[antoinetoussaint-byte]

Behavior and ownership

Release v0.19.9 includes bounded, explicit recovery of an orphan process generation, operator-selected exact-ID container stop with retention checks, and the merged exact-reference local Docker image lookup fix (#861). Ordinary workspace-scoped stop and stale reaping retain their current behavior.

Core owns PreviewProcessGroupRecovery, strict expectation parsing, registry authentication, original-owner absence and expected boot/birth checks, kernel-bound delivery and conditional same-record removal. CLI owns operator selection, authorization and reporting. A changed record, duplicate namespace, live owner or missing proof refuses; replacement registrations are preserved. Success requires nil error plus GroupDead and RecordRemoved. Receipts have a consistent1MiB inclusive bound, reserving the default JSON Encoder newline; the registry cap remains16KiB.

Classification: owner fix in Core runners; no compatibility bypass or legacy boot rewrite. docs/session-ledger.md documents admission, serialization, signal/removal semantics and limits. Recovery Go source is byte-identical to reviewed a189a4a (ad874 implementation plus receipt-size correction), integrated onto current main without discarding #833/#840/#841/#855 or #861.

Exact-ID container stop

Classification: owner fix in Core dockerrun; CLI owns operator authorization and selection. PreviewContainerStop, ParseContainerStopExpectation and StopContainer use full immutable Docker IDs and fresh comparison of Created, actual/logical name, every label and complete canonical native mount values. Missing HostConfig and AutoRemove refuse before stop. There is no name lookup, ledger claim, relabel, removal or fallback. Nil success requires Stopped, Retained and MountsUnchanged; an error may follow an effect and is never reported as proof of no effect. Same-name replacements are preserved.

The single owner parser rejects unknown/duplicate/null/trailing fields and case aliases, including nested MountPoint aliases; arbitrary label keys remain case-sensitive. Producer/parser/execution share a 64 KiB bound including the default Encoder newline and explicit empty mounts. docs/container-stop.md documents operation, limits, and the explicit local Docker-native JSON receipt exception to the protobuf default; docs/architecture.md links that owner decision. The shape is fixed, has no migration/fallback, and requires fresh preview after implementation changes; it does not claim version detection or cross-release receipt compatibility. Future shape/meaning changes require a separately versioned contract under the protobuf default unless a new exception is reviewed. docs/session-ledger.md links this operation without claiming ledger adoption.

CI failure correction

The previous PR863 Build failure occurred in Linux race TestAuthenticateOwnedProcessGroupLeaderlessDecision/apple_platform_binary_descendant. The fixture could observe sleep's executable before its inherited credential was observable. A real Linux diagnostic reproduced a credential mismatch followed20ms later by the correct credential for the same PID. It did not capture the raw environ bytes. The test now waits for that positive fixture precondition on Linux before the existing authentication assertion. Failure to establish readiness fails instead of skipping. Production authentication is unchanged; credential-stripping negative coverage remains.

Release and compatibility

version/info.codefly.yaml advances0.19.8 to0.19.9. The existing version-tag workflow publishes only from the merged main commit after the Core suite passes. No manual tag or release is created. agents/contract/contract.json is unchanged: protocol1/startup2, same capabilities and operation contracts. CLI recovery consumer adoption follows publication and must qualify against the stable module without a workspace replacement.

This keeps the existing PR863 carrier a94f3d9 as an ancestor and merges current main e2d65b5 before adding recovery. No rebase or force push is required. #860 remains held; #862 is not included. Full-workspace provider design is not part of this release.

Verification

• All-package compile passed on the integrated recovery source.
• Focused Darwin recovery/ownership race passed29.716s.
• Corrected Linux platform-descendant fixture passed500 consecutive runs; before correction the same real fixture reproduced the CI failure.
• make check-version-tag passes: declares0.19.9, latest publishedv0.19.8.
• go vet for runners/base, runners/dockerrun and resources passes.
• At preserved 6203, full affected packages pass: runners/base67.959s, runners/dockerrun182.703s, resources2.637s, internal/ciguard46.853s; SDK1.326s/dependencies68.258s/session0.007s.
• At preserved 6203, focused recovery/ownership race passes on Linux/arm6421.815s and Darwin/arm6429.121s.
• The first private-home SDK run failed the existing100-byte Unix-socket path guard because the macOS temporary HOME was too long. The unchanged SDK suite passes with a shorter private /tmp HOME; the failed log is retained. No source or gate was weakened.
• This is local affected-surface qualification, not a claim to have rerun all tagged infrastructure, full-module race, vulnerability, coverage or remote CI gates.

Source/provenance: /tmp/core863-recovery-frozen-manifest.json and /tmp/core863-recovery-main.patch. Independent review accepted the integrated recovery source at6203; the later container implementation and docs received combined Core/CLI review with no blocking findings. Refreshed exact-head remote CI remains required before merge/publication.

Container implementation c1376ad passes full dockerrun (202.377s), maintained real-Docker/transport race (11.128s), and vet. Real fixtures prove writable-layer/named-volume retention, changed evidence refusal, AutoRemove refusal, empty-mount Encoder roundtrip, same stopped-object retry, and sibling/unattributed/same-name-replacement survival. A source overlay removing the exact-schema check makes maintained alias tests fail, reproducing the original defect; the overlay never changed committed source.

Final 3f01e23 adds only the explicit contract exception documentation. All Go/module inputs are unchanged from tested c137. Evidence: /tmp/core863-container-stop-frozen-manifest.json and /tmp/core863-container-stop-contract-manifest.json; patches retained separately. No incident operation or producer migration/data claim follows from these isolated tests. Fresh combined Core/CLI architecture and code-elegance review is complete with no blocking findings; its receipt-contract finding was closed by3f01 documentation after source-byte equivalence verification. Remote release gates remain required. Incident stop and producer migration qualification are separate from these source results.