🤖 bug: a backend that runs a turn under another backend's attempt leaves the owner free to write a no-report receipt

[ThomasK33]

Summary

With two backends on one Xum root, backend B can run a turn under attempt A without rotating the attempt. A peer or manual send in B binds, unowned, to the row's current attempt ID. Backend A, which owns A, is locally idle meanwhile. A's process-local checks (attemptCannotStillReport: no obligation, no live turn or stream in this process) therefore pass. A Stop in A persists interrupted and writes a settlement receipt that says "no report", while B's stream can still publish one: publishAgentTaskReport accepts an interrupted row whose attempt ID still matches.

Two backends can share a root with XUM_ALLOW_MULTIPLE_INSTANCES=1, or when the desktop app and xum server share ~/.xum. Electron's single-instance lock does not cover the CLI server, so a backend cannot detect its peers.

Scope

This follows from the admission model on main: an unowned send binds to a foreign attempt without rotating it. #4308's staged contract already says two-backend ownership is not guaranteed. G2 PR A (#4540) makes the gap observable, because a receipt is a durable claim. PR A scopes its receipts to one backend per root and never lets a receipt override a report:

• A receipt is evidence that one backend settled the attempt. It is never proof that no report exists.
• G2 PR B's classifier reads the report artifact first. A receipt followed by a report counts as reported.

Fix directions

1. Rotate the attempt when a backend other than the owner admits a turn under it, so the owner's attempt is superseded and its receipt is skipped.
2. Or write per-attempt execution evidence (a durable marker or lease) from any backend that runs a turn under an attempt, and check it before minting a receipt.

Related

#4308, #4414, #4415, #4540.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[linear-code]

MUX-224

[ThomasK33]

A related case was deferred here from #4577 (review thread PRRT_kwDOPxxmWM6mFfMp).

After an attempt is retired and claimed, publishAgentTaskReport does not refuse a report whose taskAttemptId still matches the retired attempt. In a single backend this cannot happen: a settlement receipt is written only once attemptCannotStillReport passes. With a second backend that runs the same attempt, the original report and the replacement could both be published. If this issue adds cross-process fencing, report publication should reject a retired attempt, with the claim and report ordering serialized through the config write.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

Closing as by-design, with the full fix tracked in #4801.

• The exactly-once hole is closed by 🤖 fix: a retired attempt refuses a late report #4754 (merged as 1774166): report publication refuses an attempt a workflow claim has retired, so for a retired attempt a workflow accepts either the late report or the replacement, never both.
• A settlement receipt stays one-backend evidence, never proof that no report exists; a report written after a receipt still reads as "reported". That scope is documented in the subagentAttemptSettlements.ts header and the CONCURRENT BACKENDS contract (🤖 docs: contract for two backends sharing one Xum root #4802, merged as 4c2a95e). Driving one task from two backends at once is unsupported.
• The full fix, a receipt written only while holding a per-attempt live-owner lock (the pattern 🤖 fix: another backend never settles a live backend's workspace turn #4772 introduced for workspace turns), is the upgrade path in 🤖 multi-backend: per-attempt live-owner lock and remaining cross-backend liveness gaps #4801.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high