chati-dev 4.5.15 → 4.5.27

package/src/orchestrator/cli.js

@@ -17,9 +17,14 @@ import { isFeatureEnabled } from '../utils/feature-flags.js';
 import { runScriptTask, formatScriptHandoff } from '../executors/runner.js';
 
 import {
-  loadSession, initSession, updateSession, recordAgentCompletion,
+  loadSession, readSessionSafe, initSession, updateSession, transitionSessionLifecycle, rollbackSessionLifecycle,
+  activateAgentExecutionState, rollbackAgentDispatch, recordAgentCompletion,
   recordModeTransition, getSessionSummary, validateSession,
   releaseSession, parseHandoffDecisionTrail, parseHandoffScaffoldSignals,
+  ensurePendingInteractionIdentity, releasePendingInteraction,
+  claimAgentExecutions,
+  releaseReservedAgentExecutions,
+  withSessionProjectionLock,
 } from './index.js';
 import {
   resolveScaffoldSource, loadScaffoldManifest, applyScaffold,
@@ -42,9 +47,14 @@ import {
 import { analyzeDeviationImpact, applyDeviation } from './index.js';
 import { detectQuickFlow, detectStandardFlow } from './index.js';
 import { getAgentFile } from '../terminal/prompt-builder.js';
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from 'fs';
-import { join, resolve, dirname } from 'path';
+import {
+  readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync,
+  lstatSync, realpathSync, renameSync, rmSync, openSync, closeSync, constants,
+  fstatSync, fchmodSync, chmodSync, readSync, linkSync, unlinkSync, fsyncSync, writeSync,
+} from 'fs';
+import { basename, join, parse, resolve, dirname, relative, isAbsolute, sep } from 'path';
 import { fileURLToPath } from 'url';
+import { createHash, randomUUID } from 'crypto';
 import { execSync } from 'child_process';
 import * as yaml from 'js-yaml';
 import {
@@ -56,10 +66,14 @@ import {
 import { updateProjectContext } from '../memory/magic-docs.js';
 import {
   loadRuntimeInstallationV2, resolveRuntimeInvocationV2,
-  describeRuntimeInstallationV2, V2_PLANNING_AGENTS,
+  resolveRuntimeAdjudicationV2, describeRuntimeInstallationV2, V2_PLANNING_AGENTS,
+  assertV2PlanningPredecessors,
 } from './runtime-installation-v2.js';
 import { compilePlanningHandoff, PLANNING_V2_TASKS_PATH } from './planning-runtime.js';
 import { persistRailHandoff } from './rail-runtime.js';
+import {
+  installationAuthorityProjectScope, signHostAuthorityPayload, verifyHostAuthorityPayload,
+} from '../installer-v2/installation-authority.js';
 
 // Spawn commands must reference the terminal runners with an absolute,
 // layout-independent path: the old monorepo-relative
@@ -68,7 +82,676 @@ import { persistRailHandoff } from './rail-runtime.js';
 // node_modules). Anchoring to this file's own location works in every layout
 // because the src/ tree shape is preserved verbatim by the CLI bundling.
 const _THISDIR = dirname(fileURLToPath(import.meta.url));
-const RUNNER = (name) => JSON.stringify(join(_THISDIR, '..', 'terminal', name));
+const NATIVE_LOCK_MAX_BYTES = 256 * 1024;
+const NATIVE_LOCK_MAX_BYTES_BIGINT = BigInt(NATIVE_LOCK_MAX_BYTES);
+const RUNNER = (name) => join(_THISDIR, '..', 'terminal', name);
+const RUNTIME_JSON_MAX_BYTES = 256 * 1024;
+const RUNTIME_SECURITY_HOOKS = Symbol.for('chati.cli.runtime-security-test-hooks');
+const SCRIPT_EXECUTION_RECEIPT_DOMAIN = 'chati.script-execution-receipt.v1';
+
+function runRuntimeSecurityTestHook(name, detail) {
+  const hook = globalThis[RUNTIME_SECURITY_HOOKS]?.[name];
+  if (typeof hook === 'function') hook(detail);
+}
+
+function sameRuntimeIdentity(left, right) {
+  return Boolean(left && right && left.dev === right.dev && left.ino === right.ino);
+}
+
+function sameRuntimeFileSnapshot(left, right) {
+  return sameRuntimeIdentity(left, right)
+    && left.size === right.size
+    && left.mode === right.mode
+    && left.mtimeNs === right.mtimeNs
+    && left.ctimeNs === right.ctimeNs;
+}
+
+// A rename is allowed to update ctime on the source inode. For the commit
+// check, retain identity, permissions, size and mtime, which are sufficient to
+// reject a replacement or content mutation without treating a valid rename as
+// a race.
+function samePublishedRuntimeFile(left, right) {
+  return sameRuntimeIdentity(left, right)
+    && left.size === right.size
+    && left.mode === right.mode
+    && left.mtimeNs === right.mtimeNs;
+}
+
+function openRuntimeDirectoryNoFollow(runtimePath) {
+  if (process.platform !== 'linux') {
+    throw Object.assign(new Error('Runtime request authority requires Linux descriptor-relative filesystem operations'), { code: 'UNSUPPORTED_RUNTIME_REQUEST_PLATFORM' });
+  }
+  const absolute = resolve(runtimePath);
+  const root = parse(absolute).root;
+  const anchor = openWorkingDirectoryAnchor(absolute);
+  const segments = anchor ? anchor.segments : absolute.slice(root.length).split(sep).filter(Boolean);
+  let fd;
+  try {
+    fd = anchor
+      ? openSync(`/proc/self/fd/${anchor.descriptor}`, constants.O_RDONLY | (constants.O_DIRECTORY || 0))
+      : openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  } finally {
+    if (anchor) closeSync(anchor.descriptor);
+  }
+  try {
+    for (const segment of segments) {
+      const child = openSync(
+        join(`/proc/self/fd/${fd}`, segment),
+        constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0),
+      );
+      const stat = fstatSync(child);
+      if (!stat.isDirectory()) {
+        closeSync(child);
+        throw Object.assign(new Error('The .chati/runtime chain must contain only real directories'), { code: 'UNSAFE_RUNTIME_PATH' });
+      }
+      closeSync(fd);
+      fd = child;
+    }
+    return { fd, stat: fstatSync(fd), absolute, reference: `/proc/self/fd/${fd}` };
+  } catch (error) {
+    closeSync(fd);
+    if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
+      throw Object.assign(new Error('The .chati/runtime chain must contain only real directories'), { code: 'UNSAFE_RUNTIME_PATH', cause: error });
+    }
+    throw error;
+  }
+}
+
+function assertRuntimeDirectoryRecord(record) {
+  const pinned = fstatSync(record.fd);
+  if (!pinned.isDirectory() || !sameRuntimeIdentity(pinned, record.runtimeIdentity)) {
+    throw Object.assign(new Error('The pinned runtime directory changed during request processing'), { code: 'UNSAFE_RUNTIME_PATH' });
+  }
+  let opened;
+  try {
+    opened = openRuntimeDirectoryNoFollow(record.runtimePath);
+    if (!sameRuntimeIdentity(opened.stat, record.runtimeIdentity)) {
+      throw Object.assign(new Error('The runtime directory changed during request processing'), { code: 'UNSAFE_RUNTIME_PATH' });
+    }
+  } finally {
+    if (opened) closeSync(opened.fd);
+  }
+}
+
+function openScriptHandoffDirectoryNoFollow(directoryPath, { create = false } = {}) {
+  if (process.platform !== 'linux') {
+    throw Object.assign(new Error('Script handoff persistence requires Linux descriptor-relative filesystem operations'), { code: 'UNSUPPORTED_SCRIPT_HANDOFF_PLATFORM' });
+  }
+  const absolute = resolve(directoryPath);
+  const root = parse(absolute).root;
+  const anchor = openWorkingDirectoryAnchor(absolute);
+  const segments = anchor ? anchor.segments : absolute.slice(root.length).split(sep).filter(Boolean);
+  let fd;
+  try {
+    fd = anchor
+      ? openSync(`/proc/self/fd/${anchor.descriptor}`, constants.O_RDONLY | (constants.O_DIRECTORY || 0))
+      : openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  } finally {
+    if (anchor) closeSync(anchor.descriptor);
+  }
+  try {
+    for (const segment of segments) {
+      const entry = join(`/proc/self/fd/${fd}`, segment);
+      let child;
+      try {
+        child = openSync(entry, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      } catch (error) {
+        if (error?.code !== 'ENOENT' || !create) throw error;
+        try { mkdirSync(entry, { mode: 0o700 }); }
+        catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
+        child = openSync(entry, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      }
+      const stat = fstatSync(child);
+      if (!stat.isDirectory()) {
+        closeSync(child);
+        throw Object.assign(new Error('The script handoff directory chain must contain only real directories'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+      }
+      closeSync(fd);
+      fd = child;
+    }
+    return { fd, stat: fstatSync(fd), absolute, reference: `/proc/self/fd/${fd}` };
+  } catch (error) {
+    closeSync(fd);
+    if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
+      throw Object.assign(new Error('The script handoff directory chain must contain only real directories'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH', cause: error });
+    }
+    throw error;
+  }
+}
+
+function assertScriptHandoffDirectoryRecord(record) {
+  const pinned = fstatSync(record.fd);
+  if (!pinned.isDirectory() || !sameRuntimeIdentity(pinned, record.stat)) {
+    throw Object.assign(new Error('The pinned script handoff directory changed during persistence'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+  }
+  let canonical;
+  try {
+    canonical = openScriptHandoffDirectoryNoFollow(record.absolute);
+    if (!sameRuntimeIdentity(canonical.stat, record.stat)) {
+      throw Object.assign(new Error('The script handoff directory chain changed during persistence'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+    }
+  } catch (error) {
+    if (error?.code === 'UNSUPPORTED_SCRIPT_HANDOFF_PLATFORM') throw error;
+    throw Object.assign(new Error('The script handoff directory chain changed during persistence'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH', cause: error });
+  } finally {
+    if (canonical) closeSync(canonical.fd);
+  }
+}
+
+export function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function ensureRuntimeResponsePath(projectDir, filename) {
+  if (!/^[A-Za-z0-9_-]+\.json$/.test(filename)) {
+    throw Object.assign(new Error('Runtime response filename is not path-safe'), { code: 'UNSAFE_RUNTIME_PATH' });
+  }
+  const projectPath = resolve(projectDir);
+  const chatiPath = join(projectPath, '.chati');
+  if (!existsSync(chatiPath) || lstatSync(chatiPath).isSymbolicLink() || !lstatSync(chatiPath).isDirectory()) {
+    throw Object.assign(new Error('The .chati directory must be a real directory'), { code: 'UNSAFE_RUNTIME_PATH' });
+  }
+  const realProject = realpathSync(projectPath);
+  const realChati = realpathSync(chatiPath);
+  const chatiRelative = relative(realProject, realChati);
+  if (!chatiRelative || chatiRelative.startsWith('..') || isAbsolute(chatiRelative)) {
+    throw Object.assign(new Error('The .chati directory must remain inside the project'), { code: 'UNSAFE_RUNTIME_PATH' });
+  }
+  const runtimePath = join(chatiPath, 'runtime');
+  if (!existsSync(runtimePath)) mkdirSync(runtimePath, { mode: 0o700 });
+  const runtimeStat = lstatSync(runtimePath);
+  if (runtimeStat.isSymbolicLink() || !runtimeStat.isDirectory()) {
+    throw Object.assign(new Error('The .chati/runtime directory must be a real directory'), { code: 'UNSAFE_RUNTIME_PATH' });
+  }
+  if (typeof process.getuid !== 'function' || runtimeStat.uid === process.getuid()) chmodSync(runtimePath, 0o700);
+  const realRuntime = realpathSync(runtimePath);
+  const runtimeRelative = relative(realChati, realRuntime);
+  if (!runtimeRelative || runtimeRelative.startsWith('..') || isAbsolute(runtimeRelative)) {
+    throw Object.assign(new Error('The runtime directory must remain inside .chati'), { code: 'UNSAFE_RUNTIME_PATH' });
+  }
+  const target = join(realRuntime, filename);
+  if (existsSync(target)) {
+    const targetStat = lstatSync(target);
+    if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+      throw Object.assign(new Error('The runtime response target must be a regular file'), { code: 'UNSAFE_RUNTIME_PATH' });
+    }
+  }
+  return target;
+}
+
+function captureRuntimePath(projectDir, filename) {
+  const target = ensureRuntimeResponsePath(projectDir, filename);
+  const runtimePath = dirname(target);
+  const opened = openRuntimeDirectoryNoFollow(runtimePath);
+  return {
+    projectDir: resolve(projectDir),
+    target,
+    targetEntry: join(opened.reference, basename(target)),
+    runtimePath,
+    runtimeIdentity: opened.stat,
+    fd: opened.fd,
+    reference: opened.reference,
+  };
+}
+
+function closeRuntimeRecord(record) {
+  if (record?.fd === undefined || record.fd === null) return;
+  closeSync(record.fd);
+  record.fd = null;
+}
+
+function runtimeProcessAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
+}
+
+function finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, canonicalEntry, expectedIdentity) {
+  assertRuntimeDirectoryRecord(runtimeRecord);
+  const claimStat = lstatSync(claimEntry, { bigint: true });
+  const canonicalStat = lstatSync(canonicalEntry, { bigint: true });
+  if (claimStat.isSymbolicLink() || !claimStat.isFile()
+    || canonicalStat.isSymbolicLink() || !canonicalStat.isFile()
+    || !sameRuntimeIdentity(claimStat, expectedIdentity)
+    || !sameRuntimeIdentity(canonicalStat, expectedIdentity)
+    || !sameRuntimeIdentity(claimStat, canonicalStat)
+    || claimStat.nlink !== 2n || canonicalStat.nlink !== 2n) {
+    throw Object.assign(new Error('Runtime request restoration links do not identify one safe file'), { code: 'RUNTIME_REQUEST_CLAIM_CONFLICT' });
+  }
+  unlinkSync(claimEntry);
+  fsyncSync(runtimeRecord.fd);
+  assertRuntimeDirectoryRecord(runtimeRecord);
+  const restored = lstatSync(canonicalEntry, { bigint: true });
+  if (restored.isSymbolicLink() || !restored.isFile()
+    || !sameRuntimeIdentity(restored, expectedIdentity) || restored.nlink !== 1n) {
+    throw Object.assign(new Error('Restored runtime request did not become one canonical link'), { code: 'RUNTIME_REQUEST_CLAIM_CONFLICT' });
+  }
+  return true;
+}
+
+function recoverInterruptedRuntimeClaim(runtimeRecord) {
+  const claimPattern = /^\.claimed-(\d+)-[A-Fa-f0-9-]{36}\.json$/;
+  const claims = readdirSync(runtimeRecord.reference)
+    .map((name) => ({ name, match: name.match(claimPattern) }))
+    .filter((entry) => entry.match);
+  if (claims.length === 0) return false;
+  if (claims.length > 1) {
+    throw Object.assign(new Error('Multiple interrupted runtime request claims require manual reconciliation'), { code: 'RUNTIME_REQUEST_CLAIM_CONFLICT' });
+  }
+  const [{ name, match }] = claims;
+  const claimEntry = join(runtimeRecord.reference, name);
+  const claimStat = lstatSync(claimEntry, { bigint: true });
+  if (claimStat.isSymbolicLink() || !claimStat.isFile()
+    || ![1n, 2n].includes(claimStat.nlink)
+    || claimStat.size > BigInt(RUNTIME_JSON_MAX_BYTES)) {
+    throw Object.assign(new Error('Interrupted runtime claim is not a safe request file'), { code: 'INVALID_RUNTIME_JSON' });
+  }
+  let canonical;
+  try { canonical = lstatSync(runtimeRecord.targetEntry, { bigint: true }); }
+  catch (error) { if (error?.code !== 'ENOENT') throw error; }
+  if (canonical) {
+    if (sameRuntimeIdentity(canonical, claimStat)) {
+      return finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, runtimeRecord.targetEntry, claimStat);
+    }
+  }
+  if (runtimeProcessAlive(Number(match[1]))) {
+    throw Object.assign(new Error('The runtime request is already claimed by a live process'), { code: 'RUNTIME_REQUEST_IN_PROGRESS' });
+  }
+  if (canonical) {
+    throw Object.assign(new Error('A canonical request and interrupted claim coexist'), { code: 'RUNTIME_REQUEST_CLAIM_CONFLICT' });
+  }
+  if (claimStat.nlink !== 1n) {
+    throw Object.assign(new Error('Interrupted runtime claim is not a safe request file'), { code: 'INVALID_RUNTIME_JSON' });
+  }
+  linkSync(claimEntry, runtimeRecord.targetEntry);
+  runRuntimeSecurityTestHook('afterRuntimeClaimRestoreLink', { claimPath: claimEntry, canonicalPath: runtimeRecord.targetEntry });
+  return finalizeRuntimeRequestRestore(runtimeRecord, claimEntry, runtimeRecord.targetEntry, claimStat);
+}
+
+function writePrivateRuntimeJson(runtimeRecord, payload, { preserveExisting = false } = {}) {
+  if (runtimeRecord?.fd === undefined || runtimeRecord?.fd === null
+    || !runtimeRecord?.targetEntry || !runtimeRecord?.reference) {
+    throw Object.assign(new Error('Runtime response persistence requires a pinned runtime directory'), { code: 'UNSAFE_RUNTIME_PATH' });
+  }
+  const temporary = join(runtimeRecord.reference, `.pending-${process.pid}-${randomUUID()}.tmp`);
+  let descriptor;
+  let written;
+  let publicationAttempted = false;
+  let published = false;
+  try {
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    runRuntimeSecurityTestHook('beforeRuntimeResponseWrite', {
+      targetPath: runtimeRecord.target,
+      targetEntry: runtimeRecord.targetEntry,
+      runtimePath: runtimeRecord.runtimePath,
+    });
+    assertRuntimeDirectoryRecord(runtimeRecord);
+
+    let existing;
+    try { existing = lstatSync(runtimeRecord.targetEntry, { bigint: true }); }
+    catch (error) { if (error?.code !== 'ENOENT') throw error; }
+    if (existing) {
+      if (existing.isSymbolicLink() || !existing.isFile() || existing.nlink !== 1n) {
+        throw Object.assign(new Error('The runtime response target must be a regular single-link file'), { code: 'UNSAFE_RUNTIME_PATH' });
+      }
+      if (preserveExisting) return;
+    }
+
+    descriptor = openSync(
+      temporary,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0),
+      0o600,
+    );
+    const bytes = Buffer.from(JSON.stringify(payload));
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(descriptor, bytes, offset, bytes.length - offset);
+    fsyncSync(descriptor);
+    written = fstatSync(descriptor, { bigint: true });
+    if (!written.isFile() || written.nlink !== 1n
+      || (written.mode & 0o777n) !== 0o600n || written.size !== BigInt(bytes.length)) {
+      throw Object.assign(new Error('The temporary runtime response is not a private regular file'), { code: 'UNSAFE_RUNTIME_PATH' });
+    }
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    runRuntimeSecurityTestHook('beforeRuntimeResponseCommit', {
+      targetPath: runtimeRecord.target,
+      targetEntry: runtimeRecord.targetEntry,
+      temporary,
+      runtimePath: runtimeRecord.runtimePath,
+    });
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    if (!sameRuntimeFileSnapshot(fstatSync(descriptor, { bigint: true }), written)) {
+      throw Object.assign(new Error('The temporary runtime response changed before publication'), { code: 'UNSAFE_RUNTIME_PATH' });
+    }
+    publicationAttempted = true;
+    renameSync(temporary, runtimeRecord.targetEntry);
+    const committed = lstatSync(runtimeRecord.targetEntry, { bigint: true });
+    if (committed.isSymbolicLink() || !committed.isFile() || !samePublishedRuntimeFile(committed, written)
+      || !samePublishedRuntimeFile(fstatSync(descriptor, { bigint: true }), written)) {
+      throw Object.assign(new Error('The published runtime response differs from its pinned temporary file'), { code: 'UNSAFE_RUNTIME_PATH' });
+    }
+    fsyncSync(runtimeRecord.fd);
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    published = true;
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+    try { unlinkSync(temporary); } catch { /* preserve primary response result */ }
+    if (publicationAttempted && !published && written) {
+      try {
+        const current = lstatSync(runtimeRecord.targetEntry, { bigint: true });
+        if (current.isFile() && !current.isSymbolicLink() && !sameRuntimeIdentity(current, written)) unlinkSync(runtimeRecord.targetEntry);
+      } catch { /* preserve primary response result */ }
+    }
+  }
+}
+
+function readClaimedRuntimeJson(claim, maxBytes = RUNTIME_JSON_MAX_BYTES) {
+  runRuntimeSecurityTestHook('beforeRuntimeRequestRead', { claimPath: claim.claimPath });
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1 - total));
+    const bytesRead = readSync(claim.fd, buffer, 0, buffer.length, null);
+    if (bytesRead === 0) break;
+    total += bytesRead;
+    if (total > maxBytes) {
+      throw Object.assign(new Error('Runtime JSON exceeds the size limit'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    chunks.push(buffer.subarray(0, bytesRead));
+  }
+  const after = fstatSync(claim.fd, { bigint: true });
+  if (!sameRuntimeIdentity(after, claim.identity)
+    || after.size !== claim.identity.size
+    || after.mtimeNs !== claim.identity.mtimeNs
+    || after.ctimeNs !== claim.identity.ctimeNs) {
+    throw Object.assign(new Error('Runtime JSON changed while it was being read'), { code: 'INVALID_RUNTIME_JSON' });
+  }
+  return JSON.parse(Buffer.concat(chunks, total).toString('utf-8'));
+}
+
+function claimRuntimeRequest(runtimeRecord) {
+  const canonicalPath = runtimeRecord.target;
+  const claimName = `.claimed-${process.pid}-${randomUUID()}.json`;
+  const claim = {
+    canonicalPath,
+    canonicalEntry: runtimeRecord.targetEntry,
+    claimPath: join(runtimeRecord.reference, claimName),
+    claimName,
+    runtimeRecord,
+    fd: null,
+    identity: null,
+  };
+  try {
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    recoverInterruptedRuntimeClaim(runtimeRecord);
+    runRuntimeSecurityTestHook('beforeRuntimeRequestOpen', { canonicalPath, directory: runtimeRecord.runtimePath });
+    claim.fd = openSync(
+      claim.canonicalEntry,
+      constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0),
+    );
+    claim.identity = fstatSync(claim.fd, { bigint: true });
+    if (!claim.identity.isFile() || claim.identity.nlink !== 1n
+      || claim.identity.size > BigInt(RUNTIME_JSON_MAX_BYTES)) {
+      throw Object.assign(new Error('Runtime JSON must be a regular file within the size limit'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    runRuntimeSecurityTestHook('beforeRuntimeClaimRename', { canonicalPath, claimPath: claim.claimPath });
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    renameSync(claim.canonicalEntry, claim.claimPath);
+    fsyncSync(runtimeRecord.fd);
+    const claimedPathStat = lstatSync(claim.claimPath, { bigint: true });
+    if (claimedPathStat.isSymbolicLink() || !claimedPathStat.isFile()
+      || !sameRuntimeIdentity(claimedPathStat, claim.identity)) {
+      throw Object.assign(new Error('Runtime JSON changed while it was being claimed'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    fchmodSync(claim.fd, 0o600);
+    claim.identity = fstatSync(claim.fd, { bigint: true });
+    if ((claim.identity.mode & 0o777n) !== 0o600n) {
+      throw Object.assign(new Error('Runtime JSON permissions could not be restricted'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    return claim;
+  } catch (err) {
+    if (claim.fd !== null) closeSync(claim.fd);
+    err.runtimeClaim = claim;
+    throw err;
+  }
+}
+
+function restoreRuntimeRequest(claim) {
+  if (!claim?.claimPath || !claim.identity) return false;
+  let current;
+  try { current = lstatSync(claim.claimPath, { bigint: true }); }
+  catch (error) { if (error?.code === 'ENOENT') return false; throw error; }
+  if (current.isSymbolicLink() || !current.isFile() || !sameRuntimeIdentity(current, claim.identity)) return false;
+  try {
+    linkSync(claim.claimPath, claim.canonicalEntry);
+  } catch (error) {
+    if (error?.code !== 'EEXIST') throw error;
+    const canonical = lstatSync(claim.canonicalEntry, { bigint: true });
+    if (!sameRuntimeIdentity(canonical, current)) return false;
+    return finalizeRuntimeRequestRestore(claim.runtimeRecord, claim.claimPath, claim.canonicalEntry, claim.identity);
+  }
+  runRuntimeSecurityTestHook('afterRuntimeRequestRestoreLink', { claimPath: claim.claimPath, canonicalPath: claim.canonicalEntry });
+  return finalizeRuntimeRequestRestore(claim.runtimeRecord, claim.claimPath, claim.canonicalEntry, claim.identity);
+}
+
+function consumeRuntimeRequest(claim) {
+  if (!claim?.claimPath || !claim.identity) return true;
+  const current = lstatSync(claim.claimPath, { bigint: true });
+  if (current.isSymbolicLink() || !current.isFile() || !sameRuntimeIdentity(current, claim.identity)) return false;
+  unlinkSync(claim.claimPath);
+  fsyncSync(claim.runtimeRecord.fd);
+  assertRuntimeDirectoryRecord(claim.runtimeRecord);
+  return true;
+}
+
+function scriptExecutionReceiptDigest(receipt) {
+  return createHash('sha256').update(JSON.stringify({
+    schema_version: receipt.schema_version,
+    state: receipt.state,
+    request: receipt.request,
+    result: receipt.result,
+    executed_at: receipt.executed_at,
+    execution_id: receipt.execution_id,
+    project_scope: receipt.project_scope,
+  })).digest('hex');
+}
+
+function persistExecutedRuntimeRequest(runtimeRecord, claim, request, result, executedAt) {
+  assertRuntimeDirectoryRecord(runtimeRecord);
+  const current = lstatSync(claim.claimPath, { bigint: true });
+  if (current.isSymbolicLink() || !current.isFile() || !sameRuntimeIdentity(current, claim.identity)) {
+    throw Object.assign(new Error('The claimed request changed before its execution receipt was persisted'), { code: 'INVALID_RUNTIME_JSON' });
+  }
+  const material = {
+    schema_version: 1,
+    state: 'executed_pending_handoff',
+    request: {
+      kind: 'script', ref: request.ref, id: request.id || request.task || '', title: request.title || '',
+    },
+    result,
+    executed_at: executedAt,
+    execution_id: randomUUID(),
+    project_scope: installationAuthorityProjectScope(runtimeRecord.projectDir),
+  };
+  const proof = signHostAuthorityPayload(material, { domain: SCRIPT_EXECUTION_RECEIPT_DOMAIN });
+  const receipt = {
+    ...material,
+    receipt_digest: scriptExecutionReceiptDigest(material),
+    authority_id: proof.authority_id,
+    signature: proof.signature,
+  };
+  const temporary = join(runtimeRecord.reference, `.executed-${process.pid}-${randomUUID()}.tmp`);
+  const claimBackup = join(runtimeRecord.reference, `.receipt-backup-${process.pid}-${randomUUID()}.tmp`);
+  const originalClaimIdentity = claim.identity;
+  let temporaryDescriptor;
+  let written;
+  let publicationAttempted = false;
+  let published = false;
+  let backupCreated = false;
+  try {
+    const bytes = Buffer.from(JSON.stringify(receipt));
+    temporaryDescriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(temporaryDescriptor, bytes, offset, bytes.length - offset);
+    fsyncSync(temporaryDescriptor);
+    written = fstatSync(temporaryDescriptor, { bigint: true });
+    if (!written.isFile() || written.nlink !== 1n || (written.mode & 0o777n) !== 0o600n
+      || written.size !== BigInt(bytes.length)) {
+      throw Object.assign(new Error('The temporary execution receipt is not a private regular file'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    const beforeRename = lstatSync(claim.claimPath, { bigint: true });
+    if (beforeRename.isSymbolicLink() || !beforeRename.isFile() || !sameRuntimeIdentity(beforeRename, claim.identity)) {
+      throw Object.assign(new Error('The claimed request changed before its execution receipt was committed'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    runRuntimeSecurityTestHook('beforeRuntimeReceiptCommit', { claimPath: claim.claimPath, temporary, runtimePath: runtimeRecord.runtimePath });
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    if (!sameRuntimeFileSnapshot(fstatSync(temporaryDescriptor, { bigint: true }), written)) {
+      throw Object.assign(new Error('The temporary execution receipt changed before publication'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    linkSync(claim.claimPath, claimBackup);
+    backupCreated = true;
+    const backup = lstatSync(claimBackup, { bigint: true });
+    if (backup.isSymbolicLink() || !backup.isFile() || !sameRuntimeIdentity(backup, originalClaimIdentity)
+      || backup.nlink !== 2n) {
+      throw Object.assign(new Error('The original request could not be protected during receipt publication'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    publicationAttempted = true;
+    renameSync(temporary, claim.claimPath);
+    fsyncSync(runtimeRecord.fd);
+    claim.identity = lstatSync(claim.claimPath, { bigint: true });
+    if (!claim.identity.isFile() || claim.identity.isSymbolicLink?.() || !samePublishedRuntimeFile(claim.identity, written)
+      || !samePublishedRuntimeFile(fstatSync(temporaryDescriptor, { bigint: true }), written)) {
+      throw Object.assign(new Error('The execution receipt is not a private regular file'), { code: 'INVALID_RUNTIME_JSON' });
+    }
+    assertRuntimeDirectoryRecord(runtimeRecord);
+    unlinkSync(claimBackup);
+    backupCreated = false;
+    fsyncSync(runtimeRecord.fd);
+    published = true;
+    return receipt;
+  } finally {
+    if (temporaryDescriptor !== undefined) closeSync(temporaryDescriptor);
+    try { unlinkSync(temporary); } catch { /* preserve primary receipt result */ }
+    if (publicationAttempted && !published && backupCreated) {
+      try {
+        const backup = lstatSync(claimBackup, { bigint: true });
+        if (!backup.isSymbolicLink() && backup.isFile() && sameRuntimeIdentity(backup, originalClaimIdentity)) {
+          renameSync(claimBackup, claim.claimPath);
+          claim.identity = lstatSync(claim.claimPath, { bigint: true });
+          fsyncSync(runtimeRecord.fd);
+          backupCreated = false;
+        }
+      } catch { /* preserve primary receipt result */ }
+    }
+    if (backupCreated) {
+      try { unlinkSync(claimBackup); } catch { /* preserve primary receipt result */ }
+    }
+  }
+}
+
+function writeDurableScriptHandoff(path, content) {
+  const directoryPath = dirname(path);
+  const directory = openScriptHandoffDirectoryNoFollow(directoryPath, { create: true });
+  const name = basename(path);
+  if (resolve(path) !== join(directory.absolute, name)) {
+    closeSync(directory.fd);
+    throw Object.assign(new Error('The script handoff target is not canonical'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+  }
+  const temporary = join(directory.reference, `.${name}.${process.pid}.${randomUUID()}.tmp`);
+  const destination = join(directory.reference, name);
+  let descriptor;
+  let written;
+  let publicationAttempted = false;
+  let published = false;
+  try {
+    assertScriptHandoffDirectoryRecord(directory);
+    runRuntimeSecurityTestHook('beforeScriptHandoffTempOpen', { handoffPath: path, temporary, directory: directory.absolute });
+    assertScriptHandoffDirectoryRecord(directory);
+    descriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const bytes = Buffer.from(content);
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(descriptor, bytes, offset, bytes.length - offset);
+    fsyncSync(descriptor);
+    written = fstatSync(descriptor, { bigint: true });
+    if (!written.isFile() || written.nlink !== 1n || (written.mode & 0o777n) !== 0o600n || written.size !== BigInt(bytes.length)) {
+      throw Object.assign(new Error('The temporary script handoff is not a private regular file'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+    }
+    assertScriptHandoffDirectoryRecord(directory);
+    runRuntimeSecurityTestHook('beforeScriptHandoffCommit', { handoffPath: path, temporary, directory: directory.absolute });
+    assertScriptHandoffDirectoryRecord(directory);
+    let existing;
+    try { existing = lstatSync(destination, { bigint: true }); }
+    catch (error) { if (error?.code !== 'ENOENT') throw error; }
+    if (existing && (existing.isSymbolicLink() || !existing.isFile() || existing.nlink !== 1n)) {
+      throw Object.assign(new Error('The script handoff destination must be a regular single-link file'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+    }
+    if (!sameRuntimeFileSnapshot(fstatSync(descriptor, { bigint: true }), written)) {
+      throw Object.assign(new Error('The temporary script handoff changed before publication'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+    }
+    publicationAttempted = true;
+    renameSync(temporary, destination);
+    const committed = lstatSync(destination, { bigint: true });
+    if (committed.isSymbolicLink() || !committed.isFile() || !samePublishedRuntimeFile(committed, written)
+      || !samePublishedRuntimeFile(fstatSync(descriptor, { bigint: true }), written)) {
+      throw Object.assign(new Error('The published script handoff differs from its pinned temporary file'), { code: 'UNSAFE_SCRIPT_HANDOFF_PATH' });
+    }
+    fsyncSync(directory.fd);
+    assertScriptHandoffDirectoryRecord(directory);
+    published = true;
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+    try { unlinkSync(temporary); } catch { /* preserve primary handoff result */ }
+    if (publicationAttempted && !published && written) {
+      try {
+        const current = lstatSync(destination, { bigint: true });
+        if (current.isFile() && !current.isSymbolicLink() && !sameRuntimeIdentity(current, written)) unlinkSync(destination);
+      } catch { /* preserve primary handoff result */ }
+    }
+    closeSync(directory.fd);
+  }
+}
+
+function isExecutedScriptReceipt(projectDir, value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || value.schema_version !== 1 || value.state !== 'executed_pending_handoff'
+    || typeof value.executed_at !== 'string' || typeof value.receipt_digest !== 'string'
+    || typeof value.execution_id !== 'string' || !/^[a-f0-9-]{36}$/i.test(value.execution_id)
+    || typeof value.authority_id !== 'string' || typeof value.signature !== 'string'
+    || !value.result || typeof value.result !== 'object' || Array.isArray(value.result)) return false;
+  if (!validateScriptRequestSchema(value.request)) return false;
+  try {
+    const expectedScope = installationAuthorityProjectScope(projectDir);
+    if (JSON.stringify(value.project_scope) !== JSON.stringify(expectedScope)
+      || value.receipt_digest !== scriptExecutionReceiptDigest(value)) return false;
+    return verifyHostAuthorityPayload({
+      schema_version: value.schema_version,
+      state: value.state,
+      request: value.request,
+      result: value.result,
+      executed_at: value.executed_at,
+      execution_id: value.execution_id,
+      project_scope: value.project_scope,
+    }, {
+      domain: SCRIPT_EXECUTION_RECEIPT_DOMAIN,
+      authorityId: value.authority_id,
+      signature: value.signature,
+    });
+  } catch {
+    return false;
+  }
+}
+
+function validateScriptRequestSchema(request) {
+  if (!request || typeof request !== 'object' || Array.isArray(request)) return false;
+  if (typeof request.kind !== 'string' || typeof request.ref !== 'string') return false;
+  if (request.kind === 'script'
+    && (typeof request.id !== 'string' || typeof request.title !== 'string')) return false;
+  return true;
+}
+
+function scriptRequestError(code, error) {
+  return { ran: false, status: 'error', code, error, reason: error };
+}
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -87,7 +770,7 @@ const RESUME_MESSAGES = {
   en: 'Session saved. Type /chati anytime to resume.',
   pt: 'Sessão salva. Digite /chati para retomar.',
   es: 'Sesión guardada. Escribe /chati para reanudar.',
-  fr: 'Session sauvee. Tapez /chati pour reprendre.',
+  fr: 'Session sauvée. Tapez /chati pour reprendre.',
 };
 
 function getRuntimeAgentPipeline(projectDir, session = null) {
@@ -573,17 +1256,22 @@ function sessionToPipelineState(session, projectDir) {
  */
 export function buildSpawnCommand(agent, projectDir, previousAgent, provider, timeout, model = null, strictProvider = false, routing = {}) {
   if (!provider) throw new Error('A routed provider is required to build an agent spawn command');
+  const taskId = routing.task_id || `${agent}-task`;
   const parts = [
-    'node', RUNNER('run-agent.js'),
-    '--agent', agent,
-    '--task-id', `${agent}-task`,
-    '--project-dir', JSON.stringify(resolve(projectDir)),
-    '--previous-agent', previousAgent || 'none',
-    '--provider', provider,
-    ...(model ? ['--model', model] : []),
-    ...(routing.provider_id ? ['--provider-id', routing.provider_id] : []),
-    ...(routing.reasoning_configuration ? ['--reasoning-configuration', routing.reasoning_configuration] : []),
-    ...(routing.catalog_snapshot_ref ? ['--catalog-snapshot-ref', routing.catalog_snapshot_ref] : []),
+    'node', shellQuote(RUNNER('run-agent.js')),
+    '--agent', shellQuote(agent),
+    '--task-id', shellQuote(taskId),
+    '--project-dir', shellQuote(resolve(projectDir)),
+    '--previous-agent', shellQuote(previousAgent || 'none'),
+    '--provider', shellQuote(provider),
+    ...(model ? ['--model', shellQuote(model)] : []),
+    ...(routing.provider_id ? ['--provider-id', shellQuote(routing.provider_id)] : []),
+    ...(routing.reasoning_configuration ? ['--reasoning-configuration', shellQuote(routing.reasoning_configuration)] : []),
+    ...(routing.catalog_snapshot_ref ? ['--catalog-snapshot-ref', shellQuote(routing.catalog_snapshot_ref)] : []),
+    ...(routing.additional_context_file ? ['--additional-context-file', shellQuote(routing.additional_context_file)] : []),
+    ...(routing.interaction_id ? ['--interaction-id', shellQuote(routing.interaction_id)] : []),
+    ...(routing.reasoning_escalation ? ['--reasoning-escalation'] : []),
+    ...(routing.execution_claim_id ? ['--execution-claim-id', shellQuote(routing.execution_claim_id)] : []),
     ...(strictProvider ? ['--strict-provider'] : []),
     '--timeout', String(timeout || 600000),
   ];
@@ -598,13 +1286,13 @@ export function buildParallelSpawnCommand(agents, projectDir, previousAgent, pro
   if (!provider) throw new Error('A routed provider is required to build a parallel spawn command');
   const taskIds = agents.map(a => `${a}-task`).join(',');
   const parts = [
-    'node', RUNNER('run-parallel.js'),
-    '--agents', agents.join(','),
-    '--task-ids', taskIds,
-    '--project-dir', JSON.stringify(resolve(projectDir)),
-    '--previous-agent', previousAgent || 'none',
-    '--provider', provider,
-    ...(model ? ['--model', model] : []),
+    'node', shellQuote(RUNNER('run-parallel.js')),
+    '--agents', shellQuote(agents.join(',')),
+    '--task-ids', shellQuote(taskIds),
+    '--project-dir', shellQuote(resolve(projectDir)),
+    '--previous-agent', shellQuote(previousAgent || 'none'),
+    '--provider', shellQuote(provider),
+    ...(model ? ['--model', shellQuote(model)] : []),
     ...(strictProvider ? ['--strict-provider'] : []),
     '--timeout', String(timeout || 900000),
   ];
@@ -681,6 +1369,26 @@ export function resolveAgentModel(agent, projectDir) {
   return defaults;
 }
 
+function resolveAdjudicationModel(projectDir, fallbackBinding = {}) {
+  const artifact = loadRuntimeInstallationV2(projectDir);
+  if (artifact) {
+    const invocation = resolveRuntimeAdjudicationV2({ artifact });
+    return {
+      provider: invocation.harness_id,
+      provider_id: invocation.provider_id,
+      model: invocation.model_pin.model_id,
+      reasoning_configuration: invocation.model_pin.reasoning_configuration,
+      catalog_snapshot_ref: invocation.model_pin.catalog_snapshot_ref,
+      source: 'installation-v2-adjudication',
+    };
+  }
+  return {
+    ...fallbackBinding,
+    reasoning_configuration: fallbackBinding.reasoning_configuration || 'high',
+    source: 'legacy-explicit-adjudication',
+  };
+}
+
 /**
  * Estimate context bracket from pipeline progress.
  */
@@ -719,7 +1427,7 @@ function sessionLockTargets(projectDir) {
     orchestratorPath: existsSync(join(projectDir, frameworkDir, '.adapted', target.provider, 'orchestrator', 'chati.md'))
       ? `${frameworkDir}/.adapted/${target.provider}/orchestrator/chati.md`
       : `${frameworkDir}/orchestrator/chati.md`,
-  })).filter(({ provider, path }) => enabled.has(provider) && existsSync(path));
+  })).filter(({ provider }) => enabled.has(provider));
 }
 
 function removeLegacyPauseSection(content) {
@@ -732,64 +1440,291 @@ function removeLegacyPauseSection(content) {
   return clean;
 }
 
-function writeSessionLock(projectDir, currentAgent, stateInfo = {}) {
+function nativeLockFailure(code, message) {
+  throw Object.assign(new Error(message), { code });
+}
 
-  // Phase display is authoritatively driven by session.mode on disk. Callers
-  // previously passed stateInfo.phase derived from transient intermediate
-  // values (the next agent's expected phase before user approval), causing
-  // the lock to drift ahead of session.yaml (e.g. show "build" while
-  // session.mode was still "plan" awaiting approval).
-  let authoritativePhase = null;
+function nativeLockSnapshot(stat) {
+  return Object.freeze({
+    dev: stat.dev, ino: stat.ino, mode: stat.mode, uid: stat.uid, gid: stat.gid,
+  });
+}
+
+function sameNativeLockSnapshot(left, right) {
+  return Boolean(left && right && Object.keys(left).every((key) => left[key] === right[key]));
+}
+
+function closeNativeLockStorage(storage) {
+  for (const descriptor of [...(storage?.descriptors ?? [])].reverse()) {
+    try { closeSync(descriptor); } catch { /* preserve primary projection result */ }
+  }
+}
+
+function openWorkingDirectoryAnchor(absolute) {
+  if (process.platform !== 'linux') return null;
+  let descriptor;
   try {
-    const { loaded, session } = loadSession(projectDir);
-    if (loaded && session?.mode) authoritativePhase = session.mode;
-  } catch { /* non-fatal — fall back to stateInfo */ }
+    descriptor = openSync('.', constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+    const workingDirectory = realpathSync(`/proc/self/fd/${descriptor}`);
+    const targetRelative = relative(workingDirectory, absolute);
+    if (targetRelative === '..' || targetRelative.startsWith(`..${sep}`) || isAbsolute(targetRelative)) {
+      closeSync(descriptor);
+      return null;
+    }
+    return Object.freeze({ descriptor, segments: targetRelative.split(sep).filter(Boolean) });
+  } catch {
+    if (descriptor !== undefined) closeSync(descriptor);
+    return null;
+  }
+}
 
-  const stateInner = `## Current State
-- **Agent**: ${currentAgent || 'None'}
-- **Phase**: ${authoritativePhase || stateInfo.phase || 'discover'}
-- **Pipeline**: ${stateInfo.position ?? 0}/${stateInfo.total ?? '?'} (${stateInfo.progress ?? 0}%)
-- **Mode**: ${stateInfo.mode || 'interactive'}`;
+function openNativeLockStorage(projectDir, targetPath) {
+  if (process.platform !== 'linux') {
+    return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock projection requires Linux descriptor-relative storage');
+  }
+  const project = resolve(projectDir);
+  const target = resolve(targetPath);
+  const targetRelative = relative(project, target);
+  if (!targetRelative || targetRelative === '..' || targetRelative.startsWith(`..${sep}`) || isAbsolute(targetRelative)) {
+    return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock target must remain inside the project');
+  }
+  const parent = dirname(target);
+  const root = parse(parent).root;
+  const workingDirectoryAnchor = openWorkingDirectoryAnchor(project);
+  const parentRelative = relative(project, parent);
+  const anchor = workingDirectoryAnchor;
+  const segments = anchor
+    ? [...anchor.segments, ...parentRelative.split(sep).filter(Boolean)]
+    : parent.slice(root.length).split(sep).filter(Boolean);
+  const descriptors = [];
+  const snapshots = [];
+  try {
+    let descriptor;
+    try {
+      descriptor = anchor
+        ? openSync(`/proc/self/fd/${anchor.descriptor}`, constants.O_RDONLY | (constants.O_DIRECTORY || 0))
+        : openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+    } finally {
+      if (anchor) closeSync(anchor.descriptor);
+    }
+    descriptors.push(descriptor);
+    snapshots.push(nativeLockSnapshot(fstatSync(descriptor)));
+    for (const segment of segments) {
+      descriptor = openSync(
+        join(`/proc/self/fd/${descriptor}`, segment),
+        constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0),
+      );
+      const stat = fstatSync(descriptor);
+      if (!stat.isDirectory()) return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock directory chain must contain only real directories');
+      descriptors.push(descriptor);
+      snapshots.push(nativeLockSnapshot(stat));
+    }
+    return Object.freeze({
+      project, target, name: basename(target), parent,
+      descriptor: descriptors.at(-1), descriptors: Object.freeze(descriptors), snapshots: Object.freeze(snapshots),
+    });
+  } catch (error) {
+    closeNativeLockStorage({ descriptors });
+    if (error?.code === 'UNSAFE_NATIVE_LOCK_PATH') throw error;
+    return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', `native lock directory cannot be pinned: ${error.message}`);
+  }
+}
 
-  for (const target of sessionLockTargets(projectDir)) {
-    let content = removeLegacyPauseSection(existsSync(target.path) ? readFileSync(target.path, 'utf-8') : '');
-    const lockInner = `## Session Lock: ACTIVE
+function assertNativeLockStorage(storage) {
+  let current;
+  try {
+    current = openNativeLockStorage(storage.project, storage.target);
+    if (current.snapshots.length !== storage.snapshots.length
+      || current.snapshots.some((snapshot, index) => !sameNativeLockSnapshot(snapshot, storage.snapshots[index]))) {
+      return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock directory chain changed during projection');
+    }
+    for (const [index, descriptor] of storage.descriptors.entries()) {
+      if (!sameNativeLockSnapshot(nativeLockSnapshot(fstatSync(descriptor)), storage.snapshots[index])) {
+        return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'pinned native lock directory changed during projection');
+      }
+    }
+  } finally { closeNativeLockStorage(current); }
+  return undefined;
+}
 
-**Chati.dev session is ACTIVE.** Follow these rules for EVERY message:
+function readHarnessProjection(storage) {
+  const reference = join(`/proc/self/fd/${storage.descriptor}`, storage.name);
+  let descriptor;
+  try {
+    const pathStat = lstatSync(reference, { bigint: true });
+    if (pathStat.isSymbolicLink()) return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock must not be a symlink');
+    descriptor = openSync(reference, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    const before = fstatSync(descriptor, { bigint: true });
+    if (!before.isFile() || before.nlink !== 1n) return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock must be a single-link regular file');
+    if (before.size > NATIVE_LOCK_MAX_BYTES_BIGINT) return nativeLockFailure('NATIVE_LOCK_SIZE_LIMIT', 'native lock exceeds the 256 KiB safety limit');
+    const bytes = Buffer.alloc(Number(before.size));
+    let offset = 0;
+    while (offset < bytes.length) {
+      const count = readSync(descriptor, bytes, offset, bytes.length - offset, offset);
+      if (count === 0) break;
+      offset += count;
+    }
+    const after = fstatSync(descriptor, { bigint: true });
+    const finalPath = lstatSync(reference, { bigint: true });
+    const snapshot = (stat) => ({
+      dev: stat.dev, ino: stat.ino, mode: stat.mode, uid: stat.uid, gid: stat.gid,
+      nlink: stat.nlink, size: stat.size, mtimeNs: stat.mtimeNs, ctimeNs: stat.ctimeNs,
+    });
+    const initial = snapshot(before);
+    if (offset !== bytes.length || !sameNativeLockSnapshot(initial, snapshot(after))
+      || !sameNativeLockSnapshot(initial, snapshot(finalPath))) {
+      return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock changed while being read');
+    }
+    return Object.freeze({ content: bytes.toString('utf8'), snapshot: initial });
+  } catch (error) {
+    if (['UNSAFE_NATIVE_LOCK_PATH', 'NATIVE_LOCK_SIZE_LIMIT'].includes(error?.code)) throw error;
+    return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', `native lock cannot be read safely: ${error.message}`);
+  } finally { if (descriptor !== undefined) closeSync(descriptor); }
+}
 
-1. Read \`${target.orchestratorPath}\` and follow its routing logic
-2. Route ALL user messages through the current agent: \`${currentAgent}\`
-3. NEVER respond outside of the Chati.dev system
-4. The ONLY way to exit is via \`${target.invocation} exit\`, \`${target.invocation} stop\`, or \`${target.invocation} quit\``;
-    content = replaceBlock(content, LOCK_START, LOCK_END, lockInner);
-    content = replaceBlock(content, STATE_START, STATE_END, stateInner);
-    writeFileSync(target.path, content.trimEnd() + '\n', 'utf-8');
+function writeHarnessProjectionAtomic(storage, content, expected) {
+  const reference = `/proc/self/fd/${storage.descriptor}`;
+  const temporaryName = `.${storage.name}.${process.pid}.${randomUUID()}.tmp`;
+  const temporary = join(reference, temporaryName);
+  const destination = join(reference, storage.name);
+  let descriptor;
+  let replaced = false;
+  try {
+    if (Buffer.byteLength(content, 'utf8') > NATIVE_LOCK_MAX_BYTES) {
+      return nativeLockFailure('NATIVE_LOCK_SIZE_LIMIT', 'projected native lock exceeds the 256 KiB safety limit');
+    }
+    descriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const bytes = Buffer.from(content, 'utf8');
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(descriptor, bytes, offset, bytes.length - offset, null);
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = undefined;
+    assertNativeLockStorage(storage);
+    const current = lstatSync(destination, { bigint: true });
+    const currentSnapshot = {
+      dev: current.dev, ino: current.ino, mode: current.mode, uid: current.uid, gid: current.gid,
+      nlink: current.nlink, size: current.size, mtimeNs: current.mtimeNs, ctimeNs: current.ctimeNs,
+    };
+    if (current.isSymbolicLink() || !sameNativeLockSnapshot(currentSnapshot, expected)) {
+      return nativeLockFailure('UNSAFE_NATIVE_LOCK_PATH', 'native lock changed before atomic replacement');
+    }
+    renameSync(temporary, destination);
+    replaced = true;
+    fsyncSync(storage.descriptor);
+  } catch (error) {
+    if (replaced) error.nativeLockCommitted = true;
+    throw error;
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+    rmSync(temporary, { force: true });
   }
+  return undefined;
 }
 
-/**
- * Remove session lock blocks from every enabled harness's native local file.
- */
-function removeSessionLock(projectDir, resumeMsg) {
-  const stateInner = `## Current State
+function projectSessionLocks(projectDir, { resumeMsg = null } = {}) {
+  return withSessionProjectionLock(projectDir, (session) => {
+    const active = session.session_status !== 'paused' && Boolean(session.current_agent);
+    const pipeline = getRuntimeAgentPipeline(projectDir, session);
+    const completed = Array.isArray(session.completed_agents) ? session.completed_agents.length : 0;
+    const progress = pipeline.length > 0 ? Math.round((completed / pipeline.length) * 100) : 0;
+    const stateInner = active
+      ? `## Current State
+- **Agent**: ${session.current_agent}
+- **Phase**: ${session.mode || 'discover'}
+- **Pipeline**: ${completed}/${pipeline.length || '?'} (${progress}%)
+- **Mode**: ${session.execution_mode || 'interactive'}`
+      : `## Current State
 - **Agent**: None (ready to start)
 - **Pipeline**: Pre-start
 - **Mode**: interactive`;
 
-  for (const target of sessionLockTargets(projectDir)) {
-    let content = removeLegacyPauseSection(existsSync(target.path) ? readFileSync(target.path, 'utf-8') : '');
-    const lockInner = `## Session Lock
+    const prepared = [];
+    try {
+      // Validate and render every enabled harness before replacing any file.
+      // A missing or unsafe target therefore cannot leave a partial projection.
+      for (const target of sessionLockTargets(projectDir)) {
+        const storage = openNativeLockStorage(projectDir, target.path);
+        prepared.push({ target, storage, committed: false });
+        const source = readHarnessProjection(storage);
+        let content = removeLegacyPauseSection(source.content);
+        const lockInner = active
+          ? `## Session Lock: ACTIVE
+
+**Chati.dev session is ACTIVE.** Follow these rules for EVERY message:
+
+1. Read \`${target.orchestratorPath}\` and follow its routing logic
+2. Route ALL user messages through the current agent: \`${session.current_agent}\`
+3. NEVER respond outside of the Chati.dev system
+4. The ONLY way to exit is via \`${target.invocation} exit\`, \`${target.invocation} stop\`, or \`${target.invocation} quit\``
+          : `## Session Lock
 **Status: INACTIVE**: Type \`${target.invocation}\` to activate.`;
-    content = replaceBlock(content, LOCK_START, LOCK_END, lockInner);
-    content = replaceBlock(content, STATE_START, STATE_END, stateInner);
+        content = replaceBlock(content, LOCK_START, LOCK_END, lockInner);
+        content = replaceBlock(content, STATE_START, STATE_END, stateInner);
+        if (!active && resumeMsg) {
+          const providerMessage = resumeMsg.replaceAll('/chati', target.invocation);
+          const pauseBlock = `${PAUSE_START}\n## Session Paused\n\n${providerMessage}\n${PAUSE_END}`;
+          content = `${content.trimEnd()}\n\n${pauseBlock}\n`;
+        }
+        prepared.at(-1).source = source;
+        prepared.at(-1).content = `${content.trimEnd()}\n`;
+      }
 
-    if (resumeMsg) {
-      const providerMessage = resumeMsg.replaceAll('/chati', target.invocation);
-      const pauseBlock = `${PAUSE_START}\n## Session Paused\n\n${providerMessage}\n${PAUSE_END}`;
-      content = content.trimEnd() + `\n\n${pauseBlock}\n`;
+      for (const entry of prepared) {
+        runRuntimeSecurityTestHook('beforeNativeLockReplacement', { target: entry.target.path });
+        try {
+          writeHarnessProjectionAtomic(entry.storage, entry.content, entry.source.snapshot);
+          entry.committed = true;
+        } catch (error) {
+          if (error.nativeLockCommitted) entry.committed = true;
+          throw error;
+        }
+      }
+      return Object.freeze({
+        active,
+        projected: Object.freeze(prepared.map(({ target }) => target.path)),
+      });
+    } catch (error) {
+      const rollbackErrors = [];
+      for (const entry of [...prepared].reverse()) {
+        if (!entry.committed || !entry.source) continue;
+        try {
+          const current = readHarnessProjection(entry.storage);
+          if (current.content !== entry.content) {
+            throw Object.assign(
+              new Error('native lock changed after this projection committed'),
+              { code: 'NATIVE_LOCK_ROLLBACK_CONFLICT' },
+            );
+          }
+          writeHarnessProjectionAtomic(entry.storage, entry.source.content, current.snapshot);
+        } catch (rollbackError) {
+          rollbackErrors.push(`${entry.target.path}: ${rollbackError.message}`);
+        }
+      }
+      if (rollbackErrors.length > 0) {
+        throw Object.assign(
+          new Error(`Native lock projection failed (${error.message}) and rollback was incomplete: ${rollbackErrors.join('; ')}`),
+          { code: 'NATIVE_LOCK_ROLLBACK_FAILED', cause: error },
+        );
+      }
+      throw error;
+    } finally {
+      for (const entry of prepared) closeNativeLockStorage(entry.storage);
     }
-    writeFileSync(target.path, content.trimEnd() + '\n', 'utf-8');
-  }
+  });
+}
+
+function writeSessionLock(projectDir, currentAgent, stateInfo = {}) {
+  void currentAgent;
+  void stateInfo;
+  return projectSessionLocks(projectDir);
+}
+
+/**
+ * Remove session lock blocks from every enabled harness's native local file.
+ */
+function removeSessionLock(projectDir, resumeMsg) {
+  return projectSessionLocks(projectDir, { resumeMsg });
 }
 
 // ---------------------------------------------------------------------------
@@ -798,50 +1733,148 @@ function removeSessionLock(projectDir, resumeMsg) {
 
 async function handleNext(projectDir) {
   const result = await _handleNextInner(projectDir);
-
-  // Fase 8: attach state-at-a-glance card to every non-error response.
-  // The card renders as a JSON string field; the terminal / orchestrator
-  // prompt can console.log it verbatim. Silent on setup/error responses
-  // so a missing session does not produce a misleading card.
-  if (result && result.action !== 'setup' && result.action !== 'error') {
-    try {
-      const { session } = loadSession(projectDir);
-      if (session) {
-        result.state_card = buildStateCard({ session, projectDir });
+  let dispatchMutation = null;
+
+  // The canonical session owns the active task. Native harness lock files are
+  // projections only, so a CLI switch cannot create a second execution.
+  // Persist only actions that actually dispatch an agent. Surface holds and
+  // RAIL handoffs are control-plane responses, not running pipeline agents.
+  const dispatchActions = new Set([
+    'spawn_routed_interactive',
+    'spawn_autonomous',
+    'spawn_parallel',
+    'spawn_team',
+  ]);
+  if (result?.agent && dispatchActions.has(result.action)) {
+    const binding = result.model_info ? {
+      provider: result.model_info.provider || null,
+      provider_id: result.model_info.provider_id || null,
+      model: result.model_info.model || null,
+      reasoning_configuration: result.model_info.reasoning_configuration || null,
+      catalog_snapshot_ref: result.model_info.catalog_snapshot_ref || null,
+    } : null;
+    if (result.model_info?.source === 'installation-v2') {
+      const dispatchedAgents = Array.isArray(result.parallel_spawn_commands) && result.parallel_spawn_commands.length > 0
+        ? result.parallel_spawn_commands.map((entry) => ({ agent: entry.agent, binding: entry.agent === result.agent ? binding : null }))
+        : [{ agent: result.agent, binding }];
+      const claimed = claimAgentExecutions(projectDir, dispatchedAgents);
+      if (!claimed.saved) {
+        return errorResult(`Could not persist canonical agent state: ${claimed.error}`, 'SESSION_WRITE_FAILED');
       }
-    } catch { /* non-fatal — card is UX sugar */ }
+      if (!claimed.claimed) {
+        return {
+          action: 'agent_execution_in_flight',
+          agent: claimed.agent || result.agent,
+          code: claimed.code || 'AGENT_EXECUTION_IN_FLIGHT',
+          status_summary: claimed.error || `Agent ${result.agent} is already executing in another CLI.`,
+        };
+      }
+      dispatchMutation = {
+        expectedAgent: result.agent,
+        claims: claimed.claims,
+        previous: claimed.previous,
+      };
+      if (result.spawn_command && claimed.claims[result.agent]) {
+        result.spawn_command += ` --execution-claim-id ${shellQuote(claimed.claims[result.agent])}`;
+      }
+      if (Array.isArray(result.parallel_spawn_commands)) {
+        result.parallel_spawn_commands = result.parallel_spawn_commands.map((entry) => ({
+          ...entry,
+          command: `${entry.command} --execution-claim-id ${shellQuote(claimed.claims[entry.agent])}`,
+        }));
+      }
+      result.execution_claim_id = claimed.claims[result.agent] || null;
+    } else {
+      const persisted = activateAgentExecutionState(projectDir, {
+        agent: result.agent,
+        binding,
+      });
+      if (!persisted.saved) {
+        return errorResult(`Could not persist canonical agent state: ${persisted.error}`, 'SESSION_WRITE_FAILED');
+      }
+      dispatchMutation = {
+        expectedAgent: result.agent,
+        previous: persisted.previous,
+      };
+    }
   }
 
   // Centralized session lock update: applies to ALL return paths.
   // Activates lock when an agent is returned, deactivates on completion.
   if (result && result.agent && result.action !== 'error' && result.action !== 'setup') {
-    const activating = ['activate_interactive', 'spawn_routed_interactive', 'spawn_autonomous', 'spawn_team', 'spawn_parallel'];
+    const activating = ['activate_interactive', 'spawn_routed_interactive', 'spawn_autonomous', 'spawn_team', 'spawn_parallel', 'resume_pending_interaction'];
     if (activating.includes(result.action)) {
+      let projection;
       try {
         const runtimePipeline = getRuntimeAgentPipeline(projectDir, result.session);
-        writeSessionLock(projectDir, result.agent, {
+        projection = writeSessionLock(projectDir, result.agent, {
           phase: result.phase || 'discover',
           mode: result.session?.execution_mode || 'interactive',
           position: result.pipeline_progress?.completedAgents?.length ?? 0,
           total: runtimePipeline.length,
           progress: result.pipeline_progress?.progress ?? 0,
         });
-      } catch { /* non-fatal */ }
+      } catch (error) {
+        projection = { projected: false, error: error.message, code: error.code };
+      }
+      if (!projection.projected) {
+        if (dispatchMutation) {
+          const rollback = rollbackAgentDispatch(projectDir, dispatchMutation);
+          if (!rollback.saved || !rollback.rolledBack) {
+            return errorResult(
+              `Native session lock projection failed (${projection.error}); canonical rollback also failed: ${rollback.error}`,
+              rollback.code || 'SESSION_PROJECTION_ROLLBACK_FAILED',
+            );
+          }
+        }
+        return errorResult(
+          `Native session lock projection failed: ${projection.error}`,
+          projection.code || 'SESSION_PROJECTION_FAILED',
+        );
+      }
     }
   } else if (result && result.action === 'complete') {
+    let projection;
     try {
       const { session } = loadSession(projectDir);
       const lang = session?.language || 'en';
-      removeSessionLock(projectDir, RESUME_MESSAGES[lang] || RESUME_MESSAGES.en);
-    } catch { /* non-fatal */ }
+      projection = removeSessionLock(projectDir, RESUME_MESSAGES[lang] || RESUME_MESSAGES.en);
+    } catch (error) {
+      projection = { projected: false, error: error.message, code: error.code };
+    }
+    if (!projection.projected) {
+      return errorResult(
+        `Native session lock projection failed: ${projection.error}`,
+        projection.code || 'SESSION_PROJECTION_FAILED',
+      );
+    }
+  }
+
+  if (dispatchMutation) {
+    recordEvent(projectDir, EventType.AGENT_ACTIVATED, result.agent, { action: result.action, phase: result.phase });
+  }
+
+  // Fase 8: attach state-at-a-glance card after canonical state and every
+  // enabled native projection have committed successfully.
+  if (result && result.action !== 'setup' && result.action !== 'error') {
+    try {
+      const { session } = loadSession(projectDir);
+      if (session) result.state_card = buildStateCard({ session, projectDir });
+    } catch { /* non-fatal — card is UX sugar */ }
   }
 
   return result;
 }
 
 async function _handleNextInner(projectDir) {
-  const { loaded, session } = loadSession(projectDir);
+  const { loaded, session, error } = loadSession(projectDir);
   if (!loaded || !session) {
+    if (!['Session file not found', 'Session directory not found'].includes(error)) {
+      const code = error?.includes('Timed out waiting for session write lock')
+        ? 'SESSION_WRITE_FAILED'
+        : 'INVALID_SESSION_PATH';
+      return errorResult(`Cannot load session safely: ${error}`, code);
+    }
     return { action: 'setup', status_summary: 'No session found. Project needs initialization.' };
   }
 
@@ -852,6 +1885,146 @@ async function _handleNextInner(projectDir) {
 
   const installationV2 = loadRuntimeInstallationV2(projectDir);
   const runtimePipeline = getRuntimeAgentPipeline(projectDir, session);
+
+  const pending = session.pending_interaction;
+  if (pending?.status === 'relay_in_flight') {
+    const relayStartedAt = Date.parse(pending.relay_started_at || '');
+    const explicitLeaseExpiry = Date.parse(pending.relay_lease_expires_at || '');
+    const relayLeaseExpired = Number.isFinite(explicitLeaseExpiry)
+      ? Date.now() >= explicitLeaseExpiry
+      : Number.isFinite(relayStartedAt) && Date.now() - relayStartedAt > 25 * 60 * 1000;
+    if (relayLeaseExpired) {
+      const recovered = releasePendingInteraction(projectDir, {
+        interactionId: pending.interaction_id || null,
+        claimId: pending.relay_claim_id || null,
+      });
+      if (!recovered.saved || (!recovered.released && !recovered.settled)) {
+        return errorResult(`Could not recover stale pending relay: ${recovered.error || 'ownership mismatch'}`, 'SESSION_WRITE_FAILED');
+      }
+      return _handleNextInner(projectDir);
+    }
+    return {
+      action: 'pending_interaction_in_flight',
+      agent: pending.agent,
+      interaction_id: pending.interaction_id || null,
+      relay_cycles: pending.relay_cycles || 1,
+      wait_for_user: false,
+      spawn_command: null,
+      deferred_spawn_command: null,
+      session: { language: session.language, active_harness: session.active_harness },
+      status_summary: `The response for ${pending.agent} is already being relayed by another process.`,
+    };
+  }
+  if (pending?.status === 'waiting_for_user' && pending.agent && pending.question) {
+    if ((pending.relay_cycles || 1) > 3) {
+      const originalBinding = pending.execution_binding || session.current_execution_binding || resolveAgentModel(pending.agent, projectDir);
+      const identity = ensurePendingInteractionIdentity(projectDir, originalBinding);
+      if (!identity.saved || !identity.interactionId) {
+        return errorResult(`Could not identify pending interaction: ${identity.error || 'unknown error'}`, 'SESSION_WRITE_FAILED');
+      }
+      const adjudicationBinding = resolveAdjudicationModel(projectDir, originalBinding);
+      let contextFile;
+      let contextRuntime;
+      try {
+        contextRuntime = captureRuntimePath(projectDir, `pending-adjudication-${identity.interactionId}.json`);
+        writePrivateRuntimeJson(contextRuntime, {
+          response: `Reasoning escalation after three unresolved relays. Review the pending interaction and its project context. Resolve the issue technically when safe. Ask the user only if authority, product intent, or unavailable information is strictly required. Pending question: ${pending.question}`,
+        });
+        contextFile = contextRuntime.target;
+      } catch (error) {
+        return errorResult(error.message, error.code || 'UNSAFE_RUNTIME_PATH');
+      } finally {
+        closeRuntimeRecord(contextRuntime);
+      }
+      const spawnCommand = buildSpawnCommand(
+        pending.agent,
+        projectDir,
+        session.last_handoff || 'none',
+        adjudicationBinding.provider,
+        600000,
+        adjudicationBinding.model,
+        true,
+        {
+          ...adjudicationBinding,
+          task_id: pending.task_id,
+          interaction_id: identity.interactionId,
+          additional_context_file: contextFile,
+          reasoning_escalation: true,
+        },
+      );
+      return {
+        action: 'pending_interaction_escalation_required',
+        agent: pending.agent,
+        question: pending.question,
+        interaction_id: identity.interactionId,
+        relay_cycles: pending.relay_cycles || 3,
+        wait_for_user: false,
+        spawn_command: spawnCommand,
+        deferred_spawn_command: null,
+        model_info: adjudicationBinding,
+        escalation_required: true,
+        session: { language: session.language, active_harness: session.active_harness },
+        status_summary: 'Interactive relay limit reached. Apply the configured reasoning escalation.',
+      };
+    }
+    const binding = pending.execution_binding || session.current_execution_binding || resolveAgentModel(pending.agent, projectDir);
+    const identity = ensurePendingInteractionIdentity(projectDir, binding);
+    if (!identity.saved || !identity.interactionId) {
+      return errorResult(`Could not identify pending interaction: ${identity.error || 'unknown error'}`, 'SESSION_WRITE_FAILED');
+    }
+    let responseFile;
+    let responseRuntime;
+    try {
+      responseRuntime = captureRuntimePath(projectDir, `pending-response-${identity.interactionId}.json`);
+      writePrivateRuntimeJson(responseRuntime, { response: '' }, { preserveExisting: true });
+      responseFile = responseRuntime.target;
+    } catch (error) {
+      return errorResult(error.message, error.code || 'UNSAFE_RUNTIME_PATH');
+    } finally {
+      closeRuntimeRecord(responseRuntime);
+    }
+    const agentDef = getAgentDefinition(pending.agent);
+    const deferredSpawnCommand = buildSpawnCommand(
+      pending.agent,
+      projectDir,
+      session.last_handoff || 'none',
+      binding.provider,
+      600000,
+      binding.model,
+      true,
+      {
+        ...binding,
+        task_id: pending.task_id,
+        interaction_id: identity.interactionId,
+        additional_context_file: responseFile,
+      },
+    );
+    return {
+      action: 'resume_pending_interaction',
+      agent: pending.agent,
+      agent_file: getAgentFile(pending.agent, projectDir) || null,
+      phase: agentDef?.phase || session.mode,
+      question: pending.question,
+      relay_cycles: pending.relay_cycles || 1,
+      wait_for_user: true,
+      requires_user_response: true,
+      interaction_id: identity.interactionId,
+      response_file: responseFile,
+      response_file_format: { response: 'exact user response as a JSON string' },
+      spawn_command: null,
+      deferred_spawn_command: deferredSpawnCommand,
+      model_info: binding,
+      redispatched: false,
+      pipeline_progress: getPipelineProgress(sessionToPipelineState(session, projectDir)),
+      session: {
+        language: session.language,
+        project_type: session.project_type || session.project?.type,
+        execution_mode: session.execution_mode,
+        active_harness: session.active_harness,
+      },
+      status_summary: `Waiting for the user's answer to ${pending.agent}.`,
+    };
+  }
   if (installationV2 && session.rail_handoff_id) {
     const completedPlanning = runtimePipeline.length;
     return {
@@ -899,6 +2072,16 @@ async function _handleNextInner(projectDir) {
   if (currentAgent && !completedAgents.includes(currentAgent)) {
     const agent = currentAgent;
     const agentStatus = session.agents?.[agent]?.status;
+    if (agentStatus === 'awaiting_advance') {
+      return {
+        action: 'awaiting_agent_advance',
+        agent,
+        code: 'AGENT_AWAITING_ADVANCE',
+        pipeline_progress: getPipelineProgress(pipelineState),
+        session: { language: session.language, project_type: session.project_type || session.project?.type, execution_mode: session.execution_mode },
+        status_summary: `${agent} finished its routed process and is waiting for canonical advance.`,
+      };
+    }
     if (agentStatus === 'in_progress') {
       const agentFile = getAgentFile(agent, projectDir) || null;
       const agentDef = getAgentDefinition(agent);
@@ -1006,7 +2189,56 @@ async function _handleNextInner(projectDir) {
     };
   }
 
-  const nextAgent = nextInfo.next;
+  let nextAgent = nextInfo.next;
+
+  // Parallel groups can be resumed after only a subset has completed. Never
+  // send completed members back through the claim layer, and do not let a live
+  // claim for one member prevent an unclaimed sibling from being dispatched.
+  // A successful member waiting for canonical advance still takes precedence,
+  // because its result must be committed before the group can progress.
+  if (installationV2 && nextInfo.isParallel && nextInfo.group.length > 1) {
+    const incompleteGroup = nextInfo.group.filter((agent) => (
+      !completedAgents.includes(agent) && session.agents?.[agent]?.status !== 'completed'
+    ));
+    const awaitingAdvance = incompleteGroup.find((agent) => (
+      session.agents?.[agent]?.status === 'awaiting_advance'
+      || session.agents?.[agent]?.execution_claim_state === 'awaiting_advance'
+    ));
+    if (awaitingAdvance) {
+      return {
+        action: 'awaiting_agent_advance',
+        agent: awaitingAdvance,
+        code: 'AGENT_AWAITING_ADVANCE',
+        pipeline_progress: getPipelineProgress(pipelineState),
+        session: { language: session.language, project_type: session.project_type || session.project?.type, execution_mode: session.execution_mode },
+        status_summary: `${awaitingAdvance} finished its routed process and is waiting for canonical advance.`,
+      };
+    }
+    const now = Date.now();
+    const liveAgents = incompleteGroup.filter((agent) => {
+      const state = session.agents?.[agent];
+      const expiry = Date.parse(state?.execution_claim_expires_at || '');
+      return state?.status === 'in_progress'
+        && Boolean(state.execution_claim_id)
+        && Number.isFinite(expiry)
+        && expiry > now;
+    });
+    const dispatchableGroup = incompleteGroup.filter((agent) => !liveAgents.includes(agent));
+    if (dispatchableGroup.length === 0 && liveAgents.length > 0) {
+      return {
+        action: 'agent_execution_in_flight',
+        agent: liveAgents[0],
+        code: 'AGENT_EXECUTION_IN_FLIGHT',
+        pipeline_progress: getPipelineProgress(pipelineState),
+        session: { language: session.language, project_type: session.project_type || session.project?.type, execution_mode: session.execution_mode },
+        status_summary: `The remaining planning agents are already executing: ${liveAgents.join(', ')}.`,
+      };
+    }
+    if (dispatchableGroup.length > 0) {
+      nextAgent = dispatchableGroup[0];
+      nextInfo = { ...nextInfo, next: nextAgent, group: dispatchableGroup };
+    }
+  }
   const agentFile = getAgentFile(nextAgent, projectDir) || null;
   const agentDef = getAgentDefinition(nextAgent);
   const isInteractive = INTERACTIVE_AGENTS.includes(nextAgent);
@@ -1402,6 +2634,50 @@ async function handleAdvance(projectDir, args) {
   const { loaded, session } = loadSession(projectDir);
   if (!loaded || !session) return errorResult('No session found', 'NO_SESSION');
 
+  let runtimeV2;
+  try { runtimeV2 = loadRuntimeInstallationV2(projectDir); } catch (error) {
+    return errorResult(error.message, error.code || 'INVALID_INSTALLATION_ARTIFACT');
+  }
+  if (runtimeV2) {
+    if (!V2_PLANNING_AGENTS.includes(agent)) {
+      return errorResult(
+        `Agent ${agent} is outside the v2 planning runtime. Implementation and release must advance through a sealed RAIL handoff.`,
+        'V2_RAIL_EXECUTION_REQUIRED',
+      );
+    }
+    if (!session.agents || !Object.hasOwn(session.agents, agent)) {
+      return errorResult(`Agent ${agent} is not part of the canonical v2 session.`, 'INVALID_AGENT_ADVANCE');
+    }
+    try {
+      assertV2PlanningPredecessors(session, agent);
+    } catch (error) {
+      return errorResult(error.message, error.code || 'V2_PLANNING_PREDECESSORS_INCOMPLETE');
+    }
+  }
+  const agentState = session.agents && session.agents[agent];
+
+  // Legacy preview and scaffold decisions mutate the v1 Build/Deploy state
+  // machine. Runtime v2 ends planning at a sealed RAIL handoff, so accepting
+  // any of those decisions here would create a second execution authority.
+  if (runtimeV2 && decision) {
+    return errorResult(
+      `Decision ${decision} belongs to the legacy Build/Deploy pipeline. Runtime v2 must continue through RAIL.`,
+      'V2_RAIL_DECISION_REQUIRED',
+    );
+  }
+
+  if (runtimeV2 && agent === 'tasks' && status === 'completed' && score < 95) {
+    return {
+      advanced: false,
+      blocked: true,
+      reason: 'V2_TASKS_SCORE_BELOW_THRESHOLD',
+      message: `Tasks scored ${score}. A score of at least 95 is required before the planning handoff can be sealed for RAIL.`,
+      score,
+      required_score: 95,
+      agent_state: agentState?.status || null,
+    };
+  }
+
   // Fase 10 scaffold decision — route apply|skip|dryrun to the scaffold
   // dispatcher BEFORE the alreadyCompleted guard so the user can resolve a
   // pending scaffold decision after qa-planning is marked complete.
@@ -1413,7 +2689,6 @@ async function handleAdvance(projectDir, args) {
   // Idempotency guard: if this agent is already marked completed, return no-op.
   // Prevents duplicate advance calls (hook + user-approval path) from double-
   // incrementing pipeline_position or corrupting completed_agents.
-  const agentState = session.agents && session.agents[agent];
   const alreadyCompleted =
     agentState && agentState.status === 'completed' &&
     Array.isArray(session.completed_agents) && session.completed_agents.includes(agent);
@@ -1429,6 +2704,13 @@ async function handleAdvance(projectDir, args) {
     };
   }
 
+  if (runtimeV2 && status === 'completed' && agentState?.status !== 'awaiting_advance') {
+    return errorResult(
+      `Agent ${agent} has no successful routed result awaiting canonical advance.`,
+      'V2_AGENT_RESULT_NOT_HELD',
+    );
+  }
+
   // Handle user_preview decisions
   if (decision) {
     const pipelineState = sessionToPipelineState(session, projectDir);
@@ -2235,24 +3517,28 @@ async function handleInit(projectDir, args) {
   } catch { /* expected: license file may not exist */ }
 
   const type = args.type || 'greenfield';
-  const language = args.language || 'en';
+  let language = args.language || null;
   const workflow = args.workflow || 'full';
+  const runtimeV2 = Boolean(loadRuntimeInstallationV2(projectDir));
 
-  // Preserve fields from session.yaml created by installer (project name, ides, mcps)
+  // Preserve fields from the canonical session created by the installer.
   let preservedName = args.name || '';
   let preservedIdes = [];
   let preservedMcps = [];
   let preservedProviders = [];
-  try {
-    const existingPath = join(projectDir, '.chati', 'session.yaml');
-    if (existsSync(existingPath)) {
-      const existing = yaml.load(readFileSync(existingPath, 'utf-8')) || {};
-      preservedName = preservedName || existing.project?.name || '';
-      preservedIdes = existing.ides || [];
-      preservedMcps = existing.mcps || [];
-      preservedProviders = existing.providers_enabled || [];
-    }
-  } catch { /* expected: session may not exist */ }
+  const existingSession = loadSession(projectDir);
+  if (existingSession.loaded) {
+    const existing = existingSession.session || {};
+    language = language || existing.language || 'en';
+    preservedName = preservedName || existing.project?.name || '';
+    preservedIdes = existing.ides || [];
+    preservedMcps = existing.mcps || [];
+    preservedProviders = existing.providers_enabled || [];
+  } else if (existsSync(join(projectDir, '.chati', 'session.yaml'))
+    || !['Session file not found', 'Session directory not found'].includes(existingSession.error)) {
+    return errorResult(`Cannot read the existing session safely: ${existingSession.error}`, 'INVALID_SESSION_PATH');
+  }
+  language = language || 'en';
   if (preservedProviders.length === 0) {
     preservedProviders = parseProviderConfig(projectDir).enabled;
   }
@@ -2272,23 +3558,21 @@ async function handleInit(projectDir, args) {
     const p = initPipeline({ isGreenfield, targetDir: projectDir });
     pipelineAgents = Object.keys(p.agents);
   }
+  if (runtimeV2) pipelineAgents = pipelineAgents.filter(agent => V2_PLANNING_AGENTS.includes(agent));
 
   // RESUME GUARD: if a session already exists with completed agents or a non-discover mode,
   // this is a RESUME — preserve all state and only update workflow/lock. Do NOT reset.
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  const isResume = existsSync(sessionPath) && (() => {
-    try {
-      const s = yaml.load(readFileSync(sessionPath, 'utf-8')) || {};
-      const hasProgress = (s.completed_agents && s.completed_agents.length > 0)
-        || (s.mode && s.mode !== 'discover')
-        || (s.current_agent && s.current_agent !== '');
-      return hasProgress;
-    } catch { return false; }
+  let isResume = existingSession.loaded && (() => {
+    const s = existingSession.session || {};
+    return (s.completed_agents && s.completed_agents.length > 0)
+      || (s.mode && s.mode !== 'discover')
+      || (s.current_agent && s.current_agent !== '');
   })();
 
   if (isResume) {
     // Resume path — keep session.yaml intact, just refresh workflow if changed
-    await updateSession(projectDir, { workflow });
+    const updated = updateSession(projectDir, { workflow });
+    if (!updated.saved) return errorResult(`Failed to resume session: ${updated.error}`, 'SESSION_WRITE_FAILED');
     recordEvent(projectDir, EventType.SESSION_STARTED, 'orchestrator', { resume: true, workflow });
   } else {
     // Fresh init — create new session
@@ -2300,34 +3584,73 @@ async function handleInit(projectDir, args) {
       ides: preservedIdes,
       mcps: preservedMcps,
       providersEnabled: preservedProviders,
+      runtimeVersion: runtimeV2 ? 2 : 1,
     });
 
     if (!result.created) {
       return errorResult(`Failed to initialize session: ${result.error}`, 'INIT_FAILED');
     }
-
-    await updateSession(projectDir, { workflow });
-    clearTimeline(projectDir);
-    recordEvent(projectDir, EventType.SESSION_STARTED, 'orchestrator', { projectType: type, workflow, language });
+    if (result.preserved) {
+      isResume = true;
+      const updated = updateSession(projectDir, { workflow });
+      if (!updated.saved) return errorResult(`Failed to resume preserved session: ${updated.error}`, 'SESSION_WRITE_FAILED');
+      recordEvent(projectDir, EventType.SESSION_STARTED, 'orchestrator', { resume: true, workflow, concurrent_init_preserved: true });
+    } else {
+      const updated = updateSession(projectDir, { workflow });
+      if (!updated.saved) return errorResult(`Failed to initialize workflow state: ${updated.error}`, 'SESSION_WRITE_FAILED');
+      clearTimeline(projectDir);
+      recordEvent(projectDir, EventType.SESSION_STARTED, 'orchestrator', { projectType: type, workflow, language });
+    }
   }
 
   // Determine first/active agent — on resume, use current_agent from session
   let firstAgent;
+  let firstAgentMutation = null;
   if (isResume) {
-    const s = yaml.load(readFileSync(sessionPath, 'utf-8')) || {};
+    const resumed = loadSession(projectDir);
+    if (!resumed.loaded) return errorResult(`Failed to load resumed session: ${resumed.error}`, 'INVALID_SESSION_PATH');
+    const s = resumed.session || {};
     firstAgent = s.current_agent || (isGreenfield ? 'greenfield-wu' : 'brownfield-wu');
   } else {
     firstAgent = isGreenfield ? 'greenfield-wu' : 'brownfield-wu';
-    await updateSession(projectDir, { current_agent: firstAgent });
+    const updated = activateAgentExecutionState(projectDir, {
+      agent: firstAgent,
+      markInProgress: false,
+    });
+    if (!updated.saved) return errorResult(`Failed to select the first agent: ${updated.error}`, 'SESSION_WRITE_FAILED');
+    firstAgentMutation = {
+      expectedAgent: firstAgent,
+      previous: updated.previous,
+    };
   }
   const firstAgentFile = getAgentFile(firstAgent, projectDir) || null;
 
   // Write session lock
   try {
-    writeSessionLock(projectDir, firstAgent);
+    const projection = writeSessionLock(projectDir, firstAgent);
+    if (!projection.projected) {
+      if (firstAgentMutation) {
+        const rollback = rollbackAgentDispatch(projectDir, firstAgentMutation);
+        if (!rollback.saved || !rollback.rolledBack) {
+          return errorResult(
+            `Native session lock projection failed (${projection.error}); canonical rollback also failed: ${rollback.error}`,
+            rollback.code || 'SESSION_PROJECTION_ROLLBACK_FAILED',
+          );
+        }
+      }
+      return errorResult(`Native session lock projection failed: ${projection.error}`, projection.code || 'SESSION_PROJECTION_FAILED');
+    }
   } catch (err) {
-    // Non-blocking — lock is nice-to-have, not critical
-    process.stderr.write(`[chati] cli lock-write: ${err.message}\n`);
+    if (firstAgentMutation) {
+      const rollback = rollbackAgentDispatch(projectDir, firstAgentMutation);
+      if (!rollback.saved || !rollback.rolledBack) {
+        return errorResult(
+          `Native session lock projection failed (${err.message}); canonical rollback also failed: ${rollback.error}`,
+          rollback.code || 'SESSION_PROJECTION_ROLLBACK_FAILED',
+        );
+      }
+    }
+    return errorResult(`Native session lock projection failed: ${err.message}`, err.code || 'SESSION_PROJECTION_FAILED');
   }
 
   return {
@@ -2405,8 +3728,8 @@ async function handleStatus(projectDir) {
   // bracket prism-engine last computed. If the session predates v1.2
   // (no context_* fields yet), the block falls back to estimateContextBracket
   // so the existing response shape stays stable for consumers.
-  const activeModel     = session.active_model || null;
-  const activeProvider  = session.active_provider || (session.providers_enabled || [])[0] || null;
+  const activeModel     = session.current_execution_binding?.model || session.active_model || null;
+  const activeProvider  = session.current_execution_binding?.provider || session.active_provider || null;
   const windowTokens    = session.context_window_tokens != null
     ? session.context_window_tokens
     : resolveContextLimit(activeModel, activeProvider);
@@ -2425,6 +3748,7 @@ async function handleStatus(projectDir) {
     pipeline: progress,
     handoff_history: handoffHistory,
     deviation_count: (session.deviations || []).length,
+    decision_trail: session.decision_trail || [],
     backlog: session.backlog || [],
     agents: Object.fromEntries(Object.entries(session.agents || {}).filter(([name]) => runtimeAgentNames.has(name))),
     agent_models: agentModels,
@@ -2440,9 +3764,64 @@ async function handleStatus(projectDir) {
     },
     user_level: session.user_level || 'auto',
     execution_mode: session.execution_mode || 'interactive',
+    active_harness: session.active_harness || null,
+    current_execution_binding: session.current_execution_binding || null,
+    pending_interaction: session.pending_interaction || null,
   };
 }
 
+async function handleActivateHarness(projectDir, args) {
+  const harness = args.harness;
+  const installation = loadRuntimeInstallationV2(projectDir);
+  const supported = installation
+    ? [...new Set(installation.installation.enabled_providers.map(({ harness_id }) => harness_id))]
+    : parseProviderConfig(projectDir).enabled;
+  if (!supported.includes(harness)) {
+    const installed = supported.length > 0 ? supported.join(', ') : 'none';
+    return errorResult(`Harness is not enabled by this installation. Enabled harnesses: ${installed}.`, 'INVALID_HARNESS');
+  }
+  const saved = transitionSessionLifecycle(projectDir, { activeHarness: harness, sessionStatus: 'active' });
+  if (!saved.saved) {
+    const code = ['Session file not found', 'Session directory not found'].includes(saved.error)
+      ? 'NO_SESSION'
+      : 'SESSION_WRITE_FAILED';
+    return errorResult(code === 'NO_SESSION' ? 'No session found' : saved.error, code);
+  }
+  const session = saved.session;
+  const previous = saved.previous.active_harness;
+  const wasActive = saved.previous.session_status === 'active';
+  let projection;
+  try {
+    projection = writeSessionLock(projectDir, session.current_agent || '', {
+      phase: session.mode,
+      mode: session.execution_mode || 'interactive',
+    });
+  } catch (error) {
+    projection = { projected: false, error: error.message, code: error.code };
+  }
+  if (!projection.projected) {
+    const rollback = rollbackSessionLifecycle(projectDir, {
+      expectedActiveHarness: harness,
+      expectedSessionStatus: 'active',
+      previous: saved.previous,
+    });
+    if (!rollback.saved || !rollback.rolledBack) {
+      return errorResult(
+        `Native session lock projection failed (${projection.error}); canonical rollback also failed: ${rollback.error}`,
+        rollback.code || 'SESSION_PROJECTION_ROLLBACK_FAILED',
+      );
+    }
+    return errorResult(projection.error, projection.code || 'SESSION_PROJECTION_FAILED');
+  }
+  if (previous !== harness) {
+    recordEvent(projectDir, EventType.HARNESS_ACTIVATED, 'orchestrator', { harness, previous_harness: previous });
+  }
+  if (previous !== harness || !wasActive) {
+    recordEvent(projectDir, EventType.SESSION_STARTED, session.current_agent || 'orchestrator', { harness, resumed: Boolean(previous) });
+  }
+  return { activated: true, harness, previous_harness: previous, language: session.language || 'en' };
+}
+
 async function handleDeviation(projectDir, args) {
   const type = args.type;
   const target = args.target || null;
@@ -2519,14 +3898,18 @@ async function handleDeviation(projectDir, args) {
 }
 
 async function handleExit(projectDir, args) {
-  const { loaded, session } = loadSession(projectDir);
-  if (!loaded || !session) {
+  const persisted = transitionSessionLifecycle(projectDir, { sessionStatus: 'paused' });
+  if (!persisted.saved && ['Session file not found', 'Session directory not found'].includes(persisted.error)) {
     return { exited: true, session_saved: false, lock_removed: false, resume_message: null };
   }
+  if (!persisted.saved) {
+    return { exited: false, session_saved: false, lock_removed: false, resume_message: null, error: persisted.error };
+  }
+  const session = persisted.previous;
 
   // Save current state
-  recordEvent(projectDir, EventType.SESSION_ENDED, session.current_agent || 'orchestrator', { mode: session.mode });
-  await updateSession(projectDir, {});
+  recordEvent(projectDir, EventType.SESSION_ENDED, session.current_agent || 'orchestrator', { mode: session.mode, harness: session.active_harness || null });
+  releaseReservedAgentExecutions(projectDir);
 
   // Release session ownership
   const userId = args['user-id'] || process.env.USER || 'default';
@@ -2536,15 +3919,22 @@ async function handleExit(projectDir, args) {
 
   // Remove lock from CLAUDE.local.md
   const lang = session.language || 'en';
-  const resumeMsg = RESUME_MESSAGES[lang] || RESUME_MESSAGES.en;
+  const genericResumeMsg = RESUME_MESSAGES[lang] || RESUME_MESSAGES.en;
+  const resumeMsg = session.active_harness === 'codex'
+    ? genericResumeMsg.replaceAll('/chati', '$chati')
+    : genericResumeMsg;
+  let projection;
   try {
-    removeSessionLock(projectDir, resumeMsg);
-  } catch { /* expected: lock file may not exist */ }
+    // Each lock target translates the generic command to its native syntax.
+    // The returned message below remains native to the harness that exited.
+    projection = removeSessionLock(projectDir, genericResumeMsg);
+  } catch (error) { projection = { projected: false, error: error.message }; }
 
   return {
     exited: true,
     session_saved: true,
-    lock_removed: true,
+    lock_removed: projection.projected,
+    ...(projection.projected ? {} : { lock_projection_error: projection.error }),
     resume_message: resumeMsg,
     language: lang,
   };
@@ -2789,11 +4179,8 @@ export function isAgentTeamsEnabled(projectDir) {
 
   // Never infer a primary harness. The legacy native team path is available
   // only while the session explicitly records Claude as the active provider.
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return false;
-  const sessionRaw = readFileSync(sessionPath, 'utf-8');
-  const providerMatch = sessionRaw.match(/^\s*active_provider:\s*["']?(\w+)/m);
-  return providerMatch?.[1] === 'claude';
+  const sessionRead = readSessionSafe(projectDir);
+  return sessionRead.loaded && sessionRead.session?.active_provider === 'claude';
 }
 
 async function handleSpawnTeam(projectDir, args) {
@@ -2936,13 +4323,13 @@ async function handleSpawnTeam(projectDir, args) {
 
   // Build spawn command
   const spawnCmd = [
-    'node', RUNNER('run-team.js'),
-    '--team-id', teamId,
-    '--team-type', teamType,
-    '--project-dir', JSON.stringify(resolve(projectDir)),
-    '--previous-agent', previousAgent,
-    '--provider', provider,
-    '--timeout', args.timeout || '1800000',
+    'node', shellQuote(RUNNER('run-team.js')),
+    '--team-id', shellQuote(teamId),
+    '--team-type', shellQuote(teamType),
+    '--project-dir', shellQuote(resolve(projectDir)),
+    '--previous-agent', shellQuote(previousAgent),
+    '--provider', shellQuote(provider),
+    '--timeout', shellQuote(args.timeout || '1800000'),
   ].join(' ');
 
   return {
@@ -3349,31 +4736,103 @@ export async function handleRunScriptTask(projectDir, args) {
     return { ran: false, reason: 'The execution_kinds feature is off. Run this task through the agent path.', fallback: 'agent' };
   }
 
-  const kind = String(args.kind || 'script');
+  let runtimeRecord;
+  try {
+  let request = args;
+  let runtimeClaim = null;
+  if (args['request-file']) {
+    try {
+      runtimeRecord = captureRuntimePath(projectDir, 'script-task-request.json');
+      const requestedPath = isAbsolute(args['request-file'])
+        ? resolve(args['request-file'])
+        : resolve(projectDir, args['request-file']);
+      if (requestedPath !== runtimeRecord.target) {
+        return scriptRequestError('INVALID_SCRIPT_TASK_REQUEST_PATH', 'The script task request file must be .chati/runtime/script-task-request.json.');
+      }
+      runtimeClaim = claimRuntimeRequest(runtimeRecord);
+      request = readClaimedRuntimeJson(runtimeClaim);
+    } catch (err) {
+      runtimeClaim = runtimeClaim || err.runtimeClaim || null;
+      if (runtimeClaim?.fd !== null && runtimeClaim?.fd !== undefined) {
+        try { closeSync(runtimeClaim.fd); } catch { /* already closed */ }
+        runtimeClaim.fd = null;
+      }
+      try { restoreRuntimeRequest(runtimeClaim); } catch { /* keep the claimed copy for manual recovery */ }
+      const code = (err.code === 'ENOENT' && !runtimeClaim?.identity) || err.code === 'RUNTIME_REQUEST_IN_PROGRESS'
+        ? 'INVALID_SCRIPT_TASK_REQUEST_PATH'
+        : 'INVALID_SCRIPT_TASK_REQUEST';
+      return scriptRequestError(code, code === 'INVALID_SCRIPT_TASK_REQUEST_PATH'
+        ? 'The script task request file must be .chati/runtime/script-task-request.json.'
+        : 'The script task request file is invalid or changed during validation.');
+    } finally {
+      if (runtimeClaim?.fd !== null && runtimeClaim?.fd !== undefined) {
+        try { closeSync(runtimeClaim.fd); } catch { /* already closed */ }
+        runtimeClaim.fd = null;
+      }
+    }
+    if (!validateScriptRequestSchema(request) && !isExecutedScriptReceipt(projectDir, request)) {
+      try { restoreRuntimeRequest(runtimeClaim); } catch { /* preserve the claimed copy */ }
+      return scriptRequestError('INVALID_SCRIPT_TASK_REQUEST_SCHEMA', 'The script task request does not match the required kind/ref/id/title schema.');
+    }
+  }
+
+  let executionReceipt = isExecutedScriptReceipt(projectDir, request) ? request : null;
+  if (executionReceipt) request = executionReceipt.request;
+
+  const kind = String(request.kind || 'script');
   if (kind !== 'script') {
-    return { ran: false, reason: `execution_kind "${kind}" is not auto-run by the script runner (only "script" is). Route through the normal path.`, kind };
+    try { restoreRuntimeRequest(runtimeClaim); } catch { /* preserve the claimed copy */ }
+    return scriptRequestError('UNSUPPORTED_EXECUTION_KIND', `execution_kind "${kind}" is not auto-run by the script runner (only "script" is).`);
   }
 
-  const ref = args.ref || '';
+  const ref = request.ref || '';
   if (!ref) {
-    return { ran: false, reason: 'Missing --ref (the execution_ref, for example "npm-script:test").' };
+    try { restoreRuntimeRequest(runtimeClaim); } catch { /* preserve the claimed copy */ }
+    return scriptRequestError('MISSING_EXECUTION_REF', 'Missing --ref (the execution_ref, for example "npm-script:test").');
   }
 
-  const id = args.id || args.task || '';
-  const title = args.title || '';
-  const result = await runScriptTask(projectDir, { id, title, execution_ref: ref });
+  const id = request.id || request.task || '';
+  const title = request.title || '';
+  let result = executionReceipt?.result;
+  let timestamp = executionReceipt?.executed_at;
+  if (!executionReceipt) {
+    try {
+      result = await runScriptTask(projectDir, { id, title, execution_ref: ref });
+    } catch {
+      try { restoreRuntimeRequest(runtimeClaim); } catch { /* preserve the claimed copy */ }
+      return scriptRequestError('SCRIPT_TASK_EXECUTION_FAILED', 'The script task executor failed before producing a result. The request was preserved for retry.');
+    }
+    timestamp = new Date().toISOString();
+    if (runtimeClaim) {
+      try {
+        executionReceipt = persistExecutedRuntimeRequest(runtimeRecord, runtimeClaim, request, result, timestamp);
+      } catch {
+        return scriptRequestError('SCRIPT_TASK_EXECUTION_RECEIPT_FAILED', 'The script task ran, but its durable execution receipt could not be persisted. The claimed request was quarantined to prevent automatic re-execution.');
+      }
+    }
+  }
 
   // Write a synthetic handoff so the pipeline reads it like an agent handoff.
-  const timestamp = new Date().toISOString();
   const handoff = formatScriptHandoff({ id, title }, result, timestamp);
-  let handoffPath = null;
+  let handoffPath;
   try {
     const dir = join(projectDir, resolveFrameworkDir(projectDir), 'artifacts', 'handoffs');
-    mkdirSync(dir, { recursive: true });
     handoffPath = join(dir, `script-${(id || 'task').replace(/[^A-Za-z0-9._-]/g, '_')}.md`);
-    writeFileSync(handoffPath, handoff, 'utf-8');
+    writeDurableScriptHandoff(handoffPath, handoff);
+    runRuntimeSecurityTestHook('afterScriptHandoffDurable', { handoffPath, runtimeClaimPath: runtimeClaim?.claimPath });
   } catch {
-    // best-effort; the structured result is still returned for the orchestrator
+    try { restoreRuntimeRequest(runtimeClaim); } catch { /* preserve the claimed copy */ }
+    return scriptRequestError('SCRIPT_TASK_HANDOFF_FAILED', 'The script task ran, but its handoff could not be persisted. Its execution receipt was preserved so retry will only persist the handoff.');
+  }
+
+  if (runtimeClaim) {
+    try {
+      if (!consumeRuntimeRequest(runtimeClaim)) {
+        return scriptRequestError('SCRIPT_TASK_REQUEST_FINALIZATION_FAILED', 'The script task ran and its handoff was persisted, but the claimed request changed before finalization.');
+      }
+    } catch {
+      return scriptRequestError('SCRIPT_TASK_REQUEST_FINALIZATION_FAILED', 'The script task ran and its handoff was persisted, but the claimed request could not be finalized.');
+    }
   }
 
   return {
@@ -3386,6 +4845,9 @@ export async function handleRunScriptTask(projectDir, args) {
     handoffPath,
     details: result.details,
   };
+  } finally {
+    closeRuntimeRecord(runtimeRecord);
+  }
 }
 
 /**
@@ -3561,6 +5023,9 @@ export async function runOrchestrate(subCommand, argv, projectDir) {
       case 'exit':
         output(await handleExit(projectDir, args));
         break;
+      case 'activate-harness':
+        output(await handleActivateHarness(projectDir, args));
+        break;
       case 'providers':
         output(await handleProviders(projectDir));
         break;
@@ -3614,7 +5079,7 @@ export async function runOrchestrate(subCommand, argv, projectDir) {
         break;
     }
   } catch (err) {
-    output(errorResult(`Orchestrate error: ${err.message}`, 'INTERNAL_ERROR'));
+    output(errorResult(`Orchestrate error: ${err.message}`, err.code || 'INTERNAL_ERROR'));
     process.exitCode = 1;
   }
 }