fix(session): close owner-aware shared reader safety boundary

[snowykr]

Scope

Split #6240 after external readonly prerequisite #6316 installed. Base b37ba33f1b516d4ceac200ed5c08e0254b08c130; exact head 22d1bac844b086a5d6854422fdc6630bfee4fba6. Owned and actual dev production review cost 547 additions+deletions (Scope369+178); tests139 and release fragment3 excluded. No extraction/caller/generated production exclusions.

Complete shared target, pending-receipt and completed-receipt readers retain strict owner evidence, contiguous attempts, original deletion proof and native outcome matching. Malformed/unsupported owner metadata cannot become absence and reconstruct a destructive cleanup target. Direct/reconcile, canonical-absence and header-patch races refuse owner effects before complete consumers install. Owner-free legacy behavior and the native exact-identity fence/error mapping remain intact. No placeholders, compatibility fallback or effect authority from decoded DTOs.

Whole-root fail-closed discovery is intentional: a malformed/unauthenticated v2 sibling prevents a partial inventory from proving live sibling absence. The explicit source comment addresses #6316's nonblocking review note. Automatic owner production and post-move task admission remain OFF. Protocol/scanner/managed/SDK/GC effects install separately; this PR does not enable them.

Exact-head verification

Separate QA checkout clean before/after at 22d1bac844b086a5d6854422fdc6630bfee4fba6:

• bun test packages/coding-agent/test/managed-gc-retirement-journal.test.ts packages/coding-agent/test/managed-gc-retirement-codec.test.ts packages/coding-agent/test/task-artifact-owner-transcript.test.ts packages/coding-agent/test/session-storage.test.ts packages/coding-agent/test/gc-disk-retention.test.ts packages/coding-agent/test/task-artifact-owner-retirement.test.ts packages/coding-agent/test/task-artifact-owner-access.test.ts: exit0, 212 passed / 8 existing platform skips / 0 failed / 1111 assertions, seven real files. Runner refuses nonexistent test paths.
• bun --cwd=packages/coding-agent run check: exit0 at this exact head; full vendor/Biome/typecheck, baseline2 warnings/1 info retained, no suppression.

Genuine current-source native0.18.6 addon SHA256 ecca056f0c63eca5139c674999a86ca8f4c32926cb18b4c9804efd0d00c32030, source SHA256 26555fb71debdd40e0cdb70811847765452facd4cbb4107b646df7cc1a25dcaf. Native crates tree identical to the successful ci-profile source build b1fbdafa94f0ad68825d2d46590ba4ad81e013e0; truthful generated descriptor already externally installed through #6314. No descriptor rewrite during QA, version/digest waiver, released-artifact substitution, timeout increase or new skip.

Darwin local execution, not full cumulative task-admission/Rust/API/platform proof. The separate inherited over-limit 50,001-entry reaper exact-QA20s failure remains outside these focused green claims; no performance candidate delivery or gate waiver. Prior #6316 Linux bug/old changes-request retained; its fixed exact47a approved by write-access probepark review5405416016, code-event37191477305 success, externally merged by Yeachan-Heo c2adb3d. That approval/CI does not transfer here.

Preservation and delivery

Protected original HEAD 1a12e32f6bbcb5c4a469dd480b4b5dacb37dc95d / 44 staged files preserved; protected reference HEAD 7e5f7ef2a745bc1c3d012362f00be9a441bdeb76 / sourceHash sha256:0ef698e426d34102d9be3e0c250a880059221bfa77c0ace2351bea28c97528ab preserved. Release fragment included; shared CHANGELOG untouched.

Fresh exact-head code-event CI and approving write-access maintainer review required. Leader does not merge. No final cohort, critic or whole-goal completion claim.

[probepark]

Review (head 22d1bac, gajae-reviewer on behalf of probepark)

CI: green. Every planned check passed at this head, including check:@gajae-code/coding-agent, the managed-gc-retirement-journal shard, Virtual integration validation and Windows dev:doctor. The approve gate returned ALLOW with no pending, failed or need-local items.
Scope: +510 / -179, 3 files. Reviewable production code is packages/coding-agent/src/session/internal/managed-session-scope.ts (+369/-178). The test (+138/-1) and the changelog fragment were excluded by ocr.
Conventions: release fragment changelog.d/task-owner-shared-reader-boundary.md present, shared CHANGELOG untouched. No generated files, no labels, no console.*, no new Worker.
Notable:

• managed-session-scope.ts:3058: retiredTargets now turns a SyntaxError into durability_failed where it used to return undefined. Combined with the new rethrow in tombstonePathContaining (:4356), one unparsable tombstone file now stops reconcileManagedTombstones and every deleteManagedSessionCandidate in the scope, where before it was skipped. This matches the stated fail-closed intent and tombstones are published through publishManagedTombstone, so it is not blocking. The changelog fragment only mentions owner claims, though, so a user who hits this will get no explanation from it.
• assertLegacyOwnerFreeTranscript (:3088) calls readSnapshotSync on the whole transcript. It now runs at each deleteSessionVerifiedWithFence stage plus the pre-lock and post-lock target loops, so one deletion of a large legacy transcript reads it 3–5 times. This is correct, but it is a cost on the owner-free legacy path. A bounded header-only read would be enough if the locator can only appear in the header or a header_patch.

Checked and clean: parseRetiredTargetRecord (:3107) rejects every taskArtifactOwner* key except a strictly parsed taskArtifactOwnerDeletionEvidence whose sessionId matches. parseCleanupReceiptRecord only allows taskArtifactOwnerTranscriptDeleted===true when the target carries deletion evidence. cleanupCompleted and publishCleanupCompleted refuse owner targets before any effect. The pending-receipt refactor moves the old checks unchanged and adds only the owner clause. The new tests restore spies through vi.restoreAllMocks() and reset ManagedSessionScopeTestHooks.beforeVerifiedDelete in afterEach.

Blocking: none

PR body verdict line count=0, not updated. Suggested verdict line: gajae.pr-review-verdict.v1 merge-approved sha256:22bd1e99f8e0dc78516e33666eb16afa989e0d53c1cbfbc34f08ef7dd67ad265 reviewer:human reviewer-id:probepark evidence:ci-green;approve-gate-allow;owner-claim-parsers-read;pending-receipt-refactor-diffed;spy-restore-checked

Verdict: gajae.pr-review-verdict.v1 merge-approved sha256:22bd1e99f8e0dc78516e33666eb16afa989e0d53c1cbfbc34f08ef7dd67ad265 reviewer:human reviewer-id:probepark evidence:ci-green;approve-gate-allow;owner-claim-parsers-read;pending-receipt-refactor-diffed;spy-restore-checked