[ITSGJY]

Scope

Addresses yyjeqhc/webcodex#1362 in this Fork Draft PR. A retained Workflow Session may be inspected or closed by its authorized owner after its original Runner Project has been unregistered, but must not regain execution rights when the Project selector is reused.

Implementation

• Persist a unique registration_incarnation UUID for each new Project registration (explicit register/create, path registration, and managed worktrees). Ordinary Runner reconnects and restarts reuse the value stored in the TOML record.
• Upgrade valid legacy Project TOML records once through a synchronized, atomic write before advertising them in the Runner inventory. Preserve the existing TOML content and table scopes. If the upgrade cannot be persisted, the Project is not granted a temporary execution identity.
• Carry the registration ID in the Runner Project summary, validate its syntax at the registry boundary, and bind the Server's Session identity to both the registration ID and its registered root witness.
• Keep owner-authorized historical read/close gated on proof of unregistration from a complete current Runner inventory. An active replacement registration cannot inherit the original Session's authority.
• Retain the existing permission checks and close/SQLite durability semantics; the new identity is also checked at generic Session-bound execution admission.

Regression evidence (commit 05a624265e385562ee467c59e2d28885c2740332)

• Reproduced the same-ID, same-root unregister/re-register vulnerability with a failing RED test before the fix; verified GREEN after the registration identity fence.
• Session retirement/reconnect/legacy-identity, native shell admission, and SQLite close/reopen regressions: 8 passed, 0 failed.
• Server cargo test --locked -p webcodex --lib: 3,901 passed, 0 failed, 14 ignored.
• Runner Registry: 411 passed, 0 failed, 1 ignored.
• Runner (including configuration preflight): 1,211 passed, 0 failed, 11 ignored.
• Legacy-TOML migration and rotation tests: passed. Rust formatting and git diff --check: passed.
• Experimental Code Mode compatibility: 73 passed / 0 failed; receipt tests 5 passed / 0 failed. Fixed an audit fixture to provide its persisted Project registration identity.
• Private TOML file mode preservation during migration: passed (Unix 0600 regression).
• Fork CI for this exact head: https://github.com/ITSGJY/webcodex/actions/runs/42212727069 (pending / in progress).

Review gates

• Independent Codex review of this head is not complete. Both Codex ACP and the locally installed Codex CLI returned a workspace-credit error. Previous-head reviews are not approval of this commit.
• The remaining distributed request-lifetime/inventory-propagation race requires a separate protocol-level security review; Server-side admission tests alone do not establish a Runner-side request-incarnation CAS.
• Existing, pre-upgrade Sessions lacking the new registration witness cannot resume live work merely by matching a Project path. A new Session may be started against a safely upgraded registration.

This PR remains Draft. No upstream PR, merge, production deployment, or service restart has been performed; owner review remains required.