3 people 7adb81672d Address review: a superseded Go never opens a second session ...

An overlay renews its lease right before Go, then captures and uploads
the element before its generate event leaves. When that outlasts the
lease and its result post is lost, a rescuer can claim the target and
Go, and the helper accepted both generate events: two sessions for one
request.

The generate envelope now carries this page's clientId, and the helper
refuses a generate event for a target that another page holds under a
live lease, or that was already answered with a different session
(`served_agent_targets`, recorded on every ok resolution): 409
`agent_target_already_served`, nothing journaled. The overlay treats
that refusal like a foreign session and hands the surface back. The
answering session's own event stays welcome, so the common path (result
post first, then the event) is unchanged.

Tests: two Rust integration cases (rival lease, answered elsewhere,
welcome for the serving session) and a Node protocol case, contract
pins for the envelope and the refusal handling, contract doc.

Written with AI assistance (Claude).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-09-15 05:45:49 +05:00

..

agent_target.rs

Address review: a superseded Go never opens a second session

2026-09-15 05:45:49 +05:00

live_server_security.rs

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

serve_question_security.rs

Fix: use system fonts and the light theme in the picker (#751)

2026-09-06 12:44:15 -07:00