "node",
-    "-g",
-    "node",
-    "-m",
-    "0755",
-    "/home/node/.local/share",
   ]);
-  if (res.status !== 0) {
-    console.error(
-      `[orchestrator] recovery: ${containerName} could not repair /home/node/.local/share ownership: ${res.stderr.trim() || `docker exec exited ${String(res.status)}`}`,
-    );
-    return false;
+  if (inspected.status === 0 && inspected.stdout.trim() === "true") {
+    return "started";
   }
-  return true;
+  if (inspected.status !== 0 && !(await dockerDaemonReachable())) {
+    return "unreachable";
+  }
+  console.error(
+    `[orchestrator] docker start ${containerName} failed: ${res.stderr.trim()}`,
+  );
+  return "failed";
+}
+
+const RUNTIME_WRITER_LIST_FORMAT =
+  '{{json .Names}}\t{{.Label "com.docker.compose.project"}}\t{{.Label "com.docker.compose.service"}}';
+const RUNTIME_WRITER_INSPECT_FORMAT = [
+  "{{json .Id}}",
+  "{{json .Name}}",
+  "{{json .State.Running}}",
+  "{{json .State.Restarting}}",
+  "{{json .State.Paused}}",
+  "{{json .HostConfig.RestartPolicy.Name}}",
+  '{{json (index .Config.Labels "com.docker.compose.project")}}',
+  '{{json (index .Config.Labels "com.docker.compose.service")}}',
+  "{{json .Mounts}}",
+  "{{json .Config.Env}}",
+].join("\n");
+const RUNTIME_WRITER_CONTAINER_ID_RE = /^[0-9a-f]{64}$/;
+const RUNTIME_WRITER_SCAN_OUTPUT_BYTES = 2 * 1024 * 1024;
+const TASK_RUNTIME_PATH = RUNTIME_AUTHORITY_ENV.PATH;
+const TASK_OWNED_ENV = new Map<string, string>(
+  Object.entries(RUNTIME_AUTHORITY_ENV),
+);
+const NPM_CONFIG_ENV_PREFIX = "npm_config_";
+function normalizeNpmConfigEnvKey(key: string): string | undefined {
+  const folded = key.toLowerCase();
+  if (!folded.startsWith(NPM_CONFIG_ENV_PREFIX)) return undefined;
+  // npm converts underscores in the option suffix to hyphens. Docker can
+  // preserve spellings a shell cannot assign (for example LOGS-DIR), so both
+  // forms must be treated as the same owned option during immutable-env proof.
+  return (
+    NPM_CONFIG_ENV_PREFIX +
+    folded.slice(NPM_CONFIG_ENV_PREFIX.length).replaceAll("_", "-")
+  );
+}
+const TASK_OWNED_NORMALIZED_NPM_ENV_KEYS = new Set(
+  [...TASK_OWNED_ENV.keys()]
+    .map(normalizeNpmConfigEnvKey)
+    .filter((key): key is string => key !== undefined),
+);
+
+interface RuntimeWriterCandidate {
+  taskId: string;
+  composeProject: string;
+  containerName: string;
+}
+
+interface RuntimeWriterMetadata extends RuntimeWriterCandidate {
+  containerId: string;
+  running: boolean;
+  restarting: boolean;
+  paused: boolean;
+  restartPolicy: string;
+  sharedMount: "absent" | "read-only" | "writable" | "invalid";
+  taskEnvironment: "current" | "invalid";
+}
+
+type RuntimeWriterInspection =
+  | { kind: "ready"; metadata: RuntimeWriterMetadata }
+  | { kind: "failed"; detail: string }
+  | { kind: "unreachable" };
+
+export type TaskRuntimeContainerInspection =
+  | {
+      kind: "ready";
+      containerId: string;
+      running: boolean;
+      restarting: boolean;
+      paused: boolean;
+      sharedMount: RuntimeWriterMetadata["sharedMount"];
+      taskEnvironment: RuntimeWriterMetadata["taskEnvironment"];
+    }
+  | { kind: "failed"; detail: string }
+  | { kind: "unreachable" };
+
+export interface WritableRuntimeQuarantineResult {
+  verdict: "ready" | "retry" | "stale";
+  /** Known rows whose local `stopped` verdict must be published or replayed. */
+  stoppedTaskIds: string[];
+}
+
+function runtimeWriterCandidate(
+  rawName: unknown,
+  rawProject: string,
+  rawService: string,
+): RuntimeWriterCandidate | "unrelated" | "invalid" {
+  if (!rawProject.startsWith("task-")) return "unrelated";
+  const taskId = rawProject.slice("task-".length);
+  if (!isSafeHostTaskId(taskId)) return "invalid";
+  if (rawService !== "app" || typeof rawName !== "string") return "invalid";
+  const containerName = `${rawProject}-app-1`;
+  if (rawName !== containerName) return "invalid";
+  return { taskId, composeProject: rawProject, containerName };
+}
+
+/**
+ * Enumerate the Docker authority, not only SQLite. A crashed task-down or an
+ * older host can leave a Uai app container behind after its row changes, and
+ * that orphan can still mutate the host-wide runtime volume.
+ */
+async function listRuntimeWriterCandidates(): Promise<
+  | { kind: "ready"; candidates: RuntimeWriterCandidate[]; ambiguous: boolean }
+  | { kind: "unreachable" }
+> {
+  const listed = await dockerCli(
+    [
+      "ps",
+      "--all",
+      "--filter",
+      "label=com.docker.compose.project",
+      "--filter",
+      "label=com.docker.compose.service=app",
+      "--format",
+      RUNTIME_WRITER_LIST_FORMAT,
+    ],
+    { timeoutMs: 30_000, maxOutputBytes: RUNTIME_WRITER_SCAN_OUTPUT_BYTES },
+  );
+  if (listed.status !== 0 || listed.outputTruncated) {
+    return { kind: "unreachable" };
+  }
+
+  const candidates = new Map<string, RuntimeWriterCandidate>();
+  let ambiguous = false;
+  for (const rawLine of listed.stdout.split(/\r?\n/)) {
+    if (!rawLine) continue;
+    const fields = rawLine.split("\t");
+    if (fields.length !== 3) {
+      ambiguous = true;
+      continue;
+    }
+    let name: unknown;
+    try {
+      name = JSON.parse(fields[0]!);
+    } catch {
+      ambiguous = true;
+      continue;
+    }
+    const candidate = runtimeWriterCandidate(name, fields[1]!, fields[2]!);
+    if (candidate === "unrelated") continue;
+    if (candidate === "invalid") {
+      ambiguous = true;
+      continue;
+    }
+    if (candidates.has(candidate.containerName)) {
+      ambiguous = true;
+      continue;
+    }
+    candidates.set(candidate.containerName, candidate);
+  }
+  return { kind: "ready", candidates: [...candidates.values()], ambiguous };
+}
+
+async function inspectRuntimeWriterContainer(
+  candidate: RuntimeWriterCandidate,
+  target: string = candidate.containerName,
+): Promise<RuntimeWriterInspection> {
+  const inspected = await dockerCli(
+    ["inspect", "--format", RUNTIME_WRITER_INSPECT_FORMAT, target],
+    { timeoutMs: 30_000, maxOutputBytes: 1024 * 1024 },
+  );
+  if (inspected.status !== 0 || inspected.outputTruncated) {
+    if (!(await dockerDaemonReachable())) return { kind: "unreachable" };
+    return {
+      kind: "failed",
+      detail:
+        inspected.stderr.trim() ||
+        `could not inspect Uai app container ${candidate.containerName}`,
+    };
+  }
+
+  const fields = inspected.stdout.trimEnd().split(/\r?\n/);
+  if (fields.length !== 10) {
+    return { kind: "failed", detail: "Docker returned malformed app metadata" };
+  }
+  let parsed: unknown[];
+  try {
+    parsed = fields.map((field) => JSON.parse(field));
+  } catch {
+    return { kind: "failed", detail: "Docker returned malformed app metadata" };
+  }
+  const [
+    containerId,
+    containerName,
+    running,
+    restarting,
+    paused,
+    restartPolicy,
+    composeProject,
+    composeService,
+    mounts,
+    environment,
+  ] = parsed;
+  if (
+    typeof containerId !== "string" ||
+    !RUNTIME_WRITER_CONTAINER_ID_RE.test(containerId) ||
+    containerName !== `/${candidate.containerName}` ||
+    typeof running !== "boolean" ||
+    typeof restarting !== "boolean" ||
+    typeof paused !== "boolean" ||
+    typeof restartPolicy !== "string" ||
+    composeProject !== candidate.composeProject ||
+    composeService !== "app" ||
+    !Array.isArray(mounts)
+  ) {
+    return {
+      kind: "failed",
+      detail: `Docker returned ambiguous identity/state metadata for ${candidate.containerName}`,
+    };
+  }
+
+  if (
+    !mounts.every(
+      (mount) => mount && typeof mount === "object" && !Array.isArray(mount),
+    )
+  ) {
+    return {
+      kind: "failed",
+      detail: `Docker returned malformed mount metadata for ${candidate.containerName}`,
+    };
+  }
+  const mountRecords = mounts as Array<Record<string, unknown>>;
+  const asdfMounts = mountRecords.filter(
+    (mount) => mount.Destination === "/opt/asdf-data",
+  );
+  const namedSharedMounts = mountRecords.filter(
+    (mount) => mount.Name === "uai-asdf-data",
+  );
+  let sharedMount: RuntimeWriterMetadata["sharedMount"];
+  if (
+    namedSharedMounts.some(
+      (mount) => mount.Type === "volume" && mount.RW === true,
+    )
+  ) {
+    // The volume name, not its destination, is the shared writer authority.
+    // An orphan can mount it at an arbitrary path and still race maintenance.
+    sharedMount = "writable";
+  } else if (
+    namedSharedMounts.some(
+      (mount) => mount.Type !== "volume" || typeof mount.RW !== "boolean",
+    )
+  ) {
+    sharedMount = "invalid";
+  } else if (asdfMounts.length === 0) {
+    sharedMount = "absent";
+  } else if (
+    asdfMounts.length === 1 &&
+    namedSharedMounts.length === 1 &&
+    asdfMounts[0]!.Type === "volume" &&
+    asdfMounts[0]!.Name === "uai-asdf-data" &&
+    asdfMounts[0]!.RW === false
+  ) {
+    sharedMount = "read-only";
+  } else {
+    sharedMount = "invalid";
+  }
+  const environmentIsStringArray =
+    Array.isArray(environment) &&
+    environment.every((entry) => typeof entry === "string");
+  const environmentEntries = environmentIsStringArray
+    ? (environment as string[])
+    : [];
+  const exactValues = new Map<string, string[]>();
+  let taskEnvironment: RuntimeWriterMetadata["taskEnvironment"] =
+    environmentIsStringArray ? "current" : "invalid";
+  for (const entry of environmentEntries) {
+    const divider = entry.indexOf("=");
+    const key = divider < 0 ? entry : entry.slice(0, divider);
+    const value = divider < 0 ? "" : entry.slice(divider + 1);
+    if (divider < 1) taskEnvironment = "invalid";
+    const normalizedNpmKey = normalizeNpmConfigEnvKey(key);
+    if (
+      normalizedNpmKey !== undefined &&
+      TASK_OWNED_NORMALIZED_NPM_ENV_KEYS.has(normalizedNpmKey) &&
+      !TASK_OWNED_ENV.has(key)
+    ) {
+      taskEnvironment = "invalid";
+    }
+    const values = exactValues.get(key) ?? [];
+    values.push(value);
+    exactValues.set(key, values);
+  }
+  for (const [key, expected] of TASK_OWNED_ENV) {
+    const values = exactValues.get(key);
+    if (values?.length !== 1 || values[0] !== expected) {
+      taskEnvironment = "invalid";
+    }
+  }
+  // Keep an explicit assertion for the trust-precedence property even though
+  // PATH is also part of TASK_OWNED_ENV above.
+  if (exactValues.get("PATH")?.[0] !== TASK_RUNTIME_PATH) taskEnvironment = "invalid";
+  return {
+    kind: "ready",
+    metadata: {
+      ...candidate,
+      containerId,
+      running,
+      restarting,
+      paused,
+      restartPolicy,
+      sharedMount,
+      taskEnvironment,
+    },
+  };
+}
+
+/** Exact single-task form used by duplicate taskUp admission. */
+export async function inspectTaskRuntimeContainer(
+  taskId: string,
+  composeProject: string,
+): Promise<TaskRuntimeContainerInspection> {
+  if (!isSafeHostTaskId(taskId) || composeProject !== `task-${taskId}`) {
+    return { kind: "failed", detail: "invalid task/Compose runtime identity" };
+  }
+  const inspected = await inspectRuntimeWriterContainer({
+    taskId,
+    composeProject,
+    containerName: `${composeProject}-app-1`,
+  });
+  if (inspected.kind !== "ready") return inspected;
+  return {
+    kind: "ready",
+    containerId: inspected.metadata.containerId,
+    running: inspected.metadata.running,
+    restarting: inspected.metadata.restarting,
+    paused: inspected.metadata.paused,
+    sharedMount: inspected.metadata.sharedMount,
+    taskEnvironment: inspected.metadata.taskEnvironment,
+  };
+}
+
+function restartPolicyDisabled(name: string): boolean {
+  return name === "" || name === "no";
+}
+
+async function stopRuntimeWriter(
+  metadata: RuntimeWriterMetadata,
+): Promise<"stopped" | "failed" | "unreachable"> {
+  // A preserved legacy container must not spring back up under Docker's own
+  // restart policy after the host has declared it stopped. Mount mode is
+  // immutable, so only explicit taskUp may recreate it with the L5 contract.
+  await dockerCli(["update", "--restart=no", metadata.containerId], {
+    timeoutMs: 30_000,
+    maxOutputBytes: 1024 * 1024,
+  });
+  let current = await inspectRuntimeWriterContainer(
+    metadata,
+    metadata.containerId,
+  );
+  if (current.kind !== "ready") return current.kind;
+  if (
+    current.metadata.containerId !== metadata.containerId ||
+    !restartPolicyDisabled(current.metadata.restartPolicy)
+  ) {
+    return "failed";
+  }
+
+  if (current.metadata.paused) {
+    // Docker refuses ordinary stop/kill operations for some paused states.
+    // The restart policy is already disabled; unpause the exact immutable id,
+    // re-prove identity/policy, then immediately enter the bounded stop path.
+    await dockerCli(["unpause", metadata.containerId], {
+      timeoutMs: 15_000,
+      maxOutputBytes: 1024 * 1024,
+    });
+    current = await inspectRuntimeWriterContainer(
+      metadata,
+      metadata.containerId,
+    );
+    if (current.kind !== "ready") return current.kind;
+    if (
+      current.metadata.containerId !== metadata.containerId ||
+      !restartPolicyDisabled(current.metadata.restartPolicy) ||
+      current.metadata.paused
+    ) {
+      return "failed";
+    }
+  }
+
+  if (!current.metadata.running && !current.metadata.restarting) {
+    return "stopped";
+  }
+  await dockerCli(["stop", "--time", "10", metadata.containerId], {
+    timeoutMs: 30_000,
+    maxOutputBytes: 1024 * 1024,
+  });
+  current = await inspectRuntimeWriterContainer(metadata, metadata.containerId);
+  if (current.kind !== "ready") return current.kind;
+  if (
+    current.metadata.containerId === metadata.containerId &&
+    restartPolicyDisabled(current.metadata.restartPolicy) &&
+    !current.metadata.running &&
+    !current.metadata.restarting
+  ) {
+    return "stopped";
+  }
+
+  await dockerCli(["kill", metadata.containerId], {
+    timeoutMs: 15_000,
+    maxOutputBytes: 1024 * 1024,
+  });
+  current = await inspectRuntimeWriterContainer(metadata, metadata.containerId);
+  if (current.kind !== "ready") return current.kind;
+  return current.metadata.containerId === metadata.containerId &&
+    restartPolicyDisabled(current.metadata.restartPolicy) &&
+    !current.metadata.running &&
+    !current.metadata.restarting
+    ? "stopped"
+    : "failed";
+}
+
+/** Stop the exact container previously inspected by taskUp. Re-inspection by
+ * immutable id closes the name-reuse gap before any shared-volume writer. */
+export async function quarantineTaskRuntimeContainer(options: {
+  taskId: string;
+  composeProject: string;
+  expectedContainerId: string;
+}): Promise<"stopped" | "failed" | "unreachable"> {
+  if (
+    !isSafeHostTaskId(options.taskId) ||
+    options.composeProject !== `task-${options.taskId}` ||
+    !RUNTIME_WRITER_CONTAINER_ID_RE.test(options.expectedContainerId)
+  ) {
+    return "failed";
+  }
+  const candidate: RuntimeWriterCandidate = {
+    taskId: options.taskId,
+    composeProject: options.composeProject,
+    containerName: `${options.composeProject}-app-1`,
+  };
+  const inspected = await inspectRuntimeWriterContainer(
+    candidate,
+    options.expectedContainerId,
+  );
+  if (inspected.kind !== "ready") return inspected.kind;
+  if (inspected.metadata.containerId !== options.expectedContainerId) {
+    return "failed";
+  }
+  return stopRuntimeWriter(inspected.metadata);
+}
+
+/**
+ * L5 rolling fence. It must complete before the first standard-image/runtime
+ * volume writer of an activation generation. New task containers mount the
+ * shared volume read-only; every preserved legacy writer is tombstoned and
+ * stopped, while an exact RO container remains eligible for recovery.
+ */
+export async function quarantineWritableRuntimeContainers(options: {
+  lifecycle: Orchestrator;
+  isCurrent?: () => boolean;
+  /** `contract` (default) sweeps only containers whose shared-volume
+   * attachment violates the current contract. `volume-holders` sweeps EVERY
+   * task container attached to the shared volume — the activation driver's
+   * non-writer escape when the volume needs a repair the holders block
+   * (ADR-108; apple only, a no-op on Docker). */
+  scope?: "contract" | "volume-holders";
+}): Promise<WritableRuntimeQuarantineResult> {
+  // Dispatch on the PIN: this sweep runs inside activation's
+  // beforeMaintenance, where the public state is still `checking` and the
+  // ready-gated identity is null — the docker fallback then retries forever
+  // against a daemon that does not exist on a Docker-free Mac.
+  if (pinnedContainerRuntimeProvider() === "apple-container") {
+    return quarantineWritableAppleRuntimeContainers(options);
+  }
+  const isCurrent = options.isCurrent ?? (() => true);
+  const stoppedTaskIds = new Set<string>();
+  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [] };
+
+  const listed = await listRuntimeWriterCandidates();
+  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [] };
+  if (listed.kind === "unreachable") {
+    return { verdict: "retry", stoppedTaskIds: [] };
+  }
+  let resolved = !listed.ambiguous;
+
+  for (const candidate of listed.candidates) {
+    if (!isCurrent()) {
+      return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+    }
+    await options.lifecycle.runTaskLifecycle(candidate.taskId, async () => {
+      if (!isCurrent()) return;
+      const inspection = await inspectRuntimeWriterContainer(candidate);
+      if (inspection.kind !== "ready") {
+        resolved = false;
+        console.error(
+          `[orchestrator] runtime isolation: ${candidate.containerName} inspection did not prove a safe mount (${inspection.kind === "failed" ? inspection.detail : "Docker unreachable"})`,
+        );
+        return;
+      }
+      const task = getHostTask(candidate.taskId);
+      const knownPreservedTask =
+        task?.composeProject === candidate.composeProject &&
+        typeof task.statusMirror === "string" &&
+        isOnDashboard(task.statusMirror);
+      if (
+        inspection.metadata.sharedMount === "read-only" &&
+        inspection.metadata.taskEnvironment === "current"
+      ) {
+        return;
+      }
+      if (!knownPreservedTask) {
+        // A task-shaped orphan with a proven RO shared mount cannot race
+        // maintenance. Without a host row, its non-current task-local npm
+        // environment is not enough ownership evidence to mutate it.
+        if (inspection.metadata.sharedMount === "read-only") return;
+        if (inspection.metadata.sharedMount === "absent") return;
+        if (inspection.metadata.sharedMount === "invalid") {
+          // `task-*` is Uai's namespace, but it is not by itself permission to
+          // stop an unrelated/stale user stack. Only the exact named writable
+          // Uai volume is positive ownership evidence without a host row.
+          resolved = false;
+          console.error(
+            `[orchestrator] runtime isolation: orphan ${candidate.containerName} has ambiguous shared-runtime mount metadata; maintenance remains fenced`,
+          );
+          return;
+        }
+      }
+
+      // Drain before the first stop/update. A running agent continuation may
+      // otherwise race the quarantine and respawn into the legacy container.
+      await options.lifecycle.quarantineChannelForRecovery(candidate.taskId);
+      const stopped = await stopRuntimeWriter(inspection.metadata);
+      if (stopped !== "stopped") {
+        resolved = false;
+        console.error(
+          `[orchestrator] runtime isolation: could not prove ${candidate.containerName} stopped (${stopped})`,
+        );
+        return;
+      }
+
+      if (knownPreservedTask) {
+        // Always re-publish the stopped verdict. A prior process may have
+        // committed SQLite and crashed before its websocket frame left; the
+        // cloud could otherwise remain ghost-running indefinitely.
+        stoppedTaskIds.add(candidate.taskId);
+        db_setStatus(candidate.taskId, "stopped", {
+          codeServerPort: null,
+          previewPorts: "[]",
+        });
+      }
+      clearTaskGatewayAcl(candidate.taskId);
+      // We deliberately reflect a proven physical stop even if the daemon
+      // epoch changed while stopping: leaving the row active would invite a
+      // later recovery to restart an immutable legacy writer. The next
+      // activation generation independently re-enumerates Docker before
+      // maintenance. Non-safety cleanup below may wait for that generation.
+      if (!isCurrent()) return;
+      try {
+        await stopPreviewSidecars(candidate.taskId);
+      } catch (error) {
+        console.warn(
+          `[orchestrator] runtime isolation: ${candidate.taskId} preview cleanup failed: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+      }
+      console.warn(
+        `[orchestrator] runtime isolation: ${candidate.containerName} used a writable/non-current shared runtime mount and remains stopped until explicit Resume recreates it`,
+      );
+    });
+  }
+
+  if (!isCurrent()) {
+    return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+  }
+  return {
+    verdict: resolved ? "ready" : "retry",
+    stoppedTaskIds: [...stoppedTaskIds].sort(),
+  };
+}
+
+const RECOVERY_RUNTIME_INSPECT_FORMAT =
+  "{{json .Image}}|{{json .State.Running}}|{{json .HostConfig.GroupAdd}}|{{json .Mounts}}";
+const RECOVERY_RUNTIME_IMAGE_RE = /^sha256:[0-9a-f]{64}$/;
+const RECOVERY_RUNTIME_SCRIPT_PATH =
+  "/usr/local/bin/uai-materialize-runtimes";
+const RECOVERY_COREPACK_VERSION_PATH =
+  "/usr/local/share/uai/corepack-version";
+const RECOVERY_INIT_PATH = "/uai-init-current";
+const RECOVERY_INIT_PROJECTS_PATH = "/uai-runtime-projects-current";
+const RECOVERY_RUNTIME_TIMEOUT_MS = 630_000;
+const RECOVERY_RUNTIME_OUTPUT_TAIL_BYTES = 1024 * 1024;
+
+interface RecoveryDockerMount {
+  Type?: unknown;
+  Name?: unknown;
+  Source?: unknown;
+  Destination?: unknown;
+  RW?: unknown;
+}
+
+interface RecoveryRuntimeSpec {
+  imageId: string;
+  workspaceSource: string;
+  groupAdds: string[];
+  projectCount: number;
+  projectAllowlistSource: string;
+}
+
+type RecoveryRuntimeInspection =
+  | { kind: "ready"; spec: RecoveryRuntimeSpec }
+  | { kind: "failed"; detail: string }
+  | { kind: "unreachable" };
+
+type RecoveryRuntimeResult =
+  | { kind: "ready" }
+  | { kind: "failed"; detail: string }
+  | { kind: "unreachable" };
+
+function recoveryRuntimeAssets():
+  | { materializer: string; corepackVersion: string; uaiInit: string }
+  | { error: string } {
+  const materializer = standardImageRuntimeMaterializerPath();
+  const corepackVersion = standardImageCorepackVersionPath();
+  const uaiInit = join(dirname(materializer), "uai-init");
+  try {
+    const materializerStat = lstatSync(materializer);
+    if (!materializerStat.isFile() || materializerStat.isSymbolicLink() ||
+        (materializerStat.mode & 0o111) === 0) {
+      return { error: `packaged materializer is not a regular executable: ${materializer}` };
+    }
+    const versionStat = lstatSync(corepackVersion);
+    if (!versionStat.isFile() || versionStat.isSymbolicLink()) {
+      return { error: `packaged Corepack pin is not a regular file: ${corepackVersion}` };
+    }
+    const version = readFileSync(corepackVersion, "utf8");
+    if (!/^\d+\.\d+\.\d+\n?$/.test(version)) {
+      return { error: `packaged Corepack pin is malformed: ${corepackVersion}` };
+    }
+    const initStat = lstatSync(uaiInit);
+    if (
+      !initStat.isFile() ||
+      initStat.isSymbolicLink() ||
+      (initStat.mode & 0o111) === 0
+    ) {
+      return { error: `packaged task initializer is not a regular executable: ${uaiInit}` };
+    }
+  } catch (err) {
+    return {
+      error: `packaged runtime assets are unavailable: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+  return { materializer, corepackVersion, uaiInit };
+}
+
+function expectedRecoveryWorkspaceSources(
+  task: typeof schema.hostTasks.$inferSelect,
+): Set<string> {
+  const expected = new Set<string>();
+  if (!task.worktreePath) return expected;
+  const lexical = join(task.worktreePath, "workspace");
+  try {
+    const stat = lstatSync(lexical);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) return expected;
+    expected.add(lexical);
+    expected.add(realpathSync(lexical));
+  } catch {
+    // Missing, unreadable, and unresolvable workspaces are never safe input
+    // to `docker run`: a legacy `-v` bind would recreate a missing source as
+    // an empty directory and falsely prove that the task had no projects.
+  }
+  return expected;
+}
+
+function validRecoveryGroupAdds(value: unknown): string[] | null {
+  if (value === null || value === undefined) return [];
+  if (!Array.isArray(value)) return null;
+  const groups: string[] = [];
+  for (const candidate of value) {
+    if (typeof candidate !== "string" || !/^[1-9]\d{0,9}$/.test(candidate)) {
+      return null;
+    }
+    const numeric = Number(candidate);
+    if (!Number.isSafeInteger(numeric) || numeric > 4_294_967_294) {
+      return null;
+    }
+    if (!groups.includes(candidate)) groups.push(candidate);
+  }
+  return groups;
+}
+
+function safeRecoveryProjectSlug(slug: unknown): slug is string {
+  return typeof slug === "string" && /^[a-z0-9-]{1,64}$/.test(slug);
+}
+
+function validateRecoveryProjects(
+  task: typeof schema.hostTasks.$inferSelect,
+  workspaceSource: string,
+): { slugs: string[] } | { error: string } {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(task.projectSlugs);
+  } catch {
+    return { error: "the persisted project slug list is invalid JSON" };
+  }
+  if (!Array.isArray(parsed) || !parsed.every(safeRecoveryProjectSlug)) {
+    return { error: "the persisted project slug list contains an unsafe entry" };
+  }
+  const slugs = parsed as string[];
+  const expected = new Set(slugs);
+  if (expected.size !== slugs.length) {
+    return { error: "the persisted project slug list contains duplicates" };
+  }
+
+  for (const slug of expected) {
+    const project = join(workspaceSource, slug);
+    let projectStat: ReturnType<typeof lstatSync>;
+    let markerStat: ReturnType<typeof lstatSync>;
+    try {
+      projectStat = lstatSync(project);
+      markerStat = lstatSync(join(project, ".git"));
+    } catch {
+      return { error: `expected project ${slug} or its .git marker is missing` };
+    }
+    if (
+      projectStat.isSymbolicLink() ||
+      !projectStat.isDirectory() ||
+      markerStat.isSymbolicLink() ||
+      (!markerStat.isFile() && !markerStat.isDirectory())
+    ) {
+      return { error: `expected project ${slug} is not a safe Git worktree` };
+    }
+  }
+  return { slugs };
+}
+
+function validateRecoveryWorkspaceRuntimeRoot(
+  workspaceSource: string,
+): string | null {
+  const shadow = join(workspaceSource, ".tool-versions");
+  try {
+    // Any type is forbidden, including regular files and dangling symlinks.
+    // lstat is metadata-only, so FIFO/device/socket entries cannot block the
+    // host recovery loop.
+    lstatSync(shadow);
+    return "the workspace root contains a forbidden .tool-versions runtime override";
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return null;
+    return `the workspace-root runtime authority could not be verified: ${
+      err instanceof Error ? err.message : String(err)
+    }`;
+  }
+}
+
+function recoveryRuntimeProjectAllowlist(
+  task: typeof schema.hostTasks.$inferSelect,
+  slugs: string[],
+): { path: string } | { error: string } {
+  if (!task.worktreePath) {
+    return { error: "the task has no persisted runtime directory" };
+  }
+  const runtimeDir = join(task.worktreePath, ".uai");
+  const target = join(runtimeDir, "runtime-projects");
+  const expected = slugs.length > 0 ? `${slugs.join("\n")}\n` : "";
+  try {
+    const runtimeDirStat = lstatSync(runtimeDir);
+    if (!runtimeDirStat.isDirectory() || runtimeDirStat.isSymbolicLink()) {
+      return { error: "the task runtime directory is not a safe directory" };
+    }
+    try {
+      const targetStat = lstatSync(target);
+      if (!targetStat.isFile() || targetStat.isSymbolicLink()) {
+        return { error: "the task runtime-project allowlist is not a regular file" };
+      }
+      if (readFileSync(target, "utf8") !== expected) {
+        return { error: "the task runtime-project allowlist does not match persisted projects" };
+      }
+      return { path: target };
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+    }
+
+    if (slugs.length === 0) {
+      return {
+        error: "zero-project recovery lacks an existing authoritative empty runtime-project allowlist",
+      };
+    }
+
+    const stagingDir = mkdtempSync(join(runtimeDir, ".runtime-projects-"));
+    const staged = join(stagingDir, "runtime-projects");
+    try {
+      writeFileSync(staged, expected, { encoding: "utf8", flag: "wx", mode: 0o644 });
+      renameSync(staged, target);
+    } finally {
+      rmSync(stagingDir, { recursive: true, force: true });
+    }
+    return { path: target };
+  } catch (err) {
+    return {
+      error: `the task runtime-project allowlist is unavailable: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+}
+
+async function inspectRecoveryRuntime(
+  task: typeof schema.hostTasks.$inferSelect,
+  containerName: string,
+): Promise<RecoveryRuntimeInspection> {
+  const inspected = await dockerCli(
+    [
+      "inspect",
+      "--format",
+      RECOVERY_RUNTIME_INSPECT_FORMAT,
+      containerName,
+    ],
+    { timeoutMs: 30_000, maxOutputBytes: 128 * 1024 },
+  );
+  if (inspected.status !== 0) {
+    if (!(await dockerDaemonReachable())) return { kind: "unreachable" };
+    return {
+      kind: "failed",
+      detail:
+        inspected.stderr.trim() ||
+        `could not inspect stopped app container ${containerName}`,
+    };
+  }
+
+  const firstDivider = inspected.stdout.indexOf("|");
+  const secondDivider = inspected.stdout.indexOf("|", firstDivider + 1);
+  const thirdDivider = inspected.stdout.indexOf("|", secondDivider + 1);
+  if (firstDivider < 0 || secondDivider < 0 || thirdDivider < 0) {
+    return { kind: "failed", detail: "Docker returned malformed runtime metadata" };
+  }
+
+  let imageId: unknown;
+  let running: unknown;
+  let rawGroupAdds: unknown;
+  let mounts: unknown;
+  try {
+    imageId = JSON.parse(inspected.stdout.slice(0, firstDivider));
+    running = JSON.parse(
+      inspected.stdout.slice(firstDivider + 1, secondDivider),
+    );
+    rawGroupAdds = JSON.parse(
+      inspected.stdout.slice(secondDivider + 1, thirdDivider),
+    );
+    mounts = JSON.parse(inspected.stdout.slice(thirdDivider + 1));
+  } catch {
+    return { kind: "failed", detail: "Docker returned invalid runtime metadata JSON" };
+  }
+  if (running !== false) {
+    return {
+      kind: "failed",
+      detail: "the app container was not proven stopped before runtime maintenance",
+    };
+  }
+  if (typeof imageId !== "string" || !RECOVERY_RUNTIME_IMAGE_RE.test(imageId)) {
+    return { kind: "failed", detail: "the app container has an invalid immutable image ID" };
+  }
+  if (!Array.isArray(mounts)) {
+    return { kind: "failed", detail: "the app container has invalid mount metadata" };
+  }
+  const groupAdds = validRecoveryGroupAdds(rawGroupAdds);
+  if (groupAdds === null) {
+    return {
+      kind: "failed",
+      detail: "the app container has malformed or unsafe supplemental groups",
+    };
+  }
+  const typedMounts = mounts as RecoveryDockerMount[];
+  const workspaceMounts = typedMounts.filter(
+    (mount) => mount.Destination === "/workspace",
+  );
+  const expectedWorkspaceSources = expectedRecoveryWorkspaceSources(task);
+  if (
+    workspaceMounts.length !== 1 ||
+    workspaceMounts[0]?.Type !== "bind" ||
+    typeof workspaceMounts[0]?.Source !== "string" ||
+    !expectedWorkspaceSources.has(workspaceMounts[0].Source)
+  ) {
+    return {
+      kind: "failed",
+      detail: "the app container does not have the exact expected /workspace bind",
+    };
+  }
+  try {
+    const workspaceStat = lstatSync(workspaceMounts[0].Source);
+    if (!workspaceStat.isDirectory() || workspaceStat.isSymbolicLink()) {
+      return {
+        kind: "failed",
+        detail: "the app container's /workspace source is not a real directory",
+      };
+    }
+  } catch {
+    return {
+      kind: "failed",
+      detail: "the app container's /workspace source no longer exists",
+    };
+  }
+  const workspaceRuntimeError = validateRecoveryWorkspaceRuntimeRoot(
+    workspaceMounts[0].Source,
+  );
+  if (workspaceRuntimeError) {
+    return { kind: "failed", detail: workspaceRuntimeError };
+  }
+  const projects = validateRecoveryProjects(
+    task,
+    workspaceMounts[0].Source,
+  );
+  if ("error" in projects) {
+    return { kind: "failed", detail: projects.error };
+  }
+  const projectAllowlist = recoveryRuntimeProjectAllowlist(
+    task,
+    projects.slugs,
+  );
+  if ("error" in projectAllowlist) {
+    return { kind: "failed", detail: projectAllowlist.error };
+  }
+  const asdfMounts = typedMounts.filter(
+    (mount) => mount.Destination === "/opt/asdf-data",
+  );
+  if (
+    asdfMounts.length !== 1 ||
+    asdfMounts[0]?.Type !== "volume" ||
+    asdfMounts[0]?.Name !== "uai-asdf-data" ||
+    asdfMounts[0]?.RW !== false
+  ) {
+    return {
+      kind: "failed",
+      detail:
+        "the app container does not use the exact read-only uai-asdf-data volume; explicit Resume must recreate legacy writable containers",
+    };
+  }
+  return {
+    kind: "ready",
+    spec: {
+      imageId,
+      workspaceSource: workspaceMounts[0].Source,
+      groupAdds,
+      projectCount: projects.slugs.length,
+      projectAllowlistSource: projectAllowlist.path,
+    },
+  };
+}
+
+async function materializeRecoveryRuntimes(
+  spec: RecoveryRuntimeSpec,
+): Promise<RecoveryRuntimeResult> {
+  if (spec.projectCount === 0) return { kind: "ready" };
+  const assets = recoveryRuntimeAssets();
+  if ("error" in assets) return { kind: "failed", detail: assets.error };
+  try {
+    const workspaceStat = lstatSync(spec.workspaceSource);
+    if (!workspaceStat.isDirectory() || workspaceStat.isSymbolicLink()) {
+      return {
+        kind: "failed",
+        detail: "the app container's /workspace source is no longer a real directory",
+      };
+    }
+  } catch {
+    return {
+      kind: "failed",
+      detail: "the app container's /workspace source disappeared before runtime proof",
+    };
+  }
+  try {
+    const allowlistStat = lstatSync(spec.projectAllowlistSource);
+    if (!allowlistStat.isFile() || allowlistStat.isSymbolicLink()) {
+      return {
+        kind: "failed",
+        detail: "the runtime-project allowlist is no longer a regular file",
+      };
+    }
+  } catch {
+    return {
+      kind: "failed",
+      detail: "the runtime-project allowlist disappeared before runtime proof",
+    };
+  }
+  const supplementalGroups = spec.groupAdds.flatMap((group) => [
+    "--group-add",
+    group,
+  ]);
+  const result = await dockerCli(
+    [
+      "run",
+      "--rm",
+      "--user",
+      "node",
+      ...supplementalGroups,
+      "--workdir",
+      "/workspace",
+      "--mount",
+      `type=bind,src=${spec.workspaceSource},dst=/workspace,readonly`,
+      "-v",
+      "uai-asdf-data:/opt/asdf-data:rw",
+      "-v",
+      `${assets.materializer}:${RECOVERY_RUNTIME_SCRIPT_PATH}:ro`,
+      "-v",
+      `${assets.corepackVersion}:${RECOVERY_COREPACK_VERSION_PATH}:ro`,
+      "-v",
+      `${spec.projectAllowlistSource}:/run/uai/runtime-projects:ro`,
+      "--env",
+      "LD_PRELOAD=",
+      "--env",
+      "LD_AUDIT=",
+      "--env",
+      "LD_LIBRARY_PATH=",
+      "--env",
+      "BASH_ENV=",
+      "--env",
+      "ENV=",
+      "--entrypoint",
+      "/usr/bin/env",
+      spec.imageId,
+      "-i",
+      "HOME=/home/node",
+      "ASDF_DIR=/opt/asdf",
+      "ASDF_DATA_DIR=/opt/asdf-data",
+      "PATH=/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+      "/usr/bin/timeout",
+      "--signal=TERM",
+      "--kill-after=10s",
+      "600s",
+      RECOVERY_RUNTIME_SCRIPT_PATH,
+    ],
+    {
+      timeoutMs: RECOVERY_RUNTIME_TIMEOUT_MS,
+      tailOutputBytes: RECOVERY_RUNTIME_OUTPUT_TAIL_BYTES,
+    },
+  );
+  if (result.status === 0) return { kind: "ready" };
+  if (!(await dockerDaemonReachable())) return { kind: "unreachable" };
+  return {
+    kind: "failed",
+    detail: `${result.outputTruncated ? "earlier runtime output was truncated; " : ""}${
+      result.stderr.trim() ||
+      `runtime materializer exited ${String(result.status)}`
+    }`,
+  };
+}
+
+async function stageRecoveryInit(
+  containerName: string,
+  spec: RecoveryRuntimeSpec,
+): Promise<RecoveryRuntimeResult> {
+  const assets = recoveryRuntimeAssets();
+  if ("error" in assets) return { kind: "failed", detail: assets.error };
+  const copies: Array<[string, string]> = [
+    [assets.uaiInit, RECOVERY_INIT_PATH],
+    [spec.projectAllowlistSource, RECOVERY_INIT_PROJECTS_PATH],
+  ];
+  for (const [source, destination] of copies) {
+    const copied = await dockerCli(
+      ["cp", source, `${containerName}:${destination}`],
+      { timeoutMs: 30_000, maxOutputBytes: 1024 * 1024 },
+    );
+    if (copied.status === 0) continue;
+    if (!(await dockerDaemonReachable())) return { kind: "unreachable" };
+    return {
+      kind: "failed",
+      detail:
+        copied.stderr.trim() ||
+        `could not stage ${destination} in the stopped app container`,
+    };
+  }
+  return { kind: "ready" };
+}
+
+type DockerQuarantineResult = "stopped" | "failed" | "unreachable";
+
+async function quarantineRunningContainer(
+  containerName: string,
+): Promise<DockerQuarantineResult> {
+  const stopped = await dockerCli(
+    ["stop", "--time", "10", containerName],
+    { timeoutMs: 30_000 },
+  );
+  const inspected = await dockerCli(
+    ["inspect", "--format", "{{.State.Running}}", containerName],
+    { timeoutMs: 10_000 },
+  );
+  if (inspected.status === 0 && inspected.stdout.trim() === "false") {
+    return "stopped";
+  }
+  if (inspected.status !== 0 && !(await dockerDaemonReachable())) {
+    return "unreachable";
+  }
+  const killed = await dockerCli(["kill", containerName], {
+    timeoutMs: 15_000,
+  });
+  const killInspection = await dockerCli(
+    ["inspect", "--format", "{{.State.Running}}", containerName],
+    { timeoutMs: 10_000 },
+  );
+  if (
+    killInspection.status === 0 &&
+    killInspection.stdout.trim() === "false"
+  ) {
+    return "stopped";
+  }
+  if (killInspection.status !== 0 && !(await dockerDaemonReachable())) {
+    return "unreachable";
+  }
+  console.error(
+    `[orchestrator] recovery: could not quarantine ${containerName} before runtime proof: ${
+      stopped.stderr.trim() ||
+      inspected.stderr.trim() ||
+      killed.stderr.trim() ||
+      killInspection.stderr.trim() ||
+      "container is still running after stop and kill"
+    }`,
+  );
+  return "failed";
+}
+
+/**
+ * Repair the shared node data root before any recovered-container init.
+ * Older task-up versions created the OpenCode leaf as root and accidentally
+ * left this parent root-owned, which prevented code-server from creating its
+ * managed User profile. `install -d` creates or repairs the exact directory
+ * without recursively changing unrelated application state beneath it.
+ */
+async function repairNodeDataRoot(containerName: string): Promise<boolean> {
+  const res = await dockerCli([
+    "exec",
+    "-u",
+    "root",
+    ...runtimeAuthorityDockerExecArgs(),
+    containerName,
+    "/usr/bin/install",
+    "-d",
+    "-o",
+    "node",
+    "-g",
+    "node",
+    "-m",
+    "0755",
+    "/home/node/.local/share",
+  ]);
+  if (res.status !== 0) {
+    console.error(
+      `[orchestrator] recovery: ${containerName} could not repair /home/node/.local/share ownership: ${res.stderr.trim() || `docker exec exited ${String(res.status)}`}`,
+    );
+    return false;
+  }
+  return true;
+}
+
+interface DockerPortResult {
+  reachable: boolean;
+  port: number | null;
 }
 
 async function dockerPort(
   containerName: string,
   containerPort: number,
-): Promise<number | null> {
+): Promise<DockerPortResult> {
   const res = await dockerCli(["port", containerName, String(containerPort)]);
-  if (res.status !== 0) return null;
+  if (res.status === null) return { reachable: false, port: null };
+  if (res.status !== 0) {
+    return {
+      reachable: await dockerDaemonReachable(),
+      port: null,
+    };
+  }
   // Output: "127.0.0.1:32785\n"
   const firstLine = res.stdout.split("\n")[0]?.trim() ?? "";
   const colonIdx = firstLine.lastIndexOf(":");
-  if (colonIdx === -1) return null;
+  if (colonIdx === -1) return { reachable: true, port: null };
   const port = Number(firstLine.slice(colonIdx + 1));
-  return Number.isFinite(port) ? port : null;
+  return {
+    reachable: true,
+    port: Number.isFinite(port) ? port : null,
+  };
 }
 
 async function dockerExec(
@@ -3589,102 +5284,952 @@ async function dockerExec(
   timeoutMs?: number,
 ): Promise<boolean> {
   const res = await dockerCli(
-    ["exec", containerName, ...cmd],
+    ["exec", ...runtimeAuthorityDockerExecArgs(), containerName, ...cmd],
     timeoutMs === undefined ? {} : { timeoutMs },
   );
   return res.status === 0;
 }
 
-/** Exported for tests; production entry is the getOrchestrator() boot guard. */
-export async function recoverRunningTasks(opts?: {
-  /** Delay between passes while docker is unreachable (tests shrink it). */
-  retryMs?: number;
-  /** Bound on passes; ~15 min at the default cadence covers slow boots. */
-  maxPasses?: number;
-}): Promise<void> {
-  const retryMs = opts?.retryMs ?? 20_000;
-  const maxPasses = opts?.maxPasses ?? 45;
-  let pendingTaskIds: ReadonlySet<string> | undefined;
-  // After a machine reboot the host service and the Docker daemon start
-  // concurrently; a pass that finds docker unreachable resolves nothing and
-  // must retry once the daemon is up — the whole point of recovery is to
-  // restart the exited containers that reboot left behind.
-  for (let pass = 1; ; pass++) {
-    const deferred = await recoveryPass(pendingTaskIds);
-    if (deferred.size === 0) {
-      finishAllTaskRecovery();
-      return;
+/** Exported for tests; production entry is the getOrchestrator() boot guard. */
+export async function recoverRunningTasks(opts?: {
+  /** Delay between passes while docker is unreachable (tests shrink it). */
+  retryMs?: number;
+  /** Bound on passes; ~15 min at the default cadence covers slow boots. */
+  maxPasses?: number;
+  /** Post-boot recovery must queue behind live taskUp/taskDown operations.
+   * Boot recovery omits this and uses its earlier per-task barriers instead. */
+  lifecycle?: Orchestrator;
+  /** Test seam; production waits for the shared image/CLI-volume reconcile. */
+  maintenanceReady?: Promise<void>;
+  /** A daemon-generation fence. False cancels every remaining side effect. */
+  isCurrent?: () => boolean;
+}): Promise<boolean> {
+  const retryMs = opts?.retryMs ?? 20_000;
+  const maxPasses = opts?.maxPasses ?? 45;
+  let pendingTaskIds: ReadonlySet<string> | undefined;
+  // After a machine reboot the host service and its selected environment
+  // provider start concurrently. Unknown provider state resolves nothing and
+  // must retry once the runtime answers.
+  for (let pass = 1; ; pass++) {
+    if (opts?.isCurrent?.() === false) {
+      if (!opts.lifecycle) finishAllTaskRecovery();
+      return false;
+    }
+    const result = await recoveryPass(
+      pendingTaskIds,
+      opts?.lifecycle,
+      opts?.maintenanceReady ?? agentClisReady,
+      opts?.isCurrent ?? (() => true),
+    );
+    if (opts?.isCurrent?.() === false) {
+      if (!opts.lifecycle) finishAllTaskRecovery();
+      return false;
+    }
+    const { deferred } = result;
+    if (!result.resolved) {
+      if (!opts?.lifecycle) finishAllTaskRecovery();
+      return false;
+    }
+    if (deferred.size === 0) {
+      if (!opts?.lifecycle) finishAllTaskRecovery();
+      return true;
+    }
+    pendingTaskIds = deferred;
+    if (pass >= maxPasses) {
+      console.warn(
+        `[orchestrator] recovery: task environment runtime still unreachable after ${pass} passes — giving up (${deferred.size} task(s) unresolved)`,
+      );
+      if (!opts?.lifecycle) finishAllTaskRecovery();
+      return false;
+    }
+    if (pass === 1) {
+      console.log(
+        `[orchestrator] recovery: task environment runtime not ready — retrying every ${Math.round(retryMs / 1000)}s for ${deferred.size} task(s)`,
+      );
+    }
+    await new Promise((resolve) => setTimeout(resolve, retryMs));
+  }
+}
+
+interface RecoveryPassResult {
+  deferred: Set<string>;
+  resolved: boolean;
+}
+
+/** One recovery sweep. Returns only task ids deferred by an unreachable provider;
+ * successful ids are never revisited by a later retry pass. `resolved` is
+ * false for an unexpected failure whose runtime state could not be proved. */
+async function recoveryPass(
+  onlyTaskIds?: ReadonlySet<string>,
+  lifecycle?: Orchestrator,
+  maintenanceReady: Promise<void> = agentClisReady,
+  isCurrent: () => boolean = () => true,
+): Promise<RecoveryPassResult> {
+  const deferred = new Set<string>();
+  let resolved = true;
+  try {
+    if (!isCurrent()) return { deferred, resolved: false };
+    const db = getDb();
+    const activeRows = db
+      .select()
+      .from(schema.hostTasks)
+      .where(inArray(schema.hostTasks.statusMirror, [...ACTIVE_STATUSES]))
+      .all();
+    const rows = onlyTaskIds
+      ? activeRows.filter((task) => onlyTaskIds.has(task.taskId))
+      : activeRows;
+    if (!lifecycle) {
+      const activeTaskIds = new Set(rows.map((task) => task.taskId));
+      const expectedTaskIds =
+        onlyTaskIds ?? new Set(taskRecoveryBarriers.keys());
+      for (const taskId of expectedTaskIds) {
+        if (!activeTaskIds.has(taskId)) finishTaskRecovery(taskId);
+      }
+      for (const task of rows) openTaskRecoveryBarrier(task.taskId);
+    }
+    if (rows.length === 0) return { deferred, resolved };
+    console.log(
+      `[orchestrator] recovery: scanning ${rows.length} active task row(s)`,
+    );
+    for (const task of rows) {
+      if (!isCurrent()) break;
+      try {
+        const recovered = lifecycle
+          ? await lifecycle.runTaskLifecycle(task.taskId, async () => {
+              // The row was selected before this lifecycle slot became ours.
+              // A queued taskDown/taskUp may have completed meanwhile, so act
+              // only on the current local authority—not the stale snapshot.
+              const current = getHostTask(task.taskId);
+              if (
+                !current ||
+                !isCurrent() ||
+                !current.statusMirror ||
+                !isActive(current.statusMirror)
+              ) {
+                return true;
+              }
+              return recoverPersistedTaskEnvironment(
+                current,
+                maintenanceReady,
+                isCurrent,
+                lifecycle,
+              );
+            })
+          : await recoverPersistedTaskEnvironment(
+              task,
+              maintenanceReady,
+              isCurrent,
+            );
+        if (recovered) {
+          if (!lifecycle) finishTaskRecovery(task.taskId);
+        } else {
+          deferred.add(task.taskId);
+        }
+      } catch (err) {
+        resolved = false;
+        if (!lifecycle) finishTaskRecovery(task.taskId);
+        console.error(
+          `[orchestrator] recovery: ${task.taskId} failed:`,
+          err instanceof Error ? err.message : err,
+        );
+      }
+    }
+  } catch (err) {
+    resolved = false;
+    if (!lifecycle) finishAllTaskRecovery();
+    console.error(
+      "[orchestrator] recovery: top-level failure",
+      err instanceof Error ? err.message : err,
+    );
+  }
+  return { deferred, resolved };
+}
+
+/** Apple-backend variant of the writable-runtime quarantine. Task containers
+ * prove their shared-cache mount read-only at creation, so a writable mount
+ * here is either a live materializer that outlived its bound or tampering —
+ * both are stopped (task-labeled rows report `stopped`). A CLI that cannot
+ * answer yields `retry`, exactly like an unreachable Docker daemon; it is
+ * never treated as an empty inventory. */
+async function quarantineWritableAppleRuntimeContainers(options: {
+  lifecycle: Orchestrator;
+  isCurrent?: () => boolean;
+  scope?: "contract" | "volume-holders";
+}): Promise<WritableRuntimeQuarantineResult> {
+  const isCurrent = options.isCurrent ?? (() => true);
+  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [] };
+  const binding = appleContainerRuntimeBinding();
+  if (binding === null) return { verdict: "retry", stoppedTaskIds: [] };
+  const cli = appleCliRunner(() => binding.containerCliPath);
+  const listed = await cli(["list", "--all", "--format", "json"], {
+    timeoutMs: 30_000,
+    maxOutputBytes: 8 * 1024 * 1024,
+  });
+  if (listed.status !== 0 || listed.truncated === true) {
+    return { verdict: "retry", stoppedTaskIds: [] };
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(listed.stdout);
+  } catch {
+    return { verdict: "retry", stoppedTaskIds: [] };
+  }
+  if (!Array.isArray(parsed)) return { verdict: "retry", stoppedTaskIds: [] };
+  const stoppedTaskIds = new Set<string>();
+  let resolved = true;
+
+  const stopAndProve = async (id: string): Promise<boolean> => {
+    const stopped = await cli(["stop", "--time", "30", id], {
+      timeoutMs: 90_000,
+      maxOutputBytes: 256 * 1024,
+    });
+    const after = await cli(["inspect", id], {
+      timeoutMs: 15_000,
+      maxOutputBytes: 1024 * 1024,
+    });
+    if (after.status !== 0) {
+      return (
+        after.stdout.trim() === "" &&
+        after.stderr
+          .split("\n")
+          .some((line) => line.trim() === `Error: container not found: ${id}`)
+      );
+    }
+    try {
+      const parsedAfter = JSON.parse(after.stdout) as Array<{
+        id?: unknown;
+        status?: { state?: unknown };
+      }>;
+      // Only one exact-identity record in the runtime's terminal stopped
+      // state settles the proof. A wrong-identity record, a transitional
+      // state ("starting"), or an ambiguous shape must never release
+      // shared-runtime maintenance while the writer may still be active.
+      if (
+        Array.isArray(parsedAfter) &&
+        parsedAfter.length === 1 &&
+        parsedAfter[0]?.id === id &&
+        parsedAfter[0]?.status?.state === "stopped"
+      ) {
+        return true;
+      }
+    } catch {
+      // fall through to the failure log below
+    }
+    console.error(
+      `[orchestrator] runtime isolation: apple container ${id} holds the shared runtime cache writable and could not be proven stopped (stop exit ${stopped.status})`,
+    );
+    return false;
+  };
+
+  for (const item of parsed as Array<{
+    configuration?: {
+      id?: unknown;
+      labels?: Record<string, unknown>;
+      mounts?: Array<{
+        destination?: unknown;
+        options?: unknown;
+        type?: { volume?: { name?: unknown } };
+      }>;
+    };
+  }>) {
+    if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+    const id = item?.configuration?.id;
+    if (typeof id !== "string" || id.length === 0) {
+      resolved = false;
+      continue;
+    }
+    const mounts = item.configuration?.mounts;
+    // Sweep every container whose shared-volume attachment violates the
+    // CURRENT contract: writable (missing ro, or contradictory ro+rw), or at
+    // any destination other than the ADR-108 staging path — which includes
+    // every pre-ADR-108 container (read-only at /opt/asdf-data). Stopping
+    // legacy containers HERE, before writer maintenance, is what lets a
+    // legacy host migrate at all: a running legacy container would otherwise
+    // hold the volume against the very reconcile whose completion recovery
+    // needs (review 2026-08-18: maintenance retried forever and recovery —
+    // the step that settles legacy containers — never ran).
+    const writableShared = (Array.isArray(mounts) ? mounts : []).some(
+      (mount) =>
+        mount?.type?.volume?.name === "uai-asdf-data" &&
+        (options.scope === "volume-holders" ||
+          !(Array.isArray(mount.options) && mount.options.includes("ro")) ||
+          (Array.isArray(mount.options) && mount.options.includes("rw")) ||
+          mount?.destination !== "/run/uai/asdf-lower"),
+    );
+    if (!writableShared) continue;
+    const label = item.configuration?.labels?.["com.uai.task"];
+    // The label is container-influenced data. Only a syntactically safe task
+    // id whose derived container name matches this exact container may drive
+    // task-scoped mutations (lifecycle slot, DB row, ACL removal); anything
+    // else is stopped as an anonymous writer, nothing task-scoped touched.
+    const taskId =
+      typeof label === "string" &&
+      isSafeHostTaskId(label) &&
+      id === appleTaskContainerName(label)
+        ? label
+        : null;
+    if (taskId === null) {
+      if (!(await stopAndProve(id))) resolved = false;
+      continue;
+    }
+    // Task-labeled writers stop inside the task's lifecycle slot so a
+    // concurrent taskUp/taskDown cannot interleave, and a known row commits
+    // its durable `stopped` verdict before the frame is queued — a crashed
+    // publisher must never leave SQLite saying running.
+    await options.lifecycle.runTaskLifecycle(taskId, async () => {
+      if (!isCurrent()) return;
+      await options.lifecycle.quarantineChannelForRecovery(taskId);
+      if (!(await stopAndProve(id))) {
+        resolved = false;
+        return;
+      }
+      const task = getHostTask(taskId);
+      if (task?.statusMirror && isOnDashboard(task.statusMirror)) {
+        db_setStatus(taskId, "stopped", {
+          codeServerPort: null,
+          previewPorts: "[]",
+        });
+        stoppedTaskIds.add(taskId);
+      }
+      // Revoke live access with the environment, like the Docker sweep.
+      clearTaskGatewayAcl(taskId);
+    });
+  }
+  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+  return {
+    verdict: resolved ? "ready" : "retry",
+    stoppedTaskIds: [...stoppedTaskIds],
+  };
+}
+
+/** Dispatch one durable row through its provider. Generic boot orchestration
+ * owns DB/lifecycle sequencing but never derives a Compose/container identity. */
+async function recoverPersistedTaskEnvironment(
+  task: typeof schema.hostTasks.$inferSelect,
+  maintenanceReady: Promise<void>,
+  isCurrent: () => boolean,
+  lifecycle?: Orchestrator,
+): Promise<boolean> {
+  const environment = await reconstructPersistedTaskEnvironment(task);
+  if (environment === null) return true;
+  if (!isCurrent()) return true;
+  const result = await environment.recover({
+    maintenanceReady,
+    isCurrent,
+    ...(lifecycle
+      ? {
+          quarantineConsumers: () =>
+            lifecycle.quarantineChannelForRecovery(task.taskId),
+          allowConsumers: () => lifecycle.allowChannel(task.taskId),
+          ensureConsumersStarted: async () => {
+            await lifecycle.ensureStarted(task.taskId);
+          },
+        }
+      : {}),
+  });
+  return result.outcome === "recovered";
+}
+
+interface RecoveryTaskConsumers {
+  quarantineChannelForRecovery(taskId: string): Promise<void>;
+  allowChannel(taskId: string): void;
+  ensureStarted(taskId: string): Promise<boolean | void>;
+}
+
+/** Apple provider driver. Recovery must end in a durable truth: a running
+ * container is re-initialized (dependencies + code-server) under an
+ * in-container deadline; a stopped one is started and initialized; a
+ * container that is provenly absent — or cannot be started — marks the task
+ * `stopped` so the host never reports operational with a phantom running
+ * task. Unknown CLI answers stay deferred and retryable. */
+/** Exact TypeScript port of task-up.sh's container environment-authority
+ * proof (the jq filter behind "verify task runtime isolation"): each required
+ * canonical entry appears exactly once, every owned-npm-config spelling
+ * (case-folded, underscores treated as hyphens) must be one of the canonical
+ * eight, and PATH plus the asdf/corepack controls hold their exact values
+ * exactly once. */
+export function appleTaskEnvironmentAuthorityHolds(value: unknown): boolean {
+  if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) {
+    return false;
+  }
+  const environment = value as string[];
+  const npmPrefix = "/home/node/.local/share/uai-npm";
+  const npmCache = "/home/node/.cache/uai-npm";
+  const runtimePath =
+    "/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:" +
+    `/usr/sbin:/usr/bin:/sbin:/bin:${npmPrefix}/bin`;
+  const required = [
+    `NPM_CONFIG_PREFIX=${npmPrefix}`,
+    `npm_config_prefix=${npmPrefix}`,
+    `NPM_CONFIG_CACHE=${npmCache}`,
+    `npm_config_cache=${npmCache}`,
+    `NPM_CONFIG_LOGS_DIR=${npmCache}/_logs`,
+    `npm_config_logs_dir=${npmCache}/_logs`,
+    "NPM_CONFIG_UMASK=0002",
+    "npm_config_umask=0002",
+  ];
+  const owned = ["prefix", "cache", "logs-dir", "umask"];
+  const countOf = (exact: string): number =>
+    environment.filter((entry) => entry === exact).length;
+  const isOwnedNpmConfig = (key: string): boolean => {
+    const folded = key.toLowerCase();
+    return (
+      folded.startsWith("npm_config_") &&
+      owned.includes(folded.slice("npm_config_".length).replace(/_/g, "-"))
+    );
+  };
+  const ownedEntries = environment.filter((entry) =>
+    isOwnedNpmConfig(entry.split("=")[0]!),
+  );
+  return (
+    required.every((entry) => countOf(entry) === 1) &&
+    ownedEntries.length === required.length &&
+    countOf(`PATH=${runtimePath}`) === 1 &&
+    countOf("ASDF_DATA_DIR=/opt/asdf-data") === 1 &&
+    countOf("ASDF_SKIP_RESHIM=1") === 1 &&
+    countOf("COREPACK_HOME=/opt/asdf-data/corepack") === 1 &&
+    countOf("COREPACK_ENABLE_NETWORK=0") === 1
+  );
+}
+
+export type AppleTaskRuntimeContractVerdict =
+  | { kind: "holds" }
+  | { kind: "violated" }
+  | { kind: "unreachable"; detail: string };
+
+/**
+ * The apple runtime-authority contract, in one inspection: this exact name
+ * carries this task's label, is running, mounts the shared cache read-only
+ * at exactly the ADR-108 staging path (and nowhere else, with no
+ * contradictory options), binds /workspace as exactly one writable virtiofs
+ * share of this task's real worktree leaf, and carries the same immutable
+ * npm/runtime environment authority task-up proved at creation. Factored
+ * from recovery so the taskUp lost-response fast path proves the SAME
+ * invariants (review 2026-08-18 round 4). `unreachable` and `violated` are
+ * distinct so the fast path can retry without stopping a container it could
+ * not observe, while recovery keeps treating both as quarantine grounds.
+ */
+export async function proveAppleTaskRuntimeContract(options: {
+  taskId: string;
+  containerName: string;
+  hostWorktreePath: string;
+  cli?: ReturnType<typeof appleCliRunner>;
+}): Promise<AppleTaskRuntimeContractVerdict> {
+  let cli = options.cli;
+  if (!cli) {
+    const binding = appleContainerRuntimeBinding();
+    if (binding === null) {
+      return { kind: "unreachable", detail: "apple runtime binding unavailable" };
+    }
+    cli = appleCliRunner(() => binding.containerCliPath);
+  }
+  const contract = await cli(["inspect", options.containerName], {
+    timeoutMs: 15_000,
+    maxOutputBytes: 4 * 1024 * 1024,
+  });
+  if (contract.status !== 0) {
+    return {
+      kind: "unreachable",
+      detail:
+        contract.stderr.trim().slice(0, 200) ||
+        `inspect exited ${contract.status ?? "killed"}`,
+    };
+  }
+  try {
+    const records = JSON.parse(contract.stdout) as Array<{
+      id?: unknown;
+      status?: { state?: unknown };
+      configuration?: {
+        labels?: Record<string, unknown>;
+        mounts?: Array<{
+          destination?: unknown;
+          options?: unknown;
+          type?: { volume?: { name?: unknown } };
+        }>;
+        initProcess?: { environment?: unknown };
+      };
+    }>;
+    // Same strictness as the provider's inspection: exactly one record and
+    // it must identify itself as the requested container, or a malformed
+    // response describing another container could authorize execution.
+    if (!Array.isArray(records) || records.length !== 1) {
+      throw new Error("contract inspection shape is invalid");
+    }
+    const record = records[0]!;
+    if (record.id !== options.containerName) {
+      throw new Error("contract inspection identity mismatch");
+    }
+    const mounts = record?.configuration?.mounts ?? [];
+    // ADR-108: the shared volume attaches read-only at the overlay staging
+    // path and /opt/asdf-data must NOT be a host mount at all — the
+    // writable view there is the in-guest overlay.
+    const runtimeMounts = mounts.filter(
+      (mount) => mount?.destination === "/run/uai/asdf-lower",
+    );
+    const sharedMounts = mounts.filter(
+      (mount) => mount?.type?.volume?.name === "uai-asdf-data",
+    );
+    const asdfHostMounts = mounts.filter(
+      (mount) => mount?.destination === "/opt/asdf-data",
+    );
+    // The /workspace authority: exactly one bind (never a volume) whose
+    // source is this task's exact worktree leaf, still a real non-symlink
+    // directory on disk — the same proof Docker recovery performs.
+    const workspaceMounts = mounts.filter(
+      (mount) => mount?.destination === "/workspace",
+    );
+    const expectedWorkspaceSource = join(
+      options.hostWorktreePath,
+      "workspace",
+    );
+    // The verified Apple dialect for a host-directory bind is exactly
+    // type:{virtiofs:{}} — a closed shape.
+    const workspaceType = workspaceMounts[0]?.type as
+      | Record<string, unknown>
+      | undefined;
+    const workspaceTypeIsVirtiofs =
+      workspaceType !== undefined &&
+      typeof workspaceType === "object" &&
+      !Array.isArray(workspaceType) &&
+      Object.keys(workspaceType).length === 1 &&
+      typeof workspaceType.virtiofs === "object" &&
+      workspaceType.virtiofs !== null &&
+      !Array.isArray(workspaceType.virtiofs) &&
+      Object.keys(workspaceType.virtiofs as object).length === 0;
+    // Writable is part of the authority: a read-only /workspace would
+    // expose a task whose agents cannot work.
+    const workspaceOptions = workspaceMounts[0]?.options;
+    let workspaceAuthorityHolds =
+      workspaceMounts.length === 1 &&
+      workspaceTypeIsVirtiofs &&
+      Array.isArray(workspaceOptions) &&
+      !(workspaceOptions as unknown[]).includes("ro") &&
+      (workspaceMounts[0] as { source?: unknown } | undefined)?.source ===
+        expectedWorkspaceSource;
+    if (workspaceAuthorityHolds) {
+      try {
+        const workspaceStat = lstatSync(expectedWorkspaceSource);
+        workspaceAuthorityHolds =
+          workspaceStat.isDirectory() && !workspaceStat.isSymbolicLink();
+      } catch {
+        workspaceAuthorityHolds = false;
+      }
+    }
+    const rawEnvironment = record?.configuration?.initProcess?.environment;
+    const holds =
+      record?.status?.state === "running" &&
+      record?.configuration?.labels?.["com.uai.task"] === options.taskId &&
+      runtimeMounts.length === 1 &&
+      sharedMounts.length === 1 &&
+      sharedMounts[0] === runtimeMounts[0] &&
+      asdfHostMounts.length === 0 &&
+      Array.isArray(runtimeMounts[0]?.options) &&
+      (runtimeMounts[0]!.options as unknown[]).includes("ro") &&
+      // Closed options contract: an array carrying BOTH ro and rw is
+      // contradictory and proves nothing.
+      !(runtimeMounts[0]!.options as unknown[]).includes("rw") &&
+      workspaceAuthorityHolds &&
+      appleTaskEnvironmentAuthorityHolds(rawEnvironment);
+    return holds ? { kind: "holds" } : { kind: "violated" };
+  } catch {
+    return { kind: "violated" };
+  }
+}
+
+export async function recoverAppleTaskEnvironment(
+  descriptor: TaskEnvironmentDescriptor,
+  context: TaskEnvironmentRecoveryContext,
+): Promise<TaskEnvironmentRecoveryResult> {
+  const locator = parseAppleTaskEnvironmentLocator(descriptor.locator);
+  const task = getHostTask(descriptor.taskId);
+  if (!task || !task.statusMirror || !isActive(task.statusMirror)) {
+    return { outcome: "recovered" };
+  }
+  // The boot maintenance latch (agentClisReady) is awaited ONLY before the
+  // first in-container exec, exactly like Docker recovery. Awaiting it here
+  // deadlocked the first fresh Apple host (live 2026-08-15): the on-connect
+  // recovery sweep held this driver on the latch, activation joins in-flight
+  // recovery before its maintenance, and the maintenance that settles the
+  // latch could therefore never run — the host sat silently in `checking`
+  // forever. Status verdicts, quarantines, and workspace settlement need no
+  // maintenance and must never wait on it.
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  const binding = appleContainerRuntimeBinding();
+  if (binding === null) {
+    return { outcome: "deferred", detail: "apple runtime binding unavailable" };
+  }
+  const cli = appleCliRunner(() => binding.containerCliPath);
+  const environment = await reconstructPersistedTaskEnvironment(task);
+  if (environment === null) return { outcome: "recovered" };
+
+  const markStopped = (): TaskEnvironmentRecoveryResult => {
+    db_setStatus(descriptor.taskId, "stopped", {
+      codeServerPort: null,
+      previewPorts: "[]",
+    });
+    // A stopped verdict must also revoke live access paths, exactly like the
+    // Docker quarantine: the MCP gateway token dies with the environment.
+    clearTaskGatewayAcl(descriptor.taskId);
+    return { outcome: "recovered" };
+  };
+  // Without its workspace the task cannot resume — stopped would advertise a
+  // restart that must fail. Docker recovery reconciles this as error.
+  const markError = (): TaskEnvironmentRecoveryResult => {
+    db_setStatus(descriptor.taskId, "error", {
+      codeServerPort: null,
+      previewPorts: "[]",
+      composeProject: null,
+    });
+    clearTaskGatewayAcl(descriptor.taskId);
+    return { outcome: "recovered" };
+  };
+  // Every settled verdict consults the freshest workspace observation: a
+  // workspace that vanished mid-recovery must land as error exactly like one
+  // that was already gone at the first look.
+  const settleFromStatus = (settled: {
+    workspacePresent: boolean;
+  }): TaskEnvironmentRecoveryResult =>
+    settled.workspacePresent ? markStopped() : markError();
+
+  let status = await environment.status();
+  if (status.state === "unknown") {
+    return { outcome: "deferred", detail: status.detail };
+  }
+  // Every awaited runtime observation can outlive this recovery's readiness
+  // generation; a superseded pass must observe only, never mutate. Recheck
+  // after each await and before each mutation from here on.
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  // Drain consumers before ANY durable verdict or mutation — including the
+  // absent path, where a live channel could otherwise keep serving a task
+  // whose row is about to say stopped.
+  await context.quarantineConsumers?.();
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  if (status.state === "absent") {
+    // Name-anchored absence came from the provider's inspect. The disk truth
+    // decides the verdict: an intact workspace resumes via re-provision
+    // (stopped); a vanished one cannot, and stopped would advertise a
+    // restart that must fail (error).
+    return status.workspacePresent ? markStopped() : markError();
+  }
+  if (status.state === "stopped" && !status.workspacePresent) {
+    // Never start a container whose workspace is gone: dependency recovery
+    // would mutate a recreated or missing tree.
+    return markError();
+  }
+  if (status.state === "stopped") {
+    const started = await cli(["start", locator.containerName], {
+      timeoutMs: 120_000,
+      maxOutputBytes: 256 * 1024,
+    });
+    if (!context.isCurrent()) {
+      return { outcome: "deferred", detail: "runtime generation superseded" };
     }
-    pendingTaskIds = deferred;
-    if (pass >= maxPasses) {
-      console.warn(
-        `[orchestrator] recovery: docker still unreachable after ${pass} passes — giving up (${deferred.size} task(s) unresolved)`,
-      );
-      finishAllTaskRecovery();
-      return;
+    // A failed start command or an ambiguous follow-up is NOT proof of a
+    // stopped container: only an exact stopped/absent answer may settle the
+    // durable row, and unknown always stays deferred and retryable.
+    status = await environment.status();
+    if (status.state === "unknown") {
+      return { outcome: "deferred", detail: status.detail };
     }
-    if (pass === 1) {
-      console.log(
-        `[orchestrator] recovery: docker not ready — retrying every ${Math.round(retryMs / 1000)}s for ${deferred.size} task(s)`,
+    if (!context.isCurrent()) {
+      return { outcome: "deferred", detail: "runtime generation superseded" };
+    }
+    if (status.state === "stopped" || status.state === "absent") {
+      return settleFromStatus(status);
+    }
+    if (started.status !== 0) {
+      // The CLI reported failure yet the container runs — trust the state
+      // probe over the command's exit and continue into revalidation.
+      console.warn(
+        `[orchestrator] recovery: ${descriptor.taskId} container start exited ${started.status} but the container is running; continuing`,
       );
     }
-    await new Promise((resolve) => setTimeout(resolve, retryMs));
   }
-}
 
-/** One recovery sweep. Returns only task ids deferred by unreachable Docker;
- *  successful ids are never revisited by a later retry pass. */
-async function recoveryPass(
-  onlyTaskIds?: ReadonlySet<string>,
-): Promise<Set<string>> {
-  const deferred = new Set<string>();
-  try {
-    const db = getDb();
-    const activeRows = db
-      .select()
-      .from(schema.hostTasks)
-      .where(inArray(schema.hostTasks.statusMirror, [...ACTIVE_STATUSES]))
-      .all();
-    const rows = onlyTaskIds
-      ? activeRows.filter((task) => onlyTaskIds.has(task.taskId))
-      : activeRows;
-    const activeTaskIds = new Set(rows.map((task) => task.taskId));
-    const expectedTaskIds =
-      onlyTaskIds ?? new Set(taskRecoveryBarriers.keys());
-    for (const taskId of expectedTaskIds) {
-      if (!activeTaskIds.has(taskId)) finishTaskRecovery(taskId);
-    }
-    for (const task of rows) openTaskRecoveryBarrier(task.taskId);
-    if (rows.length === 0) return deferred;
-    console.log(
-      `[orchestrator] recovery: scanning ${rows.length} active task row(s)`,
+  // One inspection proves the whole trust decision — factored into
+  // proveAppleTaskRuntimeContract so the taskUp lost-response fast path can
+  // prove the SAME invariants (review 2026-08-18 round 4). Recovery keeps
+  // its historical mapping: anything short of `holds` — including an
+  // unreachable inspect — quarantines below.
+  const contractVerdict = await proveAppleTaskRuntimeContract({
+    taskId: descriptor.taskId,
+    containerName: locator.containerName,
+    hostWorktreePath: locator.hostWorktreePath,
+    cli,
+  });
+  const contractHolds = contractVerdict.kind === "holds";
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  if (!contractHolds) {
+    await environment.stop();
+    const after = await environment.status();
+    if (after.state === "running" || after.state === "unknown") {
+      return {
+        outcome: "deferred",
+        detail:
+          "task container failed its runtime-authority contract and could not be proven stopped",
+      };
+    }
+    if (!context.isCurrent()) {
+      return { outcome: "deferred", detail: "runtime generation superseded" };
+    }
+    console.error(
+      `[orchestrator] recovery: ${descriptor.taskId} container failed its runtime-authority contract; task was stopped and remains quarantined`,
     );
-    for (const task of rows) {
-      try {
-        if (await recoverOneTask(task)) finishTaskRecovery(task.taskId);
-        else deferred.add(task.taskId);
-      } catch (err) {
-        finishTaskRecovery(task.taskId);
-        console.error(
-          `[orchestrator] recovery: ${task.taskId} failed:`,
-          err instanceof Error ? err.message : err,
-        );
-      }
+    return settleFromStatus(after);
+  }
+  // Even an already-running container's first exec resolves through shared
+  // asdf shims; fence it behind the one-way boot maintenance latch, exactly
+  // like Docker recovery fences its workbench probe.
+  await context.maintenanceReady;
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  // ADR-108: guest mounts do not survive a VM restart, so the runtime
+  // overlay must be re-established (idempotently) before ANY exec resolves
+  // through /opt/asdf-data shims — including uai-init below. The upper layer
+  // persists in the container filesystem, so the task's own installs return
+  // with the mount. Proven from the guest mount table, exactly like task-up.
+  const overlay = await environment.exec({
+    argv: [
+      "/bin/sh",
+      "-c",
+      // Same establishment + token-exact proof as task-up §6a: exactly one
+      // effective mount at the merged path and the lower, comma-delimited
+      // option tokens (substring matching accepted a -evil suffix), a
+      // read-only lower, and a real node-owned upper.
+      "set -e; /bin/mkdir -p /var/lib/uai/asdf-upper /var/lib/uai/asdf-work /opt/asdf-data; " +
+        "/bin/chown node:node /var/lib/uai/asdf-upper; " +
+        'if ! /bin/grep -q "^overlay /opt/asdf-data overlay " /proc/mounts; then ' +
+        "/bin/mount -t overlay overlay -o lowerdir=/run/uai/asdf-lower,upperdir=/var/lib/uai/asdf-upper,workdir=/var/lib/uai/asdf-work /opt/asdf-data; fi; " +
+        'overlay_lines=$(/bin/grep -c "^overlay /opt/asdf-data overlay " /proc/mounts || true); ' +
+        '[ "$overlay_lines" = "1" ] || { echo "expected exactly one /opt/asdf-data overlay, found $overlay_lines" >&2; exit 1; }; ' +
+        'any_lines=$(/bin/grep -c " /opt/asdf-data " /proc/mounts || true); ' +
+        '[ "$any_lines" = "1" ] || { echo "unexpected extra mounts at /opt/asdf-data" >&2; exit 1; }; ' +
+        'opts=$(/bin/grep "^overlay /opt/asdf-data overlay " /proc/mounts | /usr/bin/cut -d" " -f4); ' +
+        'case ",$opts," in *",lowerdir=/run/uai/asdf-lower,"*) ;; *) echo "overlay lower is foreign" >&2; exit 1 ;; esac; ' +
+        'case ",$opts," in *",upperdir=/var/lib/uai/asdf-upper,"*) ;; *) echo "overlay upper is foreign" >&2; exit 1 ;; esac; ' +
+        'case ",$opts," in *",workdir=/var/lib/uai/asdf-work,"*) ;; *) echo "overlay workdir is foreign" >&2; exit 1 ;; esac; ' +
+        'case ",$opts," in *",ro,"*) echo "overlay is unexpectedly read-only" >&2; exit 1 ;; esac; ' +
+        'lower_lines=$(/bin/grep -c " /run/uai/asdf-lower " /proc/mounts || true); ' +
+        '[ "$lower_lines" = "1" ] || { echo "expected exactly one lower attachment, found $lower_lines" >&2; exit 1; }; ' +
+        'lopts=$(/bin/grep " /run/uai/asdf-lower " /proc/mounts | /usr/bin/cut -d" " -f4); ' +
+        'case ",$lopts," in *",ro,"*) ;; *) echo "lower attachment is not read-only" >&2; exit 1 ;; esac; ' +
+        '[ ! -L /var/lib/uai/asdf-upper ] || { echo "upper is a symlink" >&2; exit 1; }; ' +
+        '[ -d /var/lib/uai/asdf-upper ] || { echo "upper is not a directory" >&2; exit 1; }; ' +
+        '[ "$(/usr/bin/stat -c %U /var/lib/uai/asdf-upper)" = "node" ] || { echo "upper is not node-owned" >&2; exit 1; }; ' +
+        "/usr/bin/test -d /opt/asdf-data/plugins",
+    ],
+    user: "root",
+    env: {},
+    timeoutMs: 30_000,
+    maxOutputBytes: 64 * 1024,
+  });
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  if (overlay.exitCode !== 0 || overlay.signal !== null) {
+    await environment.stop();
+    const afterOverlay = await environment.status();
+    if (afterOverlay.state === "running" || afterOverlay.state === "unknown") {
+      return {
+        outcome: "deferred",
+        detail:
+          "task runtime overlay could not be established and the container could not be proven stopped",
+      };
+    }
+    if (!context.isCurrent()) {
+      return { outcome: "deferred", detail: "runtime generation superseded" };
     }
-  } catch (err) {
-    finishAllTaskRecovery();
     console.error(
-      "[orchestrator] recovery: top-level failure",
-      err instanceof Error ? err.message : err,
+      `[orchestrator] recovery: ${descriptor.taskId} runtime overlay could not be established (exit ${overlay.exitCode}, signal ${overlay.signal}); task was stopped`,
+    );
+    return settleFromStatus(afterOverlay);
+  }
+  // Dependencies + code-server. The in-container deadline (TERM then KILL)
+  // means a host-side expiry can never leave the initializer mutating the
+  // workspace while agents use it; exit 78 is a runtime-authority violation
+  // and quarantines exactly like at task-up.
+  const init = await environment.exec({
+    argv: [
+      "/usr/bin/timeout",
+      "--signal=TERM",
+      "--kill-after=15s",
+      "570s",
+      "/usr/local/bin/uai-init",
+    ],
+    env: {},
+    timeoutMs: 10 * 60_000,
+    maxOutputBytes: 1024 * 1024,
+  });
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  if (
+    init.exitCode === null ||
+    init.signal !== null ||
+    init.stdoutTruncated ||
+    init.stderrTruncated
+  ) {
+    // The host-side client died (deadline, overflow, forced settlement)
+    // without a real exit code, so the in-container initializer may STILL be
+    // mutating dependencies for several minutes. Never expose the task on an
+    // unknowable outcome: stop and prove, or stay deferred.
+    await environment.stop();
+    const after = await environment.status();
+    if (after.state === "running" || after.state === "unknown") {
+      return {
+        outcome: "deferred",
+        detail:
+          "task initializer outcome was unknowable and the container could not be proven stopped",
+      };
+    }
+    if (!context.isCurrent()) {
+      return { outcome: "deferred", detail: "runtime generation superseded" };
+    }
+    console.error(
+      `[orchestrator] recovery: ${descriptor.taskId} initializer outcome was unknowable (exit ${init.exitCode}, signal ${init.signal}); task was stopped pending a clean re-run`,
+    );
+    return settleFromStatus(after);
+  }
+  if (init.exitCode === 78) {
+    await environment.stop();
+    const after = await environment.status();
+    if (after.state === "running" || after.state === "unknown") {
+      return {
+        outcome: "deferred",
+        detail:
+          "runtime-authority violation detected and the container could not be proven stopped",
+      };
+    }
+    if (!context.isCurrent()) {
+      return { outcome: "deferred", detail: "runtime generation superseded" };
+    }
+    console.error(
+      `[orchestrator] recovery: ${descriptor.taskId} initializer detected a workspace runtime-authority violation; task was stopped and remains quarantined`,
+    );
+    return settleFromStatus(after);
+  }
+  if (init.exitCode !== 0) {
+    console.warn(
+      `[orchestrator] recovery: ${descriptor.taskId} uai-init failed (exit ${init.exitCode}); container is up but Editor may be down`,
+    );
+  }
+  if (!context.isCurrent()) {
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  db_setRuntime(descriptor.taskId, { codeServerPort: null });
+  context.allowConsumers?.();
+  await context.ensureConsumersStarted?.();
+  if (!context.isCurrent()) {
+    // Admission reopened against a superseded generation: re-quarantine so
+    // the successor generation re-proves the environment before consumers
+    // touch it — the same closing move Docker recovery makes.
+    await context.quarantineConsumers?.();
+    return { outcome: "deferred", detail: "runtime generation superseded" };
+  }
+  return { outcome: "recovered" };
+}
+
+/** Docker provider driver. The legacy repair implementation remains local to
+ * this module for now, but it is reachable only through the provider handle;
+ * the generic recovery sweep above never consumes its locator payload. */
+async function recoverDockerTaskEnvironment(
+  descriptor: TaskEnvironmentDescriptor,
+  context: TaskEnvironmentRecoveryContext,
+): Promise<TaskEnvironmentRecoveryResult> {
+  const locator = parseDockerTaskEnvironmentLocator(descriptor.locator);
+  const task = getHostTask(descriptor.taskId);
+  if (!task || !task.statusMirror || !isActive(task.statusMirror)) {
+    return { outcome: "recovered" };
+  }
+  const isPreparedRow =
+    (task.statusMirror === "starting" || task.statusMirror === "error") &&
+    task.composeProject === null &&
+    task.worktreePath === null;
+  if (
+    !isPreparedRow &&
+    (task.composeProject !== locator.composeProject ||
+      task.worktreePath !== locator.hostWorktreePath)
+  ) {
+    throw new Error(
+      `task ${descriptor.taskId} environment locator no longer matches its durable row`,
     );
   }
-  return deferred;
+  // Provider-owned provisional metadata is authoritative after a crash. Feed
+  // the already-validated deterministic values to the Docker-private repair
+  // helpers without teaching the generic sweep how to derive them.
+  const recoveryTask = isPreparedRow
+    ? {
+        ...task,
+        composeProject: locator.composeProject,
+        worktreePath: locator.hostWorktreePath,
+      }
+    : task;
+
+  const lifecycleCallbacks = [
+    context.quarantineConsumers,
+    context.allowConsumers,
+    context.ensureConsumersStarted,
+  ];
+  const hasLifecycle = lifecycleCallbacks.some(Boolean);
+  if (hasLifecycle && !lifecycleCallbacks.every(Boolean)) {
+    throw new Error("task environment recovery lifecycle callbacks are incomplete");
+  }
+  const consumers: RecoveryTaskConsumers | undefined = hasLifecycle
+    ? {
+        quarantineChannelForRecovery: async (taskId) => {
+          if (taskId !== descriptor.taskId) {
+            throw new Error("task environment recovery consumer identity mismatch");
+          }
+          await context.quarantineConsumers!();
+        },
+        allowChannel: (taskId) => {
+          if (taskId !== descriptor.taskId) {
+            throw new Error("task environment recovery consumer identity mismatch");
+          }
+          context.allowConsumers!();
+        },
+        ensureStarted: async (taskId) => {
+          if (taskId !== descriptor.taskId) {
+            throw new Error("task environment recovery consumer identity mismatch");
+          }
+          await context.ensureConsumersStarted!();
+        },
+      }
+    : undefined;
+  const recovered = await recoverOneDockerTask(
+    recoveryTask,
+    context.maintenanceReady,
+    context.isCurrent,
+    consumers,
+  );
+  return recovered
+    ? { outcome: "recovered" }
+    : {
+        outcome: "deferred",
+        detail: "container runtime did not answer during task recovery",
+      };
 }
 
+setDockerTaskEnvironmentRecoveryDriver(recoverDockerTaskEnvironment);
+setAppleTaskEnvironmentRecoveryDriver(recoverAppleTaskEnvironment);
+
 /** Returns false when docker was unreachable (caller retries the pass). */
-async function recoverOneTask(
+async function recoverOneDockerTask(
   task: typeof schema.hostTasks.$inferSelect,
+  maintenanceReady: Promise<void>,
+  isCurrent: () => boolean = () => true,
+  lifecycle?: RecoveryTaskConsumers,
 ): Promise<boolean> {
+  if (!isCurrent()) return true;
   const composeProject = task.composeProject;
   if (!composeProject) {
     // We never wrote a compose project name for this row — must be
@@ -3696,6 +6241,7 @@ async function recoverOneTask(
   const containers = await dockerListContainersByLabel(
     `com.docker.compose.project=${composeProject}`,
   );
+  if (!isCurrent()) return true;
   if (containers === null) {
     // Docker unreachable / timed out — actual state unknown. Leave the row
     // alone; the retrying caller re-scans once docker answers.
@@ -3722,12 +6268,106 @@ async function recoverOneTask(
     return true;
   }
 
-  const running = containers.some((c) => c.State === "running");
+  // Defense in depth for every recovery entry point: the maintained
+  // activation normally quarantines legacy writers before its first shared
+  // volume mutation, but recovery itself must never fast-path or `docker
+  // start` a container whose immutable mount is not the exact L5 RO contract.
+  const mountContract = await inspectRuntimeWriterContainer({
+    taskId: task.taskId,
+    composeProject,
+    containerName,
+  });
+  if (!isCurrent()) return true;
+  if (mountContract.kind === "unreachable") return false;
+  if (mountContract.kind === "failed") {
+    console.error(
+      `[orchestrator] recovery: ${task.taskId} mount identity is ambiguous; deferring without starting it: ${mountContract.detail}`,
+    );
+    return false;
+  }
+  if (
+    mountContract.metadata.sharedMount !== "read-only" ||
+    mountContract.metadata.taskEnvironment !== "current"
+  ) {
+    if (lifecycle) {
+      await lifecycle.quarantineChannelForRecovery(task.taskId);
+      if (!isCurrent()) return true;
+    }
+    const stopped = await stopRuntimeWriter(mountContract.metadata);
+    if (!isCurrent()) return true;
+    if (stopped === "unreachable") return false;
+    if (stopped === "failed") {
+      throw new Error(
+        `${task.taskId} has a legacy/non-current runtime mount and could not be proven stopped`,
+      );
+    }
+    db_setStatus(task.taskId, "stopped", {
+      codeServerPort: null,
+      previewPorts: "[]",
+    });
+    clearTaskGatewayAcl(task.taskId);
+    console.warn(
+      `[orchestrator] recovery: ${task.taskId} uses a legacy/non-current runtime mount; it remains stopped until explicit Resume recreates it`,
+    );
+    return true;
+  }
+
+  // Even a container already marked running needs an in-container workbench
+  // probe. Fence that first exec, as well as the exited-container repair path,
+  // behind the same one-way boot maintenance latch.
+  await maintenanceReady;
+  if (!isCurrent()) return true;
+
+  let running = containers.some(
+    (container) =>
+      container.Names === containerName && container.State === "running",
+  );
   if (running) {
+    // A stale recovery generation may have successfully issued `docker start`
+    // and then been cancelled before uai-init. Do not bless every running
+    // container solely from Docker state: code-server is the cheap proof that
+    // the workbench init completed. A fresh sweep repairs a merely-started
+    // container through the shared init path below.
+    const workbenchReady = await dockerExec(
+      containerName,
+      ["/usr/bin/pgrep", "-f", "code-server.*--bind-addr"],
+      10_000,
+    );
+    if (!isCurrent()) return true;
+    if (!workbenchReady && !(await dockerDaemonReachable())) return false;
+    if (!isCurrent()) return true;
+    if (!workbenchReady) {
+      console.log(
+        `[orchestrator] recovery: ${task.taskId} running without its workbench; quarantining before runtime proof`,
+      );
+      // Post-boot recovery can race live agent sessions. Drain their external
+      // work and tombstone the channel before stopping the shared-volume
+      // writer; successful recovery reopens the preserved channel spec below.
+      if (lifecycle) {
+        await lifecycle.quarantineChannelForRecovery(task.taskId);
+        if (!isCurrent()) return true;
+      }
+      const quarantined = await quarantineRunningContainer(containerName);
+      if (!isCurrent()) return true;
+      if (quarantined === "unreachable") return false;
+      if (quarantined === "failed") {
+        db_setStatus(task.taskId, "stopped", {
+          codeServerPort: null,
+          previewPorts: "[]",
+        });
+        throw new Error(
+          `${task.taskId} could not prove its running app stopped after stop and kill; task remains quarantined`,
+        );
+      }
+      running = false;
+    } else {
     // Container is up. Re-discover the host port in case Docker
     // remapped it across restarts (it usually does for ephemeral
     // bindings).
-    const port = await dockerPort(containerName, 8080);
+    const portResult = await dockerPort(containerName, 8080);
+    if (!isCurrent()) return true;
+    if (!portResult.reachable) return false;
+    const port = portResult.port;
     if (port && port !== task.codeServerPort) {
       db_setRuntime(task.taskId, {
         codeServerPort: port,
@@ -3754,30 +6394,113 @@ async function recoverOneTask(
         }`,
       ),
     );
+    if (!isCurrent()) return true;
+    if (lifecycle) {
+      lifecycle.allowChannel(task.taskId);
+      await lifecycle.ensureStarted(task.taskId);
+      if (!isCurrent()) {
+        await lifecycle.quarantineChannelForRecovery(task.taskId);
+      }
+    }
     return true;
+    }
   }
 
-  // Container exists but exited. Bring it back up + re-launch the
-  // in-container init (deps + code-server).
-  console.log(
-    `[orchestrator] recovery: ${task.taskId} starting exited container ${containerName}`,
+  // The exact app container is now stopped. Prove every project runtime from
+  // its immutable image and mounts before bringing it back up. Rolling old
+  // images receive the current packaged materializer/Corepack pin as read-only
+  // binds, so recovery cannot bypass a newly-shipped proof contract.
+  const runtimeInspection = await inspectRecoveryRuntime(task, containerName);
+  if (!isCurrent()) return true;
+  if (runtimeInspection.kind === "unreachable") return false;
+  if (runtimeInspection.kind === "failed") {
+    console.error(
+      `[orchestrator] recovery: ${task.taskId} runtime inspection failed; keeping task stopped: ${runtimeInspection.detail}`,
+    );
+    db_setStatus(task.taskId, "stopped", {
+      codeServerPort: null,
+      previewPorts: "[]",
+    });
+    return true;
+  }
+  const runtimeMaterialization = await materializeRecoveryRuntimes(
+    runtimeInspection.spec,
+  );
+  if (!isCurrent()) return true;
+  if (runtimeMaterialization.kind === "unreachable") return false;
+  if (runtimeMaterialization.kind === "failed") {
+    console.error(
+      `[orchestrator] recovery: ${task.taskId} runtime materialization failed; keeping task stopped and requiring a complete retry: ${runtimeMaterialization.detail}`,
+    );
+    db_setStatus(task.taskId, "stopped", {
+      codeServerPort: null,
+      previewPorts: "[]",
+    });
+    return true;
+  }
+  const stagedInit = await stageRecoveryInit(
+    containerName,
+    runtimeInspection.spec,
+  );
+  if (!isCurrent()) return true;
+  if (stagedInit.kind === "unreachable") return false;
+  if (stagedInit.kind === "failed") {
+    console.error(
+      `[orchestrator] recovery: ${task.taskId} could not stage the current task initializer; keeping task stopped: ${stagedInit.detail}`,
+    );
+    db_setStatus(task.taskId, "stopped", {
+      codeServerPort: null,
+      previewPorts: "[]",
+    });
+    return true;
+  }
+  const preStartWorkspaceRuntimeError = validateRecoveryWorkspaceRuntimeRoot(
+    runtimeInspection.spec.workspaceSource,
   );
-  if (!(await dockerStart(containerName))) {
+  if (preStartWorkspaceRuntimeError) {
+    console.error(
+      `[orchestrator] recovery: ${task.taskId} workspace runtime authority changed after proof; keeping task stopped: ${preStartWorkspaceRuntimeError}`,
+    );
     db_setStatus(task.taskId, "stopped", {
       codeServerPort: null,
       previewPorts: "[]",
     });
     return true;
   }
+
+  // Runtime proof succeeded. Bring the preserved app back up + re-launch the
+  // task-local dependency/editor init.
+  // If Docker appeared after the host's initial no-runtime verdict, the
+  // standard-image repair starts concurrently with this boot sweep. uai-init
+  // is now task-local (dependencies + editor), but it still resolves through
+  // shared asdf shims; never run it until the boot owner has finished
+  // reconciling the image and agent CLI volume.
+  if (!running) {
+    console.log(
+      `[orchestrator] recovery: ${task.taskId} starting exited container ${containerName}`,
+    );
+    const started = await dockerStart(containerName);
+    if (!isCurrent()) return true;
+    if (started === "unreachable") return false;
+    if (started === "failed") {
+      db_setStatus(task.taskId, "stopped", {
+        codeServerPort: null,
+        previewPorts: "[]",
+      });
+      return true;
+    }
+  }
   // uai-init seeds code-server's profile beneath this shared data root. Heal
   // containers created by older hosts before running it as node.
   await repairNodeDataRoot(containerName);
+  if (!isCurrent()) return true;
   // Correctly-owned Codex creds BEFORE uai-init / any agent respawn: the boot
   // reinject sweep only targets containers already running, so a container
   // recovered here would otherwise keep whatever it held when it exited —
   // possibly host-uid-owned 0600 files Codex can't read. Failure is surfaced
   // by the inject itself and must not abort the task's recovery.
   await injectCodexIntoContainer(containerName);
+  if (!isCurrent()) return true;
   // Establish the task owner's GitHub transport BEFORE uai-init performs any
   // dependency-network work. This matters for package manifests that refer to
   // private GitHub repositories: gh's credential helper must already be live
@@ -3785,7 +6508,20 @@ async function recoverOneTask(
   // like the prior post-init call, but it is now ordered rather than raced.
   if (task.ownerUserId) {
     try {
-      await reconcileTaskGitAuth(task.taskId, task.ownerUserId);
+      await reconcileTaskGitAuth(task.taskId, task.ownerUserId, {
+        // Recovery is sanctioned private maintenance while public admission is
+        // deliberately `checking`. Fence it by this daemon epoch instead of
+        // the public operational bit, preserving private-dependency setup
+        // before uai-init without letting stale recovery keep mutating.
+        admitContainerWork: () => {
+          if (!isCurrent()) {
+            throw new ContainerRuntimeUnavailableError(
+              "container runtime recovery generation was superseded",
+            );
+          }
+        },
+      });
+      if (!isCurrent()) return true;
     } catch (err) {
       console.warn(
         `[orchestrator] recovery: ${task.taskId} GitHub auth setup failed before uai-init: ${
@@ -3793,6 +6529,7 @@ async function recoverOneTask(
         }`,
       );
     }
+    if (!isCurrent()) return true;
   }
   // uai-init reinstalls workspace deps (pnpm/npm install) — minutes on a big
   // repo. dockerCli's 30s default would SIGKILL it mid-install.
@@ -3801,17 +6538,119 @@ async function recoverOneTask(
       "exec",
       "-e",
       "UAI_SKIP_GIT_TRANSPORT=1",
+      "-e",
+      "UAI_WORKSPACE=/workspace",
+      "-e",
+      `UAI_RUNTIME_PROJECTS=${RECOVERY_INIT_PROJECTS_PATH}`,
+      "-e",
+      "PATH=/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+      "-e",
+      "HOME=/home/node",
+      "-e",
+      "XDG_CONFIG_HOME=/home/node/.config",
+      "-e",
+      "XDG_DATA_HOME=/home/node/.local/share",
+      "-e",
+      "ASDF_DIR=/opt/asdf",
+      "-e",
+      "ASDF_DATA_DIR=/opt/asdf-data",
+      "-e",
+      "ASDF_CONFIG_FILE=/dev/null",
+      "-e",
+      "ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions",
+      "-e",
+      "ASDF_NODEJS_VERSION=",
+      "-e",
+      "ASDF_PYTHON_VERSION=",
+      "-e",
+      "ASDF_GOLANG_VERSION=",
+      "-e",
+      "ASDF_RUBY_VERSION=",
+      "-e",
+      "ASDF_RUST_VERSION=",
+      "-e",
+      "COREPACK_HOME=/opt/asdf-data/corepack",
+      "-e",
+      "COREPACK_DEFAULT_TO_LATEST=0",
+      "-e",
+      "COREPACK_ENV_FILE=0",
+      "-e",
+      "COREPACK_NPM_REGISTRY=https://registry.npmjs.org",
+      "-e",
+      "COREPACK_ENABLE_NETWORK=0",
+      "-e",
+      "COREPACK_ENABLE_AUTO_PIN=0",
+      "-e",
+      "COREPACK_ENABLE_DOWNLOAD_PROMPT=0",
+      "-e",
+      "COREPACK_ENABLE_PROJECT_SPEC=1",
+      "-e",
+      "COREPACK_ENABLE_STRICT=1",
+      "-e",
+      "COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0",
+      "-e",
+      "COREPACK_INTEGRITY_CHECK=1",
+      "-e",
+      "LD_PRELOAD=",
+      "-e",
+      "LD_AUDIT=",
+      "-e",
+      "LD_LIBRARY_PATH=",
+      "-e",
+      "NODE_OPTIONS=",
+      "-e",
+      "NODE_PATH=",
+      // SHELLOPTS/BASHOPTS deliberately absent: present-in-env (even empty)
+      // makes bash export its live options into children.
+      "-e",
+      "PS4=",
+      "-e",
+      "BASH_ENV=",
+      "-e",
+      "ENV=",
       containerName,
-      "/usr/local/bin/uai-init",
+      // The host-side deadline below only kills the local docker client; the
+      // server-side exec would keep mutating workspace dependencies while the
+      // recovered task is already exposed to agents. This in-container
+      // deadline kills the actual initializer first (TERM, then KILL), and
+      // the host allowance is deliberately wider so a timed-out run settles
+      // with exit 124 instead of racing the client kill.
+      "/usr/bin/timeout",
+      "--signal=TERM",
+      "--kill-after=15s",
+      "570s",
+      RECOVERY_INIT_PATH,
     ],
     { timeoutMs: 10 * 60_000 },
   );
+  if (!isCurrent()) return true;
+  if (initResult.status === 78) {
+    const quarantined = await quarantineRunningContainer(containerName);
+    if (!isCurrent()) return true;
+    if (quarantined === "unreachable") return false;
+    db_setStatus(task.taskId, "stopped", {
+      codeServerPort: null,
+      previewPorts: "[]",
+    });
+    if (quarantined === "failed") {
+      throw new Error(
+        `${task.taskId} reported a runtime-authority violation and could not be proven stopped`,
+      );
+    }
+    console.error(
+      `[orchestrator] recovery: ${task.taskId} initializer detected a workspace runtime-authority violation; task was stopped and remains quarantined`,
+    );
+    return true;
+  }
   if (initResult.status !== 0) {
     console.warn(
       `[orchestrator] recovery: ${task.taskId} uai-init failed; container is up but Editor may be down`,
     );
   }
-  const port = (await dockerPort(containerName, 8080)) ?? null;
+  const portResult = await dockerPort(containerName, 8080);
+  if (!isCurrent()) return true;
+  if (!portResult.reachable) return false;
+  const port = portResult.port;
   db_setRuntime(task.taskId, {
     codeServerPort: port,
   });
@@ -3825,6 +6664,14 @@ async function recoverOneTask(
   console.log(
     `[orchestrator] recovery: ${task.taskId} resumed (port ${port ?? "?"})`,
   );
+  if (!isCurrent()) return true;
+  if (lifecycle) {
+    lifecycle.allowChannel(task.taskId);
+    await lifecycle.ensureStarted(task.taskId);
+    if (!isCurrent()) {
+      await lifecycle.quarantineChannelForRecovery(task.taskId);
+    }
+  }
   return true;
 }