aiterm-mcp 0.61.2 → 0.61.3

package/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.3] - 2026-10-22
+
+### Fixed
+
+- An unknown send in the opt-in POSIX native execution entry no longer permanently blocks an explicit `pty_close` of that one session. The close is pinned to its expected launch/native identity; only confirmed close and absence release the failed-send admission. The original request remains unknown and is never replayed. Issued work, unknown management operations, and uncertain identities stay blocked.
+- Native handler errors retain their original explanation alongside the typed execution error. A failed recovery close preserves the old launch metadata and reports the native failure.
+
 ## [0.61.2] - 2026-10-22
 
 ### 修正
@@ -2715,7 +2722,8 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.2...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.3...HEAD
+[0.61.3]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.2...v0.61.3
 [0.61.2]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.1...v0.61.2
 [0.61.1]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.0...v0.61.1
 [0.61.0]: https://github.com/kitepon/aiterm-mcp/compare/v0.60.1...v0.61.0

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.2** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.3** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -731,7 +731,7 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 `pty_send` はコマンドやpromptの意味を判定せず、指定された本文を端末へ送る。既定ではESC・ブラケットペースト終端などをサニタイズし、`pty_read`も制御文字を無害化して返す（`raw: true`はそのまま扱う）。コマンドの許可・拒否はshell、接続先、起動したharnessが所有する。
 
-1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためplatformのmultiplexerへUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellまたはPowerShellが前面にいる時のsanitize済み複数行は、改行を含まない単一入力へ符号化する。POSIXは`eval`、PowerShellはUTF-8のBase64を復元したscriptblockのdot-sourceを使い、変数と作業場所を現在のshellに保つ。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatchは本文全体を`ESC[200~/201~`で1回だけ包み、包んだ全体を同じchunkで流す。agent TUIには1回の貼り付けに見えるので画像pathが貼り付けの間で切れず、chunk投入中のキー解釈による語中文字化け・submit取り落としも抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。`pty_list`で対象sessionを確認し、`pty_close`で閉じてから同じsession IDを作り直す。公開の一括停止toolは存在しない。
+1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためplatformのmultiplexerへUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellまたはPowerShellが前面にいる時のsanitize済み複数行は、改行を含まない単一入力へ符号化する。POSIXは`eval`、PowerShellはUTF-8のBase64を復元したscriptblockのdot-sourceを使い、変数と作業場所を現在のshellに保つ。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatchは本文全体を`ESC[200~/201~`で1回だけ包み、包んだ全体を同じchunkで流す。agent TUIには1回の貼り付けに見えるので画像pathが貼り付けの間で切れず、chunk投入中のキー解釈による語中文字化け・submit取り落としも抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。`pty_list`で対象sessionを確認し、`pty_close`で閉じてから同じsession IDを作り直す。公開の一括停止toolは存在しない。 POSIXの明示native execution構成では、unknown sendになった対象1席も`pty_close`で閉じて再作成できる。元requestはunknownのまま保持し、再送しない。発行中の操作、管理close自体のunknown、native identityが不明な席は引き続き拒否する。
 
 ## 人が覗く
 

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.2** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.3** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -789,7 +789,7 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 `pty_send` does not interpret command or prompt meaning; it delivers the requested text to the terminal. By default it sanitizes ESC and bracketed-paste terminators, while `pty_read` neutralizes control characters in returned output (`raw: true` keeps them unchanged). The shell, remote endpoint, or launched harness owns command authorization.
 
-Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session are serialized across aiterm processes so chunks cannot interleave. Every OS pastes through its multiplexer in UTF-8-safe 256-byte chunks with a 10 ms drain interval; macOS, Linux, and WSL2 have all demonstrated silent middle/trailing loss when a long input is pushed without that boundary. Sanitized multiline text sent while a POSIX shell or PowerShell is in the foreground is encoded as one newline-free input (`eval` for POSIX shells; a dot-sourced, UTF-8 Base64-decoded scriptblock for PowerShell): the shell receives the complete script before it runs the first line, so a pager or REPL started mid-script cannot consume later lines as interactive keystrokes. Single-line input, `raw:true`, and non-shell frontends remain direct PTY pastes. Agent dispatches additionally wrap the whole text once in `ESC[200~/201~` and stream the wrapped text in the same chunks, so the agent TUI sees one paste (an image path is never split across pastes), hardening prompt injection against mid-word key-interpretation corruption and dropped submits. If a later chunk fails, aiterm reports the partial-send state and does not press Enter automatically. A lock left by a terminated sender fails closed before sending; use `pty_list` to confirm the affected session, close it with `pty_close`, then recreate the same session ID. There is no public kill-all tool.
+Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session are serialized across aiterm processes so chunks cannot interleave. Every OS pastes through its multiplexer in UTF-8-safe 256-byte chunks with a 10 ms drain interval; macOS, Linux, and WSL2 have all demonstrated silent middle/trailing loss when a long input is pushed without that boundary. Sanitized multiline text sent while a POSIX shell or PowerShell is in the foreground is encoded as one newline-free input (`eval` for POSIX shells; a dot-sourced, UTF-8 Base64-decoded scriptblock for PowerShell): the shell receives the complete script before it runs the first line, so a pager or REPL started mid-script cannot consume later lines as interactive keystrokes. Single-line input, `raw:true`, and non-shell frontends remain direct PTY pastes. Agent dispatches additionally wrap the whole text once in `ESC[200~/201~` and stream the wrapped text in the same chunks, so the agent TUI sees one paste (an image path is never split across pastes), hardening prompt injection against mid-word key-interpretation corruption and dropped submits. If a later chunk fails, aiterm reports the partial-send state and does not press Enter automatically. A lock left by a terminated sender fails closed before sending; use `pty_list` to confirm the affected session, close it with `pty_close`, then recreate the same session ID. There is no public kill-all tool. In the opt-in POSIX native execution entry, an unknown send can also be recovered by explicitly closing that one session with `pty_close`, then recreating it. The original request remains unknown and must not be replayed. Issued work, unknown management closes, and uncertain native identity remain blocked.
 
 ## A human can watch
 

package/dist/core.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 import * as rtk from "./rtk.js";
 import { closeExpectedExecution, parseExecutionNativeSessions, executionNativeBindingSchema } from "./execution-close.js";
 import { executionPointSchema } from "./execution-contract.js";
-import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary } from "./execution-effect.js";
+import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget } from "./execution-effect.js";
 import { ExecutionError } from "./execution-wire.js";
 import { readExecutionParentProcess } from "./execution-parent-process.js";
 import { isCursorMcpClient } from "aiterm-steer-delivery";
@@ -1869,7 +1869,12 @@ function closeSessionInternal(name, observeDependency = true, o = {}) {
     assertSessionClosable(name);
     if (o.letHarnessExit)
         letClaudeExitBeforeClose(name);
-    (observeDependency ? tmux : tmuxCleanup)("kill-session", "-t", name);
+    const killed = (observeDependency ? tmux : tmuxCleanup)("kill-session", "-t", name);
+    if (executionManagementCloseTarget(name) && killed.code !== 0) {
+        // Recovery must not erase the old launch metadata or report closed when
+        // its one pinned native close failed. Keep the original send uncertainty.
+        throw new AitermError(`tmux sessionを閉じられませんでした: ${killed.stderr.trim() || `code=${killed.code}`}`, 2);
+    }
     for (const p of [logpath(name), offsetpath(name), lastcmdpath(name), markpath(name), sendLockPath(name)]) {
         try {
             fs.unlinkSync(p);

package/dist/execution-dispatch.js

@@ -140,12 +140,15 @@ export function createExecutionDispatcher(bindings) {
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
                     const context = { schema: "aiterm.execution-source.v1", source };
                     const supplied = executionRefFromMeta(fixedExtra._meta);
+                    // A host's explicit session close is a management RPC with its own
+                    // existing process/request identity, not a delivery or resend.
+                    const hostClose = client === "bellteam" && route.tool === "pty_close" && !supplied;
                     if (args.remote !== undefined && args.remote !== null)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED");
                     let reference = supplied;
                     let directRequest = null;
                     let frozenParent = null;
-                    if (!reference && client !== "bellteam" && native) {
+                    if (!reference && (client !== "bellteam" || hostClose) && native) {
                         directRequest = executionRequestSchema.options[4].parse({ kind: "mcp", process_pid: native.pid,
                             process_started_identity: native.started_identity, request_id: fixedExtra.requestId,
                             tool: route.tool, target_session_id: route.target });
@@ -186,7 +189,7 @@ export function createExecutionDispatcher(bindings) {
                     }
                     else {
                         // BellTeam must retain its existing delivery/room/call reference.
-                        if (client === "bellteam" || !directRequest)
+                        if ((client === "bellteam" && !hostClose) || !directRequest)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
                         const current = await observe(route.target);
                         if (route.stage === "send" && !current.point)
@@ -204,15 +207,21 @@ export function createExecutionDispatcher(bindings) {
                     const expected = status.relation.target?.launch ?? (status.reservation.target.expected_launch_id
                         ? { session_id: route.target, launch_id: status.reservation.target.expected_launch_id } : null);
                     const requestMeta = { ...fixedExtra._meta, [EXECUTION_REQUEST_META_KEY]: reference };
-                    return await runDeferredBoundExecution(bindings.service, requestMeta, route.stage, route.target, async () => {
+                    let handlerFailure;
+                    const bound = await runDeferredBoundExecution(bindings.service, requestMeta, route.stage, route.target, async () => {
                         const result = await withExecutionRequest(reference.request, () => body(args, { ...fixedExtra, _meta: requestMeta }), {
                             source: status.source.status === "verified" ? status.source.point : null,
                             client_name: client ?? null, native_identity: native,
                             metadata: fixedExtra._meta === undefined ? null : fixedExtra._meta,
                             ...(captureNativeParent ? { native_parent: frozenParent } : {}),
                         });
-                        if (result.isError)
+                        if (result.isError) {
+                            // Keep the original native/handler refusal for the caller. It is
+                            // still an error, never an accepted receipt or replay permission;
+                            // the service determines whether an effect crossed its gate.
+                            handlerFailure = result;
                             throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                        }
                         // Missing/invalid binding evidence is returned as null. The wrapper
                         // retains the genuine successful receipt if binding then fails; it
                         // must not turn a valid accepted action into permission to resend.
@@ -263,6 +272,8 @@ export function createExecutionDispatcher(bindings) {
                         }
                         return { result, target };
                     }, cancellation?.assert);
+                    return handlerFailure && bound.isError ? { ...handlerFailure,
+                        _meta: { ...handlerFailure._meta, ...bound._meta } } : bound;
                 }
                 catch (error) {
                     return executionErrorResult(error);
@@ -276,7 +287,7 @@ export function createExecutionDispatcher(bindings) {
                 const failure = executionErrorResult(new ExecutionError("EXECUTION_UNCONFIRMED", "possible"));
                 // Preserve a genuine accepted result even when cancellation recording
                 // failed. Status-only uncertainty must never become permission to resend.
-                return result.isError ? failure : { ...result, _meta: { ...result._meta,
+                return { ...result, _meta: { ...result._meta,
                         [EXECUTION_ERROR_META_KEY]: failure._meta[EXECUTION_ERROR_META_KEY] } };
             }
             return result;

package/dist/execution-effect.js

@@ -286,6 +286,21 @@ export function bindExecutionNativeTarget(session, nativeId) {
         refuse(scope, "EXECUTION_CONFLICT");
     scope.nativeTargets.add(nativeId);
 }
+/** Bound only by the management-close wrapper, never tool arguments. The
+ * ordinary core close/cleanup keeps using its session name; native commands
+ * are pinned to the independently captured native ID through the same gate.
+ */
+export function bindExecutionManagementCloseTarget(session, nativeId) {
+    const scope = scopes.getStore();
+    if (!scope || scope.session !== session || scope.didIssue || scope.creation || scope.interrupt || !/^\$\d+$/.test(nativeId))
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    scope.managementCloseTarget = nativeId;
+    scope.nativeTargets.add(nativeId);
+}
+export function executionManagementCloseTarget(session) {
+    const scope = scopes.getStore();
+    return scope?.session === session ? scope.managementCloseTarget : undefined;
+}
 export function beforeExecutionEffect(session, verify) {
     const scope = scopes.getStore();
     if (!scope) {
@@ -376,7 +391,7 @@ export function guardTmuxExecution(input) {
                 if (!parsed || parsed[1] !== scope.session)
                     refuse(scope, "EXECUTION_CONFLICT");
                 if (command !== "new-session")
-                    args[at + 1] = `${scope.createdNative ?? "=" + scope.session}${parsed[2] ?? ":"}`;
+                    args[at + 1] = `${scope.managementCloseTarget ?? scope.createdNative ?? "=" + scope.session}${parsed[2] ?? ":"}`;
             }
             effects = true;
         }

package/dist/execution-service.js

@@ -41,6 +41,30 @@ function find(state, request) {
         throw new ExecutionError("EXECUTION_NOT_FOUND");
     return record;
 }
+const managementClose = (request) => request.kind === "mcp" && request.tool === "pty_close";
+/** Only a returned, unknown send may be displaced by an explicit close of
+ * that exact launch. Issued work, management/parent slots and other generations
+ * remain blockers. The record is never turned into accepted or not_sent.
+ */
+function recoverableSends(state, request, session, expected) {
+    if (!managementClose(request) || expected === null)
+        return [];
+    return state.slots.filter(slot => {
+        if (slot.session_id !== session || slot.expected_launch_id !== expected || slot.stage !== "send"
+            || slot.state !== "unknown" || !slot.request || same(slot.request, request))
+            return false;
+        if (slot.request.kind === "mcp" && !["pty_send", "claude_turn.issue"].includes(slot.request.tool))
+            return false;
+        const original = state.records.find(record => same(record.reservation.request, slot.request));
+        return original?.operations.send === "unknown" && !["issued", "unknown"].includes(original.operations.launch)
+            && original.relation.phase === "submitted_unknown" && original.relation.completion === "unknown"
+            && same(original.relation.target?.launch, { session_id: session, launch_id: expected });
+    });
+}
+function targetBlocked(state, request, session, expected) {
+    const recoverable = recoverableSends(state, request, session, expected);
+    return state.slots.some(slot => slot.session_id === session && !recoverable.includes(slot));
+}
 function view(state, record) {
     return executionRecordSchema.parse({ ...record,
         stopping: record.stopping || stopped(state, record.relation.source?.launch) || stopped(state, record.relation.target?.launch)
@@ -389,6 +413,28 @@ export class ExecutionService {
             return native.server;
         }, { readOnly: true });
     }
+    /** Private wrapper preparation for an explicit management close. No native
+     * effect or slot removal occurs here. The invoke gate independently rechecks
+     * this same identity immediately before every native command.
+     */
+    managementCloseNative(metaInput) {
+        const { request } = executionRefMetaSchema.parse(metaInput);
+        if (!managementClose(request))
+            return undefined;
+        if (!this.store.transactionSync)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        return this.store.transactionSync(state => {
+            const record = find(state, request), target = record.reservation.target;
+            if (!recoverableSends(state, request, target.session_id, target.expected_launch_id).length)
+                return undefined;
+            if (record.operations.send !== "preparing" || targetBlocked(state, request, target.session_id, target.expected_launch_id))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            const native = this.runtime.nativeSessionSync?.(target.session_id);
+            if (native?.state !== "present" || !native.server)
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            return native.native_id;
+        }, { readOnly: true });
+    }
     verifyCreationServer(metaInput, expected) {
         const { request } = executionRefMetaSchema.parse(metaInput);
         if (!this.store.transactionSync)
@@ -564,7 +610,7 @@ export class ExecutionService {
             }
             sourceAdmission(state, source.point, args.source_session_id);
             const target = args.reservation.target;
-            if (state.slots.some(slot => slot.session_id === target.session_id))
+            if (targetBlocked(state, args.reservation.request, target.session_id, target.expected_launch_id))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
             const current = await this.runtime.observe(target.session_id);
             this.expectTarget(current, target.expected_launch_id, target.session_id);
@@ -606,6 +652,7 @@ export class ExecutionService {
     }
     async invokeInternal(metaInput, stage, body, targetSessionId, deferred, admission) {
         const { request } = executionRefMetaSchema.parse(metaInput);
+        let expectedCloseNative;
         if (deferred && (!this.store.transactionSync || !this.runtime.observeSync))
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
         await this.store.transaction(async (state) => {
@@ -625,6 +672,16 @@ export class ExecutionService {
             if (record.reservation.source.launch && !relation.source)
                 throw new ExecutionError("EXECUTION_UNCONFIRMED");
             if (deferred) {
+                const target = record.reservation.target;
+                if (recoverableSends(state, request, target.session_id, target.expected_launch_id).length) {
+                    if (targetBlocked(state, request, target.session_id, target.expected_launch_id))
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                    this.expectTarget(await this.runtime.observe(target.session_id), target.expected_launch_id, target.session_id);
+                    const native = this.runtime.nativeSessionSync?.(target.session_id);
+                    if (native?.state !== "present" || !native.server)
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                    expectedCloseNative = { native_id: native.native_id, server: structuredClone(native.server) };
+                }
                 record.operations[stage] = "preparing";
                 return; // no native effect or target slot yet; stop can cancel this
             }
@@ -654,6 +711,14 @@ export class ExecutionService {
             state.slots.push({ session_id: target.session_id, expected_launch_id: expected, stage, state: "issued", request });
         });
         let issued = !deferred, finished = false;
+        const checkCloseNative = (session) => {
+            if (!expectedCloseNative)
+                return;
+            const native = this.runtime.nativeSessionSync?.(session);
+            if (native?.state !== "present" || native.native_id !== expectedCloseNative.native_id
+                || !same(native.server, expectedCloseNative.server))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+        };
         const checkOrIssue = (commit, preparation) => {
             admission?.();
             const prepared = () => { admission?.(); return preparation(); };
@@ -688,6 +753,7 @@ export class ExecutionService {
                             throw new ExecutionError("EXECUTION_STALE_GENERATION");
                     }
                     const current = this.runtime.observeSync(slot.session_id);
+                    checkCloseNative(slot.session_id);
                     if (current.state === "present" && stopped(state, current.launch))
                         throw new ExecutionError("EXECUTION_STOPPING");
                     if (slot.created_native_id) {
@@ -725,11 +791,12 @@ export class ExecutionService {
                         throw new ExecutionError("EXECUTION_STALE_GENERATION");
                 }
                 const target = record.reservation.target;
-                if (state.slots.some(slot => slot.session_id === target.session_id))
+                if (targetBlocked(state, request, target.session_id, target.expected_launch_id))
                     throw new ExecutionError("EXECUTION_UNCONFIRMED");
                 const expected = relation.target?.launch.launch_id ?? target.expected_launch_id;
                 const current = this.runtime.observeSync(target.session_id);
                 this.expectTarget(current, expected, target.session_id);
+                checkCloseNative(target.session_id);
                 if (current.state === "present" && stopped(state, current.launch))
                     throw new ExecutionError("EXECUTION_STOPPING");
                 if ((stage === "launch" && current.state !== "absent") || (stage === "send" && current.state !== "present"))
@@ -830,8 +897,14 @@ export class ExecutionService {
             if (state.stopping.some(value => same(value, record.relation.source?.launch)) && !state.stopping.some(value => same(value, targetPoint.launch)))
                 state.stopping.push(targetPoint.launch);
             state.slots = state.slots.filter(value => !same(value.request, request));
-            if (closing)
+            if (closing) {
+                // Actual management close plus confirmed absence releases only these
+                // failed send admissions. Old callbacks still fail their missing-slot
+                // guard, and their records remain unknown and cannot be invoked again.
+                const recovered = recoverableSends(state, request, slot.session_id, expected);
+                state.slots = state.slots.filter(value => !recovered.includes(value));
                 this.interruptRelations(state, targetPoint.launch);
+            }
             return view(state, record);
         }).catch(async () => {
             // The side effect already returned, but its result could not be safely
@@ -1326,6 +1399,8 @@ export class ExecutionService {
     interruptRelations(state, launch) {
         for (const record of state.records)
             if (same(record.relation.target?.launch, launch)) {
+                if (record.operations.launch === "unknown" || record.operations.send === "unknown")
+                    continue;
                 record.relation.completion = "interrupted";
                 record.relation.target_fence = "closed";
             }

package/dist/execution-tools.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { executionReservationSchema, executionRequestSchema, executionPointSchema, cascadeInterruptRequestSchema, cascadeInterruptResultObjectSchema } from "./execution-contract.js";
 import { executionActionSchema, executionFinishSchema, executionRecordSchema, executionBindingSchema, executionRootsRequestSchema, executionRootsResultObjectSchema, executionRefFromMeta, executionErrorResult, ExecutionError, EXECUTION_BINDING_META_KEY, EXECUTION_ERROR_META_KEY, EXECUTION_SOURCE_META_KEY } from "./execution-wire.js";
-import { withExecutionEffectScope } from "./execution-effect.js";
+import { withExecutionEffectScope, bindExecutionManagementCloseTarget } from "./execution-effect.js";
 import { immediateStopInputSchema, immediateStopResultSchema } from "./execution-immediate-stop.js";
 export function executionBindingMeta(record) {
     return { [EXECUTION_BINDING_META_KEY]: executionBindingSchema.parse({
@@ -119,7 +119,12 @@ async function runExecutionReceipt(service, meta, stage, body, targetSessionId,
         const result = deferred
             ? await service.invokeDeferred(ref, stage, async (issue, prepare) => {
                 let expectedServer;
-                const action = await withExecutionEffectScope(targetSessionId, issue, run, stage === "launch" ? {
+                const action = await withExecutionEffectScope(targetSessionId, issue, () => {
+                    const native = service.managementCloseNative(ref);
+                    if (native)
+                        bindExecutionManagementCloseTarget(targetSessionId, native);
+                    return run();
+                }, stage === "launch" ? {
                     prepare: () => { expectedServer = service.prepareCreation(ref); return expectedServer; },
                     verifyServer: () => { if (!expectedServer)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED"); service.verifyCreationServer(ref, expectedServer); },

package/docs/DESIGN.md

@@ -424,6 +424,15 @@ ADR 0074（repositoryの`docs/adr/0074-agent-model-catalog.md`）。
 境界失敗は明示errorにする。retry、別model、別harness、別backendへ自動fallbackしない。
 stale send lockは並行processとのABAを避けるため自動削除せず、公開APIでは対象sessionを`pty_close`して
 同じIDで再作成する。全session一括停止は公開しない。
+POSIXの明示native execution構成では、返却済みsendのunknown枠が対象席の管理closeまで
+永久に拒否しないよう、通常`pty_close`だけを同じ期待launch/native IDで受付できる。
+unknown send枠を保持したまま既存core closeへ進み、native close成功と席の不在を確認した後だけ
+該当send枠を解放する。元recordのphase/completion/sendはunknownのまま残し、再送や成功化をしない。
+旧callbackは未知/消失した元slotで拒否され、同IDの新launchへnative作用を発行できない。
+issued、管理close自体のunknown、親作用のslot、世代/native/serverの不明・交代は対象外。
+既存の送信・待機lockの拒否も維持し、他席やissuerの停止を復旧条件へ追加しない。
+native handlerのisErrorは元の本文を保持し、`aiterm/execution_error`のcode/effectを併記する。
+native作用後の不明はpossibleのままで、原因説明を再送可否や成功receiptへ変換しない。
 agent sessionへの送信1本を守る`<name>.agent-send.lock`は持つ時間が長いので、持ち主が終了した残骸を次の送信が片付ける。消す役を`<name>.agent-send.lock.reap`の排他作成で1つに絞り、
 その中でもう一度確かめてから消すので、確かめた後で別のlockに入れ替わらない。消す役の印そのものが残った時だけは自動で消さず、`pty_close`を案内する。
 終了した持ち主のpidを別のprocessが使い回すと、pidだけでは生きて見える。生きて見える持ち主は、processが始まってからの経過とlockを作ってからの時間を比べ、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.2",
+  "version": "0.61.3",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [