Complete owner-scoped ChatGPT subscription team setup and recovery

[Exohayvan]

Summary

• Complete the eligible legacy-empty organization and fresh starter-team path: dedicated consent, account models, explicit owner setup policy, Improve/Generate, review, Create, and persistent organization Settings status/disconnect.
• Add macOS protected local storage, bounded one-use subscription operations, single tool-free Responses SSE, honest unknown token/plan-cost reporting, and retained history/debt.
• Add guarded filesystem/ledger coordination and explicit proof-based unsent/publication recovery; retain uncertainty blocks and no automatic provider retries.
• Add durable macOS native verification and the setup contract.

Scope and safety

• macOS-only supported protected runtime. Linux/Windows refuse unsupported runtime truthfully and retain portable/refusal coverage.
• Requires separate user-consented Eidolon authorization; existing Codex login/credentials are not reused or imported.
• Subscription access is starter-team setup only, not ongoing organization execution.
• Owner explicitly approves effective call/time limits; token/USD plan costs may remain unknown. Inherited setup-default limits may retire only through explicit local-owner policy; execution limits, history and debt remain.
• Managed/shared/global/unknown authority is blocked. Running/uncertain outcomes block new sends.
• Explicit Find/Check/retry requires exact input and current owner/source/account/epoch/revision proof; Check is local and never resends. Local disconnect does not claim remote revocation.
• No actual OAuth registration/grants, user credentials, live provider calls, release or installation were performed.

Validation

• Reviewed synthetic source C16: cafce563397b67fad0df141b853dacaad27b1c59, tree 7346b68d2ebdb205e62142925596ff569f2ae6f5.
• C16 hosted proof: all four backend hosts passed; seven macOS Electron journeys passed once with zero retries; three real macOS ACL cases passed; 246 UI and 21 observer tests, typecheck/build passed.
• Real macOS registered cases cover fresh/legacy full setup, uncertainty, explicit unsent retry, publication recovery and stranded-unsent reconciliation using synthetic consent/TLS/vault edges and real filesystem/owner/admission behavior.
• Historical diagnostic failures remain retained. The initial full PR run 39083877073 failed: macOS native 6/7, Linux core 84/87, and two Windows diagnostic tests; the separate credential-native gate also failed. These are not retroactive passes.
• Reviewed repairs distinguish expected unsupported-platform status from verification errors; preserve explicit no-send/manual-setup checks; isolate the Windows SQLite test factory; and permit only a first metadata-only final-path ancestor change through the existing single complete ACL revalidation. Replacement, security/ACL changes and repeated churn still refuse.
• Native probes now cover both final-FD and final-path windows. Synthetic sibling cleanup completes before releasing the outer store lock and returning consent, using a pinned parent descriptor. The cleanup race is independently reproduced but is not claimed as the historical catalog failure's actor.
• Frozen 13-file repair manifest SHA256: 53f6a95d2e63759251383bcede49657342e60e38d53cc2c64085a2f5f5ae0b67. All source bytes were recovered and independently hash-verified after workspace reset; no new local rerun is claimed.
• Prior focused repair receipts: 711 backend tests; 260 Settings UI tests; 79 native-fixture/diagnostic portable tests plus seven platform-specific Linux skips; 21 observer tests; 130 related UI tests and types/lint. Hosted native and complete updated-head gates remain required.
• Updated head 87280b3f87b1a4da39e5a8b9a32b6ad5c88e2c7a, tree 20b7e0bc24d957b89872b3b16004119e87f66edc, parent a49c13a621374b9fe1eb5178282fa359525e5de8, based on main d1eb6e698a1668f99cb4c5e083a1ebf04a74bb94.
• This draft requires all updated-head PR gates, including credential regressions and the required macOS native job, before merge; post-main verification remains required.

Updated-head results and remaining work

• Head 87280b3f run 39193336469: macOS native seven journeys and required native/old-runtime cases passed without retries; all Windows shards and macOS backend passed. Native macOS source receipts and screenshots were independently reviewed.
• Credential regression run 39193336553 and Node isolation run 39193336526 passed.
• Linux backend passed 7,070 tests, then legacy-fixture acquisition failed on an existing .git/shallow.lock. The lock creator remains unproven. A separately reviewed fixture checkout repair preserves the exact old module and current-runtime proof; it does not resolve the broader passive-import side effects found during diagnosis.
• Linux native core passed 86/87. The Arabic unsupported-subscription jobs textarea focus outline clipped inside eid-team-body at 1280/200%; retained artifact 12162510425 is under diagnosis. No assertion weakening or blind retry is planned.
• Both failures and their aggregate failures remain historical failures. The draft is not merge-ready; all final-head gates and artifact review remain required.

Final repair candidate

• Head e03cfec410a280f8907277009a023376edf73664, tree cfdda332108dbcb303ab65bb6885be99eb4e9826, adds only the independently reviewed four-file workflow/test repair to 87280b3f.
• Legacy proof acquisition uses separate pinned Git metadata on Linux/macOS; unchanged immutable legacy module and current-runtime ownership proof remain required.
• Team round-trip keyboard focus is measured after its one production render frame. The complete clipping, contrast and focus assertion body is unchanged; no refocusing, test scrolling, arbitrary delay or assertion tolerance was added. Exact-source tests pass 15/15 with broken-reveal and premature-measurement negative controls. Hosted native causality remains pending.
• Full final-head PR checks and a separate focused native timing proof are pending. Earlier failures remain recorded above; no merge eligibility is claimed.

Previous reviewed source and focused acceptance

• Previous head 9f287720a6c61d084fbad84c03b2c556243ccb9d, tree b087944b942b43013a5935a4f6e9262480a54bbd, still based on main d1eb6e698a1668f99cb4c5e083a1ebf04a74bb94. The complete 17-file delta from e03 was independently audited against every reviewed intermediate blob. Temporary diagnostic workflows are excluded.
• The e03 Linux native core passed 2,788 unit and 87 native cases; Linux/macOS backend and immutable old-selector/current-runtime proofs passed. Credentials and Node gates passed. Focused keyboard timing proof demonstrated the immediate Arabic clipping and the existing production frame's correction, with unchanged negative controls.
• e03 Windows outcomes initially crashed with an access violation during the native stack dump. Two bounded diagnostic arms passed, then one authorized unchanged canonical failed-shard rerun passed 79 tests; matrix siblings also passed. This is nonreproduction, not a root-cause fix. The original failure remains retained.
• e03 macOS native and subsequent bounded diagnostics exposed a correctly refused second metadata drift under the shared system temporary ancestor. Fixtures now use an identity-checked private workspace container; production second-drift refusal remains unchanged. A native Electron real-churn case verifies explicit local reconciliation before separate new consent without duplicate OAuth/send.
• A later legacy journey exposed SQLite admission-read contention after durable dispatch marking. Reads now participate in the existing bounded ledger coordinator through connection close, preserving original deadlines, cancellation, source/owner fencing, one-use permits and uncertain debt. Deterministic contention tests and actual scheduler lifecycle probes reproduce the failure class and verify the repair; no automatic resend/refund was added.
• A fixture teardown ENOTEMPTY failure remains recorded; its historical writer is unproven. Fixture teardown now observes only previously verified owned process identities with bounded waiting and identity-checked removal. It neither broadly kills processes nor retries deletion; the captured-descendant scope is deliberately limited.
• The first combined focused run 39215046253 failed at full typecheck before Electron. A one-line exported receipt type fixes TS4058; exact-source aggregate typecheck reproduced red to green, and emitted JavaScript is unchanged.
• Reviewed focused macOS run 39219354686 passed all eight cases once, zero retries/skips. Artifact 12171363219, SHA256 d33eeb3e2246a803777f5ff67e8c98f159efe8b9902ce222e88ee84cbb11bba1, was independently checked against source/tree stamps, accounting snapshots, screenshots and all seven strict teardown receipts. Each captured six identities, ended with zero remaining live identities, root exited and sandbox removed. Initial live counts were zero, so this does not identify or reproduce the earlier teardown writer.
• Fresh and legacy full setup/Create, retained prior debt, post-Create Disconnect, charged uncertainty, explicit stranded-unsent recovery and local authorization reconciliation passed. Required real macOS filesystem/registered/old-runtime checks also passed using synthetic provider/auth edges.
• All ordinary final-head platform, credential, Node and native gates must now pass on this updated PR head. No merge eligibility is claimed until those gates and artifact review finish; actual-main post-verification remains required.

Shutdown lifecycle repair and current full verification

• Current head 172b9547665385264192bf2cdb628443f27bb725, tree 008fc3f0a6d66706aa3886a6e0ffed71c2682581, adds exactly six independently reviewed files to 9f: three lifecycle source/tests, two failure-only fixture identity diagnostics, and explicit lifecycle test registration. No temporary workflow is included.
• Full 9f run 39221272795 passed every platform job except macOS native and its dependent aggregate: 2,788 unit and 87 Linux native cases passed, as did Windows, macOS backend, credentials and Node checks. The stranded-unsent body passed, but teardown again hit ENOTEMPTY; all six captured identities had already exited and only the home category remained. This historical failure is retained.
• Exact-source synthetic-child controls independently reproduced a separate production shutdown/start race: reconnect after shutdown admission, paused pre-spawn work, the spawn-to-claim ownership gap, and stale descriptor publication. A bounded lifecycle seal and physical-child registry now reject late starts/publication, retain exact owned children across claims/cache eviction, and preserve normal reconnect/cancellation and unrelated ownership. No shutdown timeout increase, broad process kill or deletion retry was added. This demonstrated race is not claimed as identification of the historical ENOTEMPTY writer.
• All 22 independent exact-source primary/pool/claim controls and 44 focused lifecycle tests passed; all three TypeScript configurations and changed-file lint passed. The local full-suite attempt lacked support files and is explicitly not a full aggregate pass; hosted aggregate verification is required.
• Focused 39227563730 passed all eight native cases once with zero retries/skips. Artifact 12176022577 and exact start/end source stamps were independently reviewed, including nine body screenshots and seven settled/removed teardown receipts. All captured initial-live counts were zero, so this run does not identify the earlier writer or exercise waiting for a live captured descendant.
• Expanded macOS verification passed 304 component tests, 69 Node fixture tests, backend/protected-store/registered-native checks and required real ACL/old-runtime gates. Failure-only home identity evidence now distinguishes same/recreated/unsafe/missing/inspection_failed states without exposing raw paths or changing successful receipts.
• The final-head runs started as pending; completed results are below: Organization regression 39230145378, credentials 39230145387, Node isolation 39230145370, and desktop update recovery 39230145390. The PR remains draft until every applicable exact-head gate and artifact review passes.

Final-head acceptance

• All 24 exact-head checks passed on 172b9547665385264192bf2cdb628443f27bb725 / tree 008fc3f0a6d66706aa3886a6e0ffed71c2682581. Organization run 39230145378 completed successfully on attempt 1, including all 19 jobs and both native aggregates. Credentials, Node isolation and desktop update recovery runs linked above also passed.
• Linux core passed 2,788 unit and 87 native cases. Full durable macOS artifact 12177041148 was independently accepted: event merge tree exactly matches the reviewed source, unchanged start/end receipts, eight single-pass cases, seven clean teardown receipts, required real-macOS/old-runtime cases, and nine reviewed body screenshots.
• Earlier failures and their unresolved historical actor attribution remain documented above. These results establish synthetic guarded setup/recovery behavior; they do not represent actual OAuth grants, paid provider requests, release installation, or ongoing organization subscription execution.
• Merge still requires fresh head/base verification; actual-main post-merge verification remains required.