[Maneek21]

Change

Recover unattended OAuth Runtime channels after real session expiry or terminal stale-session renewal denial. Renew 5–6 minutes early, and reconcile current operator-configured registrations through the Host service-credential endpoint. Transient failures retry indefinitely with exponential jitter capped at five minutes; permanent service denial emits reconnect_required. Fresh sessions travel through the existing authenticated installer, persist encrypted, replace old workers and reconcile lost ACKs. No Send/start/result effect is retried.

Gmail refresh now keeps durable transport/verification reconciliation under the account lock, retains the last usable refresh token, and commits received credentials before later authority checks and identity GETs. Restart resumes verification with the newest credentials. invalid_grant and identity mismatch require reconnect; Microsoft uncertain rotating-token responses retain their fence.

Replace orphan-only writer ownership with a lifetime SQLite OS file lock. Hard crashes release ownership automatically; encrypted atomic row commits and Send uncertainty journals remain intact. Preserve existing file line endings, update reviewed provider adaptations/provenance, and package the new modules and regressions.

Validation

• Recovery regressions pass: >15-minute Host/Runtime outage, stale/legacy channel metadata, renewal/install ACK loss, bounded transient backoff, permanent denial, live revocation, concurrent refresh, refresh/verification timeout, missing replacement refresh token, token-commit process kill/restart, and writer kills at read/commit boundaries.
• Existing process restart, installer, renewal and shutdown checks pass.
• verify:provenance passes (57 copied modules); exported artifact module closure/startup passes (164 local modules).
• Broader Runtime suite and focused preview checks were run. The broad suite exposes the existing foreground-cache test "two foreground requests retain the exact session lock and second hit uses fresh authority" and three 25-item Graph/Gmail action-deadline tests; all four failures reproduce on untouched origin/main at 84cc9a1 on this Windows environment. The focused preview suite passes locally. Legacy adoption tests require unavailable /app Host-private imports. These are not reported as passing.

Host dependency: Maneek21/Deft#401 must release first. Existing explicit finite permissions and unreviewed upgrades keep their prior authority boundaries. This PR does not merge, release, deploy or change demo.deft.ing. See runtime/UNATTENDED-RECOVERY.md for the design and legacy-writer rollout boundary.

Final validation: latest-head CI at 61b3019 is green, including exported-artifact startup: https://github.com/Maneek21/deft-email/actions/runs/39500194997 . Writer bootstrap/read/commit and shutdown/restart checks pass (21 tests); observation latency checks pass (14); refresh, reconnect and credential-repair fences pass (22). The broad Windows run also caught an obsolete process-fixture assumption, which was corrected and rerun successfully (5 tests). Existing unchanged lines were checked byte-for-byte, including CRLF.

Connect-once integration

Require Host preview.131. Preserve the exact Host service-registration fence by teaching the Runtime to route the current registration after an authenticated v2 custody transition. Index prepared transitions before acknowledging prepare, and enroll only a connected journal with an exact receipt and matching local source/successor sessions. Reconstruct enrollment after restart and use it for data, channel installation, local jobs and service reacquisition. Operator files and secret handling remain unchanged.

The previous dispatcher failed EMAIL_RUNTIME_REGISTRATION_DENIED for a Host-authorized successor unless tests first edited operator registrations and restarted. Regressions now cover two upgrades without config edits, data after restart, crash after connected journal before ACK, changed principals/Host denial, and an actual server installing both action/observation channels then reacquiring after simulated twenty-minute expiry. The Host still authorizes every operation. No provider effects are retried.

Validation: provenance, App build/tests/UI, focused Runtime preview suite, v2 reattachment/installer tests, and standalone exported artifact closure/startup passed locally. Windows artifact verification used Windows bsdtar ahead of Git Bash tar, which cannot parse native drive paths. Linux CI is required before merge.

The real demo retains legacy action channel files. A second regression reproduced healthy current sessions being reinstalled repeatedly because an unrelated unattributed legacy action had ended. Scope that legacy fallback to registrations without an authenticated complete installation; the actual-server test now includes an ended legacy file and proves no reinstallation loop before or after expired-session restart.

🤖 Generated with Claude Code