@timurproko/a1 0.2.7-dev.834 → 0.2.7-dev.835

package/bin/tab-launch-context.d.ts

@@ -2,6 +2,7 @@ export interface TabLaunchCredentials {
   readonly tabId: string;
   readonly token: string;
   readonly endpoint: string;
+  readonly releaseId?: string;
 }
 
 export function formatResidentFallbackNotice(reason: string): string;

package/bin/tab-launch-context.js

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 
-const TAB_ENVIRONMENT_NAMES = ["A1_TAB_ID", "A1_TAB_TOKEN", "A1_TAB_ENDPOINT"];
+const TAB_ENVIRONMENT_NAMES = ["A1_TAB_ID", "A1_TAB_TOKEN", "A1_TAB_ENDPOINT", "A1_TAB_RELEASE_ID"];
 
 /** @param {string} reason */
 export function formatResidentFallbackNotice(reason) {
@@ -83,12 +83,12 @@ export function consumeTabLaunchContext(arguments_, environment) {
   const incarnationArgument = uiArguments.indexOf("--tab-incarnation");
   const tabIncarnation = incarnationArgument === -1 ? undefined : Number(uiArguments[incarnationArgument + 1]);
   if (incarnationArgument !== -1) uiArguments.splice(incarnationArgument, 2);
-  const [tabId, token, endpoint] = TAB_ENVIRONMENT_NAMES.map(name => environment[name]);
+  const [tabId, token, endpoint, releaseId] = TAB_ENVIRONMENT_NAMES.map(name => environment[name]);
   for (const name of TAB_ENVIRONMENT_NAMES) delete environment[name];
   if (!tabMode) return { uiArguments, tabCredentials: undefined, tabStandby: false };
   if (!tabId || !token || !endpoint || !tabDataDir || tabDataDir.includes("\0")
     || typeof tabIncarnation !== "number" || !Number.isSafeInteger(tabIncarnation) || tabIncarnation < 1) {
     throw new Error("A1 tab mode requires bridge credentials, recovery directory, and incarnation");
   }
-  return { uiArguments, tabCredentials: { tabId, token, endpoint }, tabDataDir, tabIncarnation, tabStandby };
+  return { uiArguments, tabCredentials: { tabId, token, endpoint, ...(releaseId === undefined ? {} : { releaseId }) }, tabDataDir, tabIncarnation, tabStandby };
 }

package/dist/cli/tabs.d.ts

@@ -2,7 +2,7 @@ import { runTerminalHostMaintenance, writeDoctorBundle } from "../foundation/res
 import type { TabsRequest } from "./tabs-request.js";
 export type { TabsRequest } from "./tabs-request.js";
 export interface TabsCommandOptions {
-    /** The running package root; its terminal host is a candidate after the active release. */
+    /** The invoking package, never a different active or retained release. */
     readonly packageRoot?: string;
     readonly environment?: NodeJS.ProcessEnv;
     readonly stdout?: (message: string) => void;

package/dist/cli/tabs.js

@@ -1,5 +1,5 @@
 import { resolveProductPaths } from "../foundation/lifecycle/index.js";
-import { CohortStateStore } from "../foundation/release/index.js";
+import { materializeRelease } from "../foundation/release/index.js";
 import { readResidentTabLaunchSettings, runTerminalHostMaintenance, writeDoctorBundle, } from "../foundation/resident-tabs/index.js";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../product-identity.js";
 /** `a1 tabs`: inspect or stop resident tabs without attaching, and never start a host to report state. */
@@ -9,7 +9,7 @@ export async function runTabsCommand(request, options = {}) {
     const stderr = options.stderr ?? (message => process.stderr.write(message));
     const paths = resolveProductPaths(environment);
     const profileRoot = environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir;
-    const releaseRoots = await installedReleaseRoots(paths.dataDir, options.packageRoot);
+    const releaseRoots = await invokingReleaseRoots(paths.dataDir, options.packageRoot, environment);
     const maintenance = options.maintenance ?? runTerminalHostMaintenance;
     const report = await maintenance({
         action: request.action === "doctor" ? "host-status" : request.action,
@@ -51,22 +51,18 @@ export async function runTabsCommand(request, options = {}) {
     }
     return report.exitCode === 0 ? 0 : 1;
 }
-async function installedReleaseRoots(dataDir, packageRoot) {
-    const roots = [];
+async function invokingReleaseRoots(dataDir, packageRoot, environment) {
+    if (!packageRoot)
+        return [];
+    if (environment[PRODUCT_IDENTITY.environment.developmentInstanceId])
+        return [packageRoot];
     try {
-        const state = await new CohortStateStore(dataDir).read();
-        for (const id of [state.references.active, state.references.rollback]) {
-            if (id && state.releases[id])
-                roots.push(state.releases[id].releaseRoot);
-        }
-        roots.push(...Object.values(state.releases).map(record => record.releaseRoot));
+        // Invariant: immutable materialization selects exact payload bytes without activating or starting a host.
+        return [(await materializeRelease(packageRoot, dataDir)).releaseRoot];
     }
     catch {
-        // Rationale: unreadable release state still leaves the running package's own host.
+        return [];
     }
-    if (packageRoot)
-        roots.push(packageRoot);
-    return [...new Set(roots)];
 }
 const NO_TABS = "No resident tabs are running.\n";
 function describe(request, report) {

package/dist/foundation/release/release-gc.js

@@ -316,14 +316,29 @@ async function residentReleaseHolds(dataDir, reader) {
     const everything = () => [...new Set(records.map(record => record.releaseId))].map(releaseId => ({ authority: "resident", releaseId }));
     if (!report.complete)
         return everything();
-    const byRoot = new Map(records.map(record => [comparablePath(record.releaseRoot), record.releaseId]));
-    const store = comparablePath(resolve(dataDir, "releases"));
+    if (report.releaseRoots.length === 0)
+        return [];
+    // Rationale: native Windows extended paths and Unix aliases must match the catalog's spelling.
+    const byRoot = new Map();
+    for (const record of records) {
+        const canonical = await realpath(record.releaseRoot).catch(() => record.releaseRoot);
+        byRoot.set(comparablePath(canonical), record.releaseId);
+    }
+    const directory = await realpath(resolve(dataDir, "releases")).catch(() => null);
+    if (directory === null)
+        return everything();
+    const store = comparablePath(directory);
     const holds = new Set();
     for (const root of report.releaseRoots) {
-        const releaseId = byRoot.get(comparablePath(root));
+        // Security: an unresolved live root may alias managed content; uncertainty must retain it.
+        const canonical = await realpath(root).catch(() => null);
+        if (canonical === null)
+            return everything();
+        const key = comparablePath(canonical);
+        const releaseId = byRoot.get(key);
         if (releaseId)
             holds.add(releaseId);
-        else if (comparablePath(root).startsWith(`${store}${sep}`))
+        else if (key.startsWith(`${store}${sep}`))
             return everything();
     }
     return [...holds].sort().map(releaseId => ({ authority: "resident", releaseId }));

package/dist/foundation/resident-tabs/bridge-client.d.ts

@@ -5,6 +5,7 @@ export interface TabBridgeCredentials {
     readonly tabId: string;
     readonly token: string;
     readonly endpoint: string;
+    readonly releaseId?: string;
 }
 export interface TabAttachment {
     readonly clientId: string;

package/dist/foundation/resident-tabs/bridge-client.js

@@ -70,7 +70,7 @@ export class TabBridgeClient {
             this.#startWaiter = finish;
             transport.once("connect", () => {
                 this.#send("hello", {
-                    role: "bridge", generation: 1, build: this.#options.build ?? "a1",
+                    role: "bridge", generation: 1, build: this.#options.build ?? "a1", releaseId: this.#options.credentials.releaseId,
                     features: ["bridge-status", "bridge-detach", "bridge-heartbeat", "bridge-restart", "bridge-visibility", "bridge-rename", "bridge-route", "bridge-stop", "bridge-shortcuts", "controller-boundary", "recovery-journal"],
                     token: [...Buffer.from(this.#options.credentials.token, "base64")], tabId: this.#options.credentials.tabId,
                     pid: this.#options.pid ?? process.pid, startIdentity: this.#options.startIdentity ?? `${process.pid}:node`,
@@ -208,6 +208,11 @@ export class TabBridgeClient {
     }
     #receive(message) {
         if (message.type === "welcome" && message.body["generation"] === 1) {
+            const id = this.#options.credentials.releaseId;
+            if (id !== undefined && message.body["releaseId"] !== id) {
+                this.#fail(false);
+                return;
+            }
             const advertised = message.body["features"];
             this.#features = new Set(Array.isArray(advertised) ? advertised.filter((feature) => typeof feature === "string") : []);
             this.#connected = true;

package/dist/foundation/resident-tabs/maintenance.d.ts

@@ -21,7 +21,7 @@ export interface MaintenanceOptions {
     readonly profileRoot: string;
     readonly dataDir: string;
     readonly runtimeDir: string;
-    /** Installed release roots whose verified terminal host may run maintenance, in preference order. */
+    /** The first root is the invoking release; other roots never substitute for it. */
     readonly releaseRoots: readonly string[];
     readonly environment: NodeJS.ProcessEnv;
     readonly platform?: NodeJS.Platform;
@@ -33,11 +33,7 @@ export interface MaintenanceOptions {
         readonly stdout: string;
     }>;
 }
-/**
- * Runs one maintenance form through a verified terminal host. When the running host speaks
- * another protocol generation, it retries once with the addon from the release that host
- * recorded, after verifying that release's manifest; it never loads an unverified addon.
- */
+/** Runs maintenance only through the invoking release; another cohort is never a retry target. */
 export declare function runTerminalHostMaintenance(options: MaintenanceOptions): Promise<MaintenanceReport>;
 /** The largest maintenance report accepted from the terminal host. */
 export declare const MAX_MAINTENANCE_REPORT_BYTES: number;

package/dist/foundation/resident-tabs/maintenance.js

@@ -4,26 +4,14 @@ import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { runBoundedHostCommand } from "./bounded-host-command.js";
 import { resolveTerminalHostEntryPath, resolveTerminalHostPath } from "./ensure-terminal-host.js";
 import { verifyTerminalHostArtifact } from "./terminal-host-artifact.js";
-const INCOMPATIBLE_EXIT = 4;
-/**
- * Runs one maintenance form through a verified terminal host. When the running host speaks
- * another protocol generation, it retries once with the addon from the release that host
- * recorded, after verifying that release's manifest; it never loads an unverified addon.
- */
+/** Runs maintenance only through the invoking release; another cohort is never a retry target. */
 export async function runTerminalHostMaintenance(options) {
     const platform = options.platform ?? process.platform;
     const architecture = options.architecture ?? process.arch;
-    const command = await firstVerifiedHost(options, options.releaseRoots, platform, architecture);
+    const command = await firstVerifiedHost(options, options.releaseRoots.slice(0, 1), platform, architecture);
     if (command === undefined)
-        return unavailable(options.action, "no verified terminal host is installed");
-    const report = await invoke(options, command);
-    if (report.exitCode !== INCOMPATIBLE_EXIT || typeof report.releaseRoot !== "string")
-        return report;
-    const cohort = await firstVerifiedHost({ ...options, environment: {} }, [report.releaseRoot], platform, architecture);
-    if (cohort === undefined || cohort.entry === command.entry) {
-        return { ...report, message: "the running tabs use another version whose terminal host cannot be verified" };
-    }
-    return await invoke({ ...options, environment: installedEnvironment(options.environment) }, cohort);
+        return unavailable(options.action, "the invoking release has no verified terminal host");
+    return await invoke(options, command);
 }
 function arguments_(options) {
     const command = options.action === "stop" ? ["stop", options.tabId ?? ""] : [options.action];
@@ -67,17 +55,11 @@ async function firstVerifiedHost(options, roots, platform, architecture) {
             return { executable: process.execPath, entry: resolveTerminalHostEntryPath(root) };
         }
         catch {
-            // Rationale: an older retained release may predate the packaged host; try the next one.
+            // Invariant: a missing or altered invoking artifact fails closed.
         }
     }
     return undefined;
 }
-function installedEnvironment(environment) {
-    const sanitized = { ...environment };
-    delete sanitized[PRODUCT_IDENTITY.environment.developmentInstanceId];
-    delete sanitized[PRODUCT_IDENTITY.environment.terminalHostPath];
-    return sanitized;
-}
 function unavailable(action, message) {
     return { schema: "a1-tabs-maintenance-v1", command: action, host: "unavailable", message, exitCode: 3 };
 }

package/dist/foundation/resident-tabs/release-holds.js

@@ -1,4 +1,4 @@
-import { readdir, stat } from "node:fs/promises";
+import { readdir } from "node:fs/promises";
 import { resolve } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { runBoundedHostCommand } from "./bounded-host-command.js";
@@ -51,19 +51,8 @@ async function hasResidentRecords(dataDir) {
     catch (error) {
         return !(error instanceof Error && "code" in error && error.code === "ENOENT");
     }
-    for (const profile of profiles) {
-        for (const record of ["server.json", "registry.json"]) {
-            try {
-                await stat(resolve(dataDir, "tabs", profile, record));
-                return true;
-            }
-            catch (error) {
-                if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
-                    return true;
-            }
-        }
-    }
-    return false;
+    // Invariant: native inspection, not a following stat, judges unknown or linked namespace entries.
+    return profiles.length > 0;
 }
 function incomplete(reason) {
     return { complete: false, releaseRoots: [], uncertain: [reason] };

package/dist/native/darwin-arm64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-10-26T04:56:17.941Z",
+  "builtAt": "2026-10-26T12:38:01.432Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "a87eaaffcd986b624c8b044b756446cc1bdaf4334a1775b97820542fe34f9fb7",

package/dist/native/darwin-arm64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "arm64",
   "target": "aarch64-apple-darwin",
   "capability": "supported",
-  "builtAt": "2026-10-26T04:59:18.364Z",
+  "builtAt": "2026-10-26T12:40:53.110Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "54bdccc28f03d9e974efb691f99ec2645c528748b1ea9832c9c1e059e111ce92",
-    "size": 5941872
+    "sha256": "c42ed0b065515794627cd0064a5da4de4c84396460315615356aab340e73eef0",
+    "size": 5962320
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/native/darwin-x64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "darwin",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-26T04:56:23.732Z",
+  "builtAt": "2026-10-26T12:38:07.232Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "783a65f0de287a1c02cd5429dbe97bc8633f4cc8a7b92e3e961180b9bdcff814",

package/dist/native/darwin-x64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "x64",
   "target": "x86_64-apple-darwin",
   "capability": "supported",
-  "builtAt": "2026-10-26T05:01:25.953Z",
+  "builtAt": "2026-10-26T12:43:26.281Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "048fb157fd7f98770d7256ef66638ef5ed225ae42225af8f3095413f95d4957b",
-    "size": 6476992
+    "sha256": "65f9a9556babcf6f361f643699142a854e564ef0c487d6709a48615a98dc8d75",
+    "size": 6497320
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/native/linux-x64/manifest.json

@@ -7,7 +7,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-26T04:56:11.560Z",
+  "builtAt": "2026-10-26T12:37:52.900Z",
   "artifact": {
     "filename": "process-guardian.node",
     "sha256": "118e5954e3864672bd8482ab7edf419cb27dcdf2533720316979b7f5cc5a53a5",

package/dist/native/linux-x64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "x64",
   "target": "x86_64-unknown-linux-gnu",
   "capability": "supported",
-  "builtAt": "2026-10-26T04:59:27.220Z",
+  "builtAt": "2026-10-26T12:40:25.329Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "9e59caca78d8e966e1a1d468e47ebba59fb242e43b86e4ee8893a8dd20cb9ab8",
-    "size": 7212552
+    "sha256": "234f73020b8f8cb31fd9a172f13c437255bb575a63466a3b369065e8866acead",
+    "size": 7236184
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/native/win32-x64/manifest.json

@@ -7,10 +7,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-10-26T04:57:24.731Z",
+  "builtAt": "2026-10-26T12:38:48.590Z",
   "artifact": {
     "filename": "process-guardian.node",
-    "sha256": "a51e98cbd97f0abfcd99b00101133bfe45509f4a620f275a696985a16f4e2312",
+    "sha256": "4136caabb0a807ff5b7c10e4b2cb1dd5e326c72bd3d7c61429e970879ac46f77",
     "size": 402432
   },
   "provenance": {

package/dist/native/win32-x64/terminal-host.manifest.json

@@ -9,11 +9,11 @@
   "architecture": "x64",
   "target": "x86_64-pc-windows-msvc",
   "capability": "supported",
-  "builtAt": "2026-10-26T05:00:51.094Z",
+  "builtAt": "2026-10-26T12:40:52.007Z",
   "artifact": {
     "filename": "terminal-host.node",
-    "sha256": "2be0eb9858bbfde8dd6dddb8bfc5881918f6c7804f74cd51cc97b56112b1adad",
-    "size": 6294016
+    "sha256": "a48fa7c8bdb979c8ca2834b280b590174b1574b16fc263aa5ad12ba1361a44a5",
+    "size": 6316032
   },
   "entry": {
     "filename": "dist/foundation/resident-tabs/host-entry.js",

package/dist/product-identity.d.ts

@@ -1,4 +1,4 @@
-declare const ENVIRONMENT_KEYS: readonly ["clipboardDiagnostics", "configDir", "dataDir", "databasePath", "developmentHistoryDataDir", "developmentInstanceId", "developmentRoot", "endpoint", "exitNoticePath", "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "residentFixtureControlDir", "residentProgressObservationDir", "residentProgressRunId", "residentProgressTabId", "residentProgressTabIncarnation", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId"];
+declare const ENVIRONMENT_KEYS: readonly ["clipboardDiagnostics", "configDir", "dataDir", "databasePath", "developmentHistoryDataDir", "developmentInstanceId", "developmentRoot", "endpoint", "exitNoticePath", "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "residentFixtureControlDir", "residentProgressObservationDir", "residentProgressRunId", "residentProgressTabId", "residentProgressTabIncarnation", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabReleaseId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId"];
 declare const FILESYSTEM_KEYS: readonly ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
 declare const STATE_KEYS: readonly ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile", "sessionRepositoryDirectory", "sessionWorktreeClaimDirectory"];
 declare const ENDPOINT_KEYS: readonly ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];

package/dist/product-identity.js

@@ -1,7 +1,7 @@
 import rawIdentity from "./product-identity.json" with { type: "json" };
 const ENVIRONMENT_KEYS = [
     "clipboardDiagnostics", "configDir", "dataDir", "databasePath", "developmentHistoryDataDir", "developmentInstanceId", "developmentRoot", "endpoint", "exitNoticePath",
-    "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "residentFixtureControlDir", "residentProgressObservationDir", "residentProgressRunId", "residentProgressTabId", "residentProgressTabIncarnation", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId",
+    "paneId", "probeTrace", "processGuardianPath", "prFooterPreview", "profileHome", "residentFixtureControlDir", "residentProgressObservationDir", "residentProgressRunId", "residentProgressTabId", "residentProgressTabIncarnation", "runtimeDir", "sessionRuntimeId", "skipVersionCheck", "startupTrace", "suggestionDiagnostics", "tabEndpoint", "tabId", "tabReleaseId", "tabToken", "tabsEndpoint", "terminalHostPath", "terminalSessionId",
 ];
 const FILESYSTEM_KEYS = ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
 const STATE_KEYS = ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile", "sessionRepositoryDirectory", "sessionWorktreeClaimDirectory"];

package/dist/product-identity.json

@@ -36,6 +36,7 @@
         "suggestionDiagnostics": "A1_SUGGESTION_DIAGNOSTICS",
         "tabEndpoint": "A1_TAB_ENDPOINT",
         "tabId": "A1_TAB_ID",
+        "tabReleaseId": "A1_TAB_RELEASE_ID",
         "tabToken": "A1_TAB_TOKEN",
         "tabsEndpoint": "A1_TABS_ENDPOINT",
         "terminalHostPath": "A1_TERMINAL_HOST_PATH",

package/docs/architecture/resident-tabs.md

@@ -175,13 +175,13 @@ Transport correctness does not rely on `timeBeginPeriod`. The existing per-role
 
 The existing opt-in progress route (`A1_RESIDENT_PROGRESS_OBSERVATION_DIR` plus `A1_RESIDENT_PROGRESS_RUN_ID`) adds `pipe-frame-read`, `pipe-write-complete`, `outer-write-complete`, `wake-gap`, and `wake-repaint-requested` stages. Connection-level records may omit tab identity. `durationUs` is local monotonic completion/assembly time; `idleWaitUs` separately describes waiting for the next frame and is not delivery latency. Native records include `monotonicUs`, `clockEpoch`, and optional `clockDiscontinuity`. Consumers exclude negative, epoch-crossing, and clock-discontinuity-crossing derived samples, while retaining valid local completion durations. The queue remains bounded and asynchronous, with loss accounting and no terminal content or credentials. Outer-write completion is not proof of physical pixels.
 
-For recurring post-wake stalls, compare an existing resident client, a new client on the same resident host, and direct `a1 solo` in the same outer terminal. Use matched holder/attach revisions and local I/O durations to distinguish child progress, transport delay, and outer writes. If solo and other terminal applications also stall, do not assign the failure to resident pipes without further evidence. Simulated-gap fixtures do not certify physical sleep/wake recovery; do not automate workstation suspend. Updates retain old resident cohorts, so new endpoint code takes effect only as those roles reach their ordinary lifecycle or the maintainer explicitly chooses to stop them. Installing the update never recycles running tabs.
+For recurring post-wake stalls, compare an existing resident client, a new client on the same resident host, and direct `a1 solo` in the same outer terminal. Use matched holder/attach revisions and local I/O durations to distinguish child progress, transport delay, and outer writes. If solo and other terminal applications also stall, do not assign the failure to resident pipes without further evidence. Simulated-gap fixtures do not certify physical sleep/wake recovery; do not automate workstation suspend. Updates retain old resident cohorts, but a new launch selects its own immutable release namespace rather than reusing their host. Existing roles keep their original code and lifecycle; installing an update never recycles running tabs.
 
 ### 3. Host scope, endpoints, writer authority, and credentials
 
-- There is **one server per OS user × canonical A1 profile root**, independent of the release cohort. Tabs must outlive release changes, and the supervisor is forbidden from retaining runtime processes.
-  - Windows endpoint: `\\.\pipe\a1-tabs-<sha256(canonicalProfileHome)[0:20]>`.
-  - macOS and Linux endpoint: a Unix domain socket `a1-tabs-<same profile hash>.sock` inside an owner-only (`0700`) per-user runtime directory (`$XDG_RUNTIME_DIR` when set, otherwise a private directory under the profile's runtime dir), kept short enough for the platform's socket path limit.
+- There is **one server per OS user, canonical A1 profile root and immutable release identity**. Different releases coexist without migration; the supervisor remains forbidden from retaining runtime processes. A domain-separated hash of canonical profile and fixed originating release/addon identity selects the flat `<data>/tabs/<scope>` directory, credential files, registry, epochs and `server-start-<scope>.lock`.
+  - Windows endpoint: `\\.\pipe\a1-tabs-<scope[0:20]>`.
+  - macOS and Linux endpoint: a Unix domain socket `a1-tabs-<same scope>.sock` inside an owner-only (`0700`) per-user runtime directory (`$XDG_RUNTIME_DIR` when set, otherwise a private directory under the profile's runtime dir), kept short enough for the platform's socket path limit.
   - Generation 1 admits holders over the authenticated owner endpoint. Dedicated `…-h-<tabId>` endpoints remain an optional later optimization.
   - Hermetic override: `A1_TABS_ENDPOINT`, together with the `A1_*_DIR` overrides.
 - **The endpoint is discovery; the writer lease is authority.** A starting server probes with a real handshake. If a live server answers, it exits as `already-running` and joins the winner. A failed probe does not authorize blind endpoint reclaim: the starter reads the owner marker, verifies pid and native start identity, requests termination, and waits for the owner-only OS-exclusive registry-writer lease. If the owner cannot be verified or the lease cannot be acquired, startup fails closed instead of creating split brain.
@@ -189,7 +189,7 @@ For recurring post-wake stalls, compare an existing resident client, a new clien
 - **Access and authentication:**
   - The endpoint, token files, secret file, registry, and writer lease are owner-only: Windows ACLs on the named pipe and files, `0700` directories and `0600` files on macOS and Linux, plus a peer-credential check (`SO_PEERCRED` / `getpeereid`) on every Unix socket connection.
   - Clients present a random 32-byte client token from an owner-only file.
-  - One random owner-only profile secret persists outside the registry. Per-tab/per-incarnation holder and bridge credentials are derived from that secret and the non-secret tab/incarnation identity, so a replacement server can authenticate surviving processes without storing tab credentials.
+  - One random owner-only profile/release secret persists outside its registry. Per-tab/per-incarnation holder and bridge credentials are derived from that secret and the non-secret tab/incarnation identity, so a replacement server can authenticate surviving processes without storing tab credentials.
   - Holders and bridges also present pid and native start identity. Nothing unverifiable is adopted, signalled, terminated, or allowed to mutate state.
 
 ### 4. Detached start
@@ -326,10 +326,10 @@ Tab status is an A1-owned state machine fed by `bridge.status`:
 ### 10. Updates and version skew
 
 - **Artifacts and process images.** The server and holders are Node runtimes that load the addon and fixed entry from immutable release directories, never from the mutable npm prefix. Activation therefore never overwrites a loaded addon or entry, and release retention keeps every release used by a verified resident process.
-- **Same generation, newer client.** The client attaches normally, and features the server lacks are disabled per method.
-- **No automatic handoff in the first version.** A compatible resident cohort remains on its immutable release until all of its tabs stop. A newer same-generation client may attach with unsupported optional operations disabled.
-- **Retention.** Release collection keeps the server's, every holder's, and every tab child's release while native identities verify. Package activation does not terminate or overwrite them.
-- **Incompatibility.** A generation mismatch never kills resident processes. The client reports that the resident host must be stopped explicitly before the preview can restart on the newer generation. Automatic server handoff and idle tab recycling require a follow-up change.
+- **Exact release admission.** Clients, holders and bridges present a release identity before capability negotiation. Matching protocol generation or display version does not permit cross-release attachment. Native clients also check the welcome identity; bridge identity is consumed from holder-private launch context before extensions load.
+- **Independent activation.** A newer release starts or reuses its own host. Existing resident and solo processes remain untouched. Server recovery and child launches retain the originating fixed Node, entry and addon; the active-release pointer never retargets them. No automatic migration, handoff or idle recycling is performed.
+- **Retention.** Read-only bounded collection scans every flat release namespace and legacy profile namespace. It keeps server, holder and child releases while identities verify and retains all candidates on unreadable, linked, oversized or unverifiable state. Package activation never overwrites loaded artifacts.
+- **Maintenance and legacy state.** Maintenance resolves the invoking package's immutable materialization without activation or host startup, uses only that release's verified entry, and never retries another recorded cohort. List, stop, status and doctor remain release-local, including unresponsive-host termination. Legacy unversioned state is neither migrated nor adopted; it is read only for conservative retention. Shared configuration and session file locks remain profile-neutral.
 
 ### 11. Foreground UX
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.2.7-dev.834",
+  "version": "0.2.7-dev.835",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",