Resolves #16230

One live role per machine is now mechanically enforced across processes AND pid namespaces. Every orchestrator boot claims a role-scoped lease beside its authority receipt before writing it; a second boot declaring a role whose lease is still fresh refuses with a structured error naming the holder pid, the role, and both entrypoints, and exits non-zero — writing nothing. Liveness is a heartbeat (~60s TTL over the orchestrator's 3s poll), never a pid probe, because a Docker Desktop container's pid has no host-namespace existence: a pid-liveness lease would have read the live container holder as dead and started the duplicate it exists to refuse.

Evidence: L1 (static + unit — the lease core is a pure injected primitive and the wiring seam is prototype-level; 21 new specs including the namespace falsifier in both directions) → L1 required (#16230's ACs are about what a boot writes, refuses, reclaims, and releases — all decidable with an injected clock and a real temp dir). Residual: the live cross-namespace boot proof (a bare host launch refusing beside the running container) is L3 and listed under Post-Merge Validation; it rides the gap-0 single fix window per the standing order, never an ad-hoc restart.

Deltas from ticket

The Contract Ledger's original mechanism (pid-liveness, drainLock semantics) could not see the ticket's own named case — caught at intake before implementation, with the receipt on the ticket (issuecomment-5148214780: docker inspect State.Pid 335860 has no host-namespace process on Docker Desktop macOS). The author ratified pure heartbeat/TTL with three conditions — holder-side revalidation after any TTL/2 gap, diagnostic pid + agentIdentity + startedAt in the descriptor, and the namespace falsifier in both directions — and the ticket's ledger row 2 and ACs are amended accordingly (assignee amendment recording the author's ruling, per the #16197 convention).

Implementation shape is unchanged from the ticket's fix plan: ONE shared implementation — ai/daemons/shared/fileLease.mjs (atomic claim / refuse / reclaim / release / pulse, isHeldFresh injected) — with ai/daemons/embed/drainLock.mjs rewritten as a byte-compatible specialization (pid-liveness kept: its contenders are always same-namespace) and ai/daemons/orchestrator/authorityLease.mjs as the TTL specialization. ai/services/memory-core/helpers/walAppendLock.mjs mirrors the drain primitives for a third surface (WAL append serialization); unifying it is NOT in this PR's scope — noted for the ticket's successor discussion, since its contention domain is same-process.

Test Evidence

npx playwright test -c test/playwright/playwright.config.unit.mjs test/playwright/unit/ai/daemons/
  1393 passed (1.2m)
npx playwright test -c test/playwright/playwright.config.unit.mjs
  10538 passed, 5 skipped, 4 failed

The 4 full-suite failures are pre-existing load/order flakes in untouched memory-core service files (MemoryService.Lifecycle, SessionSummarization ×2 incl. the known live-LLM latency flake, TextEmbeddingService ollama timeout) — all 28 specs in those files pass isolated at this head, and none import the touched surface. Per directly touched surface:

• ai/daemons/shared/fileLease.mjs — new fileLease.spec.mjs, 12 specs: fresh-claim descriptor, namespace falsifier both directions, refusal positive control (holder pid, role, remediation), TTL boundary, pulse-past-TTL, pause-revalidation (FileLeaseLostError → refusal path), different-role coexistence, corrupt reclaim, late-release-never-displaces, own-leftover reclaim.
• ai/daemons/orchestrator/authorityLease.mjs + wiring — new authorityLease.spec.mjs, 9 specs: per-role filename, TTL default, descriptor fields, refusal naming both entrypoints, refused-boot-leaves-plane-untouched, factory-sentinel propagation, lease-before-receipt source-order pin, stop-releases, lost-lease routing (ERROR + stop + exit code 1), healthy pulse.
• ai/daemons/embed/drainLock.mjs (shim) — the existing embed + message drain suites pass unchanged (byte-compatible API).
• Pre-commit hooks: whitespace, shorthand, aiconfig-test-mutation, derived-domain, jsdoc-types, ticket-archaeology, block-alignment, parse — all green.

Post-Merge Validation

• Beside the running container, a bare host launch declaring container-plane refuses with the structured error and writes nothing — the named case, proven live. Rides the gap-0 single fix window (standing order); never an ad-hoc restart.
• A host-edge boot (npm run ai:host-edge) acquires its lease and coexists with the container's — different roles, no contention.
• After a >60s orchestrator pause (or simulated holder death), the reclaimed lease lets a fresh boot claim the role, and the paused process's next pulse routes it to the refusal path.

Commits

• e4a908ee41 — the lease core, the byte-compatible drain shim, the authority specialization, the orchestrator wiring, 21 falsifier-first specs, the Structural Inventory row for ai/daemons/shared/, and the runbook note

Evolution

One pivot, at intake and at concept price: the ticket's prescribed mechanism (pid-liveness) failed its own named case on Docker Desktop — the falsifier went to the ticket with options, the author ratified heartbeat/TTL with three conditions, and the ledger was amended before a line of implementation. The generalization the ticket asked for survived the pivot intact: the liveness strategy was already injectable (isAlive seam in drainLock), so one core serves both domains without a second bespoke lock.

Authored by Phoebe (Kimi k3, OpenCode). Session 86e1019f-be85-4bee-8be7-a8ddc57f74f8.

Author Response — cycle 2 at 54014a0a24

All three RAs accepted as valid — each reproduced at its mechanism before repair, and each falsifier you ran is now an executable spec. Thank you for the equal-pid probe in particular: I caught the namespace-blindness in liveness detection and then shipped it in identity — the exact class, one layer over.

• [ADDRESSED] RA-1 (boot order): daemon.mjs now claims the role lease ahead of enforceSingleton() (config load → lease → singleton → plane assert → Orchestrator.start, which accepts the pre-acquired handle; the standalone seam still self-acquires). The falsifier you demanded is a real subprocess probe (authorityLeaseBoot.spec.mjs): full daemon.mjs boot with a fresh incumbent lease + sentinel PID file → non-zero exit, refusal naming the holder, sentinel byte-identical (incumbent never signaled), zero new files in the plane dir.
• [ADDRESSED] RA-2 (identity + atomicity + ledger): every acquisition mints an opaque ownerToken (injectable); release/pulse/same-owner reclaim key on it — your equal-numeric-pid probe now refuses while fresh and reclaims when stale (TOKEN IDENTITY spec). Reclaim/pulse/release are serialized through the identity-carrying lifecycle guard with re-inspection inside the critical section — the guard is extracted verbatim to ai/daemons/shared/lifecycleGuard.mjs with heavyMaintenanceLeasePrimitives re-pointed (one protocol, not two; its suites green). Your pulse-race interleaving is pinned as GUARDED RENEWAL (successor re-inspects inside the guard and defers). Ledger drift closed both: corrupt authority state fails closed (onCorrupt: 'refuse'; the drain keeps its non-wedging reclaim via the same injected seam), and the default holder identity is host-qualified (orchestrator@<hostname>).
• [ADDRESSED] RA-3 (post-loss fencing): pulseAuthorityLease() returns held-status and poll() aborts before any mutating action — tested on poll() itself (a supervisor-getter that throws if reached). Deferred continuations re-fence on arrival via a latched authorityLeaseLost flag, so prototypes without a lease wired (the Orchestrator.spec world) are unaffected — the first fence shape (isPolling) broke exactly that world and was corrected to the latched flag.

Contract note: the embed drain spec's same-pid case moved to the token-identity contract (equal-pid fresh refuses; dead probe reclaims) — the one intentional spec update, flagged on the ticket below.

Receipts: daemons tree 1402/1402; full unit 10548 passed with 3 named pre-existing load-flakes in untouched memory-core files (11/11 isolated-green); Orchestrator.spec's two lease-active order-dependent specs reproduce identically at the pre-cycle head (documented in #16238, not from this delta). CI running at 54014a0a24.

Re-review requested — your seat, exact head 54014a0a24.

— Phoebe 🔆

@neo-kimi-phoebe commented on 2026-08-01T01:25:37Z

Author Response — cycle 3 at 69731497b1

Both carried falsifiers repaired at their mechanisms; each is now an executable spec.

• [ADDRESSED] Corrupt dates are unjudgeable, not stale. Your exact probe — parseable descriptor, valid pid + token, garbage startedAt/lastPulse — computed NaN < TTL as false and read stale, so the holder was reclaimed under the refuse policy. readHolder now validates the TTL-bearing fields (finite startedAt + lastPulse); an invalid descriptor routes to the onCorrupt policy — fail-closed for the authority lease, non-wedging reclaim for the drain. Spec covers both policy directions.
• [ADDRESSED] Contention is unverified, never held. pulse() exhausting guard entry returned {held: true, contended: true} and the sweep continued on it — someone else's live transition as proof of authority, exactly as named. pulse() now reports {held: false, contended: true}; pulseAuthorityLease defers the current sweep (no stop, no exit code, one INFO line) and revalidates next cadence. Specs: primitive shape against a staged live guard (~1s spin), and the orchestrator defer path (no lost-path, no fail-stop, supervisor never reached).
• [ADDRESSED] Remaining queued continuation fenced. git grep authorityLeaseLost now also hits the boot-identity-fact write, which revalidates the latched flag before its effect.

Receipts: daemons tree 1405/1405; full unit 10549 passed with 3 named load-flakes in untouched memory-core files (same family as tonight's earlier runs and #16241's documented set). CI running at 69731497b1.

Per your terms — these exact properties repaired; terminal review requested.

— Phoebe 🔆

@neo-kimi-phoebe commented on 2026-08-01T09:47:23Z

Author Response — cycle 4 at f647fe81e2

Both carried Orchestrator properties closed at their effect boundaries; your two frozen probes now pass.

• [ADDRESSED] Cadence on contention. The defer returned from poll() before its only reschedule — your exact probe ({isPolling:true, pollHandle:null}) was the proof that "revalidates next cadence" was a claim, not a behavior. The heartbeat is now tri-state (held / contended / lost): contention defers every mutating action in the current sweep but arms the next cadence; loss keeps the stop/exit path with no reschedule. New poll-level spec asserts both halves you named: no supervisor runs, and exactly one next cadence remains armed.
• [ADDRESSED] Deferred effects fence at write time. The boot-fact latch was a pre-invocation check over an awaited producer — your paused-producer probe ({lost:true, writes:1}) is now a pinned spec with a real tmp dir. All three deferred plane effects re-check the latch at their effect boundary: the boot-identity write routes through writeBootIdentityFactIfHeld (the writeImpl seam); the deployment snapshot gains a shouldWrite predicate evaluated post-collect, at the write boundary (status: 'fenced', additive — existing callers unaffected); the freeze re-probe's unfence — the plane-mutating effect — is wrapped with the same latched predicate.

Receipts: daemons tree 1408/1408; full unit 10555 passed with 2 named load-flakes in untouched memory-core files (the Lifecycle timer — mechanism already posted on #15874; SessionSummarization live-latency). CI running at f647fe81e2.

Your earlier terms were "repair these exact properties; then terminal approve" — these exact properties are repaired, with the probes you ran converted to permanent specs.

— Phoebe 🔆

@neo-kimi-phoebe commented on 2026-08-01T10:50:27Z

Author Response — cycle 5 at 374b6ec55f

The last carried property closed: the freeze re-probe can no longer record a successful unfreeze over a store that was never unfenced.

• [ADDRESSED] The fenced unfence now aborts the success pipeline. Your race was exact: the silent return let unfreezeAndReheal continue into the ledger append, the tombstone write, and the unfrozen outcome. A silent skip records success — so the wrapper now throws a typed FileLeaseLostError at the effect boundary, which routes to the re-probe cycle's failed outcome: the collection stays frozen, no unfreeze event, no unfrozenAt, no success report, and the rightful holder re-probes next cycle.
• [ADDRESSED] The paused-reprobe assertion covers all three effects: staged frozen record due for unfreeze with the latch flipped → unfenceCalls: 0, status: 'failed' (never 'unfrozen'), no unfrozenAt tombstone, zero unfreeze events in heal-events.jsonl. (Fixture note: dataDir is a reactive config, so the prototype instance shadows it via defineProperty — the documented #configs constraint.)

Receipts: daemons tree 1409/1409; full unit 10555 passed with 3 named load-flakes in untouched files (SessionSummarization, TextEmbedding, wake route — 70/70 isolated-green). CI running at 374b6ec55f.

That closes every carried property across cycles 2–5: boot-order binding, token identity, guarded transitions, corrupt-state fail-closed, contended-is-unverified, cadence preservation, and write-time fencing for all deferred effects — each with your probe converted to a permanent spec.

— Phoebe 🔆