Track post-cap restart safety findings from PR #121 #156

PR #121 received additional automated findings after the repository's two-round Copilot cap. This issue records the verified findings under the 2026-09-16 ruling in AGENTS.md. The PR remains held while its legacy compatibility implementation is completed.

• Handoff comparison and replacement were separate operations, allowing a cooperating writer to overwrite changed input. Serialize ownership and checksum checks with atomic replacement under the existing helper writer mutex.
• Truncated or malformed schema-1 records could be silently repaired during a transition. Validate all mandatory fields, duplicates, identity keys, numeric counters, absolute paths and digest syntax before any write.
• A signal after the launcher exited could offer retry while a descendant still held the lane. Require affirmative all-holder absence before recording a retryable failure.
• Pane respawn did not forward the configured control root. Preserve both LANES_LANE_STATE_ROOT and AGENT_PROTOCOL_ROOT with shell-safe quoting.
• Interactive retry did not repeat the holder check after the preceding attempt failed. Check all holders before every claimed attempt launches and keep unknown/live ownership indeterminate.
• An ordinary first launch with --dir and no register row failed when PROJECTS_ROOT was absent. Use the resolved checkout as a read hint after explicit-root and recorded-directory precedence, while continuing to refuse unreadable existing intents.

The launcher-boundary finding was checked against the current workBenches claude-profile implementation: an existing TMUX pane uses the foreground path and forwards the restart environment. The earlier new-session behavior is historical incident evidence, now clarified in the manual.

Implementation and sandbox regressions are being completed in #121. This issue does not release the merge hold or authorize changes to managed lane state.

Later post-cap review also identified four bounded safety cases fixed in the same held implementation: known current/recorded pane identity is required; child readiness rejects zombie/unknown process state; pane respawn preserves launcher host/OS/container values; and existing unusable state-root ancestors fail closed rather than answering absent intent. Sandbox regressions cover these cases.

Final stabilization at a950672 addresses seven further verified post-cap cases:

• Require an existing absolute Claude checkout before preservation, and verify the entire pending identity, launch facts and handoff checksum before respawn. Fault-injected pending records cannot authorize killing the old pane.
• Compare handoff filesystem identity at row/prompt gates so equivalent parent/leaf symlink spellings remain valid; preserve the links while publishing their target.
• Reject record/control delimiters in launch facts instead of changing path bytes; preserve exact field values through read/write APIs.
• Create intent temporaries exclusively with same-directory mktemp and private permissions; never follow the prior predictable temporary-name symlink.
• Reject unknown keys, malformed lines and delimiters through the shared schema parser, including generated records before publication.
• Fence both source and destination lane names during rename under the existing mutex. Unfinished/failed or malformed restart ownership refuses before canonical input changes.
• Stop observers cooperatively through private cancellation markers and reap owned jobs. Never signal a numeric observer PID that may have been recycled; cover TERM between fork and PID publication too.

The expert panel verified these changes on inspection. New entrypoint regressions are in tests/test_supervised_restart_regressions.py; the serialized local run and current-head CI are in progress. The hold remains unchanged.

At 0e4b311, the final post-cap triage also:

• Writes current pending profile/window/directory/handoff facts explicitly, preventing a prior operation's account profile from leaking into a new restart.
• Defers TERM/HUP during claim CAS and claim-identity publication, then reconciles only the successfully owned attempt. A confirmed-empty holder read permits failure before any child launch; a lost CAS leaves the competing intent unchanged.
• Resolves physical handoff targets under the shared writer mutex, so a waiting publisher cannot retain an obsolete symlink target.
• Rejects blank lines as malformed schema content, alongside unknown keys and control delimiters.
• Documents the existing legacy rename exception precisely: it shares the mutex and refuses unfinished recovery; its four-file transaction has EXIT rollback and existing stamp-failure regression coverage, rather than a crash-atomic guarantee. Restart preservation and resume-stamp publication retain the stronger atomic checksum contract.

The focused serialized rerun is queued and current-head CI is running. These updates do not release the existing merge hold.

Final helper hardening at 733557c requires the locked publication target to have the same filesystem identity as the operation's recorded handoff. Preservation binds that handoff through preparing-state CAS before publication. An installed but unreadable, non-executable, nonregular or broken managed reader refuses instead of falling back to an absence scan. The handoff skill now documents the legacy rename exception too. Five sandbox cases cover valid/wrong-target publication and unusable reader types. The expert panel found no blockers in these changes. Current-head CI is running; local serialization remains queued.