Both reviewers (Codex gpt-5.6-sol xhigh, Antigravity) returned
request-changes on c6316cc; this addresses their reconciled findings.

Protocol compatibility (Codex M7 — the compat claim was false):
- recovery_policy / recovery_drain_timeout_s removed from the wire
  RootConfigSnapshot: released workers validate the snapshot with
  extra="forbid", so the new response fields would have crashed every
  old worker at parse time. The settings are coordinator-side only and
  excluded when snapshots are built.

Liveness correctness (both reviews' top finding + Codex M6):
- is_worker_alive distinguishes "pid gone" from "cannot capture": a
  coordinator whose team-harness lacks process identity (version skew)
  now returns unknown -> legacy behavior, never "verified dead" ->
  duplicate dispatch. Zombies count as dead (an exited-but-unreaped
  worker cannot hold its task hostage via 409).
- The unbounded read timeout applies to /register ONLY; /finished keeps
  the bounded default so a wedged response cannot leave a worker
  alive-but-stuck forever. 409 messages name the pid and the
  kill-and-reregister escape hatch for hung workers.

Recovery safety (Codex M2/M3/M5/m1, Antigravity 3/4/5):
- Two-phase /register: the potentially long drain runs OUTSIDE the state
  lock (phase A), with a locked re-validating commit (phase B) that
  replans when state moved in between — loopy status/stop and /finished
  stay usable during recovery; lock contention surfaces as HTTP 503 and
  friendly CLI errors instead of raw tracebacks.
- Unsettled outcomes block dispatch: if any orphan may still be running
  after recovery (unverifiable identity, probe failure, kill that did
  not land), /register returns 409 instead of starting a second writer;
  the salvage record (now with unsettled_workers, written even when a
  mid-loop refusal aborts recovery) names the unresolved processes.
- Same-host gate: a worker identity from another hostname skips local
  reaping (signals cannot reach it; shared-filesystem deployments would
  otherwise probe the wrong host's pids and report false success).
- Run-record validation: a discovered directory name is only reaped when
  its run.json's run_id and session_output_dir point back at this
  iteration (stray names cannot select an unrelated run).
- ONE recovery_drain_timeout_s deadline shared across all of the
  iteration's runs (was per-run).

Ownership (Codex M8):
- A stale /finished from a DIFFERENT identified worker is refused (409)
  instead of being handed the live task (second executor); unknown
  identities keep the pre-existing stale-retry behavior.

Audit honesty (Codex m2, Antigravity 7):
- History error is abandoned_after_<policy> (drain/reap), only when
  something actually settled.

Docs: http-contract (canonical + website), session-layout (both),
configuration, README, CHANGELOG all realigned with the implemented
behavior (same-host-only recovery, hung-worker escape hatch, shared
deadline, coordinator-only settings, stale-finished 409, 503 semantics).

Tests: 6 added (141 total) — version-skew unknown, zombie-as-dead,
stray-directory skip, unsettled -> RecoveryIncompleteError with salvage,
stale-finished 409 + legacy passthrough, no-recovery-fields-on-the-wire.
Integration re-verified against the real team-harness branch: a real
orphan drained through the hardened flow (record-match guard passing,
salvage with settled/unsettled counts).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PN8aFwwxA8FzMy9LgpbQFt

… owner

The maintainer confirmed backward compatibility is not required, which
unlocks closing the one residual duplicate-execution window the compat
compromise had left open (Codex M8's weak branch):

- /register without a worker identity is rejected with HTTP 400 (breaking;
  pre-0.3 workers cannot register — upgrade workers and coordinator
  together). Every dispatched task therefore has a recorded owner and
  liveness verification is always at least attemptable.
- A stale /finished is replayed ONLY to the task's recorded owner; any
  other caller — identified or anonymous — gets HTTP 409. A task persisted
  by a pre-identity version (owner None) keeps the legacy replay for that
  one resume.

Deliberately KEPT despite permission to break:
- recovery settings stay off the wire snapshot (coordinator-only concern —
  better design regardless of compat);
- the "unknown" liveness verdict and importlib soft-resolution remain: they
  guard against runtime environment facts (remote hosts, a team-harness
  without process identity), not old clients.

Docs (http-contract both copies, CHANGELOG breaking header per the 0.2.0
house style) and tests updated: register-requires-identity, anonymous
stale 409, owner replay, pre-upgrade ownerless replay. 143 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PN8aFwwxA8FzMy9LgpbQFt