@runuai/host 0.9.149 → 0.9.151

package/src/index.ts

@@ -1,9 +1,28 @@
 import {
   agent,
   AgentError,
+  CREDENTIALS_WITHDRAWN_MESSAGE,
   toolStderrDetail,
+  type LeasedTaskUp,
   type TaskDownResult,
 } from "../lib/agent";
+import {
+  activeCloudCredentials,
+  admitLegacyStart,
+  cloudCredentialRuntime,
+  credentialsMode,
+  onOwnCredentials,
+  whileOnOwnCredentials,
+  type LegacyStartPermit,
+} from "../lib/cloud-credential-host";
+import { CredentialLeaseUnavailableError, type TaskAssignment } from "../lib/cloud-credential-leases";
+import {
+  StartInterruptedError,
+  type CloudCredentialRuntime,
+  type TaskCredentialStart,
+  type TaskUpHold,
+} from "../lib/cloud-credential-runtime";
+import { writeTaskGithub, writeTaskSshKey } from "../lib/credential-consumers/github";
 import { agentClisReady, ensureStandardImage } from "../lib/standard-image";
 import { cloneRepo } from "../lib/repo-clone";
 import { handleFilesOp } from "../lib/shared-files";
@@ -43,16 +62,23 @@ import {
   appendTranscriptViaEnvironment,
 } from "../lib/transcript";
 import { buildTaskDiff } from "../lib/task-diff";
+import { stoppedTaskDiff } from "../lib/task-diff-sandbox";
 import {
+  admitTaskRunEpoch,
+  canReuseTaskRuntimeForRun,
+  closeTaskRunAssignment,
+  closeTaskRunAssignmentForStop,
   deleteHostTask,
   getHostTask,
   hostTaskEnvMode,
+  readTaskRunEpochState,
   recordHostEvent,
   recordTaskDown,
   recordTaskEnvironmentPrepared,
   recordTaskError,
   recordTaskOwner,
   recordTaskProjectEnvSpec,
+  recordTaskRuntimeEstablished,
   recordTaskStarting,
   recordTaskUpResult,
   taskProjectEnvSpec,
@@ -78,7 +104,10 @@ import { activeSecretsProxy } from "../lib/secrets-proxy/host";
 import { secretsProxyEnabled } from "../lib/secrets-proxy/runtime";
 import { forgetTaskProxyReadiness } from "../lib/secrets-proxy/readiness";
 import { admitFreshTaskView } from "../lib/secrets-proxy/sidecar-view";
-import { invalidateTaskWrites, reconcileTaskProxyState } from "../lib/secrets-proxy/task-trust";
+import {
+  invalidateTaskWrites,
+  reconcileTaskProxyState,
+} from "../lib/secrets-proxy/task-trust";
 import { parsePreviewPortRuntimes } from "../lib/preview-ports";
 import { dockerCli } from "../lib/docker-exec";
 import {
@@ -187,7 +216,7 @@ export {
 export { cloneRepo } from "../lib/repo-clone";
 export type { CloneRepoInput, CloneRepoResult } from "../lib/repo-clone";
 
-export { parseGitDiff, runGitDiff } from "../lib/git-diff";
+export { parseGitDiff } from "../lib/git-diff";
 export type { DiffFile, DiffHunk, DiffLine, DiffStatus } from "../lib/git-diff";
 
 export {
@@ -242,88 +271,292 @@ function sidecarRunnerIsPinned(): HostCommandResult<never> | null {
   };
 }
 
-export const hostCommands: HostCommands = {
-  // The hostId argument is cloud-side routing (host-scoped commands carry
-  // their target in args, like filesOp); this process IS the target.
-  async hostUpdate(ctx, _hostId) {
-    logCommand(ctx, "hostUpdate");
-    const pinned = sidecarRunnerIsPinned();
-    if (pinned) return pinned;
-    try {
-      const { updateManagedRuntime } = await import("../lib/managed-runtime");
-      const outcome = await updateManagedRuntime();
-      if (outcome.status === "not-managed") {
-        return {
-          ok: false,
-          code: HostErrorCode.Internal,
-          message:
-            "this host is not a managed install — update it where it runs",
-          retryable: false,
-        };
-      }
-      if (outcome.status === "deferred") {
-        // A rollback hold is an operator verdict that the newer release is
-        // unsafe on this host; a remote click must not override it.
-        return {
-          ok: true,
-          value: { version: outcome.version, staged: false, deferred: true },
-        };
-      }
-      if (outcome.status === "current") {
-        return { ok: true, value: { version: outcome.version, staged: false } };
+type TaskUpCommand = HostCommands["taskUp"];
+type TaskUpOutcome = Awaited<ReturnType<TaskUpCommand>>;
+
+/**
+ * ADR-154: a start on cloud credentials, as task-up carries it. It begins in
+ * the short admission slot (the run's startup; every older start of the task
+ * interrupted), is awaited outside every slot, holds its installed grant
+ * through the long slot (the clone, provisioning and the runtime-ready
+ * writes), publishes its success only while it is still the task's current
+ * start with its credentials open, and is settled after: ended, or abandoned
+ * with its hold let go first.
+ */
+interface CloudCredentialTaskStart {
+  readonly runtime: CloudCredentialRuntime;
+  readonly assignment: TaskAssignment;
+  start: TaskCredentialStart | null;
+  hold: TaskUpHold | null;
+}
+
+/** The start's lease for task-up: its whole grant's hold, and what the
+ *  runner writes into the runtime once it exists (the owner's GitHub sign-in
+ *  and SSH key, recorded for cleanup) before anything in it runs. */
+function leasedTaskUp(start: TaskCredentialStart, hold: TaskUpHold): LeasedTaskUp {
+  return {
+    // The whole grant's signal: its gate closing, a cleanup reaching it or
+    // the start being interrupted all end task-up.
+    clone: { ...hold.git, signal: hold.signal },
+    runtimeReady: async (environment, signal) => {
+      for (const write of [writeTaskGithub, writeTaskSshKey]) {
+        if (signal.aborted) throw new CredentialLeaseUnavailableError("the task's credentials were withdrawn");
+        await write(environment, start.assignment);
       }
-      managedHostRestartHook?.();
-      return { ok: true, value: { version: outcome.version, staged: true } };
-    } catch (error) {
-      return {
-        ok: false,
-        code: HostErrorCode.Internal,
-        message: `update failed: ${
-          error instanceof Error ? error.message : "unknown error"
-        }`,
-        retryable: true,
-      };
+    },
+  };
+}
+
+/** `wait`, given up (rejecting) as soon as the runner begins leaving its own
+ *  credentials, when what it waits for may never come. */
+function untilLeavingLegacy<T>(legacy: LegacyStartPermit | null, wait: Promise<T>): Promise<T> {
+  if (legacy === null) return wait;
+  const signal = legacy.signal;
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = (): void => reject(signal.reason);
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+    wait.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error: unknown) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      },
+    );
+  });
+}
+
+/** A start the runner does not take while it switches its tasks to cloud
+ *  credentials: the cloud starts it again shortly. */
+function switchingToCloudCredentials(): TaskUpOutcome {
+  return {
+    ok: false,
+    code: HostErrorCode.HostUnavailable,
+    message: "This host is switching its tasks to cloud credentials; the task starts once it is done.",
+    retryable: true,
+    retryReason: "managed_restart",
+  };
+}
+
+/** What a start reports when Stop, teardown, a newer run or shutdown
+ *  interrupted it, in place of its own outcome; null when none did. The
+ *  interruption that won decides: shutdown asks the cloud to start the
+ *  task again once the runner is back, anything else leaves a run that is
+ *  no longer current. */
+function interruptedStartResult(cloud: CloudCredentialTaskStart | null): TaskUpOutcome | null {
+  if (!cloud?.start?.signal.aborted) return null;
+  const reason: unknown = cloud.start.signal.reason;
+  if (reason instanceof StartInterruptedError && reason.by === "shutdown") {
+    return {
+      ok: false,
+      code: HostErrorCode.HostUnavailable,
+      message: "This host is restarting; the task starts once it is back.",
+      retryable: true,
+      retryReason: "managed_restart",
+    };
+  }
+  return {
+    ok: false,
+    code: HostErrorCode.TaskAlreadyRunning,
+    message: `task ${cloud.assignment.taskId} run ${String(cloud.assignment.runEpoch)} is no longer current: Stop, teardown or a newer run took over its start`,
+  };
+}
+
+/** The start's credentials closed for its run without an interruption:
+ *  removed, refused or replaced in the cloud. */
+function withdrawnStart(): TaskUpOutcome {
+  return { ok: false, code: HostErrorCode.Internal, message: CREDENTIALS_WITHDRAWN_MESSAGE };
+}
+
+/** The last word before a start publishes its success: null while it may.
+ *  Otherwise what it reports instead (`interrupted` when Stop, teardown, a
+ *  newer run or shutdown took over): its interruption's result, or a
+ *  withdrawn start's failure once its credentials are no longer open for
+ *  its run. */
+function cloudStartCannotPublish(
+  cloud: CloudCredentialTaskStart | null,
+): { result: TaskUpOutcome; interrupted: boolean } | null {
+  if (!cloud?.start) return null;
+  const interrupted = interruptedStartResult(cloud);
+  if (interrupted) return { result: interrupted, interrupted: true };
+  try {
+    cloud.start.assertCurrent();
+    return null;
+  } catch {
+    return { result: withdrawnStart(), interrupted: false };
+  }
+}
+
+/** The long slot's operation, the start's hold let go as it ends: a hold
+ *  never outlives the slot it was taken in, so a Stop or teardown queued
+ *  behind it never waits on it. */
+function releasingHold(
+  cloud: CloudCredentialTaskStart | null,
+  operation: () => Promise<TaskUpOutcome>,
+): () => Promise<TaskUpOutcome> {
+  return async () => {
+    try {
+      return await operation();
+    } finally {
+      cloud?.hold?.release();
     }
-  },
-  async hostRestart(ctx, _hostId) {
-    logCommand(ctx, "hostRestart");
-    const pinned = sidecarRunnerIsPinned();
-    if (pinned) return pinned;
-    if (!managedHostRestartHook) {
+  };
+}
+
+async function taskUpOn(
+  ctx: Parameters<TaskUpCommand>[0],
+  input: Parameters<TaskUpCommand>[1],
+  cloud: CloudCredentialTaskStart | null,
+  legacy: LegacyStartPermit | null,
+): ReturnType<TaskUpCommand> {
+  const orchestrator = getOrchestrator();
+  let runEpochAdmission: ReturnType<typeof admitTaskRunEpoch>;
+  try {
+    if (input.task.runEpoch === undefined) {
+      // ADR-154: a start on the runner's own credentials only while the
+      // runner is still on them.
+      if (legacy?.valid() === false) return switchingToCloudCredentials();
+      // Preserve the v0 path exactly during the rolling window. It has no
+      // assignment floor to serialize and must keep failing cheap host
+      // preflights before entering the runtime lifecycle queue.
+      runEpochAdmission = admitTaskRunEpoch(input.task.id, undefined);
+    } else {
+      const admitted = await orchestrator.runTaskLifecycle(
+        input.task.id,
+        async () => {
+          // ADR-154: a start on the runner's own credentials is admitted
+          // only while the runner is still on them.
+          if (legacy?.valid() === false) {
+            return { ok: false as const, result: switchingToCloudCredentials() };
+          }
+          const admission = admitTaskRunEpoch(
+            input.task.id,
+            input.task.runEpoch,
+          );
+          if (admission.kind === "stale") {
+            return {
+              ok: false as const,
+              result: {
+                ok: false as const,
+                code: HostErrorCode.TaskAlreadyRunning,
+                message:
+                  `task ${input.task.id} run ${String(input.task.runEpoch)} is stale; ` +
+                  `this runner has already admitted run ${String(admission.currentRunEpoch)}`,
+              },
+            };
+          }
+          // ADR-154: the run's credential startup begins in this short slot;
+          // its predecessor's cleanup and its grant are awaited outside it.
+          if (cloud !== null) {
+            try {
+              cloud.start = cloud.runtime.beginStart(cloud.assignment);
+            } catch (error) {
+              return {
+                ok: false as const,
+                result: {
+                  ok: false as const,
+                  code: HostErrorCode.HostUnavailable,
+                  message: `task ${input.task.id} could not begin on its cloud credentials: ${
+                    error instanceof Error ? error.message : String(error)
+                  }`,
+                  retryable: true,
+                  ...(error instanceof StartInterruptedError ? { retryReason: "managed_restart" as const } : {}),
+                },
+              };
+            }
+          }
+          return { ok: true as const, admission };
+        },
+      );
+      if (!admitted.ok) return admitted.result;
+      runEpochAdmission = admitted.admission;
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      code: HostErrorCode.Internal,
+      message:
+        error instanceof Error
+          ? error.message
+          : "the task run epoch is invalid",
+    };
+  }
+  // Admission alone never proves a runtime belongs to this assignment. A
+  // failed prior start can leave an open floor beside the older runtime.
+  const mayReuseRuntime = canReuseTaskRuntimeForRun(
+    input.task.id,
+    input.task.runEpoch,
+  );
+  const admissionFailure = managedMaintenanceUnavailable();
+  if (admissionFailure) return admissionFailure;
+  const runtimePreparationFailure = await prepareContainerRuntimeForTask();
+  if (runtimePreparationFailure) return runtimePreparationFailure;
+  const runtimeFailure = runtimeUnavailable();
+  if (runtimeFailure) return runtimeFailure;
+  // The boot reconcile briefly replaces CLI shims in the shared volume.
+  // Do not create local lifecycle/channel state until its one-way latch has
+  // settled (success or best-effort failure), then revalidate both mutable
+  // admission authorities after the await.
+  await agentClisReady;
+  const readyAdmissionFailure = managedMaintenanceUnavailable();
+  if (readyAdmissionFailure) return readyAdmissionFailure;
+  const readyRuntimeFailure = runtimeUnavailable();
+  if (readyRuntimeFailure) return readyRuntimeFailure;
+  try {
+    await waitForMcpGatewayReady();
+  } catch (error) {
+    console.warn(
+      `[task-gateway] refusing task ${input.task.id} before provisioning: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+    return {
+      ok: false,
+      code: HostErrorCode.HostUnavailable,
+      message:
+        "The task environment gateway is not ready on this host. Retry the task; if it persists, check the host service log.",
+      retryable: true,
+    };
+  }
+  // A task machine's own guards first: its runner's data directory root's
+  // alone, and the metadata service closed to the task's user. Without
+  // them the task does not start: it could read the sidecar's host token.
+  if (sidecarMode()) {
+    const guard = guardSidecarMachine({ dataDir: env.dataDir });
+    if (!guard.ok) {
+      console.warn(`[sidecar] refusing task ${input.task.id}: ${guard.reason}`);
       return {
         ok: false,
         code: HostErrorCode.Internal,
-        message: "restart is unavailable in this process",
+        message: `This task machine is not safe to run the task on: ${guard.reason}. Close the task and start it again on a new machine.`,
         retryable: false,
       };
     }
-    // The result frame flushes before exit: shutdown drains in-flight
-    // commands (this one included) before the process terminates.
-    managedHostRestartHook();
-    return { ok: true, value: undefined };
-  },
-  async taskUp(ctx, input) {
-    logCommand(ctx, "taskUp", input.task.id);
-    const admissionFailure = managedMaintenanceUnavailable();
-    if (admissionFailure) return admissionFailure;
-    const runtimePreparationFailure = await prepareContainerRuntimeForTask();
-    if (runtimePreparationFailure) return runtimePreparationFailure;
-    const runtimeFailure = runtimeUnavailable();
-    if (runtimeFailure) return runtimeFailure;
-    // The boot reconcile briefly replaces CLI shims in the shared volume.
-    // Do not create local lifecycle/channel state until its one-way latch has
-    // settled (success or best-effort failure), then revalidate both mutable
-    // admission authorities after the await.
-    await agentClisReady;
-    const readyAdmissionFailure = managedMaintenanceUnavailable();
-    if (readyAdmissionFailure) return readyAdmissionFailure;
-    const readyRuntimeFailure = runtimeUnavailable();
-    if (readyRuntimeFailure) return readyRuntimeFailure;
+  }
+  // A bindings-capable task sidecar must activate and commit its exact
+  // replica before any task state, /env generation or process can exist.
+  // Otherwise the source's intentional pre-activation legacy fallback
+  // could expose stored plaintext during the first reconciliation.
+  if (sidecarMode()) {
     try {
-      await waitForMcpGatewayReady();
+      // ADR-154: on cloud credentials the start's own grant is what readies
+      // it (awaited below); the v0 lease that readies the machine's stores
+      // never runs there.
+      if (cloud === null) await untilLeavingLegacy(legacy, awaitSidecarReady());
+      // ADR-154: and its env is the composer's, never the machine's replica.
+      if (cloud === null && projectEnvBindingCapability() !== null) {
+        await untilLeavingLegacy(legacy, awaitProjectEnvReplicaReady());
+      }
     } catch (error) {
+      // ADR-154: the runner began leaving its own credentials, and with them
+      // the v0 lease this readiness comes from: the cloud starts the task
+      // again on cloud credentials.
+      if (legacy?.signal.aborted) return switchingToCloudCredentials();
       console.warn(
-        `[task-gateway] refusing task ${input.task.id} before provisioning: ${
+        `[task-env] refusing task ${input.task.id} before provisioning: ${
           error instanceof Error ? error.message : String(error)
         }`,
       );
@@ -331,881 +564,1072 @@ export const hostCommands: HostCommands = {
         ok: false,
         code: HostErrorCode.HostUnavailable,
         message:
-          "The task environment gateway is not ready on this host. Retry the task; if it persists, check the host service log.",
+          "This task machine is still synchronizing its environment. Retry shortly.",
         retryable: true,
       };
     }
-    // A task machine's own guards first: its runner's data directory root's
-    // alone, and the metadata service closed to the task's user. Without
-    // them the task does not start: it could read the sidecar's host token.
-    if (sidecarMode()) {
-      const guard = guardSidecarMachine({ dataDir: env.dataDir });
-      if (!guard.ok) {
-        console.warn(`[sidecar] refusing task ${input.task.id}: ${guard.reason}`);
-        return {
+  }
+  // ADR-118 follow-up: each apple-container task is its own VM, and each
+  // VM pins host vnodes for its life. Refuse to start ANOTHER one when the
+  // table is nearly full — a clear, retryable refusal now beats ENFILE
+  // storms (and the suspected panic path) for the whole machine later.
+  if (pinnedContainerRuntimeProvider() === "apple-container") {
+    const vnodeProblem = await vnodeAdmissionProblem();
+    if (vnodeProblem) {
+      return {
+        ok: false,
+        code: HostErrorCode.HostUnavailable,
+        message: vnodeProblem,
+        retryable: true,
+      };
+    }
+  }
+  // ADR-154: the grant installed and its gate open, its env snapshot exact:
+  // awaited outside every lifecycle slot, and bounded.
+  if (cloud?.start) {
+    try {
+      await cloud.runtime.waitForLaunchReady(cloud.start);
+    } catch (error) {
+      return (
+        interruptedStartResult(cloud) ?? {
           ok: false,
-          code: HostErrorCode.Internal,
-          message: `This task machine is not safe to run the task on: ${guard.reason}. Close the task and start it again on a new machine.`,
-          retryable: false,
-        };
-      }
+          code: HostErrorCode.HostUnavailable,
+          message: `The task's cloud credentials did not become usable (${
+            error instanceof Error ? error.message : String(error)
+          }). Retry the task.`,
+          retryable: true,
+        }
+      );
     }
-    // A bindings-capable task sidecar must activate and commit its exact
-    // replica before any task state, /env generation or process can exist.
-    // Otherwise the source's intentional pre-activation legacy fallback
-    // could expose stored plaintext during the first reconciliation.
-    if (sidecarMode()) {
+  }
+  return orchestrator.runTaskLifecycle(input.task.id, releasingHold(cloud, async () => {
+    // A direct duplicate teardown may still be draining operations that
+    // target this task's stable compose/container names. Never recreate
+    // those names until every close caller has crossed the shared fence.
+    await orchestrator.waitForChannelClose(input.task.id);
+    // Admission is a short lifecycle transaction before the long host
+    // preflights above. A newer dispatch may have advanced the durable
+    // floor while this command was waiting; once this command owns the
+    // lifecycle slot, reject it before it can observe or mutate a newer
+    // assignment's runtime.
+    const assignmentState = readTaskRunEpochState(input.task.id);
+    const assignmentCurrent =
+      input.task.runEpoch === undefined
+        ? assignmentState === null
+        : assignmentState !== null &&
+          assignmentState.assignmentOpen &&
+          assignmentState.highestRunEpoch === input.task.runEpoch;
+    if (!assignmentCurrent) {
+      const currentRunEpoch = assignmentState?.highestRunEpoch ?? 0;
+      return {
+        ok: false,
+        code: HostErrorCode.TaskAlreadyRunning,
+        message:
+          `task ${input.task.id} run ${String(input.task.runEpoch)} is no longer current; ` +
+          `this runner has admitted run ${String(currentRunEpoch)}`,
+      };
+    }
+    const inSlotAdmissionFailure = managedMaintenanceUnavailable();
+    if (inSlotAdmissionFailure) return inSlotAdmissionFailure;
+    const inSlotRuntimeFailure = runtimeUnavailable();
+    if (inSlotRuntimeFailure) return inSlotRuntimeFailure;
+    // ADR-154: nothing of a start on the runner's own credentials happens
+    // once the runner has begun leaving them.
+    if (legacy?.valid() === false) return switchingToCloudCredentials();
+    // ADR-154: the start holds its installed grant from here through the
+    // clone, provisioning and the runtime-ready writes; without it nothing
+    // starts.
+    if (cloud?.start) {
       try {
-        await awaitSidecarReady();
-        if (projectEnvBindingCapability() !== null) {
-          await awaitProjectEnvReplicaReady();
-        }
+        cloud.hold = cloud.runtime.tryAcquireTaskUpHold(cloud.start);
       } catch (error) {
-        console.warn(
-          `[task-env] refusing task ${input.task.id} before provisioning: ${
-            error instanceof Error ? error.message : String(error)
-          }`,
-        );
         return {
           ok: false,
           code: HostErrorCode.HostUnavailable,
-          message:
-            "This task machine is still synchronizing its environment. Retry shortly.",
+          message: `The task's lease names credentials that could not be read (${
+            error instanceof Error ? error.message : String(error)
+          }). Retry the task.`,
           retryable: true,
         };
       }
+      if (cloud.hold === null) return interruptedStartResult(cloud) ?? withdrawnStart();
+    }
+    // A command retry that arrives after the original start completed must
+    // not rerender/compose-up/uai-init underneath live agent sessions. Treat
+    // that lost-response retry as the successful operation it already was:
+    // every cloud caller records a non-ok taskUp as an errored task.
+    const existingTask = getHostTask(input.task.id);
+    const incomingEnvSpec = taskProjectEnvSpec(input);
+    let existingGatewayReady = true;
+    if (existingTask && hostTaskEnvMode(existingTask) === "loader") {
+      // A lost-response retry is also the repair path after a host process
+      // restart: reattach the live resolver before any task process can be
+      // treated as reusable. Missing/corrupt durable identity forces normal
+      // recreation, which mints a generation and restarts its forwarder.
+      recordTaskProjectEnvSpec(input.task.id, input);
+      existingGatewayReady =
+        recoverTaskGatewayTask(input.task.id, {
+          // The generation serves the run its runtime was established for.
+          resolveEnv: taskEnvResolver(input.task.id, incomingEnvSpec, existingTask.runEpoch > 0 ? existingTask.runEpoch : null),
+          runEpoch: existingTask.runEpoch > 0 ? existingTask.runEpoch : null,
+        }) !== null;
     }
-    // ADR-118 follow-up: each apple-container task is its own VM, and each
-    // VM pins host vnodes for its life. Refuse to start ANOTHER one when the
-    // table is nearly full — a clear, retryable refusal now beats ENFILE
-    // storms (and the suspected panic path) for the whole machine later.
-    if (pinnedContainerRuntimeProvider() === "apple-container") {
-      const vnodeProblem = await vnodeAdmissionProblem();
-      if (vnodeProblem) {
+    let runtimeQuarantinedForRecreate = false;
+    let channelClosedForRecreate = false;
+    if (
+      existingTask?.statusMirror === "running" &&
+      existingTask.environmentProvider === "apple-container"
+    ) {
+      // ADR-106/round-4: the lost-response fast path must speak the
+      // provider's language — the Docker branch below ENOENTs on a
+      // Docker-free Mac and suspended the generation instead of returning
+      // the persisted success.
+      if (!existingTask.composeProject || !existingTask.worktreePath) {
         return {
           ok: false,
-          code: HostErrorCode.HostUnavailable,
-          message: vnodeProblem,
-          retryable: true,
+          code: HostErrorCode.Internal,
+          message:
+            `task ${input.task.id} is running but its persisted runtime ` +
+            "metadata is incomplete",
         };
       }
-    }
-    const orchestrator = getOrchestrator();
-    return orchestrator.runTaskLifecycle(input.task.id, async () => {
-      // A direct duplicate teardown may still be draining operations that
-      // target this task's stable compose/container names. Never recreate
-      // those names until every close caller has crossed the shared fence.
-      await orchestrator.waitForChannelClose(input.task.id);
-      const inSlotAdmissionFailure = managedMaintenanceUnavailable();
-      if (inSlotAdmissionFailure) return inSlotAdmissionFailure;
-      const inSlotRuntimeFailure = runtimeUnavailable();
-      if (inSlotRuntimeFailure) return inSlotRuntimeFailure;
-      // A command retry that arrives after the original start completed must
-      // not rerender/compose-up/uai-init underneath live agent sessions. Treat
-      // that lost-response retry as the successful operation it already was:
-      // every cloud caller records a non-ok taskUp as an errored task.
-      const existingTask = getHostTask(input.task.id);
-      const incomingEnvSpec = taskProjectEnvSpec(input);
-      let existingGatewayReady = true;
-      if (existingTask && hostTaskEnvMode(existingTask) === "loader") {
-        // A lost-response retry is also the repair path after a host process
-        // restart: reattach the live resolver before any task process can be
-        // treated as reusable. Missing/corrupt durable identity forces normal
-        // recreation, which mints a generation and restarts its forwarder.
-        recordTaskProjectEnvSpec(input.task.id, input);
-        existingGatewayReady =
-          recoverTaskGatewayTask(input.task.id, {
-            resolveEnv: taskEnvResolver(input.task.id, incomingEnvSpec),
-          }) !== null;
-      }
-      let runtimeQuarantinedForRecreate = false;
-      let channelClosedForRecreate = false;
-      if (
-        existingTask?.statusMirror === "running" &&
-        existingTask.environmentProvider === "apple-container"
-      ) {
-        // ADR-106/round-4: the lost-response fast path must speak the
-        // provider's language — the Docker branch below ENOENTs on a
-        // Docker-free Mac and suspended the generation instead of returning
-        // the persisted success.
-        if (!existingTask.composeProject || !existingTask.worktreePath) {
+      // Round 5: every await below can outlive the runtime generation
+      // (bridge revalidation, forced recheck). A superseded pass must
+      // observe only — never reopen consumers or mutate the container —
+      // the same discipline apple recovery applies.
+      // Round 6: the fence requires the OPERATIONAL generation, not merely
+      // the epoch — plain suspension (connection revalidation) keeps the
+      // epoch and ready status while the daemon is unverified.
+      const fastEpoch = containerRuntimeReadinessEpoch();
+      const fastStale = (): boolean =>
+        !containerRuntimeGenerationOperational(fastEpoch);
+      const staleRetry = {
+        ok: false as const,
+        code: HostErrorCode.HostUnavailable,
+        message:
+          `the container runtime generation changed while verifying task ${input.task.id}; retry`,
+        retryable: true,
+      };
+      const environment = await reconstructPersistedTaskEnvironment(
+        existingTask,
+      );
+      if (fastStale()) return staleRetry;
+      if (environment === null) {
+        // The persisted locator no longer reconstructs (e.g. an engine
+        // identity change) — recreate through the normal path.
+        suspendTaskGatewayTask(input.task.id);
+        await orchestrator.closeChannel(input.task.id);
+        // Session drain can outlive the generation too: a superseded pass
+        // must not reach recordTaskStarting/provisioning below.
+        if (fastStale()) return staleRetry;
+        channelClosedForRecreate = true;
+      } else {
+        const appleStatus = await environment.status();
+        if (fastStale()) return staleRetry;
+        if (appleStatus.state === "unknown") {
           return {
             ok: false,
-            code: HostErrorCode.Internal,
+            code: HostErrorCode.HostUnavailable,
             message:
-              `task ${input.task.id} is running but its persisted runtime ` +
-              "metadata is incomplete",
+              `could not verify runtime state for task ${input.task.id}: ` +
+              appleStatus.detail,
+            retryable: true,
           };
         }
-        // Round 5: every await below can outlive the runtime generation
-        // (bridge revalidation, forced recheck). A superseded pass must
-        // observe only — never reopen consumers or mutate the container —
-        // the same discipline apple recovery applies.
-        // Round 6: the fence requires the OPERATIONAL generation, not merely
-        // the epoch — plain suspension (connection revalidation) keeps the
-        // epoch and ready status while the daemon is unverified.
-        const fastEpoch = containerRuntimeReadinessEpoch();
-        const fastStale = (): boolean =>
-          !containerRuntimeGenerationOperational(fastEpoch);
-        const staleRetry = {
-          ok: false as const,
-          code: HostErrorCode.HostUnavailable,
-          message:
-            `the container runtime generation changed while verifying task ${input.task.id}; retry`,
-          retryable: true,
-        };
-        const environment = await reconstructPersistedTaskEnvironment(
-          existingTask,
-        );
-        if (fastStale()) return staleRetry;
-        if (environment === null) {
-          // The persisted locator no longer reconstructs (e.g. an engine
-          // identity change) — recreate through the normal path.
-          suspendTaskGatewayTask(input.task.id);
-          await orchestrator.closeChannel(input.task.id);
-          // Session drain can outlive the generation too: a superseded pass
-          // must not reach recordTaskStarting/provisioning below.
-          if (fastStale()) return staleRetry;
-          channelClosedForRecreate = true;
-        } else {
-          const appleStatus = await environment.status();
+        if (appleStatus.state === "running") {
+          const verdict = await proveAppleTaskRuntimeContract({
+            taskId: input.task.id,
+            containerName: appleTaskContainerName(input.task.id),
+            // The row's worktreePath is task-up's $task_dir — the same
+            // directory the apple locator records as hostWorktreePath.
+            hostWorktreePath: existingTask.worktreePath,
+          });
           if (fastStale()) return staleRetry;
-          if (appleStatus.state === "unknown") {
+          if (verdict.kind === "unreachable") {
             return {
               ok: false,
               code: HostErrorCode.HostUnavailable,
               message:
-                `could not verify runtime state for task ${input.task.id}: ` +
-                appleStatus.detail,
+                `could not prove the exact runtime contract for task ${input.task.id}: ` +
+                verdict.detail,
               retryable: true,
             };
           }
-          if (appleStatus.state === "running") {
-            const verdict = await proveAppleTaskRuntimeContract({
-              taskId: input.task.id,
-              containerName: appleTaskContainerName(input.task.id),
-              // The row's worktreePath is task-up's $task_dir — the same
-              // directory the apple locator records as hostWorktreePath.
-              hostWorktreePath: existingTask.worktreePath,
+          let projectsHealthy = true;
+          for (const project of verdict.kind === "holds"
+            ? input.projects
+            : []) {
+            const gitHealth = await environment.exec({
+              projectEnvProfile: "maintenance",
+              argv: [
+                "/usr/bin/env",
+                "-i",
+                "HOME=/home/node",
+                "PATH=/usr/bin:/bin",
+                "/usr/bin/git",
+                "rev-parse",
+                "--is-inside-work-tree",
+              ],
+              user: "node",
+              cwd: `/workspace/${project.slug}`,
+              env: {},
+              timeoutMs: 10_000,
+              maxOutputBytes: 64 * 1024,
             });
             if (fastStale()) return staleRetry;
-            if (verdict.kind === "unreachable") {
+            if (gitHealth.exitCode === null || gitHealth.signal !== null) {
               return {
                 ok: false,
                 code: HostErrorCode.HostUnavailable,
                 message:
-                  `could not prove the exact runtime contract for task ${input.task.id}: ` +
-                  verdict.detail,
+                  `could not verify Git state for task ${input.task.id} ` +
+                  `project ${project.id}: the runtime did not answer`,
                 retryable: true,
               };
             }
-            let projectsHealthy = true;
-            for (const project of verdict.kind === "holds"
-              ? input.projects
-              : []) {
-              const gitHealth = await environment.exec({
-                projectEnvProfile: "maintenance",
-                argv: [
-                  "/usr/bin/env",
-                  "-i",
-                  "HOME=/home/node",
-                  "PATH=/usr/bin:/bin",
-                  "/usr/bin/git",
-                  "rev-parse",
-                  "--is-inside-work-tree",
-                ],
-                user: "node",
-                cwd: `/workspace/${project.slug}`,
-                env: {},
-                timeoutMs: 10_000,
-                maxOutputBytes: 64 * 1024,
-              });
-              if (fastStale()) return staleRetry;
-              if (gitHealth.exitCode === null || gitHealth.signal !== null) {
-                return {
-                  ok: false,
-                  code: HostErrorCode.HostUnavailable,
-                  message:
-                    `could not verify Git state for task ${input.task.id} ` +
-                    `project ${project.id}: the runtime did not answer`,
-                  retryable: true,
-                };
-              }
-              if (
-                gitHealth.exitCode !== 0 ||
-                Buffer.from(gitHealth.stdout).toString("utf8").trim() !==
-                  "true"
-              ) {
-                projectsHealthy = false;
-                console.warn(
-                  `[host-agent] task ${input.task.id}: project ${project.id} Git health check failed; rebuilding the running task`,
-                );
-                break;
-              }
-            }
             if (
-              verdict.kind === "holds" &&
-              projectsHealthy &&
-              existingGatewayReady
+              gitHealth.exitCode !== 0 ||
+              Buffer.from(gitHealth.stdout).toString("utf8").trim() !==
+                "true"
             ) {
-              if (fastStale()) return staleRetry;
-              orchestrator.allowChannel(input.task.id);
-              return {
-                ok: true,
-                value: {
-                  composeProject: existingTask.composeProject,
-                  worktreePath: existingTask.worktreePath,
-                  codeServerPort: existingTask.codeServerPort ?? undefined,
-                  previewPorts: parsePreviewPortRuntimes(
-                    existingTask.previewPorts,
-                  ),
-                  envMode: hostTaskEnvMode(existingTask),
-                },
-              };
-            }
-            // Violated contract or broken project repo: drain, stop, and
-            // prove before task-up recreates the same stable name.
-            if (fastStale()) return staleRetry;
-            suspendTaskGatewayTask(input.task.id);
-            await orchestrator.closeChannel(input.task.id);
-            channelClosedForRecreate = true;
-            if (fastStale()) return staleRetry;
-            await environment.stop();
-            const after = await environment.status();
-            if (fastStale()) return staleRetry;
-            if (after.state === "running" || after.state === "unknown") {
-              return {
-                ok: false,
-                code: HostErrorCode.HostUnavailable,
-                message:
-                  `task ${input.task.id} has a non-current runtime contract and ` +
-                  "could not be proven stopped; retry after the runtime is healthy",
-                retryable: true,
-              };
+              projectsHealthy = false;
+              console.warn(
+                `[host-agent] task ${input.task.id}: project ${project.id} Git health check failed; rebuilding the running task`,
+              );
+              break;
             }
-            // Round 5: the container is PHYSICALLY stopped now, whatever the
-            // reason (violated contract or a broken project repo). A failed
-            // recreation must roll the mirror back to stopped — restoring
-            // "running" would advertise a container proven not to run.
-            runtimeQuarantinedForRecreate = true;
-          } else {
-            // Provider proved the container absent/stopped: normal self-heal
-            // recreate — and the rollback state must say stopped for the
-            // same reason as above.
-            if (fastStale()) return staleRetry;
-            suspendTaskGatewayTask(input.task.id);
-            await orchestrator.closeChannel(input.task.id);
-            // Fence AFTER the drain as well: provisioning must never start
-            // under a generation this pass no longer owns.
+          }
+          if (
+            verdict.kind === "holds" &&
+            projectsHealthy &&
+            existingGatewayReady &&
+            mayReuseRuntime
+          ) {
             if (fastStale()) return staleRetry;
-            channelClosedForRecreate = true;
-            runtimeQuarantinedForRecreate = true;
+            const cannotPublish = cloudStartCannotPublish(cloud);
+            if (cannotPublish) return cannotPublish.result;
+            orchestrator.allowChannel(input.task.id);
+            return {
+              ok: true,
+              value: {
+                composeProject: existingTask.composeProject,
+                worktreePath: existingTask.worktreePath,
+                codeServerPort: existingTask.codeServerPort ?? undefined,
+                previewPorts: parsePreviewPortRuntimes(
+                  existingTask.previewPorts,
+                ),
+                envMode: hostTaskEnvMode(existingTask),
+              },
+            };
           }
+          // Violated contract or broken project repo: drain, stop, and
+          // prove before task-up recreates the same stable name.
+          if (fastStale()) return staleRetry;
+          suspendTaskGatewayTask(input.task.id);
+          await orchestrator.closeChannel(input.task.id);
+          channelClosedForRecreate = true;
+          if (fastStale()) return staleRetry;
+          await environment.stop();
+          const after = await environment.status();
+          if (fastStale()) return staleRetry;
+          if (after.state === "running" || after.state === "unknown") {
+            return {
+              ok: false,
+              code: HostErrorCode.HostUnavailable,
+              message:
+                `task ${input.task.id} has a non-current runtime contract and ` +
+                "could not be proven stopped; retry after the runtime is healthy",
+              retryable: true,
+            };
+          }
+          // Round 5: the container is PHYSICALLY stopped now, whatever the
+          // reason (violated contract or a broken project repo). A failed
+          // recreation must roll the mirror back to stopped — restoring
+          // "running" would advertise a container proven not to run.
+          runtimeQuarantinedForRecreate = true;
+        } else {
+          // Provider proved the container absent/stopped: normal self-heal
+          // recreate — and the rollback state must say stopped for the
+          // same reason as above.
+          if (fastStale()) return staleRetry;
+          suspendTaskGatewayTask(input.task.id);
+          await orchestrator.closeChannel(input.task.id);
+          // Fence AFTER the drain as well: provisioning must never start
+          // under a generation this pass no longer owns.
+          if (fastStale()) return staleRetry;
+          channelClosedForRecreate = true;
+          runtimeQuarantinedForRecreate = true;
         }
-      } else if (
-        existingTask?.statusMirror === "running" &&
-        isEnvironmentTransportProvider(existingTask.environmentProvider)
-      ) {
-        // ADR-121: a machine-backed task revalidates through its own
-        // provider — the compose fast path below speaks docker and would
-        // misread a machine row. Running machine → persisted success;
-        // anything else falls through to provisionTaskEnvironment, whose
-        // machine provider owns recovery semantics.
-        try {
-          const environment = await reconstructPersistedTaskEnvironment(
-            existingTask,
-          );
-          if (environment) {
-            const machineStatus = await environment.status();
-            if (machineStatus.state === "running" && existingGatewayReady) {
-              orchestrator.allowChannel(input.task.id);
-              return {
-                ok: true,
-                value: {
-                  composeProject: existingTask.composeProject ?? "",
-                  worktreePath: existingTask.worktreePath ?? "",
-                  codeServerPort: existingTask.codeServerPort ?? undefined,
-                  envMode: hostTaskEnvMode(existingTask),
-                },
-              };
-            }
+      }
+    } else if (
+      existingTask?.statusMirror === "running" &&
+      isEnvironmentTransportProvider(existingTask.environmentProvider)
+    ) {
+      // ADR-121: a machine-backed task revalidates through its own
+      // provider — the compose fast path below speaks docker and would
+      // misread a machine row. Running machine → persisted success;
+      // anything else falls through to provisionTaskEnvironment, whose
+      // machine provider owns recovery semantics.
+      try {
+        const environment = await reconstructPersistedTaskEnvironment(
+          existingTask,
+        );
+        if (environment) {
+          const machineStatus = await environment.status();
+          if (
+            machineStatus.state === "running" &&
+            existingGatewayReady &&
+            mayReuseRuntime
+          ) {
+            const cannotPublish = cloudStartCannotPublish(cloud);
+            if (cannotPublish) return cannotPublish.result;
+            orchestrator.allowChannel(input.task.id);
+            return {
+              ok: true,
+              value: {
+                composeProject: existingTask.composeProject ?? "",
+                worktreePath: existingTask.worktreePath ?? "",
+                codeServerPort: existingTask.codeServerPort ?? undefined,
+                envMode: hostTaskEnvMode(existingTask),
+              },
+            };
           }
-        } catch (error) {
-          console.warn(
-            `[machine] task ${input.task.id}: running-row revalidation failed, continuing to provision: ${error instanceof Error ? error.message : String(error)}`,
+        }
+      } catch (error) {
+        console.warn(
+          `[machine] task ${input.task.id}: running-row revalidation failed, continuing to provision: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      }
+    } else if (existingTask?.statusMirror === "running") {
+      if (!existingTask.composeProject || !existingTask.worktreePath) {
+        return {
+          ok: false,
+          code: HostErrorCode.Internal,
+          message:
+            `task ${input.task.id} is running but its persisted runtime ` +
+            "metadata is incomplete",
+        };
+      }
+      // The mirror may be stale after a manual `docker compose down`.
+      // Confirm the app itself is live before treating this as a lost-response
+      // retry; otherwise fall through to the normal taskUp self-heal.
+      const appRuntime = await dockerCli(
+        [
+          "ps",
+          "-a",
+          "--filter",
+          `label=com.docker.compose.project=${existingTask.composeProject}`,
+          "--filter",
+          "label=com.docker.compose.service=app",
+          "--format",
+          "{{.State}}",
+        ],
+        { timeoutMs: 10_000 },
+      );
+      if (appRuntime.status !== 0) {
+        return dockerUnavailableResult(
+          `could not verify runtime state for task ${input.task.id}: ` +
+            (appRuntime.stderr.trim().slice(0, 200) ||
+              "docker did not answer"),
+        );
+      }
+      if (
+        appRuntime.stdout
+          .split(/\r?\n/)
+          .some((state) => state.trim() === "running")
+      ) {
+        const appContainer = `${existingTask.composeProject}-app-1`;
+        const runtimeContract = await inspectTaskRuntimeContainer(
+          input.task.id,
+          existingTask.composeProject,
+        );
+        if (runtimeContract.kind === "unreachable") {
+          return dockerUnavailableResult(
+            `could not inspect the exact runtime mount for task ${input.task.id}`,
           );
         }
-      } else if (existingTask?.statusMirror === "running") {
-        if (!existingTask.composeProject || !existingTask.worktreePath) {
+        if (runtimeContract.kind === "failed") {
           return {
             ok: false,
-            code: HostErrorCode.Internal,
+            code: HostErrorCode.HostUnavailable,
             message:
-              `task ${input.task.id} is running but its persisted runtime ` +
-              "metadata is incomplete",
+              `could not prove the exact runtime contract for task ${input.task.id}: ` +
+              runtimeContract.detail,
+            retryable: true,
           };
         }
-        // The mirror may be stale after a manual `docker compose down`.
-        // Confirm the app itself is live before treating this as a lost-response
-        // retry; otherwise fall through to the normal taskUp self-heal.
-        const appRuntime = await dockerCli(
-          [
-            "ps",
-            "-a",
-            "--filter",
-            `label=com.docker.compose.project=${existingTask.composeProject}`,
-            "--filter",
-            "label=com.docker.compose.service=app",
-            "--format",
-            "{{.State}}",
-          ],
-          { timeoutMs: 10_000 },
-        );
-        if (appRuntime.status !== 0) {
-          return dockerUnavailableResult(
-            `could not verify runtime state for task ${input.task.id}: ` +
-              (appRuntime.stderr.trim().slice(0, 200) ||
-                "docker did not answer"),
-          );
-        }
-        if (
-          appRuntime.stdout
-            .split(/\r?\n/)
-            .some((state) => state.trim() === "running")
-        ) {
-          const appContainer = `${existingTask.composeProject}-app-1`;
-          const runtimeContract = await inspectTaskRuntimeContainer(
-            input.task.id,
-            existingTask.composeProject,
-          );
-          if (runtimeContract.kind === "unreachable") {
+        const reusable =
+          runtimeContract.running &&
+          !runtimeContract.restarting &&
+          !runtimeContract.paused &&
+          runtimeContract.sharedMount === "read-only" &&
+          runtimeContract.taskEnvironment === "current" &&
+          existingGatewayReady &&
+          mayReuseRuntime;
+        if (!reusable) {
+          // Drain/tombstone before touching the exact container. task-up's
+          // pre-materialization cleanup then removes this stopped immutable
+          // generation, so Compose must create the current RO/private-prefix
+          // contract rather than `docker start`ing it again.
+          suspendTaskGatewayTask(input.task.id);
+          await orchestrator.closeChannel(input.task.id);
+          channelClosedForRecreate = true;
+          const quarantined = await quarantineTaskRuntimeContainer({
+            taskId: input.task.id,
+            composeProject: existingTask.composeProject,
+            expectedContainerId: runtimeContract.containerId,
+          });
+          if (quarantined === "unreachable") {
             return dockerUnavailableResult(
-              `could not inspect the exact runtime mount for task ${input.task.id}`,
+              `Docker became unavailable while quarantining task ${input.task.id}`,
             );
           }
-          if (runtimeContract.kind === "failed") {
+          if (quarantined === "failed") {
             return {
               ok: false,
               code: HostErrorCode.HostUnavailable,
               message:
-                `could not prove the exact runtime contract for task ${input.task.id}: ` +
-                runtimeContract.detail,
+                `task ${input.task.id} has a non-current runtime contract and ` +
+                "could not be proven stopped; retry after Docker is healthy",
               retryable: true,
             };
           }
-          const reusable =
-            runtimeContract.running &&
-            !runtimeContract.restarting &&
-            !runtimeContract.paused &&
-            runtimeContract.sharedMount === "read-only" &&
-            runtimeContract.taskEnvironment === "current" &&
-            existingGatewayReady;
-          if (!reusable) {
-            // Drain/tombstone before touching the exact container. task-up's
-            // pre-materialization cleanup then removes this stopped immutable
-            // generation, so Compose must create the current RO/private-prefix
-            // contract rather than `docker start`ing it again.
-            suspendTaskGatewayTask(input.task.id);
-            await orchestrator.closeChannel(input.task.id);
-            channelClosedForRecreate = true;
-            const quarantined = await quarantineTaskRuntimeContainer({
-              taskId: input.task.id,
-              composeProject: existingTask.composeProject,
-              expectedContainerId: runtimeContract.containerId,
-            });
-            if (quarantined === "unreachable") {
-              return dockerUnavailableResult(
-                `Docker became unavailable while quarantining task ${input.task.id}`,
-              );
-            }
-            if (quarantined === "failed") {
-              return {
-                ok: false,
-                code: HostErrorCode.HostUnavailable,
-                message:
-                  `task ${input.task.id} has a non-current runtime contract and ` +
-                  "could not be proven stopped; retry after Docker is healthy",
-                retryable: true,
-              };
-            }
-            runtimeQuarantinedForRecreate = true;
-          }
-          // Docker being up is not enough to prove a lost-response retry is
-          // healthy. The worktree's `.git` file contains an absolute pointer
-          // into the task-private repository; after a host workspace-root
-          // migration the old container can keep running while every agent
-          // sees `fatal: not a git repository`. Probe from INSIDE the live
-          // container, which is the filesystem view the agents actually use.
-          // Scratchpads have no projects, so this remains an O(1) fast path.
-          let projectsHealthy = true;
-          for (const project of reusable ? input.projects : []) {
-            const gitHealth = await dockerCli(
-              [
-                "exec",
-                "-u",
-                "node",
-                // docker exec inherits the Compose/project environment. Clear
-                // loader and Git controls before the first executable, then
-                // give Git a minimal environment of its own. Keep this aligned
-                // with task-up.sh's managed container operations.
-                "-e",
-                "HOME=/home/node",
-                "-e",
-                "PATH=/usr/bin:/bin",
-                "-e",
-                "LD_PRELOAD=",
-                "-e",
-                "LD_LIBRARY_PATH=",
-                "-e",
-                "DYLD_INSERT_LIBRARIES=",
-                "-e",
-                "DYLD_LIBRARY_PATH=",
-                "-e",
-                "BASH_ENV=",
-                "-e",
-                "ENV=",
-                "-e",
-                "GIT_CONFIG=",
-                "-e",
-                "GIT_CONFIG_GLOBAL=",
-                "-e",
-                "GIT_CONFIG_SYSTEM=",
-                "-e",
-                "GIT_CONFIG_NOSYSTEM=",
-                "-e",
-                "GIT_CONFIG_COUNT=0",
-                "-e",
-                "GIT_EXEC_PATH=",
-                "-e",
-                "GIT_SSH=",
-                "-e",
-                "GIT_SSH_COMMAND=",
-                "-e",
-                "GIT_ASKPASS=",
-                "-e",
-                "SSH_ASKPASS=",
-                "-w",
-                `/workspace/${project.slug}`,
-                appContainer,
-                "/usr/bin/env",
-                "-i",
-                "HOME=/home/node",
-                "PATH=/usr/bin:/bin",
-                "/usr/bin/git",
-                "rev-parse",
-                "--is-inside-work-tree",
-              ],
-              { timeoutMs: 10_000 },
+          runtimeQuarantinedForRecreate = true;
+        }
+        // Docker being up is not enough to prove a lost-response retry is
+        // healthy. The worktree's `.git` file contains an absolute pointer
+        // into the task-private repository; after a host workspace-root
+        // migration the old container can keep running while every agent
+        // sees `fatal: not a git repository`. Probe from INSIDE the live
+        // container, which is the filesystem view the agents actually use.
+        // Scratchpads have no projects, so this remains an O(1) fast path.
+        let projectsHealthy = true;
+        for (const project of reusable ? input.projects : []) {
+          const gitHealth = await dockerCli(
+            [
+              "exec",
+              "-u",
+              "node",
+              // docker exec inherits the Compose/project environment. Clear
+              // loader and Git controls before the first executable, then
+              // give Git a minimal environment of its own. Keep this aligned
+              // with task-up.sh's managed container operations.
+              "-e",
+              "HOME=/home/node",
+              "-e",
+              "PATH=/usr/bin:/bin",
+              "-e",
+              "LD_PRELOAD=",
+              "-e",
+              "LD_LIBRARY_PATH=",
+              "-e",
+              "DYLD_INSERT_LIBRARIES=",
+              "-e",
+              "DYLD_LIBRARY_PATH=",
+              "-e",
+              "BASH_ENV=",
+              "-e",
+              "ENV=",
+              "-e",
+              "GIT_CONFIG=",
+              "-e",
+              "GIT_CONFIG_GLOBAL=",
+              "-e",
+              "GIT_CONFIG_SYSTEM=",
+              "-e",
+              "GIT_CONFIG_NOSYSTEM=",
+              "-e",
+              "GIT_CONFIG_COUNT=0",
+              "-e",
+              "GIT_EXEC_PATH=",
+              "-e",
+              "GIT_SSH=",
+              "-e",
+              "GIT_SSH_COMMAND=",
+              "-e",
+              "GIT_ASKPASS=",
+              "-e",
+              "SSH_ASKPASS=",
+              "-w",
+              `/workspace/${project.slug}`,
+              appContainer,
+              "/usr/bin/env",
+              "-i",
+              "HOME=/home/node",
+              "PATH=/usr/bin:/bin",
+              "/usr/bin/git",
+              "rev-parse",
+              "--is-inside-work-tree",
+            ],
+            { timeoutMs: 10_000 },
+          );
+          // A timeout/spawn error is not proof that the repository is
+          // broken. Preserve the running task and let the caller retry once
+          // Docker can answer, just as the runtime-state probe above does.
+          if (gitHealth.status === null) {
+            return dockerUnavailableResult(
+              `could not verify Git state for task ${input.task.id} ` +
+                `project ${project.id}: ` +
+                (gitHealth.stderr.trim().slice(0, 200) ||
+                  "docker did not answer"),
             );
-            // A timeout/spawn error is not proof that the repository is
-            // broken. Preserve the running task and let the caller retry once
-            // Docker can answer, just as the runtime-state probe above does.
-            if (gitHealth.status === null) {
-              return dockerUnavailableResult(
+          }
+          if (
+            gitHealth.status !== 0 ||
+            gitHealth.stdout.trim() !== "true"
+          ) {
+            if (gitHealth.status !== 0) {
+              const unavailable = await runtimeFailureIfDaemonUnavailable(
                 `could not verify Git state for task ${input.task.id} ` +
                   `project ${project.id}: ` +
                   (gitHealth.stderr.trim().slice(0, 200) ||
-                    "docker did not answer"),
+                    `git exited ${String(gitHealth.status)}`),
               );
+              if (unavailable) return unavailable;
             }
-            if (
-              gitHealth.status !== 0 ||
-              gitHealth.stdout.trim() !== "true"
-            ) {
-              if (gitHealth.status !== 0) {
-                const unavailable = await runtimeFailureIfDaemonUnavailable(
-                  `could not verify Git state for task ${input.task.id} ` +
-                    `project ${project.id}: ` +
-                    (gitHealth.stderr.trim().slice(0, 200) ||
-                      `git exited ${String(gitHealth.status)}`),
-                );
-                if (unavailable) return unavailable;
-              }
-              projectsHealthy = false;
-              console.warn(
-                `[host-agent] task ${input.task.id}: project ${project.id} Git health check failed; rebuilding the running task (${gitHealth.stderr.trim().slice(0, 200) || `git exited ${String(gitHealth.status)}`})`,
-              );
-              break;
-            }
-          }
-          if (reusable && projectsHealthy) {
-            // waitForChannelClose crossed the teardown fence above. A completed
-            // close-only teardown may have left this running task tombstoned,
-            // so the idempotent-success transition must reopen delivery just
-            // like a fresh successful taskUp does.
-            orchestrator.allowChannel(input.task.id);
-            return {
-              ok: true,
-              value: {
-                composeProject: existingTask.composeProject,
-                worktreePath: existingTask.worktreePath,
-                codeServerPort: existingTask.codeServerPort ?? undefined,
-                previewPorts: parsePreviewPortRuntimes(
-                  existingTask.previewPorts,
-                ),
-                envMode: hostTaskEnvMode(existingTask),
-              },
-            };
+            projectsHealthy = false;
+            console.warn(
+              `[host-agent] task ${input.task.id}: project ${project.id} Git health check failed; rebuilding the running task (${gitHealth.stderr.trim().slice(0, 200) || `git exited ${String(gitHealth.status)}`})`,
+            );
+            break;
           }
         }
-        // Docker positively proved the mirrored app is absent/stopped, or the
-        // live container proved one of its project repositories is broken.
-        // Drain and invalidate any stale in-memory channel before taskUp
-        // recreates the same stable compose/container names and repairs Git.
-        if (!channelClosedForRecreate) {
-          suspendTaskGatewayTask(input.task.id);
-          await orchestrator.closeChannel(input.task.id);
+        if (reusable && projectsHealthy) {
+          // waitForChannelClose crossed the teardown fence above. A completed
+          // close-only teardown may have left this running task tombstoned,
+          // so the idempotent-success transition must reopen delivery just
+          // like a fresh successful taskUp does.
+          const cannotPublish = cloudStartCannotPublish(cloud);
+          if (cannotPublish) return cannotPublish.result;
+          orchestrator.allowChannel(input.task.id);
+          return {
+            ok: true,
+            value: {
+              composeProject: existingTask.composeProject,
+              worktreePath: existingTask.worktreePath,
+              codeServerPort: existingTask.codeServerPort ?? undefined,
+              previewPorts: parsePreviewPortRuntimes(
+                existingTask.previewPorts,
+              ),
+              envMode: hostTaskEnvMode(existingTask),
+            },
+          };
         }
       }
-      const priorRuntimeState = existingTask
-        ? runtimeQuarantinedForRecreate
-          ? {
-              statusMirror: "stopped",
-              codeServerPort: null,
-              previewPorts: "[]",
-              lockedAt: null,
-              startedAt: existingTask.startedAt,
-              endedAt: existingTask.endedAt,
-              environmentProvider: existingTask.environmentProvider,
-              environmentLocator: existingTask.environmentLocator,
-              envMode: existingTask.envMode,
-              projectEnvSpec: existingTask.projectEnvSpec,
-            }
-          : {
-              statusMirror: existingTask.statusMirror,
-              lockedAt: existingTask.lockedAt,
-              startedAt: existingTask.startedAt,
-              endedAt: existingTask.endedAt,
-              environmentProvider: existingTask.environmentProvider,
-              environmentLocator: existingTask.environmentLocator,
-              envMode: existingTask.envMode,
-              projectEnvSpec: existingTask.projectEnvSpec,
-            }
-        : {
-            statusMirror: input.task.status,
+      // Docker positively proved the mirrored app is absent/stopped, or the
+      // live container proved one of its project repositories is broken.
+      // Drain and invalidate any stale in-memory channel before taskUp
+      // recreates the same stable compose/container names and repairs Git.
+      if (!channelClosedForRecreate) {
+        suspendTaskGatewayTask(input.task.id);
+        await orchestrator.closeChannel(input.task.id);
+      }
+    }
+    const priorRuntimeState = existingTask
+      ? runtimeQuarantinedForRecreate
+        ? {
+            statusMirror: "stopped",
+            codeServerPort: null,
+            previewPorts: "[]",
             lockedAt: null,
-            startedAt: null,
-            endedAt: null,
-          };
-      // ADR-153 machines: a task with no row has never run on this machine,
-      // so everything it runs comes through its hosts view. Recorded before
-      // the row, and so before the task's first process; a task with a row
-      // (a start driven again, a start after a stop) stands as recorded.
-      if (sidecarMode() && !existingTask) admitFreshTaskView(input.task.id);
+            startedAt: existingTask.startedAt,
+            endedAt: existingTask.endedAt,
+            environmentProvider: existingTask.environmentProvider,
+            environmentLocator: existingTask.environmentLocator,
+            envMode: existingTask.envMode,
+            projectEnvSpec: existingTask.projectEnvSpec,
+            runEpoch: existingTask.runEpoch,
+          }
+        : {
+            statusMirror: existingTask.statusMirror,
+            lockedAt: existingTask.lockedAt,
+            startedAt: existingTask.startedAt,
+            endedAt: existingTask.endedAt,
+            environmentProvider: existingTask.environmentProvider,
+            environmentLocator: existingTask.environmentLocator,
+            envMode: existingTask.envMode,
+            projectEnvSpec: existingTask.projectEnvSpec,
+            runEpoch: existingTask.runEpoch,
+          }
+      : {
+          statusMirror: input.task.status,
+          lockedAt: null,
+          startedAt: null,
+          endedAt: null,
+        };
+    // ADR-153 machines: a task with no row has never run on this machine,
+    // so everything it runs comes through its hosts view. Recorded before
+    // the row, and so before the task's first process; a task with a row
+    // (a start driven again, a start after a stop) stands as recorded.
+    const taskWasKnownBeforeAssignment =
+      runEpochAdmission.kind === "accepted"
+        ? runEpochAdmission.hadTask
+        : existingTask !== null;
+    if (sidecarMode() && !taskWasKnownBeforeAssignment) {
+      admitFreshTaskView(input.task.id);
+    }
+    if (input.task.runEpoch === undefined) {
       recordTaskStarting(input.task.id);
-      // Cross-process managed maintenance and task admission use a two-sided
-      // handshake: update/uninstall writes its durable marker before checking
-      // this DB row; task-up writes `starting` before checking admission again.
-      // Whichever arrives second observes the first, so a runtime cannot be
-      // swapped or removed while an unrecorded task enters Docker side effects.
-      const admittedMaintenanceFailure = managedMaintenanceUnavailable();
-      if (admittedMaintenanceFailure) {
-        if (existingTask) upsertHostTask(input.task.id, priorRuntimeState);
-        else deleteHostTask(input.task.id);
-        if (!runtimeQuarantinedForRecreate) {
-          orchestrator.allowChannel(input.task.id);
-        }
-        return admittedMaintenanceFailure;
+    } else {
+      recordTaskStarting(input.task.id, input.task.runEpoch);
+    }
+    // Cross-process managed maintenance and task admission use a two-sided
+    // handshake: update/uninstall writes its durable marker before checking
+    // this DB row; task-up writes `starting` before checking admission again.
+    // Whichever arrives second observes the first, so a runtime cannot be
+    // swapped or removed while an unrecorded task enters Docker side effects.
+    const admittedMaintenanceFailure = managedMaintenanceUnavailable();
+    if (admittedMaintenanceFailure) {
+      if (existingTask) upsertHostTask(input.task.id, priorRuntimeState);
+      else deleteHostTask(input.task.id);
+      if (!runtimeQuarantinedForRecreate) {
+        orchestrator.allowChannel(input.task.id);
       }
-      recordTaskOwner(
-        input.task.id,
-        input.task.ownerUserId,
-        input.ownerEmail ?? null,
-        input.ownerName ?? null,
-        input.projects.map((p) => p.slug),
-        // ADR-131 D3: persisted so recovery re-provisions the same scope.
-        input.task.engineAccountScope ?? null,
-        // Lead project first (position 0 wins env collisions, as in task-up).
-        [...input.projects]
-          .sort((a, b) => a.position - b.position)
-          .map((p) => p.id),
-      );
-      recordTaskProjectEnvSpec(input.task.id, input);
-      // ADR-048: persist the cloud-issued per-task cli secret (host-private) so the
-      // `uai` CLI's per-agent tokens can be minted now + after a host restart.
-      if (input.task.cliSecret) {
-        storeTaskCliSecret(input.task.id, input.task.cliSecret);
+      return admittedMaintenanceFailure;
+    }
+    recordTaskOwner(
+      input.task.id,
+      input.task.ownerUserId,
+      input.ownerEmail ?? null,
+      input.ownerName ?? null,
+      input.projects.map((p) => p.slug),
+      // ADR-131 D3: persisted so recovery re-provisions the same scope.
+      input.task.engineAccountScope ?? null,
+      // Lead project first (position 0 wins env collisions, as in task-up).
+      [...input.projects]
+        .sort((a, b) => a.position - b.position)
+        .map((p) => p.id),
+    );
+    recordTaskProjectEnvSpec(input.task.id, input);
+    // ADR-048: persist the cloud-issued per-task cli secret (host-private) so the
+    // `uai` CLI's per-agent tokens can be minted now + after a host restart.
+    if (input.task.cliSecret) {
+      storeTaskCliSecret(input.task.id, input.task.cliSecret);
+    }
+    recordHostEvent(input.task.id, "task.created");
+    let environmentLocator: TaskEnvironmentLocator | undefined;
+    // The locator of everything this start may create, recorded before any
+    // of it exists: once set, the row must keep it.
+    let runtimePrepared = false;
+    const recordPrepared = async (locator: TaskEnvironmentLocator): Promise<void> => {
+      recordTaskEnvironmentPrepared(input.task.id, locator, "loader");
+      runtimePrepared = true;
+    };
+    let registeredTaskGatewayGeneration: string | null = null;
+    let result: TaskUpOutcome = await wrapAgent(ctx, "taskUp", async () => {
+      // Self-heal the standard base image before task-up needs it. The
+      // boot-time build is best-effort + one-shot: a host that started before
+      // Docker was ready (common on Docker Desktop) never built
+      // uai-standard:dev, so every task-up died on a doomed registry pull
+      // (live 2026-07-22). This is idempotent — a fast inspect when present,
+      // a real build only when missing/stale (Docker is definitely up now, a
+      // task just arrived). On a build FAILURE, surface WHY to the cloud (not
+      // just the host log — the operator can't read a remote user's machine).
+      // A pass that succeeded within the hour is reused (2026-09-09: the
+      // re-check cost 16 s of every task start); the hourly schedule in
+      // main.ts and the boot pass keep it fresh.
+      const img = await ensureStandardImage({ maxAgeMs: 60 * 60_000 });
+      if (!img.ok) {
+        throw new AgentError(
+          "STANDARD_IMAGE_UNAVAILABLE",
+          img.error
+            ? `could not prepare the host base image uai-standard:dev — the build failed. ${toolStderrDetail(img.error)}`
+            : "could not prepare the host base image uai-standard:dev — see the host log.",
+          {},
+        );
       }
-      recordHostEvent(input.task.id, "task.created");
-      let environmentLocator: TaskEnvironmentLocator | undefined;
-      let registeredTaskGatewayGeneration: string | null = null;
-      const result = await wrapAgent(ctx, "taskUp", async () => {
-        // Self-heal the standard base image before task-up needs it. The
-        // boot-time build is best-effort + one-shot: a host that started before
-        // Docker was ready (common on Docker Desktop) never built
-        // uai-standard:dev, so every task-up died on a doomed registry pull
-        // (live 2026-07-22). This is idempotent — a fast inspect when present,
-        // a real build only when missing/stale (Docker is definitely up now, a
-        // task just arrived). On a build FAILURE, surface WHY to the cloud (not
-        // just the host log — the operator can't read a remote user's machine).
-        // A pass that succeeded within the hour is reused (2026-09-09: the
-        // re-check cost 16 s of every task start); the hourly schedule in
-        // main.ts and the boot pass keep it fresh.
-        const img = await ensureStandardImage({ maxAgeMs: 60 * 60_000 });
-        if (!img.ok) {
-          throw new AgentError(
-            "STANDARD_IMAGE_UNAVAILABLE",
-            img.error
-              ? `could not prepare the host base image uai-standard:dev — the build failed. ${toolStderrDetail(img.error)}`
-              : "could not prepare the host base image uai-standard:dev — see the host log.",
-            {},
-          );
-        }
-        let gitCredential: TaskGithubGitCredential | null;
-        try {
-          gitCredential = input.projects.some((project) =>
-            isGithubRepo(project.repoUrl),
-          )
-            ? await prepareTaskGithubGitCredential(input.task.ownerUserId)
-            : null;
-        } catch {
-          throw new AgentError(
-            "GITHUB_AUTH_UNAVAILABLE",
-            "GitHub is connected on this host, but Uai could not prepare its credential for Git. Retry the task; if it persists, reconnect GitHub on this host.",
+      let gitCredential: TaskGithubGitCredential | null;
+      try {
+        // ADR-154: a start on cloud credentials clones with its lease's,
+        // never the runner's own store.
+        gitCredential = cloud === null && input.projects.some((project) =>
+          isGithubRepo(project.repoUrl),
+        )
+          ? await prepareTaskGithubGitCredential(input.task.ownerUserId)
+          : null;
+      } catch {
+        throw new AgentError(
+          "GITHUB_AUTH_UNAVAILABLE",
+          "GitHub is connected on this host, but Uai could not prepare its credential for Git. Retry the task; if it persists, reconnect GitHub on this host.",
+        );
+      }
+      if (sidecarMode() && cloud === null) {
+        // ADR-133: project env lives under /uai/projects/<id>, readable by
+        // the lease only for parameters tagged with this org, and only the
+        // task's own projects are worth listing — their ids are known here,
+        // not at the first grant (docs/credential-store.md).
+        const { reconcileProjectEnvFromStore } = await import("../lib/user-credentials-store");
+        const projectIds = input.projects.map((project) => project.id);
+        const env = await reconcileProjectEnvFromStore({ projectIds }).catch((error: unknown) => {
+          console.warn(
+            `[project-env] task ${input.task.id}: credential store read failed: ${error instanceof Error ? error.message : String(error)}`,
           );
-        }
-        if (sidecarMode()) {
-          // ADR-133: project env lives under /uai/projects/<id>, readable by
-          // the lease only for parameters tagged with this org, and only the
-          // task's own projects are worth listing — their ids are known here,
-          // not at the first grant (docs/credential-store.md).
-          const { reconcileProjectEnvFromStore } = await import("../lib/user-credentials-store");
-          const projectIds = input.projects.map((project) => project.id);
-          const env = await reconcileProjectEnvFromStore({ projectIds }).catch((error: unknown) => {
-            console.warn(
-              `[project-env] task ${input.task.id}: credential store read failed: ${error instanceof Error ? error.message : String(error)}`,
-            );
-            return null;
-          });
-          if (env && !env.skipped) {
-            console.log(
-              `[project-env] task ${input.task.id}: credential store reconciled for ${projectIds.length} project(s): ${env.imported} imported, ${env.removed} removed, ${env.errors} errors`,
-            );
-          }
-        }
-        // Mint the authenticated task generation before its environment
-        // starts. The declarations are pinned; values remain live DB reads.
-        const gatewayRegistration = registerTaskGatewayTask(input.task.id, {
-          resolveEnv: taskEnvResolver(input.task.id, incomingEnvSpec),
+          return null;
         });
-        registeredTaskGatewayGeneration = gatewayRegistration.generation;
-        const gatewaySecret = taskGatewayForwarderSecretInput(
-          input.task.id,
-          gatewayRegistration.generation,
-        );
-        if (gatewaySecret === null) {
-          removeTaskGatewayTask(
-            input.task.id,
-            gatewayRegistration.generation,
+        if (env && !env.skipped) {
+          console.log(
+            `[project-env] task ${input.task.id}: credential store reconciled for ${projectIds.length} project(s): ${env.imported} imported, ${env.removed} removed, ${env.errors} errors`,
           );
-          registeredTaskGatewayGeneration = null;
-          throw new Error("could not export the task gateway generation secret");
         }
-        // Launch screen: the first stage boundary. A machine-backed task
-        // spends the next minute launching an EC2 instance; a container
-        // task goes straight to preparing its workspace.
-        orchestrator.emitTaskStage(
+      }
+      // Mint the authenticated task generation before its environment
+      // starts. The declarations are pinned; values remain live DB reads.
+      const gatewayRegistration = registerTaskGatewayTask(input.task.id, {
+        resolveEnv: taskEnvResolver(input.task.id, incomingEnvSpec, input.task.runEpoch ?? null),
+        runEpoch: input.task.runEpoch ?? null,
+      });
+      registeredTaskGatewayGeneration = gatewayRegistration.generation;
+      const gatewaySecret = taskGatewayForwarderSecretInput(
+        input.task.id,
+        gatewayRegistration.generation,
+      );
+      if (gatewaySecret === null) {
+        removeTaskGatewayTask(
           input.task.id,
-          machineTasksEnabled() ? "machine" : "workspace",
+          gatewayRegistration.generation,
         );
-        try {
-          const taskGateway = {
-            generation: gatewayRegistration.generation,
-            secret: gatewaySecret,
-          };
-          const provisioned = gitCredential
-            ? await gitCredential.run(() =>
-                provisionTaskEnvironment(
-                  input,
-                  {
-                    githubCredentialSocket: gitCredential.socketPath,
-                    taskGateway,
-                  },
-                  async (locator) => {
-                    recordTaskEnvironmentPrepared(
-                      input.task.id,
-                      locator,
-                      "loader",
-                    );
-                  },
-                ),
-              )
-            : await provisionTaskEnvironment(
+        registeredTaskGatewayGeneration = null;
+        throw new Error("could not export the task gateway generation secret");
+      }
+      // Launch screen: the first stage boundary. A machine-backed task
+      // spends the next minute launching an EC2 instance; a container
+      // task goes straight to preparing its workspace.
+      orchestrator.emitTaskStage(
+        input.task.id,
+        machineTasksEnabled() ? "machine" : "workspace",
+      );
+      try {
+        const taskGateway = {
+          generation: gatewayRegistration.generation,
+          secret: gatewaySecret,
+        };
+        const provisioned = gitCredential
+          ? await gitCredential.run(() =>
+              provisionTaskEnvironment(
                 input,
-                { taskGateway },
-                async (locator) => {
-                  recordTaskEnvironmentPrepared(
-                    input.task.id,
-                    locator,
-                    "loader",
-                  );
+                {
+                  githubCredentialSocket: gitCredential.socketPath,
+                  taskGateway,
                 },
-              );
-          environmentLocator = provisioned.handle.descriptor.locator;
-          // ADR-153 §4: the task's own schema observations, read from the
-          // bases task-up recorded before its container started (a machine
-          // captures its own). Stored once; a resume reuses them.
-          const envSchemas = isEnvironmentTransportProvider(getHostTask(input.task.id)?.environmentProvider)
-            ? undefined
-            : captureTaskEnvSchemas(
-                input.task.id,
-                incomingEnvSpec.projects.map((project) => project.projectId),
-              );
-          // ADR-153: before any consumer is let in, bring the task to now:
-          // a CA successor minted while it started, and the domains its
-          // policy has now rather than those task-up was handed. A failure
-          // leaves those keys withheld, and the trust watcher retries.
-          const secretsProxy = activeSecretsProxy();
-          if (secretsProxy !== null) {
-            await reconcileTaskProxyState(provisioned.handle, secretsProxy.runtime).catch((error: unknown) => {
-              console.warn(
-                `[secrets-proxy] task ${input.task.id}: could not bring the task's trust and pins up to date: ${
-                  error instanceof Error ? error.message : String(error)
-                }`,
-              );
-              secretsProxy.runtime.requestTrustDelivery();
-            });
-          }
-          return envSchemas === undefined || envSchemas.length === 0
-            ? { ...provisioned.result, envMode: "loader" as const }
-            : { ...provisioned.result, envMode: "loader" as const, envSchemas };
-        } finally {
-          gatewaySecret.fill(0);
-          await gitCredential?.close().catch((error: unknown) => {
-            // Cleanup must not replace the actual task-up result/error. The
-            // credential is short-lived and close() also removes its private
-            // directory in a finally block; retain diagnostics for operators.
+                recordPrepared,
+              ),
+            )
+          : await provisionTaskEnvironment(
+              input,
+              {
+                taskGateway,
+                ...(cloud?.start && cloud.hold ? { leased: leasedTaskUp(cloud.start, cloud.hold) } : {}),
+              },
+              recordPrepared,
+            );
+        environmentLocator = provisioned.handle.descriptor.locator;
+        // ADR-153 §4: the task's own schema observations, read from the
+        // bases task-up recorded before its container started (a machine
+        // captures its own). Stored once; a resume reuses them.
+        const envSchemas = isEnvironmentTransportProvider(getHostTask(input.task.id)?.environmentProvider)
+          ? undefined
+          : captureTaskEnvSchemas(
+              input.task.id,
+              incomingEnvSpec.projects.map((project) => project.projectId),
+            );
+        // ADR-153: before any consumer is let in, bring the task to now:
+        // a CA successor minted while it started, and the domains its
+        // policy has now rather than those task-up was handed. A failure
+        // leaves those keys withheld, and the trust watcher retries.
+        const secretsProxy = activeSecretsProxy();
+        if (secretsProxy !== null) {
+          await reconcileTaskProxyState(provisioned.handle, secretsProxy.runtime).catch((error: unknown) => {
             console.warn(
-              `[github] task ${input.task.id}: credential cleanup failed: ${error instanceof Error ? error.message : String(error)}`,
+              `[secrets-proxy] task ${input.task.id}: could not bring the task's trust and pins up to date: ${
+                error instanceof Error ? error.message : String(error)
+              }`,
             );
+            secretsProxy.runtime.requestTrustDelivery();
           });
         }
-      });
-      if (!result.ok && registeredTaskGatewayGeneration !== null) {
-        forgetTaskEnvSnapshot(input.task.id);
-        try {
-          removeTaskGatewayTask(
-            input.task.id,
-            registeredTaskGatewayGeneration,
-          );
-        } catch (error) {
-          // The in-process authority is revoked before durable deletion is
-          // attempted. Preserve the task-up error while retaining a cleanup
-          // diagnostic; a leftover file loads inactive after restart.
+        return envSchemas === undefined || envSchemas.length === 0
+          ? { ...provisioned.result, envMode: "loader" as const }
+          : { ...provisioned.result, envMode: "loader" as const, envSchemas };
+      } finally {
+        gatewaySecret.fill(0);
+        await gitCredential?.close().catch((error: unknown) => {
+          // Cleanup must not replace the actual task-up result/error. The
+          // credential is short-lived and close() also removes its private
+          // directory in a finally block; retain diagnostics for operators.
           console.warn(
-            `[task-gateway] task ${input.task.id}: failed to remove the rejected generation: ${
-              error instanceof Error ? error.message : String(error)
-            }`,
+            `[github] task ${input.task.id}: credential cleanup failed: ${error instanceof Error ? error.message : String(error)}`,
           );
-        }
+        });
       }
-      if (result.ok) {
-        orchestrator.allowChannel(input.task.id);
-        if (environmentLocator === undefined) {
-          throw new Error("task environment provision returned no locator");
-        }
-        recordTaskUpResult(
+    });
+    // ADR-154: the last word before the start publishes its outcome. A
+    // success needs the start still the task's current one, its credentials
+    // open for its run; an interrupted start reports its interruption, never
+    // what it failed of. Nothing it made is destroyed here: a teardown would
+    // delete a resumed task's workspace, and whoever took over acts on the
+    // runtime itself.
+    const interrupted = interruptedStartResult(cloud);
+    const replaced = result.ok
+      ? cloudStartCannotPublish(cloud)
+      : interrupted
+        ? { result: interrupted, interrupted: true }
+        : null;
+    if (replaced) result = replaced.result;
+    if (!result.ok && registeredTaskGatewayGeneration !== null) {
+      forgetTaskEnvSnapshot(input.task.id);
+      try {
+        removeTaskGatewayTask(
           input.task.id,
-          result.value,
-          environmentLocator,
-          "loader",
+          registeredTaskGatewayGeneration,
         );
-        recordHostEvent(input.task.id, "task.started");
-        // ADR-153: with the proxy off, every start says so, since the task's
-        // proxied keys are withheld rather than delivered.
-        if (activeSecretsProxy() === null) {
-          orchestrator.emitSystemNote(
-            input.task.id,
-            secretsProxyEnabled()
-              ? "The secrets proxy could not start on this host, so this task's proxied env vars are withheld. See the host log."
-              : "The secrets proxy is off on this host (UAI_SECRETS_PROXY=off), so this task's proxied env vars are withheld.",
-          );
-        }
-        // ADR-153 §4: one note naming the keys this task does not get, and
-        // why, so nobody hunts for a value Uai withholds on purpose.
-        try {
-          const withheld = taskEnvWithheldNoteNow(input.task.id, incomingEnvSpec);
-          if (withheld !== null) orchestrator.emitSystemNote(input.task.id, withheld);
-        } catch (error) {
+      } catch (error) {
+        // The in-process authority is revoked before durable deletion is
+        // attempted. Preserve the task-up error while retaining a cleanup
+        // diagnostic; a leftover file loads inactive after restart.
+        console.warn(
+          `[task-gateway] task ${input.task.id}: failed to remove the rejected generation: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+      }
+    }
+    if (result.ok) {
+      orchestrator.allowChannel(input.task.id);
+      if (environmentLocator === undefined) {
+        throw new Error("task environment provision returned no locator");
+      }
+      recordTaskUpResult(
+        input.task.id,
+        result.value,
+        environmentLocator,
+        "loader",
+      );
+      if (input.task.runEpoch !== undefined) {
+        recordTaskRuntimeEstablished(
+          input.task.id,
+          input.task.runEpoch,
+        );
+      }
+      recordHostEvent(input.task.id, "task.started");
+      // ADR-153: with the proxy off, every start says so, since the task's
+      // proxied keys are withheld rather than delivered.
+      if (activeSecretsProxy() === null) {
+        orchestrator.emitSystemNote(
+          input.task.id,
+          secretsProxyEnabled()
+            ? "The secrets proxy could not start on this host, so this task's proxied env vars are withheld. See the host log."
+            : "The secrets proxy is off on this host (UAI_SECRETS_PROXY=off), so this task's proxied env vars are withheld.",
+        );
+      }
+      // ADR-153 §4: one note naming the keys this task does not get, and
+      // why, so nobody hunts for a value Uai withholds on purpose.
+      try {
+        const withheld = taskEnvWithheldNoteNow(input.task.id, incomingEnvSpec, input.task.runEpoch ?? null);
+        if (withheld !== null) orchestrator.emitSystemNote(input.task.id, withheld);
+      } catch (error) {
+        console.warn(
+          `[project-env] task ${input.task.id}: withheld-keys note failed: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+      }
+      // Degraded start (uai-init failed twice): the task is up, but say so
+      // in the feed — a silent half-start reads as a broken product.
+      if (result.value.initWarning) {
+        orchestrator.emitSystemNote(
+          input.task.id,
+          result.value.initWarning,
+        );
+      }
+      // ADR-122 phase 1: a project that declares @required env keys with
+      // no value on this host gets ONE visible note now — not a blank 500
+      // hours later (live 2026-08-25). Best-effort by design: a schema
+      // read hiccup must never fail a completed task-up.
+      void noteMissingRequiredEnvKeys(input).catch((err) =>
+        console.warn(
+          `[env-schema] task ${input.task.id}: validation note failed: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        ),
+      );
+      // GitHub auth for the container is best-effort (ADR-027) and runs in the
+      // background — it must never block or fail task-up. Awaiting it here would
+      // couple the command result to a network token-exchange: a slow/hung
+      // exchange (e.g. cloud mid-deploy) would trip the cloud's command timeout
+      // and mark a running task as errored. The reconciler injects + schedules
+      // (or emits a system note on failure) on its own; the agents come up
+      // regardless and the token lands well before the first `gh` call.
+      // ADR-121: machine-backed tasks take a direct environment injection —
+      // the compose reconciler would probe for an app container, find none,
+      // and silently skip. Reconnect re-injection for machines is a
+      // follow-up alongside the machine recovery pass.
+      if (cloud !== null) {
+        // ADR-154: the runtime-ready writes put the lease's GitHub sign-in
+        // and SSH key in; the runner's own store has nothing to add.
+      } else if (isEnvironmentTransportProvider(getHostTask(input.task.id)?.environmentProvider)) {
+        void machineTaskGithubAuth(
+          input.task.id,
+          input.task.ownerUserId,
+        ).catch((err) =>
           console.warn(
-            `[project-env] task ${input.task.id}: withheld-keys note failed: ${
-              error instanceof Error ? error.message : String(error)
+            `[github] machine task ${input.task.id}: auth injection failed: ${
+              err instanceof Error ? err.message : String(err)
             }`,
-          );
-        }
-        // Degraded start (uai-init failed twice): the task is up, but say so
-        // in the feed — a silent half-start reads as a broken product.
-        if (result.value.initWarning) {
-          orchestrator.emitSystemNote(
-            input.task.id,
-            result.value.initWarning,
-          );
-        }
-        // ADR-122 phase 1: a project that declares @required env keys with
-        // no value on this host gets ONE visible note now — not a blank 500
-        // hours later (live 2026-08-25). Best-effort by design: a schema
-        // read hiccup must never fail a completed task-up.
-        void noteMissingRequiredEnvKeys(input).catch((err) =>
+          ),
+        );
+      } else {
+        void reconcileTaskGitAuth(
+          input.task.id,
+          input.task.ownerUserId,
+        ).catch((err) =>
           console.warn(
-            `[env-schema] task ${input.task.id}: validation note failed: ${
+            `[github] task ${input.task.id}: post-start reconciliation failed: ${
               err instanceof Error ? err.message : String(err)
             }`,
           ),
         );
-        // GitHub auth for the container is best-effort (ADR-027) and runs in the
-        // background — it must never block or fail task-up. Awaiting it here would
-        // couple the command result to a network token-exchange: a slow/hung
-        // exchange (e.g. cloud mid-deploy) would trip the cloud's command timeout
-        // and mark a running task as errored. The reconciler injects + schedules
-        // (or emits a system note on failure) on its own; the agents come up
-        // regardless and the token lands well before the first `gh` call.
-        // ADR-121: machine-backed tasks take a direct environment injection —
-        // the compose reconciler would probe for an app container, find none,
-        // and silently skip. Reconnect re-injection for machines is a
-        // follow-up alongside the machine recovery pass.
-        if (isEnvironmentTransportProvider(getHostTask(input.task.id)?.environmentProvider)) {
-          void machineTaskGithubAuth(
-            input.task.id,
-            input.task.ownerUserId,
-          ).catch((err) =>
-            console.warn(
-              `[github] machine task ${input.task.id}: auth injection failed: ${
-                err instanceof Error ? err.message : String(err)
-              }`,
-            ),
-          );
-        } else {
-          void reconcileTaskGitAuth(
-            input.task.id,
-            input.task.ownerUserId,
-          ).catch((err) =>
-            console.warn(
-              `[github] task ${input.task.id}: post-start reconciliation failed: ${
-                err instanceof Error ? err.message : String(err)
-              }`,
-            ),
-          );
-        }
-      } else if (result.code === HostErrorCode.HostUnavailable) {
-        // A daemon outage is retryable infrastructure state, not proof that
-        // the task itself failed. Undo the optimistic local `starting` mirror
-        // and normally reopen delivery; a runtime already proven stopped for
-        // L5 recreation stays stopped/tombstoned for the cloud's retry.
-        if (existingTask) upsertHostTask(input.task.id, priorRuntimeState);
-        else deleteHostTask(input.task.id);
-        if (!runtimeQuarantinedForRecreate) {
-          orchestrator.allowChannel(input.task.id);
-        }
-      } else {
-        recordTaskError(input.task.id);
       }
-      return result;
-    });
+    } else if (replaced?.interrupted) {
+      // ADR-154: Stop, teardown, a newer run or shutdown took over, and the
+      // channel stays closed for it. A start that recorded its runtime's
+      // locator (before any of that runtime existed) keeps it exactly, so
+      // whoever took over stops, destroys or starts again that runtime and
+      // nothing that may exist is forgotten; its credentials are cleaned up
+      // while it still runs. A start that recorded none made nothing, and
+      // leaves no trace.
+      if (runtimePrepared) recordTaskError(input.task.id);
+      else if (existingTask) upsertHostTask(input.task.id, priorRuntimeState);
+      else deleteHostTask(input.task.id);
+    } else if (result.code === HostErrorCode.HostUnavailable) {
+      // A daemon outage is retryable infrastructure state, not proof that
+      // the task itself failed. Undo the optimistic local `starting` mirror
+      // and normally reopen delivery; a runtime already proven stopped for
+      // L5 recreation stays stopped/tombstoned for the cloud's retry.
+      if (existingTask) upsertHostTask(input.task.id, priorRuntimeState);
+      else deleteHostTask(input.task.id);
+      if (!runtimeQuarantinedForRecreate) {
+        orchestrator.allowChannel(input.task.id);
+      }
+    } else {
+      recordTaskError(input.task.id);
+    }
+    return result;
+  }));
+}
+
+export const hostCommands: HostCommands = {
+  // The hostId argument is cloud-side routing (host-scoped commands carry
+  // their target in args, like filesOp); this process IS the target.
+  async hostUpdate(ctx, _hostId) {
+    logCommand(ctx, "hostUpdate");
+    const pinned = sidecarRunnerIsPinned();
+    if (pinned) return pinned;
+    try {
+      const { updateManagedRuntime } = await import("../lib/managed-runtime");
+      const outcome = await updateManagedRuntime();
+      if (outcome.status === "not-managed") {
+        return {
+          ok: false,
+          code: HostErrorCode.Internal,
+          message:
+            "this host is not a managed install — update it where it runs",
+          retryable: false,
+        };
+      }
+      if (outcome.status === "deferred") {
+        // A rollback hold is an operator verdict that the newer release is
+        // unsafe on this host; a remote click must not override it.
+        return {
+          ok: true,
+          value: { version: outcome.version, staged: false, deferred: true },
+        };
+      }
+      if (outcome.status === "current") {
+        return { ok: true, value: { version: outcome.version, staged: false } };
+      }
+      managedHostRestartHook?.();
+      return { ok: true, value: { version: outcome.version, staged: true } };
+    } catch (error) {
+      return {
+        ok: false,
+        code: HostErrorCode.Internal,
+        message: `update failed: ${
+          error instanceof Error ? error.message : "unknown error"
+        }`,
+        retryable: true,
+      };
+    }
+  },
+  async hostRestart(ctx, _hostId) {
+    logCommand(ctx, "hostRestart");
+    const pinned = sidecarRunnerIsPinned();
+    if (pinned) return pinned;
+    if (!managedHostRestartHook) {
+      return {
+        ok: false,
+        code: HostErrorCode.Internal,
+        message: "restart is unavailable in this process",
+        retryable: false,
+      };
+    }
+    // The result frame flushes before exit: shutdown drains in-flight
+    // commands (this one included) before the process terminates.
+    managedHostRestartHook();
+    return { ok: true, value: undefined };
+  },
+  async taskUp(ctx, input) {
+    logCommand(ctx, "taskUp", input.task.id);
+    // ADR-154: on cloud credentials every start goes through the composer,
+    // and none starts while the runner's activation is pending.
+    const mode = credentialsMode();
+    if (mode === "pending") return switchingToCloudCredentials();
+    // On the runner's own credentials, a counted permit from here to the
+    // outcome: leaving them waits for it.
+    let legacy: LegacyStartPermit | null = null;
+    if (mode === "legacy") {
+      legacy = admitLegacyStart();
+      if (legacy === null) return switchingToCloudCredentials();
+    }
+    let cloud: CloudCredentialTaskStart | null = null;
+    if (mode === "active") {
+      const runtime = cloudCredentialRuntime();
+      if (runtime === null || input.task.runEpoch === undefined) {
+        return {
+          ok: false,
+          code: HostErrorCode.Internal,
+          message: "This host runs tasks only on cloud credentials, and could not start this one on them.",
+          retryable: false,
+        };
+      }
+      cloud = { runtime, assignment: { taskId: input.task.id, runEpoch: input.task.runEpoch }, start: null, hold: null };
+      // A newer run's start ends an older one's before it queues behind it.
+      runtime.interruptStarts(input.task.id, { below: input.task.runEpoch });
+    }
+    let outcome: TaskUpOutcome | undefined;
+    try {
+      outcome = await taskUpOn(ctx, input, cloud, legacy);
+      return outcome;
+    } finally {
+      legacy?.release();
+      // Its hold already let go with the long slot: the cleanup an abandon
+      // runs never waits on it.
+      if (cloud?.start) {
+        if (outcome?.ok === true) cloud.runtime.endStart(cloud.start);
+        else await cloud.runtime.abandonStart(cloud.start, cloud.hold);
+      }
+    }
   },
 
   async taskDown(ctx, input) {
     logCommand(ctx, "taskDown", input.taskId);
     const orphanGc = input.cleanup?.kind === "orphan-gc";
+    // ADR-154: teardown ends its run's start (orphan GC: every start of the
+    // task) before it queues behind it.
+    const interrupting = activeCloudCredentials();
+    if (interrupting) {
+      if (orphanGc) interrupting.interruptStarts(input.taskId);
+      else if (input.task.runEpoch !== undefined) interrupting.interruptStarts(input.taskId, { exact: input.task.runEpoch });
+    }
     // A GC command is already authoritative evidence that this cloud task is
     // gone. Enter the lifecycle slot and tombstone its channel even when the
     // runtime is temporarily unavailable; the durable cloud intent will retry
@@ -1237,6 +1661,40 @@ export const hostCommands: HostCommands = {
       } else {
         environment = null;
       }
+      // Close the exact v1 assignment before any terminal side effect. A
+      // delayed teardown for an older run must never tombstone or destroy the
+      // newer run. Orphan GC is authoritative for the task id and therefore
+      // closes whichever assignment still survives locally.
+      let v1AssignmentClosed = false;
+      let closedRunEpoch: number | null = null;
+      const assignmentState = readTaskRunEpochState(input.taskId);
+      if (assignmentState !== null || input.task.runEpoch !== undefined) {
+        const requestedRunEpoch = orphanGc
+          ? assignmentState?.highestRunEpoch
+          : input.task.runEpoch;
+        if (assignmentState === null || requestedRunEpoch === undefined) {
+          return {
+            ok: false,
+            code: HostErrorCode.TaskAlreadyRunning,
+            message:
+              `task ${input.taskId} teardown does not name its current run`,
+          };
+        }
+        const closed = closeTaskRunAssignment(
+          input.taskId,
+          requestedRunEpoch,
+        );
+        if (closed.kind === "missing" || closed.kind === "mismatch") {
+          return {
+            ok: false,
+            code: HostErrorCode.TaskAlreadyRunning,
+            message:
+              `task ${input.taskId} run ${String(requestedRunEpoch)} is no longer current`,
+          };
+        }
+        v1AssignmentClosed = true;
+        closedRunEpoch = requestedRunEpoch;
+      }
       // Tombstone + close before container destruction. A concurrent cloud
       // ensure cannot reopen the channel while teardown is awaiting Docker.
       const suspendedTaskGateway = suspendTaskGatewayTask(input.taskId);
@@ -1269,6 +1727,17 @@ export const hostCommands: HostCommands = {
           }`,
         );
       }
+      // ADR-154 §6: the closed run's credentials cleaned up, every path
+      // proven gone (or the runtime destroyed), before the runtime goes; by
+      // the composer as it is now, in the slot.
+      const credentials = activeCloudCredentials();
+      if (credentials && closedRunEpoch !== null) {
+        try {
+          await credentials.closeAssignment({ taskId: input.taskId, runEpoch: closedRunEpoch }, "teardown");
+        } catch (error) {
+          return failFromUnknown(error);
+        }
+      }
       const result = await wrapAgent(ctx, "taskDown", async () => {
         if (environment === null) return agent.taskDown(input);
         // taskDown is TERMINAL — its only cloud callers are task close and
@@ -1341,7 +1810,7 @@ export const hostCommands: HostCommands = {
       } else {
         // Destruction failed; let a subsequent ensure restore the still-running
         // task instead of leaving it permanently tombstoned.
-        if (!orphanGc) {
+        if (!orphanGc && !v1AssignmentClosed) {
           if (suspendedTaskGateway) {
             reactivateTaskGatewayTask(suspendedTaskGateway);
           }
@@ -1354,22 +1823,55 @@ export const hostCommands: HostCommands = {
 
   async taskStop(ctx, taskId, input) {
     logCommand(ctx, "taskStop", taskId, input.reason);
-    // ADR-125: idle stops are the cloud's judgment from what it can see;
-    // only the host can see a turn that is mid-flight RIGHT NOW. Manual
-    // pause carries no veto — a human's explicit gesture wins.
-    if (input.reason === "idle") {
-      const activeAt = getOrchestrator().lastChannelActivity(taskId);
-      if (activeAt !== null && Date.now() - activeAt < IDLE_STOP_VETO_MS) {
-        return { ok: true, value: { vetoed: "active" as const } };
-      }
+    const orchestrator = getOrchestrator();
+    // ADR-154: a manual Stop ends its run's start before it queues behind
+    // it; an idle Stop never does, since a start vetoes it in the slot.
+    const interrupting = activeCloudCredentials();
+    if (interrupting && input.reason !== "idle" && input.runEpoch !== undefined) {
+      interrupting.interruptStarts(taskId, { exact: input.runEpoch });
+    }
+    const result = await orchestrator.stopTask(taskId, {
+      // ADR-154: the run Stop closes, cleaned up by the composer as it is
+      // when Stop gets there, in the slot.
+      closeCredentials: (runEpoch: number) =>
+        activeCloudCredentials()?.closeAssignment({ taskId, runEpoch }, "stop") ?? Promise.resolve(),
+      // Resolve legacy versus v1 only after Stop owns the task lifecycle slot.
+      // Otherwise task-up can admit v1 between an outside read and the stop.
+      admitAssignment: () => {
+        if (input.runEpoch === undefined) {
+          return readTaskRunEpochState(taskId) === null
+            ? { kind: "legacy" }
+            : { kind: "stale" };
+        }
+        const closed = closeTaskRunAssignmentForStop(taskId, input.runEpoch);
+        return closed.kind === "closed" || closed.kind === "already_closed"
+          ? { kind: "closed", runEpoch: input.runEpoch }
+          : { kind: "stale" };
+      },
+      // ADR-125: idle stops are the cloud's judgment from what it can see;
+      // only the host can see a turn that is mid-flight RIGHT NOW. Evaluate
+      // immediately before assignment closure. Manual pause has no veto.
+      shouldVeto:
+        input.reason === "idle"
+          ? () => {
+              const activeAt = orchestrator.lastChannelActivity(taskId);
+              return (
+                activeAt !== null && Date.now() - activeAt < IDLE_STOP_VETO_MS
+              );
+            }
+          : undefined,
+    });
+    if (result.ok && result.vetoed) {
+      return { ok: true, value: { vetoed: "active" as const } };
     }
-    const result = await getOrchestrator().stopTask(taskId);
     if (!result.ok) {
       return {
         ok: false,
-        code: HostErrorCode.Internal,
+        code: result.assignmentStale
+          ? HostErrorCode.TaskAlreadyRunning
+          : HostErrorCode.Internal,
         message: result.error ?? "stop failed",
-        retryable: true,
+        ...(result.assignmentStale ? {} : { retryable: true }),
       };
     }
     return { ok: true, value: {} };
@@ -1635,15 +2137,19 @@ export const hostCommands: HostCommands = {
     if (runtimeFailure) return runtimeFailure;
     try {
       const task = getHostTask(input.taskId);
-      // A stopped/terminal task retains its host worktree, so preserve the
-      // historical host-side fallback there. A running task must reconstruct
-      // its exact persisted provider identity: malformed/foreign metadata is
-      // not permission to run Git against a different filesystem view.
-      const environment =
-        task?.statusMirror === "running"
-          ? await reconstructPersistedTaskEnvironment(task)
-          : null;
-      if (task?.statusMirror === "running" && environment === null) {
+      // #cb3j0z: Git never runs on the host against a task's repositories;
+      // what a task configured there would run as the runner's user. A
+      // running task must reconstruct its exact persisted provider identity
+      // (malformed/foreign metadata is not permission to run Git against a
+      // different filesystem view) and diffs there; a stopped one diffs in
+      // a throwaway sandbox of its retained worktree.
+      if (task?.statusMirror !== "running") {
+        return ok(
+          await stoppedTaskDiff(input, task ? { environmentProvider: task.environmentProvider ?? null } : null),
+        );
+      }
+      const environment = await reconstructPersistedTaskEnvironment(task);
+      if (environment === null) {
         throw new Error(
           `running task ${input.taskId} has no persisted task environment`,
         );
@@ -1671,7 +2177,7 @@ export const hostCommands: HostCommands = {
         );
         return ok(undefined);
       }
-      writeAttachment(
+      await writeAttachment(
         input.taskId,
         input.filename,
         Buffer.from(input.dataBase64, "base64"),
@@ -1690,7 +2196,7 @@ export const hostCommands: HostCommands = {
         ? await environment.readWorkspaceFile(
             attachmentEnvironmentPath(environment, input.filename),
           )
-        : readAttachment(input.taskId, input.filename);
+        : await readAttachment(input.taskId, input.filename);
       if (!bytes) {
         return {
           ok: false,
@@ -1780,22 +2286,27 @@ function normalizeChannelSpec(input: ChannelEnsureInput): ChannelEnsureInput {
  * `setup-git` gesture as containers, no compose probing). Best-effort like
  * the compose reconciler: absence of a GitHub connection is a quiet no-op.
  */
+/** ADR-154: only while the runner is on its own credentials. Leaving them
+ *  waits for one under way, and the write is fenced on them: none starts
+ *  once leaving has begun. */
 async function machineTaskGithubAuth(
   taskId: string,
   userId: string,
 ): Promise<void> {
-  const environment = await reconstructHostTaskEnvironment(taskId);
-  if (!environment) return;
-  const token = await requestAccessToken(userId);
-  if (!token) return;
-  // Machine work is not container work: no docker/apple runtime admission.
-  await injectIntoContainer(
-    taskId,
-    token.accessToken,
-    undefined,
-    () => {},
-    environment,
-  );
+  await whileOnOwnCredentials(async () => {
+    const environment = await reconstructHostTaskEnvironment(taskId);
+    if (!environment) return;
+    const token = await requestAccessToken(userId);
+    if (!token || !onOwnCredentials()) return;
+    // Machine work is not container work: no docker/apple runtime admission.
+    await injectIntoContainer(
+      taskId,
+      token.accessToken,
+      undefined,
+      () => {},
+      environment,
+    );
+  });
 }
 
 async function reconstructHostTaskEnvironment(