weir-harness 1.2.3 → 2.1.0

package/src/capabilities/capability-remote.js

@@ -21,6 +21,7 @@ import { openCapabilityStore } from './store/store.js'
 import { buildReceiptPayload, buildListPayload, buildConditionsPayload, buildPresetsPayload, buildDefaultGetPayload } from './read-payloads.js'
 import { PRESET_SELECTED_EVENT } from './preset-invalidation.js'
 import { createAudit } from '../shared/audit.js'
+import { mcpDiagnostic, sanitizeMcpPayload } from './mcp-diagnostics.js'
 
 /** The host-root service key the typert gateway resolves (S27: ctx.get from the host root). */
 export const CAPABILITY_READ_SERVICE_KEY = 'weirCapabilityRead'
@@ -71,15 +72,74 @@ export function capabilityReadBridge(presetId) {
   return feeds?.size === 1 ? [...feeds][0].faces : null
 }
 
-function soleFeed(presetId) {
+/**
+ * The isolated `weirMcpManager` owned by the exact preset revision a live
+ * session's Agent retains, or undefined when that cannot be proven. The
+ * registry's `serviceFor(agent, name)` reads `agent.ctx`'s retained mount, so
+ * an old session keeps resolving its old revision after a config change or a
+ * bundle toggle remounted the preset next to it. Everything is read through
+ * caller-supplied ctx getters (never a static runtime import).
+ * @param {string} sessionId
+ * @param {{ agents?: () => any, agentPresets?: () => any }} [runtime]
+ */
+function sessionManager(sessionId, runtime) {
+  try {
+    const agent = runtime?.agents?.()?.get?.(sessionId)
+    // A cold or unknown session has no live Agent and hence no retained mount.
+    if (!agent?.ctx || agent.id !== sessionId) return undefined
+    const registry = runtime?.agentPresets?.()
+    if (typeof registry?.serviceFor !== 'function') return undefined
+    return registry.serviceFor(agent, 'weirMcpManager') ?? undefined
+  } catch { return undefined }
+}
+
+/**
+ * Resolve the feed owning ONE session's read/mutation.
+ *
+ * A single feed is the fast path (no agent lookup). Several feeds for one
+ * preset are legitimate — two retained revisions of the same preset stay
+ * mounted while old sessions still use the old one — so the owner is the
+ * unique feed whose `faces.mcpManager()` IS the manager the session's own
+ * revision provides. Every other outcome fails closed with `owner-ambiguous`:
+ * no runtime seam, a cold/unknown agent, a revision without a manager, no
+ * matching feed, or several feeds sharing that manager (overlapping
+ * generations of one revision). Never newest-wins.
+ * @param {string} presetId
+ * @param {string} sessionId
+ * @param {{ agents?: () => any, agentPresets?: () => any }} [runtime]
+ */
+function sessionFeed(presetId, sessionId, runtime) {
   const feeds = bridgeFeeds.get(presetId)
   if (!feeds?.size) throw new CapabilityReadError('bridge-absent', `capability read: no feed for preset ${presetId}`)
-  if (feeds.size !== 1) throw new CapabilityReadError('owner-ambiguous', `capability read: overlapping feeds for preset ${presetId}`)
-  return [...feeds][0]
+  if (feeds.size === 1) return [...feeds][0]
+  const ambiguous = reason => new CapabilityReadError('owner-ambiguous', `capability read: overlapping feeds for preset ${presetId}: ${reason}`)
+  const manager = sessionManager(sessionId, runtime)
+  if (manager === undefined) throw ambiguous(`session ${JSON.stringify(sessionId)} has no live agent with a preset-owned MCP manager`)
+  const matches = [...feeds].filter(feed => {
+    try { return feed.faces?.mcpManager?.() === manager } catch { return false }
+  })
+  if (matches.length === 0) throw ambiguous(`no feed belongs to the revision of session ${JSON.stringify(sessionId)}`)
+  if (matches.length > 1) throw ambiguous(`${matches.length} feeds share the manager of session ${JSON.stringify(sessionId)}`)
+  return matches[0]
+}
+
+/**
+ * Exact feed token used by mutation ownership snapshots and their rechecks.
+ * @param {string} presetId
+ * @param {string} sessionId
+ * @param {{ agents?: () => any, agentPresets?: () => any }} [runtime] ctx getters for the host `agents` and `agentPresets` services
+ */
+export function capabilityReadFeed(presetId, sessionId, runtime = undefined) { return sessionFeed(presetId, sessionId, runtime) }
+
+/** @param {{ bridge?: Function, agents?: () => any, agentPresets?: () => any }} dependencies */
+function feedResolver(dependencies) {
+  if (dependencies.bridge) return dependencies.bridge
+  const runtime = { agents: dependencies.agents, agentPresets: dependencies.agentPresets }
+  return (presetId, sessionId) => sessionFeed(presetId, sessionId, runtime)
 }
 
 /** Extract the current projected owner and its last committed selection generation. */
-function ownership(observation, sessionId) {
+export function capabilityOwnership(observation, sessionId) {
   if (!observation || observation.header?.id !== sessionId) {
     throw new CapabilityReadError('unknown-session', `capability read: unknown session ${JSON.stringify(sessionId)}`)
   }
@@ -95,7 +155,7 @@ function ownership(observation, sessionId) {
 
 /** Create the host read service. Observations are caller-owned leases, always disposed. */
 export function createCapabilityReadService(dependencies = {}) {
-  const bridgeFor = dependencies.bridge ?? soleFeed
+  const bridgeFor = feedResolver(dependencies)
   const storeFor = dependencies.store ?? (profileContext => openCapabilityStore({ profileContext }))
   const ensure = dependencies.ensureRegistered ?? (() => true)
   const onDegraded = dependencies.onDegraded ?? (() => {})
@@ -105,7 +165,7 @@ export function createCapabilityReadService(dependencies = {}) {
     try {
       lease = await observeSession(sessionId)
       if (!lease || typeof lease[Symbol.dispose] !== 'function') throw new CapabilityReadError('owner-unavailable', 'capability read: session observation is unavailable')
-      return { lease, owner: ownership(lease, sessionId) }
+      return { lease, owner: capabilityOwnership(lease, sessionId) }
     } catch (cause) {
       lease?.[Symbol.dispose]?.()
       if (cause instanceof CapabilityReadError) throw cause
@@ -117,7 +177,7 @@ export function createCapabilityReadService(dependencies = {}) {
     const first = await observe(sessionId)
     try {
       const { presetId, cwd, selectionSeq } = first.owner
-      const feed = bridgeFor(presetId)
+      const feed = bridgeFor(presetId, sessionId)
       if (!feed) throw new CapabilityReadError('bridge-absent', `capability read: no feed for preset ${presetId}`)
       const faces = feed.faces ?? feed
       const options = { cwd, scope: { session: { id: sessionId } } }
@@ -149,7 +209,7 @@ export function createCapabilityReadService(dependencies = {}) {
       }
       const second = await observe(sessionId)
       try {
-        if (second.owner.presetId !== presetId || second.owner.cwd !== cwd || second.owner.selectionSeq !== selectionSeq || bridgeFor(presetId) !== feed) {
+        if (second.owner.presetId !== presetId || second.owner.cwd !== cwd || second.owner.selectionSeq !== selectionSeq || bridgeFor(presetId, sessionId) !== feed) {
           throw new CapabilityReadError('owner-changed', 'capability read: owner or feed changed during read')
         }
         return payload
@@ -185,27 +245,143 @@ export function createCapabilityReadService(dependencies = {}) {
   }
 }
 
+export const CAPABILITY_MUTATION_SERVICE_KEY = 'weirCapabilityMutation'
+export const CAPABILITY_MUTATION_NAMESPACE = 'weirCapabilityMutations'
+export const CAPABILITY_MUTATION_METHODS = ['mutate', 'batch']
+
+export function sameMutationOwner(first, second) {
+  const profile = value => value ? `${value.home ?? ''}\0${value.name ?? ''}` : ''
+  return first.owner.presetId === second.owner.presetId
+    && first.owner.cwd === second.owner.cwd
+    && first.feed === second.feed
+    && profile(first.profile) === profile(second.profile)
+}
+
+/** Session-preset/profile/feed ownership for mutations; selectionSeq is not compared. */
+export function createCapabilityMutationService(dependencies = {}) {
+  const bridgeFor = feedResolver(dependencies)
+  const ensure = dependencies.ensureRegistered ?? (() => true)
+  const observeSession = dependencies.observeSession ?? (sessionId => dependencies.sessionQuery?.()?.observeSession(sessionId))
+  const observe = async sessionId => {
+    let lease
+    try {
+      lease = await observeSession(sessionId)
+      if (!lease || typeof lease[Symbol.dispose] !== 'function') throw new CapabilityReadError('owner-unavailable', 'capability mutation: session observation unavailable')
+      const owner = capabilityOwnership(lease, sessionId)
+      const feed = bridgeFor(owner.presetId, sessionId)
+      if (!feed) throw new CapabilityReadError('bridge-absent', `capability mutation: no feed for preset ${owner.presetId}`)
+      const faces = feed.faces ?? feed
+      return { lease, owner, feed, faces, profile: faces.profileContext?.() }
+    } catch (cause) {
+      lease?.[Symbol.dispose]?.()
+      if (cause instanceof CapabilityReadError) throw cause
+      throw new CapabilityReadError('unknown-session', `capability mutation: cannot observe session ${JSON.stringify(sessionId)}`, { cause })
+    }
+  }
+  async function mutate(sessionId, request, batch = false) {
+    if (!ensure()) throw new CapabilityReadError('channel-unavailable', 'capability mutation channel is not registered')
+    const first = await observe(sessionId)
+    try {
+      const assertOwner = async () => {
+        const current = await observe(sessionId)
+        try {
+          if (!sameMutationOwner(first, current)) throw new CapabilityReadError('owner-changed', 'capability mutation: session preset/profile/feed owner changed')
+        } finally { current.lease[Symbol.dispose]() }
+      }
+      if (typeof first.faces.mcpOperations !== 'function') throw new CapabilityReadError('bridge-absent', 'capability mutation: owning preset has no MCP operations')
+      const operations = first.faces.mcpOperations({ id: sessionId, header: { cwd: first.owner.cwd } }, { assertOwner })
+      let result
+      try {
+        result = batch ? await operations.executeBatch(request) : request?.action === 'preview' ? await operations.preview(request) : await operations.execute(request)
+      } catch (cause) {
+        result = { status: cause?.code === 'owner-changed' ? 'owner-changed' : 'validation-failed', saved: false, error: mcpDiagnostic(cause, { code: cause?.code ?? 'validation-failed' }) }
+      }
+      // A response may be stale by the time it is serialized. Never claim a
+      // rollback; return the operation's actual saved facts with owner-changed.
+      try {
+        await assertOwner()
+      } catch (cause) {
+        if (result.status !== 'owner-changed') {
+          return sanitizeMcpPayload({
+            ...result,
+            status: 'owner-changed',
+            ownerChanged: true,
+            actual: {
+              status: result.status,
+              saved: result.saved === true,
+              registryRevision: result.registryRevision ?? null,
+              generation: result.generation ?? null,
+              incarnation: result.incarnation ?? null,
+            },
+            error: mcpDiagnostic(cause, { code: 'owner-changed' }),
+          })
+        }
+      }
+      return sanitizeMcpPayload(result)
+    } finally {
+      first.lease[Symbol.dispose]()
+    }
+  }
+  return {
+    mutate: (sessionId, request) => mutate(sessionId, request, false),
+    batch: (sessionId, request) => mutate(sessionId, request, true),
+  }
+}
+
+/**
+ * Every endpoint the gateway resolves through this package's ONE host-face
+ * contribution, in contribution order. A live read says nothing about write
+ * availability, so liveness is always checked across this whole set.
+ */
+export const CAPABILITY_ENDPOINTS = [
+  ...CAPABILITY_READ_METHODS.map(method => `${CAPABILITY_READ_NAMESPACE}/${method}`),
+  ...CAPABILITY_MUTATION_METHODS.map(method => `${CAPABILITY_MUTATION_NAMESPACE}/${method}`),
+]
+
 /**
  * The hand-written typert contribution (S27: empty schemas/model, src-json
  * codecs, no zod, no generated artifacts). Parameters and results are plain
  * JSON; the envelope validates the argument name only.
+ *
+ * ALL five read and two mutation invocations live in ONE contribution, because
+ * the registry keys exactly one record per package+face and rejects any second
+ * registration while that record is live: two separate `weir-harness` host-face
+ * contributions could never overlap generations, and the face the mutation half
+ * used to declare (`host-mutations`) is not a face the registry accepts at all —
+ * register() threw and apply() swallowed it into a warning, so the write channel
+ * was silently dead. One atomic batch also means recovery restores every
+ * endpoint or none.
  */
-export function capabilityReadContribution() {
+export function capabilityContribution() {
   return {
-    // The registry's validatePackage requires both (missing = silently dead registration): it validates the package name and keys the package record by face.
+    // The registry's validatePackage requires both (missing = silently dead registration): it validates the package name, rejects any face except host/client, and keys the package record by face.
     package: 'weir-harness',
     face: 'host',
     schemas: [],
     model: { services: [], events: [], objects: [] },
-    invocations: CAPABILITY_READ_METHODS.map(method => ({
-      id: `weir-harness.${CAPABILITY_READ_NAMESPACE}.${method}`,
-      service: CAPABILITY_READ_SERVICE_KEY,
-      namespace: CAPABILITY_READ_NAMESPACE,
-      method,
-      invocation: { kind: 'direct' },
-      parameters: [{ name: 'sessionId', wire: 'sessionId', source: 'json', codec: { mode: 'src-json' } }],
-      result: { mode: 'src-json' },
-    })),
+    invocations: [
+      ...CAPABILITY_READ_METHODS.map(method => ({
+        id: `weir-harness.${CAPABILITY_READ_NAMESPACE}.${method}`,
+        service: CAPABILITY_READ_SERVICE_KEY,
+        namespace: CAPABILITY_READ_NAMESPACE,
+        method,
+        invocation: { kind: 'direct' },
+        parameters: [{ name: 'sessionId', wire: 'sessionId', source: 'json', codec: { mode: 'src-json' } }],
+        result: { mode: 'src-json' },
+      })),
+      ...CAPABILITY_MUTATION_METHODS.map(method => ({
+        id: `weir-harness.${CAPABILITY_MUTATION_NAMESPACE}.${method}`,
+        service: CAPABILITY_MUTATION_SERVICE_KEY,
+        namespace: CAPABILITY_MUTATION_NAMESPACE,
+        method,
+        invocation: { kind: 'direct' },
+        parameters: [
+          { name: 'sessionId', wire: 'sessionId', source: 'json', codec: { mode: 'src-json' } },
+          { name: 'request', wire: 'request', source: 'json', codec: { mode: 'src-json' } },
+        ],
+        result: { mode: 'src-json' },
+      })),
+    ],
   }
 }
 
@@ -222,6 +398,20 @@ export function capabilityReadContribution() {
  * gateway dispatch resolves through it as well, so the loader must order this
  * row after the typert provider — including a composition where a user-layer
  * patch injects typert after the bundle rows (S27).
+ *
+ * Registration lifecycle (S27.5, gateway/definition-unavailable): a fiber
+ * reload runs apply() again while the previous incarnation's effects are still
+ * unwinding, so BOTH the service provision and the contribution registration can
+ * lose that race, and the old incarnation then withdraws what the new one
+ * skipped. Because the gateway refuses a withdrawn strict definition before it
+ * ever reaches a service method (hasSeen + no live definition), the recovery
+ * must live in this plugin's own fiber: it subscribes to `typert.local` changes
+ * and re-attempts provision+registration on a coalesced microtask while the
+ * endpoints are incomplete. Every one of those facts is per-fiber state: a
+ * pending retry, the disposal latch and the warning latch belong to THIS
+ * generation, so an old generation can never consume the survivor's retry, and
+ * a disposed fiber cannot resurrect the endpoints (Cordis rejects its effect
+ * creation with INACTIVE_EFFECT — the final barrier, never a retry loop).
  */
 export function apply(ctx) {
   const warn = text => ctx.logger?.warn?.(text)
@@ -236,46 +426,107 @@ export function apply(ctx) {
     warn('weir capability remote: typert service is unavailable in this composition; capability reads stay unavailable on the client')
     return
   }
-  // Idempotent, self-healing registration. The registry rejects a duplicate
-  // package contribution, so a re-mount that races the previous fiber's
-  // disposal must not treat "already registered" as fatal when the endpoints
-  // are actually live — and a later withdrawal (that previous fiber finally
-  // disposing) must be repaired on the next read rather than left dead.
-  const endpointLive = () => {
-    try { return Boolean(typert.local?.get?.(`${CAPABILITY_READ_NAMESPACE}/receipt`)) } catch { return false }
+  // Per-fiber lifecycle state. NEVER module-global: the previous incarnation's
+  // listener and this one can both observe the same withdrawal.
+  let disposed = false
+  let retryQueued = false
+  let registrationWarned = false
+  const endpointLive = endpoint => {
+    try { return Boolean(typert.local?.get?.(endpoint)) } catch { return false }
   }
-  const ensureRegistered = () => {
-    if (endpointLive()) return true
+  const endpointsComplete = () => CAPABILITY_ENDPOINTS.every(endpointLive)
+  let readService
+  let mutationService
+  // Provide one service unless another incarnation still holds the host-root
+  // key. A host-root provide lives on the ROOT fiber (S27: the gateway resolves
+  // ctx.get from the host root), so the first incarnation's receiver survives
+  // every reload; replacing it is neither possible nor needed. A lost race is
+  // not fatal — the retry below keeps every endpoint self-healing.
+  const ensureService = (key, service) => {
     try {
-      typert.register(capabilityReadContribution())
+      const current = typeof ctx.get === 'function' ? ctx.get(key) : undefined
+      if (current === service) return true
+      if (current !== undefined) return false
+      ctx.root.reflect.provide(key, service)
       return true
+    } catch { return false }
+  }
+  const ensureServices = () => {
+    const read = ensureService(CAPABILITY_READ_SERVICE_KEY, readService)
+    const mutation = ensureService(CAPABILITY_MUTATION_SERVICE_KEY, mutationService)
+    return read && mutation
+  }
+  // Exactly ONE register attempt per call: the registry rejects the whole batch
+  // or commits all of it, so looping could only repeat the same rejection.
+  const ensureContribution = () => {
+    if (endpointsComplete()) return true
+    try {
+      typert.register(capabilityContribution())
     } catch (cause) {
-      // Duplicate-package race: a previous generation's registration still
-      // serves the endpoints — that is success, not a warning.
-      if (endpointLive()) return true
-      warn(`weir capability remote: registration failed (${cause instanceof Error ? cause.message : String(cause)}); capability reads stay unavailable on the client`)
-      return false
+      if (!endpointsComplete()) {
+        // A disposed fiber's rejection is terminal (the survivor owns the retry).
+        if (cause?.code === 'INACTIVE_EFFECT') {
+          disposed = true
+          return false
+        }
+        if (!registrationWarned) {
+          registrationWarned = true
+          warn(`weir capability remote: registration failed (${cause instanceof Error ? cause.message : String(cause)}); capability endpoints stay unavailable on the client`)
+        }
+        return false
+      }
     }
+    return endpointsComplete()
   }
+  const ensureRegistered = () => ensureContribution()
+  // Coalesce a burst of registry changes into one microtask. Waiting a turn also
+  // lets the disposing incarnation finish synchronously releasing its service
+  // keys, which a synchronous retry inside the change callback would still see.
+  const queueRetry = () => {
+    if (disposed || retryQueued) return
+    retryQueued = true
+    queueMicrotask(() => {
+      retryQueued = false
+      if (disposed || endpointsComplete()) return
+      ensureServices()
+      ensureContribution()
+    })
+  }
+  // Latch disposal as early as the fiber allows, before a queued retry can run
+  // against a fiber Cordis has already detached. A fiber that is already gone
+  // needs no latch: its next register() is rejected with INACTIVE_EFFECT.
+  try {
+    if (typeof ctx.effect === 'function') ctx.effect(() => () => { disposed = true })
+  } catch { /* detached fiber: the effect rejection is the barrier */ }
   try {
     const audit = createAudit(ctx)
     const onDegraded = facts => {
       warn(`weir capability read degraded: method=${facts.method} session=${facts.sessionId} preset=${facts.presetId} header=${facts.headerPreset} source=${facts.source} warnings=${facts.warnings.join(';')} provider=${facts.providerReason ?? '-'}: ${facts.providerError ?? '-'}`)
       audit({ id: facts.sessionId, header: { cwd: facts.cwd } }, 'capability-read', facts)
     }
-    const service = createCapabilityReadService({ ensureRegistered, sessionQuery: () => ctx.get?.('sessionQuery'), onDegraded })
-    // The exact frozen binding validateBinding requires (S27): { service,
-    // serviceKey, namespace } — built by hand, no protocol import.
-    service.typertRemote = Object.freeze({
-      service,
-      serviceKey: CAPABILITY_READ_SERVICE_KEY,
-      namespace: CAPABILITY_READ_NAMESPACE,
-    })
-    Object.freeze(service)
-    ctx.root.reflect.provide(CAPABILITY_READ_SERVICE_KEY, service)
-    ensureRegistered()
+    // Per-session owner resolution reads the host agents registry and the
+    // preset registry lazily (both host-root services; no mount-time inject).
+    const runtime = { agents: () => ctx.get?.('agents'), agentPresets: () => ctx.get?.('agentPresets') }
+    readService = createCapabilityReadService({ ensureRegistered, sessionQuery: () => ctx.get?.('sessionQuery'), onDegraded, ...runtime })
+    readService.typertRemote = Object.freeze({ service: readService, serviceKey: CAPABILITY_READ_SERVICE_KEY, namespace: CAPABILITY_READ_NAMESPACE })
+    Object.freeze(readService)
+    mutationService = createCapabilityMutationService({ ensureRegistered, sessionQuery: () => ctx.get?.('sessionQuery'), ...runtime })
+    mutationService.typertRemote = Object.freeze({ service: mutationService, serviceKey: CAPABILITY_MUTATION_SERVICE_KEY, namespace: CAPABILITY_MUTATION_NAMESPACE })
+    Object.freeze(mutationService)
   } catch (cause) {
     warn(`weir capability remote: setup failed (${cause instanceof Error ? cause.message : String(cause)}); capability reads stay unavailable on the client`)
+    return
+  }
+  // Provision BEFORE registering: the gateway resolves the service key of a
+  // live definition, so an endpoint must never outlive its receiver.
+  ensureServices()
+  ensureContribution()
+  // Independent per-fiber subscription: hosts without it keep the older
+  // self-heal-on-call behaviour (each service call still checks the endpoints).
+  try {
+    typert.local?.subscribe?.(() => { if (!endpointsComplete()) queueRetry() })
+  } catch (cause) {
+    warn(`weir capability remote: registration watch failed (${cause instanceof Error ? cause.message : String(cause)}); the capability channel only self-heals on the next call`)
   }
 }
 

package/src/capabilities/initial-selection.js

@@ -154,7 +154,7 @@ export function resolveSkillNamesForSave(names, candidates, appliedSkills) {
   return { identities, missing, ambiguous }
 }
 
-export function resolveInitialSelection({ defaultsRecord, builtinIdentities = [], enabledMcpIdentities = [] }) {
+export function resolveInitialSelection({ defaultsRecord, builtinIdentities = [], enabledMcpIdentities = [], mcpIncarnations }) {
   // A cleared marker is an explicit removal (9.4): it behaves as ABSENT —
   // clearing is never an explicit empty set, which stays a savable choice.
   const cleared = defaultsRecord && defaultsRecord.kind === 'ok'
@@ -169,13 +169,14 @@ export function resolveInitialSelection({ defaultsRecord, builtinIdentities = []
       selection: {
         skills: Array.isArray(payload.skills) ? structuredClone(payload.skills) : [],
         mcpServers: Array.isArray(payload.mcpServers) ? /** @type {string[]} */ (payload.mcpServers).slice() : [],
+        ...((mcpIncarnations ?? payload.mcpIncarnations) ? { mcpIncarnations: structuredClone(mcpIncarnations ?? payload.mcpIncarnations) } : {}),
       },
       missing: Array.isArray(payload.unresolvedRefs) ? payload.unresolvedRefs.slice() : [],
     }
   }
   return {
     source: 'builtin-baseline',
-    selection: { skills: builtinIdentities.slice(), mcpServers: enabledMcpIdentities.slice() },
+    selection: { skills: builtinIdentities.slice(), mcpServers: enabledMcpIdentities.slice(), ...(mcpIncarnations ? { mcpIncarnations: structuredClone(mcpIncarnations) } : {}) },
     missing: [],
   }
 }

package/src/capabilities/lifecycle-preload.js

@@ -1,11 +1,19 @@
-// Task 6.1 preload (design D6): at plugin apply, load the accepted
-// selections of KNOWN sessions into the lifecycle memory snapshot, so the
-// agent/created listener's synchronous read hits memory instead of disk.
-// This module is the async boundary — it runs at mount time, NEVER inside
-// the agent/created listener. A slow or failed preload costs one blocking
-// synchronous disk read per agent creation (the listener's miss path),
-// never correctness. Records that do not decode are pre-marked BLOCKED, so
-// the fail-closed state is ready before the first agent is created.
+// Task 6.1 preload (design D6): at plugin apply, load the EFFECTIVE selections
+// of KNOWN sessions into the lifecycle memory snapshot, so the agent/created
+// listener's synchronous read hits memory instead of disk. This module is the
+// async boundary — it runs at mount time, NEVER inside the agent/created
+// listener. A slow or failed preload costs one blocking synchronous disk read
+// per agent creation (the listener's miss path), never correctness. Records
+// that do not decode are pre-marked BLOCKED, so the fail-closed state is ready
+// before the first agent is created.
+//
+// "Effective" is the same priority the synchronous read path applies: the
+// accepted selection when one exists, otherwise the durable inherited snapshot
+// (a fork of a fork, or a fork whose source only resolved an initial set). Both
+// are loaded here, because a cold session read (Badge/manager receipt, MCP
+// gate, Skill catalog) must report the inherited set rather than an empty one
+// until the fork's agent is recreated. A corrupt record of EITHER unit blocks
+// the session — never a fall-through to the other one.
 import { readdir } from 'node:fs/promises'
 import { join } from 'node:path'
 import { isSegment } from './store/paths.js'
@@ -14,10 +22,17 @@ import { openCapabilityStore } from './store/store.js'
 /** @param {unknown} error */
 const message = error => (error instanceof Error ? error.message : String(error))
 
+/** @param {unknown} payload @returns {number} capturedAt used by the inherited restore */
+const capturedAtOf = payload => {
+  const value = /** @type {Record<string, unknown>} */ (payload ?? {}).capturedAt
+  return typeof value === 'number' && Number.isFinite(value) ? value : 0
+}
+
 /**
  * @param {{
  *   lifecycle: {
- *     publish(sessionId: string, next: { revision: number, skills?: unknown[], mcpServers?: string[] }): unknown,
+ *     publish(sessionId: string, next: { revision: number, skills?: unknown[], mcpServers?: string[],
+ *       captured?: { parentSessionId: string, parentRevision: number | null, capturedAt: number } | null }): unknown,
  *     markBlocked(sessionId: string, reason: 'corrupt'|'unknown-schema'|'torn'|'unreadable'): unknown,
  *     peek(sessionId: string): unknown,
  *   },
@@ -45,20 +60,63 @@ export async function preloadLifecycleSnapshots({ lifecycle, profileContext, pla
     if (!isSegment(name)) continue
     // A fresher in-memory publication (e.g. an Apply accepted while this
     // preload was in flight) always wins over the disk record it came from.
-    if (lifecycle.peek(name)) continue
+    // Capture the exact observed object so EVERY post-await publication or
+    // blocked marker can be gated on the same freshness proof.
+    const observed = lifecycle.peek(name) ?? null
+    if (observed) continue
     try {
       const record = await active.read({ kind: 'selection', sessionId: name })
+      // The first await may have allowed an accepted Apply (or another
+      // publisher) to replace the memory snapshot. Never publish/mark stale.
+      if (lifecycle.peek(name) !== observed) continue
       if (record.kind === 'ok') {
         const payload = record.payload ?? {}
         lifecycle.publish(name, {
           revision: record.revision,
           skills: Array.isArray(payload.skills) ? payload.skills : [],
           mcpServers: Array.isArray(payload.mcpServers) ? payload.mcpServers : [],
+          mcpIncarnations: payload.mcpIncarnations,
         })
         loaded++
-      } else if (record.kind === 'corrupt' || record.kind === 'unknown-schema' || record.kind === 'torn') {
+        continue
+      }
+      if (record.kind !== 'absent') {
         lifecycle.markBlocked(name, record.kind)
         blocked++
+        continue
+      }
+      // No accepted record: the effective set may be the durable inherited
+      // snapshot. Same fail-closed treatment for a record that exists but does
+      // not decode — the session must not look uninitialized (and be handed a
+      // fresh initial baseline) merely because its inheritance is damaged.
+      const inherited = await active.read({ kind: 'inherited', sessionId: name })
+      // A second independent read creates another interleaving window: an
+      // accepted Apply here MUST outrank the older inherited unit.
+      if (lifecycle.peek(name) !== observed) continue
+      if (inherited.kind === 'ok') {
+        const payload = /** @type {Record<string, unknown>} */ (inherited.payload ?? {})
+        const parent = payload.parent && typeof payload.parent === 'object'
+          ? /** @type {Record<string, unknown>} */ (payload.parent)
+          : null
+        lifecycle.publish(name, {
+          revision: inherited.revision,
+          skills: Array.isArray(payload.skills) ? payload.skills : [],
+          mcpServers: Array.isArray(payload.mcpServers) ? payload.mcpServers : [],
+          mcpIncarnations: payload.mcpIncarnations,
+          captured: parent && typeof parent.sessionId === 'string' && parent.sessionId.length > 0
+            ? {
+              parentSessionId: parent.sessionId,
+              parentRevision: Number.isSafeInteger(parent.revision) ? /** @type {number} */ (parent.revision) : null,
+              capturedAt: capturedAtOf(payload),
+            }
+            : null,
+        })
+        loaded++
+        continue
+      }
+      if (inherited.kind !== 'absent') {
+        lifecycle.markBlocked(name, inherited.kind)
+        blocked++
       }
     } catch (error) {
       warn(`lifecycle snapshot preload skipped session "${name}": ${message(error)}`)