weir-harness 1.1.6 → 1.2.0

package/src/edit-lock/index.js

@@ -26,7 +26,7 @@ import { createStaleSweepScheduler } from './stale-sweep.js'
 import { createRemoteEditLockDomain, endpointFor, serveEditLockEndpoint } from './remote.js'
 import { registerBindingRuntime, createBindingAttester } from './binding-attestation.js'
 import { localDomain, remoteDomain } from './domain.js'
-import { AUTHORITY_DIR, createDomainRegistry, excludeFromGit, managementRootFor } from './domains.js'
+import { AUTHORITY_DIR, createDomainRegistry, excludeFromGit, managementRootFor, sharedDomainRegistryFor } from './domains.js'
 import { createRecoveryDriver } from './recovery.js'
 import { createSettlementDriver } from './settle.js'
 import { editLockLimits } from '../settings/sections.js'
@@ -41,6 +41,29 @@ const inject = ['tools', 'fs', 'agents']
 /** Tool names whose definitions must be Edit Lock routed when enabled. */
 export const GUARDED_TOOLS = Object.freeze(['write', 'edit', 'hash_edit', 'lsp_rename', 'str_replace_editor'])
 
+/** Claimed managed-editor executions, shared by every mount of this bundle in
+ * the process (change edit-lock-shared-domain-mounts, design D3): membership
+ * is execute-object identity, so cross-host admission is impossible and an
+ * execution claimed by a disposed mount is harmless — no live guard reads it.
+ * Whichever mount's guard stage hears an execution, the verdict is the same.
+ * @type {WeakSet<Function>} */
+const managed = new WeakSet()
+
+/** Host-lifetime live weirEditLock services (design D3): every mount registers
+ * its service at apply and unregisters at dispose, so the endpoint currency
+ * proof can accept any live sibling mount's service identity.
+ * @type {WeakMap<object, Set<object>>} */
+const liveServicesByHost = new WeakMap()
+/** @param {object} host @returns {Set<object>} */
+function liveServicesFor(host) {
+  let services = liveServicesByHost.get(host)
+  if (!services) {
+    services = new Set()
+    liveServicesByHost.set(host, services)
+  }
+  return services
+}
+
 /** Row config wins over the settings section; `root` + `authorityDirectory`
  * pin one fixed domain (development compositions and probes).
  * @param {unknown} config @param {unknown} [settings] */
@@ -258,7 +281,7 @@ function registerLockTools(ctx, service) {
       output: text('message'),
       async execute(/** @type {any} */ _args, /** @type {any} */ exec) {
         const unavailable = service.startupFailure(exec.agent)
-        if (unavailable) return { ...unavailable, message: `Edit Lock unavailable: ${unavailable.reason}. ${unavailable.bindingFailure?.retryable ? 'Do not retry failed edits: the binding is retried automatically when the user next sends a message, and /edit-lock retry also retries the connection; neither resumes editing by itself.' : 'Inspect Edit Lock maintenance before continuing.'}` }
+        if (unavailable) return { ...unavailable, message: `Edit Lock unavailable: ${unavailable.reason}. ${statusRetryHint(unavailable.bindingFailure)}` }
         const locks = await service.locks(exec)
         const lines = locks.map((/** @type {any} */ lock) => `- ${lock.resourceId} owner=${lock.mine ? 'this session' : lock.owner} status=${lock.status} generation=${lock.generation}${lock.reason ? ` reason=${lock.reason}` : ''}`)
         // The reservation is part of what the holder needs to know: without it the
@@ -310,6 +333,41 @@ function describe(status) {
   return lines.join('\n')
 }
 
+/** In-session binding-failure notice copy (change edit-lock-binding-transfer,
+ * design D4): the transferable class (same-process idle holder) is a calm
+ * self-heal announcement rather than an editing-disabled alarm and never
+ * carries the raw holder classification or the reservation warning; a mid-turn
+ * holder names the real state and the retry moment. Template layer stays
+ * English (AGENTS §3.7). @param {string} reason @param {any} failure */
+function bindingFailureNotice(reason, failure) {
+  if (failure?.code === 'binding-duplicate' && failure.holderKind === 'transferable') {
+    return "Edit Lock: this session's editing authority is held by an inactive attachment of this same session; it transfers automatically when you send a message."
+  }
+  if (failure?.code === 'binding-duplicate' && failure.holderKind === 'serving') {
+    return "Edit Lock: this session is being edited in another attachment right now; managed file editing stays unavailable until that turn finishes. Do not retry the failed edit; use /edit-lock retry (or the panel's Retry connection) once it finishes — retry does not Continue editing."
+  }
+  return `Edit Lock could not start this session's edit domain (${reason}); managed file editing is temporarily unavailable. ${failure?.code === 'binding-duplicate' ? 'Do not retry the failed edit: the binding is retried automatically when the user next sends a message, after which editing works normally. Never remove a live publisher reservation.' : 'Inspect Edit Lock maintenance before continuing.'}`
+}
+
+/** Read-only binding-unavailable guidance tail for the tool/service surfaces
+ * (domainFor and edit_lock_status), split by the recorded holder class.
+ * @param {string} failure @param {any} bindingFailure */
+function bindingUnavailableMessage(failure, bindingFailure) {
+  const kind = bindingFailure?.holderKind
+  if (kind === 'transferable') return `Edit Lock binding is unavailable (${failure}). The holder is an inactive attachment of this same session: the binding transfers automatically when the user next sends a message, and /edit-lock retry also takes it over; neither resumes editing by itself. Do not retry the failed edit.`
+  if (kind === 'serving') return `Edit Lock binding is unavailable (${failure}). This session is being edited in another attachment right now; retry the connection once that turn finishes. Do not retry the failed edit.`
+  return `Edit Lock binding is unavailable (${failure}). Do not retry the failed edit: the binding is retried automatically when the user next sends a message, after which editing works normally. Never remove a live publisher reservation.`
+}
+
+/** edit_lock_status read-only guidance tail, split by the recorded holder
+ * class (change edit-lock-binding-transfer). @param {any} bindingFailure */
+function statusRetryHint(bindingFailure) {
+  if (bindingFailure?.retryable !== true) return 'Inspect Edit Lock maintenance before continuing.'
+  if (bindingFailure.holderKind === 'transferable') return 'The holder is an inactive attachment of this same session: editing attaches automatically when you next send a message, and /edit-lock retry also takes it over; neither resumes editing by itself.'
+  if (bindingFailure.holderKind === 'serving') return 'This session is being edited in another attachment right now; /edit-lock retry retries the connection once that turn finishes — it does not resume editing by itself.'
+  return 'Do not retry failed edits: the binding is retried automatically when the user next sends a message, and /edit-lock retry also retries the connection; neither resumes editing by itself.'
+}
+
 /** Composition dependencies, not persisted settings. Defaults are the host paths.
  * @param {{ platform?: string, resolveRoot?: typeof managementRootFor, endpoint?: typeof endpointFor, exclude?: typeof excludeFromGit }} [dependencies] */
 export function createEditLockPlugin({ platform = process.platform, resolveRoot = managementRootFor, endpoint = endpointFor, exclude = excludeFromGit } = {}) {
@@ -335,6 +393,10 @@ return (ctx, config = {}) => {
     evidence?.failed(platformFailure)
     ctx.logger?.warn?.(platformFailure.message)
   }
+  /** The shared-registry handle, assigned inside the mount try so a failed
+   * apply can release its count (design D1: a failed mount enters no count).
+   * @type {any} */
+  let shared = null
   try {
   /** @type {any} */
   let sandboxPolicyRef = null
@@ -342,6 +404,11 @@ return (ctx, config = {}) => {
   // Capture the original host filesystem once; the manager is its only writer.
   const fs = ctx.fs
   const audit = createAudit(ctx)
+  // The host-lifetime key shared by the write-scope store, the domain registry
+  // container and the live-service set (design D1/D3) — identical to the key
+  // expression the settings evidence store uses.
+  const host = ctx.root ?? ctx
+  const liveServices = liveServicesFor(host)
   /** Successful undefined means no live runtime; missing service means unknown.
    * @param {string} sessionId */
   const servingRuntime = sessionId => {
@@ -361,12 +428,12 @@ return (ctx, config = {}) => {
   const disposedAgents = new WeakSet()
   /** One queued automatic-recovery summary notice per management root (design
    * D3): delivered to the first agent that finishes domain start, then gone.
-   * @type {Map<string, string>} */
-  const recoveryNotices = new Map()
-  // The tool registry may hand back a normalized copy of a definition; the
-  // claimed execute function is what actually runs, so it is the identity.
-  /** @type {WeakSet<Function>} */
-  const managed = new WeakSet()
+   * Shared across sibling mounts with the domain registry (change
+   * edit-lock-shared-domain-mounts): the domain opens through the first
+   * mount's closure, so the queue must live in the shared entry for the
+   * mount that hears the first post-recovery turn to drain it. Assigned
+   * with `shared` below. @type {Map<string, string>} */
+  let recoveryNotices
   /** Managed write registrations outlive this mount: the tool is installed
    * into the agent's OWN scope layer, which a preset rebind never disposes.
    * Their disposers live in a host-lifetime store so any later generation can
@@ -375,7 +442,7 @@ return (ctx, config = {}) => {
    * tearing the managed write down mid-gap would expose the stock writers
    * until the next mount's per-agent re-install.
    * @type {WeakMap<object, import('./write-scopes.js').WriteScopeEntry>} */
-  const writeScopes = writeScopesFor(ctx.root ?? ctx)
+  const writeScopes = writeScopesFor(host)
   let closed = false
   /** Remote channel agents on the publisher side → their notice sink.
    * @type {WeakMap<object, (event: unknown) => void>} */
@@ -384,8 +451,11 @@ return (ctx, config = {}) => {
   const startFailures = new WeakMap()
   /** Publisher-classified failures, never inferred from text. @type {WeakMap<object, any>} */
   const bindingFailures = new WeakMap()
-  /** Settled domain per bound agent, for synchronous gates. @type {WeakMap<object, any>} */
-  const settled = new WeakMap()
+  /** Settled domain per bound agent, for synchronous gates. Shared across
+   * sibling mounts with the domain registry (design D3): whichever mount
+   * hears an event reads the same binding. Assigned with `shared` below.
+   * @type {WeakMap<object, any>} */
+  let settled
   /** In-flight setup per agent, shared by every entry point (creation,
    * preset-switch, catch-up, lazy re-bind) so concurrent callers can never
    * double-register. @type {WeakMap<object, Promise<void>>} */
@@ -474,16 +544,26 @@ return (ctx, config = {}) => {
       })
       let server
       try { server = await serveEditLockEndpoint(lifecycle, endpoint(directory), sinks, attestBinding,
-        (agent, requireProof) => {
+        (agent, requireProof, transfer = false) => {
           if (closed || disposedAgents.has(agent)) return false
           const agents = ctx.get?.('agents')
           if (typeof agents?.get === 'function') {
-            if (agents.get(agent.id) !== agent) return false
+            if (transfer === true) {
+              // A transfer claimant is NEVER the registry's serving agent —
+              // that mismatch is the defect being repaired (change
+              // edit-lock-binding-transfer). Its liveness proof is listing
+              // among the live root agents; holder-side admission is the
+              // lifecycle's transferStart.
+              if (typeof agents.roots !== 'function' || !agents.roots().includes(agent)) return false
+            } else if (agents.get(agent.id) !== agent) return false
           } else if (requireProof) return false
           // Fresh creation keeps the established missing/throwing-registry
           // fallback. A reclaim or retry never uses that fallback as proof.
+          // Currency proof (design D3): the agent's resolved service must be a
+          // LIVE service of this process — after a preset switch that is the
+          // sibling mount's service, never this mount's own necessarily.
           if (typeof presets?.serviceFor === 'function') {
-            try { return presets.serviceFor(agent, 'weirEditLock') === service }
+            try { return liveServices.has(presets.serviceFor(agent, 'weirEditLock')) }
             catch { return !requireProof }
           }
           return true
@@ -499,12 +579,21 @@ return (ctx, config = {}) => {
       throw error
     }
   }
-  const registry = createDomainRegistry(root => {
+  // One domain registry per host + effective domain configuration, shared by
+  // every same-process preset mount of this bundle (design D1): a sibling
+  // mount never degrades to a same-process remote client, and the LAST
+  // disposer closes all domains through the established drain discipline. The
+  // first mount's `open` closure serves every sharing mount — mounts are
+  // process-persistent, so the capture is safe (design D1 trade-off).
+  shared = sharedDomainRegistryFor(host, options.fixed ? `${options.fixed.root}\n${options.fixed.directory}` : '', () => createDomainRegistry(root => {
     const fixed = options.fixed
     if (fixed) return openDomain(fixed.root, fixed.directory, root)
     try { exclude(root) } catch (error) { ctx.logger?.warn?.(`edit lock: could not update .git/info/exclude: ${/** @type {any} */ (error)?.message ?? error}`) }
     return openDomain(root, join(root, AUTHORITY_DIR), root)
-  }, resolveRoot)
+  }, resolveRoot))
+  const registry = shared.registry
+  settled = shared.settled
+  recoveryNotices = shared.recoveryNotices
   /** @param {any} agent */
   const domainOf = agent => registry.forAgent(agent)
   /** Lazy re-bind (design D2): an own-preset main agent with no binding —
@@ -520,7 +609,7 @@ return (ctx, config = {}) => {
     await setupInFlight.get(agent)
     if (settled.has(agent)) return settled.get(agent)
     const failure = startFailures.get(agent)
-    if (failure && bindingFailures.has(agent)) throw new Error(`Edit Lock binding is unavailable (${failure}). Do not retry the failed edit: the binding is retried automatically when the user next sends a message, after which editing works normally. Never remove a live publisher reservation.`)
+    if (failure && bindingFailures.has(agent)) throw new Error(bindingUnavailableMessage(failure, bindingFailures.get(agent)))
     if (failure) throw new Error(`this session has no Edit Lock domain: setup failed under the current preset generation (${failure}); the automatic re-bind was already attempted. Recovery: restart DeepSeek Harness or start a new conversation.`)
     // No fence match (foreign preset) or unmount: keep the stock refusal.
     return registry.forAgent(agent)
@@ -623,7 +712,17 @@ return (ctx, config = {}) => {
     if (platformFailure) return { state: 'unavailable', reason: platformFailure.message, bindingFailure: null }
     if (!agent || settled.has(agent) || !startFailures.has(agent)) return null
     let eligible = false
-    try { eligible = !closed && !disposedAgents.has(agent) && ownAgent(agent) && servingRuntime(agent.id) === agent } catch { /* no trusted live identity */ }
+    try {
+      const serving = servingRuntime(agent.id)
+      eligible = !closed && !disposedAgents.has(agent) && ownAgent(agent)
+        && (serving === agent
+          // The registry names ANOTHER live local agent — the dual-agent defect
+          // this change heals (edit-lock-binding-transfer). The recorded
+          // duplicate-binding failure is still THIS agent's honest panel state:
+          // show it, with its Retry action, instead of hiding behind the ghost's
+          // healthy binding. An empty registry stays hidden (unattestable).
+          || (serving !== undefined && bindingFailures.get(agent)?.code === 'binding-duplicate'))
+    } catch { /* no trusted live identity */ }
     if (!eligible) return null
     const failure = bindingFailures.get(agent)
     return { state: 'unavailable', reason: startFailures.get(agent),
@@ -682,6 +781,9 @@ return (ctx, config = {}) => {
     },
   })
   ctx.reflect.provide('weirEditLock', service)
+  // Any live sibling mount's service identity attests endpoint currency
+  // (design D3); unregister at dispose.
+  liveServices.add(service)
 
   const offTools = registerLockTools(ctx, service)
 
@@ -700,6 +802,15 @@ return (ctx, config = {}) => {
     const agent = exec?.agent
     if (!closed && agent && !registry.rootOf(agent) && !startFailures.has(agent) && (agent?.session?.header?.delegationDepth ?? 0) === 0 && ownAgent(agent)) {
       await setupAgent(agent)
+      // The lazy re-bind is a driving ingress (design D1, change
+      // edit-lock-binding-transfer): when the re-setup just recorded a
+      // duplicate-binding failure, ONE transfer-capable retry runs here — an
+      // idle same-process holder hands the binding over mid-turn. The recorded
+      // failure then suppresses further attempts for the rest of this mount
+      // generation, so arbitrary write calls never loop retries.
+      if (bindingFailures.get(agent)?.code === 'binding-duplicate') {
+        try { await retryBinding(agent, 'write-guard') } catch { /* audited inside retryBinding; the denial below names the recorded cause */ }
+      }
       if (admitted()) return next()
     }
     const failure = /** @type {any} */ (agent) ? startFailures.get(agent) : undefined
@@ -728,8 +839,12 @@ return (ctx, config = {}) => {
    * re-bind, so the paths can never diverge. Root selection and successful
    * startup are separate: explicit binding retry reuses the existing scope
    * and root, while ordinary entry points never repeat a failed startup.
-   * @param {any} agent */
-  async function setupAgentOnce(agent, retry = false) {
+   * @param {any} agent @param {boolean} [retry] @param {boolean} [transfer]
+   * transfer (change edit-lock-binding-transfer) marks the driving-ingress
+   * transfer admission: the domain's transferStart re-adjudicates holder
+   * idleness at execution, and the post-bind registry-identity check is
+   * skipped because the registry legitimately still names the idle holder. */
+  async function setupAgentOnce(agent, retry = false, transfer = false) {
     if (closed || settled.has(agent)) return
     // No writer scope, root resolution, directory, reservation or session
     // authority may be installed when the mount preflight failed.
@@ -764,9 +879,10 @@ return (ctx, config = {}) => {
     }
     try {
       const domain = await domainOf(agent)
-      if (retry) await domain.retryStart(agent)
+      if (transfer) await domain.transferStart(agent)
+      else if (retry) await domain.retryStart(agent)
       else await domain.start(agent)
-      if (closed || disposedAgents.has(agent) || (retry && (!ownAgent(agent) || servingRuntime(agent.id) !== agent))) {
+      if (closed || disposedAgents.has(agent) || (retry && (!ownAgent(agent) || (!transfer && servingRuntime(agent.id) !== agent)))) {
         await domain.forget(agent)
         throw new Error('Edit Lock mount changed during binding')
       }
@@ -790,7 +906,7 @@ return (ctx, config = {}) => {
       if (failure?.code === 'binding-duplicate') bindingFailures.set(agent, failure)
       else bindingFailures.delete(agent)
       try { evidence?.recordSessionFailure?.(sessionOf(agent), reason) } catch { /* reporting only */ }
-      try { deliverLocal(agent, `Edit Lock could not start this session's edit domain (${reason}); managed file editing is temporarily unavailable. ${failure?.code === 'binding-duplicate' ? 'Do not retry the failed edit: the binding is retried automatically when the user next sends a message, after which editing works normally. Never remove a live publisher reservation.' : 'Inspect Edit Lock maintenance before continuing.'}`) } catch { /* the panel record remains */ }
+      try { deliverLocal(agent, bindingFailureNotice(reason, failure)) } catch { /* the panel record remains */ }
       ctx.logger?.warn?.(`edit lock registration failed for ${sessionOf(agent)}: ${reason}`)
     }
   }
@@ -806,20 +922,64 @@ return (ctx, config = {}) => {
     setupInFlight.set(agent, task)
     return task
   }
-  /** Trusted command ingress only. Same Agent/root/mount; no writer reinstallation.
-   * @param {any} agent */
-  async function retryBinding(agent) {
-    if (closed || disposedAgents.has(agent) || !ownAgent(agent) || servingRuntime(agent.id) !== agent) throw new Error('Edit Lock retry requires the current live Agent of this mount')
+  /** Trusted driving ingresses only: the explicit /edit-lock retry (and panel
+   * action), the message-armed pre-step retry, and the write-guard lazy
+   * re-bind. Same Agent/root/mount; no writer reinstallation. Every attempt
+   * past the eligibility gate is audited — a silently swallowed refusal is a
+   * defect (change edit-lock-binding-transfer, design D3/D5).
+   * @param {any} agent @param {'command' | 'message' | 'write-guard'} [via] */
+  async function retryBinding(agent, via = 'command') {
+    if (closed || disposedAgents.has(agent) || !ownAgent(agent)) throw new Error('Edit Lock retry requires the current live Agent of this mount')
     if (!registry.rootOf(agent) || bindingFailures.get(agent)?.code !== 'binding-duplicate') throw new Error('Edit Lock startup failure is not eligible for binding retry')
-    let task = setupInFlight.get(agent)
-    if (!task) {
-      const inner = setupAgentOnce(agent, true)
-      task = inner.finally(() => { if (setupInFlight.get(agent) === task) setupInFlight.delete(agent) })
-      setupInFlight.set(agent, task)
+    const cause = bindingFailures.get(agent)
+    const sessionId = sessionOf(agent) ?? null
+    const root = registry.rootOf(agent) ?? undefined
+    /** @param {string} result @param {Record<string, unknown>} [extra] */
+    const record = (result, extra = {}) => audit(agent?.session ?? null, AUDIT_TYPES.editLockMaintenance, {
+      kind: 'binding-transfer', sessionId, code: cause?.code ?? 'binding-duplicate', result, ...extra,
+    }, { root })
+    // Attestation trichotomy (design D5): the registry naming THIS claimant
+    // keeps the existing superseded rebind; naming ANOTHER live local agent
+    // routes to the transfer admission (holder idleness is re-adjudicated at
+    // execution, publisher-side); an unavailable or empty registry stays
+    // fail-closed — the holder cannot be attested.
+    let serving
+    try { serving = servingRuntime(agent.id) } catch { serving = undefined }
+    if (serving === undefined) {
+      const error = new Error('Edit Lock binding retry refused: the agent registry is unavailable or names no live agent for this session, so the holder cannot be attested. The recorded cause stays; a later retry remains possible.')
+      record('refused', { reason: 'registry-unattestable', detail: error.message })
+      throw error
+    }
+    const transfer = serving !== agent
+    try {
+      let task = setupInFlight.get(agent)
+      if (!task) {
+        const inner = setupAgentOnce(agent, true, transfer)
+        task = inner.finally(() => { if (setupInFlight.get(agent) === task) setupInFlight.delete(agent) })
+        setupInFlight.set(agent, task)
+      }
+      await task
+    } catch (error) {
+      record('refused', { reason: /** @type {any} */ (error)?.bindingFailure?.holderKind ?? 'retry-refused', detail: String(/** @type {any} */ (error)?.message ?? error) })
+      throw error
     }
-    await task
     const failure = startFailures.get(agent)
-    if (failure || !settled.has(agent)) throw new Error(failure ?? 'Edit Lock binding remains unavailable')
+    if (failure || !settled.has(agent)) {
+      // setupAgentOnce records instead of rethrowing: the refusal's holder
+      // class comes from the freshly re-recorded structured failure.
+      const error = new Error(failure ?? 'Edit Lock binding remains unavailable')
+      record('refused', { reason: bindingFailures.get(agent)?.holderKind ?? 'binding-unavailable', detail: error.message })
+      throw error
+    }
+    if (transfer) {
+      record('transferred', { holder: cause?.holderKind ?? null })
+    } else if (via === 'message') {
+      // The message-armed superseded success keeps its established audit shape
+      // (pinned by the editlock-binding-auto-retry integration scenario).
+      audit(agent?.session ?? null, AUDIT_TYPES.editLockMaintenance, {
+        kind: 'binding-auto-retry', sessionId, code: cause?.code ?? 'binding-duplicate', result: 'recovered',
+      }, { root })
+    }
     return 'Edit Lock connection recovered. Editing remains interrupted; use Continue editing when ready. No failed edit was replayed.'
   }
   ctx.on('agent/created', (/** @type {any} */ { agent }) => setupAgent(agent))
@@ -953,17 +1113,17 @@ return (ctx, config = {}) => {
       lastTurn.set(agent, turn)
       if (pendingBindingRetry.get(agent) === true) {
         pendingBindingRetry.delete(agent)
-        const cause = bindingFailures.get(agent)
         try {
-          await retryBinding(agent)
+          await retryBinding(agent, 'message')
           // The genuine message that armed this retry is also this turn's
           // Continue receipt: re-arm what setupAgentOnce(retry) cleared, then
-          // fall through to the ordinary auto-resume consumption below.
+          // fall through to the ordinary auto-resume consumption below. A
+          // transfer success (registry named an idle same-process holder)
+          // lands here identically: bound interrupted, then resumed in-turn.
           pendingAutoResume.set(agent, true)
-          audit(agent?.session ?? null, AUDIT_TYPES.editLockMaintenance, {
-            kind: 'binding-auto-retry', sessionId: sessionOf(agent) ?? null,
-            code: cause?.code ?? 'binding-duplicate', result: 'recovered',
-          }, { root: registry.rootOf(agent) ?? undefined })
+          // The outcome audit (transferred / refused) was written inside
+          // retryBinding — success AND refusal alike; the catch below is not
+          // a silent swallow any more (design D3).
         } catch { /* a safe refusal keeps the recorded cause; the turn proceeds with edits denied */ }
       }
       const domain = settled.get(agent)
@@ -1284,6 +1444,7 @@ return (ctx, config = {}) => {
   return async () => {
     if (closed) return
     closed = true
+    liveServices.delete(service)
     offDelegateLifecycle()
     evidence?.disposing()
     try {
@@ -1295,10 +1456,9 @@ return (ctx, config = {}) => {
       offView()
       offCommand?.()
       for (const off of offTools) off?.()
-      // Retain uncertain evidence until every generation-owned domain is drained.
-      const results = await Promise.allSettled(registry.all().map(async domain => (await domain).close()))
-      const failure = results.find(result => result.status === 'rejected')
-      if (failure?.status === 'rejected') throw failure.reason
+      // Retain uncertain evidence until every generation-owned domain is
+      // drained; only the LAST sharing disposer closes them (design D1).
+      await shared.release()
       evidence?.dispose()
     } catch (error) {
       evidence?.failed(error)
@@ -1307,6 +1467,10 @@ return (ctx, config = {}) => {
   }
   } catch (error) {
     evidence?.failed(error)
+    // A mount that failed mid-apply must not stay counted in the shared
+    // registry (design D1); domains are lazy, so this release closes nothing
+    // unless a sibling mount already opened one — its count keeps it alive.
+    if (shared) void shared.release().catch(() => {})
     throw error
   }
 }

package/src/edit-lock/lifecycle.js

@@ -169,6 +169,17 @@ export function createEditLockLifecycle(runtime, sessionForAgent, options = {})
     }
     return result
   }
+  /** Holder liveness signal (change edit-lock-binding-transfer, task 1.1): the
+   * DSH agent `status` vocabulary is exactly 'idle' | 'running' (idle covers the
+   * idle and maintenance phases). Only 'idle' proves the holder is not mid-turn;
+   * a missing, non-string or throwing read is undeterminable and never admits.
+   * @param {object} holder @returns {string | undefined} */
+  function holderStatus(holder) {
+    try {
+      const status = /** @type {any} */ (holder)?.status
+      return typeof status === 'string' ? status : undefined
+    } catch { return undefined }
+  }
   /** Read-only startup admission. A revoked session is startable: it binds as
    * interrupted and its revocation ends only through the trusted resume path
    * (the epoch advance is the repair; binding alone grants no authority).
@@ -184,22 +195,42 @@ export function createEditLockLifecycle(runtime, sessionForAgent, options = {})
   }
   /** Register once before publishing an agent's editing tools. A session the
    * manager already knows (restart, re-created agent) is never re-armed: it
-   * starts interrupted and needs trusted resume. @param {object} agent
+   * starts interrupted and needs trusted resume. Presenting the SAME agent
+   * object again adopts the established entry instead of registering twice
+   * (change edit-lock-shared-domain-mounts, design D2). @param {object} agent
    * @returns {Promise<'active'|'interrupted'>} */
   function start(agent) {
     if (closed) return Promise.reject(new Error('edit lifecycle closed'))
-    if (entries.has(agent)) return Promise.reject(new Error('agent already registered'))
+    const existing = entries.get(agent)
+    if (existing) {
+      // Same-agent binding adoption: a sibling mount's idempotent re-setup
+      // presents the same agent object and takes the established start result
+      // verbatim — no openSession, no revocation, no epoch advance, no state
+      // change. A stopped/revoked entry keeps its state: adoption returns its
+      // established result, and business ingress stays gated by
+      // denyStopped/business until a trusted resume. Identity continuity is
+      // required — a host that reused the agent object for a different
+      // session keeps the duplicate-registration refusal.
+      if (sessionForAgent(agent) === existing.sessionId) return existing.ready
+      return Promise.reject(new Error('agent already registered'))
+    }
     const sessionId = sessionForAgent(agent)
     if (!sessionId) return Promise.reject(new Error('unregistered lifecycle agent'))
     const prior = [...entries].find(([, entry]) => entry.sessionId === sessionId)
     if (prior) {
       let serving
       try { serving = options.servingRuntime?.(sessionId) } catch { /* unknown: refuse */ }
+      // A registry-named local holder that is provably not mid-turn is the
+      // TRANSFERABLE class (serving-idle): passive paths still refuse, but the
+      // refusal announces the automatic takeover instead of a window hunt.
+      const attestation = serving === prior[0]
+        ? (/** @type {any} */ (prior[0]).remote !== true && holderStatus(prior[0]) === 'idle' ? 'serving-idle' : 'serving')
+        : 'unknown'
       const refusal = () => {
-        const reason = bindingRefusalReason(/** @type {any} */ (prior[0]).remote === true ? undefined : process.pid, serving === prior[0] ? 'serving' : 'unknown')
+        const reason = bindingRefusalReason(/** @type {any} */ (prior[0]).remote === true ? undefined : process.pid, attestation)
         // Remote callers render after their retry budget; local callers have no wire.
         return Object.assign(new Error(/** @type {any} */ (agent).remote === true ? reason : `${reason}: ${bindingGuidance(sessionId, reason)}`),
-          { bindingFailure: bindingFailure(/** @type {any} */ (prior[0]).remote === true ? undefined : process.pid, serving === prior[0] ? 'serving' : 'unknown') })
+          { bindingFailure: bindingFailure(/** @type {any} */ (prior[0]).remote === true ? undefined : process.pid, attestation) })
       }
       // Remote entries are channel proxies, NOT runtime identities. Only the
       // endpoint's nonce attestation may reclaim them (including same-process).
@@ -236,6 +267,39 @@ export function createEditLockLifecycle(runtime, sessionForAgent, options = {})
     })()
     return entry.ready
   }
+  /** Trusted driving-ingress transfer admission (change
+   * edit-lock-binding-transfer, design D1/D2): take the binding from a
+   * same-process, local (non-remote-proxy) holder that is registry-named and
+   * provably not mid-turn, reusing the exact superseded-reclaim semantics —
+   * durable revocation and forget, no lock is released, the claimant binds as
+   * interrupted. Every other shape (remote proxy, holder not registry-named,
+   * mid-turn, undeterminable liveness, unavailable registry) delegates to the
+   * ordinary start(), keeping its fail-closed refusal and its classification.
+   * Passive entry points (creation setup, catch-up, preset switch) never call
+   * this. @param {object} agent @returns {Promise<'active'|'interrupted'>} */
+  function transferStart(agent) {
+    if (closed) return Promise.reject(new Error('edit lifecycle closed'))
+    if (entries.has(agent)) return Promise.reject(new Error('agent already registered'))
+    const sessionId = sessionForAgent(agent)
+    if (!sessionId) return Promise.reject(new Error('unregistered lifecycle agent'))
+    const prior = [...entries].find(([, entry]) => entry.sessionId === sessionId)
+    if (!prior) return start(agent)
+    let serving
+    try { serving = options.servingRuntime?.(sessionId) } catch { /* unattestable: fall through to the ordinary refusal */ }
+    if (/** @type {any} */ (prior[0]).remote !== true && serving === prior[0] && holderStatus(prior[0]) === 'idle') {
+      // Concurrent claimants re-check after the shared revocation settles;
+      // no file lock is released and the claimant starts interrupted. A failed
+      // revocation keeps the transferable refusal: the holder entry is retained
+      // (start()'s reclaim-failure discipline) and the next driving ingress
+      // re-attempts the transfer.
+      return forget(prior[0]).then(() => start(agent), () => {
+        const reason = bindingRefusalReason(process.pid, 'serving-idle')
+        throw Object.assign(new Error(/** @type {any} */ (agent).remote === true ? reason : `${reason}: ${bindingGuidance(sessionId, reason)}`),
+          { bindingFailure: bindingFailure(process.pid, 'serving-idle') })
+      })
+    }
+    return start(agent)
+  }
   return Object.freeze({
     assertStartable,
     /** Local bindings only; endpoint arbitration reports channel proxies. */
@@ -283,6 +347,8 @@ export function createEditLockLifecycle(runtime, sessionForAgent, options = {})
       pendingRequests(exec) { return negotiation.pending(host.executionFor(exec.agent).sessionId) },
     }),
     start,
+    /** Explicit driving-ingress transfer entry; ordinary start() never transfers. */
+    transferStart,
     stop,
     /** Normal end of an agent: an agent that is still active (never stopped,
      * not recovering) can never edit again, so its active locks are released

package/src/edit-lock/remote.js

@@ -172,6 +172,22 @@ export async function serveEditLockEndpoint(lifecycle, endpoint, sinks, attest,
             const agent = Object.freeze({ id: sessionId, remote: true })
             sinks.set(agent, event => transport.notify(event))
             inner = createEditLockPeer(lifecycle, agent)
+            // A retry open is a trusted driving ingress (change
+            // edit-lock-binding-transfer): when the ordinary start is refused by
+            // a duplicate LOCAL holder, the transfer admission re-adjudicates the
+            // holder's idleness publisher-side. start() runs first and refuses
+            // without side effects, so a non-transferable refusal keeps its
+            // original classification and is evaluated exactly once per caller.
+            if (message.request.retry === true && typeof lifecycle.transferStart === 'function') {
+              try {
+                const state = await lifecycle.start(agent)
+                return { peer: inner, state }
+              } catch (error) {
+                if (/** @type {any} */ (error)?.bindingFailure?.code !== 'binding-duplicate') throw error
+                const state = await lifecycle.transferStart(agent)
+                return { peer: inner, state }
+              }
+            }
             const state = await lifecycle.start(agent)
             return { peer: inner, state }
           }, { nonce: typeof message.request.nonce === 'string' && message.request.nonce.length <= 256 ? message.request.nonce : undefined,
@@ -199,14 +215,17 @@ export async function serveEditLockEndpoint(lifecycle, endpoint, sinks, attest,
   })
   return Object.freeze({
     bindings: arbitration.bindings,
-    /** @param {any} agent @param {boolean} [retry] */
-    startLocal(agent, retry = false) {
+    /** @param {any} agent @param {boolean} [retry] @param {boolean} [transfer]
+     * transfer: the claimant arrives through a driving ingress whose registry
+     * identity is the defect being repaired — the lifecycle transfer admission
+     * decides, and the currency proof relaxes accordingly (isCurrentLocal). */
+    startLocal(agent, retry = false, transfer = false) {
       return arbitration.openLocal(agent.id, async reclaimed => {
         const current = () => {
-          try { return !closed && (isCurrentLocal ? isCurrentLocal(agent, reclaimed || retry) : !(reclaimed || retry)) } catch { return false }
+          try { return !closed && (isCurrentLocal ? isCurrentLocal(agent, reclaimed || retry, transfer) : !(reclaimed || retry)) } catch { return false }
         }
         if (!current()) throw new Error('local edit binding claimant is no longer current')
-        const state = await lifecycle.start(agent)
+        const state = transfer && typeof lifecycle.transferStart === 'function' ? await lifecycle.transferStart(agent) : await lifecycle.start(agent)
         if (!current()) {
           // A stopped entry still has subtractive cleanup authority. Forget it
           // only after durable revocation; never dispose (which releases locks).