@the-open-engine/zeroshot 6.25.0 → 6.26.0

package/task-lib/commands/clean.js

@@ -1,6 +1,6 @@
 import { unlinkSync, existsSync } from 'fs';
 import chalk from 'chalk';
-import { loadTasks, saveTasks } from '../store.js';
+import { clearTaskCommandCleanup, loadTasks, removeTaskIfUnchanged } from '../store.js';
 import { createCommandSpecCleanup } from '../command-spec-cleanup.js';
 import { cleanupOmpSessionPartitionForTask } from '../omp-session-cleanup.js';
 
@@ -8,13 +8,82 @@ import { cleanupOmpSessionPartitionForTask } from '../omp-session-cleanup.js';
  * Delete a task's OMP session partition directory as part of removing its row. Every ownership
  * state is cleaned here, including `provisional`: the row is going away, so leaving its partition
  * behind would orphan a directory nothing can ever reclaim. The shared OMP CAS blob root is never
- * touched. An unsafe/unresolvable path preserves the owner record — and therefore the whole task
- * row, the same retry-safety contract commandCleanup already uses — with an actionable warning.
+ * touched. An unsafe/unresolvable path — or an ownership record that exists but cannot be read —
+ * preserves the record, and therefore the whole task row, with an actionable warning.
  */
 export function cleanUpOmpSessionPartition(task, warn) {
   return cleanupOmpSessionPartitionForTask(task, warn);
 }
 
+/**
+ * The live-task retention boundary, evaluated before *any* cleanup side effect.
+ *
+ * A running task owns everything the row points at: its OMP session partition is the working
+ * directory of a live provider process, and its command-cleanup receipt names paths that process
+ * is still using. This used to be checked only inside the `commandCleanup` branch — i.e. after the
+ * OMP partition had already been staged and recursively deleted — so `clean --all` could destroy a
+ * live session's transcript for any task that happened not to carry a cleanup receipt.
+ */
+function isLiveTask(task) {
+  return task.status === 'running';
+}
+
+/**
+ * Remove one task row that `clean` selected, in the only order that is safe:
+ * live-task check, then OMP partition, then command cleanup, then log file, then an owner-fenced
+ * row delete.
+ *
+ * `task` is a snapshot from the caller's single `loadTasks()`, so the delete is conditional on the
+ * row still matching it (see removeTaskIfUnchanged). A watcher update, a kill, or a resume's
+ * ownership transfer landing mid-cleanup leaves the row in place rather than being reverted by a
+ * whole-table rewrite.
+ *
+ * @returns {{removed: boolean, reason: string|null}} `reason` is a short retention label
+ */
+export function removeCleanedTask(task, { warn }) {
+  if (isLiveTask(task)) {
+    return { removed: false, reason: 'running' };
+  }
+  if (!cleanUpOmpSessionPartition(task, warn)) {
+    return { removed: false, reason: 'OMP partition cleanup pending' };
+  }
+
+  let cleanupCleared = false;
+  if (task.commandCleanup) {
+    let recovered = false;
+    try {
+      const cleanup = createCommandSpecCleanup(task.commandCleanup, (cleanupPath, error) => {
+        warn(`failed to clean up ${cleanupPath}: ${error.message}`);
+      });
+      recovered = cleanup.runSync();
+    } catch (error) {
+      warn(`failed to validate cleanup for task ${task.id}: ${error.message}`);
+    }
+    if (!recovered) {
+      return { removed: false, reason: 'command cleanup pending' };
+    }
+    cleanupCleared = true;
+  }
+
+  if (task.logFile && existsSync(task.logFile)) {
+    unlinkSync(task.logFile);
+  }
+
+  if (
+    !removeTaskIfUnchanged(task.id, {
+      status: task.status,
+      ompSessionOwnership: task.ompSessionOwnership ?? null,
+    })
+  ) {
+    // The row moved on under us. Its side effects are already done, so record the one piece of
+    // durable state that would otherwise be retried forever, using a single-column write that
+    // cannot clobber whatever the concurrent writer just persisted.
+    if (cleanupCleared) clearTaskCommandCleanup(task.id, task.commandCleanup);
+    return { removed: false, reason: 'the row changed while it was being cleaned' };
+  }
+  return { removed: true, reason: null };
+}
+
 export function cleanTasks(options = {}) {
   const tasks = loadTasks();
   const taskList = Object.values(tasks);
@@ -48,56 +117,21 @@ export function cleanTasks(options = {}) {
   console.log(chalk.dim(`Removing ${toRemove.length} task(s)...\n`));
 
   for (const task of toRemove) {
-    if (
-      !cleanUpOmpSessionPartition(task, (message) =>
-        console.log(chalk.yellow(`Warning: ${message}`))
-      )
-    ) {
+    const { removed, reason } = removeCleanedTask(task, {
+      warn: (message) => console.log(chalk.yellow(`Warning: ${message}`)),
+    });
+    if (!removed) {
       cleanupFailed = true;
-      console.log(
-        chalk.yellow(`  Retained: ${task.id} [${task.status}] (OMP partition cleanup pending)`)
-      );
+      console.log(chalk.yellow(`  Retained: ${task.id} [${task.status}] (${reason})`));
       continue;
     }
-    if (task.commandCleanup) {
-      if (task.status === 'running') {
-        cleanupFailed = true;
-        console.log(
-          chalk.yellow(`  Retained: ${task.id} [running] (live command cleanup ownership)`)
-        );
-        continue;
-      }
-      let recovered = false;
-      try {
-        const cleanup = createCommandSpecCleanup(task.commandCleanup, (cleanupPath, error) => {
-          console.log(chalk.yellow(`Warning: failed to clean up ${cleanupPath}: ${error.message}`));
-        });
-        recovered = cleanup.runSync();
-      } catch (error) {
-        console.log(
-          chalk.yellow(`Warning: failed to validate cleanup for task ${task.id}: ${error.message}`)
-        );
-      }
-      if (!recovered) {
-        cleanupFailed = true;
-        console.log(
-          chalk.yellow(`  Retained: ${task.id} [${task.status}] (command cleanup pending)`)
-        );
-        continue;
-      }
-      task.commandCleanup = null;
-    }
-    if (task.logFile && existsSync(task.logFile)) {
-      unlinkSync(task.logFile);
-    }
-
     console.log(chalk.dim(`  Removed: ${task.id} [${task.status}]`));
-    delete tasks[task.id];
     removedCount++;
   }
 
-  saveTasks(tasks);
-
+  // No whole-table rewrite here by design. Rows are deleted individually above, each fenced on the
+  // snapshot it was validated against, so a concurrent watcher/kill/ownership-transfer write is
+  // never reverted by cleanup finishing after it.
   console.log(chalk.green(`\n✓ Cleaned ${removedCount} task(s)`));
   if (cleanupFailed) process.exitCode = 1;
 }

package/task-lib/commands/kill.js

@@ -2,6 +2,25 @@ import chalk from 'chalk';
 import { getTask, requestTaskCancellation, updateTask } from '../store.js';
 import { createCommandSpecCleanup } from '../command-spec-cleanup.js';
 import { terminateProcess } from '../process-termination.js';
+import { retireOmpOwnershipAtTerminalBoundary } from '../omp-session-ownership.js';
+
+/**
+ * Retire the task's OMP session ownership at a confirmed terminal boundary (killed / stale).
+ *
+ * A killed task's provisional partition claim would otherwise outlive the process that made it: no
+ * watcher is left to reach `finalizeOmpOwnership`, and cleanup refuses to reclaim a partition any
+ * row still claims provisionally, so the directory would be unreclaimable forever. Runs *before*
+ * the terminal status write so no window exists where the row is terminal but still claiming.
+ */
+function retireOmpOwnershipForKilledTask(taskId) {
+  retireOmpOwnershipAtTerminalBoundary(taskId, (error) => {
+    console.log(
+      chalk.yellow(
+        `Warning: failed to retire the OMP session ownership of task ${taskId}: ${error.message}`
+      )
+    );
+  });
+}
 
 async function cleanupTerminatedTask(task) {
   if (!task.commandCleanup) return {};
@@ -125,6 +144,7 @@ export async function killTaskCommand(taskId, options = {}) {
     }
     console.log(chalk.yellow('Process already dead, updating status...'));
     const cleanupUpdate = await cleanupTerminatedTask(task);
+    retireOmpOwnershipForKilledTask(taskId);
     updateTask(taskId, {
       status: 'stale',
       pid: null,
@@ -147,6 +167,7 @@ export async function killTaskCommand(taskId, options = {}) {
     if (result.degraded) {
       console.log(chalk.yellow(`Warning: ${result.degradedReason}`));
     }
+    retireOmpOwnershipForKilledTask(taskId);
     updateTask(taskId, {
       status: 'killed',
       pid: null,

package/task-lib/commands/resume.js

@@ -13,12 +13,29 @@ const { providerSupportsCapability } = require('../../lib/provider-names.js');
  * including the partition identity, which the cluster path can only learn from the row itself.
  * `state === 'committed'` is required: a provisional or cleanup-required record never durably
  * proved a resumable session, so anything less fails closed to a fresh context.
+ *
+ * This surface is standalone-only, and refuses a `cluster-agent` owner outright.
+ *
+ * A cluster-agent lineage belongs to a live agent generation: the committed record is the tail of
+ * an `agentId`/`clusterId`/iteration chain whose next turn is spawned by that agent process, and
+ * only that process can reach the post-hook boundary where a cluster-agent owner may be committed
+ * (agent-lifecycle.js#finalizeProviderSessionAfterCommit). Handing those ids to a detached
+ * `zeroshot task resume` would transfer the whole lineage onto a row no parent agent knows about
+ * or can ever commit: the prior owner's record is cleared by the transfer, the resumed row stays
+ * provisional to the end of time, and the partition becomes unreclaimable while the agent that
+ * *should* own the continuation silently falls back to a fresh context. Refusing before spawn is
+ * what keeps that lineage intact and resumable by its real owner.
  */
 function buildOmpResumeTaskOptions(task) {
   const ownership = validateOwnedByTask(task.ompSessionOwnership, task.id);
   if (!ownership) {
     throw new Error(`Task ${task.id} has no valid OMP session ownership record; refusing resume.`);
   }
+  if (ownership.owner.kind !== 'standalone') {
+    throw new Error(
+      `Task ${task.id} OMP session is owned by cluster agent ${ownership.owner.clusterId}/${ownership.owner.agentId}; manual resume is standalone-only. Let the owning agent continue it.`
+    );
+  }
   if (ownership.state !== 'committed' || !ownership.session || !ownership.partitionIdentity) {
     throw new Error(
       `Task ${task.id} OMP session ownership is '${ownership.state}', not a committed resumable session; refusing resume.`
@@ -28,6 +45,9 @@ function buildOmpResumeTaskOptions(task) {
     cwd: ownership.canonicalWorkspace,
     provider: task.provider,
     storageRoot: ownership.storageRoot,
+    // A standalone owner carries null cluster/agent ids by schema, so the resumed row is
+    // standalone too. They are passed explicitly rather than omitted so this stays an exact
+    // lineage copy of the record above, not an inference.
     clusterId: ownership.owner.clusterId,
     agentId: ownership.owner.agentId,
     ompResume: {

package/task-lib/commands/run.js

@@ -23,13 +23,28 @@ const OMP_RESUME_ALLOWED_FIELDS = new Set([
   ...OMP_RESUME_OPTIONAL_IDENTITY_FIELDS,
 ]);
 
+// Issue #866 fixes device/inode as *canonical unsigned decimal strings*. This descriptor arrives
+// over argv from another process, so the type is checked, never coerced: `String(value.device)`
+// would have accepted the JSON number 42, `new String('42')`, `['42']`, and anything else with a
+// matching toString, then silently canonicalized it into a string the persisted record never
+// contained. A descriptor that does not already carry the canonical form is a descriptor built by
+// something other than this codebase's writer, and it fails closed rather than being repaired.
+const CANONICAL_DECIMAL = /^(0|[1-9][0-9]*)$/;
+const IDENTITY_KEYS = new Set(['device', 'inode']);
+
+function isCanonicalDecimalString(value) {
+  return typeof value === 'string' && CANONICAL_DECIMAL.test(value);
+}
+
 function isIdentityShape(value) {
   return (
     value !== null &&
     typeof value === 'object' &&
     !Array.isArray(value) &&
-    /^(0|[1-9][0-9]*)$/.test(String(value.device)) &&
-    /^(0|[1-9][0-9]*)$/.test(String(value.inode))
+    Object.keys(value).length === IDENTITY_KEYS.size &&
+    Object.keys(value).every((key) => IDENTITY_KEYS.has(key)) &&
+    isCanonicalDecimalString(value.device) &&
+    isCanonicalDecimalString(value.inode)
   );
 }
 

package/task-lib/omp-session-cleanup.js

@@ -18,7 +18,12 @@
 //
 // An unsafe or unresolvable path preserves the owner record with an actionable warning instead of
 // deleting, so the operator can inspect it and the cleanup stays durably retryable.
-import { loadTasks, updateTask, getTaskStoreDatabase } from './store.js';
+import {
+  loadTasks,
+  updateTask,
+  getTaskStoreDatabase,
+  hasUnreadableOmpSessionOwnership,
+} from './store.js';
 import { findAuthoritativeOwnersForPartition } from './omp-session-ownership.js';
 import {
   serializeOmpSessionOwnership,
@@ -52,10 +57,17 @@ const {
  * writes this column only through `serializeOmpSessionOwnership`, whose output is canonical per
  * record, so comparing the stored bytes is an exact "still the same record" test.
  *
- * The recursive removal runs *after* the fence is released, because by then the tree only answers
- * to an unguessable staging name nothing else knows, and holding a write lock across an
- * arbitrarily large `rm -r` would stall every other task-store writer.
+ * The recursive removal runs *after* the fence is released. By then the tree only answers to its
+ * deterministic owner-bound staging name, and every retry revalidates that name and identity.
+ * Holding a write lock across an arbitrarily large `rm -r` would stall every other store writer.
  */
+function describeBlockingOwner(owner) {
+  if (owner.unknown) {
+    return `${owner.taskId} (ownership record is unreadable or invalid; inspect or repair that task row)`;
+  }
+  return `${owner.taskId} (${owner.state})`;
+}
+
 function stageUnderOwnerFence(ownership, taskId) {
   const database = getTaskStoreDatabase();
   const expectedRecord = serializeOmpSessionOwnership(ownership);
@@ -76,7 +88,7 @@ function stageUnderOwnerFence(ownership, taskId) {
       return {
         staged: false,
         deleted: false,
-        reason: `it is still claimed by ${owners.map((o) => `${o.taskId} (${o.state})`).join(', ')}`,
+        reason: `it is still claimed by ${owners.map(describeBlockingOwner).join(', ')}`,
       };
     }
     return stageOmpSessionPartitionForDeletion(ownership);
@@ -96,6 +108,17 @@ function stageUnderOwnerFence(ownership, taskId) {
  *   successful delete — required on surfaces (cluster clear) where the row itself survives.
  */
 export function cleanupOmpSessionPartitionForTask(task, warn, { clearRecord = false } = {}) {
+  // A SQL-NULL ownership column is exact truth that this task never allocated a partition: there
+  // is nothing to clean and the row is free to go. An *unreadable* column is the opposite — some
+  // partition may exist that only this row still points at — so the row and its evidence are
+  // retained for an operator instead of being deleted into an orphan. The malformed bytes are
+  // never parsed, canonicalized, or otherwise acted on.
+  if (hasUnreadableOmpSessionOwnership(task)) {
+    warn(
+      `Task ${task.id}: OMP session ownership record is present but unreadable; retaining the task row and its record for inspection. Nothing was deleted, and any partition it named must be reclaimed manually.`
+    );
+    return false;
+  }
   if (!task?.ompSessionOwnership) return true;
   const ownership = validateOwnedByTask(task.ompSessionOwnership, task.id);
   if (!ownership) {
@@ -119,7 +142,7 @@ export function cleanupOmpSessionPartitionForTask(task, warn, { clearRecord = fa
     return false;
   }
 
-  const { deleted, reason } = removeStagedOmpSessionPartition(staged.stagingPath);
+  const { deleted, reason } = removeStagedOmpSessionPartition(staged.stagingPath, ownership);
   if (!deleted) {
     warn(`Task ${task.id}: retained OMP session partition ${ownership.partitionId} (${reason}).`);
     return false;
@@ -139,14 +162,28 @@ function finishCleanup(task, clearRecord) {
  * the cluster's own `storageDir`, so this is what makes cluster clear (and therefore purge)
  * actually reclaim them; the task rows themselves survive and have their ownership cleared.
  *
- * @returns {{deleted: string[], retained: string[]}} partition ids
+ * A row whose ownership column is present but unreadable cannot be attributed to a cluster at all
+ * — the owner tuple is exactly what is unreadable — so it is reported separately (`unreadable`)
+ * rather than silently skipped. Cluster clear keeps task rows, so the evidence survives either way;
+ * the warning is what tells the operator a partition may need reclaiming by hand.
+ *
+ * @returns {{deleted: string[], retained: string[], unreadable: string[]}} partition ids, plus the
+ *   task ids whose ownership record could not be read
  */
 export function cleanupOmpSessionPartitionsForCluster(clusterId, warn) {
   const deleted = [];
   const retained = [];
-  if (!clusterId) return { deleted, retained };
+  const unreadable = [];
+  if (!clusterId) return { deleted, retained, unreadable };
 
   for (const task of Object.values(loadTasks())) {
+    if (hasUnreadableOmpSessionOwnership(task)) {
+      unreadable.push(task.id);
+      warn(
+        `Task ${task.id}: OMP session ownership record is present but unreadable, so it cannot be attributed to a cluster; the row and its record are retained for inspection.`
+      );
+      continue;
+    }
     const ownership = validateOwnedByTask(task?.ompSessionOwnership ?? null, task?.id);
     if (!ownership || ownership.owner.kind !== 'cluster-agent') continue;
     if (ownership.owner.clusterId !== clusterId) continue;
@@ -156,5 +193,5 @@ export function cleanupOmpSessionPartitionsForCluster(clusterId, warn) {
       retained.push(ownership.partitionId);
     }
   }
-  return { deleted, retained };
+  return { deleted, retained, unreadable };
 }

package/task-lib/omp-session-ownership-schema.js

@@ -8,7 +8,6 @@
 // `owner`, `session`, or either identity) rejects the whole record, and every known key is
 // re-derived into a canonical form on the way out. A record that does not validate is never
 // partially trusted — callers fail closed to a fresh context.
-import { createHash } from 'crypto';
 import { isAbsolute, resolve as resolvePath } from 'path';
 import { createRequire } from 'module';
 
@@ -16,11 +15,7 @@ const require = createRequire(import.meta.url);
 const { PARTITION_ID_PATTERN, partitionPathFor } = require('../src/omp-session-partition.js');
 
 export const OMP_OWNERSHIP_SCHEMA_VERSION = 1;
-export const OMP_OWNERSHIP_STATES = Object.freeze([
-  'provisional',
-  'committed',
-  'cleanup-required',
-]);
+export const OMP_OWNERSHIP_STATES = Object.freeze(['provisional', 'committed', 'cleanup-required']);
 
 const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/u;
 const DECIMAL_PATTERN = /^(0|[1-9][0-9]*)$/u;
@@ -89,14 +84,6 @@ export function canonicalOwnerUid() {
   return typeof process.getuid === 'function' ? String(process.getuid()) : '0';
 }
 
-/** sha256 over the UTF-8 bytes of a stable JSON encoding (sorted keys) of `fields`. */
-export function computeExecutionFingerprint(fields) {
-  const sortedKeys = Object.keys(fields).sort();
-  const stable = {};
-  for (const key of sortedKeys) stable[key] = fields[key];
-  return `sha256:${createHash('sha256').update(JSON.stringify(stable), 'utf8').digest('hex')}`;
-}
-
 function normalizeOwner(owner) {
   if (!isPlainObject(owner) || !hasOnlyKeys(owner, OWNER_KEYS)) return null;
   if (!OWNER_KINDS.has(owner.kind)) return null;
@@ -179,7 +166,9 @@ export function validateOmpSessionOwnership(value) {
   // No partially populated pairs, in any state: an observation of the materialized session is
   // either complete (both the partition identity and the full session tuple) or absent.
   if (hasPartitionIdentity !== hasSession) return null;
-  const partitionIdentity = hasPartitionIdentity ? normalizeIdentity(value.partitionIdentity) : null;
+  const partitionIdentity = hasPartitionIdentity
+    ? normalizeIdentity(value.partitionIdentity)
+    : null;
   const session = hasSession ? normalizeSession(value.session) : null;
   if (hasPartitionIdentity && (!partitionIdentity || !session)) return null;
   // `committed` is the only state that asserts a resumable session, so it is the only state that
@@ -252,6 +241,23 @@ export function parseOmpSessionOwnership(raw) {
   return validateOmpSessionOwnership(parsed);
 }
 
+/**
+ * Closed raw-column inspection seam for a stored `omp_session_ownership` value.
+ *
+ * `parseOmpSessionOwnership` collapses *both* "SQL NULL" and "non-null but unreadable" to `null`,
+ * and those two mean opposite things to cleanup: SQL NULL is exact truth that there is nothing to
+ * clean, while unreadable bytes are evidence that a partition may exist whose owner record we can
+ * no longer interpret. Deleting such a row would orphan that partition permanently, so every
+ * cleanup surface needs to tell them apart.
+ *
+ * The seam is deliberately closed: it reports only `{present, valid}` and never hands the raw text
+ * back, so nothing downstream can be tempted to parse, canonicalize, or act on malformed JSON.
+ */
+export function inspectStoredOmpSessionOwnership(raw) {
+  if (raw === null || raw === undefined) return { present: false, valid: false };
+  return { present: true, valid: parseOmpSessionOwnership(raw) !== null };
+}
+
 export function serializeOmpSessionOwnership(value) {
   if (!value) return null;
   const validated = validateOmpSessionOwnership(value);

package/task-lib/omp-session-ownership.js

@@ -16,12 +16,14 @@
 //
 // A resumed turn additionally performs `transferOmpSessionOwnership` before its prompt is written:
 // in one transaction the prior committed owner's record is cleared and its lineage (partition
-// identity + session tuple) is moved onto the resumed task's still-`provisional` row. That keeps
-// exactly one *committed* owner — and keeps "committed" meaning what it means everywhere else,
-// this turn's own success boundary has passed — instead of publishing a half-finished
-// continuation as resumable.
+// identity + session tuple) is moved onto the resumed task's still-`provisional` row.
 //
-// It does NOT keep exactly one row *referencing* the partition. A resumed row is inserted (and
+// That means a partition has at most one *committed* owner, and for the whole span of a resumed
+// turn it has NONE: the authoritative live claimant is `provisional` by design, because
+// "committed" means this row's own success boundary has already passed. Publishing a half-finished
+// continuation as resumable is exactly what that ordering prevents.
+//
+// It also does NOT keep exactly one row *referencing* the partition. A resumed row is inserted (and
 // therefore already names the partition) before its transfer runs, so two competing resumes of the
 // same committed session put three rows on one partition: the prior owner plus both candidates.
 // Only one transfer can win; the loser fails closed and is retired to `cleanup-required` holding a
@@ -34,14 +36,12 @@ import { statSync } from 'fs';
 import { getTask, getTaskStoreDatabase } from './store.js';
 import {
   buildProvisionalOwnership,
-  computeExecutionFingerprint,
+  parseOmpSessionOwnership,
   serializeOmpSessionOwnership,
   validateOmpSessionOwnership,
   validateOwnedByTask,
 } from './omp-session-ownership-schema.js';
 
-export { computeExecutionFingerprint };
-
 function statIdentity(targetPath) {
   const stat = statSync(targetPath);
   return { device: String(stat.dev), inode: String(stat.ino) };
@@ -49,12 +49,7 @@ function statIdentity(targetPath) {
 
 /** Pure builder for the initial provisional record; embed the result in the task row passed to
  * addTask() so the SQL row is durable before the partition directory is created on disk. */
-export function writeProvisionalOwnership({
-  partitionId,
-  storageRoot,
-  canonicalWorkspace,
-  owner,
-}) {
+export function writeProvisionalOwnership({ partitionId, storageRoot, canonicalWorkspace, owner }) {
   return buildProvisionalOwnership({
     partitionId,
     storageRoot,
@@ -185,6 +180,35 @@ export function markCleanupRequired(taskId) {
   return casOwnership(taskId, current, updated) ? updated : readOwnership(taskId);
 }
 
+/**
+ * Retire a task's OMP ownership from a *confirmed durable task boundary* — a failed, cancelled,
+ * stale, or killed transition — without ever letting that retirement break the boundary itself.
+ *
+ * Every caller here is already committing a terminal task-status write (task-lib/runner.js's
+ * row-before-directory failure, `zeroshot task kill`, `zeroshot clear`, `zeroshot kill-all`), so
+ * this must not throw: an unreachable or locked task store must not turn "the task is killed" into
+ * an unhandled rejection. It is idempotent and safe to re-enter — `markCleanupRequired` no-ops once
+ * the record has left `provisional`, so a retried kill or a crash-recovery replay converges.
+ *
+ * The decision is derived from the boundary, never from whether the partition directory happens to
+ * exist: a fresh partition can be mid-materialization at exactly this moment, and file presence
+ * would answer the wrong question.
+ *
+ * @param {string} taskId
+ * @param {(error: Error) => void} [onError] receives an unexpected store failure for logging
+ * @returns {boolean} true when the retirement ran without error (including no-op cases)
+ */
+export function retireOmpOwnershipAtTerminalBoundary(taskId, onError) {
+  if (typeof taskId !== 'string' || taskId.length === 0) return true;
+  try {
+    markCleanupRequired(taskId);
+    return true;
+  } catch (error) {
+    onError?.(error instanceof Error ? error : new Error(String(error)));
+    return false;
+  }
+}
+
 /**
  * The ownership states that constitute a live claim on a partition.
  *
@@ -201,28 +225,34 @@ export const AUTHORITATIVE_OWNERSHIP_STATES = Object.freeze(['provisional', 'com
 
 const AUTHORITATIVE_STATES = new Set(AUTHORITATIVE_OWNERSHIP_STATES);
 
-/** Every row other than `excludeTaskId` whose *own* valid record names this partition, as
- * `{taskId, state}`. Rows whose stored JSON is unparseable, invalid, or owned by a different task
- * id are not that row's ownership and are skipped. */
+/** Every row other than `excludeTaskId` whose own valid record names this partition, plus every
+ * unreadable or invalid non-null row as global unknown authoritative evidence. A malformed record
+ * cannot safely prove which partition it names, so cleanup must assume it may name the partition
+ * being considered; skipping it could orphan the only directory that damaged row still points at.
+ *
+ * The partition filter is applied in JS after validation rather than in SQL. SQLite's
+ * `json_extract()` raises "malformed JSON" for a column whose bytes are not valid JSON. Reading the
+ * column as opaque text both avoids that failure and lets cleanup represent corruption explicitly
+ * instead of treating unknown evidence as absence. */
 function ownersForPartition(partitionId, excludeTaskId, database) {
   const rows = database
     .prepare(
-      `SELECT id, omp_session_ownership FROM tasks
-       WHERE omp_session_ownership IS NOT NULL
-         AND json_extract(omp_session_ownership, '$.partitionId') = ?`
+      `SELECT id, omp_session_ownership AS record FROM tasks
+       WHERE omp_session_ownership IS NOT NULL`
     )
-    .all(partitionId);
+    .all();
   const owners = [];
   for (const row of rows) {
     if (row.id === excludeTaskId) continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(row.omp_session_ownership);
-    } catch {
+    const record = parseOmpSessionOwnership(row.record);
+    const owned = record && validateOwnedByTask(record, row.id);
+    if (!owned) {
+      owners.push({ taskId: row.id, state: null, unknown: true });
       continue;
     }
-    const record = validateOwnedByTask(parsed, row.id);
-    if (record) owners.push({ taskId: row.id, state: record.state });
+    if (owned.partitionId === partitionId) {
+      owners.push({ taskId: row.id, state: owned.state });
+    }
   }
   return owners;
 }
@@ -258,8 +288,8 @@ export function findAuthoritativeOwnersForPartition(
   excludeTaskId = null,
   database = getTaskStoreDatabase()
 ) {
-  return ownersForPartition(partitionId, excludeTaskId, database).filter((owner) =>
-    AUTHORITATIVE_STATES.has(owner.state)
+  return ownersForPartition(partitionId, excludeTaskId, database).filter(
+    (owner) => owner.unknown || AUTHORITATIVE_STATES.has(owner.state)
   );
 }
 
@@ -270,8 +300,13 @@ export function findAuthoritativeOwnersForPartition(
  * Both sides are fenced on their exact current JSON inside one transaction, so the outcome is all
  * or nothing: either the prior owner's record is cleared *and* the resumed row carries the
  * inherited lineage, or nothing changed and the caller must fail the turn closed. There is never a
- * window in which two rows are committed owners of the same partition, nor one in which the
- * partition has no owner row at all.
+ * window in which two rows are *committed* owners of the same partition.
+ *
+ * There is, however, a long window in which *no* row is committed: from the instant this transfer
+ * applies until the resumed turn reaches its own success boundary, the authoritative claimant is
+ * this `provisional` row. That is the intended steady state of a resumed turn, not a gap — which
+ * is why every partition fence is over the authoritative states (see
+ * findAuthoritativeOwnersForPartition) and not over the committed rows alone.
  *
  * Returns the transferred record, or null when the transfer did not apply (prior owner already
  * moved, resumed row already advanced, lineage mismatch).