Add capability-gated adoption for disconnected client-owned sessions

[rynfar]

Problem

A new Pylon server process cannot safely adopt a still-running Prime client_owned worker. Prime gives each DaemonClient a fresh in-memory owner identity, hides client-owned workers from other clients, and rejects a new client's attach. Disconnect also starts the owned-worker cleanup window. Pylon issue #84 therefore cannot be fixed with the current public list/attach/watch APIs.

promote_owned_session is not an acceptable substitute. It removes private owner scoping and makes the worker resident without proving recovery authority.

Required outcome

Add a frozen SDK feature and negotiated daemon capability for recoverable client-owned adoption. The exact token name is chosen with the implementation, but the contract must:

• create a recoverable client-owned worker with an opaque, high-entropy recovery handle that is never returned by list/snapshot or written to logs;
• durably bind the handle to the exact worker, private session, active-session lineage, supervisor generation, and correlated prompt lifecycle;
• atomically adopt and attach only after the old owner transport is gone;
• fence the old owner from reconnecting or mutating after adoption;
• allow exactly one authority when adopters race;
• make retry after an adopter crash converge without stranding a one-shot rotated token;
• return a coherent generation-aware snapshot/cursor plus the exact correlated lifecycle state before recovered events are released;
• transfer the connection-scoped MCP owner/credential atomically for an active streaming worker;
• retain active recoverable work beyond the existing disconnect grace, with bounded terminal/unclaimed cleanup;
• preserve authoritative complete_owned_session and cleanup proof after adoption.

Version 1 may require the same retained supervisor process and exact supervisor generation. A daemon/supervisor replacement, partial replay, or unavailable continuity fails closed.

Compatibility and security

• Gate every new wire shape by negotiated protocol/schema/capability. Allocate the next free schema revision at implementation time; do not preclaim a revision against other open branches.
• Old clients and supervisors must keep current behavior and cannot accidentally enable adoption.
• Wrong, expired, other-session, stale-generation, live-owner, or concurrent-loser handles fail without disclosing that a worker exists.
• Do not expose recovery handles, native identities, correlations, paths, prompts, snapshots, tool data, or transport details through public events or logs.
• Adoption is full-access only. Approval-required sessions retain their current fail-closed behavior.

Acceptance coverage

• disconnected old owner → exact handle adopts the same active worker; prompt count remains one;
• old owner is fenced; two concurrent adopters yield one mutating authority;
• adopter crash before response can retry without losing the worker;
• live owner, wrong/expired handle, stale generation, partial replay, malformed snapshot, and mismatched lifecycle all fail closed;
• exact MCP ownership transfers before any recovered event is exposed;
• completion, cleanup, child/queue join, adoption, and supervisor-shutdown races converge without leaks;
• mixed current/stock directions retain existing behavior;
• public serialization and log canaries contain none of the private recovery material.

Dependencies and scope

• Land snapshot-generation isolation in fix(coding-agent): finish mixed-version snapshot catch-up isolation #21 / PR fix(coding-agent): isolate snapshot catch-up failures #19 first.
• Pylon's exact admission/session-incarnation lineage is tracked by pylon#175 / PR fix tui flicker when attaching to long or streaming sessions PrimeIntellect-ai/prime-agent#192.
• Pylon also needs a provenance-checked fork artifact/install path before it can depend on this capability.
• Pylon-side private persistence, daemon retention, exact-once lifecycle/checkpoint settlement, and restart integration stay in pylon#84.

Non-goals: Comet, nonpersistent_daemon_worker_v1, resident promotion, cross-host state copying, approval-required adoption, and Windows native transport authentication.

[rynfar]

Implementation started on clean branch feat/recoverable-owned-session-adoption from exact origin/pylon 63fb578aace412da02c999e383b7dde8c9a84f3a. Current protocol is 7/schema 29, so revision 30 is free today and will be rechecked immediately before allocation.

The audited v1 is deliberately narrow: full-access client_owned, same retained supervisor generation, two-phase snapshot-replacement adoption, atomic MCP owner-tag transfer, ownership-generation fencing, retryable handle rotation, bounded disconnected retention, exact cleanup proof, and one generic non-enumerating failure. It will not promote to resident, replay a prompt, create a replacement worker, cross supervisor generations/hosts, enable approval-required adoption, or claim Windows native security.

Implementation is isolated from dirty #20 and all Comet work. Capability advertisement remains off until protocol, authority store, fencing, snapshot/event ordering, MCP transfer, crash/race, mixed-version, cleanup, and privacy tests pass. No push or PR exists yet.