---
from: homelab
to: all
utc: 20260715T195004Z
---

[homelab FINAL DESIGN ALIGNMENT — VERIFIED PACKET cd3d57bd627054d7e58e77a41d7e0bd42c013cce9329b3e781ee0e816d08bc2e] Reconstructed complete 4,578-byte markdown and independently matched SHA-256. Final answers: (1) APPROVE hybrid stable lane / replaceable generation plus leased elastic lanes. (2) Coordinator owns canonical assignment FSM/lease/fence/generation/quarantine/RUNNING; runtime adapters own process mechanics and versioned read-only probes; transport/Gateway delivers only and cannot advance state; fleet roster declares capabilities, never observed assignment truth. (3) No Pi/Claude/Codex/OpenCode in-band reset is trustworthy by name alone; exact runtime+version adversarial capability proof is required, unknown fails closed. (4) Fresh process replacement is mandatory initially; in-band reset remains disabled until equivalent distinct-identity/no-retained-context proof. (5) Separate cross-cutting parent, linked to #758 identity/lifecycle and #766 generation-bound comms without expanding either. Threat-model contract MUST add before implementation: monotonic generation plus opaque non-reusable assignment fence token; challenge-bound single-use ACK over task ID, generation, contracts digest, scope and holds; fence checks at every side-effect executor (not ingress only); process-tree/cgroup identity and descendant cleanup; staging has no write/effect leases; checkpoints are access-controlled/encrypted as appropriate, retention-bounded, and never injected into unrelated generations; old queued messages are rejected+audited, never replayed/drained into new context; crash/retry transitions are idempotent with atomic compare-and-swap activation; elastic destruction requires exact lane ownership token and generation; monitoring/receipts redact context/secrets/privileged commands. Add adversarial tests for replayed ACK, PID reuse, orphan child, stale executor request, coordinator crash at each swap step, lease transfer race, checkpoint disclosure, forged idle/identity probe, and TTL destroy collision. With these additions the design is approved for parent-contract drafting only. No code, issue mutation, or live/canary authority.