@runuai/host 0.9.148 → 0.9.150

package/scripts/agent/uai-env-exec.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Refresh ADR-153 project env in this process, then replace it with the task
+# command.  The mounted production name is /usr/local/bin/uai-env-exec.
+
+if [ "$#" -eq 0 ]; then
+  printf '%s\n' 'usage: uai-env-exec COMMAND [ARG ...]' >&2
+  exit 64
+fi
+
+if [ "${UAI_ENV_HOOK-0}" = "1" ]; then
+  __uai_hook=/usr/local/share/uai/env-hook.sh
+  if [ "${UAI_ENV_HOOK_TESTING-}" = "1" ] &&
+     [ -n "${UAI_ENV_TEST_HOOK_PATH-}" ]; then
+    __uai_hook=$UAI_ENV_TEST_HOOK_PATH
+  fi
+  if [ ! -r "$__uai_hook" ]; then
+    printf '%s\n' 'uai-env-exec: project environment hook is unavailable' >&2
+    exit 127
+  fi
+  # shellcheck source=/dev/null
+  . "$__uai_hook"
+  __uai_env_sync
+  unset __uai_hook
+fi
+
+exec -- "$@"

package/src/cli.ts

@@ -53,13 +53,14 @@ import {
 import {
   abortManagedRuntimeInstall,
   acknowledgeManagedRuntimeActivation,
+  acknowledgeManagedRuntimeActivationWithCapabilityFloor,
   beginManagedRuntimeInstall,
   completeManagedRuntimeInstall,
   installManagedRuntimeArchive,
   managedRuntimeInstallStartupState,
   managedRuntimePaths,
   nativeReleasePlatform,
-  reconcileManagedRuntimeActivation,
+  reconcileManagedRuntimeActivationWithCapabilityFloor,
   reconcileManagedRuntimeInstallLifecycle,
   reconcileManagedRuntimeUninstall,
   removeManagedRuntime,
@@ -76,6 +77,7 @@ import {
   type ManagedServiceManagerState,
   type ReconcileManagedRuntimeInstallLifecycleOptions,
 } from "../lib/managed-runtime";
+import { PROJECT_ENV_BINDINGS_RUNTIME_CAPABILITY } from "../lib/project-env-feature";
 import { teardownAppleRuntimeStateForUninstall } from "../lib/apple-uninstall-teardown";
 import {
   readRuntimeProviderState,
@@ -269,7 +271,14 @@ async function cmdRun(rest: string[] = []): Promise<void> {
   ) {
     const activationWasPending = existsSync(managedPaths.activationPending);
     try {
-      if (!(await acknowledgeManagedRuntimeActivation(runningVersion))) {
+      const acknowledged = activationWasPending
+        ? await acknowledgeManagedRuntimeActivationWithCapabilityFloor(
+            runningVersion,
+            PROJECT_ENV_BINDINGS_RUNTIME_CAPABILITY,
+            host.completeProjectEnvBindingsAfterManagedRuntimeFloor,
+          )
+        : await acknowledgeManagedRuntimeActivation(runningVersion);
+      if (!acknowledged) {
         // Selection changed while the service module was loading. Its task
         // admission remains closed by the marker; drain and let the supervisor
         // start the newly selected stable command.
@@ -277,6 +286,7 @@ async function cmdRun(rest: string[] = []): Promise<void> {
         return;
       }
       if (activationWasPending) {
+        host.advertiseProjectEnvBindingsAfterManagedRuntimeActivation();
         console.log(
           `[host-agent] managed runtime ${runningVersion} activated (pending activation acknowledged)`,
         );
@@ -295,7 +305,20 @@ async function cmdRun(rest: string[] = []): Promise<void> {
     new ManagedActivationWatcher({
       restartRequired: async () => {
         if (localManagedUpdateRunning) return false;
-        return reconcileManagedRuntimeActivation(runningVersion);
+        let capabilityCompleted = false;
+        const restartRequired =
+          await reconcileManagedRuntimeActivationWithCapabilityFloor(
+            runningVersion,
+            PROJECT_ENV_BINDINGS_RUNTIME_CAPABILITY,
+            () => {
+              host.completeProjectEnvBindingsAfterManagedRuntimeFloor();
+              capabilityCompleted = true;
+            },
+          );
+        if (capabilityCompleted) {
+          host.advertiseProjectEnvBindingsAfterManagedRuntimeActivation();
+        }
+        return restartRequired;
       },
       isIdle: host.isIdleForManagedHostUpdate,
       onReady: host.requestManagedHostRestart,

package/src/index.ts

@@ -31,7 +31,7 @@ import {
 import { readAttachment, writeAttachment } from "../lib/attachments";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { taskProjectWorktree } from "../lib/env";
+import { env, taskProjectWorktree } from "../lib/env";
 import { getDecryptedForProject } from "../lib/host-env";
 import {
   envSchemaNote,
@@ -46,20 +46,39 @@ import { buildTaskDiff } from "../lib/task-diff";
 import {
   deleteHostTask,
   getHostTask,
+  hostTaskEnvMode,
   recordHostEvent,
   recordTaskDown,
   recordTaskEnvironmentPrepared,
   recordTaskError,
   recordTaskOwner,
+  recordTaskProjectEnvSpec,
   recordTaskStarting,
   recordTaskUpResult,
+  taskProjectEnvSpec,
   purgeHostTaskState,
   upsertHostTask,
 } from "../lib/runtime-state";
 import {
   clearTaskGatewayAcl,
   clearTaskGatewayAclStrict,
+  waitForMcpGatewayReady,
 } from "../lib/mcp-gateway";
+import {
+  recoverTaskGatewayTask,
+  registerTaskGatewayTask,
+  reactivateTaskGatewayTask,
+  removeTaskGatewayTask,
+  suspendTaskGatewayTask,
+  taskGatewayForwarderSecretInput,
+} from "../lib/task-gateway-state";
+import { captureTaskEnvSchemas, forgetTaskEnvSchemaObservations } from "../lib/project-env-schema-capture";
+import { forgetTaskEnvSnapshot, taskEnvResolver, taskEnvWithheldNoteNow } from "../lib/task-env-source";
+import { activeSecretsProxy } from "../lib/secrets-proxy/host";
+import { secretsProxyEnabled } from "../lib/secrets-proxy/runtime";
+import { forgetTaskProxyReadiness } from "../lib/secrets-proxy/readiness";
+import { admitFreshTaskView } from "../lib/secrets-proxy/sidecar-view";
+import { invalidateTaskWrites, reconcileTaskProxyState } from "../lib/secrets-proxy/task-trust";
 import { parsePreviewPortRuntimes } from "../lib/preview-ports";
 import { dockerCli } from "../lib/docker-exec";
 import {
@@ -186,6 +205,9 @@ export type {
 } from "../lib/preview-ports";
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
 import { awaitSidecarReady, sidecarMode } from "../lib/sidecar";
+import { guardSidecarMachine } from "../lib/sidecar-guard";
+import { projectEnvBindingCapability } from "../lib/project-env-feature";
+import { awaitProjectEnvReplicaReady } from "../lib/project-env-replica";
 
 export const hostEvents: HostEventStream = {
   subscribe(handler) {
@@ -297,6 +319,62 @@ export const hostCommands: HostCommands = {
     if (readyAdmissionFailure) return readyAdmissionFailure;
     const readyRuntimeFailure = runtimeUnavailable();
     if (readyRuntimeFailure) return readyRuntimeFailure;
+    try {
+      await waitForMcpGatewayReady();
+    } catch (error) {
+      console.warn(
+        `[task-gateway] refusing task ${input.task.id} before provisioning: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      return {
+        ok: false,
+        code: HostErrorCode.HostUnavailable,
+        message:
+          "The task environment gateway is not ready on this host. Retry the task; if it persists, check the host service log.",
+        retryable: true,
+      };
+    }
+    // A task machine's own guards first: its runner's data directory root's
+    // alone, and the metadata service closed to the task's user. Without
+    // them the task does not start: it could read the sidecar's host token.
+    if (sidecarMode()) {
+      const guard = guardSidecarMachine({ dataDir: env.dataDir });
+      if (!guard.ok) {
+        console.warn(`[sidecar] refusing task ${input.task.id}: ${guard.reason}`);
+        return {
+          ok: false,
+          code: HostErrorCode.Internal,
+          message: `This task machine is not safe to run the task on: ${guard.reason}. Close the task and start it again on a new machine.`,
+          retryable: false,
+        };
+      }
+    }
+    // A bindings-capable task sidecar must activate and commit its exact
+    // replica before any task state, /env generation or process can exist.
+    // Otherwise the source's intentional pre-activation legacy fallback
+    // could expose stored plaintext during the first reconciliation.
+    if (sidecarMode()) {
+      try {
+        await awaitSidecarReady();
+        if (projectEnvBindingCapability() !== null) {
+          await awaitProjectEnvReplicaReady();
+        }
+      } catch (error) {
+        console.warn(
+          `[task-env] refusing task ${input.task.id} before provisioning: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+        return {
+          ok: false,
+          code: HostErrorCode.HostUnavailable,
+          message:
+            "This task machine is still synchronizing its environment. Retry shortly.",
+          retryable: true,
+        };
+      }
+    }
     // ADR-118 follow-up: each apple-container task is its own VM, and each
     // VM pins host vnodes for its life. Refuse to start ANOTHER one when the
     // table is nearly full — a clear, retryable refusal now beats ENFILE
@@ -327,6 +405,19 @@ export const hostCommands: HostCommands = {
       // that lost-response retry as the successful operation it already was:
       // every cloud caller records a non-ok taskUp as an errored task.
       const existingTask = getHostTask(input.task.id);
+      const incomingEnvSpec = taskProjectEnvSpec(input);
+      let existingGatewayReady = true;
+      if (existingTask && hostTaskEnvMode(existingTask) === "loader") {
+        // A lost-response retry is also the repair path after a host process
+        // restart: reattach the live resolver before any task process can be
+        // treated as reusable. Missing/corrupt durable identity forces normal
+        // recreation, which mints a generation and restarts its forwarder.
+        recordTaskProjectEnvSpec(input.task.id, input);
+        existingGatewayReady =
+          recoverTaskGatewayTask(input.task.id, {
+            resolveEnv: taskEnvResolver(input.task.id, incomingEnvSpec),
+          }) !== null;
+      }
       let runtimeQuarantinedForRecreate = false;
       let channelClosedForRecreate = false;
       if (
@@ -370,6 +461,7 @@ export const hostCommands: HostCommands = {
         if (environment === null) {
           // The persisted locator no longer reconstructs (e.g. an engine
           // identity change) — recreate through the normal path.
+          suspendTaskGatewayTask(input.task.id);
           await orchestrator.closeChannel(input.task.id);
           // Session drain can outlive the generation too: a superseded pass
           // must not reach recordTaskStarting/provisioning below.
@@ -412,6 +504,7 @@ export const hostCommands: HostCommands = {
               ? input.projects
               : []) {
               const gitHealth = await environment.exec({
+                projectEnvProfile: "maintenance",
                 argv: [
                   "/usr/bin/env",
                   "-i",
@@ -450,7 +543,11 @@ export const hostCommands: HostCommands = {
                 break;
               }
             }
-            if (verdict.kind === "holds" && projectsHealthy) {
+            if (
+              verdict.kind === "holds" &&
+              projectsHealthy &&
+              existingGatewayReady
+            ) {
               if (fastStale()) return staleRetry;
               orchestrator.allowChannel(input.task.id);
               return {
@@ -462,12 +559,14 @@ export const hostCommands: HostCommands = {
                   previewPorts: parsePreviewPortRuntimes(
                     existingTask.previewPorts,
                   ),
+                  envMode: hostTaskEnvMode(existingTask),
                 },
               };
             }
             // Violated contract or broken project repo: drain, stop, and
             // prove before task-up recreates the same stable name.
             if (fastStale()) return staleRetry;
+            suspendTaskGatewayTask(input.task.id);
             await orchestrator.closeChannel(input.task.id);
             channelClosedForRecreate = true;
             if (fastStale()) return staleRetry;
@@ -494,6 +593,7 @@ export const hostCommands: HostCommands = {
             // recreate — and the rollback state must say stopped for the
             // same reason as above.
             if (fastStale()) return staleRetry;
+            suspendTaskGatewayTask(input.task.id);
             await orchestrator.closeChannel(input.task.id);
             // Fence AFTER the drain as well: provisioning must never start
             // under a generation this pass no longer owns.
@@ -517,7 +617,7 @@ export const hostCommands: HostCommands = {
           );
           if (environment) {
             const machineStatus = await environment.status();
-            if (machineStatus.state === "running") {
+            if (machineStatus.state === "running" && existingGatewayReady) {
               orchestrator.allowChannel(input.task.id);
               return {
                 ok: true,
@@ -525,6 +625,7 @@ export const hostCommands: HostCommands = {
                   composeProject: existingTask.composeProject ?? "",
                   worktreePath: existingTask.worktreePath ?? "",
                   codeServerPort: existingTask.codeServerPort ?? undefined,
+                  envMode: hostTaskEnvMode(existingTask),
                 },
               };
             }
@@ -597,12 +698,14 @@ export const hostCommands: HostCommands = {
             !runtimeContract.restarting &&
             !runtimeContract.paused &&
             runtimeContract.sharedMount === "read-only" &&
-            runtimeContract.taskEnvironment === "current";
+            runtimeContract.taskEnvironment === "current" &&
+            existingGatewayReady;
           if (!reusable) {
             // Drain/tombstone before touching the exact container. task-up's
             // pre-materialization cleanup then removes this stopped immutable
             // generation, so Compose must create the current RO/private-prefix
             // contract rather than `docker start`ing it again.
+            suspendTaskGatewayTask(input.task.id);
             await orchestrator.closeChannel(input.task.id);
             channelClosedForRecreate = true;
             const quarantined = await quarantineTaskRuntimeContainer({
@@ -740,6 +843,7 @@ export const hostCommands: HostCommands = {
                 previewPorts: parsePreviewPortRuntimes(
                   existingTask.previewPorts,
                 ),
+                envMode: hostTaskEnvMode(existingTask),
               },
             };
           }
@@ -749,6 +853,7 @@ export const hostCommands: HostCommands = {
         // Drain and invalidate any stale in-memory channel before taskUp
         // recreates the same stable compose/container names and repairs Git.
         if (!channelClosedForRecreate) {
+          suspendTaskGatewayTask(input.task.id);
           await orchestrator.closeChannel(input.task.id);
         }
       }
@@ -763,6 +868,8 @@ export const hostCommands: HostCommands = {
               endedAt: existingTask.endedAt,
               environmentProvider: existingTask.environmentProvider,
               environmentLocator: existingTask.environmentLocator,
+              envMode: existingTask.envMode,
+              projectEnvSpec: existingTask.projectEnvSpec,
             }
           : {
               statusMirror: existingTask.statusMirror,
@@ -771,6 +878,8 @@ export const hostCommands: HostCommands = {
               endedAt: existingTask.endedAt,
               environmentProvider: existingTask.environmentProvider,
               environmentLocator: existingTask.environmentLocator,
+              envMode: existingTask.envMode,
+              projectEnvSpec: existingTask.projectEnvSpec,
             }
         : {
             statusMirror: input.task.status,
@@ -778,6 +887,11 @@ export const hostCommands: HostCommands = {
             startedAt: null,
             endedAt: null,
           };
+      // ADR-153 machines: a task with no row has never run on this machine,
+      // so everything it runs comes through its hosts view. Recorded before
+      // the row, and so before the task's first process; a task with a row
+      // (a start driven again, a start after a stop) stands as recorded.
+      if (sidecarMode() && !existingTask) admitFreshTaskView(input.task.id);
       recordTaskStarting(input.task.id);
       // Cross-process managed maintenance and task admission use a two-sided
       // handshake: update/uninstall writes its durable marker before checking
@@ -806,6 +920,7 @@ export const hostCommands: HostCommands = {
           .sort((a, b) => a.position - b.position)
           .map((p) => p.id),
       );
+      recordTaskProjectEnvSpec(input.task.id, input);
       // ADR-048: persist the cloud-issued per-task cli secret (host-private) so the
       // `uai` CLI's per-agent tokens can be minted now + after a host restart.
       if (input.task.cliSecret) {
@@ -813,6 +928,7 @@ export const hostCommands: HostCommands = {
       }
       recordHostEvent(input.task.id, "task.created");
       let environmentLocator: TaskEnvironmentLocator | undefined;
+      let registeredTaskGatewayGeneration: string | null = null;
       const result = await wrapAgent(ctx, "taskUp", async () => {
         // Self-heal the standard base image before task-up needs it. The
         // boot-time build is best-effort + one-shot: a host that started before
@@ -848,9 +964,6 @@ export const hostCommands: HostCommands = {
             "GitHub is connected on this host, but Uai could not prepare its credential for Git. Retry the task; if it persists, reconnect GitHub on this host.",
           );
         }
-        // ADR-133 sidecar: nothing to clone or spawn with until the lease
-        // has landed and the store is reconciled under it.
-        await awaitSidecarReady();
         if (sidecarMode()) {
           // ADR-133: project env lives under /uai/projects/<id>, readable by
           // the lease only for parameters tagged with this org, and only the
@@ -870,6 +983,24 @@ export const hostCommands: HostCommands = {
             );
           }
         }
+        // Mint the authenticated task generation before its environment
+        // starts. The declarations are pinned; values remain live DB reads.
+        const gatewayRegistration = registerTaskGatewayTask(input.task.id, {
+          resolveEnv: taskEnvResolver(input.task.id, incomingEnvSpec),
+        });
+        registeredTaskGatewayGeneration = gatewayRegistration.generation;
+        const gatewaySecret = taskGatewayForwarderSecretInput(
+          input.task.id,
+          gatewayRegistration.generation,
+        );
+        if (gatewaySecret === null) {
+          removeTaskGatewayTask(
+            input.task.id,
+            gatewayRegistration.generation,
+          );
+          registeredTaskGatewayGeneration = null;
+          throw new Error("could not export the task gateway generation secret");
+        }
         // Launch screen: the first stage boundary. A machine-backed task
         // spends the next minute launching an EC2 instance; a container
         // task goes straight to preparing its workspace.
@@ -878,22 +1009,68 @@ export const hostCommands: HostCommands = {
           machineTasksEnabled() ? "machine" : "workspace",
         );
         try {
+          const taskGateway = {
+            generation: gatewayRegistration.generation,
+            secret: gatewaySecret,
+          };
           const provisioned = gitCredential
             ? await gitCredential.run(() =>
                 provisionTaskEnvironment(
                   input,
-                  { githubCredentialSocket: gitCredential.socketPath },
+                  {
+                    githubCredentialSocket: gitCredential.socketPath,
+                    taskGateway,
+                  },
                   async (locator) => {
-                    recordTaskEnvironmentPrepared(input.task.id, locator);
+                    recordTaskEnvironmentPrepared(
+                      input.task.id,
+                      locator,
+                      "loader",
+                    );
                   },
                 ),
               )
-            : await provisionTaskEnvironment(input, {}, async (locator) => {
-                recordTaskEnvironmentPrepared(input.task.id, locator);
-              });
+            : await provisionTaskEnvironment(
+                input,
+                { taskGateway },
+                async (locator) => {
+                  recordTaskEnvironmentPrepared(
+                    input.task.id,
+                    locator,
+                    "loader",
+                  );
+                },
+              );
           environmentLocator = provisioned.handle.descriptor.locator;
-          return provisioned.result;
+          // ADR-153 §4: the task's own schema observations, read from the
+          // bases task-up recorded before its container started (a machine
+          // captures its own). Stored once; a resume reuses them.
+          const envSchemas = isEnvironmentTransportProvider(getHostTask(input.task.id)?.environmentProvider)
+            ? undefined
+            : captureTaskEnvSchemas(
+                input.task.id,
+                incomingEnvSpec.projects.map((project) => project.projectId),
+              );
+          // ADR-153: before any consumer is let in, bring the task to now:
+          // a CA successor minted while it started, and the domains its
+          // policy has now rather than those task-up was handed. A failure
+          // leaves those keys withheld, and the trust watcher retries.
+          const secretsProxy = activeSecretsProxy();
+          if (secretsProxy !== null) {
+            await reconcileTaskProxyState(provisioned.handle, secretsProxy.runtime).catch((error: unknown) => {
+              console.warn(
+                `[secrets-proxy] task ${input.task.id}: could not bring the task's trust and pins up to date: ${
+                  error instanceof Error ? error.message : String(error)
+                }`,
+              );
+              secretsProxy.runtime.requestTrustDelivery();
+            });
+          }
+          return envSchemas === undefined || envSchemas.length === 0
+            ? { ...provisioned.result, envMode: "loader" as const }
+            : { ...provisioned.result, envMode: "loader" as const, envSchemas };
         } finally {
+          gatewaySecret.fill(0);
           await gitCredential?.close().catch((error: unknown) => {
             // Cleanup must not replace the actual task-up result/error. The
             // credential is short-lived and close() also removes its private
@@ -904,13 +1081,58 @@ export const hostCommands: HostCommands = {
           });
         }
       });
+      if (!result.ok && registeredTaskGatewayGeneration !== null) {
+        forgetTaskEnvSnapshot(input.task.id);
+        try {
+          removeTaskGatewayTask(
+            input.task.id,
+            registeredTaskGatewayGeneration,
+          );
+        } catch (error) {
+          // The in-process authority is revoked before durable deletion is
+          // attempted. Preserve the task-up error while retaining a cleanup
+          // diagnostic; a leftover file loads inactive after restart.
+          console.warn(
+            `[task-gateway] task ${input.task.id}: failed to remove the rejected generation: ${
+              error instanceof Error ? error.message : String(error)
+            }`,
+          );
+        }
+      }
       if (result.ok) {
         orchestrator.allowChannel(input.task.id);
         if (environmentLocator === undefined) {
           throw new Error("task environment provision returned no locator");
         }
-        recordTaskUpResult(input.task.id, result.value, environmentLocator);
+        recordTaskUpResult(
+          input.task.id,
+          result.value,
+          environmentLocator,
+          "loader",
+        );
         recordHostEvent(input.task.id, "task.started");
+        // ADR-153: with the proxy off, every start says so, since the task's
+        // proxied keys are withheld rather than delivered.
+        if (activeSecretsProxy() === null) {
+          orchestrator.emitSystemNote(
+            input.task.id,
+            secretsProxyEnabled()
+              ? "The secrets proxy could not start on this host, so this task's proxied env vars are withheld. See the host log."
+              : "The secrets proxy is off on this host (UAI_SECRETS_PROXY=off), so this task's proxied env vars are withheld.",
+          );
+        }
+        // ADR-153 §4: one note naming the keys this task does not get, and
+        // why, so nobody hunts for a value Uai withholds on purpose.
+        try {
+          const withheld = taskEnvWithheldNoteNow(input.task.id, incomingEnvSpec);
+          if (withheld !== null) orchestrator.emitSystemNote(input.task.id, withheld);
+        } catch (error) {
+          console.warn(
+            `[project-env] task ${input.task.id}: withheld-keys note failed: ${
+              error instanceof Error ? error.message : String(error)
+            }`,
+          );
+        }
         // Degraded start (uai-init failed twice): the task is up, but say so
         // in the feed — a silent half-start reads as a broken product.
         if (result.value.initWarning) {
@@ -1017,6 +1239,10 @@ export const hostCommands: HostCommands = {
       }
       // Tombstone + close before container destruction. A concurrent cloud
       // ensure cannot reopen the channel while teardown is awaiting Docker.
+      const suspendedTaskGateway = suspendTaskGatewayTask(input.taskId);
+      // ADR-153: the suspended generation is no longer served; end the
+      // proxy connections it already had, too.
+      activeSecretsProxy()?.runtime.stopTask(input.taskId);
       await orchestrator.closeChannel(input.taskId);
       if (orphanGc) {
         const inSlotRuntimeFailure = runtimeUnavailable();
@@ -1067,6 +1293,14 @@ export const hostCommands: HostCommands = {
             clearTaskGatewayAclStrict(input.taskId);
             removeTaskCliSecretStrict(input.taskId);
             removeTaskIdentityStrict(input.taskId);
+            removeTaskGatewayTask(input.taskId);
+            // No longer served: the proxy forgets its placeholders, and no
+            // write still queued for the task may land or record.
+            activeSecretsProxy()?.runtime.dropTask(input.taskId);
+            invalidateTaskWrites(input.taskId);
+            forgetTaskProxyReadiness(input.taskId);
+            forgetTaskEnvSnapshot(input.taskId);
+            forgetTaskEnvSchemaObservations(input.taskId);
             clearRefresh(input.taskId);
             // Last, atomically. Do not record taskDown/task.ended first: both
             // would recreate the very inventory evidence being pruned.
@@ -1081,10 +1315,25 @@ export const hostCommands: HostCommands = {
             return failFromUnknown(error);
           }
         }
-        // Revoke only after destruction succeeds. On failure the task is
-        // reopened below and its on-disk MCP definitions must retain the same
-        // gateway token; deleting it early would make those exact definitions
-        // look foreign and permanently strand the recovered channel.
+        // The live generation was suspended before channel drain. Delete its
+        // durable state only after destruction succeeds; on failure the task
+        // is reopened below with the same on-disk MCP definitions.
+        try {
+          removeTaskGatewayTask(input.taskId);
+        } catch (error) {
+          // Destruction succeeded and the live authority was already revoked,
+          // but keep the lifecycle retryable until the durable identity is
+          // gone. Never reopen a channel onto the destroyed runtime.
+          recordTaskError(input.taskId);
+          return failFromUnknown(error);
+        }
+        // No longer served: the proxy forgets its placeholders, and no write
+        // still queued for the task may land or record.
+        activeSecretsProxy()?.runtime.dropTask(input.taskId);
+        invalidateTaskWrites(input.taskId);
+        forgetTaskProxyReadiness(input.taskId);
+        forgetTaskEnvSnapshot(input.taskId);
+        forgetTaskEnvSchemaObservations(input.taskId);
         clearTaskGatewayAcl(input.taskId);
         recordTaskDown(input.taskId, result.value.status);
         recordHostEvent(input.taskId, "task.ended");
@@ -1092,7 +1341,12 @@ export const hostCommands: HostCommands = {
       } else {
         // Destruction failed; let a subsequent ensure restore the still-running
         // task instead of leaving it permanently tombstoned.
-        if (!orphanGc) orchestrator.allowChannel(input.taskId);
+        if (!orphanGc) {
+          if (suspendedTaskGateway) {
+            reactivateTaskGatewayTask(suspendedTaskGateway);
+          }
+          orchestrator.allowChannel(input.taskId);
+        }
       }
       return result;
     });