evolcore 0.0.38 → 0.0.40

package/dist/core/ownership/owner-resolver.js

@@ -1,14 +1,16 @@
 import fs from 'fs';
 import path from 'path';
+import { randomUUID } from 'crypto';
 import { resolvePaths } from '../../paths.js';
 import { isValidAid } from '../../aun/aid/validation.js';
-import { atomicReadJson, atomicWriteJson } from '../../utils/atomic-write.js';
+import { atomicReadJson } from '../../utils/atomic-write.js';
 import { configuredOwnerList as readConfiguredOwnerList } from '../../config/owner-config.js';
 import { logger } from '../../utils/logger.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 export const OWNERSHIP_CACHE_MAX_AGE_MS = 30 * 60_000;
 export const OWNERSHIP_AUTHORIZATION_MAX_AGE_MS = 5 * 60_000;
-const OWNERSHIP_PENDING_REFRESH_MS = 5_000;
+// Background refreshes should heal a short outage without retrying on every tool call.
+const OWNERSHIP_BACKGROUND_REFRESH_MIN_INTERVAL_MS = 60_000;
 const CREATION_BIND_OPERATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** Only use the task returned by this create's bind call. Never select a latest task. */
 export function creationOwnershipBinding(task, subjectAid, ownerAid) {
@@ -117,7 +119,12 @@ export class OwnerResolver {
                 if (subject.client !== client || subject.generation !== generation)
                     return;
                 const record = this.record(payload);
-                if (!record || record.sub_aid !== subjectAid)
+                if (!record)
+                    return;
+                this.trackBindingRequest(subjectAid, subject, event, record);
+                // When this AID is the prospective owner, the request concerns the
+                // remote sub's ownership, not this AID's own Owner authorization.
+                if (record.sub_aid !== subjectAid)
                     return;
                 if (typeof record.operation_id === 'string') {
                     const key = JSON.stringify([event, record.operation_id, record.step, record.status,
@@ -129,7 +136,7 @@ export class OwnerResolver {
                         subject.taskEvents.delete(subject.taskEvents.values().next().value);
                 }
                 this.invalidate(subject, 'Ownership changed; fresh consensus is required');
-                const task = this.task(record);
+                const task = this.task(record, event);
                 logger.info(`[ownership] ${event} ${JSON.stringify({ subjectAid, ownerAid: task?.owner_aid,
                     operationId: task?.operation_id, taskStatus: task?.status, step: task?.step,
                     code: task?.code, reason: task?.reason })}`);
@@ -139,10 +146,6 @@ export class OwnerResolver {
                     subject.view.task = task;
                     subject.view.requestStatus = 'submitted';
                 }
-                try {
-                    this.persist(subjectAid, subject);
-                }
-                catch { }
                 this.schedule(subjectAid, subject);
             }));
         }
@@ -195,9 +198,6 @@ export class OwnerResolver {
             if (subject.timer)
                 clearTimeout(subject.timer);
             subject.timer = undefined;
-            if (subject.pendingRefreshTimer)
-                clearTimeout(subject.pendingRefreshTimer);
-            subject.pendingRefreshTimer = undefined;
         }
         subject.view.connected = connected;
         if (connected)
@@ -211,10 +211,10 @@ export class OwnerResolver {
         if (subject.timer)
             clearTimeout(subject.timer);
         subject.timer = undefined;
-        if (subject.pendingRefreshTimer)
-            clearTimeout(subject.pendingRefreshTimer);
-        subject.pendingRefreshTimer = undefined;
         subject.taskEvents.clear();
+        subject.requests.clear();
+        subject.decisionTasks.clear();
+        delete subject.view.decisionTask;
         for (const subscription of subject.subscriptions.splice(0)) {
             try {
                 subscription.unsubscribe();
@@ -275,6 +275,7 @@ export class OwnerResolver {
     snapshot(subjectAid) {
         const subject = this.subject(subjectAid);
         const view = JSON.parse(JSON.stringify(subject.view));
+        view.requests = [...subject.requests.values()].map(request => ({ ...request }));
         if (view.consensusStatus === 'consensus' && !this.owner(subjectAid)) {
             view.ownerAid = undefined;
             view.synchronization = { status: 'unavailable' };
@@ -284,12 +285,6 @@ export class OwnerResolver {
             && view.checkedAt !== undefined && view.checkedAt <= now
             ? view.ownerAid && now - view.checkedAt < OWNERSHIP_AUTHORIZATION_MAX_AGE_MS ? 'verified' : 'expired'
             : 'unavailable';
-        if (subject.persistenceError) {
-            view.requestStatus = 'error';
-            view.reason = subject.persistenceError;
-            view.synchronization.status = 'unavailable';
-            view.authorizationStatus = 'unavailable';
-        }
         return view;
     }
     async refresh(subjectAid, options = {}) {
@@ -298,7 +293,10 @@ export class OwnerResolver {
         if (subject.timer)
             clearTimeout(subject.timer);
         subject.timer = undefined;
-        const refreshing = subject.refreshing?.epoch === subject.epoch ? subject.refreshing.promise : undefined;
+        const inFlight = subject.refreshing?.epoch === subject.epoch ? subject.refreshing : undefined;
+        const refreshing = inFlight?.promise;
+        const initialEpoch = subject.epoch;
+        const initialCheckedAt = subject.view.checkedAt;
         const maxAgeMs = options.maxAgeMs ?? this.options.lifetimeMs ?? OWNERSHIP_CACHE_MAX_AGE_MS;
         const isFresh = () => {
             const { checkedAt, validUntil, consensusStatus } = subject.view;
@@ -308,32 +306,48 @@ export class OwnerResolver {
                 && now - checkedAt < maxAgeMs;
         };
         if (!refreshing && !options.force && isFresh()) {
+            if (options.allowTransient
+                && this.now() - (subject.lastRefreshAttemptAt ?? 0) >= OWNERSHIP_BACKGROUND_REFRESH_MIN_INTERVAL_MS) {
+                this.schedule(subjectAid, subject, true);
+            }
             return this.snapshot(subjectAid);
         }
-        const promise = refreshing ?? this.refreshSubject(subjectAid, subject);
-        subject.refreshing = { epoch: subject.epoch, promise };
+        const attemptId = inFlight?.attemptId ?? ++subject.query;
+        const attemptedAt = inFlight?.attemptedAt ?? this.now();
+        const promise = refreshing ?? this.refreshSubject(subjectAid, subject, attemptId, attemptedAt);
+        subject.refreshing = { epoch: subject.epoch, attemptId, attemptedAt, promise };
         try {
             await promise;
-            if (!subject.view.connected && subject.view.consensusStatus === 'consensus' && !isFresh()) {
+            if (subject.epoch !== initialEpoch && subject.view.consensusStatus === 'consensus'
+                && subject.view.checkedAt === initialCheckedAt) {
+                this.handleRefreshFailure(subjectAid, subject, Object.assign(new Error('Ownership refresh was interrupted by a connection state change'), { code: 'CLIENT_DISCONNECTED' }), attemptedAt, attemptId);
+            }
+            if (!subject.view.connected && subject.view.consensusStatus === 'consensus' && !isFresh()
+                && subject.view.refreshFailure?.fallbackUsed !== true) {
                 this.invalidate(subject, 'Ownership cache expired while disconnected');
             }
+            if (!options.allowTransient && subject.view.refreshFailure?.attemptId === attemptId
+                && subject.view.refreshFailure.fallbackUsed) {
+                return this.unavailableSnapshot(subjectAid, subject.view.refreshFailure);
+            }
             return this.snapshot(subjectAid);
         }
         finally {
             if (subject.refreshing?.promise === promise)
                 subject.refreshing = undefined;
-            this.schedulePendingRefresh(subjectAid, subject);
         }
     }
-    async refreshSubject(subjectAid, subject) {
+    async refreshSubject(subjectAid, subject, attemptId, attemptedAt) {
         const client = subject.client;
+        subject.lastRefreshAttemptAt = attemptedAt;
         if (!client || !subject.view.connected) {
-            this.invalidate(subject, 'Subject AID has no connected SDK client');
+            const reason = 'Subject AID has no connected SDK client';
+            this.handleRefreshFailure(subjectAid, subject, { code: 'CLIENT_DISCONNECTED', message: reason }, attemptedAt, attemptId);
             return this.snapshot(subjectAid);
         }
         const generation = subject.generation;
         const epoch = subject.epoch;
-        const query = ++subject.query;
+        const query = attemptId;
         let timeout;
         try {
             const consensus = await Promise.race([
@@ -352,6 +366,16 @@ export class OwnerResolver {
             if (consensus.sub_aid !== subjectAid || (consensus.status === 'consensus' && !ownerAid)) {
                 throw new Error('Ownership consensus contains a mismatched subject or invalid owner');
             }
+            if (consensus.status === 'consensus' && consensus.lock !== 'locked') {
+                throw Object.assign(new OwnershipError('CONSENSUS_MISMATCH', 'Ownership consensus reports an unlocked relation'), { retryable: false });
+            }
+            if (consensus.status === 'unavailable' && consensus.retryable === true) {
+                const reason = consensus.reason ?? 'Ownership consensus is temporarily unavailable';
+                this.handleRefreshFailure(subjectAid, subject, {
+                    code: consensus.code ?? 'UNAVAILABLE', message: reason, retryable: true,
+                }, attemptedAt, attemptId);
+                return this.snapshot(subjectAid);
+            }
             const previousOwner = this.owner(subjectAid);
             const previousStatus = subject.view.consensusStatus;
             const checkedAt = this.now();
@@ -372,6 +396,7 @@ export class OwnerResolver {
                     || subject.view.consensus?.relation_version !== consensus.relation_version
                     || subject.view.consensus?.lock !== consensus.lock ? 1 : 0),
                 reason: consensus.reason,
+                refreshFailure: undefined,
                 synchronization: {
                     status: consensus.status === 'unavailable' || consensus.status === 'not_applicable' ? 'unavailable'
                         : consensus.status === 'invalid' ? 'conflict'
@@ -384,12 +409,12 @@ export class OwnerResolver {
                 this.notify(subjectAid, ownerAid);
             if (ownerAid === subject.view.requestedOwnerAid && subject.view.requestStatus === 'interrupted') {
                 subject.view.requestStatus = 'submitted';
-                this.persist(subjectAid, subject);
             }
         }
         catch (error) {
             if (subject.client === client && subject.generation === generation && subject.epoch === epoch && subject.query === query) {
-                this.invalidate(subject, error instanceof Error ? error.message : String(error));
+                const reason = error instanceof Error ? error.message : String(error);
+                this.handleRefreshFailure(subjectAid, subject, error, attemptedAt, attemptId);
             }
         }
         finally {
@@ -398,14 +423,75 @@ export class OwnerResolver {
         }
         return this.snapshot(subjectAid);
     }
+    handleRefreshFailure(subjectAid, subject, error, attemptedAt, attemptId) {
+        const details = error && typeof error === 'object' ? error : {};
+        const reason = error instanceof Error ? error.message
+            : typeof details.message === 'string' ? details.message : String(error);
+        const code = String(details.stringCode ?? details.code ?? 'OWNERSHIP_REFRESH_FAILED');
+        const transient = this.isTransientRefreshFailure(error);
+        // Keep the shared cache intact for ordinary callers; strict waiters receive
+        // an unavailable view for this attempt and cannot consume the fallback.
+        const fallbackUsed = transient && this.canUseTransientAuthorization(subject, attemptedAt);
+        if (!fallbackUsed)
+            this.invalidate(subject, reason);
+        subject.view.refreshFailure = {
+            kind: transient ? 'transient' : 'permanent', code, reason, attemptedAt, attemptId, fallbackUsed,
+        };
+        if (fallbackUsed) {
+            logger.warn(`[ownership] transient refresh failure subject=${subjectAid} attempt=${attemptId} code=${code} fallback=true reason=${reason}`);
+        }
+        else {
+            logger.warn(`[ownership] refresh failed subject=${subjectAid} attempt=${attemptId} code=${code} transient=${transient} reason=${reason}`);
+        }
+    }
+    unavailableSnapshot(subjectAid, failure) {
+        const view = this.snapshot(subjectAid);
+        view.ownerAid = undefined;
+        view.consensusStatus = 'unavailable';
+        view.authorizationStatus = 'unavailable';
+        view.validUntil = undefined;
+        view.reason = failure.reason;
+        view.synchronization = { status: 'unavailable' };
+        return view;
+    }
+    canUseTransientAuthorization(subject, attemptedAt) {
+        const view = subject.view;
+        const now = this.now();
+        return view.consensusStatus === 'consensus'
+            && !!view.ownerAid
+            && view.checkedAt !== undefined
+            && view.checkedAt <= attemptedAt
+            && view.checkedAt <= now
+            && now - view.checkedAt < OWNERSHIP_AUTHORIZATION_MAX_AGE_MS
+            && (view.validUntil ?? 0) > now;
+    }
+    isTransientRefreshFailure(error) {
+        const details = error && typeof error === 'object' ? error : {};
+        const code = String(details.code ?? details.stringCode ?? '').toUpperCase();
+        const message = error instanceof Error ? error.message
+            : typeof details.message === 'string' ? details.message : String(error);
+        if (['INVALID', 'CONFLICT', 'FORBIDDEN', 'NOT_APPLICABLE', 'OWNER_LOCKED', 'TASK_MISMATCH',
+            'CONSENSUS_MISMATCH', 'UNSUPPORTED_PROTOCOL', 'PERSISTENCE_UNAVAILABLE'].includes(code))
+            return false;
+        if (/projection.*(?:does not match|conflict)|(?:agent|owner)\.md changed (?:while|during)|NS relation changed .*consensus check|digest does not match authoritative observation|Storage material changed during authoritative read/i.test(message))
+            return false;
+        if (details.retryable === false)
+            return false;
+        if (details.retryable === true)
+            return true;
+        return code === 'TIMEOUT' || code === 'NETWORK_ERROR' || code === 'UNAVAILABLE'
+            || code === 'CLIENT_DISCONNECTED' || code === 'CONNECTION_FAILED'
+            || code === 'GATEWAY_UNAVAILABLE' || code === 'CONNECTION_UNAVAILABLE'
+            || code === 'ECONNREFUSED' || code === 'ECONNRESET' || code === 'ETIMEDOUT'
+            || code === 'ENETUNREACH' || code === 'EAI_AGAIN' || code === 'ENOTFOUND' || code === 'EHOSTUNREACH'
+            || /timed out|timeout|connection reset|connection refused|connection closed|socket hang up|not connected|network error|fetch failed|gateway unavailable|gateway timeout|temporarily unavailable/i.test(message);
+    }
     async bind(subjectAid, ownerAid) {
-        this.assertLocalSubject(subjectAid);
+        this.assertAid(subjectAid);
         this.assertAid(ownerAid);
         if (ownerAid === subjectAid)
             throw new OwnershipError('INVALID_OWNER', 'Subject cannot own itself');
         const subject = this.subject(subjectAid);
-        if (subject.persistenceError)
-            throw new OwnershipError('persistence_unavailable', subject.persistenceError);
         if (subject.binding) {
             if (subject.binding.ownerAid !== ownerAid)
                 throw new OwnershipError('BIND_CONFLICT', 'Another owner binding is in progress');
@@ -421,93 +507,261 @@ export class OwnerResolver {
                 subject.binding = undefined;
         }
     }
+    async decide(subjectAid, operationId, decision, reason) {
+        const subject = this.subject(subjectAid);
+        const generation = subject.generation;
+        logger.info(`[ownership] ${decision} requested local=${subjectAid} operationId=${operationId}`);
+        try {
+            return await this.withSubjectClient(subjectAid, async (client, attached) => {
+                // SDK 0.5.24 can recover an authenticated request from message history;
+                // this in-memory projection is only used to detect mismatched results.
+                const request = subject.requests.get(operationId) ?? subject.decisionTasks.get(operationId);
+                const result = decision === 'accept'
+                    ? await client.acceptOwnershipRequest(operationId)
+                    : await client.rejectOwnershipRequest(operationId, reason);
+                if (subject.generation !== generation || (attached && subject.client !== client)) {
+                    throw new OwnershipError('CLIENT_REPLACED', 'Subject SDK client changed during approval; query status before retrying');
+                }
+                const task = this.bindingTask(result);
+                if (!task || (request && !this.sameBindingTask(task, request))) {
+                    throw new OwnershipError('TASK_MISMATCH', 'SDK returned a different ownership decision task');
+                }
+                subject.view.decisionTask = task;
+                subject.decisionTasks.set(operationId, task);
+                subject.requests.delete(operationId);
+                delete subject.view.decisionConsensus;
+                if (task.sub_aid === subjectAid) {
+                    this.invalidate(subject, 'Binding decision submitted; fresh consensus is required');
+                    this.schedule(subjectAid, subject);
+                }
+                logger.info(`[ownership] ${decision} result ${JSON.stringify(task)}`);
+                if (task.status === 'error' || task.status === 'stopped' || (decision === 'accept' && task.status === 'rejected')) {
+                    throw Object.assign(new OwnershipError(task.code ?? 'OWNERSHIP_DECISION_FAILED', task.reason ?? `Ownership task ${task.status}`), { retryable: task.retryable });
+                }
+                subject.view.decisionConsensus = await client.checkOwnershipConsensus(task.sub_aid);
+                return this.snapshot(subjectAid);
+            });
+        }
+        catch (error) {
+            logger.warn(`[ownership] ${decision} failed ${JSON.stringify({
+                localAid: subjectAid, operationId, error: error instanceof Error ? error.message : String(error),
+            })}`);
+            throw error;
+        }
+    }
+    async status(subjectAid) {
+        const subject = this.subject(subjectAid);
+        const generation = subject.generation;
+        return this.withSubjectClient(subjectAid, async (client, attached) => {
+            if (attached)
+                return this.refresh(subjectAid, { force: true });
+            const consensus = await client.checkOwnershipConsensus(subjectAid);
+            if (subject.generation !== generation) {
+                throw new OwnershipError('CLIENT_REPLACED', 'Subject state changed during status query; retry');
+            }
+            this.applyConsensus(subjectAid, subject, consensus);
+            return this.snapshot(subjectAid);
+        });
+    }
+    async withSubjectClient(subjectAid, operation) {
+        const subject = this.subject(subjectAid);
+        if (subject.client && subject.view.connected)
+            return operation(subject.client, true);
+        let store;
+        let client;
+        try {
+            const sdkStore = await import('../../aun/aid/store.js');
+            store = await sdkStore.getAidStore({ slotId: `ownership-${randomUUID()}` });
+            const loaded = store.load(subjectAid);
+            if (!loaded.ok || !loaded.data.aid.isCertValid() || !loaded.data.aid.isPrivateKeyValid()) {
+                throw new OwnershipError('SUBJECT_UNAVAILABLE', loaded.ok
+                    ? 'Subject local certificate or private key is unavailable'
+                    : `Subject local credentials are unavailable: ${loaded.error.message}`);
+            }
+            client = await sdkStore.loadClient(store, subjectAid);
+            if (client.currentAid?.aid !== subjectAid || !client.currentAid.isCertValid() || !client.currentAid.isPrivateKeyValid()) {
+                throw new OwnershipError('SUBJECT_MISMATCH', 'Loaded SDK identity does not match the requested subject');
+            }
+            await client.connect({
+                connection_kind: 'short', short_ttl_ms: 120_000, auto_reconnect: false, background_sync: false,
+                connect_timeout: 10, call_timeout: 30,
+            });
+            return await operation(client, false);
+        }
+        finally {
+            if (client) {
+                try {
+                    await client.close();
+                }
+                catch { }
+            }
+            try {
+                store?.close();
+            }
+            catch { }
+        }
+    }
     stop() {
         for (const subjectAid of this.subjects.keys())
             this.detachClient(subjectAid);
         this.configuredOwners.clear();
     }
     async submitBinding(subjectAid, ownerAid, subject) {
-        const current = await this.refresh(subjectAid, { force: true });
-        if (current.consensusStatus === 'consensus') {
-            if (current.ownerAid === ownerAid)
-                return current;
-            throw new OwnershipError('OWNER_ALREADY_BOUND', 'Subject already has a protocol owner; transfer is not supported');
-        }
-        const recovering = (subject.view.task?.status === 'pending' || subject.view.requestStatus === 'interrupted')
-            && subject.view.requestedOwnerAid === ownerAid;
-        if (!['unbound', 'released'].includes(current.consensusStatus)
-            && !(recovering && current.consensusStatus === 'single_sided')) {
-            throw new OwnershipError('CONSENSUS_REQUIRED', 'Binding requires a fresh unbound or released consensus result');
-        }
-        if (subject.view.task?.status === 'pending') {
-            if (subject.view.task.owner_aid !== ownerAid)
-                throw new OwnershipError('BIND_CONFLICT', 'A different binding task is pending');
-        }
-        if (subject.view.requestStatus === 'interrupted' && subject.view.requestedOwnerAid !== ownerAid) {
-            throw new OwnershipError('BIND_UNCERTAIN', 'Retry the interrupted request with its original owner before changing the target');
-        }
         const client = subject.client;
-        if (!client || !subject.view.connected)
-            throw new OwnershipError('SUBJECT_UNAVAILABLE', 'Subject AID SDK client is not ready');
         const generation = subject.generation;
         subject.view = { ...subject.view, requestedOwnerAid: ownerAid, requestStatus: 'requesting', task: undefined };
-        this.persist(subjectAid, subject);
         try {
+            const local = await this.tryLocalBind(subjectAid, ownerAid);
+            if (local) {
+                if (client && (subject.client !== client || subject.generation !== generation)) {
+                    throw new OwnershipError('CLIENT_REPLACED', 'Subject SDK client changed during local binding');
+                }
+                subject.view.task = local.task;
+                this.applyConsensus(subjectAid, subject, local.consensus);
+                subject.view.requestStatus = undefined;
+                subject.view.reason = undefined;
+                return this.snapshot(subjectAid);
+            }
+            if (!client || !subject.view.connected)
+                throw new OwnershipError('SUBJECT_UNAVAILABLE', 'Subject AID SDK client is not ready');
+            const current = await this.refresh(subjectAid, { force: true });
+            if (current.consensusStatus === 'consensus') {
+                if (current.ownerAid === ownerAid)
+                    return current;
+                throw new OwnershipError('OWNER_ALREADY_BOUND', 'Subject already has a protocol owner; transfer is not supported');
+            }
+            if (!['unbound', 'released', 'single_sided'].includes(current.consensusStatus)) {
+                throw new OwnershipError('CONSENSUS_REQUIRED', 'Binding requires a fresh readable ownership baseline');
+            }
             const task = this.task(await client.bindOwneraid(ownerAid));
             if (subject.client !== client || subject.generation !== generation) {
                 throw new OwnershipError('CLIENT_REPLACED', 'Subject SDK client changed during binding; the request may have been submitted');
             }
             if (!task || task.sub_aid !== subjectAid || task.owner_aid !== ownerAid || task.operation !== 'bind') {
-                throw new OwnershipError('TASK_MISMATCH', 'SDK returned a binding task for a different subject or owner');
+                throw new OwnershipError('TASK_MISMATCH', 'SDK returned a binding result for a different subject or owner');
             }
             subject.view.task = task;
-            subject.view.requestStatus = 'submitted';
-            this.persist(subjectAid, subject);
+            subject.view.requestStatus = task.status === 'error' ? 'error' : 'submitted';
+            subject.view.reason = task.reason;
+            if (task.status === 'error' || task.status === 'rejected' || task.status === 'stopped') {
+                throw Object.assign(new OwnershipError(task.code ?? 'BIND_FAILED', task.reason ?? `Binding ended with ${task.status}`), {
+                    retryable: task.retryable,
+                });
+            }
             this.invalidate(subject, 'Binding submitted; waiting for explicit owner approval and fresh consensus');
             this.schedule(subjectAid, subject);
             return this.snapshot(subjectAid);
         }
         catch (error) {
-            if (subject.client === client && subject.generation === generation) {
+            if (!client || (subject.client === client && subject.generation === generation)) {
                 subject.view.requestStatus = 'interrupted';
                 subject.view.reason = error instanceof Error ? error.message : String(error);
-                this.persist(subjectAid, subject);
             }
             throw error;
         }
     }
-    subject(subjectAid) {
-        this.assertAid(subjectAid);
-        let subject = this.subjects.get(subjectAid);
-        if (subject)
-            return subject;
-        let saved = null;
-        let persistenceError;
+    async tryLocalBind(subjectAid, ownerAid) {
+        let store;
+        let ownerClient;
+        let subClient;
+        let invoked = false;
         try {
-            const filename = this.statePath(subjectAid);
-            saved = atomicReadJson(filename);
-            const savedTask = saved?.task !== undefined ? this.task(saved.task) : undefined;
-            if ((saved === null && fs.existsSync(filename)) || (saved && (saved.version !== 1 || saved.subjectAid !== subjectAid
-                || (saved.requestedOwnerAid !== undefined && (typeof saved.requestedOwnerAid !== 'string' || !isValidAid(saved.requestedOwnerAid)))
-                || (saved.task !== undefined && (!savedTask || savedTask.sub_aid !== subjectAid || savedTask.owner_aid !== saved.requestedOwnerAid))
-                || (saved.requestStatus !== undefined && !['requesting', 'submitted', 'interrupted', 'error'].includes(String(saved.requestStatus)))))) {
-                throw new Error('Invalid persisted ownership task');
+            const sdkStore = await import('../../aun/aid/store.js');
+            store = await sdkStore.getAidStore({ slotId: sdkStore.SLOT.cli });
+            const ownerIdentity = store.load(ownerAid);
+            const subIdentity = store.load(subjectAid);
+            if (!ownerIdentity.ok || !subIdentity.ok
+                || !ownerIdentity.data.aid.isPrivateKeyValid() || !subIdentity.data.aid.isPrivateKeyValid())
+                return undefined;
+            ownerClient = await sdkStore.loadClient(store, ownerAid);
+            subClient = await sdkStore.loadClient(store, subjectAid);
+            if (typeof ownerClient.bindLocalSubaid !== 'function'
+                || ownerClient.getType() !== 'agent' || subClient.getType() !== 'agent')
+                return undefined;
+            invoked = true;
+            const task = this.task(await ownerClient.bindLocalSubaid(subClient));
+            if (!task || task.operation !== 'bind' || task.sub_aid !== subjectAid || task.owner_aid !== ownerAid
+                || task.status !== 'completed') {
+                throw Object.assign(new OwnershipError(task?.code ?? 'LOCAL_BIND_FAILED', task?.reason ?? 'Local binding did not complete'), { retryable: task?.retryable });
+            }
+            const consensus = await ownerClient.checkOwnershipConsensus(subjectAid);
+            if (consensus.status !== 'consensus' || consensus.owner_aid !== ownerAid
+                || consensus.sub_aid !== subjectAid || consensus.relation_version !== task.target_relation_version
+                || consensus.lock !== 'locked') {
+                throw new OwnershipError('CONSENSUS_REQUIRED', 'Local binding did not produce the expected fresh ownership consensus');
             }
+            return { task, consensus };
         }
         catch (error) {
-            saved = null;
-            persistenceError = `Ownership task storage is unavailable: ${error instanceof Error ? error.message : String(error)}`;
+            if (!invoked) {
+                logger.debug(`[ownership] local identity pair unavailable for ${subjectAid}/${ownerAid}: ${error instanceof Error ? error.message : String(error)}`);
+                return undefined;
+            }
+            throw error;
         }
-        const task = saved?.subjectAid === subjectAid ? this.task(saved.task) : undefined;
+        finally {
+            if (ownerClient) {
+                try {
+                    await ownerClient.close();
+                }
+                catch { }
+            }
+            if (subClient) {
+                try {
+                    await subClient.close();
+                }
+                catch { }
+            }
+            try {
+                store?.close();
+            }
+            catch { }
+        }
+    }
+    applyConsensus(subjectAid, subject, consensus) {
+        if (consensus.sub_aid !== subjectAid)
+            throw new OwnershipError('TASK_MISMATCH', 'Ownership consensus subject does not match');
+        const ownerAid = consensus.status === 'consensus' && typeof consensus.owner_aid === 'string'
+            && isValidAid(consensus.owner_aid) && consensus.owner_aid !== subjectAid ? consensus.owner_aid : undefined;
+        if (consensus.status === 'consensus' && !ownerAid)
+            throw new OwnershipError('TASK_MISMATCH', 'Ownership consensus owner is invalid');
+        const previousOwner = this.owner(subjectAid);
+        const previousStatus = subject.view.consensusStatus;
+        const checkedAt = this.now();
+        const pending = subject.view.task?.status === 'pending' || subject.view.requestStatus === 'requesting';
+        subject.view = {
+            ...subject.view, ownerAid,
+            relation: consensus.status === 'consensus' || consensus.status === 'unbound' || consensus.status === 'released'
+                ? { consensusStatus: consensus.status, ownerAid, checkedAt, relationVersion: consensus.relation_version }
+                : subject.view.relation,
+            authorizationStatus: ownerAid ? 'verified' : 'unavailable', consensusStatus: consensus.status,
+            consensus: JSON.parse(JSON.stringify(consensus)),
+            checkedAt, validUntil: checkedAt + (this.options.lifetimeMs ?? OWNERSHIP_CACHE_MAX_AGE_MS),
+            revision: subject.view.revision + (previousOwner !== ownerAid || subject.view.consensusStatus !== consensus.status
+                || subject.view.consensus?.relation_version !== consensus.relation_version
+                || subject.view.consensus?.lock !== consensus.lock ? 1 : 0),
+            reason: consensus.reason,
+            synchronization: {
+                status: consensus.status === 'unavailable' || consensus.status === 'not_applicable' ? 'unavailable'
+                    : consensus.status === 'invalid' ? 'conflict'
+                        : ownerAid && subject.view.requestedOwnerAid && subject.view.requestedOwnerAid !== ownerAid ? 'conflict'
+                            : consensus.status === 'single_sided' || (!ownerAid && pending) ? 'pending' : 'synced',
+                runtimeOwnerAid: ownerAid,
+            },
+        };
+        if (previousOwner !== ownerAid || previousStatus !== consensus.status)
+            this.notify(subjectAid, ownerAid);
+    }
+    subject(subjectAid) {
+        this.assertAid(subjectAid);
+        let subject = this.subjects.get(subjectAid);
+        if (subject)
+            return subject;
         subject = {
-            generation: 0, epoch: 0, query: 0, subscriptions: [], taskEvents: new Set(), persistenceError,
+            generation: 0, epoch: 0, query: 0, subscriptions: [], taskEvents: new Set(),
+            requests: new Map(), decisionTasks: new Map(),
             view: {
                 subjectAid, consensusStatus: 'unavailable', authorizationStatus: 'unavailable', connected: false, revision: 0,
-                task: task?.sub_aid === subjectAid ? task : undefined,
-                requestedOwnerAid: saved?.subjectAid === subjectAid && typeof saved.requestedOwnerAid === 'string'
-                    && isValidAid(saved.requestedOwnerAid) ? saved.requestedOwnerAid : undefined,
-                requestStatus: saved?.requestStatus === 'requesting' || saved?.requestStatus === 'interrupted' ? 'interrupted'
-                    : task ? 'submitted' : undefined,
                 synchronization: { status: 'unavailable' },
             },
         };
@@ -519,7 +773,8 @@ export class OwnerResolver {
         subject.epoch += 1;
         subject.view = {
             ...subject.view, ownerAid: undefined, consensusStatus: 'unavailable', authorizationStatus: 'unavailable', validUntil: undefined,
-            revision: subject.view.revision + 1, reason, synchronization: { status: 'unavailable' },
+            revision: subject.view.revision + 1, reason, refreshFailure: undefined,
+            synchronization: { status: 'unavailable' },
         };
         if (previousOwner)
             this.notify(subject.view.subjectAid);
@@ -544,63 +799,17 @@ export class OwnerResolver {
             }
         }
     }
-    schedule(subjectAid, subject) {
+    schedule(subjectAid, subject, allowTransient = true) {
         if (subject.timer || !subject.client || !subject.view.connected)
             return;
         subject.timer = setTimeout(() => {
             subject.timer = undefined;
-            void this.refresh(subjectAid, { force: true }).catch(error => {
+            void this.refresh(subjectAid, { force: true, allowTransient }).catch(error => {
                 logger.warn(`[ownership] Event refresh failed for ${subjectAid}: ${error instanceof Error ? error.message : String(error)}`);
             });
         }, 0);
         subject.timer.unref?.();
     }
-    schedulePendingRefresh(subjectAid, subject) {
-        // The owner's final publication can become readable after the last SDK
-        // event. A cached unbound/single-sided observation must not strand an
-        // approved creation in ownerpending until the next connection or command.
-        // Only fresh SDK consensus can authorize the existing owner-bound handler;
-        // this never resubmits a binding or infers ownership from task completion.
-        const needsRefresh = subject.client && subject.view.connected
-            && subject.view.requestedOwnerAid && subject.view.consensusStatus !== 'consensus'
-            && (subject.view.task?.status === 'pending' || subject.view.task?.status === 'completed'
-                || subject.view.requestStatus === 'requesting' || subject.view.requestStatus === 'interrupted');
-        if (!needsRefresh) {
-            if (subject.pendingRefreshTimer)
-                clearTimeout(subject.pendingRefreshTimer);
-            subject.pendingRefreshTimer = undefined;
-            return;
-        }
-        if (subject.pendingRefreshTimer)
-            return;
-        subject.pendingRefreshTimer = setTimeout(() => {
-            subject.pendingRefreshTimer = undefined;
-            void this.refresh(subjectAid, { force: true }).catch(error => {
-                logger.warn(`[ownership] Pending consensus refresh failed for ${subjectAid}: ${error instanceof Error ? error.message : String(error)}`);
-            });
-        }, OWNERSHIP_PENDING_REFRESH_MS);
-        subject.pendingRefreshTimer.unref?.();
-    }
-    statePath(subjectAid) {
-        return path.join(this.options.stateDirectory?.() ?? path.join(resolvePaths().root, 'data', 'ownership'), `${subjectAid}.json`);
-    }
-    persist(subjectAid, subject) {
-        if (!subject.persistenceError) {
-            try {
-                const filename = this.statePath(subjectAid);
-                fs.mkdirSync(path.dirname(filename), { recursive: true });
-                atomicWriteJson(filename, {
-                    version: 1, subjectAid, requestedOwnerAid: subject.view.requestedOwnerAid,
-                    requestStatus: subject.view.requestStatus, task: subject.view.task,
-                });
-                return;
-            }
-            catch (error) {
-                subject.persistenceError = `Ownership task storage is unavailable: ${error instanceof Error ? error.message : String(error)}`;
-            }
-        }
-        throw new OwnershipError('persistence_unavailable', subject.persistenceError);
-    }
     now() {
         return this.options.now?.() ?? Date.now();
     }
@@ -639,15 +848,107 @@ export class OwnerResolver {
     record(value) {
         return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
     }
-    task(value) {
+    trackBindingRequest(localAid, subject, event, record) {
+        const requestAction = record.action === 'bind.request' || record.action === 'transfer.request';
+        if (event === 'ownership.request'
+            && (record.operation !== 'bind' || (record.action !== undefined && !requestAction)))
+            return;
+        const task = this.bindingTask(event === 'ownership.request'
+            ? { ...record, status: 'pending', step: 'approval' }
+            : record, event);
+        if (!task || (task.sub_aid !== localAid && task.owner_aid !== localAid))
+            return;
+        const request = subject.requests.get(task.operation_id);
+        const decisionTask = subject.decisionTasks.get(task.operation_id);
+        if ((request && !this.sameBindingTask(task, request))
+            || (decisionTask && !this.sameBindingTask(task, decisionTask)))
+            return;
+        if (event === 'ownership.request') {
+            const requester = record.requester_aid;
+            const remote = task.sub_aid === localAid ? task.owner_aid : task.sub_aid;
+            if (task.status !== 'pending' || task.step !== 'approval' || requester !== remote || decisionTask)
+                return;
+            subject.requests.set(task.operation_id, {
+                ...task, requester_aid: remote, local_role: task.sub_aid === localAid ? 'sub' : 'owner',
+            });
+            logger.info(`[ownership] inbound binding ${JSON.stringify({
+                localAid, operationId: task.operation_id, subAid: task.sub_aid, ownerAid: task.owner_aid,
+            })}`);
+        }
+        else {
+            const awaitingApproval = task.step === 'approval'
+                && (task.status === 'pending' || (task.status === 'error' && task.retryable === true))
+                && !['ownership.completed', 'ownership.rejected', 'ownership.stopped'].includes(event);
+            if (request && awaitingApproval)
+                subject.requests.set(task.operation_id, { ...request, ...task });
+            else
+                subject.requests.delete(task.operation_id);
+        }
+        const retryableDecision = task.step !== 'approval'
+            && (task.status === 'pending' || (task.status === 'error' && task.retryable === true))
+            && !['ownership.completed', 'ownership.rejected', 'ownership.stopped'].includes(event);
+        if (decisionTask || retryableDecision) {
+            subject.decisionTasks.set(task.operation_id, task);
+            subject.view.decisionTask = task;
+        }
+        else if (subject.view.decisionTask?.operation_id === task.operation_id) {
+            subject.view.decisionTask = task;
+        }
+    }
+    sameBindingTask(left, right) {
+        return left.operation_id === right.operation_id && left.sub_aid === right.sub_aid
+            && left.owner_aid === right.owner_aid && left.new_owner_aid === right.new_owner_aid
+            && left.base_relation_version === right.base_relation_version
+            && left.target_relation_version === right.target_relation_version;
+    }
+    /** Only public task fields are exposed; raw SDK records remain SDK-owned. */
+    bindingTask(value, event) {
+        const task = this.task(value, event);
+        if (!task || task.operation !== 'bind' || !CREATION_BIND_OPERATION_ID.test(task.operation_id)
+            || task.sub_aid === task.owner_aid || !Number.isSafeInteger(task.base_relation_version)
+            || task.base_relation_version < 0 || !Number.isSafeInteger(task.target_relation_version)
+            || task.target_relation_version !== task.base_relation_version + 1)
+            return undefined;
+        if (task.new_owner_aid !== undefined)
+            return undefined;
+        return {
+            operation_id: task.operation_id, operation: task.operation, sub_aid: task.sub_aid, owner_aid: task.owner_aid,
+            ...(task.new_owner_aid ? { new_owner_aid: task.new_owner_aid } : {}),
+            base_relation_version: task.base_relation_version, target_relation_version: task.target_relation_version,
+            status: task.status, step: task.step,
+            ...(typeof task.code === 'string' ? { code: task.code } : {}),
+            ...(typeof task.reason === 'string' ? { reason: task.reason } : {}),
+            ...(typeof task.retryable === 'boolean' ? { retryable: task.retryable } : {}),
+        };
+    }
+    task(value, event) {
         const record = this.record(value);
+        const baseRelationVersion = record?.base_relation_version;
+        const targetRelationVersion = record?.target_relation_version;
         if (!record || typeof record.operation_id !== 'string' || !record.operation_id
-            || record.operation !== 'bind' || typeof record.sub_aid !== 'string' || !isValidAid(record.sub_aid)
+            || !['bind', 'transfer'].includes(String(record.operation)) || typeof record.sub_aid !== 'string' || !isValidAid(record.sub_aid)
             || typeof record.owner_aid !== 'string' || !isValidAid(record.owner_aid)
-            || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(String(record.status))
-            || typeof record.step !== 'string')
+            || (record.new_owner_aid !== undefined && (typeof record.new_owner_aid !== 'string' || !isValidAid(record.new_owner_aid)))
+            || typeof baseRelationVersion !== 'number' || !Number.isSafeInteger(baseRelationVersion) || baseRelationVersion < 0
+            || typeof targetRelationVersion !== 'number' || !Number.isSafeInteger(targetRelationVersion)
+            || targetRelationVersion !== baseRelationVersion + 1)
             return undefined;
-        return JSON.parse(JSON.stringify(record));
+        const status = ['pending', 'completed', 'rejected', 'stopped', 'error'].includes(String(record.status))
+            ? record.status
+            : event === 'ownership.rejected' ? 'rejected'
+                : event === 'ownership.completed' ? 'completed' : 'pending';
+        const step = typeof record.step === 'string' ? record.step
+            : event === 'ownership.request' ? 'approval' : 'local_actions';
+        return {
+            operation_id: record.operation_id, operation: record.operation,
+            sub_aid: record.sub_aid, owner_aid: record.owner_aid,
+            ...(typeof record.new_owner_aid === 'string' ? { new_owner_aid: record.new_owner_aid } : {}),
+            base_relation_version: baseRelationVersion, target_relation_version: targetRelationVersion,
+            status, step,
+            ...(typeof record.code === 'string' ? { code: record.code } : {}),
+            ...(typeof record.reason === 'string' ? { reason: record.reason } : {}),
+            ...(typeof record.retryable === 'boolean' ? { retryable: record.retryable } : {}),
+        };
     }
 }
 export const ownerResolver = new OwnerResolver();
@@ -662,10 +963,17 @@ export async function refreshOwnershipForAuthorization(subjectAid, options = {})
     const ownershipSubjectAid = daemonAid && subjectAid === `${daemonAid}#daemon` ? daemonAid : subjectAid;
     const subjects = new Set([ownershipSubjectAid, ...(!ownershipSubjectAid || options.includeDaemon !== false ? [daemonAid] : [])]
         .filter((aid) => !!aid));
-    await Promise.all([...subjects].map(aid => ownerResolver.refresh(aid, {
+    const views = await Promise.all([...subjects].map(aid => ownerResolver.refresh(aid, {
         maxAgeMs: options.maxAgeMs ?? OWNERSHIP_AUTHORIZATION_MAX_AGE_MS,
         force: options.force,
+        allowTransient: options.allowTransient,
     })));
+    if (!options.allowTransient) {
+        const failure = views.find(view => view.consensusStatus === 'unavailable' && view.refreshFailure);
+        if (failure?.refreshFailure) {
+            throw new OwnershipError('OWNER_REFRESH_FAILED', `Ownership refresh failed (${failure.refreshFailure.code}): ${failure.refreshFailure.reason}`);
+        }
+    }
 }
 export async function assertOwnershipAuthorization(context) {
     const authorization = context?.executionPermission;
@@ -673,15 +981,32 @@ export async function assertOwnershipAuthorization(context) {
     const ownerActor = hasTrustedPrincipal(context?.actor) ? context.actor.principalId : undefined;
     if (!authorization && !ownerRole)
         return;
-    await refreshOwnershipForAuthorization(context?.selfAid ?? authorization?.agentAid);
+    await refreshOwnershipForAuthorization(context?.selfAid ?? authorization?.agentAid, { allowTransient: true });
+    const subjectAid = context?.selfAid ?? authorization?.agentAid;
     if (authorization) {
         if (!getDaemonOwners().includes(authorization.authorizedBy)
             || (authorization.source === 'agent-policy'
                 && !ownerResolver.isOwner(authorization.agentAid ?? '', authorization.authorizedBy))) {
+            const view = subjectAid ? ownerResolver.snapshot(subjectAid) : undefined;
+            logger.warn(`[ownership] authorization denied ${JSON.stringify({
+                subjectAid, authorizedBy: authorization.authorizedBy,
+                consensusStatus: view?.consensusStatus,
+                failureCode: view?.refreshFailure?.code,
+                refreshFailure: view?.refreshFailure?.reason,
+                refreshFailureKind: view?.refreshFailure?.kind,
+            })}`);
             throw new OwnershipError('OWNER_UNAVAILABLE', 'Current Owner no longer authorizes this execution');
         }
     }
     else if (!context?.selfAid || !ownerResolver.isOwner(context.selfAid, ownerActor)) {
+        const view = context?.selfAid ? ownerResolver.snapshot(context.selfAid) : undefined;
+        logger.warn(`[ownership] authorization denied ${JSON.stringify({
+            subjectAid: context?.selfAid, actorAid: ownerActor,
+            consensusStatus: view?.consensusStatus,
+            failureCode: view?.refreshFailure?.code,
+            refreshFailure: view?.refreshFailure?.reason,
+            refreshFailureKind: view?.refreshFailure?.kind,
+        })}`);
         throw new OwnershipError('OWNER_UNAVAILABLE', 'Current Owner could not be verified; start a new task with the current role');
     }
 }