@runuai/host 0.9.149 → 0.9.151

package/lib/orchestrator.ts

@@ -51,6 +51,7 @@ import { isSafeHostTaskId } from "./task-identity";
 import { projectEnvForTask } from "./host-env";
 import { shadowRoute } from "./routing/shadow";
 import {
+  closeCurrentTaskRunAssignmentForStoppedRuntime,
   getHostTask,
   hostTaskEnvMode,
   hostTaskProjectIds,
@@ -79,6 +80,7 @@ import {
 } from "./container-runtime";
 import {
   reconstructPersistedTaskEnvironment,
+  reconstructTaskEnvironment,
   setAppleTaskEnvironmentRecoveryDriver,
   setDockerTaskEnvironmentRecoveryDriver,
 } from "./task-environment";
@@ -137,6 +139,14 @@ import {
   type BrowserSetup,
 } from "./browser-testing";
 import { injectCodexIntoContainer } from "./codex-auth";
+import { runtimeNamespaceOf, type RuntimeNamespace } from "./task-environment/workspace-files";
+import {
+  holdOwnCredentials,
+  LeftOwnCredentialsError,
+  onOwnCredentials,
+  onOwnCredentialsEnvironment,
+  whileOnOwnCredentials,
+} from "./cloud-credential-host";
 import { isCredentialInvalidSignal, requestCredentialRefresh } from "./token-broker-local";
 import {
   codexHomeIsolatable,
@@ -147,8 +157,51 @@ import {
   pickEngineAccount,
   provisionEngineAccounts,
   resolveEngineAccounts,
+  selectAccount,
   type ResolvedEngineAccount,
 } from "./engine-accounts";
+import {
+  ENGINE_ACCOUNT_HOMES,
+  EngineCredentialWriteRefused,
+  engineSpawnEnv,
+  engineVersionHeldBack,
+  ensureEngineHome,
+  escalateEngineLaunchFence,
+  isLeasedEngineAccount,
+  leasedEnginesFor,
+  onLeasedEnginesChanged,
+  refreshLeasedEngineAccount,
+  setEngineAdmissionFloorRaiser,
+  syncEngineHomes,
+  waitForEngineGate,
+  type LeasedEngineAccount,
+  type TaskEngineLease,
+} from "./credential-consumers/engines";
+import {
+  admitEngineLaunch,
+  anchoredEnvironment,
+  dischargeEngineRevocations,
+  ENGINE_ACCOUNT_ENV,
+  ENGINE_RUN_ENV,
+  EngineAnchorLost,
+  EngineLaunchRefused,
+  newEngineLaunchSlotId,
+  raiseEngineAdmissionFloors,
+  retireEngineLaunchSlot,
+  sameRuntime,
+  stopAnchoredEngines,
+  type EngineAdmissionFloor,
+  type EngineLaunchIdentity,
+} from "./credential-consumers/engine-anchor";
+import { CredentialLeaseUnavailableError } from "./cloud-credential-leases";
+import type { TaskCredentialCleanupRequest } from "./task-credential-cleanup";
+import {
+  forgetLeasedEngineRuntimes,
+  listCredentialCleanupPaths,
+  listLeasedEngineRuntimes,
+  rememberLeasedEngineRuntime,
+} from "./credential-cleanup-inventory";
+import { ENGINE_CREDENTIAL_FILES, ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
 import { clearTaskGatewayAcl, setupMcpTaskConfig } from "./mcp-gateway";
 import {
   reactivateTaskGatewayTask,
@@ -179,7 +232,11 @@ import {
   MAX_SECRETARY_DISPATCH_ID_CHARS,
   SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE,
 } from "../src/protocol";
-import { isEnvironmentTransportProvider } from "./task-environment/types";
+import {
+  isEnvironmentTransportProvider,
+  parseTaskEnvironmentLocator,
+  serializeTaskEnvironmentLocator,
+} from "./task-environment/types";
 import { forgetTaskEnvSnapshot } from "./task-env-source";
 
 export type HostEventSubscriber = (event: HostEvent) => void;
@@ -385,6 +442,41 @@ interface Channel {
   /** ADR-076: per-agent account-rotation budget (reset on a successful turn) —
    *  bounds a rate-limit storm across accounts, mirroring the respawn budget. */
   rotations: Map<string, number>;
+  /** ADR-154: the task's AI accounts come from its lease. Sticky for the
+   *  channel: once on cloud credentials, never the runner's own accounts. */
+  leased: boolean;
+  /** ADR-154 §8: rewrites of the task's account homes after a change, one
+   *  after another. */
+  leasedSync: Promise<void> | null;
+  /** ADR-154 §6: agents a cleanup stopped, started again on their next
+   *  account once the task's gate opens. */
+  leasedRespawn: Set<string>;
+  /** ADR-154 §6: the exact lease material each agent's session was picked
+   *  on, so a spawn starts only on what the task still holds and a cleanup
+   *  of an older run never stops a newer run's agent. */
+  leasedIdentityByAgent: Map<string, LeasedIdentity>;
+  /** ADR-154 §5: agents down for want of a usable account; the gate's next
+   *  opening starts them again. */
+  leasedBlocked: Set<string>;
+  /** ADR-154 §8: a failed rewrite of the account homes, retried. */
+  leasedSyncRetry: ReturnType<typeof setTimeout> | null;
+  /** ADR-154 §5, §6: agents wait to be started again (stopped by a cleanup,
+   *  down for want of an account, or their spawn's material moved); kept
+   *  until a start pass actually ran, so a failed pass does not lose it. */
+  leasedWakePending: boolean;
+  /** ADR-154 §6: engines being created on a leased account (null: on an
+   *  agent's task token alone, the Managed Engine) right now, each until its
+   *  create settles. Every cleanup attempt on the account (on every one, for
+   *  a whole run's) waits for them before it proves the engines gone,
+   *  whatever has become of the agent's binding meanwhile. */
+  leasedCreating: Set<{
+    agentId: string;
+    accountId: string | null;
+    runEpoch: number;
+    settled: Promise<void>;
+  }>;
+  /** ADR-154 §6: each agent's current spawn of a leased engine. */
+  leasedLaunches: Map<string, LeasedLaunchSlot>;
 }
 
 interface AcceptedPrompt {
@@ -405,6 +497,119 @@ interface RecoveryFence {
 const MAX_RESPAWNS_PER_AGENT = 5;
 /** ADR-076: hard cap on account rotations per agent between successful turns. */
 const MAX_ROTATIONS_PER_AGENT = 6;
+/** ADR-154 §5: how long a spawn waits for the task's leased AI accounts
+ *  before the agent fails with "credentials unavailable". */
+const LEASED_ACCOUNT_WAIT_MS = 60_000;
+/** ADR-154 §6: how long the cleanup's quiesce step waits for a spawn
+ *  already creating an engine on a removed account. */
+const LEASED_QUIESCE_EXIT_MS = 20_000;
+/** ADR-141: the shadow router reads the tail of the task's chat (it keeps
+ *  1,200 characters) and its classifier's answer, never more. */
+const SHADOW_CONTEXT_BYTES = 8 * 1024;
+const SHADOW_OUTPUT_BYTES = 64 * 1024;
+/** ADR-154 §6: the markers every process of a leased engine inherits: its
+ *  run and its account. A launch carrying them is an engine launch, started
+ *  only under the engine supervisor. */
+const LEASED_RUN_ENV = ENGINE_RUN_ENV;
+const LEASED_ACCOUNT_ENV = ENGINE_ACCOUNT_ENV;
+/**
+ * ADR-154 §6: every variable an env-token account may set, blank. A leased
+ * spawn carries these under its account's own values: an explicit blank
+ * wins over an adapter's inheritance of the runner's variable (Claude's
+ * passEnv, Grok's XAI_API_KEY, Cursor's fallback) and over the container's
+ * env, so no engine ever runs on the runner's own credential beside, or
+ * instead of, the task's.
+ */
+const LEASED_CREDENTIAL_BLANKS: Readonly<Record<string, string>> = Object.freeze(
+  Object.fromEntries(
+    [...new Set(Object.values(ENGINE_ENV_CREDENTIAL_KEYS).flat())].map((name) => [name, ""]),
+  ),
+);
+/** ADR-128: the Managed Engine. It needs no AI account (it runs on Uai's
+ *  gateway), but its agent's task token is its bearer: on a leased task its
+ *  launches are admitted as that token (ADR-154 §6). */
+const MANAGED_ENGINE_KIND = "uai";
+/** ADR-154 §10: kinds whose agents carry no credential at all; every other
+ *  kind outside the leased lanes (Kimi) stays down on a leased task until
+ *  its lane exists. */
+const CREDENTIAL_FREE_KINDS: ReadonlySet<string> = new Set(["mock"]);
+/** ADR-154 §8: how soon a failed rewrite of a task's account homes is tried
+ *  again. */
+const LEASED_SYNC_RETRY_MS = 30_000;
+
+/** ADR-154 §6: the exact lease material a spawn starts on: an AI account's,
+ *  or, for the Managed Engine, the task's open run alone (its agent's task
+ *  token is its credential). */
+type LeasedIdentity =
+  | { subject: "account"; runEpoch: number; credentialId: string; revision: string; version: number }
+  | { subject: "task-token"; runEpoch: number };
+
+type SpawnArgs = Omit<Parameters<AgentSessionFactory["create"]>[0], "environment">;
+
+/**
+ * ADR-154 §6: one spawn of an agent's leased engine. Its launches are
+ * admitted only while it is the agent's current spawn and, once its create
+ * settled, only while the session it bound is the agent's live one: a spawn
+ * replaced (on the same material too), retired, removed, never bound, or
+ * whose session reported its end, launches nothing more, and once retired,
+ * nothing it was admitted for starts in its runtime (`retireLeasedLaunch`).
+ */
+interface LeasedLaunchSlot {
+  created: boolean;
+  session: AgentSession | null;
+  /** What its launches are admitted as, its slot's id included, and where. */
+  readonly identity: EngineLaunchIdentity & { slotId: string };
+  readonly environment: TaskEnvironmentHandle<unknown>;
+  /** It began writing an admission: its retirement reaches its runtime. */
+  admitted: boolean;
+  retired: boolean;
+}
+
+/** ADR-154 §6: a retired slot not yet retired in its runtime. */
+interface RetiredLaunchSlot {
+  readonly agentId: string;
+  readonly slot: LeasedLaunchSlot;
+  /** The attempt under way, if one is. */
+  attempt: Promise<void> | null;
+  /** A cleanup of its run that covers it proves what it fences: a failure
+   *  after is not escalated. */
+  covered: boolean;
+  /** Its run's full cleanup was asked for once an attempt failed. */
+  escalated: boolean;
+}
+
+function newLeasedLaunchSlot(
+  taskId: string,
+  identity: LeasedIdentity,
+  environment: TaskEnvironmentHandle<unknown>,
+): LeasedLaunchSlot {
+  return {
+    created: false,
+    session: null,
+    identity: { taskId, slotId: newEngineLaunchSlotId(), ...identity },
+    environment,
+    admitted: false,
+    retired: false,
+  };
+}
+
+function sameLeasedIdentity(a: LeasedIdentity, b: LeasedIdentity): boolean {
+  if (a.subject === "account" && b.subject === "account") {
+    return (
+      a.runEpoch === b.runEpoch &&
+      a.credentialId === b.credentialId &&
+      a.revision === b.revision &&
+      a.version === b.version
+    );
+  }
+  return a.subject === b.subject && a.runEpoch === b.runEpoch;
+}
+
+/** The engine kinds whose agents run on an AI account from the lease. */
+const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
+  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
+  ...Object.keys(ENGINE_CREDENTIAL_FILES),
+]);
 /** A burned respawn budget resets after this quiet period (see reconcile). */
 const RESPAWN_COOLDOWN_MS = 10 * 60_000;
 /** ADR-053: gap between browser-install retries. Ensures fire every couple of
@@ -504,6 +709,20 @@ async function sshIdentityDepsFor(task: {
   return { environment: () => environment };
 }
 
+export type TaskStopAssignmentAdmission =
+  | { kind: "legacy" }
+  | { kind: "closed"; runEpoch: number }
+  | { kind: "stale" };
+
+export interface OrchestratorTaskStopResult {
+  ok: boolean;
+  error?: string;
+  assignmentStale?: boolean;
+  vetoed?: boolean;
+  /** Exact v1 run stopped under the lifecycle lock. Absent for legacy. */
+  stoppedRunEpoch?: number;
+}
+
 export class Orchestrator {
   private readonly channels = new Map<string, Channel>();
   private readonly channelSpecs = new Map<string, ChannelEnsureInput>();
@@ -517,8 +736,15 @@ export class Orchestrator {
    *  later command cannot overtake an earlier one after channel close. */
   private readonly taskLifecycleTails = new Map<string, Promise<void>>();
   private readonly hostSubscribers = new Set<HostEventSubscriber>();
+  /** ADR-154 §6: launch slots retired whose retirement has not yet reached
+   *  their runtime, per task, whatever channel they were in: an agent's next
+   *  spawn launches there only once they have (`retireLeasedLaunch`). */
+  private readonly leasedRetired = new Map<string, Set<RetiredLaunchSlot>>();
 
-  constructor(private readonly factory: AgentSessionFactory) {}
+  constructor(private readonly factory: AgentSessionFactory) {
+    onLeasedEnginesChanged((taskId) => this.leasedEnginesChanged(taskId));
+    setEngineAdmissionFloorRaiser((assignment, floors) => this.raiseLeasedAdmissionFloors(assignment, floors));
+  }
 
   // -- subscriptions --------------------------------------------------------
 
@@ -645,7 +871,7 @@ export class Orchestrator {
     for (const agent of added) {
       // Per-agent link/document skills, like getOrCreateChannel does at
       // channel birth. Best-effort.
-      writeAgentSkills(channel.taskId, agent);
+      writeAgentSkills(channel.taskId, agent, () => this.workspaceRuntime(channel.taskId));
     }
     for (const { agent, reason } of changed) {
       const recoveryAbortPublished = this.supersedeRecovery(
@@ -665,6 +891,9 @@ export class Orchestrator {
         );
       }
       channel.accountByAgent.delete(agent.id);
+      // ADR-154 §6: the retired spawn launches nothing more on its material.
+      channel.leasedIdentityByAgent.delete(agent.id);
+      void this.retireLeasedLaunch(channel, agent.id, channel.leasedLaunches.get(agent.id));
       channel.rotations.delete(agent.id);
       // Crash/recovery budgets belong to the retired launch generation. A
       // newly selected engine/model/effort must get an immediate clean start,
@@ -814,6 +1043,9 @@ export class Orchestrator {
     channel.respawnLastAt.delete(agentId);
     channel.everBound.delete(agentId);
     channel.accountByAgent.delete(agentId);
+    channel.leasedIdentityByAgent.delete(agentId);
+    // ADR-154 §6: its spawn admits nothing from here (see below for the end).
+    void this.retireLeasedLaunch(channel, agentId, channel.leasedLaunches.get(agentId));
     channel.lastPrompt.delete(agentId);
     channel.rotations.delete(agentId);
 
@@ -831,6 +1063,10 @@ export class Orchestrator {
       // factory await and closes the stale process instead of binding it.
       await inFlightCreate.catch(() => null);
     }
+    // The removal ends only once its spawns are retired in their runtime, or
+    // their run's cleanup is asked for (retireInRuntime): the current one, and
+    // any whose retirement an earlier event, or this removal's drain, began.
+    await Promise.all(this.leasedRetirementsUnderWay(channel.taskId, agentId));
     if (!this.isActiveChannel(channel)) return;
     // A newer ensure can re-add the same id while the old close/create drains.
     // That spec owns the status now; do not stop its bound generation or emit
@@ -972,9 +1208,6 @@ export class Orchestrator {
           taskProxiedKeys(taskId),
         ),
       );
-      // ADR-046: materialise this agent's skills to its per-agent SKILL.md in
-      // the workspace (bind-mounted into the container). Best-effort.
-      writeAgentSkills(taskId, agent);
       // ADR-022: any agent with a non-empty initialPrompt opens a first
       // turn at container-ready. The rest stay silent until addressed.
       const firstTurn = assembleFirstTurnPrompt(
@@ -1048,8 +1281,24 @@ export class Orchestrator {
       accountByAgent: new Map(),
       lastPrompt: new Map(),
       rotations: new Map(),
+      leased: false,
+      leasedSync: null,
+      leasedRespawn: new Set(),
+      leasedIdentityByAgent: new Map(),
+      leasedBlocked: new Set(),
+      leasedSyncRetry: null,
+      leasedWakePending: false,
+      leasedCreating: new Set(),
+      leasedLaunches: new Map(),
     };
     this.channels.set(taskId, channel);
+    // ADR-046: materialise each agent's skills to its per-agent SKILL.md in
+    // the workspace (bind-mounted into the container), best-effort, once the
+    // channel can give the task's runtime: where only it can make the
+    // agent's directory (macOS, #cb3j0z), it is asked for then.
+    for (const agent of roster) {
+      writeAgentSkills(taskId, agent, () => this.workspaceRuntime(taskId));
+    }
     return channel;
   }
 
@@ -1255,22 +1504,90 @@ export class Orchestrator {
    * copies use this gate: a false→true toggle queues migration after the older
    * copy, so that copy cannot land last and erase the managed browser block.
    */
-  private codexHomes(hasCodex: boolean, scope: string): string[] {
+  private codexHomes(hasCodex: boolean, channel: Channel): string[] {
     if (!hasCodex) return [];
-    const homes = resolveEngineAccounts("codex", {}, scope)
-      .map((account) => account.configDir?.containerDir)
-      .filter((home): home is string => Boolean(home));
-    return [...new Set([DEFAULT_CODEX_HOME, ...homes])];
+    return [...new Set([DEFAULT_CODEX_HOME, ...this.accountHomes(channel, "codex")])];
   }
 
-  /** Every GROK_HOME a task in `scope` may run under: the default plus each
-   *  sign-in account's isolated home (API-key accounts use the default). */
-  private grokHomes(hasGrok: boolean, scope: string): string[] {
+  /** Every GROK_HOME a task may run under: the default plus each sign-in
+   *  account's isolated home (API-key accounts use the default). */
+  private grokHomes(hasGrok: boolean, channel: Channel): string[] {
     if (!hasGrok) return [];
-    const homes = resolveEngineAccounts("grok", {}, scope)
-      .map((account) => account.configDir?.containerDir)
-      .filter((home): home is string => Boolean(home));
-    return [...new Set([DEFAULT_GROK_HOME, ...homes])];
+    return [...new Set([DEFAULT_GROK_HOME, ...this.accountHomes(channel, "grok")])];
+  }
+
+  /** The homes `kind`'s config-directory accounts live in: the task's leased
+   *  ones, or the runner's own for a task not on cloud credentials. A leased
+   *  Codex account's home is listed with every Codex agent's own home on it,
+   *  so the task's managed config (browser, MCP) reaches the homes the
+   *  agents run in, now and whenever it changes. */
+  private accountHomes(channel: Channel, kind: string): string[] {
+    if (!this.isLeasedChannel(channel)) {
+      return resolveEngineAccounts(kind, {}, channel.engineAccountScope)
+        .map((account) => account.configDir?.containerDir)
+        .filter((home): home is string => Boolean(home));
+    }
+    const homes = (leasedEnginesFor(channel.taskId)?.accounts ?? [])
+      .filter((account) => account.engineKind === kind && account.home !== null)
+      .map((account) => account.home!);
+    if (kind !== "codex") return homes;
+    const agents = channel.roster.filter((agent) => agent.kind === "codex");
+    return homes.flatMap((home) => [home, ...agents.map((agent) => codexPerAgentHome(home, agent.id))]);
+  }
+
+  /** ADR-154: whether this channel's AI accounts come from the task's lease
+   *  (the engine consumer holds a record for the task, or the runner is no
+   *  longer on its own credentials at all: no default slot, so an agent
+   *  reattached before its grant waits for it). Sticky: a channel that was
+   *  on cloud credentials never falls back to the runner's own accounts,
+   *  not even after the record is gone. */
+  private isLeasedChannel(channel: Channel): boolean {
+    if (!channel.leased && (leasedEnginesFor(channel.taskId) !== undefined || !onOwnCredentials())) {
+      channel.leased = true;
+    }
+    return channel.leased;
+  }
+
+  /**
+   * The accounts `kind` may run on, in try order: the task's leased ones
+   * that are readable now (none while its gate is closed), or the runner's
+   * own for a task not on cloud credentials. A leased account carries no env
+   * and no directory here: the spawn boundary applies it (leasedSpawnArgs),
+   * and no runner-side copy ever names it.
+   */
+  private engineAccounts(channel: Channel, kind: string): ResolvedEngineAccount[] {
+    if (!this.isLeasedChannel(channel)) {
+      return resolveEngineAccounts(kind, {}, channel.engineAccountScope);
+    }
+    const lease = leasedEnginesFor(channel.taskId);
+    if (!lease?.open) return [];
+    return lease.accounts
+      .filter(
+        (account): account is LeasedEngineAccount =>
+          account.engineKind === kind && isLeasedEngineAccount(account),
+      )
+      .map((account) => ({
+        id: account.credentialId,
+        kind,
+        label: account.label,
+        isDefault: false,
+        scope: account.scope,
+        authKind: account.authKind,
+        execEnv: {},
+      }));
+  }
+
+  /** ADR-076 selection over `engineAccounts`: the first healthy account in
+   *  try order, skipping `exclude`. */
+  private pickAccount(
+    channel: Channel,
+    kind: string,
+    exclude?: Set<string>,
+  ): ResolvedEngineAccount | null {
+    if (!this.isLeasedChannel(channel)) {
+      return pickEngineAccount(kind, { scope: channel.engineAccountScope, exclude });
+    }
+    return selectAccount(this.engineAccounts(channel, kind), { exclude });
   }
 
   private noteProvisionMutation(
@@ -1299,9 +1616,12 @@ export class Orchestrator {
     if (this.isActiveChannel(channel)) channel.configGeneration += 1;
   }
 
-  private provisionFingerprint(kinds: readonly string[], scope: string): string {
+  private provisionFingerprint(kinds: readonly string[], channel: Channel): string {
+    // ADR-154: a leased task's accounts are never copied from the runner;
+    // the spawn boundary writes each one's files through the engine consumer.
+    if (this.isLeasedChannel(channel)) return "leased";
     const accounts = kinds.flatMap((kind) =>
-      resolveEngineAccounts(kind, {}, scope)
+      resolveEngineAccounts(kind, {}, channel.engineAccountScope)
         .filter((account) => !account.isDefault && account.configDir)
         .map((account) => ({
           kind,
@@ -1374,13 +1694,13 @@ export class Orchestrator {
     const requestedHasCodex =
       hasCodex || channel.roster.some((agent) => agent.kind === "codex");
     const requestedHomes = requestedBrowser
-      ? this.codexHomes(requestedHasCodex, channel.engineAccountScope)
+      ? this.codexHomes(requestedHasCodex, channel)
       : [];
     const requestedKinds = [
       ...new Set(channel.roster.map((agent) => agent.kind)),
     ];
     const requestedProvisionFingerprint =
-      this.provisionFingerprint(requestedKinds, channel.engineAccountScope);
+      this.provisionFingerprint(requestedKinds, channel);
     const changedProvisionKinds = this.changedProvisionKinds(
       channel.provisionAttemptedFingerprint,
       requestedProvisionFingerprint,
@@ -1389,11 +1709,14 @@ export class Orchestrator {
     const provisionKinds = forceProvision
       ? requestedKinds
       : changedProvisionKinds;
-    const mutableProvisionKinds = provisionKinds.filter((kind) =>
-      resolveEngineAccounts(kind, {}, channel.engineAccountScope).some(
-        (account) => !account.isDefault && Boolean(account.configDir),
-      ),
-    );
+    const leased = this.isLeasedChannel(channel);
+    const mutableProvisionKinds = leased
+      ? []
+      : provisionKinds.filter((kind) =>
+          resolveEngineAccounts(kind, {}, channel.engineAccountScope).some(
+            (account) => !account.isDefault && Boolean(account.configDir),
+          ),
+        );
     const mayProvisionConfig = mutableProvisionKinds.length > 0;
 
     const inFlight = channel.browserSetup;
@@ -1410,13 +1733,13 @@ export class Orchestrator {
         requestedHasCodex ||
         channel.roster.some((agent) => agent.kind === "codex");
       const latestHomes = latestBrowser
-        ? this.codexHomes(latestHasCodex, channel.engineAccountScope)
+        ? this.codexHomes(latestHasCodex, channel)
         : [];
       const latestKinds = [
         ...new Set(channel.roster.map((agent) => agent.kind)),
       ];
       const latestProvisionFingerprint =
-        this.provisionFingerprint(latestKinds, channel.engineAccountScope);
+        this.provisionFingerprint(latestKinds, channel);
       if (
         (latestBrowser &&
           coverage?.browserAttempted !== true &&
@@ -1452,7 +1775,12 @@ export class Orchestrator {
           forceProvision ||
           channel.provisionAttemptedFingerprint !==
             requestedProvisionFingerprint;
-        if (shouldProvision) {
+        if (shouldProvision && leased) {
+          // ADR-154: nothing is copied from the runner for a leased task.
+          coverage.provisionAttempted = true;
+          channel.provisionAttemptedFingerprint = requestedProvisionFingerprint;
+          channel.provisionRetryFingerprint = undefined;
+        } else if (shouldProvision) {
           coverage.provisionAttempted = true;
           if (mayProvisionConfig) {
             // Fence a factory that started before the copy without declaring a
@@ -1462,21 +1790,27 @@ export class Orchestrator {
           }
           let copiedOrUnknown = false;
           try {
-            const provisioned = channel.agentHandle
-              ? await provisionEngineAccounts(
-                  channel.containerName,
-                  provisionKinds,
-                  {},
-                  channel.agentHandle,
-                  channel.engineAccountScope,
-                )
-              : await provisionEngineAccounts(
-                  channel.containerName,
-                  provisionKinds,
-                  {},
-                  undefined,
-                  channel.engineAccountScope,
-                );
+            // ADR-154: the runner's own accounts, copied only while it is on
+            // its own credentials, counted (leaving waits for the copy);
+            // once leaving has begun, nothing is copied.
+            const provisioning = whileOnOwnCredentials(() =>
+              channel.agentHandle
+                ? provisionEngineAccounts(
+                    channel.containerName,
+                    provisionKinds,
+                    {},
+                    channel.agentHandle,
+                    channel.engineAccountScope,
+                  )
+                : provisionEngineAccounts(
+                    channel.containerName,
+                    provisionKinds,
+                    {},
+                    undefined,
+                    channel.engineAccountScope,
+                  ),
+            );
+            const provisioned = (await provisioning) ?? { copied: 0, failed: 0, mayHaveMutated: false };
             copiedOrUnknown =
               provisioned.copied > 0 || provisioned.mayHaveMutated;
             if (provisioned.failed > 0) {
@@ -1537,7 +1871,7 @@ export class Orchestrator {
               requestedHomes,
               channel.agentHandle,
               requestedKinds,
-              this.grokHomes(requestedKinds.includes("grok"), channel.engineAccountScope),
+              this.grokHomes(requestedKinds.includes("grok"), channel),
             )
           : await setupBrowserTesting(
               channel.taskId,
@@ -1546,7 +1880,7 @@ export class Orchestrator {
               requestedHomes,
               undefined,
               requestedKinds,
-              this.grokHomes(requestedKinds.includes("grok"), channel.engineAccountScope),
+              this.grokHomes(requestedKinds.includes("grok"), channel),
             );
       } catch (err) {
         console.warn(
@@ -1617,15 +1951,12 @@ export class Orchestrator {
       requestedHasCodex ||
       channel.roster.some((agent) => agent.kind === "codex");
     const latestHomes = latestBrowser
-      ? this.codexHomes(latestHasCodex, channel.engineAccountScope)
+      ? this.codexHomes(latestHasCodex, channel)
       : [];
     const latestKinds = [
       ...new Set(channel.roster.map((agent) => agent.kind)),
     ];
-    const latestProvisionFingerprint = this.provisionFingerprint(
-      latestKinds,
-      channel.engineAccountScope,
-    );
+    const latestProvisionFingerprint = this.provisionFingerprint(latestKinds, channel);
     if (
       (latestBrowser &&
         !coverage.browserAttempted &&
@@ -1714,12 +2045,9 @@ export class Orchestrator {
       ...new Set(channel.roster.map((agent) => agent.kind)),
     ].sort();
     const codexHomes = engineKinds.includes("codex")
-      ? this.codexHomes(true, channel.engineAccountScope)
+      ? this.codexHomes(true, channel)
       : [];
-    const grokHomes = this.grokHomes(
-      engineKinds.includes("grok"),
-      channel.engineAccountScope,
-    );
+    const grokHomes = this.grokHomes(engineKinds.includes("grok"), channel);
     const fingerprint = JSON.stringify({
       connections,
       engineKinds,
@@ -2053,6 +2381,9 @@ export class Orchestrator {
         if (channel.sessions.has(agent.id) || channel.spawning.has(agent.id)) {
           return false;
         }
+        // ADR-154 §5: down for want of a usable account until the gate next
+        // opens (which starts it again), not retried on every pass.
+        if (channel.leasedBlocked.has(agent.id)) return false;
         // Crash-loop budget: an agent whose session keeps dying stops being
         // respawned after MAX_RESPAWNS_PER_AGENT (the exit paths increment) —
         // but a cold budget resets so the task can heal after the cause clears.
@@ -2162,7 +2493,12 @@ export class Orchestrator {
               ),
             },
           );
-          if (!session) return;
+          if (!session) {
+            // Credentials unavailable is this agent's alone: its siblings
+            // still start.
+            if (channel.leasedBlocked.has(agent.id)) continue;
+            return;
+          }
           this.startNextPendingPrompt(channel, agent.id);
         }
       } finally {
@@ -2257,6 +2593,9 @@ export class Orchestrator {
       channel.accountByAgent.delete(agent.id);
       return { ...floor, ...base };
     }
+    // ADR-154: a leased task's account is picked and applied at the spawn
+    // boundary (leasedSpawnArgs), which can wait for the task's gate.
+    if (this.isLeasedChannel(channel)) return { ...floor, ...base };
     const account = pickEngineAccount(agent.kind, {
       scope: channel.engineAccountScope,
     });
@@ -2345,6 +2684,11 @@ export class Orchestrator {
       ) {
         return;
       }
+      // ADR-154 §6: an engine that ended launches nothing more from now,
+      // whatever its terminal handling still awaits (the runtime's proof).
+      if (event.type === "error" || event.type === "exit") {
+        this.endLeasedLaunches(channel, agentId, session);
+      }
       const operation = eventTail
         .catch(() => {})
         .then(async () => {
@@ -2411,6 +2755,835 @@ export class Orchestrator {
     return operation;
   }
 
+  /**
+   * ADR-154 §5, §6, §10: what a spawn on the task's leased AI account takes,
+   * and the exact lease material it starts on. The agent runs on the account
+   * it is bound to while that account is still served readable, else on the
+   * first healthy one in try order (the owner's accounts, then the
+   * workspace's). An env-token account's values ride the spawn, synchronously
+   * when nothing has to be waited for. A config-directory account's home gets
+   * the task's managed config first (browser, MCP), then its files, through
+   * the engine consumer, in the home the agent runs in (Codex's own copy,
+   * seeded from the account's home without its credential files). While the
+   * task's gate is closed it waits, bounded; null when no account can be
+   * used, and the agent stays down with "credentials unavailable", never on
+   * the runner's own accounts, until the gate next opens.
+   */
+  private leasedSpawnArgs(
+    channel: Channel,
+    agentId: string,
+    args: SpawnArgs,
+    environment: TaskEnvironmentHandle<unknown>,
+  ):
+    | { args: SpawnArgs; identity: LeasedIdentity }
+    | null
+    | Promise<{ args: SpawnArgs; identity: LeasedIdentity } | null> {
+    const kind = args.agent?.kind ?? "";
+    const lease = leasedEnginesFor(channel.taskId);
+    if (lease?.open) {
+      const account = this.leasedAccountFor(channel, agentId, kind, lease);
+      if (account?.authKind === "env") {
+        return this.withLeasedAccount(channel, agentId, args, account, lease.assignment.runEpoch);
+      }
+    }
+    return (async () => {
+      const deadline = Date.now() + LEASED_ACCOUNT_WAIT_MS;
+      let reason = "the task's AI accounts are not available";
+      let moved = 0;
+      while (this.isActiveChannel(channel)) {
+        const open = await this.leasedGateOpen(channel, deadline);
+        if (!open) break;
+        if (!this.isActiveChannel(channel)) return null;
+        const account = this.leasedAccountFor(channel, agentId, kind, open);
+        if (!account) {
+          reason = `no ${kind} account this task can use`;
+          break;
+        }
+        if (account.authKind === "env") {
+          return this.withLeasedAccount(channel, agentId, args, account, open.assignment.runEpoch);
+        }
+        // The account's home gets the task's managed config before anything
+        // can start in it, whenever the gate's opening first reveals it.
+        await this.ensureBrowserSetup(channel, kind === "codex");
+        if (!this.isActiveChannel(channel)) return null;
+        await this.ensureMcpConfig(channel);
+        if (!this.isActiveChannel(channel)) return null;
+        // Codex runs in a home of its own (two agents on one account never
+        // share its state runtime); the config writers above reached it.
+        const home = kind === "codex" ? codexPerAgentHome(account.home!, agentId) : account.home!;
+        try {
+          await ensureEngineHome(environment, open.assignment, account.credentialId, home);
+        } catch (error) {
+          // The account moved while it was written (a newer version, a
+          // cleanup, no longer readable, the gate closing): pick again on
+          // what the gate serves, or will once it reopens, a few times while
+          // time remains. Anything else ends here.
+          if (
+            (error instanceof EngineCredentialWriteRefused || error instanceof CredentialLeaseUnavailableError) &&
+            moved++ < 3 &&
+            Date.now() < deadline
+          ) {
+            continue;
+          }
+          reason = error instanceof CredentialLeaseUnavailableError ? error.message : "its files could not be written";
+          break;
+        }
+        if (!this.isActiveChannel(channel)) return null;
+        return this.withLeasedAccount(channel, agentId, args, account, open.assignment.runEpoch, home);
+      }
+      if (!this.isActiveChannel(channel)) return null;
+      this.leasedUnavailable(channel, agentId, reason);
+      return null;
+    })();
+  }
+
+  /** The task's open engine lease, waited for while time remains, a newer
+   *  run's when the task moves on to one; null when none opens in time. */
+  private async leasedGateOpen(channel: Channel, deadline: number): Promise<TaskEngineLease | null> {
+    while (this.isActiveChannel(channel)) {
+      const record = leasedEnginesFor(channel.taskId);
+      if (!record) return null;
+      try {
+        return await waitForEngineGate(record.assignment, Math.max(0, deadline - Date.now()));
+      } catch {
+        // The task moved on to another run: wait for that run's gate while
+        // time remains.
+        if (leasedEnginesFor(channel.taskId)?.assignment.runEpoch !== record.assignment.runEpoch && Date.now() < deadline) {
+          continue;
+        }
+        return null;
+      }
+    }
+    return null;
+  }
+
+  /**
+   * ADR-154 §6, ADR-128: what a Managed Engine spawn on a leased task takes.
+   * It runs on no AI account, but its agent's task token is its bearer: it
+   * is bound to the task's open run, its launches admitted as that token on
+   * this binding, under the engine supervisor like any leased engine's.
+   * While the task's gate is closed it waits, bounded; null when it stays
+   * closed, and the agent stays down with "credentials unavailable" until
+   * the gate next opens.
+   */
+  private leasedTaskTokenSpawnArgs(
+    channel: Channel,
+    agentId: string,
+    args: SpawnArgs,
+  ):
+    | { args: SpawnArgs; identity: LeasedIdentity }
+    | null
+    | Promise<{ args: SpawnArgs; identity: LeasedIdentity } | null> {
+    const lease = leasedEnginesFor(channel.taskId);
+    if (lease?.open) return this.withLeasedTaskToken(channel, agentId, args, lease.assignment.runEpoch);
+    return (async () => {
+      const open = await this.leasedGateOpen(channel, Date.now() + LEASED_ACCOUNT_WAIT_MS);
+      if (!this.isActiveChannel(channel)) return null;
+      if (!open) {
+        this.leasedUnavailable(channel, agentId, "the task's credentials are not available");
+        return null;
+      }
+      return this.withLeasedTaskToken(channel, agentId, args, open.assignment.runEpoch);
+    })();
+  }
+
+  /** Bind the agent to the task's run `runEpoch` on its task token alone,
+   *  and give its spawn the run's marker every process it starts inherits
+   *  (its launches are known by it, and admitted on this binding). */
+  private withLeasedTaskToken(
+    channel: Channel,
+    agentId: string,
+    args: SpawnArgs,
+    runEpoch: number,
+  ): { args: SpawnArgs; identity: LeasedIdentity } {
+    const identity = { subject: "task-token" as const, runEpoch };
+    channel.leasedIdentityByAgent.set(agentId, identity);
+    return {
+      identity,
+      args: {
+        ...args,
+        attachCompatibilityKey: JSON.stringify([args.attachCompatibilityKey ?? null, "lease-v1", runEpoch, "task-token"]),
+        agentEnv: {
+          ...(args.agentEnv ?? {}),
+          // The gateway's bearer is the agent's own token; no engine's
+          // credential of the runner's rides beside it.
+          ...LEASED_CREDENTIAL_BLANKS,
+          [LEASED_RUN_ENV]: String(runEpoch),
+        },
+      },
+    };
+  }
+
+  /**
+   * ADR-154 §6: the environment a leased engine's adapter launches through.
+   * Each engine launch it makes (the session, each one-shot turn, a durable
+   * runner once deployed, a classifier's exec), at whatever moment its
+   * transport gets there, is admitted then: for an agent's spawn (`owner`),
+   * only while that spawn is the agent's current one and, once its create
+   * settled, the session it bound is the agent's live one, and `identity`
+   * is still what the agent runs on and the task's open gate serves (for a
+   * one-shot with no agent, only the latter). The admission is written into
+   * the runtime first (its exec admitted at the provider's last moment) and
+   * the check made again just before the launch is handed over and at the
+   * provider's last moment. The launch then starts under the engine
+   * supervisor, which consumes that admission. A spawn's admissions name its
+   * slot: before its first, the agent's earlier spawns are retired in the
+   * runtime, and once the slot is retired, nothing it was admitted for
+   * starts there (`retireLeasedLaunch`). A cleanup unbinds first, waits for
+   * the admissions under way (registered before their first await), and
+   * revokes in the runtime what they wrote before it kills what the
+   * supervisors own.
+   */
+  private leasedLaunchEnvironment(
+    channel: Channel,
+    owner: { agentId: string; slot: LeasedLaunchSlot } | null,
+    identity: LeasedIdentity,
+    environment: TaskEnvironmentHandle<unknown>,
+  ): TaskEnvironmentHandle<unknown> {
+    const agentId = owner?.agentId ?? null;
+    const held = (): boolean =>
+      this.isActiveChannel(channel) &&
+      (owner === null
+        ? this.leasedMaterialServed(channel, identity)
+        : channel.leasedLaunches.get(owner.agentId) === owner.slot &&
+          (owner.slot.session === null
+            ? !owner.slot.created
+            : channel.sessions.get(owner.agentId) === owner.slot.session) &&
+          this.leasedIdentityHeld(channel, owner.agentId, identity));
+    const admittedAs: EngineLaunchIdentity = owner?.slot.identity ?? { taskId: channel.taskId, slotId: null, ...identity };
+    return anchoredEnvironment(environment, {
+      held,
+      admit: (carried) => {
+        if (environment.anchors !== true || !held()) return Promise.reject(new EngineLaunchRefused());
+        if (owner) owner.slot.admitted = true;
+        const admitted = (async () => {
+          if (owner) await this.leasedPredecessorsRetired(owner.agentId, owner.slot);
+          return admitEngineLaunch(
+            environment,
+            admittedAs,
+            () => {
+              if (!held()) throw new EngineLaunchRefused();
+            },
+            carried,
+          );
+        })();
+        const entry = {
+          agentId: agentId ?? "",
+          accountId: identity.subject === "account" ? identity.credentialId : null,
+          runEpoch: identity.runEpoch,
+          settled: admitted.then(
+            () => undefined,
+            () => undefined,
+          ),
+        };
+        channel.leasedCreating.add(entry);
+        void entry.settled.then(() => channel.leasedCreating.delete(entry));
+        return admitted;
+      },
+    });
+  }
+
+  /** `session` ended (its engine's error or exit): its spawn admits no
+   *  launch from this moment, before its terminal handling awaits anything.
+   *  Every such handling retires or replaces the session. */
+  private endLeasedLaunches(channel: Channel, agentId: string, session: AgentSession): void {
+    const slot = channel.leasedLaunches.get(agentId);
+    if (slot?.session === session) void this.retireLeasedLaunch(channel, agentId, slot);
+  }
+
+  /**
+   * ADR-154 §6: `slot` admits nothing from this moment. Then, in its
+   * runtime, it is retired: every admission it wrote that no launch has used
+   * is revoked, and none of its own is written or used after, so a launch
+   * handed to its provider before now that has not started there never
+   * does, with the agent's old task token or anything else. The agent's
+   * next spawn launches in that runtime only once that is done
+   * (`leasedPredecessorsRetired`). Resolves once that is done or escalated
+   * (see `retireInRuntime`); never rejects.
+   */
+  private retireLeasedLaunch(channel: Channel, agentId: string, slot: LeasedLaunchSlot | undefined): Promise<void> {
+    if (!slot || slot.retired) return Promise.resolve();
+    slot.retired = true;
+    if (channel.leasedLaunches.get(agentId) === slot) channel.leasedLaunches.delete(agentId);
+    // It never wrote an admission: nothing of it is in its runtime.
+    if (!slot.admitted) return Promise.resolve();
+    const retired: RetiredLaunchSlot = { agentId, slot, attempt: null, covered: false, escalated: false };
+    let pending = this.leasedRetired.get(channel.taskId);
+    if (!pending) {
+      pending = new Set();
+      this.leasedRetired.set(channel.taskId, pending);
+    }
+    pending.add(retired);
+    return this.retireInRuntime(retired).catch(() => undefined);
+  }
+
+  /**
+   * One attempt to retire `retired` in its runtime, joined while one is
+   * under way; once done, it is no longer pending. Should it fail, the order
+   * is lost: a launch handed over before the retirement may start before
+   * any later one lands, and nothing a retry does stops it. So, unless a
+   * cleanup that covers it is under way or done, the run's full credential
+   * cleanup is asked for at once (`escalateEngineLaunchFence`): its gate
+   * closed first, it proves no engine of the run runs (or stops the
+   * runtime), and keeps failing closed until it can. Rejects when this
+   * attempt failed (it is retained and retried meanwhile).
+   */
+  private retireInRuntime(retired: RetiredLaunchSlot): Promise<void> {
+    if (retired.attempt) return retired.attempt;
+    const { taskId, runEpoch } = retired.slot.identity;
+    const attempt = retireEngineLaunchSlot(retired.slot.environment, retired.slot.identity)
+      .then(
+        () => this.forgetRetired(taskId, retired),
+        (error: unknown) => {
+          if (!retired.covered && !retired.escalated) {
+            retired.escalated = true;
+            console.warn(
+              `[orchestrator] ${taskId}/${retired.agentId}: a retired spawn could not be retired in its runtime; cleaning up its run's credentials (${
+                error instanceof Error ? error.message : String(error)
+              })`,
+            );
+            escalateEngineLaunchFence({ taskId, runEpoch });
+          }
+          throw error;
+        },
+      )
+      .finally(() => {
+        if (retired.attempt === attempt) retired.attempt = null;
+      });
+    retired.attempt = attempt;
+    return attempt;
+  }
+
+  /** The task's retirements still under way (of `agentId`'s spawns alone,
+   *  when named), whichever event began them: each resolves once its slot is
+   *  retired in its runtime, or its run's cleanup has been asked for. What a
+   *  removal or a channel's close waits for. */
+  private leasedRetirementsUnderWay(taskId: string, agentId?: string): Array<Promise<void>> {
+    return [...(this.leasedRetired.get(taskId) ?? [])]
+      .filter((retired) => agentId === undefined || retired.agentId === agentId)
+      .flatMap((retired) => (retired.attempt ? [retired.attempt.catch(() => undefined)] : []));
+  }
+
+  private forgetRetired(taskId: string, retired: RetiredLaunchSlot): void {
+    const pending = this.leasedRetired.get(taskId);
+    if (!pending) return;
+    pending.delete(retired);
+    if (pending.size === 0) this.leasedRetired.delete(taskId);
+  }
+
+  /**
+   * ADR-154 §6: before `slot` writes an admission, every earlier slot of the
+   * same agent retired for the same run in the same runtime is retired
+   * there: nothing the agent's earlier spawns were admitted for can start
+   * after this one's launch. Rejects with `EngineLaunchRefused` when one
+   * could not be now.
+   */
+  private async leasedPredecessorsRetired(agentId: string, slot: LeasedLaunchSlot): Promise<void> {
+    const earlier = [...(this.leasedRetired.get(slot.identity.taskId) ?? [])].filter(
+      (retired) =>
+        retired.agentId === agentId &&
+        retired.slot.identity.runEpoch === slot.identity.runEpoch &&
+        sameRuntime(retired.slot.environment, slot.environment),
+    );
+    try {
+      await Promise.all(earlier.map((retired) => this.retireInRuntime(retired)));
+    } catch {
+      throw new EngineLaunchRefused("an earlier start of this agent could not be retired in its runtime yet");
+    }
+  }
+
+  /** The retirements still pending that a cleanup of these runs and
+   *  accounts (of every subject, for a whole run's) covers: its stop revokes
+   *  everything they fence, wherever it was written, and kills what any
+   *  launch of theirs started. Each is marked covered: one that fails from
+   *  now on is not escalated. */
+  private coveredLeasedRetirements(
+    request: Pick<TaskCredentialCleanupRequest, "taskId" | "runEpoch" | "credentialIds">,
+  ): RetiredLaunchSlot[] {
+    const named = request.credentialIds === undefined ? null : new Set(request.credentialIds);
+    const covered = [...(this.leasedRetired.get(request.taskId) ?? [])].filter((retired) => {
+      const { identity } = retired.slot;
+      return (
+        identity.runEpoch <= request.runEpoch &&
+        (!named || (identity.subject === "account" && named.has(identity.credentialId)))
+      );
+    });
+    for (const retired of covered) retired.covered = true;
+    return covered;
+  }
+
+  /** A cleanup proved every admission of these runs and accounts (of every
+   *  subject, for a whole run's) revoked wherever it was written: the
+   *  retirements still pending for them are done. */
+  private dischargeLeasedRetirements(
+    request: Pick<TaskCredentialCleanupRequest, "taskId" | "runEpoch" | "credentialIds">,
+  ): void {
+    for (const retired of this.coveredLeasedRetirements(request)) this.forgetRetired(request.taskId, retired);
+  }
+
+  /** The agent stays down for want of a usable account, says why, and is
+   *  started again when the task's gate next opens. */
+  private leasedUnavailable(channel: Channel, agentId: string, reason: string): void {
+    channel.accountByAgent.delete(agentId);
+    channel.leasedIdentityByAgent.delete(agentId);
+    channel.leasedBlocked.add(agentId);
+    this.emitHost({
+      kind: "agent.exit",
+      taskId: channel.taskId,
+      agentId,
+      reason: `${agentId}: credentials unavailable (${reason}) — the agent starts again when they are.`,
+    });
+  }
+
+  /** Whether the task's open gate still serves `identity`'s account at its
+   *  revision and version, for its run, and that version is not being held
+   *  back for a newer one: what a one-shot may start on. An agent's task
+   *  token alone needs only its run's gate open. */
+  private leasedMaterialServed(channel: Channel, identity: LeasedIdentity): boolean {
+    const lease = leasedEnginesFor(channel.taskId);
+    if (!lease?.open || lease.assignment.runEpoch !== identity.runEpoch) return false;
+    if (identity.subject === "task-token") return true;
+    const account = lease.accounts.find((candidate) => candidate.credentialId === identity.credentialId);
+    return (
+      isLeasedEngineAccount(account) &&
+      account.revision === identity.revision &&
+      account.version === identity.version &&
+      !engineVersionHeldBack(lease.assignment, identity)
+    );
+  }
+
+  /** A spawn found its lease material moved (a newer version, a cleanup):
+   *  start the agent again on what the task holds now, once its gate is
+   *  open (now, or at its next opening). */
+  private retryLeasedStart(channel: Channel, agentId: string): void {
+    if (!this.isActiveChannel(channel)) return;
+    channel.leasedRespawn.add(agentId);
+    channel.leasedWakePending = true;
+    if (leasedEnginesFor(channel.taskId)?.open) this.leasedEnginesChanged(channel.taskId);
+  }
+
+  /** Whether the agent may start on `identity` right now: still bound to it,
+   *  and the task's open gate still serves that account at that revision and
+   *  version, for that run. */
+  private leasedIdentityHeld(channel: Channel, agentId: string, identity: LeasedIdentity): boolean {
+    const bound = channel.leasedIdentityByAgent.get(agentId);
+    return bound !== undefined && sameLeasedIdentity(bound, identity) && this.leasedMaterialServed(channel, identity);
+  }
+
+  /** The leased account an agent runs on: the one it is bound to while that
+   *  is served readable, else the first healthy one in try order. */
+  private leasedAccountFor(
+    channel: Channel,
+    agentId: string,
+    kind: string,
+    lease: TaskEngineLease,
+  ): LeasedEngineAccount | undefined {
+    const accounts = lease.accounts.filter(
+      (account): account is LeasedEngineAccount =>
+        account.engineKind === kind && isLeasedEngineAccount(account),
+    );
+    const bound = channel.accountByAgent.get(agentId);
+    const kept = accounts.find((account) => account.credentialId === bound);
+    if (kept) return kept;
+    const picked = selectAccount(
+      accounts.map((account) => ({
+        id: account.credentialId,
+        kind,
+        label: account.label,
+        isDefault: false,
+        scope: account.scope,
+        authKind: account.authKind,
+        execEnv: {},
+      })),
+    );
+    return accounts.find((account) => account.credentialId === picked?.id);
+  }
+
+  /** Bind the agent to `account` for `runEpoch` and give its spawn the
+   *  account, and the markers every process it starts inherits (its launches
+   *  are known by them, and admitted on this binding). */
+  private withLeasedAccount(
+    channel: Channel,
+    agentId: string,
+    args: SpawnArgs,
+    account: LeasedEngineAccount,
+    runEpoch: number,
+    home?: string,
+  ): { args: SpawnArgs; identity: LeasedIdentity } {
+    const identity = {
+      subject: "account" as const,
+      runEpoch,
+      credentialId: account.credentialId,
+      revision: account.revision,
+      version: account.version,
+    };
+    channel.accountByAgent.set(agentId, account.credentialId);
+    channel.leasedIdentityByAgent.set(agentId, identity);
+    noteEngineAccountUsed(account.credentialId);
+    return {
+      identity,
+      args: {
+        ...args,
+        // A durable runner from before a restart is attached to only when it
+        // was launched on this exact material.
+        attachCompatibilityKey: JSON.stringify([
+          args.attachCompatibilityKey ?? null,
+          "lease-v1",
+          identity.runEpoch,
+          identity.credentialId,
+          identity.revision,
+          identity.version,
+        ]),
+        agentEnv: {
+          ...(args.agentEnv ?? {}),
+          ...LEASED_CREDENTIAL_BLANKS,
+          ...engineSpawnEnv(account, home),
+          [LEASED_RUN_ENV]: String(runEpoch),
+          [LEASED_ACCOUNT_ENV]: account.credentialId,
+        },
+      },
+    };
+  }
+
+  /**
+   * The env of a one-shot run on the task's leased account for `kind` (the
+   * shadow router's classifier): the agent's own account when it runs on
+   * one of that kind, else the first healthy one; a config-directory
+   * account's home is written first. Null when none can be used now: the
+   * classifier does not run and the pass routes by rules.
+   */
+  /** ADR-154 §6: a one-shot's env on the leased `account` chosen for it: its
+   *  home written first for a config-directory account. Null when it cannot
+   *  be given. */
+  private async leasedOneShotEnv(
+    channel: Channel,
+    lease: TaskEngineLease,
+    account: LeasedEngineAccount,
+    environment: TaskEnvironmentHandle<unknown>,
+  ): Promise<Record<string, string> | null> {
+    const marker = {
+      [LEASED_RUN_ENV]: String(lease.assignment.runEpoch),
+      [LEASED_ACCOUNT_ENV]: account.credentialId,
+    };
+    try {
+      rememberLeasedEngineRuntime({
+        taskId: channel.taskId,
+        runEpoch: lease.assignment.runEpoch,
+        runtime: environment.descriptor.locator,
+      });
+    } catch {
+      return null;
+    }
+    if (account.authKind === "env") {
+      return { ...LEASED_CREDENTIAL_BLANKS, ...engineSpawnEnv(account), ...marker };
+    }
+    try {
+      await ensureEngineHome(environment, lease.assignment, account.credentialId);
+      return { ...LEASED_CREDENTIAL_BLANKS, ...engineSpawnEnv(account), ...marker };
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * ADR-154 §6, §8: what the task's AI accounts are, or whether its gate is
+   * open, changed. Rewrite what moved in the homes this run wrote, then let
+   * each long-lived engine running on a rewritten account (Codex's
+   * app-server) respawn at its first idle moment; one-shot engines read the
+   * file again at their next turn, and env-token engines take a new value at
+   * their next spawn. Called synchronously by the engine consumer: the work
+   * runs after, one pass at a time per channel.
+   */
+  private leasedEnginesChanged(taskId: string): void {
+    const channel = this.channels.get(taskId);
+    if (!channel || !this.isActiveChannel(channel) || !this.isLeasedChannel(channel)) return;
+    if (!leasedEnginesFor(taskId)?.open) return;
+    if (channel.leasedSyncRetry) {
+      clearTimeout(channel.leasedSyncRetry);
+      channel.leasedSyncRetry = null;
+    }
+    // Agents a cleanup stopped, or that found no usable account, start again
+    // on this view, each on its next account: one attempt per opening. The
+    // intent outlives a pass that fails, for its retry.
+    if (channel.leasedRespawn.size > 0 || channel.leasedBlocked.size > 0) {
+      channel.leasedWakePending = true;
+    }
+    const run = (channel.leasedSync ?? Promise.resolve())
+      .then(async () => {
+        await this.syncLeasedHomes(channel);
+        if (!channel.leasedWakePending || !this.isActiveChannel(channel)) return;
+        channel.leasedWakePending = false;
+        channel.leasedRespawn.clear();
+        channel.leasedBlocked.clear();
+        try {
+          await this.ensureSessions(channel);
+        } catch (err) {
+          channel.leasedWakePending = true;
+          throw err;
+        }
+      })
+      .catch((err: unknown) => {
+        console.warn(
+          `[orchestrator] ${taskId}: rewriting AI account files failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+        // A home left on an old token is written again, not left so.
+        if (this.isActiveChannel(channel) && !channel.leasedSyncRetry) {
+          const retry = setTimeout(() => {
+            if (channel.leasedSyncRetry !== retry) return;
+            channel.leasedSyncRetry = null;
+            this.leasedEnginesChanged(taskId);
+          }, LEASED_SYNC_RETRY_MS);
+          retry.unref?.();
+          channel.leasedSyncRetry = retry;
+        }
+      });
+    channel.leasedSync = run;
+  }
+
+  private async syncLeasedHomes(channel: Channel): Promise<void> {
+    if (!this.isActiveChannel(channel)) return;
+    const lease = leasedEnginesFor(channel.taskId);
+    if (!lease?.open) return;
+    // Nothing was written into a runtime this channel has not settled.
+    const environment = channel.agentHandle;
+    if (environment) await syncEngineHomes(environment, lease.assignment);
+    if (!this.isActiveChannel(channel)) return;
+    // Every launch is admitted on the exact material its agent is bound to
+    // (§6): an agent whose account moved since starts again on what the
+    // task holds now. A long-lived engine holds the old token or file; a
+    // one-shot one, env-token or not, would have its next turn refused.
+    let stale = false;
+    for (const agent of channel.roster) {
+      const identity = channel.leasedIdentityByAgent.get(agent.id);
+      if (!identity || this.leasedMaterialServed(channel, identity)) continue;
+      if (!channel.sessions.has(agent.id)) continue;
+      channel.browserStaleSessions.add(agent.id);
+      stale = true;
+    }
+    // A stale idle session is recycled now; one mid-turn finishes its turn
+    // on the material it has and is recycled at its next idle moment.
+    if (stale) await this.reconcileIfStarted(channel);
+  }
+
+  /**
+   * ADR-154 §6: the cleanup coordinator's quiesce step for engines (its
+   * `quiesceProcesses` hook takes this request as it is), for the run it
+   * names and every older one, never a newer run's:
+   * - every agent on one of the request's accounts (on any leased account,
+   *   or on its task token alone, for a whole-task cleanup) is unbound at
+   *   once, so nothing launches on them again (a launch is admitted only
+   *   while its agent is bound to its exact material), and its session is
+   *   asked to stop; a spawn creating an engine on one, or a launch being
+   *   admitted, is waited for, bounded;
+   * - then, in every runtime those runs' engines ran in, every admission not
+   *   used yet is revoked, and everything each engine supervisor of those
+   *   runs and accounts owns is killed until the supervisor ends on its own,
+   *   having proved nothing it owned is left (`stopAnchoredEngines`). That
+   *   holds no state here, so a retried cleanup proves it again even after
+   *   this channel let the agents go. A supervisor lost without proving its
+   *   subtree empty leaves one proof: the runtime is stopped. An env-token
+   *   engine holds no credential file: stopping it moves it to its next
+   *   account.
+   * Rejects when anything could not be proven stopped: the cleanup then
+   * fails and is retried, never deleting under a live engine. Stopped agents
+   * start again on their next account once the gate opens.
+   */
+  async quiesceLeasedEngineAgents(
+    request: Pick<TaskCredentialCleanupRequest, "taskId" | "runEpoch" | "credentialIds">,
+  ): Promise<void> {
+    const named = request.credentialIds === undefined ? null : new Set(request.credentialIds);
+    const channel = this.channels.get(request.taskId);
+    // Every engine being created on one of the accounts (on any subject, a
+    // task token included, for a whole run's), this attempt's or left over
+    // from one that timed out: never only the bound agents'.
+    const creating = [...(channel?.leasedCreating ?? [])]
+      .filter(
+        (entry) =>
+          (!named || (entry.accountId !== null && named.has(entry.accountId))) && entry.runEpoch <= request.runEpoch,
+      )
+      .map((entry) => entry.settled);
+    // Every retirement still pending that this cleanup covers: its stop
+    // proves what they fence, so one that fails from now on is not escalated.
+    const covered = this.coveredLeasedRetirements(request);
+    if (channel) {
+      for (const [agentId, accountId] of [...channel.accountByAgent]) {
+        if (named && !named.has(accountId)) continue;
+        if ((channel.leasedIdentityByAgent.get(agentId)?.runEpoch ?? 0) > request.runEpoch) continue;
+        channel.accountByAgent.delete(agentId);
+        this.quiesceLeasedAgent(channel, agentId);
+      }
+      // A whole run's cleanup takes every agent on its task token alone too
+      // (the Managed Engine); a cleanup of named accounts never does.
+      if (!named) {
+        for (const [agentId, identity] of [...channel.leasedIdentityByAgent]) {
+          if (identity.subject !== "task-token" || identity.runEpoch > request.runEpoch) continue;
+          this.quiesceLeasedAgent(channel, agentId);
+        }
+      }
+    }
+    if (creating.length > 0) {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const bounded = new Promise<"late">((resolve) => {
+        timer = setTimeout(() => resolve("late"), LEASED_QUIESCE_EXIT_MS);
+      });
+      const outcome = await Promise.race([Promise.all(creating), bounded]);
+      clearTimeout(timer);
+      if (outcome === "late") {
+        throw new Error("an engine being started on a removed AI account did not finish starting");
+      }
+    }
+    // One of those under way is waited for, bounded, so nothing of it lands
+    // after this cleanup's stop.
+    const retiring = covered.flatMap((retired) => (retired.attempt ? [retired.attempt.catch(() => undefined)] : []));
+    if (retiring.length > 0) {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const bounded = new Promise<"late">((resolve) => {
+        timer = setTimeout(() => resolve("late"), LEASED_QUIESCE_EXIT_MS);
+      });
+      const outcome = await Promise.race([Promise.all(retiring), bounded]);
+      clearTimeout(timer);
+      if (outcome === "late") {
+        throw new Error("an engine launch slot being retired in its runtime did not finish");
+      }
+    }
+    const runtimes = await this.leasedCleanupRuntimes(request, channel);
+    for (const environment of runtimes.values()) {
+      // A runtime that is not running holds no process, unless it is frozen
+      // (paused or restarting: its processes run again without a start);
+      // one that is frozen or cannot say cannot be proven.
+      const status = await environment.status();
+      if (status.state !== "unknown" && status.frozen) {
+        throw new Error("a task runtime's engines could not be proven stopped: it is paused");
+      }
+      if (status.state === "stopped" || status.state === "absent") continue;
+      if (status.state !== "running") {
+        throw new Error("a task runtime's engines could not be proven stopped: its state is unknown");
+      }
+      try {
+        await stopAnchoredEngines(environment, {
+          taskId: request.taskId,
+          runEpoch: request.runEpoch,
+          ...(request.credentialIds === undefined ? {} : { credentialIds: request.credentialIds }),
+        });
+      } catch (error) {
+        if (!(error instanceof EngineAnchorLost)) throw error;
+        // What a lost supervisor owned may have been reparented away from
+        // it: only a stopped runtime proves none of it still runs.
+        console.warn(`[orchestrator] ${request.taskId}: ${error.message}; stopping the runtime`);
+        await environment.stop();
+        const stopped = await environment.status();
+        if (
+          stopped.state === "unknown" ||
+          stopped.frozen ||
+          (stopped.state !== "stopped" && stopped.state !== "absent")
+        ) {
+          throw error;
+        }
+      }
+    }
+    // Every admission of these runs not yet used is revoked in every runtime
+    // they were written in, or that runtime is stopped or gone and its gates
+    // with it: no revocation or slot retirement retained for them is left to
+    // do.
+    dischargeEngineRevocations(request);
+    this.dischargeLeasedRetirements(request);
+    // Every engine of these runs is proven stopped in every runtime they
+    // ran in: a whole-task cleanup lets the record of those runtimes go.
+    if (request.credentialIds === undefined) {
+      forgetLeasedEngineRuntimes(request.taskId, request.runEpoch, [...runtimes.keys()]);
+    }
+  }
+
+  /** A cleanup took the material `agentId` runs on: it is unbound at once,
+   *  so nothing launches on it again, its session is asked to stop, and it
+   *  starts again on what the task holds once the gate opens. */
+  private quiesceLeasedAgent(channel: Channel, agentId: string): void {
+    channel.leasedIdentityByAgent.delete(agentId);
+    const session = channel.sessions.get(agentId);
+    if (this.isActiveChannel(channel)) channel.leasedRespawn.add(agentId);
+    if (!session) return;
+    // Delete first: the old session's last events are generation-stale.
+    channel.sessions.delete(agentId);
+    channel.browserStaleSessions.delete(agentId);
+    channel.browserPendingStaleSessions.delete(agentId);
+    this.retainRetiredTurnBoundary(
+      channel,
+      agentId,
+      this.needsAbortedTurnBoundary(channel, agentId),
+    );
+    this.retireRunnerGeneration(channel, agentId);
+    void session.close().catch(() => {});
+  }
+
+  /**
+   * ADR-154 §6: an account is about to be served at a newer version. In
+   * every runtime a launch of this run could start in, its older versions
+   * are held back first: a launch admitted on one that has not started yet
+   * never will. Rejects, so the install fails and none of the newer version
+   * is served, when a runtime cannot be reached or proven not running.
+   */
+  private async raiseLeasedAdmissionFloors(
+    assignment: { taskId: string; runEpoch: number },
+    floors: readonly EngineAdmissionFloor[],
+  ): Promise<void> {
+    const channel = this.channels.get(assignment.taskId);
+    const runtimes = await this.leasedCleanupRuntimes(
+      { taskId: assignment.taskId, runEpoch: assignment.runEpoch },
+      channel,
+    );
+    for (const environment of runtimes.values()) {
+      const status = await environment.status();
+      if (status.state !== "unknown" && status.frozen) {
+        throw new Error("an AI account's older version could not be held back: a task runtime is paused");
+      }
+      if (status.state === "stopped" || status.state === "absent") continue;
+      if (status.state !== "running") {
+        throw new Error("an AI account's older version could not be held back: a task runtime's state is unknown");
+      }
+      await raiseEngineAdmissionFloors(environment, {
+        taskId: assignment.taskId,
+        runEpoch: assignment.runEpoch,
+        floors,
+      });
+    }
+  }
+
+  /**
+   * Every runtime a cleanup reaches, by locator: the task's current one,
+   * every one a leased engine of these runs was started in (recorded before
+   * it started, files or none), and every one the inventory names for these
+   * runs (an older runtime's files are deleted from that exact runtime).
+   */
+  private async leasedCleanupRuntimes(
+    request: Pick<TaskCredentialCleanupRequest, "taskId" | "runEpoch" | "credentialIds">,
+    channel: Channel | undefined,
+  ): Promise<Map<string, TaskEnvironmentHandle<unknown>>> {
+    const runtimes = new Map<string, TaskEnvironmentHandle<unknown>>();
+    const current =
+      channel?.agentHandle ??
+      (await (async () => {
+        const task = getHostTask(request.taskId);
+        return task ? reconstructPersistedTaskEnvironment(task) : null;
+      })());
+    if (current) runtimes.set(serializeTaskEnvironmentLocator(current.descriptor.locator), current);
+    const recorded = [
+      ...listLeasedEngineRuntimes(request.taskId),
+      ...listCredentialCleanupPaths(request.taskId),
+    ];
+    for (const row of recorded) {
+      if (row.runEpoch > request.runEpoch || runtimes.has(row.runtimeLocator)) continue;
+      const environment = await reconstructTaskEnvironment(
+        parseTaskEnvironmentLocator(row.runtimeLocator),
+        "loader",
+      );
+      if (environment.descriptor.taskId !== request.taskId) {
+        throw new Error("a cleanup runtime belongs to a different task");
+      }
+      runtimes.set(row.runtimeLocator, environment);
+    }
+    return runtimes;
+  }
+
   /**
    * Per-agent CODEX_HOME (see the call site). Returns `args` unchanged unless
    * this is a codex agent with a config-dir CODEX_HOME; then it seeds
@@ -2481,87 +3654,347 @@ export class Orchestrator {
       channel.reconcileAgain = true;
       return null;
     }
-    // ADR-076 + codex-cli 0.152.0: two codex agents that resolve to the SAME
-    // account share one CODEX_HOME, and codex's new sqlite state runtime
-    // cannot be opened by two concurrent processes — the second agent dies
-    // with "failed to initialize sqlite state runtime under <CODEX_HOME>"
-    // (live 2026-09-04, a task with two codex agents on one account). Give
-    // each codex agent its OWN CODEX_HOME, seeded once from the resolved
-    // account's dir, so their state runtimes never collide. Single-codex
-    // tasks are unaffected beyond a one-time in-container copy.
-    // Only codex agents take the isolation path; everything else uses args
-    // directly, WITHOUT an extra await — a stray microtask here reordered the
-    // Claude re-spawn's prompt re-delivery.
-    const boundArgs =
-      args.agent?.kind === "codex"
-        ? await this.isolateCodexHome(environment, agentId, args)
-        : args;
-    while (this.isActiveChannel(channel)) {
-      if (recovery && !this.recoveryIsCurrent(channel, agentId, recovery)) {
-        channel.reconcileAgain = true;
-        return null;
-      }
-      if (
-        channel.rosterSessionChanges.get(agentId)?.state === "pending-close"
-      ) {
-        channel.reconcileAgain = true;
-        return null;
-      }
-      if (!this.hasDesiredLaunchSettings(channel, agentId, boundArgs.agent)) {
-        channel.reconcileAgain = true;
-        return null;
-      }
-      const generation = channel.configGeneration;
-      const session = await this.factory.create({ ...boundArgs, environment });
-      if (!this.isActiveChannel(channel)) {
-        await session.close().catch(() => {});
-        return null;
-      }
-      if (recovery && !this.recoveryIsCurrent(channel, agentId, recovery)) {
-        await session.close().catch(() => {});
-        channel.reconcileAgain = true;
-        return null;
-      }
-      const pendingRosterClose = channel.rosterSessionChanges.get(agentId);
-      if (pendingRosterClose?.state === "pending-close") {
-        await this.closeRosterChangedSession(
-          channel,
-          agentId,
-          session,
-          pendingRosterClose,
-        );
-        channel.reconcileAgain = true;
+    // ADR-154: an agent on the runner's own accounts holds them from here
+    // until it is bound or given up. Leaving them waits for it; every process
+    // it starts, now or at a later turn, is refused at its provider's last
+    // moment once leaving has begun; and one created across that moment is
+    // closed, never bound. Its next start is on the task's lease. The hold
+    // ends in a `finally`, which adds no await (see below).
+    const ownHold = this.isLeasedChannel(channel) ? undefined : holdOwnCredentials();
+    if (ownHold === null) {
+      channel.reconcileAgain = true;
+      return null;
+    }
+    const onOwn = ownHold !== undefined;
+    try {
+      // ADR-076 + codex-cli 0.152.0: two codex agents that resolve to the SAME
+      // account share one CODEX_HOME, and codex's new sqlite state runtime
+      // cannot be opened by two concurrent processes — the second agent dies
+      // with "failed to initialize sqlite state runtime under <CODEX_HOME>"
+      // (live 2026-09-04, a task with two codex agents on one account). Give
+      // each codex agent its OWN CODEX_HOME, seeded once from the resolved
+      // account's dir, so their state runtimes never collide. Single-codex
+      // tasks are unaffected beyond a one-time in-container copy.
+      // Only codex agents take the isolation path; everything else uses args
+      // directly, WITHOUT an extra await — a stray microtask here reordered the
+      // Claude re-spawn's prompt re-delivery. A leased account is applied here
+      // too, synchronously when nothing has to be waited for or written.
+      let boundArgs = args;
+      let identity: LeasedIdentity | undefined;
+      const kind = args.agent?.kind ?? "";
+      if (!onOwn && LEASED_ENGINE_KINDS.has(kind)) {
+        // §6: a runtime that cannot start a launch under the engine supervisor
+        // never runs a leased engine.
+        if (environment.anchors !== true) {
+          this.leasedUnavailable(channel, agentId, "its runtime cannot supervise an engine");
+          return null;
+        }
+        const leased = this.leasedSpawnArgs(channel, agentId, args, environment);
+        const applied = leased instanceof Promise ? await leased : leased;
+        // Down until the gate next opens: never a loop.
+        if (!applied) return null;
+        boundArgs = applied.args;
+        identity = applied.identity;
+      } else if (!onOwn && kind === MANAGED_ENGINE_KIND) {
+        // ADR-128, ADR-154 §6: no AI account, but the agent's task token is
+        // the engine's bearer: started under the supervisor, admitted as
+        // that token on the task's open run, or not at all.
+        if (environment.anchors !== true) {
+          this.leasedUnavailable(channel, agentId, "its runtime cannot supervise an engine");
+          return null;
+        }
+        const leased = this.leasedTaskTokenSpawnArgs(channel, agentId, args);
+        const applied = leased instanceof Promise ? await leased : leased;
+        if (!applied) return null;
+        boundArgs = applied.args;
+        identity = applied.identity;
+      } else if (!onOwn && !CREDENTIAL_FREE_KINDS.has(kind)) {
+        // ADR-154 §10: a kind with no lane (Kimi) never runs on the runner's
+        // own sign-in for a leased task.
+        this.leasedUnavailable(channel, agentId, `${kind} has no AI account lane on cloud credentials`);
         return null;
+      } else if (kind === "codex") {
+        boundArgs = await this.isolateCodexHome(environment, agentId, args);
       }
-      if (!this.hasDesiredLaunchSettings(channel, agentId, boundArgs.agent)) {
-        const change = channel.rosterSessionChanges.get(agentId);
-        if (change) {
-          await this.closeRosterChangedSession(
-            channel,
-            agentId,
-            session,
-            change,
+      while (this.isActiveChannel(channel)) {
+        if (recovery && !this.recoveryIsCurrent(channel, agentId, recovery)) {
+          channel.reconcileAgain = true;
+          return null;
+        }
+        if (
+          channel.rosterSessionChanges.get(agentId)?.state === "pending-close"
+        ) {
+          channel.reconcileAgain = true;
+          return null;
+        }
+        if (!this.hasDesiredLaunchSettings(channel, agentId, boundArgs.agent)) {
+          channel.reconcileAgain = true;
+          return null;
+        }
+        if (onOwn && !onOwnCredentials()) {
+          channel.reconcileAgain = true;
+          return null;
+        }
+        const generation = channel.configGeneration;
+        // ADR-154 §6: never start an engine on lease material the task does not
+        // hold right now (its run, account, revision and version). A cleanup
+        // drops the binding synchronously, so a spawn whose account it took
+        // stops here; one already creating is registered, and every cleanup
+        // attempt waits for it.
+        if (identity && !this.leasedIdentityHeld(channel, agentId, identity)) {
+          this.retryLeasedStart(channel, agentId);
+          return null;
+        }
+        if (identity) {
+          // Where this engine runs, before it can run there (§6): a cleanup
+          // proves it stopped in this runtime even if it leaves no file.
+          try {
+            rememberLeasedEngineRuntime({
+              taskId: channel.taskId,
+              runEpoch: identity.runEpoch,
+              runtime: environment.descriptor.locator,
+            });
+          } catch (err) {
+            console.warn(
+              `[orchestrator] ${channel.taskId}/${agentId}: not starting on its AI account, its runtime could not be recorded: ${err instanceof Error ? err.message : String(err)}`,
+            );
+            return null;
+          }
+        }
+        // Every process the adapter launches for this engine (now, at each
+        // turn, or once its durable runner is deployed) is admitted then, on
+        // this exact material, for this spawn while it is the agent's current
+        // one, and started under the supervisor (§6). The agent's spawn this
+        // one replaces is retired.
+        const slot = identity ? newLeasedLaunchSlot(channel.taskId, identity, environment) : null;
+        if (slot) {
+          void this.retireLeasedLaunch(channel, agentId, channel.leasedLaunches.get(agentId));
+          channel.leasedLaunches.set(agentId, slot);
+        }
+        const creating = this.factory.create({
+          ...boundArgs,
+          environment:
+            identity && slot
+              ? this.leasedLaunchEnvironment(channel, { agentId, slot }, identity, environment)
+              : onOwn
+                ? onOwnCredentialsEnvironment(environment)
+                : environment,
+        });
+        // Settled before this spawn's own continuation: from here until it
+        // binds, nothing launches on it.
+        if (slot) {
+          void creating.then(
+            () => {
+              slot.created = true;
+            },
+            () => {
+              slot.created = true;
+            },
           );
-        } else {
-          await session.close().catch(() => {});
         }
-        channel.reconcileAgain = true;
-        return null;
-      }
-      if (generation === channel.configGeneration) {
-        // Keep the final generation check, stale cleanup, and map bind in one
-        // synchronous continuation. A config writer that resumes immediately
-        // afterward now sees this session and marks it stale; it can no longer
-        // change the generation in the await→bind gap while the process is
-        // invisible.
-        channel.browserStaleSessions.delete(agentId);
-        channel.browserPendingStaleSessions.delete(agentId);
-        this.bindSession(channel, agentId, session);
-        return session;
+        if (identity) {
+          const entry = {
+            agentId,
+            accountId: identity.subject === "account" ? identity.credentialId : null,
+            runEpoch: identity.runEpoch,
+            settled: creating.then(
+              () => undefined,
+              () => undefined,
+            ),
+          };
+          channel.leasedCreating.add(entry);
+          void entry.settled.then(() => channel.leasedCreating.delete(entry));
+        }
+        // ADR-154 §6: a spawn that does not bind (its create failed, maybe
+        // after it launched, or its session is closed unbound) is retired at
+        // once, before anything else: a launch it handed over that has not
+        // started in its runtime never does.
+        const unbound = (): Promise<void> =>
+          slot ? this.retireLeasedLaunch(channel, agentId, slot) : Promise.resolve();
+        let session: AgentSession;
+        try {
+          session = await creating;
+        } catch (error) {
+          await unbound();
+          throw error;
+        }
+        if (!this.isActiveChannel(channel)) {
+          await Promise.all([unbound(), session.close().catch(() => {})]);
+          return null;
+        }
+        // ADR-154: created on the runner's own accounts across the moment
+        // leaving them began: closed, never bound.
+        if (onOwn && !onOwnCredentials()) {
+          await Promise.all([unbound(), session.close().catch(() => {})]);
+          channel.reconcileAgain = true;
+          return null;
+        }
+        // ADR-154 §6: a cleanup that took this account while the session was
+        // being created quiesced the agent already; never keep a session on
+        // material the task no longer holds.
+        if (identity && !this.leasedIdentityHeld(channel, agentId, identity)) {
+          await Promise.all([unbound(), session.close().catch(() => {})]);
+          this.retryLeasedStart(channel, agentId);
+          return null;
+        }
+        if (identity) channel.leasedBlocked.delete(agentId);
+        if (recovery && !this.recoveryIsCurrent(channel, agentId, recovery)) {
+          await Promise.all([unbound(), session.close().catch(() => {})]);
+          channel.reconcileAgain = true;
+          return null;
+        }
+        const pendingRosterClose = channel.rosterSessionChanges.get(agentId);
+        if (pendingRosterClose?.state === "pending-close") {
+          await Promise.all([
+            unbound(),
+            this.closeRosterChangedSession(channel, agentId, session, pendingRosterClose),
+          ]);
+          channel.reconcileAgain = true;
+          return null;
+        }
+        if (!this.hasDesiredLaunchSettings(channel, agentId, boundArgs.agent)) {
+          const change = channel.rosterSessionChanges.get(agentId);
+          const retiring = unbound();
+          if (change) {
+            await this.closeRosterChangedSession(
+              channel,
+              agentId,
+              session,
+              change,
+            );
+          } else {
+            await session.close().catch(() => {});
+          }
+          await retiring;
+          channel.reconcileAgain = true;
+          return null;
+        }
+        if (generation === channel.configGeneration) {
+          // Keep the final generation check, stale cleanup, and map bind in one
+          // synchronous continuation. A config writer that resumes immediately
+          // afterward now sees this session and marks it stale; it can no longer
+          // change the generation in the await→bind gap while the process is
+          // invisible.
+          channel.browserStaleSessions.delete(agentId);
+          channel.browserPendingStaleSessions.delete(agentId);
+          if (slot) slot.session = session;
+          this.bindSession(channel, agentId, session);
+          return session;
+        }
+        await Promise.all([unbound(), session.close().catch(() => {})]);
       }
-      await session.close().catch(() => {});
+      return null;
+    } finally {
+      ownHold?.();
     }
-    return null;
+  }
+
+  /**
+   * ADR-154, the shadow router's one exec: the only use it makes of an AI
+   * account, and the only place that account's material exists for it.
+   * Null when it cannot run, and the pass routes by rules.
+   * - A leased task's: its account is chosen, and the exec registered where
+   *   a cleanup of that account waits, in one synchronous step before any of
+   *   its material is read; the registration settles when the exec does,
+   *   and nothing the material is in outlives this call (§6). A cleanup that
+   *   took the account first leaves it unchosen. The exec starts under the
+   *   engine supervisor, only on material the task still holds at the
+   *   provider's last moment.
+   * - On the runner's own credentials: they are held from the account's
+   *   choice to the exec's end, and the exec is refused at the provider's
+   *   last moment once leaving them has begun or the channel has closed.
+   */
+  private async shadowClassify(
+    channel: Channel,
+    agentId: string,
+    kind: string,
+    handle: TaskEnvironmentHandle<unknown>,
+    argv: [string, ...string[]],
+    scratchDir: string,
+    timeoutMs: number,
+  ): Promise<{ exitCode: number | null; stdout: string } | null> {
+    const request = (env: Record<string, string>, admit: () => void) => ({
+      argv: agentCliArgv(handle, argv),
+      projectEnvProfile: "task" as const,
+      cwd: scratchDir,
+      user: "node",
+      env,
+      timeoutMs,
+      maxOutputBytes: 64 * 1024,
+      admit,
+    });
+    if (!this.isLeasedChannel(channel)) {
+      const running = whileOnOwnCredentials(async () => {
+        const env = { ...(pickEngineAccount(kind, { scope: channel.engineAccountScope })?.execEnv ?? {}) };
+        const r = await handle.exec(
+          request(env, () => {
+            if (!this.isActiveChannel(channel) || !onOwnCredentials()) throw new LeftOwnCredentialsError();
+          }),
+        );
+        return { exitCode: r.exitCode, stdout: Buffer.from(r.stdout).toString("utf8") };
+      });
+      if (running === null) return null;
+      this.trackEventOperation(channel, running);
+      return running;
+    }
+    const lease = leasedEnginesFor(channel.taskId);
+    if (!lease?.open) return null;
+    const account = this.leasedAccountFor(channel, agentId, kind, lease);
+    if (!account) return null;
+    const identity: LeasedIdentity = {
+      subject: "account",
+      runEpoch: lease.assignment.runEpoch,
+      credentialId: account.credentialId,
+      revision: account.revision,
+      version: account.version,
+    };
+    let settle!: () => void;
+    const entry = {
+      agentId: `shadow:${agentId}`,
+      accountId: account.credentialId,
+      runEpoch: identity.runEpoch,
+      settled: new Promise<void>((resolve) => (settle = resolve)),
+    };
+    channel.leasedCreating.add(entry);
+    void entry.settled.then(() => channel.leasedCreating.delete(entry));
+    this.trackEventOperation(channel, entry.settled);
+    try {
+      const env = await this.leasedOneShotEnv(channel, lease, account, handle);
+      if (!env || !this.leasedMaterialServed(channel, identity)) return null;
+      const r = await this.leasedLaunchEnvironment(channel, null, identity, handle).exec(
+        request(env, () => {
+          if (!this.isActiveChannel(channel) || !this.leasedMaterialServed(channel, identity)) {
+            throw new CredentialLeaseUnavailableError("the shadow classifier's account moved");
+          }
+        }),
+      );
+      return { exitCode: r.exitCode, stdout: Buffer.from(r.stdout).toString("utf8") };
+    } finally {
+      settle();
+    }
+  }
+
+  /** #cb3j0z: the task's runtime, for what only it can do in the task's
+   *  workspace without following its links (macOS); null without one. */
+  private async workspaceRuntime(taskId: string): Promise<RuntimeNamespace | null> {
+    const channel = this.channels.get(taskId);
+    if (!channel || !this.isActiveChannel(channel)) return null;
+    try {
+      return runtimeNamespaceOf(await this.agentEnvironment(channel));
+    } catch {
+      return null;
+    }
+  }
+
+  /** Teardown drains `operation` before the task's runtime name can be
+   *  reused. */
+  private trackEventOperation(channel: Channel, operation: Promise<unknown>): void {
+    const settled = operation.then(
+      () => undefined,
+      () => undefined,
+    );
+    channel.eventOperations.add(settled);
+    void settled.then(() => channel.eventOperations.delete(settled));
   }
 
   private hasDesiredLaunchSettings(
@@ -2808,6 +4241,9 @@ export class Orchestrator {
             ),
           },
         );
+        // Credentials unavailable is this agent's alone: the gate's next
+        // opening starts it; its siblings start now.
+        if (!session && channel.leasedBlocked.has(agent.id)) continue;
         if (!session) {
           // The agents that did come up are usable; the reconcile pass keeps
           // retrying this one. Do not leave the page covered for a session
@@ -3203,13 +4639,16 @@ export class Orchestrator {
     // through this same command, and classifying them would poison the very
     // data the shadow pass exists to collect.
     if (channel.routingShadow && origin === "human") {
-        void this.shadowRouteDelivery(channel, agentId, text).catch((err) => {
+      // Its exec runs in the task's runtime: teardown drains it like any
+      // other external operation before the runtime's name can be reused.
+      const pass = this.shadowRouteDelivery(channel, agentId, text).catch((err) => {
         console.warn(
           `[routing] shadow pass failed for ${channel.taskId}/${agentId}: ${
             err instanceof Error ? err.message : String(err)
           }`,
         );
       });
+      this.trackEventOperation(channel, pass);
     }
     return { ok: true };
   }
@@ -3219,7 +4658,10 @@ export class Orchestrator {
    * one-shot executes INSIDE the task environment as the task user, with the
    * same engine account the agent runs on (so the user's own subscription
    * pays for routing, never Uai), then the result rides a host event. Bounded
-   * by a hard timeout so a hung CLI cannot pile up passes.
+   * by a hard timeout, the task's own files read included, so a hung CLI or
+   * read cannot pile up passes. ADR-154: the pass itself holds no credential
+   * (its reads are the task's own files, which take as long as the task
+   * makes them); only its one exec does (`shadowClassify`).
    */
   private async shadowRouteDelivery(channel: Channel, agentId: string, text: string): Promise<void> {
     const agent = channel.roster.find((a) => a.id === agentId);
@@ -3236,39 +4678,44 @@ export class Orchestrator {
     // Rung 1 hosts the classifier on the agent's own engine; the Managed
     // Engine delegates to claude/codex, so borrow the delegate's account.
     const hostEngine = agent.kind === "uai" ? (agent.uaiProvider === "openai" ? "codex" : "claude") : agent.kind;
-    const account = pickEngineAccount(hostEngine, { scope: channel.engineAccountScope });
-    const env: Record<string, string> = { ...(account?.execEnv ?? {}) };
-    const context =
-      handle && canRead
-        ? Buffer.from((await handle.readWorkspaceFile(`${scratchDir}/chat.md`).catch(() => null)) ?? new Uint8Array())
-            .toString("utf8")
-            .slice(-1200)
-        : "";
     const timeoutMs = 45_000;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    // Past its bound the pass is given up, and what is left of it (a read
+    // the task held) launches nothing.
+    let abandoned = false;
     const result = await Promise.race([
-      shadowRoute(text, context, hostEngine, {
-        scratchDir,
-        exec: async (argv) => {
-          if (!handle || !canExec) return null;
-          const r = await handle.exec({
-            argv: agentCliArgv(handle, argv),
-            projectEnvProfile: "task",
-            cwd: scratchDir,
-            user: "node",
-            env,
-            timeoutMs,
-            maxOutputBytes: 64 * 1024,
-          });
-          return { exitCode: r.exitCode, stdout: Buffer.from(r.stdout).toString("utf8") };
-        },
-        readFile: async (path) => {
-          if (!handle || !canRead) return null;
-          const bytes = await handle.readWorkspaceFile(path).catch(() => null);
-          return bytes ? Buffer.from(bytes).toString("utf8") : null;
-        },
+      (async () => {
+        const context =
+          handle && canRead
+            ? Buffer.from(
+                (await handle
+                  .readWorkspaceFile(`${scratchDir}/chat.md`, { maxBytes: SHADOW_CONTEXT_BYTES, from: "end" })
+                  .catch(() => null)) ?? new Uint8Array(),
+              )
+                .toString("utf8")
+                .slice(-1200)
+            : "";
+        return shadowRoute(text, context, hostEngine, {
+          scratchDir,
+          exec: (argv) =>
+            handle && canExec && !abandoned
+              ? this.shadowClassify(channel, agentId, hostEngine, handle, argv, scratchDir, timeoutMs)
+              : Promise.resolve(null),
+          readFile: async (path) => {
+            if (!handle || !canRead) return null;
+            const bytes = await handle.readWorkspaceFile(path, { maxBytes: SHADOW_OUTPUT_BYTES }).catch(() => null);
+            return bytes ? Buffer.from(bytes).toString("utf8") : null;
+          },
+        });
+      })(),
+      new Promise<null>((resolve) => {
+        timer = setTimeout(() => {
+          abandoned = true;
+          resolve(null);
+        }, timeoutMs + 5_000);
       }),
-      new Promise<null>((resolve) => setTimeout(() => resolve(null), timeoutMs + 5_000)),
     ]);
+    clearTimeout(timer);
     if (!result) {
       console.warn(`[routing] shadow pass timed out for ${channel.taskId}/${agentId}`);
       return;
@@ -3507,14 +4954,21 @@ export class Orchestrator {
           if (ownsBrokerSlot) channel.spawning.add(agentId);
           let requested = false;
           try {
-            requested = await requestCredentialRefresh({
-              kind: agent.kind,
-              accountId:
-                accountId && !accountId.startsWith("default:")
-                  ? accountId
-                  : null,
-              scope: channel.engineAccountScope,
-            });
+            // ADR-154 §7: a leased account is refreshed by the cloud's
+            // broker, through the task's lease, never by this runner.
+            const lease = this.isLeasedChannel(channel) ? leasedEnginesFor(channel.taskId) : undefined;
+            requested = this.isLeasedChannel(channel)
+              ? lease !== undefined &&
+                accountId !== null &&
+                (await refreshLeasedEngineAccount(lease.assignment, accountId)) === "refreshed"
+              : await requestCredentialRefresh({
+                  kind: agent.kind,
+                  accountId:
+                    accountId && !accountId.startsWith("default:")
+                      ? accountId
+                      : null,
+                  scope: channel.engineAccountScope,
+                });
           } catch (err) {
             console.warn(
               `[orchestrator] ${channel.taskId}/${agentId}: credential refresh request failed: ${
@@ -3825,10 +5279,16 @@ export class Orchestrator {
 
     channel.spawning.add(agentId);
     try {
-      const restored = await repairClaudeConfigInContainer(
-        channel.containerName,
-        channel.agentHandle ?? undefined,
-      );
+      // ADR-154 §6: never the runner owner's own ~/.claude.json into a task on
+      // cloud credentials; Claude writes its own again when it starts. A
+      // repair on the runner's own credentials is counted: leaving them waits
+      // for it, and none starts once leaving has begun.
+      const repairing = this.isLeasedChannel(channel)
+        ? null
+        : whileOnOwnCredentials(() =>
+            repairClaudeConfigInContainer(channel.containerName, channel.agentHandle ?? undefined),
+          );
+      const restored = repairing === null ? false : await repairing;
       if (channel.rosterSessionChanges.has(agentId)) {
         this.reconcileErroredRosterChange(
           channel,
@@ -3896,7 +5356,7 @@ export class Orchestrator {
       );
       const boundAccountId = channel.accountByAgent.get(agentId);
       const boundAccount = boundAccountId
-        ? resolveEngineAccounts(agent.kind, {}, channel.engineAccountScope).find(
+        ? this.engineAccounts(channel, agent.kind).find(
             (account) => account.id === boundAccountId,
           )
         : undefined;
@@ -3942,9 +5402,11 @@ export class Orchestrator {
       }
       this.startNextPendingPrompt(channel, agentId);
 
-      const message = restored
-        ? `${agentId} restarted — config file was missing in the container, restored from the host.`
-        : `${agentId} restarted — config file was missing in the container (host copy not found; spawned anyway).`;
+      const message = this.isLeasedChannel(channel)
+        ? `${agentId} restarted — config file was missing in the container; Claude writes its own again.`
+        : restored
+          ? `${agentId} restarted — config file was missing in the container, restored from the host.`
+          : `${agentId} restarted — config file was missing in the container (host copy not found; spawned anyway).`;
       channel.retiredTurnBoundaries.delete(agentId);
       this.emitHost({
         kind: "agent.exit",
@@ -4002,7 +5464,7 @@ export class Orchestrator {
     // A concurrent terminal event for the same session is already being
     // handled by the path that owns this spawn slot.
     if (channel.spawning.has(agentId)) return true;
-    if (resolveEngineAccounts(agent.kind, {}, channel.engineAccountScope).length < 2) {
+    if (this.engineAccounts(channel, agent.kind).length < 2) {
       return false;
     }
 
@@ -4012,10 +5474,11 @@ export class Orchestrator {
 
     const current = channel.accountByAgent.get(agentId);
     if (current) cooldownEngineAccount(current);
-    const next = pickEngineAccount(agent.kind, {
-      scope: channel.engineAccountScope,
-      exclude: current ? new Set([current]) : undefined,
-    });
+    const next = this.pickAccount(
+      channel,
+      agent.kind,
+      current ? new Set([current]) : undefined,
+    );
     if (!next) return false;
 
     const task = getHostTask(channel.taskId);
@@ -4447,7 +5910,7 @@ export class Orchestrator {
       return;
     }
 
-    const accounts = resolveEngineAccounts(agent.kind, {}, channel.engineAccountScope);
+    const accounts = this.engineAccounts(channel, agent.kind);
     const account =
       accounts.find((a) => a.id === channel.accountByAgent.get(agentId)) ??
       accounts[0];
@@ -4482,14 +5945,19 @@ export class Orchestrator {
   async refreshEngineAccountCopies(kind: string): Promise<void> {
     for (const channel of this.channels.values()) {
       if (!this.isActiveChannel(channel)) continue;
+      // ADR-154: a leased task's accounts change through its lease only.
+      if (this.isLeasedChannel(channel)) continue;
       if (!channel.roster.some((agent) => agent.kind === kind)) continue;
       try {
-        await provisionEngineAccounts(
-          channel.containerName,
-          [kind],
-          {},
-          channel.agentHandle ?? undefined,
-          channel.engineAccountScope,
+        // Only while the runner is on its own credentials, counted.
+        await whileOnOwnCredentials(() =>
+          provisionEngineAccounts(
+            channel.containerName,
+            [kind],
+            {},
+            channel.agentHandle ?? undefined,
+            channel.engineAccountScope,
+          ),
         );
       } catch (err) {
         console.warn(
@@ -4504,6 +5972,7 @@ export class Orchestrator {
   async refreshEngineAccountAgents(kind: string): Promise<void> {
     for (const channel of this.channels.values()) {
       if (!this.isActiveChannel(channel)) continue;
+      if (this.isLeasedChannel(channel)) continue;
       const agentIds = channel.roster
         .filter((agent) => agent.kind === kind)
         .map((agent) => agent.id);
@@ -4561,7 +6030,16 @@ export class Orchestrator {
     // can repopulate an orphan channel while its sessions close.
     ch.closed = true;
     this.channels.delete(taskId);
+    // ADR-154 §6: nothing its agents' spawns were admitted for starts after:
+    // the close ends only once every retirement of the task under way, its
+    // own and any an earlier event began, is done or escalated.
+    for (const [agentId, slot] of [...ch.leasedLaunches]) void this.retireLeasedLaunch(ch, agentId, slot);
+    const retirements = this.leasedRetirementsUnderWay(taskId);
     this.clearBrowserRetry(ch);
+    if (ch.leasedSyncRetry) {
+      clearTimeout(ch.leasedSyncRetry);
+      ch.leasedSyncRetry = null;
+    }
     ch.browserStaleSessions.clear();
     ch.rosterSessionChanges.clear();
     ch.browserPendingStaleSessions.clear();
@@ -4586,6 +6064,7 @@ export class Orchestrator {
       ch.sessionsReady,
       ...ch.factoryOperations,
       ...ch.eventOperations,
+      ...retirements,
     ].filter((promise): promise is Promise<unknown> => promise !== null);
     const sessions = [...ch.sessions.values()];
     ch.sessions.clear();
@@ -4683,28 +6162,103 @@ export class Orchestrator {
     return this.#channelActivity.get(taskId) ?? null;
   }
 
-  async stopTask(taskId: string): Promise<{ ok: boolean; error?: string }> {
+  async stopTask(
+    taskId: string,
+    options: {
+      admitAssignment?: () => TaskStopAssignmentAdmission;
+      shouldVeto?: () => boolean;
+      /** ADR-154 §6: the closed run's credentials cleaned up, its sessions
+       *  closed and its runtime still up for the cleanup to reach, before
+       *  the runtime stops and Stop is acknowledged. */
+      closeCredentials?: (runEpoch: number) => Promise<void>;
+    } = {},
+  ): Promise<OrchestratorTaskStopResult> {
     return this.runTaskLifecycle(taskId, () =>
-      this.stopTaskWithinLifecycle(taskId),
+      this.stopTaskWithinLifecycle(taskId, options),
     );
   }
 
+  /** `stopTask` for a caller that already holds this task's lifecycle slot
+   *  (runTaskLifecycle), so that what it checks before the stop and does
+   *  after it share the slot: ADR-154 §13's retirement re-proves the engine
+   *  first, and removes the runtime after. */
+  async stopTaskInHeldLifecycle(
+    taskId: string,
+    options: {
+      admitAssignment?: () => TaskStopAssignmentAdmission;
+      shouldVeto?: () => boolean;
+      closeCredentials?: (runEpoch: number) => Promise<void>;
+      /** After the channel drained and before anything touches the
+       *  container runtime (previews, the runtime's stop): why the caller's
+       *  proof of the daemon no longer holds, or null. A reason stops the
+       *  Stop there, mutating nothing. */
+      beforeRuntimeMutation?: () => Promise<string | null>;
+    } = {},
+  ): Promise<OrchestratorTaskStopResult> {
+    return this.stopTaskWithinLifecycle(taskId, options);
+  }
+
   private async stopTaskWithinLifecycle(
     taskId: string,
-  ): Promise<{ ok: boolean; error?: string }> {
+    options: {
+      admitAssignment?: () => TaskStopAssignmentAdmission;
+      shouldVeto?: () => boolean;
+      closeCredentials?: (runEpoch: number) => Promise<void>;
+      beforeRuntimeMutation?: () => Promise<string | null>;
+    },
+  ): Promise<OrchestratorTaskStopResult> {
+    // The activity check belongs in the same lifecycle slot as assignment
+    // closure and runtime stop. A turn may become active while Stop waits for
+    // earlier lifecycle work; veto it before closing any v1 authority.
+    if (options.shouldVeto?.()) return { ok: true, vetoed: true };
+    let assignmentAdmission: TaskStopAssignmentAdmission = { kind: "legacy" };
+    try {
+      assignmentAdmission =
+        options.admitAssignment?.() ?? ({ kind: "legacy" } as const);
+    } catch (error) {
+      return {
+        ok: false,
+        error: (error instanceof Error ? error.message : String(error)).slice(
+          0,
+          200,
+        ),
+      };
+    }
+    if (assignmentAdmission.kind === "stale") {
+      return {
+        ok: false,
+        error: "task assignment is no longer current",
+        assignmentStale: true,
+      };
+    }
+    const assignmentClosed = assignmentAdmission.kind === "closed";
     if (!backgroundContainerWorkAllowed()) {
       return { ok: false, error: "container runtime is not operational" };
     }
     const task = getHostTask(taskId);
     if (!task) return { ok: false, error: "unknown task" };
-    const project = task.composeProject;
-    if (!project) return { ok: false, error: "task has no running stack" };
+    // A runtime is named by its persisted locator, a legacy row by its
+    // Compose project. ADR-154: a start interrupted after recording its
+    // runtime's locator keeps it, with no Compose project, for Stop to reach.
+    if (!task.environmentLocator && !task.composeProject) {
+      return { ok: false, error: "task has no running stack" };
+    }
     // Revoke env/proxy access before a potentially long session drain, then
     // close sessions so nothing races to respawn them mid-stop.
     const suspendedGateway = suspendTaskGatewayTask(taskId);
     // ADR-153: no longer served; end its open proxy connections too.
     activeSecretsProxy()?.runtime.stopTask(taskId);
     await this.closeChannel(taskId);
+    // ADR-154 §13: a proof of the daemon taken before the drain may have
+    // expired during it; nothing below may reach a replaced one.
+    const stale = await options.beforeRuntimeMutation?.();
+    if (stale !== undefined && stale !== null) {
+      if (!assignmentClosed) {
+        if (suspendedGateway) reactivateTaskGatewayTask(suspendedGateway);
+        this.allowChannel(taskId);
+      }
+      return { ok: false, error: stale.slice(0, 200) };
+    }
     try {
       await stopPreviewSidecars(taskId);
     } catch (err) {
@@ -4714,6 +6268,22 @@ export class Orchestrator {
         }`,
       );
     }
+    // ADR-154 §6: Stop is acknowledged only once the closed run's
+    // credentials are cleaned up, while its runtime still runs for the
+    // cleanup to reach. A failed cleanup fails the stop; the cloud retries,
+    // and its closed run stays closed meanwhile.
+    if (assignmentAdmission.kind === "closed" && options.closeCredentials) {
+      try {
+        await options.closeCredentials(assignmentAdmission.runEpoch);
+      } catch (err) {
+        return {
+          ok: false,
+          error: `the task's credentials could not be cleaned up: ${
+            (err instanceof Error ? err.message : String(err)).slice(0, 160)
+          }`,
+        };
+      }
+    }
     // Provider-neutral resumable stop. A row that reaches this point with
     // runtime resources always carries a proven locator (legacy rows cross
     // the adoption fence before the runtime becomes operational), so a
@@ -4724,14 +6294,18 @@ export class Orchestrator {
     try {
       const environment = await reconstructPersistedTaskEnvironment(task);
       if (!environment) {
-        if (suspendedGateway) reactivateTaskGatewayTask(suspendedGateway);
-        this.allowChannel(taskId);
+        if (!assignmentClosed) {
+          if (suspendedGateway) reactivateTaskGatewayTask(suspendedGateway);
+          this.allowChannel(taskId);
+        }
         return { ok: false, error: "task has no persisted environment" };
       }
       await environment.stop();
     } catch (err) {
-      if (suspendedGateway) reactivateTaskGatewayTask(suspendedGateway);
-      this.allowChannel(taskId);
+      if (!assignmentClosed) {
+        if (suspendedGateway) reactivateTaskGatewayTask(suspendedGateway);
+        this.allowChannel(taskId);
+      }
       return {
         ok: false,
         error: (err instanceof Error ? err.message : String(err)).slice(0, 200),
@@ -4757,7 +6331,9 @@ export class Orchestrator {
     // Nothing serves the task's env now: no value of it stays in memory.
     forgetTaskEnvSnapshot(taskId);
     clearTaskGatewayAcl(taskId);
-    return { ok: true };
+    return assignmentAdmission.kind === "closed"
+      ? { ok: true, stoppedRunEpoch: assignmentAdmission.runEpoch }
+      : { ok: true };
   }
 }
 
@@ -6001,8 +7577,26 @@ export type TaskRuntimeContainerInspection =
 
 export interface WritableRuntimeQuarantineResult {
   verdict: "ready" | "retry" | "stale";
-  /** Known rows whose local `stopped` verdict must be published or replayed. */
-  stoppedTaskIds: string[];
+  /**
+   * Known rows whose local `stopped` verdict must be published or replayed.
+   * The epoch is captured while the task lifecycle slot is still held and is
+   * deliberately absent for a legacy assignment.
+   */
+  stoppedTasks: StoppedTaskStatusTarget[];
+}
+
+export interface StoppedTaskStatusTarget {
+  taskId: string;
+  runEpoch?: number;
+}
+
+function captureStoppedTaskStatusTarget(
+  taskId: string,
+): StoppedTaskStatusTarget {
+  const assignment = closeCurrentTaskRunAssignmentForStoppedRuntime(taskId);
+  return assignment.kind === "legacy"
+    ? { taskId }
+    : { taskId, runEpoch: assignment.runEpoch };
 }
 
 function runtimeWriterCandidate(
@@ -6390,19 +7984,19 @@ export async function quarantineWritableRuntimeContainers(options: {
     return quarantineWritableAppleRuntimeContainers(options);
   }
   const isCurrent = options.isCurrent ?? (() => true);
-  const stoppedTaskIds = new Set<string>();
-  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [] };
+  const stoppedTasks = new Map<string, StoppedTaskStatusTarget>();
+  if (!isCurrent()) return { verdict: "stale", stoppedTasks: [] };
 
   const listed = await listRuntimeWriterCandidates();
-  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [] };
+  if (!isCurrent()) return { verdict: "stale", stoppedTasks: [] };
   if (listed.kind === "unreachable") {
-    return { verdict: "retry", stoppedTaskIds: [] };
+    return { verdict: "retry", stoppedTasks: [] };
   }
   let resolved = !listed.ambiguous;
 
   for (const candidate of listed.candidates) {
     if (!isCurrent()) {
-      return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+      return { verdict: "stale", stoppedTasks: [...stoppedTasks.values()] };
     }
     await options.lifecycle.runTaskLifecycle(candidate.taskId, async () => {
       if (!isCurrent()) return;
@@ -6459,7 +8053,10 @@ export async function quarantineWritableRuntimeContainers(options: {
         // Always re-publish the stopped verdict. A prior process may have
         // committed SQLite and crashed before its websocket frame left; the
         // cloud could otherwise remain ghost-running indefinitely.
-        stoppedTaskIds.add(candidate.taskId);
+        stoppedTasks.set(
+          candidate.taskId,
+          captureStoppedTaskStatusTarget(candidate.taskId),
+        );
         db_setStatus(candidate.taskId, "stopped", {
           codeServerPort: null,
           previewPorts: "[]",
@@ -6488,11 +8085,13 @@ export async function quarantineWritableRuntimeContainers(options: {
   }
 
   if (!isCurrent()) {
-    return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+    return { verdict: "stale", stoppedTasks: [...stoppedTasks.values()] };
   }
   return {
     verdict: resolved ? "ready" : "retry",
-    stoppedTaskIds: [...stoppedTaskIds].sort(),
+    stoppedTasks: [...stoppedTasks.values()].sort((a, b) =>
+      a.taskId.localeCompare(b.taskId),
+    ),
   };
 }
 
@@ -7282,25 +8881,25 @@ async function quarantineWritableAppleRuntimeContainers(options: {
   scope?: "contract" | "volume-holders";
 }): Promise<WritableRuntimeQuarantineResult> {
   const isCurrent = options.isCurrent ?? (() => true);
-  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [] };
+  if (!isCurrent()) return { verdict: "stale", stoppedTasks: [] };
   const binding = appleContainerRuntimeBinding();
-  if (binding === null) return { verdict: "retry", stoppedTaskIds: [] };
+  if (binding === null) return { verdict: "retry", stoppedTasks: [] };
   const cli = appleCliRunner(() => binding.containerCliPath);
   const listed = await cli(["list", "--all", "--format", "json"], {
     timeoutMs: 30_000,
     maxOutputBytes: 8 * 1024 * 1024,
   });
   if (listed.status !== 0 || listed.truncated === true) {
-    return { verdict: "retry", stoppedTaskIds: [] };
+    return { verdict: "retry", stoppedTasks: [] };
   }
   let parsed: unknown;
   try {
     parsed = JSON.parse(listed.stdout);
   } catch {
-    return { verdict: "retry", stoppedTaskIds: [] };
+    return { verdict: "retry", stoppedTasks: [] };
   }
-  if (!Array.isArray(parsed)) return { verdict: "retry", stoppedTaskIds: [] };
-  const stoppedTaskIds = new Set<string>();
+  if (!Array.isArray(parsed)) return { verdict: "retry", stoppedTasks: [] };
+  const stoppedTasks = new Map<string, StoppedTaskStatusTarget>();
   let resolved = true;
 
   const stopAndProve = async (id: string): Promise<boolean> => {
@@ -7357,7 +8956,9 @@ async function quarantineWritableAppleRuntimeContainers(options: {
       }>;
     };
   }>) {
-    if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+    if (!isCurrent()) {
+      return { verdict: "stale", stoppedTasks: [...stoppedTasks.values()] };
+    }
     const id = item?.configuration?.id;
     if (typeof id !== "string" || id.length === 0) {
       resolved = false;
@@ -7410,20 +9011,23 @@ async function quarantineWritableAppleRuntimeContainers(options: {
       }
       const task = getHostTask(taskId);
       if (task?.statusMirror && isOnDashboard(task.statusMirror)) {
+        const stoppedTask = captureStoppedTaskStatusTarget(taskId);
         db_setStatus(taskId, "stopped", {
           codeServerPort: null,
           previewPorts: "[]",
         });
-        stoppedTaskIds.add(taskId);
+        stoppedTasks.set(taskId, stoppedTask);
       }
       // Revoke live access with the environment, like the Docker sweep.
       clearTaskGatewayAcl(taskId);
     });
   }
-  if (!isCurrent()) return { verdict: "stale", stoppedTaskIds: [...stoppedTaskIds] };
+  if (!isCurrent()) {
+    return { verdict: "stale", stoppedTasks: [...stoppedTasks.values()] };
+  }
   return {
     verdict: resolved ? "ready" : "retry",
-    stoppedTaskIds: [...stoppedTaskIds],
+    stoppedTasks: [...stoppedTasks.values()],
   };
 }
 
@@ -7477,7 +9081,7 @@ async function materializeAgentCli(
       return false;
     }
   }
-  return writeAgentCli(task.taskId, roster, apiUrl, allowPermissionless);
+  return await writeAgentCli(task.taskId, roster, apiUrl, allowPermissionless);
 }
 
 async function recoverPersistedTaskEnvironment(
@@ -8314,6 +9918,17 @@ async function recoverOneDockerTask(
   lifecycle?: RecoveryTaskConsumers,
 ): Promise<boolean> {
   if (!isCurrent()) return true;
+  // Recovery is sanctioned private maintenance while public admission is
+  // deliberately `checking`. Its container work is fenced by this daemon
+  // epoch instead of the public operational bit: work it starts keeps going
+  // while the generation is current, and a superseded one stops.
+  const admitRecoveryContainerWork = (): void => {
+    if (!isCurrent()) {
+      throw new ContainerRuntimeUnavailableError(
+        "container runtime recovery generation was superseded",
+      );
+    }
+  };
   const composeProject = task.composeProject;
   if (!composeProject) {
     // We never wrote a compose project name for this row — must be
@@ -8463,7 +10078,9 @@ async function recoverOneDockerTask(
     // ~8h later. Cheap with the per-user access-token cache — one exchange
     // per user, every task re-injects from it. Best-effort.
     if (task.ownerUserId) {
-      void reconcileTaskGitAuth(task.taskId, task.ownerUserId).catch((err) =>
+      void reconcileTaskGitAuth(task.taskId, task.ownerUserId, {
+        admitContainerWork: admitRecoveryContainerWork,
+      }).catch((err) =>
         console.warn(
           `[github] task ${task.taskId}: running recovery reconciliation failed: ${
             err instanceof Error ? err.message : String(err)
@@ -8591,7 +10208,9 @@ async function recoverOneDockerTask(
   // reinject sweep only targets containers already running, so a container
   // recovered here would otherwise keep whatever it held when it exited —
   // possibly host-uid-owned 0600 files Codex can't read. Failure is surfaced
-  // by the inject itself and must not abort the task's recovery.
+  // by the inject itself and must not abort the task's recovery. ADR-154:
+  // the runner owner's own sign-in, so only while the runner is on its own
+  // credentials (the inject fences itself).
   await injectCodexIntoContainer(containerName);
   if (!isCurrent()) return true;
   // Establish the task owner's GitHub transport BEFORE uai-init performs any
@@ -8602,17 +10221,9 @@ async function recoverOneDockerTask(
   if (task.ownerUserId) {
     try {
       await reconcileTaskGitAuth(task.taskId, task.ownerUserId, {
-        // Recovery is sanctioned private maintenance while public admission is
-        // deliberately `checking`. Fence it by this daemon epoch instead of
-        // the public operational bit, preserving private-dependency setup
-        // before uai-init without letting stale recovery keep mutating.
-        admitContainerWork: () => {
-          if (!isCurrent()) {
-            throw new ContainerRuntimeUnavailableError(
-              "container runtime recovery generation was superseded",
-            );
-          }
-        },
+        // Before uai-init, so private dependencies resolve; fenced by this
+        // recovery's epoch, not the public operational bit.
+        admitContainerWork: admitRecoveryContainerWork,
       });
       if (!isCurrent()) return true;
     } catch (err) {