Fix migration concurrency and recovery

CHANGELOG.md

@@ -2,9 +2,14 @@
 
 ## Unreleased
 
+## v2.2.1 - 2026-08-05
+
 ### Fixed
 
-- Made uninstall resumable from any active native task when the persisted ThreadBear home is archived, with durable initiator ownership, exact archive restoration, archived-main title validation, and binary-last local teardown.
+- Completed guided title migration in bounded concurrent waves without client-created native-call timeouts, while keeping exact inventory reconciliation and read-only Luna classifiers isolated to temporary installation tasks.
+- Prevented delayed/older title callbacks and no-op proposals from racing replacement or uninstall teardown with a locked state-format fence, and registered the controller's actual native runtime ID from its marked home delegation instead of trusting Codex's provisional creation handle.
+- Required that marked controller registration also come from Codex's native `subagent` source, preventing an ordinary user task from forging the delegation text and claiming migration authority.
+- Made uninstall resumable from any active native task after a completed migration, a stopped failed migration, or a quiescent pre-controller install, with installer-time home-title capture, upgrade-safe legacy subject recovery, exact decorated-home restoration, durable initiator ownership, exact archive restoration, preservation of user-created files beside the managed skill, and binary-last local teardown.
 
 ## v2.2.0 - 2026-08-03
 

README.md

@@ -18,7 +18,7 @@ The canonical shape is `<mark> <subject>[ → <action>]`. ThreadBear owns only d
 
 Open [INSTALL.md](INSTALL.md) in a new Codex task and follow the guided preview, consent, persistent-home setup, and supervised controller migration.
 
-ThreadBear installs a standalone Go binary, one small private state file, managed guidance, two Codex hooks, and one consented hourly Luna heartbeat. The initiating task becomes the persistent `🧵🐻 ThreadBear 🐻🧵` home; one ephemeral controller owns installation migration so that home returns promptly, while the heartbeat later handles quiet housekeeping from that task.
+ThreadBear installs a standalone Go binary, one small private state file, managed guidance, two Codex hook entries, and one consented hourly Luna heartbeat. The initiating task becomes the persistent `🧵🐻 ThreadBear 🐻🧵` home; one ephemeral controller owns installation migration so that home returns promptly, while the heartbeat later handles quiet housekeeping from that task.
 
 ## Commands
 
@@ -36,10 +36,10 @@ threadbear version
 
 Every command accepts `--json`. `inventory` is read-only and includes every native-addressable unarchived local Codex Desktop or CLI task, including projectless tasks, excluding the persisted main and controller tasks. Rollout-only internal records and older signed-in ChatGPT chat-history rows that Codex's native title setter cannot enumerate or rename are excluded. Those chat-history rows may remain unchanged in the Desktop sidebar even after local migration completes. `status` reports `ready:true` only after `migration_complete`; the installed binary's `help` output is authoritative.
 
-From the persistent ThreadBear task, ask to “strip title icons” or “check for updates now” at any time. The control task serially removes all leading ThreadBear status marks through the same native setter and exact Pre/Post verification used by ordinary turns. The same task's hourly Luna helper can archive only deterministically eligible, ThreadBear-owned complete user tasks after 14 quiet days, restore only archives recorded in its private ownership ledger, and run the deterministic verified update check last. Guided uninstall may start from any active native task, persists that task as the sole operation owner, temporarily restores an archived ThreadBear home only for final title cleanup, puts it back in its original archive state, and removes the binary only after native settlement and every other local artifact.
+From the persistent ThreadBear task, ask to “strip title icons” or “check for updates now” at any time. The control task serially removes all leading ThreadBear status marks through the same native setter and exact Pre/Post verification used by ordinary turns. The same task's hourly Luna helper can archive only deterministically eligible, ThreadBear-owned complete user tasks after 14 quiet days, restore only archives recorded in its private ownership ledger, and run the deterministic verified update check last. Guided uninstall may start from any active native task, persists that task as the sole operation owner, temporarily restores an archived ThreadBear home only for final title cleanup, puts it back in its original archive state, and removes the binary only after native settlement and every other ThreadBear-owned local artifact while preserving user-created files beside the managed skill.
 
 ## Boundaries
 
-ThreadBear installs no daemon or LaunchAgent. One explicitly consented hourly Codex heartbeat runs maintenance from the persistent Luna-medium task and stays quiet on no-op runs. The CLI alone selects archive candidates, stages one operation, reconciles ownership, and chooses the exact Darwin asset from the official release manifest. Luna calls supported native controls and communicates typed results; it never edits private UI storage, interprets prose to add targets, or chooses/downloads/checksums a release. Updates refuse while archive work is pending, verify repository URLs, SHA-256, embedded version, candidate self-test, candidate install, and installed status, and never downgrade. ThreadBear adds no token counts, model call, or narration to ordinary turns. Installation uses one serial native-writing controller and adaptive waves of read-only Luna-medium workers only when genuinely ambiguous history cannot be classified deterministically; workers classify and never write titles.
+ThreadBear installs no daemon or LaunchAgent. One explicitly consented hourly Codex heartbeat runs maintenance from the persistent Luna-medium task and stays quiet on no-op runs. The CLI alone selects archive candidates, stages one operation, reconciles ownership, and chooses the exact Darwin asset from the official release manifest. Luna calls supported native controls and communicates typed results; it never edits private UI storage, interprets prose to add targets, or chooses/downloads/checksums a release. Updates refuse while archive work is pending, verify repository URLs, SHA-256, embedded version, candidate self-test, candidate install, and installed status, and never downgrade. ThreadBear adds no token counts, model call, or narration to ordinary turns. Installation uses one Terra-medium controller, bounded concurrent native-title waves, and bounded read-only Luna-low classifier waves only when genuinely ambiguous history cannot be classified deterministically; workers classify and never write titles.
 
 See [architecture](docs/architecture.md), [compatibility](docs/compatibility.md), and the [status footer convention](docs/status-convention.md).

assets/AGENTS.threadbear.md

@@ -9,16 +9,26 @@ For every ordinary interactive turn in a main Codex Desktop task:
 For both title moments, replace the title literal and execute this exact shape:
 
 ```js
+const attempt = Date.now().toString(36) + "-" + Math.random().toString(36).slice(2);
 const result = await Promise.race([
-  tools.codex_app__set_thread_title({title:"REPLACE WITH THE REQUIRED TITLE"})
+  tools.codex_app__set_thread_title({title:"REPLACE WITH THE REQUIRED TITLE" + "⁣" + attempt})
     .then(value => ({status:"returned", value}))
     .catch(error => ({status:"failed", error:String(error)})),
   new Promise(resolve => setTimeout(() => resolve({status:"timeout"}), 4000))
 ]);
+if (result.status === "failed") {
+  const recovery = await tools.exec_command({
+    cmd: `THREADBEAR_TITLE_ATTEMPT='${attempt}' ~/.local/bin/threadbear maintenance --cancel "$CODEX_THREAD_ID" --json`,
+    yield_time_ms: 4000, max_output_tokens: 1000
+  });
+  result.recovery = recovery.exit_code === 0 ? "settled" : "failed";
+}
 text(result);
 ```
 
-Make exactly one native attempt. The four-second timer is the total wait budget. If it wins, the write result is unknown: end the cell, never retry or await that promise, and continue the turn. Also continue after an explicit returned failure. Do not call the native title tool directly outside this bounded cell.
+Make exactly one native attempt. The hook strips the opaque attempt suffix before the title reaches Codex. The four-second timer is the native wait budget. If it wins, the write result is unknown: end the cell, never retry or await that promise, never cancel it, and continue the turn. Only an explicit returned failure runs the local recovery command; it clears solely the exact caller's proposal carrying that same attempt ID while native readback still equals its recorded prior title. Continue even when that guarded recovery fails. Do not call the native title tool directly outside this bounded cell.
+
+This bounded current-task shape applies only to the two ordinary title moments above, where `threadId` is omitted. Explicit-target lifecycle mutations are governed by the installed ThreadBear skill instead. Follow that lifecycle's batching and wait rules; do not add this `Promise.race` unless the skill explicitly requires a four-second attempt.
 
 ThreadBear uses that first-call subject only when a fresh task still exposes its raw first message; explicit names, generated short titles, committed subjects, and later user renames remain authoritative. Its hooks expand the compact inputs into the stable visible title. They do not repair stopped turns. If the user stops a turn, the running title remains until the next real turn replaces it.
 

assets/help.txt

@@ -21,6 +21,7 @@ Install flags:
 Migration flags:
   --phase PHASE         migration_running, migration_complete, or migration_failed
   --controller-task-id ID
+  --settled             Confirm a failed wave has no unknown native calls
 
 Maintenance flags:
   --archive TASK_ID      Stage or reconcile one eligible archive