oh-my-codex 0.20.2 → 0.20.5

package/dist/subagents/tracker.js

@@ -1,27 +1,61 @@
 import { randomUUID } from 'node:crypto';
 import { closeSync, existsSync, ftruncateSync, linkSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, writeSync } from 'node:fs';
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import { hostname } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { AGENT_DEFINITIONS } from '../agents/definitions.js';
-import { getBaseStateDir, getBaseStateDirWithSource } from '../state/paths.js';
-import { canonicalizeOriginCwd } from '../leader/contract.js';
+import { getBaseStateDir } from '../state/paths.js';
 import { codexAgentsDir, projectCodexAgentsDir } from '../utils/paths.js';
 export const SUBAGENT_TRACKING_SCHEMA_VERSION = 1;
 export const DEFAULT_SUBAGENT_ACTIVE_WINDOW_MS = 120_000;
-export const OMX_ADAPTED_PROVENANCE = 'omx_adapted';
 export const NATIVE_SUBAGENT_PROVENANCE = 'native_subagent';
+// Legacy descriptive provenance written by pre-authority releases. Tolerated as
+// descriptive-only evidence: it never grants reopen authority and never blocks a
+// newly attested valid direct child, but it is preserved so authority-consistency
+// checks can distinguish recognized legacy data from unknown descriptive views.
+export const DESCRIPTIVE_ADAPTED_PROVENANCE = 'adapted';
 const KNOWN_TYPED_AGENT_ROLES = new Set(Object.keys(AGENT_DEFINITIONS).map((role) => role.toLowerCase()));
 export function subagentTrackingPath(cwd) {
     return join(getBaseStateDir(cwd), 'subagent-tracking.json');
 }
-export function resolveInstalledRoleName(role, codexHomeOverride) {
+/**
+ * Authority-relevant projection of a tracker state. The generic descriptive
+ * writer is allowed to publish descriptive churn, but it must never roll back
+ * an authority decision that another process committed after the caller read
+ * its snapshot. Comparing this projection is the durable equivalent of a CAS
+ * on the authority surface without forcing every descriptive caller to hold
+ * the tracker lock across its own read/modify/write.
+ */
+function authorityRevisionOf(state) {
+    const sessions = Object.keys(state.sessions).sort().map((sessionId) => {
+        const session = state.sessions[sessionId];
+        const threads = Object.keys(session.threads).sort().map((threadId) => {
+            const thread = session.threads[threadId];
+            return [
+                threadId,
+                thread.kind,
+                thread.provenance_kind ?? '',
+                thread.direct_child_root_id ?? '',
+                thread.direct_child_parent_id ?? '',
+                thread.reopen_authority_revoked === true ? '1' : '',
+                thread.reopen_authority_conflict_reason ?? '',
+                thread.reopen_authority_conflict_at ?? '',
+                // Availability gates whether an eligible child is actually emitted as
+                // a reopen target, so it is part of the authority surface.
+                thread.status ?? '',
+            ].join('\u0001');
+        });
+        return [sessionId, session.leader_thread_id ?? '', ...threads].join('\u0002');
+    });
+    return sessions.join('\u0003');
+}
+export function resolveInstalledRoleName(role, codexHomeOverride, projectRootOverride) {
     const normalizedRole = role.trim().toLowerCase();
     if (!normalizedRole)
         return null;
     if (KNOWN_TYPED_AGENT_ROLES.has(normalizedRole))
         return normalizedRole;
-    for (const agentsDir of [codexAgentsDir(codexHomeOverride), projectCodexAgentsDir()]) {
+    for (const agentsDir of [codexAgentsDir(codexHomeOverride), projectCodexAgentsDir(projectRootOverride)]) {
         try {
             for (const entry of readdirSync(agentsDir, { withFileTypes: true })) {
                 if (!entry.isFile() || !entry.name.endsWith('.toml'))
@@ -41,7 +75,6 @@ export function createSubagentTrackingState() {
     return {
         schemaVersion: SUBAGENT_TRACKING_SCHEMA_VERSION,
         sessions: {},
-        pending_role_intents: [],
     };
 }
 function normalizeSubagentStatus(value) {
@@ -119,40 +152,6 @@ export function isTrustedSubagentThread(session, threadId) {
         return false;
     return session.threads[normalizedThreadId]?.kind === 'subagent';
 }
-function normalizePendingRoleIntent(value) {
-    if (!value || typeof value !== 'object')
-        return null;
-    const candidate = value;
-    const role = readOptionalTrimmedString(candidate.role);
-    const sessionId = readOptionalTrimmedString(candidate.session_id);
-    const parentThreadId = readOptionalTrimmedString(candidate.parent_thread_id);
-    const createdAt = readOptionalTrimmedString(candidate.created_at);
-    const expiresAt = readOptionalTrimmedString(candidate.expires_at);
-    if (!role || !sessionId || !parentThreadId || !Object.hasOwn(candidate, 'correlation_token') || !createdAt || !expiresAt)
-        return null;
-    if (!Number.isFinite(Date.parse(createdAt)) || !Number.isFinite(Date.parse(expiresAt)))
-        return null;
-    const bindingState = candidate.binding_state === 'bound' ? 'bound' : undefined;
-    const boundAt = readOptionalTrimmedString(candidate.bound_at);
-    const hasValidBoundAt = Boolean(boundAt && Number.isFinite(Date.parse(boundAt)));
-    const originCwd = readOptionalTrimmedString(candidate.origin_cwd);
-    return {
-        role,
-        session_id: sessionId,
-        parent_thread_id: parentThreadId,
-        // Bound journals are durable security records. Retain malformed credentials verbatim so
-        // completion can reject them rather than silently converting them into claimant-less data.
-        correlation_token: candidate.correlation_token,
-        created_at: createdAt,
-        expires_at: expiresAt,
-        ...(bindingState ? { binding_state: bindingState } : {}),
-        ...(bindingState && Object.hasOwn(candidate, 'binding_claimant_token')
-            ? { binding_claimant_token: candidate.binding_claimant_token }
-            : {}),
-        ...(bindingState && hasValidBoundAt ? { bound_at: boundAt } : {}),
-        ...(originCwd ? { origin_cwd: originCwd } : {}),
-    };
-}
 export function normalizeSubagentTrackingState(input) {
     const base = createSubagentTrackingState();
     if (!input || typeof input !== 'object')
@@ -190,9 +189,11 @@ export function normalizeSubagentTrackingState(input) {
                 turn_count: typeof candidate.turn_count === 'number' && Number.isFinite(candidate.turn_count) && candidate.turn_count > 0 ? candidate.turn_count : 1,
                 ...(typeof candidate.mode === 'string' && candidate.mode.trim().length > 0 ? { mode: candidate.mode } : {}),
                 ...(typeof candidate.role === 'string' && candidate.role.trim().length > 0 ? { role: candidate.role.trim() } : {}),
-                ...(typeof candidate.provenance_kind === 'string' && candidate.provenance_kind.trim().length > 0
-                    ? { provenance_kind: candidate.provenance_kind.trim() }
-                    : {}),
+                ...(candidate.provenance_kind === NATIVE_SUBAGENT_PROVENANCE
+                    ? { provenance_kind: NATIVE_SUBAGENT_PROVENANCE }
+                    : candidate.provenance_kind === DESCRIPTIVE_ADAPTED_PROVENANCE
+                        ? { provenance_kind: DESCRIPTIVE_ADAPTED_PROVENANCE }
+                        : {}),
                 ...(typeof candidate.lane_id === 'string' && candidate.lane_id.trim().length > 0 ? { lane_id: candidate.lane_id.trim() } : {}),
                 ...(typeof candidate.scope === 'string' && candidate.scope.trim().length > 0 ? { scope: candidate.scope.trim() } : {}),
                 ...(typeof candidate.agent_nickname === 'string' && candidate.agent_nickname.trim().length > 0
@@ -217,37 +218,117 @@ export function normalizeSubagentTrackingState(input) {
                 ...(typeof candidate.resume_failure_reason === 'string' && candidate.resume_failure_reason.trim().length > 0
                     ? { resume_failure_reason: candidate.resume_failure_reason.trim() }
                     : {}),
+                ...(typeof candidate.direct_child_root_id === 'string' && candidate.direct_child_root_id.trim().length > 0
+                    ? { direct_child_root_id: candidate.direct_child_root_id.trim() }
+                    : {}),
+                ...(typeof candidate.direct_child_parent_id === 'string' && candidate.direct_child_parent_id.trim().length > 0
+                    ? { direct_child_parent_id: candidate.direct_child_parent_id.trim() }
+                    : {}),
+                ...(candidate.reopen_authority_revoked === true ? { reopen_authority_revoked: true } : {}),
+                ...(typeof candidate.reopen_authority_conflict_reason === 'string' && candidate.reopen_authority_conflict_reason.trim()
+                    ? { reopen_authority_conflict_reason: candidate.reopen_authority_conflict_reason.trim() }
+                    : {}),
+                ...(typeof candidate.reopen_authority_conflict_at === 'string' && candidate.reopen_authority_conflict_at.trim()
+                    ? { reopen_authority_conflict_at: candidate.reopen_authority_conflict_at.trim() }
+                    : {}),
             };
         }
         const sessionCandidate = rawSession;
         const leaderThreadId = typeof sessionCandidate.leader_thread_id === 'string' ? sessionCandidate.leader_thread_id.trim() || undefined : undefined;
-        const leaderAttestedAt = typeof sessionCandidate.leader_attested_at === 'string' && sessionCandidate.leader_attested_at.trim().length > 0
-            ? sessionCandidate.leader_attested_at.trim()
-            : undefined;
-        const leaderAttestSource = typeof sessionCandidate.leader_attest_source === 'string' && sessionCandidate.leader_attest_source.trim().length > 0
-            ? sessionCandidate.leader_attest_source.trim()
-            : undefined;
         const updatedAt = typeof sessionCandidate.updated_at === 'string' && sessionCandidate.updated_at.trim().length > 0
             ? sessionCandidate.updated_at
             : new Date(0).toISOString();
         sessions[sessionId] = {
             session_id: sessionId,
-            leader_thread_id: leaderThreadId,
-            ...(leaderAttestedAt ? { leader_attested_at: leaderAttestedAt } : {}),
-            ...(leaderAttestSource ? { leader_attest_source: leaderAttestSource } : {}),
+            ...(leaderThreadId ? { leader_thread_id: leaderThreadId } : {}),
             updated_at: updatedAt,
             threads,
         };
     }
-    const pendingRoleIntents = Array.isArray(parsed.pending_role_intents)
-        ? parsed.pending_role_intents.map((intent) => normalizePendingRoleIntent(intent)).filter((intent) => intent !== null)
-        : [];
     return {
         schemaVersion: SUBAGENT_TRACKING_SCHEMA_VERSION,
         sessions,
-        pending_role_intents: pendingRoleIntents,
     };
 }
+function parseStrictSubagentTrackingState(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    const candidate = parsed;
+    if (candidate.schemaVersion !== SUBAGENT_TRACKING_SCHEMA_VERSION || !candidate.sessions || typeof candidate.sessions !== 'object' || Array.isArray(candidate.sessions))
+        return null;
+    const normalizedSessionIds = new Set();
+    for (const [sessionId, sessionValue] of Object.entries(candidate.sessions)) {
+        if (!sessionId || sessionId.trim() !== sessionId || normalizedSessionIds.has(sessionId.trim()))
+            return null;
+        normalizedSessionIds.add(sessionId.trim());
+        if (!sessionValue || typeof sessionValue !== 'object' || Array.isArray(sessionValue))
+            return null;
+        const session = sessionValue;
+        if (session.session_id !== sessionId || typeof session.updated_at !== 'string' || !session.updated_at.trim())
+            return null;
+        if (!session.threads || typeof session.threads !== 'object' || Array.isArray(session.threads))
+            return null;
+        if (session.leader_thread_id !== undefined && (typeof session.leader_thread_id !== 'string' || !session.leader_thread_id.trim() || session.leader_thread_id.trim() !== session.leader_thread_id))
+            return null;
+        const normalizedThreadIds = new Set();
+        for (const [threadId, threadValue] of Object.entries(session.threads)) {
+            if (!threadId || threadId.trim() !== threadId || normalizedThreadIds.has(threadId.trim()))
+                return null;
+            normalizedThreadIds.add(threadId.trim());
+            if (!threadValue || typeof threadValue !== 'object' || Array.isArray(threadValue))
+                return null;
+            const thread = threadValue;
+            if (thread.thread_id !== threadId || (thread.kind !== 'leader' && thread.kind !== 'subagent'))
+                return null;
+            if (typeof thread.first_seen_at !== 'string' || !thread.first_seen_at.trim())
+                return null;
+            if (typeof thread.last_seen_at !== 'string' || !thread.last_seen_at.trim())
+                return null;
+            if (typeof thread.turn_count !== 'number' || !Number.isFinite(thread.turn_count) || thread.turn_count < 1)
+                return null;
+            const hasAuthorityEvidence = thread.provenance_kind === NATIVE_SUBAGENT_PROVENANCE
+                || thread.direct_child_root_id !== undefined
+                || thread.direct_child_parent_id !== undefined
+                || thread.reopen_authority_revoked !== undefined
+                || thread.reopen_authority_conflict_reason !== undefined
+                || thread.reopen_authority_conflict_at !== undefined;
+            if (hasAuthorityEvidence && thread.status !== undefined && normalizeSubagentStatus(thread.status) === undefined)
+                return null;
+            if (hasAuthorityEvidence && thread.provenance_kind !== undefined && thread.provenance_kind !== NATIVE_SUBAGENT_PROVENANCE)
+                return null;
+            for (const field of ['direct_child_root_id', 'direct_child_parent_id', 'reopen_authority_conflict_reason', 'reopen_authority_conflict_at']) {
+                if (thread[field] !== undefined && (typeof thread[field] !== 'string' || !thread[field].trim() || thread[field].trim() !== thread[field]))
+                    return null;
+            }
+            if (thread.reopen_authority_revoked !== undefined && typeof thread.reopen_authority_revoked !== 'boolean')
+                return null;
+            if ((thread.direct_child_root_id === undefined) !== (thread.direct_child_parent_id === undefined))
+                return null;
+            if ((thread.reopen_authority_conflict_reason !== undefined || thread.reopen_authority_conflict_at !== undefined) && thread.reopen_authority_revoked !== true)
+                return null;
+        }
+    }
+    return normalizeSubagentTrackingState(parsed);
+}
+function readSubagentTrackingStateStrictSync(cwd) {
+    const path = subagentTrackingPath(cwd);
+    if (!existsSync(path))
+        return { ok: true, state: createSubagentTrackingState() };
+    try {
+        const state = parseStrictSubagentTrackingState(readFileSync(path, 'utf-8'));
+        return state ? { ok: true, state } : { ok: false };
+    }
+    catch {
+        return { ok: false };
+    }
+}
 function atomicTrackingTempPath(path) {
     return `${path}.${process.pid}.${randomUUID()}.tmp`;
 }
@@ -587,41 +668,14 @@ export function withCrossProcessFileLockSync(resourcePath, operation, options =
         releaseCrossProcessFileLock(lockPath, token);
     }
 }
-function readSubagentTrackingStateSync(cwd) {
-    const path = subagentTrackingPath(cwd);
-    if (!existsSync(path))
-        return createSubagentTrackingState();
-    try {
-        return normalizeSubagentTrackingState(JSON.parse(readFileSync(path, 'utf-8')));
-    }
-    catch {
-        return createSubagentTrackingState();
-    }
+function threadIsTrackedAsSubagent(state, threadId) {
+    const id = threadId.trim();
+    return Boolean(id) && Object.values(state.sessions).some((session) => isTrustedSubagentThread(session, id));
 }
-// #3181: strict readers for the leader-attestation security decision. A missing file is a
-// legitimate empty state (fresh turn), but an existing file that fails to read/parse must
-// NOT be silently treated as empty — that would let corrupt/unreadable subagent evidence
-// be bypassed. Callers making a security decision (attest vs deny) use these.
-function readSubagentTrackingStateSyncStrict(cwd) {
-    const path = subagentTrackingPath(cwd);
-    let raw;
-    try {
-        raw = readFileSync(path, 'utf-8');
-    }
-    catch (error) {
-        // Only a genuine ENOENT (no file) is a clean empty state. Any other read/access error
-        // (permissions, I/O, ELOOP, …) must fail closed rather than be treated as empty.
-        if (error?.code === 'ENOENT')
-            return { ok: true, state: createSubagentTrackingState() };
-        return { ok: false };
-    }
-    try {
-        return { ok: true, state: normalizeSubagentTrackingState(JSON.parse(raw)) };
-    }
-    catch {
-        return { ok: false };
-    }
+export function hasLeaderSubagentCollision(state, leaderThreadId) {
+    return threadIsTrackedAsSubagent(state, leaderThreadId);
 }
+// Strict reads preserve fail-closed behavior for security-sensitive tracker decisions.
 export async function readSubagentTrackingStateStrict(cwd) {
     const path = subagentTrackingPath(cwd);
     let raw;
@@ -633,22 +687,8 @@ export async function readSubagentTrackingStateStrict(cwd) {
             return { ok: true, state: createSubagentTrackingState() };
         return { ok: false };
     }
-    try {
-        return { ok: true, state: normalizeSubagentTrackingState(JSON.parse(raw)) };
-    }
-    catch {
-        return { ok: false };
-    }
-}
-function threadIsTrackedAsSubagent(state, threadId) {
-    const id = threadId.trim();
-    if (!id)
-        return false;
-    for (const session of Object.values(state.sessions)) {
-        if (session.threads[id]?.kind === 'subagent')
-            return true;
-    }
-    return false;
+    const state = parseStrictSubagentTrackingState(raw);
+    return state ? { ok: true, state } : { ok: false };
 }
 function writeSubagentTrackingStateSync(cwd, state, publish) {
     const normalized = normalizeSubagentTrackingState(state);
@@ -676,526 +716,61 @@ export async function readSubagentTrackingState(cwd) {
     }
 }
 export async function writeSubagentTrackingState(cwd, state) {
-    const normalized = normalizeSubagentTrackingState(state);
     const path = subagentTrackingPath(cwd);
-    await mkdir(dirname(path), { recursive: true });
-    const temporaryPath = atomicTrackingTempPath(path);
-    await writeFile(temporaryPath, `${JSON.stringify(normalized, null, 2)}\n`);
-    await rename(temporaryPath, path);
-    return path;
-}
-function normalizeNowMs(nowMs) {
-    return typeof nowMs === 'number' && Number.isFinite(nowMs) ? nowMs : Date.now();
-}
-function isExpiredPendingRoleIntent(intent, nowMs) {
-    if (intent.binding_state === 'bound')
-        return false;
-    const expiresAtMs = Date.parse(intent.expires_at);
-    return !Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs;
-}
-function pendingRoleIntentPredicates(cwd, canonicalOrigin, nowMs) {
-    const isCwdPartitionedStateRoot = getBaseStateDirWithSource(cwd).rootSource === 'cwd-default';
-    const isOwn = (intent) => (intent.origin_cwd
-        ? canonicalizeOriginCwd(intent.origin_cwd) === canonicalOrigin
-        : isCwdPartitionedStateRoot);
-    const shouldPruneExpired = (intent) => (isOwn(intent)
-        && intent.binding_state !== 'bound'
-        && isExpiredPendingRoleIntent(intent, nowMs));
-    return { isOwn, shouldPruneExpired };
-}
-export function isRoleIntentOwnedByCwd(cwd, intent) {
-    return pendingRoleIntentPredicates(cwd, canonicalizeOriginCwd(cwd), Date.now()).isOwn(intent);
-}
-function sameLogicalRoleIntent(intent, sessionId, parentThreadId, correlationToken) {
-    return (intent.session_id === sessionId
-        && intent.parent_thread_id === parentThreadId
-        && (correlationToken === undefined || intent.correlation_token === correlationToken));
-}
-export function isCanonicalCorrelationToken(value) {
-    return typeof value === 'string' && /^[0-9a-f]{32}$/.test(value);
-}
-export function isCanonicalClaimantToken(value) {
-    return typeof value === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
-}
-function hasOwnBoundLogicalIntent(all, isOwn, sessionId, parentThreadId, correlationToken) {
-    return all.some((intent) => (isOwn(intent)
-        && intent.binding_state === 'bound'
-        && sameLogicalRoleIntent(intent, sessionId, parentThreadId, correlationToken)));
-}
-function selectDominantRoleIntent(candidates, canonicalOrigin) {
-    return [...candidates].sort((left, right) => {
-        const leftIsBound = left.binding_state === 'bound';
-        const rightIsBound = right.binding_state === 'bound';
-        if (leftIsBound !== rightIsBound)
-            return leftIsBound ? -1 : 1;
-        const leftIsExactOrigin = left.origin_cwd !== undefined
-            && canonicalizeOriginCwd(left.origin_cwd) === canonicalOrigin;
-        const rightIsExactOrigin = right.origin_cwd !== undefined
-            && canonicalizeOriginCwd(right.origin_cwd) === canonicalOrigin;
-        if (leftIsExactOrigin !== rightIsExactOrigin)
-            return leftIsExactOrigin ? -1 : 1;
-        const leftStableKey = [
-            left.role,
-            left.correlation_token,
-            left.created_at,
-            left.expires_at,
-            left.binding_state ?? '',
-            left.binding_claimant_token ?? '',
-            left.bound_at ?? '',
-            left.origin_cwd ?? '',
-        ].join('\u0000');
-        const rightStableKey = [
-            right.role,
-            right.correlation_token,
-            right.created_at,
-            right.expires_at,
-            right.binding_state ?? '',
-            right.binding_claimant_token ?? '',
-            right.bound_at ?? '',
-            right.origin_cwd ?? '',
-        ].join('\u0000');
-        return leftStableKey.localeCompare(rightStableKey);
-    })[0] ?? null;
-}
-export function recordPendingRoleIntent(cwd, input) {
-    const role = resolveInstalledRoleName(input.role);
-    if (!role)
-        return { ok: false, reason: 'unknown_role' };
-    const correlationToken = input.correlationToken;
-    if (!isCanonicalCorrelationToken(correlationToken)) {
-        return { ok: false, reason: 'invalid_correlation_token' };
-    }
-    const nowMs = normalizeNowMs(input.nowMs);
-    const sessionId = input.sessionId.trim();
-    const parentThreadId = input.parentThreadId.trim();
-    const canonicalOrigin = canonicalizeOriginCwd(cwd);
-    if (canonicalOrigin === null)
-        return { ok: false, reason: 'invalid_origin' };
-    const { isOwn, shouldPruneExpired } = pendingRoleIntentPredicates(cwd, canonicalOrigin, nowMs);
-    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        const state = readSubagentTrackingStateSync(cwd);
-        const all = state.pending_role_intents;
-        if (all.some((intent) => (isOwn(intent)
-            && intent.session_id === sessionId
-            && intent.parent_thread_id === parentThreadId
-            && (intent.binding_state === 'bound' || !isExpiredPendingRoleIntent(intent, nowMs))))) {
-            return { ok: false, reason: 'single_flight_conflict' };
-        }
-        const ttlMs = typeof input.ttlMs === 'number' && Number.isFinite(input.ttlMs) ? input.ttlMs : 10 * 60_000;
-        const intent = {
-            role,
-            session_id: sessionId,
-            parent_thread_id: parentThreadId,
-            correlation_token: correlationToken,
-            created_at: new Date(nowMs).toISOString(),
-            expires_at: new Date(nowMs + ttlMs).toISOString(),
-            // Store the canonical origin workspace so it authenticates future bind/complete/recover.
-            ...(canonicalOrigin ? { origin_cwd: canonicalOrigin } : {}),
-        };
-        state.pending_role_intents = [...all.filter((candidate) => !shouldPruneExpired(candidate)), intent];
-        context.assertOwnership();
-        writeSubagentTrackingStateSync(cwd, state, context.publish);
-        return { ok: true, intent };
-    });
-}
-/**
- * #3181 Phase 1 carrier write. Durably attest the authenticated leader thread for a
- * session from native-hook-reconciled metadata. Idempotent and fail-closed: it seeds
- * `leader_thread_id` + `leader_attested_at` + `leader_attest_source` only when the
- * session has no conflicting leader already. A different existing leader is NEVER
- * overwritten (returns `native_anchor_mismatch`) so a stale/foreign leader cannot be
- * replaced from a later turn. Authority for `leaderThreadId` is the caller's native
- * payload thread; it must never be derived from a native session id.
- */
-export function attestLeaderThread(cwd, input) {
-    const sessionId = input.sessionId.trim();
-    const leaderThreadId = input.leaderThreadId.trim();
-    const source = input.source.trim() || 'native';
-    if (!sessionId || !leaderThreadId)
-        return { ok: false, reason: 'native_anchor_unavailable' };
-    const nowMs = normalizeNowMs(input.nowMs);
-    const nowIso = new Date(nowMs).toISOString();
-    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        // Strict read under the lock: an unreadable/corrupt tracker denies attestation
-        // (fail closed) rather than silently reading empty.
-        const read = readSubagentTrackingStateSyncStrict(cwd);
-        if (!read.ok)
-            return { ok: false, reason: 'native_anchor_unavailable' };
-        const state = read.state;
-        // Atomic positive counter-evidence: a thread tracked as a subagent in ANY session is
-        // never attested as a leader. Checked under the same lock as the write so a concurrent
-        // child record cannot race in between a caller's pre-check and this attestation.
-        if (threadIsTrackedAsSubagent(state, leaderThreadId)) {
-            return { ok: false, reason: 'native_anchor_mismatch' };
-        }
-        const existing = state.sessions[sessionId];
-        const existingLeader = existing?.leader_thread_id?.trim();
-        if (existingLeader && existingLeader !== leaderThreadId) {
-            return { ok: false, reason: 'native_anchor_mismatch' };
-        }
-        if (existing && existingLeader === leaderThreadId && existing.leader_attested_at) {
-            return { ok: true, alreadyAttested: true };
-        }
-        const session = existing
-            ? { ...existing }
-            : { session_id: sessionId, updated_at: nowIso, threads: {} };
-        session.leader_thread_id = leaderThreadId;
-        session.leader_attested_at = nowIso;
-        session.leader_attest_source = source;
-        session.updated_at = nowIso;
-        state.sessions = { ...state.sessions, [sessionId]: session };
-        context.assertOwnership();
-        writeSubagentTrackingStateSync(cwd, state, context.publish);
-        return { ok: true, alreadyAttested: false };
-    });
-}
-/**
- * #3181 Phase 2. Single tracker-locked publish that self-heals the leader thread record
- * from a durable native attestation and records the pending role intent in the same
- * operation, closing the previous verify-then-record TOCTOU window. Fail-closed:
- * requires a durable attested leader for the session (`native_anchor_unavailable`
- * otherwise) and requires `parentThreadId` to equal the attested `leader_thread_id`
- * (`native_anchor_mismatch` otherwise). `leaderThreadId` is never inferred from a
- * native session id. Duplicate same-identity intents reuse the original receipt
- * (idempotent), never a second leader or a second intent.
- */
-export function ensureLeaderAndRecordIntent(cwd, input) {
-    const role = resolveInstalledRoleName(input.role);
-    if (!role)
-        return { ok: false, reason: 'unknown_role' };
-    const correlationToken = input.correlationToken;
-    if (!isCanonicalCorrelationToken(correlationToken)) {
-        return { ok: false, reason: 'invalid_correlation_token' };
-    }
-    const nowMs = normalizeNowMs(input.nowMs);
-    const sessionId = input.sessionId.trim();
-    const parentThreadId = input.parentThreadId.trim();
-    const canonicalOrigin = canonicalizeOriginCwd(cwd);
-    if (canonicalOrigin === null)
-        return { ok: false, reason: 'invalid_origin' };
-    const { isOwn, shouldPruneExpired } = pendingRoleIntentPredicates(cwd, canonicalOrigin, nowMs);
-    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        // Strict read under the lock: an unreadable/corrupt tracker fails closed rather than
-        // being treated as empty state.
-        const read = readSubagentTrackingStateSyncStrict(cwd);
-        if (!read.ok)
-            return { ok: false, reason: 'native_anchor_unavailable' };
-        const state = read.state;
-        const session = state.sessions[sessionId];
-        const attestedLeader = session?.leader_thread_id?.trim();
-        // Fail closed unless a durable native attestation established the leader anchor.
-        if (!session || !attestedLeader || !session.leader_attested_at) {
-            return { ok: false, reason: 'native_anchor_unavailable' };
-        }
-        if (parentThreadId !== attestedLeader) {
-            return { ok: false, reason: 'native_anchor_mismatch' };
-        }
-        // Symmetric subagent exclusion: independent of which writer won the tracker lock, a
-        // leader thread that is ALSO recorded as a subagent in ANY session (even a different
-        // one) must never receive an adapted role intent. Re-scanned here under the intent-write
-        // lock so a cross-session child record committed after attestation cannot slip through.
-        if (threadIsTrackedAsSubagent(state, attestedLeader)) {
-            return { ok: false, reason: 'native_anchor_mismatch' };
-        }
-        // Single-flight, role-agnostic (preserves recordPendingRoleIntent's invariant): a
-        // live/bound own intent for the same (session, parent) blocks a second live intent.
-        // Same-identity (same role) retries reuse the original receipt (idempotent); a
-        // different-role request for the same live parent returns single_flight_conflict
-        // rather than creating a second ambiguous intent.
-        const all = state.pending_role_intents;
-        const liveOwnIntent = all.find((intent) => (isOwn(intent)
-            && intent.session_id === sessionId
-            && intent.parent_thread_id === parentThreadId
-            && (intent.binding_state === 'bound' || !isExpiredPendingRoleIntent(intent, nowMs))));
-        if (liveOwnIntent) {
-            if (liveOwnIntent.role === role) {
-                return { ok: true, intent: liveOwnIntent, reused: true };
-            }
-            return { ok: false, reason: 'single_flight_conflict' };
-        }
-        // Self-heal the leader thread record so leader-anchor consumers see kind:"leader".
-        const nowIso = new Date(nowMs).toISOString();
-        const nextSession = { ...session, threads: { ...session.threads } };
-        const existingLeaderThread = nextSession.threads[attestedLeader];
-        if (!existingLeaderThread || existingLeaderThread.kind !== 'leader') {
-            nextSession.threads[attestedLeader] = {
-                ...(existingLeaderThread ?? {}),
-                thread_id: attestedLeader,
-                kind: 'leader',
-                first_seen_at: existingLeaderThread?.first_seen_at ?? nowIso,
-                last_seen_at: nowIso,
-                turn_count: existingLeaderThread?.turn_count ?? 0,
-            };
-        }
-        nextSession.updated_at = nowIso;
-        const ttlMs = typeof input.ttlMs === 'number' && Number.isFinite(input.ttlMs) ? input.ttlMs : 10 * 60_000;
-        const intent = {
-            role,
-            session_id: sessionId,
-            parent_thread_id: parentThreadId,
-            correlation_token: correlationToken,
-            created_at: nowIso,
-            expires_at: new Date(nowMs + ttlMs).toISOString(),
-            ...(canonicalOrigin ? { origin_cwd: canonicalOrigin } : {}),
-        };
-        state.sessions = { ...state.sessions, [sessionId]: nextSession };
-        state.pending_role_intents = [...all.filter((candidate) => !shouldPruneExpired(candidate)), intent];
-        context.assertOwnership();
-        writeSubagentTrackingStateSync(cwd, state, context.publish);
-        return { ok: true, intent, reused: false };
-    });
-}
-/**
- * #3181 legacy/native fallback, made atomic and positive-provenance-only. When no durable
- * attestation exists, an in-turn role intent may still be authorized ONLY against the
- * tracker leader_thread_id — the positively-provenanced leader thread set by a real
- * recorded leader turn (notify) or by PreToolUse attestation (gated when the caller has a
- * usable current pointer). It deliberately does NOT trust the reconciled session.json
- * native_session_id, which an ambiguous/malformed-child SessionStart can set. This is the
- * strict tracker-locked replacement for the former CLI "activeLeaderThreadIds +
- * recordPendingRoleIntent" fallback: it validates the leader anchor AND rejects any
- * all-session subagent counter-evidence under the same lock as the intent write, so a
- * subagent record landing after a pre-check (or a PreToolUse attestation that lost its
- * race) can never be downgraded into an unvalidated legacy authorization. Fail-closed:
- * unreadable/corrupt tracker → native_anchor_unavailable; parent not the tracker leader →
- * parent_not_active_leader; parent tracked as a subagent anywhere → native_anchor_mismatch.
- */
-export function recordNativeLeaderIntent(cwd, input) {
-    const role = resolveInstalledRoleName(input.role);
-    if (!role)
-        return { ok: false, reason: 'unknown_role' };
-    const correlationToken = input.correlationToken;
-    if (!isCanonicalCorrelationToken(correlationToken)) {
-        return { ok: false, reason: 'invalid_correlation_token' };
-    }
-    const nowMs = normalizeNowMs(input.nowMs);
-    const sessionId = input.sessionId.trim();
-    const parentThreadId = input.parentThreadId.trim();
-    const canonicalOrigin = canonicalizeOriginCwd(cwd);
-    if (canonicalOrigin === null)
-        return { ok: false, reason: 'invalid_origin' };
-    const { isOwn, shouldPruneExpired } = pendingRoleIntentPredicates(cwd, canonicalOrigin, nowMs);
-    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        const read = readSubagentTrackingStateSyncStrict(cwd);
-        if (!read.ok)
-            return { ok: false, reason: 'native_anchor_unavailable' };
-        const state = read.state;
-        // Positive-provenance leader anchor ONLY: the tracker leader_thread_id is set by a real
-        // recorded leader turn (notify) or by PreToolUse attestation. It is intentionally NOT
-        // the reconciled session.json native_session_id, which an ambiguous/malformed-child
-        // SessionStart can set without positively classifying a root — trusting that pointer
-        // would re-open false-leader adoption. A malformed child never obtains a tracker leader
-        // thread, so it fails closed here.
-        const trackerLeader = input.allowTrackerLeader ? state.sessions[sessionId]?.leader_thread_id?.trim() : undefined;
-        if (!parentThreadId || !trackerLeader || parentThreadId !== trackerLeader) {
-            return { ok: false, reason: 'parent_not_active_leader' };
-        }
-        // Atomic all-session subagent exclusion: a parent thread recorded as a subagent in ANY
-        // session is never a valid leader, even if it matches the tracker leader anchor.
-        if (threadIsTrackedAsSubagent(state, parentThreadId)) {
-            return { ok: false, reason: 'native_anchor_mismatch' };
-        }
-        // Role-agnostic single-flight (same contract as recordPendingRoleIntent).
-        const all = state.pending_role_intents;
-        const liveOwnIntent = all.find((intent) => (isOwn(intent)
-            && intent.session_id === sessionId
-            && intent.parent_thread_id === parentThreadId
-            && (intent.binding_state === 'bound' || !isExpiredPendingRoleIntent(intent, nowMs))));
-        if (liveOwnIntent) {
-            if (liveOwnIntent.role === role) {
-                return { ok: true, intent: liveOwnIntent, reused: true };
-            }
-            return { ok: false, reason: 'single_flight_conflict' };
-        }
-        const nowIso = new Date(nowMs).toISOString();
-        const ttlMs = typeof input.ttlMs === 'number' && Number.isFinite(input.ttlMs) ? input.ttlMs : 10 * 60_000;
-        const intent = {
-            role,
-            session_id: sessionId,
-            parent_thread_id: parentThreadId,
-            correlation_token: correlationToken,
-            created_at: nowIso,
-            expires_at: new Date(nowMs + ttlMs).toISOString(),
-            ...(canonicalOrigin ? { origin_cwd: canonicalOrigin } : {}),
-        };
-        state.pending_role_intents = [...all.filter((candidate) => !shouldPruneExpired(candidate)), intent];
-        context.assertOwnership();
-        writeSubagentTrackingStateSync(cwd, state, context.publish);
-        return { ok: true, intent, reused: false };
-    });
-}
-export function bindPendingRoleIntentUnderLock(cwd, input, bind) {
-    const nowMs = normalizeNowMs(input.nowMs);
-    const sessionId = input.sessionId.trim();
-    const parentThreadId = input.parentThreadId.trim();
-    const correlationToken = input.correlationToken;
-    if (!isCanonicalCorrelationToken(correlationToken))
-        return null;
-    // Fail-closed origin authentication: establish the caller's canonical origin workspace up
-    // front. A malformed/unavailable origin can never disclose role/claimant, run the bind
-    // callback, mutate pending->bound, or acquire the lock.
-    const canonicalOrigin = canonicalizeOriginCwd(cwd);
-    if (canonicalOrigin === null)
-        return null;
-    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        const state = readSubagentTrackingStateSync(cwd);
-        const all = state.pending_role_intents;
-        const { isOwn, shouldPruneExpired } = pendingRoleIntentPredicates(cwd, canonicalOrigin, nowMs);
-        const matchedIntent = selectDominantRoleIntent(all.filter((intent) => (isOwn(intent)
-            && correlationToken !== undefined
-            && sameLogicalRoleIntent(intent, sessionId, parentThreadId, correlationToken)
-            && (intent.binding_state === 'bound' || !isExpiredPendingRoleIntent(intent, nowMs)))), canonicalOrigin);
-        if (!matchedIntent) {
-            const retained = all.filter((intent) => !shouldPruneExpired(intent));
-            if (retained.length !== all.length) {
-                state.pending_role_intents = retained;
-                context.assertOwnership();
-                writeSubagentTrackingStateSync(cwd, state, context.publish);
+    // Fail closed on every side of the write. The proposed state must survive
+    // strict authority validation (tolerant inputs must not launder malformed
+    // authority into a valid-looking attestation); existing on-disk bytes must
+    // not be overwritten when they fail strict parsing; and the publication must
+    // not roll back an authority decision committed after the caller read its
+    // snapshot. The whole read/validate/compare/publish transaction is
+    // serialized under the tracker lock.
+    const proposedRaw = JSON.stringify(state);
+    if (!parseStrictSubagentTrackingState(proposedRaw))
+        throw new Error('Malformed subagent tracker authority state');
+    const normalized = normalizeSubagentTrackingState(state);
+    const contents = `${JSON.stringify(normalized, null, 2)}\n`;
+    const proposedAuthorityRevision = authorityRevisionOf(normalized);
+    return withCrossProcessFileLockSync(path, (lock) => {
+        if (existsSync(path)) {
+            let raw;
+            try {
+                raw = readFileSync(path, 'utf-8');
             }
-            return null;
-        }
-        const adaptedIntent = {
-            role: matchedIntent.role,
-            provenanceKind: OMX_ADAPTED_PROVENANCE,
-        };
-        if (matchedIntent.binding_state === 'bound') {
-            const next = all
-                .filter((intent) => (intent.binding_state === 'bound'
-                || !(isOwn(intent) && sameLogicalRoleIntent(intent, sessionId, parentThreadId, correlationToken))))
-                .map((intent) => (intent === matchedIntent && !intent.origin_cwd
-                ? { ...intent, origin_cwd: canonicalOrigin }
-                : intent));
-            if (next.length !== all.length || !matchedIntent.origin_cwd) {
-                state.pending_role_intents = next;
-                context.assertOwnership();
-                writeSubagentTrackingStateSync(cwd, state, context.publish);
+            catch {
+                throw new Error('Malformed subagent tracker authority state');
             }
-            return {
-                ...adaptedIntent,
-                claimantToken: undefined,
-                alreadyBound: true,
-            };
-        }
-        const claimantToken = randomUUID();
-        const boundState = bind(state, adaptedIntent);
-        boundState.pending_role_intents = all
-            .filter((intent) => !shouldPruneExpired(intent))
-            .filter((intent) => (intent === matchedIntent
-            || !(isOwn(intent) && sameLogicalRoleIntent(intent, sessionId, parentThreadId, correlationToken))))
-            .map((intent) => (intent === matchedIntent
-            ? {
-                ...matchedIntent,
-                binding_state: 'bound',
-                binding_claimant_token: claimantToken,
-                bound_at: new Date(nowMs).toISOString(),
-                origin_cwd: matchedIntent.origin_cwd ?? canonicalOrigin,
+            const current = parseStrictSubagentTrackingState(raw);
+            if (!current)
+                throw new Error('Malformed subagent tracker authority state');
+            // The generic writer is descriptive-only: it may publish descriptive
+            // churn, but it must never CHANGE the authority surface in any
+            // direction. Granting, revoking, or rolling back authority is reserved
+            // for the lock-owning authority transactions. Requiring the proposed
+            // authority projection to equal the current on-disk projection makes a
+            // stale snapshot, a fresh-read escalation, and a concurrent interleaving
+            // all fail closed with one rule.
+            if (authorityRevisionOf(current) !== proposedAuthorityRevision) {
+                throw new Error('Stale subagent tracker authority state');
             }
-            : intent));
-        context.assertOwnership();
-        writeSubagentTrackingStateSync(cwd, boundState, context.publish);
-        return { ...adaptedIntent, claimantToken, alreadyBound: false };
-    });
-}
-export function consumePendingRoleIntent(cwd, input) {
-    const nowMs = normalizeNowMs(input.nowMs);
-    const sessionId = input.sessionId.trim();
-    const parentThreadId = input.parentThreadId.trim();
-    const correlationToken = input.correlationToken;
-    if (!isCanonicalCorrelationToken(correlationToken))
-        return null;
-    const canonicalOrigin = canonicalizeOriginCwd(cwd);
-    if (canonicalOrigin === null)
-        return null;
-    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        const state = readSubagentTrackingStateSync(cwd);
-        const all = state.pending_role_intents;
-        const { isOwn, shouldPruneExpired } = pendingRoleIntentPredicates(cwd, canonicalOrigin, nowMs);
-        if (hasOwnBoundLogicalIntent(all, isOwn, sessionId, parentThreadId, correlationToken))
-            return null;
-        const consumed = selectDominantRoleIntent(all.filter((intent) => (isOwn(intent)
-            && intent.binding_state !== 'bound'
-            && !isExpiredPendingRoleIntent(intent, nowMs)
-            && correlationToken !== undefined
-            && sameLogicalRoleIntent(intent, sessionId, parentThreadId, correlationToken))), canonicalOrigin);
-        if (!consumed) {
-            const retained = all.filter((intent) => !shouldPruneExpired(intent));
-            if (retained.length !== all.length) {
-                state.pending_role_intents = retained;
-                context.assertOwnership();
-                writeSubagentTrackingStateSync(cwd, state, context.publish);
-            }
-            return null;
         }
-        state.pending_role_intents = all
-            .filter((intent) => !shouldPruneExpired(intent))
-            .filter((intent) => (intent.binding_state === 'bound'
-            || !(isOwn(intent) && sameLogicalRoleIntent(intent, sessionId, parentThreadId, correlationToken))));
-        context.assertOwnership();
-        writeSubagentTrackingStateSync(cwd, state, context.publish);
-        return { role: consumed.role, provenanceKind: OMX_ADAPTED_PROVENANCE };
-    });
-}
-export function completeAdaptedRoleBinding(cwd, input) {
-    const nowMs = normalizeNowMs(input.nowMs);
-    const sessionId = input.sessionId.trim();
-    const parentThreadId = input.parentThreadId.trim();
-    const correlationToken = input.correlationToken;
-    const claimantToken = input.claimantToken;
-    const canonicalOrigin = canonicalizeOriginCwd(cwd);
-    if (canonicalOrigin === null)
-        return 'not_found';
-    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        const state = readSubagentTrackingStateSync(cwd);
-        const all = state.pending_role_intents;
-        const { isOwn, shouldPruneExpired } = pendingRoleIntentPredicates(cwd, canonicalOrigin, nowMs);
-        // Select the owned bound scope before authenticating it. Credentials are not a lookup key:
-        // otherwise an invalid dominant duplicate could be bypassed by a lower valid duplicate.
-        const boundIntent = selectDominantRoleIntent(all.filter((intent) => (isOwn(intent)
-            && intent.binding_state === 'bound'
-            && sameLogicalRoleIntent(intent, sessionId, parentThreadId))), canonicalOrigin);
-        if (!boundIntent) {
-            const retained = all.filter((intent) => !shouldPruneExpired(intent));
-            if (retained.length !== all.length) {
-                state.pending_role_intents = retained;
-                context.assertOwnership();
-                writeSubagentTrackingStateSync(cwd, state, context.publish);
-            }
-            return 'not_found';
+        else if (proposedAuthorityRevision !== authorityRevisionOf(createSubagentTrackingState())) {
+            // Creating the tracker from nothing must not mint reopen authority.
+            // `leader_thread_id` is deliberately NOT included: it is ordinary
+            // descriptive lifecycle data that legitimate first writers set, and it
+            // never by itself makes a thread an eligible reopen target.
+            const mintsAuthority = Object.values(normalized.sessions).some((session) => Object.values(session.threads).some((thread) => thread.provenance_kind === NATIVE_SUBAGENT_PROVENANCE
+                || thread.direct_child_root_id !== undefined
+                || thread.direct_child_parent_id !== undefined
+                || thread.reopen_authority_revoked !== undefined
+                || thread.reopen_authority_conflict_reason !== undefined
+                || thread.reopen_authority_conflict_at !== undefined));
+            if (mintsAuthority)
+                throw new Error('Stale subagent tracker authority state');
         }
-        const hasClaimant = Object.hasOwn(boundIntent, 'binding_claimant_token');
-        if (!isCanonicalCorrelationToken(boundIntent.correlation_token)
-            || !isCanonicalCorrelationToken(correlationToken)
-            || boundIntent.correlation_token !== correlationToken
-            || (hasClaimant && (!isCanonicalClaimantToken(boundIntent.binding_claimant_token)
-                || !isCanonicalClaimantToken(claimantToken)
-                || boundIntent.binding_claimant_token !== claimantToken)))
-            return 'claimant_mismatch';
-        state.pending_role_intents = all
-            .filter((intent) => !shouldPruneExpired(intent))
-            .filter((intent) => !(isOwn(intent) && sameLogicalRoleIntent(intent, sessionId, parentThreadId, boundIntent.correlation_token)));
-        context.assertOwnership();
-        writeSubagentTrackingStateSync(cwd, state, context.publish);
-        return 'completed';
-    });
-}
-export function listBoundAdaptedRoleIntents(cwd, _nowMs, ownedDominant = false) {
-    const allBound = readSubagentTrackingStateSync(cwd).pending_role_intents.filter((intent) => intent.binding_state === 'bound');
-    if (!ownedDominant)
-        return allBound;
-    const canonicalOrigin = canonicalizeOriginCwd(cwd);
-    if (canonicalOrigin === null)
-        return [];
-    const { isOwn } = pendingRoleIntentPredicates(cwd, canonicalOrigin, Date.now());
-    const scopes = new Map();
-    for (const intent of allBound) {
-        if (!isOwn(intent))
-            continue;
-        const key = `${intent.session_id}\u0000${intent.parent_thread_id}`;
-        scopes.set(key, [...(scopes.get(key) ?? []), intent]);
-    }
-    return [...scopes.values()].flatMap((candidates) => {
-        const dominant = selectDominantRoleIntent(candidates, canonicalOrigin);
-        return dominant ? [dominant] : [];
+        mkdirSync(dirname(path), { recursive: true });
+        lock.assertOwnership();
+        lock.publish(contents);
+        return path;
     });
 }
 export function recordSubagentTurn(state, input) {
@@ -1263,11 +838,13 @@ export function recordSubagentTurn(state, input) {
             : preservedCompletion),
         ...(input.mode?.trim() ? { mode: input.mode.trim() } : existingThread?.mode ? { mode: existingThread.mode } : {}),
         ...(input.role?.trim() ? { role: input.role.trim() } : existingThread?.role ? { role: existingThread.role } : {}),
-        ...(input.provenanceKind?.trim()
-            ? { provenance_kind: input.provenanceKind.trim() }
-            : existingThread?.provenance_kind
-                ? { provenance_kind: existingThread.provenance_kind }
-                : {}),
+        ...(input.provenanceKind === NATIVE_SUBAGENT_PROVENANCE
+            ? { provenance_kind: NATIVE_SUBAGENT_PROVENANCE }
+            : existingThread?.provenance_kind === NATIVE_SUBAGENT_PROVENANCE
+                ? { provenance_kind: NATIVE_SUBAGENT_PROVENANCE }
+                : existingThread?.provenance_kind === DESCRIPTIVE_ADAPTED_PROVENANCE
+                    ? { provenance_kind: DESCRIPTIVE_ADAPTED_PROVENANCE }
+                    : {}),
         ...(input.laneId?.trim() ? { lane_id: input.laneId.trim() } : existingThread?.lane_id ? { lane_id: existingThread.lane_id } : {}),
         ...(input.scope?.trim() ? { scope: input.scope.trim() } : existingThread?.scope ? { scope: existingThread.scope } : {}),
         ...(input.agentNickname?.trim()
@@ -1301,6 +878,11 @@ export function recordSubagentTurn(state, input) {
             : existingThread?.resume_failure_reason
                 ? { resume_failure_reason: existingThread.resume_failure_reason }
                 : {}),
+        ...(existingThread?.direct_child_root_id ? { direct_child_root_id: existingThread.direct_child_root_id } : {}),
+        ...(existingThread?.direct_child_parent_id ? { direct_child_parent_id: existingThread.direct_child_parent_id } : {}),
+        ...(existingThread?.reopen_authority_revoked ? { reopen_authority_revoked: true } : {}),
+        ...(existingThread?.reopen_authority_conflict_reason ? { reopen_authority_conflict_reason: existingThread.reopen_authority_conflict_reason } : {}),
+        ...(existingThread?.reopen_authority_conflict_at ? { reopen_authority_conflict_at: existingThread.reopen_authority_conflict_at } : {}),
     };
     const threads = {
         ...existingSession.threads,
@@ -1315,11 +897,6 @@ export function recordSubagentTurn(state, input) {
     normalized.sessions[sessionId] = {
         session_id: sessionId,
         ...(leaderThreadId ? { leader_thread_id: leaderThreadId } : {}),
-        // #3181: preserve the durable native leader attestation across ordinary turn writes.
-        // Dropping these would let a normal child SessionStart/bind erase authentication and
-        // silently downgrade later role-intent writes to the legacy (non-atomic) path.
-        ...(existingSession.leader_attested_at ? { leader_attested_at: existingSession.leader_attested_at } : {}),
-        ...(existingSession.leader_attest_source ? { leader_attest_source: existingSession.leader_attest_source } : {}),
         updated_at: timestamp,
         threads,
     };
@@ -1327,13 +904,615 @@ export function recordSubagentTurn(state, input) {
 }
 export async function recordSubagentTurnForSession(cwd, input) {
     return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
-        const current = readSubagentTrackingStateSync(cwd);
-        const next = recordSubagentTurn(current, input);
+        const strict = readSubagentTrackingStateStrictSync(cwd);
+        if (!strict.ok)
+            throw new Error('Malformed subagent tracker authority state');
+        const next = recordSubagentTurn(strict.state, input);
+        context.assertOwnership();
+        writeSubagentTrackingStateSync(cwd, next, context.publish);
+        return next;
+    });
+}
+export function recordNativeSubagentAuthorityObservation(cwd, observation) {
+    const requestedSessionIds = [...new Set(observation.sessionIds.map((value) => value.trim()).filter(Boolean))];
+    const childThreadId = observation.childThreadId.trim();
+    const parentThreadId = observation.parentThreadId.trim();
+    const rootNativeSessionId = observation.rootNativeSessionId?.trim() ?? '';
+    const implicatedChildThreadIds = [...new Set([
+            childThreadId,
+            ...(observation.implicatedChildThreadIds ?? []).map((value) => value.trim()),
+        ].filter(Boolean))];
+    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
+        const strict = readSubagentTrackingStateStrictSync(cwd);
+        if (!strict.ok)
+            throw new Error('Malformed subagent tracker authority state');
+        let next = strict.state;
+        const existingSessionIds = Object.entries(next.sessions)
+            .filter(([, session]) => implicatedChildThreadIds.some((id) => Boolean(session.threads[id]?.direct_child_root_id || session.threads[id]?.reopen_authority_revoked)))
+            .map(([sessionId]) => sessionId);
+        const sessionIds = [...new Set([...requestedSessionIds, ...existingSessionIds])];
+        const existingBindings = Object.values(next.sessions)
+            .map((session) => session.threads[childThreadId])
+            .filter((thread) => Boolean(thread?.direct_child_root_id));
+        const authorityEvidence = observation.authorityEvidence ?? (rootNativeSessionId ? 'valid' : 'absent');
+        const globalConflict = authorityEvidence === 'untrusted' && existingBindings.length > 0
+            || authorityEvidence === 'valid' && existingBindings.some((thread) => thread.direct_child_root_id !== rootNativeSessionId || thread.direct_child_parent_id !== parentThreadId);
+        const timestamp = observation.timestamp ?? new Date().toISOString();
+        if (authorityEvidence === 'untrusted') {
+            for (const session of Object.values(next.sessions)) {
+                for (const implicatedId of implicatedChildThreadIds) {
+                    const implicatedThread = session.threads[implicatedId];
+                    if (!implicatedThread?.direct_child_root_id && !implicatedThread?.reopen_authority_revoked)
+                        continue;
+                    implicatedThread.reopen_authority_revoked = true;
+                    implicatedThread.reopen_authority_conflict_reason = 'identity_untrusted';
+                    implicatedThread.reopen_authority_conflict_at = timestamp;
+                }
+            }
+        }
+        for (const sessionId of sessionIds) {
+            if (parentThreadId && parentThreadId !== childThreadId) {
+                next = recordSubagentTurn(next, { sessionId, threadId: parentThreadId, kind: 'leader', timestamp });
+            }
+            next = recordSubagentTurn(next, {
+                sessionId,
+                threadId: childThreadId,
+                kind: 'subagent',
+                ...(parentThreadId && parentThreadId !== childThreadId ? { leaderThreadId: parentThreadId } : {}),
+                mode: observation.mode,
+                timestamp,
+            });
+            const thread = next.sessions[sessionId]?.threads[childThreadId];
+            if (!thread)
+                continue;
+            const mayAttest = authorityEvidence === 'valid'
+                && Boolean(rootNativeSessionId)
+                && childThreadId !== rootNativeSessionId
+                && parentThreadId === rootNativeSessionId;
+            if (globalConflict) {
+                thread.reopen_authority_revoked = true;
+                thread.reopen_authority_conflict_reason = 'root_or_parent_mismatch';
+                thread.reopen_authority_conflict_at = timestamp;
+            }
+            else if (mayAttest) {
+                thread.direct_child_root_id = rootNativeSessionId;
+                thread.direct_child_parent_id = parentThreadId;
+                thread.provenance_kind = NATIVE_SUBAGENT_PROVENANCE;
+                delete thread.reopen_authority_revoked;
+                delete thread.reopen_authority_conflict_reason;
+                delete thread.reopen_authority_conflict_at;
+            }
+        }
         context.assertOwnership();
         writeSubagentTrackingStateSync(cwd, next, context.publish);
         return next;
     });
 }
+/**
+ * Durable fence for authority revocations that could not be published.
+ *
+ * A negative identity observation is only meaningful if reopen consumption can
+ * see it. When the revocation transaction fails (lock exhaustion, malformed
+ * bytes, I/O error) the affected ids are recorded here instead of being
+ * silently dropped, and `consumeDirectChildReopenContext` treats any fenced id
+ * as denied until the revocation is durably applied.
+ */
+function authorityFencePath(cwd) {
+    return `${subagentTrackingPath(cwd)}.authority-fence.json`;
+}
+/** Read the fenced ids. An unreadable/malformed fence fails closed for all ids. */
+function readAuthorityFence(cwd) {
+    const path = authorityFencePath(cwd);
+    if (!existsSync(path))
+        return { ok: true, ids: new Set() };
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (!Array.isArray(parsed.ids))
+            return { ok: false, ids: new Set() };
+        const ids = parsed.ids.filter((id) => typeof id === 'string' && Boolean(id.trim()));
+        if (ids.length !== parsed.ids.length)
+            return { ok: false, ids: new Set() };
+        return { ok: true, ids: new Set(ids.map((id) => id.trim())) };
+    }
+    catch {
+        return { ok: false, ids: new Set() };
+    }
+}
+/** Upper bound on fenced ids, so repeated failures cannot grow the fence without limit. */
+export const AUTHORITY_FENCE_MAX_IDS = 512;
+/**
+ * Record ids whose revocation could not be persisted, so reopen stays denied.
+ *
+ * Every fence mutation runs under a dedicated cross-process lock on the fence
+ * path so read/merge/publish is atomic with respect to concurrent fencing and
+ * clearing. Returns true when the denial is durable; the caller must treat
+ * false as an unresolved fail-closed condition.
+ */
+export function fenceNativeSubagentAuthorities(cwd, childThreadIds, reason) {
+    const ids = childThreadIds.map((value) => value.trim()).filter(Boolean);
+    if (!ids.length)
+        return true;
+    const path = authorityFencePath(cwd);
+    try {
+        return withCrossProcessFileLockSync(path, (lock) => {
+            const existing = readAuthorityFence(cwd);
+            // An unreadable fence already denies every id; do not weaken it by
+            // rewriting it into a narrower explicit id list.
+            if (!existing.ok)
+                return true;
+            const merged = [...new Set([...existing.ids, ...ids])].sort();
+            if (merged.length > AUTHORITY_FENCE_MAX_IDS) {
+                // Refuse to grow past the cap by writing a deliberately unreadable
+                // sentinel: a global denial is strictly stronger than a partial list.
+                mkdirSync(dirname(path), { recursive: true });
+                lock.assertOwnership();
+                lock.publish(`${JSON.stringify({ ids: 'all', reason: 'fence_capacity_exceeded', fenced_at: new Date().toISOString() }, null, 2)}\n`);
+                return true;
+            }
+            mkdirSync(dirname(path), { recursive: true });
+            lock.assertOwnership();
+            lock.publish(`${JSON.stringify({ ids: merged, reason, fenced_at: new Date().toISOString() }, null, 2)}\n`);
+            return true;
+        });
+    }
+    catch {
+        // The denial could not be made durable. The caller must surface this
+        // rather than continue as if the revocation had been applied.
+        return false;
+    }
+}
+/**
+ * Last-resort global denial used when BOTH the tracker revocation transaction
+ * and the locked fence publication fail. It deliberately avoids the fence lock
+ * (which may be exactly what is unavailable) and writes an intentionally
+ * unreadable sentinel directly, because `readAuthorityFence` treats any
+ * unreadable fence as a denial of every id. Returns true when the denial is
+ * durable on disk.
+ */
+export function forceGlobalAuthorityDenial(cwd, reason) {
+    const path = authorityFencePath(cwd);
+    const contents = `${JSON.stringify({ ids: 'all', reason, fenced_at: new Date().toISOString() }, null, 2)}\n`;
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        const temporaryPath = atomicTrackingTempPath(path);
+        writeFileSync(temporaryPath, contents);
+        renameSync(temporaryPath, path);
+        return true;
+    }
+    catch {
+        try {
+            // Even a partial/truncated write is safe here: unreadable means denied.
+            writeFileSync(path, contents);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/**
+ * Drop ids from the fence once their revocation is durably published.
+ *
+ * Runs under the fence lock and re-reads inside it, so it can never clear
+ * based on a stale snapshot. An unreadable fence is a global denial and is
+ * NEVER destroyed here: only an explicit, fully reconciled id list is removed.
+ */
+function clearAuthorityFence(cwd, childThreadIds) {
+    const path = authorityFencePath(cwd);
+    if (!existsSync(path))
+        return;
+    const cleared = new Set(childThreadIds.map((value) => value.trim()).filter(Boolean));
+    if (!cleared.size)
+        return;
+    try {
+        withCrossProcessFileLockSync(path, (lock) => {
+            const existing = readAuthorityFence(cwd);
+            // Preserve an unreadable/global denial. Reconciling it requires explicit
+            // operator action, not an incidental unrelated revocation.
+            if (!existing.ok)
+                return;
+            const remaining = [...existing.ids].filter((id) => !cleared.has(id)).sort();
+            if (remaining.length === existing.ids.size)
+                return;
+            lock.assertOwnership();
+            if (!remaining.length) {
+                unlinkSync(path);
+                return;
+            }
+            lock.publish(`${JSON.stringify({ ids: remaining, reason: 'partial_clear', fenced_at: new Date().toISOString() }, null, 2)}\n`);
+        });
+    }
+    catch {
+        // Leaving a stale fence entry is fail-closed and therefore acceptable.
+    }
+}
+export function revokeNativeSubagentAuthorities(cwd, childThreadIds, reason = 'identity_untrusted') {
+    const ids = [...new Set(childThreadIds.map((value) => value.trim()).filter(Boolean))];
+    return withCrossProcessFileLockSync(subagentTrackingPath(cwd), (context) => {
+        const strict = readSubagentTrackingStateStrictSync(cwd);
+        if (!strict.ok)
+            throw new Error('Malformed subagent tracker authority state');
+        const next = strict.state;
+        const timestamp = new Date().toISOString();
+        let changed = false;
+        for (const session of Object.values(next.sessions)) {
+            for (const id of ids) {
+                const thread = session.threads[id];
+                if (!thread?.direct_child_root_id && !thread?.reopen_authority_revoked)
+                    continue;
+                thread.reopen_authority_revoked = true;
+                thread.reopen_authority_conflict_reason = reason;
+                thread.reopen_authority_conflict_at = timestamp;
+                changed = true;
+            }
+        }
+        if (changed) {
+            context.assertOwnership();
+            writeSubagentTrackingStateSync(cwd, next, context.publish);
+        }
+        // The revocation is now durable for these ids (either just published, or
+        // already present on disk), so any prior fence for them can be released.
+        clearAuthorityFence(cwd, ids);
+        return next;
+    });
+}
+function formatReopenMetadata(entry) {
+    const values = [
+        entry.role ? `role: ${entry.role}` : null,
+        entry.laneId ? `lane: ${entry.laneId}` : null,
+        entry.scope ? `scope: ${entry.scope}` : null,
+        `status: ${entry.status}`,
+        entry.lastHandoffSummary ? `handoff: ${entry.lastHandoffSummary.slice(0, 120)}` : null,
+        entry.resumeFailureReason ? `last failure: ${entry.resumeFailureReason.slice(0, 120)}` : null,
+    ].filter((value) => Boolean(value));
+    return values.length ? ` (${values.join('; ')})` : '';
+}
+function persistedReopenAuthorityWarning(reason) {
+    return [
+        '[Persisted subagent reopen]',
+        `- Warning: persisted subagent authority was excluded (${reason}); no resume authority or bookkeeping was granted.`,
+        '- Silver rule: do not spawn a same-role/same-lane replacement solely because persisted reopen authority was unavailable; continue in the root or another compatible existing lane.',
+    ].join('\n');
+}
+function persistedReopenLegacyNotice(excludedCount, source) {
+    return [
+        '[Persisted subagent reopen]',
+        `- SessionStart source: ${source}; saved subagent ids found: 0.`,
+        `- Notice: ${excludedCount} persisted subagent record(s) were excluded as non-authoritative or legacy; no resume authority or bookkeeping was granted.`,
+        '- Silver rule: do not spawn a same-role/same-lane replacement solely because persisted reopen authority was unavailable; continue in the root or another compatible existing lane.',
+    ].join('\n');
+}
+/**
+ * True when a stored partition is provably about the current root, and not an
+ * unrelated/historical workspace session that merely happens to contain a
+ * thread id equal to the current canonical session key. Canonical-key collision
+ * quarantine is scoped to correlated partitions so it cannot destroy authority
+ * or resume bookkeeping belonging to a different root.
+ */
+function partitionCorrelatesToRoot(session, sessionId, rootNativeSessionId) {
+    if (session.session_id === sessionId || session.session_id === rootNativeSessionId)
+        return true;
+    if (session.leader_thread_id === rootNativeSessionId)
+        return true;
+    if (session.threads[rootNativeSessionId] !== undefined)
+        return true;
+    return Object.values(session.threads).some((thread) => thread.direct_child_root_id === rootNativeSessionId
+        || thread.direct_child_parent_id === rootNativeSessionId);
+}
+/**
+ * Repair persisted root-as-subagent identity inversion inside an already-parsed
+ * state. Only a thread whose id equals the exact native root id is conclusively
+ * the root and is reclassified as leader. A thread whose id equals only the
+ * canonical session key is always ambiguous — the storage key is not identity
+ * proof — so it is never destructively reclassified: authority-bearing records
+ * are revoked (fail closed) and every ambiguous record loses resume bookkeeping.
+ * That ambiguity quarantine only applies inside partitions that correlate to
+ * this root; unrelated partitions are left untouched.
+ * Returns true when any record changed.
+ */
+function repairPersistedRootIdentityInState(state, sessionId, rootNativeSessionId, repairTimestamp) {
+    let changed = false;
+    for (const correlatedSession of Object.values(state.sessions)) {
+        let sessionChanged = false;
+        const correlated = partitionCorrelatesToRoot(correlatedSession, sessionId, rootNativeSessionId);
+        for (const rootId of new Set([sessionId, rootNativeSessionId])) {
+            const rootThread = correlatedSession.threads[rootId];
+            if (!rootThread || rootThread.kind !== 'subagent')
+                continue;
+            const ambiguousCanonicalCollision = rootId === sessionId && sessionId !== rootNativeSessionId;
+            if (ambiguousCanonicalCollision) {
+                // An uncorrelated partition's identically-named thread belongs to a
+                // different root: leave its authority and bookkeeping alone.
+                if (!correlated)
+                    continue;
+                const carriesAuthority = rootThread.provenance_kind === NATIVE_SUBAGENT_PROVENANCE
+                    || rootThread.direct_child_root_id !== undefined
+                    || rootThread.direct_child_parent_id !== undefined;
+                if (carriesAuthority && rootThread.reopen_authority_revoked !== true) {
+                    // Fail closed without rewriting identity: the id collides with the
+                    // canonical root key but carries child-shaped authority evidence, so
+                    // it stays a subagent whose reopen authority is revoked until root
+                    // identity is independently established.
+                    rootThread.reopen_authority_revoked = true;
+                    rootThread.reopen_authority_conflict_reason = 'canonical_root_collision';
+                    rootThread.reopen_authority_conflict_at = repairTimestamp;
+                    sessionChanged = true;
+                }
+                if (rootThread.resume_requested_at !== undefined
+                    || rootThread.resume_completed_at !== undefined
+                    || rootThread.resume_failed_at !== undefined
+                    || rootThread.resume_failure_reason !== undefined) {
+                    delete rootThread.resume_requested_at;
+                    delete rootThread.resume_completed_at;
+                    delete rootThread.resume_failed_at;
+                    delete rootThread.resume_failure_reason;
+                    sessionChanged = true;
+                }
+                continue;
+            }
+            if (rootId !== rootNativeSessionId)
+                continue;
+            rootThread.kind = 'leader';
+            delete rootThread.direct_child_root_id;
+            delete rootThread.direct_child_parent_id;
+            delete rootThread.reopen_authority_revoked;
+            delete rootThread.reopen_authority_conflict_reason;
+            delete rootThread.reopen_authority_conflict_at;
+            delete rootThread.resume_requested_at;
+            delete rootThread.resume_completed_at;
+            delete rootThread.resume_failed_at;
+            delete rootThread.resume_failure_reason;
+            sessionChanged = true;
+        }
+        if (correlatedSession.threads[rootNativeSessionId] && correlatedSession.leader_thread_id !== rootNativeSessionId) {
+            correlatedSession.leader_thread_id = rootNativeSessionId;
+            sessionChanged = true;
+        }
+        if (sessionChanged) {
+            correlatedSession.updated_at = repairTimestamp;
+            changed = true;
+        }
+    }
+    return changed;
+}
+/**
+ * Pointer-authoritative root identity repair, decoupled from reopen candidate
+ * output. Runs under the tracker lock and fails closed on malformed bytes.
+ */
+export function repairPersistedRootIdentity(cwd, context) {
+    const sessionId = context.sessionId.trim();
+    const rootNativeSessionId = context.rootNativeSessionId.trim();
+    if (!sessionId || !rootNativeSessionId)
+        return false;
+    const path = subagentTrackingPath(cwd);
+    return withCrossProcessFileLockSync(path, (lock) => {
+        let raw;
+        try {
+            raw = readFileSync(path, 'utf-8');
+        }
+        catch {
+            return false;
+        }
+        const state = parseStrictSubagentTrackingState(raw);
+        if (!state)
+            return false;
+        const changed = repairPersistedRootIdentityInState(state, sessionId, rootNativeSessionId, new Date().toISOString());
+        if (changed) {
+            lock.assertOwnership();
+            writeSubagentTrackingStateSync(cwd, state, lock.publish);
+        }
+        return changed;
+    });
+}
+/**
+ * Quarantine reopen authority for a root that is persisted as a subagent when
+ * the identity evidence is contradictory (for example a self-parented
+ * transcript marker). Unlike full repair this never asserts leader identity, so
+ * legitimate descriptive subagent evidence is preserved; it only strips the
+ * authority and resume bookkeeping that a root must never carry. Returns true
+ * when any record changed.
+ */
+export function quarantinePersistedRootAuthority(cwd, context) {
+    const sessionId = context.sessionId.trim();
+    const rootNativeSessionId = context.rootNativeSessionId.trim();
+    if (!sessionId || !rootNativeSessionId)
+        return false;
+    const path = subagentTrackingPath(cwd);
+    return withCrossProcessFileLockSync(path, (lock) => {
+        let raw;
+        try {
+            raw = readFileSync(path, 'utf-8');
+        }
+        catch {
+            return false;
+        }
+        const state = parseStrictSubagentTrackingState(raw);
+        if (!state)
+            return false;
+        const timestamp = new Date().toISOString();
+        let changed = false;
+        for (const session of Object.values(state.sessions)) {
+            if (!partitionCorrelatesToRoot(session, sessionId, rootNativeSessionId))
+                continue;
+            const rootThread = session.threads[rootNativeSessionId];
+            if (!rootThread || rootThread.kind !== 'subagent')
+                continue;
+            const carriesAuthority = rootThread.provenance_kind === NATIVE_SUBAGENT_PROVENANCE
+                || rootThread.direct_child_root_id !== undefined
+                || rootThread.direct_child_parent_id !== undefined;
+            let sessionChanged = false;
+            if (carriesAuthority && rootThread.reopen_authority_revoked !== true) {
+                rootThread.reopen_authority_revoked = true;
+                rootThread.reopen_authority_conflict_reason = 'contradictory_root_child_evidence';
+                rootThread.reopen_authority_conflict_at = timestamp;
+                sessionChanged = true;
+            }
+            if (rootThread.resume_requested_at !== undefined
+                || rootThread.resume_completed_at !== undefined
+                || rootThread.resume_failed_at !== undefined
+                || rootThread.resume_failure_reason !== undefined) {
+                delete rootThread.resume_requested_at;
+                delete rootThread.resume_completed_at;
+                delete rootThread.resume_failed_at;
+                delete rootThread.resume_failure_reason;
+                sessionChanged = true;
+            }
+            if (sessionChanged) {
+                session.updated_at = timestamp;
+                changed = true;
+            }
+        }
+        if (changed) {
+            lock.assertOwnership();
+            writeSubagentTrackingStateSync(cwd, state, lock.publish);
+        }
+        return changed;
+    });
+}
+/** Strict, lock-serialized authority consumption for SessionStart persisted reopen output. */
+export function consumeDirectChildReopenContext(cwd, context) {
+    const sessionId = context.sessionId.trim();
+    const rootNativeSessionId = context.rootNativeSessionId.trim();
+    if (!sessionId || !rootNativeSessionId)
+        return null;
+    const path = subagentTrackingPath(cwd);
+    return withCrossProcessFileLockSync(path, (lock) => {
+        let raw;
+        try {
+            raw = readFileSync(path, 'utf-8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            return persistedReopenAuthorityWarning('tracker_read_failed');
+        }
+        const state = parseStrictSubagentTrackingState(raw);
+        if (!state)
+            return persistedReopenAuthorityWarning('malformed_tracker_state');
+        // A revocation that could not be published leaves a durable fence. Fenced
+        // ids stay denied here even though the on-disk record still looks valid,
+        // so a failed negative observation can never leave old authority usable.
+        const fence = readAuthorityFence(cwd);
+        if (!fence.ok)
+            return persistedReopenAuthorityWarning('unreadable_authority_fence');
+        const repairTimestamp = new Date().toISOString();
+        // Root identity repair runs before candidate eligibility so a missing
+        // canonical partition cannot leave a known root inversion unrepaired.
+        const changed = repairPersistedRootIdentityInState(state, sessionId, rootNativeSessionId, repairTimestamp);
+        const session = state.sessions[sessionId];
+        if (!session) {
+            if (changed) {
+                lock.assertOwnership();
+                writeSubagentTrackingStateSync(cwd, state, lock.publish);
+            }
+            return null;
+        }
+        const savedSubagents = Object.values(session.threads)
+            .filter((thread) => {
+            if (thread.kind !== 'subagent'
+                || thread.thread_id === sessionId
+                || thread.thread_id === rootNativeSessionId
+                || session.leader_thread_id === thread.thread_id
+                || fence.ids.has(thread.thread_id)
+                || thread.provenance_kind !== NATIVE_SUBAGENT_PROVENANCE
+                || thread.direct_child_root_id !== rootNativeSessionId
+                || thread.direct_child_parent_id !== rootNativeSessionId
+                || thread.reopen_authority_revoked === true)
+                return false;
+            return Object.values(state.sessions).every((correlationSession) => {
+                const view = correlationSession.threads[thread.thread_id];
+                if (!view)
+                    return true;
+                // Recognized legacy adapted records are descriptive-only: they never
+                // grant authority and never block a newly attested valid child. The
+                // tolerance is shape-constrained: an adapted view may only waive
+                // missing attestation for a non-leader subagent view and never waives
+                // leader-kind or leader_thread_id contradictions.
+                if (view.provenance_kind === DESCRIPTIVE_ADAPTED_PROVENANCE
+                    && view.kind === 'subagent'
+                    && correlationSession.leader_thread_id !== thread.thread_id)
+                    return true;
+                return correlationSession.leader_thread_id !== thread.thread_id
+                    && view.kind === 'subagent'
+                    && view.provenance_kind === NATIVE_SUBAGENT_PROVENANCE
+                    && view.direct_child_root_id === rootNativeSessionId
+                    && view.direct_child_parent_id === rootNativeSessionId
+                    && view.reopen_authority_revoked !== true;
+            });
+        })
+            .map((thread) => normalizeLedgerEntry(thread, thread.status ?? 'closed'))
+            .sort(compareResumeEntries);
+        if (!savedSubagents.length) {
+            if (changed) {
+                session.updated_at = new Date().toISOString();
+                lock.assertOwnership();
+                writeSubagentTrackingStateSync(cwd, state, lock.publish);
+            }
+            // Surface intentional exclusion of legacy/non-authoritative records instead
+            // of silently returning no context. The notice fires only when every
+            // relevant view across every correlation partition is genuinely
+            // descriptive/legacy: any authority-bearing, leader-kind, or
+            // leader_thread_id-colliding view keeps the denial fail-closed null.
+            const excludedIds = new Set(Object.values(session.threads)
+                .filter((thread) => thread.kind === 'subagent')
+                .map((thread) => thread.thread_id));
+            const everyRelevantViewIsLegacy = excludedIds.size > 0
+                && Object.values(state.sessions).every((correlationSession) => {
+                    if (correlationSession.leader_thread_id && excludedIds.has(correlationSession.leader_thread_id))
+                        return false;
+                    return [...excludedIds].every((threadId) => {
+                        const view = correlationSession.threads[threadId];
+                        if (!view)
+                            return true;
+                        return view.kind === 'subagent'
+                            && view.provenance_kind !== NATIVE_SUBAGENT_PROVENANCE
+                            && view.direct_child_root_id === undefined
+                            && view.direct_child_parent_id === undefined
+                            && view.reopen_authority_revoked !== true;
+                    });
+                });
+            if (everyRelevantViewIsLegacy) {
+                return persistedReopenLegacyNotice(excludedIds.size, context.source);
+            }
+            return null;
+        }
+        const reopenTargets = savedSubagents.filter((entry) => entry.status !== 'unavailable');
+        const unavailableTargets = savedSubagents.filter((entry) => entry.status === 'unavailable');
+        const failedTargets = savedSubagents.filter((entry) => entry.resumeFailedAt || entry.resumeFailureReason);
+        const now = new Date().toISOString();
+        for (const target of reopenTargets) {
+            session.threads[target.threadId] = { ...session.threads[target.threadId], resume_requested_at: now };
+        }
+        if (reopenTargets.length || changed) {
+            session.updated_at = now;
+            lock.assertOwnership();
+            writeSubagentTrackingStateSync(cwd, state, lock.publish);
+        }
+        const lines = [
+            '[Persisted subagent reopen]',
+            `- SessionStart source: ${context.source}; saved subagent ids found: ${savedSubagents.length}.`,
+        ];
+        if (reopenTargets.length) {
+            lines.push('- Reopen these persisted subagents by id before continuing work or spawning any same-role/same-lane replacement:');
+            lines.push(...reopenTargets.slice(0, 12).map((entry) => `  - resume_agent(${JSON.stringify(entry.agentId)})${formatReopenMetadata(entry)}`));
+            if (reopenTargets.length > 12)
+                lines.push(`  - ... ${reopenTargets.length - 12} more saved subagent id(s) omitted from this compact SessionStart context; consult .omx/state/subagent-tracking.json before spawning replacements.`);
+        }
+        else {
+            lines.push('- No compatible saved subagent id is currently marked reopenable; do not spawn a replacement merely because reopen was unavailable.');
+        }
+        lines.push('- Silver rule: when follow-up work targets an existing role/lane, reuse the matching reopened id; avoid duplicate same-type subagent spawns.');
+        lines.push('- If resume_agent fails, surface a clear warning with the id and reason, then continue in the root or another compatible existing lane; do not spawn a new agent solely because reopen failed.');
+        const warnings = [...new Map([...unavailableTargets, ...failedTargets].map((entry) => [entry.agentId, entry])).values()];
+        if (warnings.length) {
+            lines.push('- Reopen warnings:');
+            lines.push(...warnings.slice(0, 8).map((entry) => `  - ${entry.agentId}${formatReopenMetadata(entry)}`));
+            if (warnings.length > 8)
+                lines.push(`  - ... ${warnings.length - 8} more warning(s) omitted from this compact SessionStart context.`);
+        }
+        return lines.join('\n');
+    });
+}
 export function summarizeSubagentSession(state, sessionId, options = {}) {
     const normalized = normalizeSubagentTrackingState(state);
     const session = normalized.sessions[sessionId];