Fix Codex App receipt recovery and safe Meridian restart

[yzsnstotz]

Summary

• Reconcile exact native App terminal receipts without resubmission; retain the authenticated queue controller bridge.
• Report interrupted original runs as terminal errors, and add controller-only recovery for proven pre-thread creation rejection.
• Preflight the selected Node against fs-ext before service teardown and pin the same runtime for build and PM2.

Verification

• 813 Node tests passed; 19 Python observer tests passed.
• TypeScript build/typecheck and shell syntax checks passed.
• CLI and App interruption regression assertions fail on old behavior and pass with the fix.
• Independent code review completed; important findings fixed.

Boundaries

No permissions changes, fabricated App UUIDs/finals, validator bypass, force push, or main merge. Native startup configuration failures must be resolved before a fresh canonical worker retry.

Follow-up: external handoff ownership (d1c0caf)

• Publish a minimal, validated provider-neutral execution reservation on status; retain durable ownership across registry/provider failure and cover pre-enqueue without resurrecting terminal requests.
• Companion Roles consumer: codex/external-handoff-watchdog (350bf46); prevents age-only PM demotion and duplicate scheduling.
• Native controller guidance now requires actual task-environment evidence and preservation of the existing native session after owner changes its permissions.
• Verification: Hub 923/923 tests passed, new regressions red -> green, build/typecheck/diff checks passed; root independently reran the full suite. Independent spec and quality reviews approved, no Critical/Important findings.
• Minor capacity follow-up: status currently scans retained queue history (current 40-record queue measured 13.01 ms). Load-test representative scale before selecting optimization. No queue retention/deletion change in this patch.
• No native Codex permission or storage changes; no product acceptance, production deployment, or PR merge implied.

Follow-up: requested execution-policy transport (3fb3680)

• Preserve registered auto_approve and sandbox_mode intent across Hub routing, executor argv and durable App requests; retain explicit false and unknown legacy state.
• Reject malformed policy payloads and conflicting changes to an existing request. Legacy terminal retries keep their original result without replay or retrofitted metadata.
• This is a partial transport fix, NOT an effective native permission grant. The public native create/send contract has no supported permission-profile setter; automatic native provisioning remains an integration gap.
• Verification on the final commit: 926/926 Node tests passed (0 failed, 0 skipped), TypeScript build passed, diff checks passed; new regressions demonstrated red then green. Independent review completed with no blocking findings.
• Deployment deferred while canonical Cyberent execution owners are active. The validator finished and downstream workers now hold reservations; no service restart, main merge, native settings/storage change, or product-wide acceptance is implied.

Historical applied delivery and scheduled validation — 2026-09-09

• The prior deferred deployment is historical: Hub delivery code35c6b21 is installed. Real scheduled invocations observed exact worker terminal → automatic queue receipt → independent validator; an actual negative verdict produced a new request and a same-native-task repair turn without duplicate creation.
• Latest evidence documentation fae85bb is pushed. At08:46 only companion Roles was restarted, installing sourcea492c679 after an actual drained window; Hub and other services remained unchanged.
• Seven explicitly verified historical accepted revisions were migrated; original FREEZE→HARNESS→BATCH-3 repair path resumed, with one real FREEZE native turn running. No blanket reset or fresh product acceptance was invented.
• At that historical checkpoint, native cyberent-meridian heartbeat used two-minute delivery plus hourly full audit; the latest owner-directed cadence below supersedes it. The NEW scheduled invocation's post-Roles-install terminal/validator/fresh-capsule/downstream chain remains pending until those actual events occur.
• Native App catalog omission persists despite section membership; requested policy transport is still not effective native permission application.
• See docs/superpowers/plans/2026-09-09-app-delivery-validation.md and 2026-09-09-scheduled-resolver-audit.md for exact request/turn IDs, independent evidence, failure boundaries and current deployment chronology.

Native error-terminal repair deployed — 2026-09-10

• Commit54bbd3362776273d3aa85450410ca6247ca7c7ad preserves actual native task_complete errors through observer, failed queue executor, nonrecoverable stream parsing, Hub error finals and persisted history. Terminal errors survive trailing transport or output-recording errors.
• Read-only status/history recovery recognizes only exact, owned failed submissions with valid chronological evidence and no newer execution owner. It records the genuine failure once; it does not resubmit native work or edit native state.
• Verification:198 Node regressions and23 Python tests passed, typecheck/build/diff check passed; independent spec and quality reviews approved. Review added mandatory submitted/start timestamps and rejection of input after submission.
• Installed23 exact source/build/guide targets with preimage backups;360 unrelated source/build files unchanged. Hub and Web restarted safely with Node24, new PIDs82925/82983; Roles and unrelated services unchanged.
• Actual HARNESS request e62211a7-fc7e-42e4-a985-a283e8484390 recovered into unique error final0d4d344e-fcd1-43ba-a0c2-b9e809c83182 at original2026-09-09T21:14:14.182Z. Registry running→idle; normal original-plan reconcile stored the authentic failure. Repeated reads retained the same final; original queue and11-file product WIP hashes unchanged.
• Remaining product blocker is an actual Codex cyber_policy denial, not a receipt success or missing local owner authorization. Original dispatcher stays paused, HARNESS failed and CORE/API blocked; no eligible independent pending row. No provider/model/executor bypass, duplicate worker, acceptance override or product-completion claim.
• Existing cyberent-meridian native heartbeat is ACTIVE every60minutes per latest user instruction; no two-minute controller. Saved prompt includes the actual failure, exact deployed receipt, supported provider escalation and next scheduled verification. Future scheduled validation is still pending actual execution.
• Local installation receipt:docs/superpowers/plans/2026-09-10-native-error-terminal-install.json. No main merge or force push.