fix(state): reject duplicate metadata CAS keys (W33)

[RecursiveIntell]

Source checkpoint e5d365606c84c6d5d8254ec3198b1059d54c3fea, parent 5430100655b69b883b406bc7ceb8747ecf1048d7.

Adds private turn-bound checkpoint handles with authenticated claim, refresh, and release operations. Tokens remain in the executing agent; isolated turns use the existing compute-host control path rather than a gateway-local/prewarmed owner. Refresh is caller-explicit before TTL expiry—no new renewal timer, scheduler, or database.

The owning turn's finally releases checkpoint custody before its native session-turn lease. Gateway finalization/teardown now requests cancellation and defers closure while that turn is live; pending intent is consumed after the turn settles. The child interrupt path also uses the shared Stop routine to wake child-owned clarification waits. Cancellation-like post-commit exceptions are classified unknown and require reconciliation, not automatic replay.

Verified local evidence on source bytes matching this commit:

• 1,173 passed, 0 failed across 19 canonical test files. This includes actual AIAgent/native-DB success/error/finalize ordering, held-turn finalization, expired release, concurrent claim/finish, and injected OSError/KeyboardInterrupt acknowledgement-loss cases.
• Both real Electron topologies passed with zero retries: claim → refresh → Stop → automatic release → next-turn reclaim in the same controller process → explicit release. Transport and native readback were real; inference was a loopback scripted test provider, not an external model.
• Focused Ruff and diff checks passed. The complete 36-path cumulative source manifest matches the tested bytes; this commit changes 12 paths.

The retained earlier failures include the reproduced missing owner/routing/Stop behavior, the premature-finalization race, cancellation classification, and test-fixture corrections. These are not erased by the later passing runs.

This addresses the reported gateway-owned release and isolated-routing findings at source/local qualification level. Fresh hosted checks, current review disposition, main merge, managed activation, live custody adoption, and full W00/W33/packet qualification remain separate. No universal cancellation or production-readiness guarantee is made.

---

Earlier source-checkpoint record (historical)

Source checkpoint 5430100655b69b883b406bc7ceb8747ecf1048d7, parent 422658c13e46b5e55651d9b33bc2b30ccdf2bcb6.

Adds the explicit SessionDBRunCustodyRefreshV1 storage envelope. Its checkpoint reference points to an earlier full V1 checkpoint; the predecessor digest may identify a compact record and intentionally retains the immutable history chain. Refreshes use the existing native head CAS and transaction owner—no second mutable lease authority or expiry-only takeover.

Local validation on matching source:

• 1,113 passed, 0 failed across 13 canonical test files, including 12 compact-storage cases, installed-wheel owner/RPC imports, integrity refusal, transaction rollback, reopen, and concurrent fencing.
• Twelve unchanged 200,000-character fixture refreshes added 2,411,933 logical UTF-8 state_meta value bytes before versus 8,657 after. This is not physical database growth, disk savings, or a workload-performance benchmark. Metadata history still grows per refresh; the API's 10,000-generation read bound remains.
• The executed decoder probe from parent 422658c read full V1 records and rejected the new compact format with INTEGRITY_SCHEMA. This is an explicit version boundary, not a general backward-compatibility claim. Existing V1 row bytes are retained.
• Replaced the packaging-list snapshot with actual built-wheel owner import/path checks. Focused Ruff and diff checks passed. Earlier failed runs, including the corrected reopen-observer fixture, remain retained.

This addresses the refresh duplication and packaging-test findings at source level.

Still blocked: the real Electron test at the parent snapshot reproduced custody remaining active after Stop and ACTIVE_AGENT_REQUIRED with turn isolation enabled. Gateway-owned release/refresh lifecycle and isolated compute-host routing are not repaired by this slice. Fresh current-head hosted qualification also remains separate. No main merge, runtime activation, live run custody adoption, or W00/W33/packet completion is claimed.

---

Earlier source-checkpoint record (historical)

Source checkpoint 422658c13e46b5e55651d9b33bc2b30ccdf2bcb6, parent 757d59b567a4a063ded713f309b69c5c267f2dc4.

Addresses the Codex-reported import-boundary findings on the disposable enforcement PR #55 (wheel omission, psutil import); they also applied to this candidate.

• Adds the two checkpoint helper modules to setuptools' explicit py-modules allowlist; it does not package the scripts directory wholesale.
• Makes psutil optional for ordinary state-store imports. The tested process/custody boundaries raise RunCustodyError with code PROCESS_INSPECTION_UNAVAILABLE when that dependency is absent; no process-identity fallback is supplied.
• Local seven-file canonical gate: 187 passed, 0 failed, including five wheel/import-boundary regressions. Tests build a wheel and import its extracted helpers without running editable-install .pth files. The corrected RED run reproduced all five failures before the repair.
• Focused Ruff, diff checks and uv lock --check --offline passed. Tested source bytes match this commit. Earlier failed probes remain retained.

Current-head CI and real transport requalification still follow. The old head's passing CI/smoke evidence is not promoted to this changed head. No main merge, activation, live run custody, security clearance, or W00/W33/packet completion is claimed.

---

Earlier source-checkpoint record (historical)

W33 checkpoint bootstrap — source checkpoint, not merge-ready

Dependency checkpoint: 757d59b567a4a063ded713f309b69c5c267f2dc4, parent 33d65e6a12a42fce5735ed2bb82654b7ef2120f8; cumulative base 370e3621bd90249e4492b4bac1d3e0046b828ae3.

Source scope

The PR preserves the SessionDB-owned checkpoint/CAS, explicit source-transition recording, read-only resume observer, checked claim admission, file-bound client, and pooled session.run_checkpoint.claim dispatcher. The dispatcher borrows the selected live agent's existing writable store and lease; claiming does not authorize resume or execute downstream effects. Caller-supplied digests and file observations are not an atomic source snapshot or proof of initial inventory completeness.

Subsequent test-only commits repair the FTS trace observer to follow the borrowed SQLite connection and respect the safety-selected journal mode. Earlier failed runs remain historical failures; they were not rewritten.

This dependency slice changes only 13 dependency paths (manifests, lockfiles and the matching lazy-install pin). It reuses scoped work from #53 commits 208cf07f1d9af6d250264d4ce758d7d687f3c7d1, 778a62e37bd76c6b93dd3ced20a14b8a621fc697, and 811522d205633e565e368e0242068c019555f391, then applies the narrower current-advisory updates including Electron 41.10.3, Vitest 4.1.11 and brace-expansion 1.1.18. It does not import #53 application changes.

Local validation record

• Canonical Python affected selection: 1,166 passed, 2 skipped across 74 files, including checkpoint, dispatcher, SQLite, packaging, lazy dependency and MCP coverage. Python inputs remain matched; three Node paths changed during that run, so it is not a fully frozen cross-language run.
• Root JS: 38 passed; TUI: 1,714 passed; web: 278 passed.
• Desktop Electron-project tests: 1,970 passed, 6 skipped. Desktop UI: 6,109 passed across the three disjoint repository shards.
• Exact-lock npm installs, TUI/Ink and Desktop builds, TUI/Desktop/web typechecks, WhatsApp syntax and uv lock --check passed in the supplied local records.
• Bounded npm audits for root, website and WhatsApp plus OSV scans of four named lockfiles reported zero advisories for the scanned snapshot. This is not an exploitability conclusion or security guarantee.

Local tests used isolated homes; the serial retry used one Vitest worker, a 3 GiB memory cap and a 512 MiB swap cap. Earlier interrupted runs, timeouts, missing build/socket prerequisites and the failed website build remain retained. Website qualification with its generation prerequisites is still pending at this checkpoint. No live external messaging was exercised.

These are controller-executed results, not independent reproduction or full product qualification. The previous head's hosted CI does not certify this new dependency head. Fresh hosted CI, current security/review disposition, protected merge, managed activation, live native custody and actual compaction/restart witnesses remain required. The PR remains draft; no merge, activation, historical-goal mutation, memory repair or W00/W33 completion is claimed.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on e5d3656 — fix(runtime): bind checkpoint custody to active turn owners}

⚠️ Action required

package-lock.json · View job

Locked npm dependency versions changed.

package-lock.json

Package	Before	After
brace-expansion (nested under @electron/asar)	1.1.12	1.1.18
@electron/get	2.0.3	5.1.0
brace-expansion (nested under @eslint/config-array)	1.1.12	1.1.18
brace-expansion (nested under @eslint/eslintrc)	1.1.12	1.1.18
brace-expansion (nested under dir-compare)	1.1.12	1.1.18
electron	40.10.2	41.10.3
brace-expansion (nested under eslint-plugin-react)	1.1.12	1.1.18
brace-expansion (nested under eslint)	1.1.12	1.1.18
brace-expansion (nested under glob)	1.1.12	1.1.18
js-yaml	4.3.1	4.3.2
➕ @electron-internal/extract-zip	—	1.0.5
➕ env-paths (nested under @electron/get)	—	3.0.0
➕ undici (nested under @electron/get)	—	7.29.0
➖ semver (nested under @electron/get)	6.3.1	—
➖ @types/yauzl	2.10.3	—
➖ extract-zip	2.0.1	—
➖ fs-extra	8.1.0	—
➖ pend	1.2.0	—
➖ yauzl	3.4.0	—
➖ @vitest/expect	4.1.10	—
➖ @vitest/mocker	4.1.10	—
➖ @vitest/pretty-format	4.1.10	—
➖ @vitest/runner	4.1.10	—
➖ @vitest/snapshot	4.1.10	—
➖ @vitest/spy	4.1.10	—
➖ @vitest/utils	4.1.10	—
➖ vitest	4.1.10	—
➖ @vitest/expect	4.1.10	—
➖ @vitest/mocker	4.1.10	—
➖ @vitest/pretty-format	4.1.10	—
➖ @vitest/runner	4.1.10	—
➖ @vitest/snapshot	4.1.10	—
➖ @vitest/spy	4.1.10	—
➖ @vitest/utils	4.1.10	—
➖ vitest	4.1.10	—
➖ @vitest/expect	4.1.10	—
➖ @vitest/mocker	4.1.10	—
➖ @vitest/pretty-format	4.1.10	—
➖ @vitest/runner	4.1.10	—
➖ @vitest/snapshot	4.1.10	—
➖ @vitest/spy	4.1.10	—
➖ @vitest/utils	4.1.10	—
➖ vitest	4.1.10	—

scripts/whatsapp-bridge/package-lock.json

Package	Before	After
@emnapi/runtime	1.11.2	1.11.3
@img/sharp-darwin-arm64	0.35.3	0.35.4
@img/sharp-darwin-x64	0.35.3	0.35.4
@img/sharp-freebsd-wasm32	0.35.3	0.35.4
@img/sharp-libvips-darwin-arm64	1.3.2	1.3.3
@img/sharp-libvips-darwin-x64	1.3.2	1.3.3
@img/sharp-libvips-linux-arm	1.3.2	1.3.3
@img/sharp-libvips-linux-arm64	1.3.2	1.3.3
@img/sharp-libvips-linux-ppc64	1.3.2	1.3.3
@img/sharp-libvips-linux-riscv64	1.3.2	1.3.3
@img/sharp-libvips-linux-s390x	1.3.2	1.3.3
@img/sharp-libvips-linux-x64	1.3.2	1.3.3
@img/sharp-libvips-linuxmusl-arm64	1.3.2	1.3.3
@img/sharp-libvips-linuxmusl-x64	1.3.2	1.3.3
@img/sharp-linux-arm	0.35.3	0.35.4
@img/sharp-linux-arm64	0.35.3	0.35.4
@img/sharp-linux-ppc64	0.35.3	0.35.4
@img/sharp-linux-riscv64	0.35.3	0.35.4
@img/sharp-linux-s390x	0.35.3	0.35.4
@img/sharp-linux-x64	0.35.3	0.35.4
@img/sharp-linuxmusl-arm64	0.35.3	0.35.4
@img/sharp-linuxmusl-x64	0.35.3	0.35.4
@img/sharp-wasm32	0.35.3	0.35.4
@img/sharp-webcontainers-wasm32	0.35.3	0.35.4
@img/sharp-win32-arm64	0.35.3	0.35.4
@img/sharp-win32-ia32	0.35.3	0.35.4
@img/sharp-win32-x64	0.35.3	0.35.4
qs	6.15.3	6.16.0
sharp	0.35.3	0.35.4

website/package-lock.json

Package	Before	After
baseline-browser-mapping	2.10.43	2.11.20
browserslist	4.28.6	4.28.8
caniuse-lite	1.0.30001806	1.0.30001810
colord	2.9.3	2.9.4
electron-to-chromium	1.5.392	1.5.418
fast-uri	3.1.5	3.1.6
joi	17.13.4	17.13.6
js-yaml	4.3.1	4.3.2
node-releases	2.0.51	2.0.54
qs	6.15.3	6.16.0
svgo	3.3.4	3.3.5
update-browserslist-db	1.2.3	1.3.2
➕ nanoid	—	3.3.18
➖ nanoid (nested under postcss)	3.3.17	—

How to fix:

Add the ci-reviewed label after verifying the version changes are expected.

---

debug info

CI timings

CI timings · View report · View job

Wall time 6m8s vs 9m31s (-35.6%). 17 job(s) slower, 22 faster, 1 unchanged.

• Python tests / Run tests slice 1/12: -91.0s
• Python tests / Run tests slice 5/12: +58.0s
• Python tests / Run tests slice 3/12: +46.0s
• Python tests / Run tests slice 4/12: +45.0s
• Python tests / Run tests slice 11/12: -42.0s

[RecursiveIntell]

W33 source checkpoint — 04ae01c706a9f71ca241f56066d591d122b54e8b

Adds a SessionDB-owned run-checkpoint persistence mixin using the existing state_meta transaction owner. It stores versioned records and a separately digested head; cooperating callers are fenced by expected generation, owner token, controller process identity and lease expiry. Checkpoint publication refuses omission or substitution of existing plan, contract, source, obligation and member bindings. The separately digested head detects member-only tampering during readback. Checkpoint/digest consistency validation returns metadata only: it does not observe external source/effect state or authorize continuation.

Changed paths: hermes_state.py, hermes_state_runs.py, pyproject.toml, tests/test_run_checkpoint_owner.py.

Local execution evidence

• Canonical scripts/run_tests.sh: 27 run-owner tests + 7 CAS tests passed.
• Affected four-file selection: 304 passed, 1 failed. The remaining TestFTS5Search.test_search_projection_skips_context_enrichment_queries assertion also failed on unchanged comparison base 370e3621bd90249e4492b4bac1d3e0046b828ae3. This supports a shared-failure classification, not an all-green or root-cause claim.
• Two review-discovered substitution bugs were reproduced as failing regressions before correction. Both now pass, as does an append-only member positive control and the existing real-process/crash coverage.
• Focused ruff/ty and diff checks passed. The complete four-path committed content matches the affected-test snapshot.

These are controller-executed local results; independent review inspected source and claim boundaries, not a full-suite reproduction. Prior failures and diagnostic attempts remain preserved. No hosted result from the previous commit is transferred to this head.

This draft is not W00/W33 completion, custody certification, package-install proof, activation, release readiness, or merge qualification. The existing coordinator still needs independently observed goal/source/effect bindings and fresh native readback before controlled adoption. Source transitions, obligation settlement, compaction/resume consumer qualification and integrated release gates remain open. The old cancelled goal and original dirty candidates remain outside this source slice.

[RecursiveIntell]

W33 source checkpoint — a4e527838f2ada2aace0dea2682446140e769793

Adds an explicit SessionDB source-transition API that records caller-supplied old/new source digests plus an observation reference/digest in a new immutable generation. It reconstructs the checkpoint while retaining all other fields and appending a transition member. Existing publication and resume paths continue to require source-digest equality. This is not independent verification of source or observation bytes or effect authorization.

This commit changes only hermes_state_runs.py and tests/test_run_checkpoint_owner.py, building on the earlier CAS and checkpoint-owner slices in this PR. No unrelated stabilization WIP was included.

Executed local validation

• Fresh canonical focused run: 44 checkpoint-owner + 7 CAS tests passed.
• Preserved affected four-file run: 321 passed, 1 failed. The FTS context-query trace assertion also failed on unchanged comparison base 370e3621bd90249e4492b4bac1d3e0046b828ae3. This supports a shared-failure classification, not a root-cause finding or an all-green result.
• Focused Ruff and diff checks passed. All five paths changed by this PR match the affected-run source manifest and committed blobs.
• Real local independent publisher contenders, transactional rollback and immutable-history readback are covered. Initial failures and diagnostic attempts remain preserved privately.

These are controller-executed local results; independent review inspected source and claim boundaries rather than reproducing the complete suite. Previous-head hosted checks are not transferred to this commit. W15 security/dependency qualification remains open; previous-head CI dependency warnings are not clearance.

The PR description is updated to describe all three source slices rather than only the original duplicate-key repair. This remains draft: no W00/W33 completion, live custody, merge qualification, activation, or release certification. The next gate is integrated coordinator source/goal/effect observation and native adoption/readback, followed by the required compaction/resume qualification. The historical cancelled goal, original run state and original dirty candidates remain preserved.

[RecursiveIntell]

W33 source checkpoint — 26f13db52876b541215a6f717164cf6019d8d397

W33 progress: adds a read-only native resume-consistency observer in scripts/run_checkpoint_resume.py, with tests in tests/test_run_checkpoint_resume.py.

It compares the complete supplied checkpoint with separately read SessionDB state, verifies explicitly bound plan/contract/source/member bytes, observes session/lease and historical-goal bindings, and rechecks the native generation. It reports resume_authorized: false and effects_executed: false. It does not acquire custody, execute or retry effects, or provide an atomic filesystem/database snapshot.

Controller validation used the canonical scripts/run_tests.sh runner with a disposable home and no file retries. The supplied controller receipt recorded 369 passed, 1 failed across six selected test files, including 29 passing consumer tests. Execution used the pre-commit tree at a4e527838f2ada2aace0dea2682446140e769793 with the two consumer files present but untracked; it was not rerun at the later commit. The complete cumulative path set, bytes and modes were subsequently checked against the tested manifest and committed content at 26f13db52876b541215a6f717164cf6019d8d397. The retained failure is tests/test_hermes_state.py::TestFTS5Search::test_search_projection_skips_context_enrichment_queries, previously also reproduced on the unchanged comparison base. That classification is not a root-cause finding or an all-green result. Focused Ruff and diff checks passed.

Earlier diagnostic failures are preserved in the evidence archive: the missing consumer entrypoint, then two regression failures showing that a closed session was still accepted. The closed-session cases now pass; an ended or compression-closed session is refused rather than silently adopted. Client-process restart tests read the same persisted checkpoint without changing native metadata; they are not execution of the actual context-compaction engine.

Publication of this bounded slice does not close W00/W33. Controlled native adoption, write-admission/caller integration, actual compaction/resume qualification, the retained FTS failure, and broader security/integration/merge gates remain open. No merge, activation, live database adoption, or memory repair was performed. The PR remains draft.

The cumulative seven-path manifest matches the committed content and modes; this commit itself contains only the two consumer paths. These are controller-executed local results, not an independent full-suite reproduction. Previous-head hosted checks are not transferred to this commit. W15 dependency/security qualification remains open.

[RecursiveIntell]

W33 checked claim — source-only progress

Commit 1c235abb3365be46207eb1077a753db2533097cf, parent 26f13db52876b541215a6f717164cf6019d8d397; cumulative base 370e3621bd90249e4492b4bac1d3e0046b828ae3.

Adds a separate SessionDB.claim_run_custody_checked() entrypoint. During the same native SQLite write transaction that publishes the run generation/head, it rechecks current-session liveness, the lineage-resolved turn lease holder and finite future expiry, and the checkpoint-bound historical-goal bytes against the supplied digest. Invalid holder values are rejected without fallback. The existing claim_run_custody() API remains a low-level custody-metadata primitive.

This checked entrypoint does not prove source-file integrity or goal semantics, authorize downstream effects, or qualify later publish/refresh/transition mutations. It is not integrated private-client adoption or actual context-compaction qualification.

Controller validation at the committed HEAD executed the canonical four-file focused selection: 104 passed, 0 failed, including 24 new admission tests. Separate-process barriers exercise session/lease/goal drift, matched success, rollback without partial generation, and preserved takeover/ABA fences. These are disposable local SessionDB fixtures, not a live adoption test.

The pre-commit seven-file affected selection reported 393 passed, 1 failed. Its full cumulative eight-path set, bytes and modes were verified against the committed content. The retained failure is tests/test_hermes_state.py::TestFTS5Search::test_search_projection_skips_context_enrichment_queries, the receipt records the failure, and prior review reported reproduction on the unchanged comparison base. It was not independently rerun in this review. This is not an all-green result or a root-cause finding. The initial RED recorded 24 missing-entrypoint failures. Focused Ruff and ty passed; execution receipts and source correspondence were checked. Reviewers inspected source and wording, not independently rerun the complete suite.

Only hermes_state_runs.py and tests/test_run_checkpoint_claim_admission.py changed in this commit. The previous four source slices retain their history and scope. No live database, goal, service, runtime or preserved WIP change, no merge or activation. PR remains draft. W00/W33, private client integration, native adoption/readback, compaction/restart, security and final integration gates remain open. Previous-head hosted checks do not certify this head.

[RecursiveIntell]

W33 private file-bound checked-claim client — source-only progress

Commit dfc3459d609ca89e0ad1f26298d8885c3fbd4b9b, parent 1c235abb3365be46207eb1077a753db2533097cf; cumulative base 370e3621bd90249e4492b4bac1d3e0046b828ae3.

Adds scripts/run_checkpoint_claim.py::claim_from_files, extracts shared file-verification helpers in scripts/run_checkpoint_resume.py, and adds tests/test_run_checkpoint_claim_client.py. The client requires an already-open writable SessionDB. It checks caller-pinned request and checkpoint file bindings in bounded, non-atomic reads, invokes the existing native checked-claim transaction, compares native readback, and distinguishes typed refusal from unknown write/readback outcomes without automatic retry. The observer remains read-only in the tested fixtures.

Caller-selected initial inventories and expected digests bind observations; they do not authenticate authority or completeness. This does not establish an atomic filesystem/database snapshot, hostile same-UID process resistance, downstream effect authority, or qualification of later refresh/publish/transition mutations.

Controller validation at the committed HEAD executed the canonical five-file focused selection: 127 passed, 0 failed, including 23 client cases. The earlier pre-commit eight-file affected selection reported 416 passed, 1 failed. Its complete cumulative ten-path set, bytes and modes were verified against the committed content, and every changed test was included. The retained failure is tests/test_hermes_state.py::TestFTS5Search::test_search_projection_skips_context_enrichment_queries. Prior comparison evidence classified it as shared-base; that baseline was not rerun for this slice. This is not an all-green affected result or a root-cause conclusion. Initial RED: 23 missing-client failures. Reviewers inspected source/evidence; the test executions are controller-run, not independent reproduction.

Only the three named paths changed in this commit. Prior checkpoint/CAS/transition/observer/admission slices retain their history. No live store, goal, service, runtime activation, memory repair or merge occurred in this slice. PR remains draft. W00/W33, real coordinator adoption and native readback, compaction/restart, security and final integrated qualification remain open. Earlier-head hosted checks do not certify this new head.

[RecursiveIntell]

W33 existing-session claim dispatcher — source progress only

Commit 15ae1ebabd8128e005a7630898d6d2ff84cd25d5.

Adds an explicit pooled session.run_checkpoint.claim RPC that borrows the selected live agent's writable SessionDB, binds the file-backed checkpoint request to the agent's session and active lease, and returns a sanitized native claim result. This operation is claim-only: it does not authorize resume or execute downstream effects. Native transaction rechecks remain the admission boundary; bounded file reads are observations, not an atomic source snapshot or proof of initial inventory completeness.

This slice changes only tui_gateway/methods_session.py, tui_gateway/server.py, scripts/run_checkpoint_claim.py, and tests/tui_gateway/test_run_checkpoint_claim_rpc.py. Parent: dfc3459d609ca89e0ad1f26298d8885c3fbd4b9b; cumulative base: 370e3621bd90249e4492b4bac1d3e0046b828ae3. Earlier checkpoint/CAS/source-transition/observer/admission/client work is preserved in the PR history.

Controller-executed canonical affected selection: 1,051 passed, 1 failed across nine files, including 55 passing direct-dispatch cases. The complete cumulative 13-path source denominator and file hashes match the final affected-run manifest; every changed test was selected. Focused Ruff and diff checks passed. The retained failure is tests/test_hermes_state.py::TestFTS5Search::test_search_projection_skips_context_enrichment_queries (0 != 1). Earlier comparison evidence classified this as shared-base; the comparison base was not rerun for this dispatcher slice. The affected selection is not all-green and this is not a root-cause conclusion. Initial RED evidence is retained: first-run teardown fixture errors, followed by corrected RED with 50 missing-method failures and one pass.

Tests exercise the actual registry, pooled dispatcher and disposable native SQLite store, including selected-session/store rejection, exactly one concurrent claimant, transaction-time identity/lease/goal changes, no automatic retry after uncertain outcomes, and native readback. Added review-requested selected-agent/native-binding interposition tests pass. These are not socket/login authentication E2E, an actual model turn, live adoption, or compaction qualification.

The selected public and cognitive-scientist reviewers inspected the narrow source/claim boundary; local affected counts above are controller-run results, not a claim of independent reproduction. Earlier-head hosted checks do not certify this candidate. PR remains draft. No merge, runtime activation, live custody adoption, historical-goal mutation or memory repair is included. W00/W33, live transport/model/compaction integration, security/dependency and final packet gates remain open.

[RecursiveIntell]

FTS observer-only repair

Commit 20d46004d69e3252e4353f88116dd7683c6d9dab.

Corrects test instrumentation only and retains assertions for zero/one/two cumulative context-query counts, pooled and writer-fallback paths, a positive-control detector, and callback cleanup. Only tests/test_hermes_state.py changed in this slice.

The 2026-09-16 local canonical validation record reports: RED reproduced (one failure); focused GREEN (two passed); complete nine-file affected selection (1,053 passed, zero failed). The full 14-path cumulative PR source manifest was checked against committed bytes. Historical failed runs remain retained; they are not rewritten as passes.

This is not an all-suite, security, release, custody, or live-adoption claim. Current-head hosted checks and bootstrap merge/activation qualification remain separate gates. The PR remains draft.

[RecursiveIntell]

W33 checkpoint bootstrap — source checkpoint, not merge-ready

Dependency checkpoint: 757d59b567a4a063ded713f309b69c5c267f2dc4, parent 33d65e6a12a42fce5735ed2bb82654b7ef2120f8; cumulative base 370e3621bd90249e4492b4bac1d3e0046b828ae3.

Source scope

The PR preserves the SessionDB-owned checkpoint/CAS, explicit source-transition recording, read-only resume observer, checked claim admission, file-bound client, and pooled session.run_checkpoint.claim dispatcher. The dispatcher borrows the selected live agent's existing writable store and lease; claiming does not authorize resume or execute downstream effects. Caller-supplied digests and file observations are not an atomic source snapshot or proof of initial inventory completeness.

Subsequent test-only commits repair the FTS trace observer to follow the borrowed SQLite connection and respect the safety-selected journal mode. Earlier failed runs remain historical failures; they were not rewritten.

This dependency slice changes only 13 dependency paths (manifests, lockfiles and the matching lazy-install pin). It reuses scoped work from #53 commits 208cf07f1d9af6d250264d4ce758d7d687f3c7d1, 778a62e37bd76c6b93dd3ced20a14b8a621fc697, and 811522d205633e565e368e0242068c019555f391, then applies the narrower current-advisory updates including Electron 41.10.3, Vitest 4.1.11 and brace-expansion 1.1.18. It does not import #53 application changes.

Local validation record

• Canonical Python affected selection: 1,166 passed, 2 skipped across 74 files, including checkpoint, dispatcher, SQLite, packaging, lazy dependency and MCP coverage. Python inputs remain matched; three Node paths changed during that run, so it is not a fully frozen cross-language run.
• Root JS: 38 passed; TUI: 1,714 passed; web: 278 passed.
• Desktop Electron-project tests: 1,970 passed, 6 skipped. Desktop UI: 6,109 passed across the three disjoint repository shards.
• Exact-lock npm installs, TUI/Ink and Desktop builds, TUI/Desktop/web typechecks, WhatsApp syntax and uv lock --check passed in the supplied local records.
• Bounded npm audits for root, website and WhatsApp plus OSV scans of four named lockfiles reported zero advisories for the scanned snapshot. This is not an exploitability conclusion or security guarantee.

Local tests used isolated homes; the serial retry used one Vitest worker, a 3 GiB memory cap and a 512 MiB swap cap. Earlier interrupted runs, timeouts, missing build/socket prerequisites and the failed website build remain retained. Website qualification with its generation prerequisites is still pending at this checkpoint. No live external messaging was exercised.

These are controller-executed results, not independent reproduction or full product qualification. The previous head's hosted CI does not certify this new dependency head. Fresh hosted CI, current security/review disposition, protected merge, managed activation, live native custody and actual compaction/restart witnesses remain required. The PR remains draft; no merge, activation, historical-goal mutation, memory repair or W00/W33 completion is claimed.

[RecursiveIntell]

Source checkpoint 422658c13e46b5e55651d9b33bc2b30ccdf2bcb6, parent 757d59b567a4a063ded713f309b69c5c267f2dc4.

Addresses the Codex-reported import-boundary findings on the disposable enforcement PR #55 (wheel omission, psutil import); they also applied to this candidate.

• Adds the two checkpoint helper modules to setuptools' explicit py-modules allowlist; it does not package the scripts directory wholesale.
• Makes psutil optional for ordinary state-store imports. The tested process/custody boundaries raise RunCustodyError with code PROCESS_INSPECTION_UNAVAILABLE when that dependency is absent; no process-identity fallback is supplied.
• Local seven-file canonical gate: 187 passed, 0 failed, including five wheel/import-boundary regressions. Tests build a wheel and import its extracted helpers without running editable-install .pth files. The corrected RED run reproduced all five failures before the repair.
• Focused Ruff, diff checks and uv lock --check --offline passed. Tested source bytes match this commit. Earlier failed probes remain retained.

Current-head CI and real transport requalification still follow. The old head's passing CI/smoke evidence is not promoted to this changed head. No main merge, activation, live run custody, security clearance, or W00/W33/packet completion is claimed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T01:37:56.038160Z	422658c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 422658c13e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[RecursiveIntell]

Source checkpoint 5430100655b69b883b406bc7ceb8747ecf1048d7, parent 422658c13e46b5e55651d9b33bc2b30ccdf2bcb6.

Adds the explicit SessionDBRunCustodyRefreshV1 storage envelope. Its checkpoint reference points to an earlier full V1 checkpoint; the predecessor digest may identify a compact record and intentionally retains the immutable history chain. Refreshes use the existing native head CAS and transaction owner—no second mutable lease authority or expiry-only takeover.

Local validation on matching source:

• 1,113 passed, 0 failed across 13 canonical test files, including 12 compact-storage cases, installed-wheel owner/RPC imports, integrity refusal, transaction rollback, reopen, and concurrent fencing.
• Twelve unchanged 200,000-character fixture refreshes added 2,411,933 logical UTF-8 state_meta value bytes before versus 8,657 after. This is not physical database growth, disk savings, or a workload-performance benchmark. Metadata history still grows per refresh; the API's 10,000-generation read bound remains.
• The executed decoder probe from parent 422658c read full V1 records and rejected the new compact format with INTEGRITY_SCHEMA. This is an explicit version boundary, not a general backward-compatibility claim. Existing V1 row bytes are retained.
• Replaced the packaging-list snapshot with actual built-wheel owner import/path checks. Focused Ruff and diff checks passed. Earlier failed runs, including the corrected reopen-observer fixture, remain retained.

This addresses the refresh duplication and packaging-test findings at source level.

Still blocked: the real Electron test at the parent snapshot reproduced custody remaining active after Stop and ACTIVE_AGENT_REQUIRED with turn isolation enabled. Gateway-owned release/refresh lifecycle and isolated compute-host routing are not repaired by this slice. Fresh current-head hosted qualification also remains separate. No main merge, runtime activation, live run custody adoption, or W00/W33/packet completion is claimed.

[RecursiveIntell]

Source checkpoint e5d365606c84c6d5d8254ec3198b1059d54c3fea, parent 5430100655b69b883b406bc7ceb8747ecf1048d7.

Adds private turn-bound checkpoint handles with authenticated claim, refresh, and release operations. Tokens remain in the executing agent; isolated turns use the existing compute-host control path rather than a gateway-local/prewarmed owner. Refresh is caller-explicit before TTL expiry—no new renewal timer, scheduler, or database.

The owning turn's finally releases checkpoint custody before its native session-turn lease. Gateway finalization/teardown now requests cancellation and defers closure while that turn is live; pending intent is consumed after the turn settles. The child interrupt path also uses the shared Stop routine to wake child-owned clarification waits. Cancellation-like post-commit exceptions are classified unknown and require reconciliation, not automatic replay.

Verified local evidence on source bytes matching this commit:

• 1,173 passed, 0 failed across 19 canonical test files. This includes actual AIAgent/native-DB success/error/finalize ordering, held-turn finalization, expired release, concurrent claim/finish, and injected OSError/KeyboardInterrupt acknowledgement-loss cases.
• Both real Electron topologies passed with zero retries: claim → refresh → Stop → automatic release → next-turn reclaim in the same controller process → explicit release. Transport and native readback were real; inference was a loopback scripted test provider, not an external model.
• Focused Ruff and diff checks passed. The complete 36-path cumulative source manifest matches the tested bytes; this commit changes 12 paths.

The retained earlier failures include the reproduced missing owner/routing/Stop behavior, the premature-finalization race, cancellation classification, and test-fixture corrections. These are not erased by the later passing runs.

This addresses the reported gateway-owned release and isolated-routing findings at source/local qualification level. Fresh hosted checks, current review disposition, main merge, managed activation, live custody adoption, and full W00/W33/packet qualification remain separate. No universal cancellation or production-readiness guarantee is made.