@bermudi/pi-delegate 0.1.13 → 0.1.14

package/lifecycle.ts

@@ -1,4 +1,5 @@
 import * as fs from "node:fs";
+import * as path from "node:path";
 import {
   createAgentSession,
   SessionManager,
@@ -20,7 +21,10 @@ import {
   persistSessionHeader,
 } from "./sessions.ts";
 import { runAgentSession, formatDeadlineExceededError } from "./runner.ts";
-import { getGitChangedFiles } from "./file-tracking.ts";
+import {
+  getGitChangedFiles,
+  projectedAttributionPath,
+} from "./file-tracking.ts";
 import { getHostDeps } from "./host.ts";
 import { resolveCwd, validateResumeFromPath } from "./utils.ts";
 import { getWholeTaskMaxRetries, getWholeTaskBaseDelayMs } from "./config.ts";
@@ -28,6 +32,17 @@ import { addUsage, emptyUsage } from "./usage.ts";
 import { scheduleDeadline } from "./timer.ts";
 import { recordTask } from "./telemetry.ts";
 import { createScratchWorkspace, ScratchDeadlineError } from "./workspace.ts";
+import {
+  isResumeFromIdentityQuarantined,
+  isSessionIdQuarantined,
+  markSessionQuarantined,
+  observeQuarantineSafety,
+  propagateSessionQuarantine,
+  reserveSessionQuarantine,
+  sessionQuarantineOf,
+  withResumeTranscriptLock,
+  type SessionQuarantine,
+} from "./session-quarantine.ts";
 
 /** Internal seam for lifecycle-level tests without replacing session ownership. */
 type RunAgentSession = typeof runAgentSession;
@@ -35,6 +50,10 @@ let runAgentSessionForTesting: RunAgentSession = runAgentSession;
 type CreateScratchWorkspace = typeof createScratchWorkspace;
 let createScratchWorkspaceForTesting: CreateScratchWorkspace =
   createScratchWorkspace;
+type DetachQuarantinedPooledSession =
+  typeof pool._quarantinePooledAgentWithoutDisposal;
+let detachQuarantinedPooledSessionForTesting: DetachQuarantinedPooledSession =
+  pool._quarantinePooledAgentWithoutDisposal;
 
 export function _setRunAgentSessionForTesting(
   override: RunAgentSession | undefined,
@@ -49,6 +68,14 @@ export function _setCreateScratchWorkspaceForTesting(
   createScratchWorkspaceForTesting = override ?? createScratchWorkspace;
 }
 
+/** @internal Simulate a pooled-detachment invariant failure in lifecycle tests. */
+export function _setQuarantinePooledSessionDetachForTesting(
+  override: DetachQuarantinedPooledSession | undefined,
+): void {
+  detachQuarantinedPooledSessionForTesting =
+    override ?? pool._quarantinePooledAgentWithoutDisposal;
+}
+
 /**
  * Test-only overrides for whole-task retry settings. When set, these bypass
  * the config-driven values so retry integration tests don't sleep real seconds.
@@ -86,12 +113,14 @@ function failTask(
   task: ResolvedTask,
   error: string,
   sessionFile?: string,
+  failureKind?: TaskResult["failureKind"],
 ): TaskResult {
   return {
     id: task.id,
     agent: task.agentName,
     output: "",
     error,
+    failureKind,
     durationMs: 0,
     tokens: 0,
     usage: emptyUsage(),
@@ -101,6 +130,66 @@ function failTask(
   };
 }
 
+function scratchSetupFailureResult(
+  task: ResolvedTask,
+  error: unknown,
+  signalAborted: boolean,
+  startedAt: number,
+): TaskResult {
+  let message = error instanceof Error ? error.message : String(error);
+  let failureKind: TaskResult["failureKind"];
+  if (signalAborted) {
+    message = "Aborted";
+    failureKind = "cancelled";
+  } else if (error instanceof ScratchDeadlineError) {
+    message = formatDeadlineExceededError(task.deadlineMs ?? 0);
+    failureKind = "deadline_exceeded";
+  }
+  return {
+    ...failTask(task, message, undefined, failureKind),
+    durationMs: Date.now() - startedAt,
+  };
+}
+
+/** Preserve every core evidence channel when the outer scratch projection
+ * itself fails. Paths cannot be trusted as projected, so structured evidence
+ * is retained verbatim and downgraded to uncertain rather than erased. */
+function scratchProjectionFailureResult(
+  task: ResolvedTask,
+  result: TaskResult | undefined,
+  error: unknown,
+  startedAt: number,
+): TaskResult {
+  const reason = error instanceof Error ? error.message : String(error);
+  const projectionError = `Scratch evidence projection failed: ${reason}`;
+  if (!result) {
+    return {
+      ...failTask(task, projectionError),
+      workspace: "scratch",
+      durationMs: Date.now() - startedAt,
+    };
+  }
+
+  let combinedError = projectionError;
+  if (result.error) combinedError = `${result.error}\n${projectionError}`;
+  const fallback: TaskResult = {
+    ...result,
+    error: combinedError,
+    workspace: "scratch",
+    sessionFile: undefined,
+    durationMs: Math.max(result.durationMs, Date.now() - startedAt),
+    touchedFiles: [...result.touchedFiles],
+    attributedFiles: result.attributedFiles
+      ? [...result.attributedFiles]
+      : undefined,
+    fileAttributions: result.fileAttributions?.map((entry) => ({
+      ...entry,
+      uncertain: true,
+    })),
+  };
+  return propagateSessionQuarantine(result, fallback);
+}
+
 /** Build a successful TaskResult for session-management actions (close/list).
  *  Pass elapsedMs to record wall time since delegate started (matches the live progress UI). */
 function completeSessionAction(
@@ -125,13 +214,80 @@ function completeSessionAction(
  * Pool hits and successfully committed sessions remain pool-owned. */
 function disposeOwnedSession(acquired: AcquiredSession): void {
   if (!acquired.lifecycleOwnsSession) return;
+  disposeSession(acquired.session, "uncommitted subagent");
+}
+
+function disposeSession(session: AgentSession, description: string): void {
   try {
-    acquired.session.dispose();
+    session.dispose();
   } catch (error) {
     // Cleanup must not replace the task's primary result, but it must emit a
     // signal: extension-bearing sessions can retain callbacks/resources when a
     // provider's dispose implementation misbehaves.
-    console.error("[delegate] uncommitted subagent disposal failed", error);
+    console.error(`[delegate] ${description} disposal failed`, error);
+  }
+}
+
+/** Detach an abandoned session from every owner immediately, then dispose it
+ * only after runner's background termination monitor proves quiescence. */
+function quarantineAcquiredSession(
+  task: ResolvedTask,
+  acquired: AcquiredSession,
+  quarantine: SessionQuarantine,
+): void {
+  let mayDisposeAfterSafety = acquired.lifecycleOwnsSession;
+  if (!acquired.lifecycleOwnsSession) {
+    const detached = task.sessionId
+      ? detachQuarantinedPooledSessionForTesting(
+          task.sessionId,
+          acquired.session,
+        )
+      : false;
+    mayDisposeAfterSafety = detached;
+    if (!detached) {
+      // The pool may still index this exact object. Keep its quarantine
+      // reservation fail-closed until safety, but never schedule disposal of an
+      // object that another owner still retains. Once safe, normal pooled reuse
+      // is preferable to poisoning the indexed session with a deferred dispose.
+      console.error(
+        `[delegate] CRITICAL: could not detach abandoned pooled AgentSession${task.sessionId ? ` '${task.sessionId}'` : ""}; retaining the indexed session without disposal until it is safe for pooled reuse`,
+      );
+    }
+  }
+
+  // Publish the admission reservation before this task can return and its
+  // active dispatch reservation is released. task.resumeFrom is already the
+  // canonical path passed to acquisition; never resolve the caller's alias
+  // again here.
+  reserveSessionQuarantine(task, quarantine, task.resumeFrom);
+  console.error(
+    mayDisposeAfterSafety
+      ? `[delegate] AgentSession${task.sessionId ? ` '${task.sessionId}'` : ""} quarantined; deferred disposal is waiting for background quiescence confirmation`
+      : `[delegate] AgentSession${task.sessionId ? ` '${task.sessionId}'` : ""} quarantined; pooled reuse remains blocked until background quiescence confirmation`,
+  );
+  const onSafetyFailure = (error: unknown): void => {
+    // A rejected safety proof is not permission to clean anything.
+    console.error(
+      "[delegate] quarantined AgentSession safety monitor failed; retaining the session indefinitely",
+      error,
+    );
+  };
+  if (mayDisposeAfterSafety) {
+    observeQuarantineSafety(
+      quarantine,
+      "quarantined AgentSession disposal",
+      () => disposeSession(acquired.session, "quarantined subagent"),
+      onSafetyFailure,
+    );
+  } else {
+    // Observe only for a loud monitor failure. No disposal callback may be
+    // attached while the pool still indexes the session object.
+    observeQuarantineSafety(
+      quarantine,
+      "retained pooled AgentSession safety",
+      () => {},
+      onSafetyFailure,
+    );
   }
 }
 
@@ -206,6 +362,7 @@ function updateProgressFromResult(p: TaskProgress, r: TaskResult): void {
   p.tokens = r.tokens;
   p.error = r.error;
   p.failureKind = r.failureKind;
+  p.incomplete = r.incomplete;
 }
 
 /** Outcome of one logical task run: the final result plus how many same-model
@@ -346,6 +503,8 @@ function canRetryWholeTask(
   // restrictive for retry safety — touched-file accounting and observed activity
   // are the direct side-effect signals.
   return (
+    !sessionQuarantineOf(result) &&
+    result.failureKind !== "cancelled" &&
     result.failureKind !== "stalled" &&
     result.failureKind !== "model_error" &&
     result.failureKind !== "deadline_exceeded" &&
@@ -597,6 +756,15 @@ async function acquireAgentSession(
   return createFreshSession(env, task);
 }
 
+let acquireAgentSessionForTesting = acquireAgentSession;
+
+/** @internal Test-only session-acquisition seam. */
+export function _setAcquireAgentSessionForTesting(
+  override: typeof acquireAgentSession | undefined,
+): void {
+  acquireAgentSessionForTesting = override ?? acquireAgentSession;
+}
+
 /**
  * Resolve the `sessionFile` to report on a TaskResult.
  *
@@ -622,21 +790,86 @@ function resolveResumableSessionFile(
 
 /** Run a single resolved task. Single source of truth for the per-task lifecycle.
  *  Used by both sync (params.async === false) and async (params.async === true) paths.
- *  When task.sessionId is set, the entire acquire/run/close lifecycle runs under
- *  a per-session mutex so concurrent tasks with the same sessionId serialize
- *  cleanly. The lock also covers sessionAction='close' and the early-busy/abort paths. */
+ *  sessionId work is serialized by the pool lock; resumeFrom work is also
+ *  serialized by canonical transcript identity. The quarantine check happens
+ *  only after both applicable locks are held, closing the validation-to-run
+ *  race for a queued call. */
 export async function runResolvedTask(
   env: TaskRunEnv,
   task: ResolvedTask,
   p: TaskProgress,
   taskIndex: number,
 ): Promise<TaskResult> {
-  if (task.sessionId) {
-    return pool.withSessionLock(task.sessionId, () =>
-      runResolvedTaskUnlocked(env, task, p, taskIndex),
-    );
-  }
-  return runResolvedTaskUnlocked(env, task, p, taskIndex);
+  return withResumeTranscriptLock(task.resumeFrom, async (transcript) => {
+    let executionTask = task;
+    if (task.resumeFrom) {
+      const resumeFromPathError = validateResumeFromPath(task.resumeFrom);
+      if (resumeFromPathError) {
+        return recordTaskOutcome(
+          env,
+          p,
+          task,
+          finishTask(
+            env,
+            p,
+            failTask(
+              task,
+              `resumeFrom: invalid session path: ${resumeFromPathError}; got ${JSON.stringify(task.resumeFrom)}`,
+            ),
+          ),
+        );
+      }
+      if (!transcript?.canonicalPath || !transcript.exists) {
+        const missingPath =
+          transcript?.lexicalPath ?? resolveCwd(task.resumeFrom);
+        return recordTaskOutcome(
+          env,
+          p,
+          task,
+          finishTask(
+            env,
+            p,
+            failTask(
+              task,
+              `resumeFrom: file not found or could not be resolved: ${missingPath}`,
+              missingPath,
+            ),
+          ),
+        );
+      }
+      // Every check, acquisition, and quarantine publication below uses this
+      // one physical identity. Never consult the caller's mutable alias again.
+      executionTask = { ...task, resumeFrom: transcript.canonicalPath };
+    }
+
+    const runLocked = async (): Promise<TaskResult> => {
+      let quarantineError: string | undefined;
+      if (
+        executionTask.sessionId &&
+        isSessionIdQuarantined(executionTask.sessionId)
+      ) {
+        quarantineError = `SessionId '${executionTask.sessionId}' is quarantined after abandonment. Wait for background safety confirmation before reusing it.`;
+      } else if (
+        executionTask.resumeFrom &&
+        isResumeFromIdentityQuarantined(executionTask.resumeFrom)
+      ) {
+        quarantineError = `resumeFrom transcript '${task.resumeFrom}' is quarantined after abandonment. Wait for background safety confirmation before resuming it.`;
+      }
+      if (quarantineError) {
+        return recordTaskOutcome(
+          env,
+          p,
+          executionTask,
+          finishTask(env, p, failTask(executionTask, quarantineError)),
+        );
+      }
+      return runResolvedTaskUnlocked(env, executionTask, p, taskIndex);
+    };
+
+    return executionTask.sessionId
+      ? pool.withSessionLock(executionTask.sessionId, runLocked)
+      : runLocked();
+  });
 }
 
 async function runResolvedTaskUnlocked(
@@ -696,26 +929,13 @@ async function runResolvedTaskUnlocked(
       deadlineAt,
     );
   } catch (error) {
-    const setupError = error instanceof Error ? error.message : String(error);
-    const deadlineExceeded =
-      !env.signal?.aborted && error instanceof ScratchDeadlineError;
-    return recordTaskOutcome(
-      env,
-      p,
+    const setupFailure = scratchSetupFailureResult(
       task,
-      finishTask(env, p, {
-        ...failTask(
-          task,
-          env.signal?.aborted
-            ? "Aborted"
-            : deadlineExceeded
-              ? formatDeadlineExceededError(task.deadlineMs ?? 0)
-              : setupError,
-        ),
-        failureKind: deadlineExceeded ? "deadline_exceeded" : undefined,
-        durationMs: Date.now() - startedAt,
-      }),
+      error,
+      env.signal?.aborted === true,
+      startedAt,
     );
+    return recordTaskOutcome(env, p, task, finishTask(env, p, setupFailure));
   }
 
   const executionTask: ResolvedTask = {
@@ -734,46 +954,161 @@ async function runResolvedTaskUnlocked(
     // Keep the pre-mapping result in `result` so the catch below can preserve
     // its paid-for counters if path mapping throws mid-rewrite.
     result = outcome.result;
+    const fileAttributions = result.fileAttributions ?? [];
+    const attributionByLexical = new Map(
+      fileAttributions.map((entry) => [path.resolve(entry.lexicalPath), entry]),
+    );
+    const attributedPhysicalPaths = new Set(
+      fileAttributions
+        .filter(
+          (entry) =>
+            entry.preExecutionPhysicalPath !== undefined &&
+            path.resolve(entry.preExecutionPhysicalPath) !==
+              path.resolve(entry.lexicalPath),
+        )
+        .map((entry) => path.resolve(entry.preExecutionPhysicalPath!)),
+    );
+    const logProjectionFailure = (
+      kind: string,
+      candidate: string,
+      error: unknown,
+    ) => {
+      const safeJson = (value: string) =>
+        JSON.stringify(
+          value.length > 1_024
+            ? `${value.slice(0, 1_024)}…[truncated ${value.length - 1_024} chars]`
+            : value,
+        )
+          .replace(/\u2028/g, "\\u2028")
+          .replace(/\u2029/g, "\\u2029");
+      const reason = error instanceof Error ? error.message : String(error);
+      console.error(
+        `[delegate] scratch ${kind} projection failed for ${safeJson(candidate)} (reason=${safeJson(reason)}); retaining conservative lexical evidence`,
+      );
+    };
+    const attributionSettled = await Promise.allSettled(
+      fileAttributions.map((entry) =>
+        workspace.resolveFileAttribution
+          ? workspace.resolveFileAttribution(entry)
+          : Promise.resolve(entry),
+      ),
+    );
+    const projectedAttributions = attributionSettled
+      .map((settled, index) => {
+        if (settled.status === "fulfilled") return settled.value;
+        const entry = fileAttributions[index]!;
+        logProjectionFailure("attribution", entry.lexicalPath, settled.reason);
+        return {
+          ...entry,
+          lexicalPath: workspace.mapPathToSource(entry.lexicalPath),
+          preExecutionPhysicalPath: entry.preExecutionPhysicalPath
+            ? workspace.mapPathToSource(entry.preExecutionPhysicalPath)
+            : undefined,
+          uncertain: true,
+        };
+      })
+      .filter(
+        (entry): entry is NonNullable<typeof entry> => entry !== undefined,
+      );
+    const touchedSettled = await Promise.allSettled(
+      result.touchedFiles.map(async (file) => {
+        const absolute = path.resolve(file);
+        // Preserve this touched-file evidence, but project it lexically: a
+        // realpath now could follow a replacement symlink. attributedFiles
+        // separately decides whether the physical target was disposable.
+        if (attributedPhysicalPaths.has(absolute)) {
+          return workspace.mapPathToSource(absolute);
+        }
+        const attribution = attributionByLexical.get(absolute);
+        if (attribution && workspace.resolveAttributedLexicalTouch) {
+          return workspace.resolveAttributedLexicalTouch(attribution);
+        }
+        return workspace.resolveReportedPath(file);
+      }),
+    );
+    const projectedTouched = touchedSettled
+      .map((settled, index) => {
+        if (settled.status === "fulfilled") return settled.value;
+        const file = result!.touchedFiles[index]!;
+        logProjectionFailure("touched-path", file, settled.reason);
+        return workspace.mapPathToSource(file);
+      })
+      .filter((file): file is string => file !== undefined);
+    let projectedAttributedFiles: string[];
+    if (fileAttributions.length) {
+      projectedAttributedFiles = projectedAttributions.map(
+        projectedAttributionPath,
+      );
+    } else {
+      const legacy = result.attributedFiles ?? [];
+      const legacySettled = await Promise.allSettled(
+        legacy.map((file) => workspace.resolveAttributedPath(file)),
+      );
+      projectedAttributedFiles = legacySettled
+        .map((settled, index) => {
+          if (settled.status === "fulfilled") return settled.value;
+          const file = legacy[index]!;
+          logProjectionFailure("attributed-path", file, settled.reason);
+          return workspace.mapPathToSource(file);
+        })
+        .filter((file): file is string => file !== undefined);
+    }
     result = {
       ...result,
       workspace: "scratch",
       sessionFile: undefined,
-      touchedFiles: await Promise.all(
-        result.touchedFiles.map((file) => workspace.resolveReportedPath(file)),
-      ),
-      // Writes inside scratch are discarded and cannot conflict. Explicit
-      // writes outside scratch (for example an absolute host path) persist and
-      // must remain attributable for overlap warnings. Resolve those paths
-      // physically so aliases to the same host file compare equally.
-      attributedFiles: (
-        await Promise.all(
-          (result.attributedFiles ?? []).map((file) =>
-            workspace.resolveAttributedPath(file),
-          ),
-        )
-      ).filter((file): file is string => file !== undefined),
+      fileAttributions: projectedAttributions,
+      touchedFiles: [
+        ...new Set([
+          ...projectedTouched,
+          ...(fileAttributions.length ? projectedAttributedFiles : []),
+        ]),
+      ],
+      // Certain writes inside scratch are discarded. External and uncertain
+      // evidence remains attributable without re-resolving physical snapshots.
+      attributedFiles: [...new Set(projectedAttributedFiles)],
     };
   } catch (error) {
-    result = {
-      ...failTask(task, error instanceof Error ? error.message : String(error)),
-      ...(result
-        ? {
-            tokens: result.tokens,
-            usage: result.usage,
-          }
-        : {}),
-      workspace: "scratch",
-      durationMs: Date.now() - startedAt,
-    };
+    result = scratchProjectionFailureResult(task, result, error, startedAt);
     // runResolvedTaskCore may already have notified a successful result
     // before path mapping failed. Correct that observable outcome below.
     needsCorrection = true;
   } finally {
-    try {
-      await workspace.cleanup();
-    } catch (error) {
-      cleanupError = `Scratch workspace cleanup failed: ${error instanceof Error ? error.message : String(error)}`;
-      console.error("[delegate] scratch workspace cleanup failed", error);
+    const quarantine = sessionQuarantineOf(result);
+    if (quarantine) {
+      console.error(
+        `[delegate] retaining abandoned scratch workspace '${workspace.scratchRoot}' until its AgentSession is confirmed quiescent`,
+      );
+      observeQuarantineSafety(
+        quarantine,
+        "deferred scratch workspace cleanup",
+        async () => {
+          try {
+            await workspace.cleanup();
+            console.error(
+              `[delegate] safely cleaned deferred scratch workspace '${workspace.scratchRoot}'`,
+            );
+          } catch (error) {
+            console.error(
+              `[delegate] deferred scratch workspace cleanup failed for '${workspace.scratchRoot}'; retaining it`,
+              error,
+            );
+          }
+        },
+        (error) => {
+          console.error(
+            `[delegate] scratch AgentSession safety monitor failed; retaining workspace '${workspace.scratchRoot}' indefinitely`,
+            error,
+          );
+        },
+      );
+    } else {
+      try {
+        await workspace.cleanup();
+      } catch (error) {
+        cleanupError = `Scratch workspace cleanup failed: ${error instanceof Error ? error.message : String(error)}`;
+        console.error("[delegate] scratch workspace cleanup failed", error);
+      }
     }
   }
 
@@ -911,9 +1246,21 @@ function deadlineExceededResult(
     sessionFile: prior?.sessionFile,
     touchedFiles: prior?.touchedFiles ?? [],
     attributedFiles: prior?.attributedFiles ?? [],
+    fileAttributions: prior?.fileAttributions,
   };
 }
 
+function abandonedAcquisitionResult(
+  task: ResolvedTask,
+  timing: AttemptTiming,
+  reason: "parent-aborted" | "deadline",
+): TaskResult {
+  if (reason === "parent-aborted") {
+    return failTask(task, "Aborted", undefined, "cancelled");
+  }
+  return deadlineExceededResult(task, timing);
+}
+
 function noteAttemptProgress(
   env: TaskRunEnv,
   p: TaskProgress,
@@ -986,8 +1333,8 @@ async function settlePooledAttempt(
   // A pre-prompt deadline (runner never called session.prompt()) left
   // the session in its pre-task state, so return it to the pool intact.
   if (
+    r.failureKind === "cancelled" ||
     r.failureKind === "stalled" ||
-    r.error === "Aborted" ||
     (r.failureKind === "deadline_exceeded" && r.prompted !== false)
   ) {
     try {
@@ -1018,6 +1365,99 @@ async function settlePooledAttempt(
   return sessionReleased;
 }
 
+type AcquisitionOutcome =
+  | { status: "acquired"; value: AcquireResult }
+  | { status: "abandoned"; reason: "parent-aborted" | "deadline" };
+
+/**
+ * Wait for materialization only while the task remains live. Host dependency or
+ * session construction can wedge without yielding an AgentSession to abort, so
+ * cancellation/deadline must have an explicit abandoned-acquisition path too.
+ * A session that materializes late is disposed immediately and is never
+ * prompted or pooled.
+ */
+async function awaitSessionAcquisition(
+  acquisition: Promise<AcquireResult>,
+  signal: AbortSignal | undefined,
+  deadlineAt: number | undefined,
+): Promise<AcquisitionOutcome> {
+  let stop!: (reason: "parent-aborted" | "deadline") => void;
+  const stopped = new Promise<"parent-aborted" | "deadline">((resolve) => {
+    stop = resolve;
+  });
+  const onAbort = () => stop("parent-aborted");
+  signal?.addEventListener("abort", onAbort, { once: true });
+  let clearDeadline: (() => void) | undefined;
+  if (deadlineAt !== undefined) {
+    clearDeadline = scheduleDeadline(deadlineAt, () => stop("deadline"));
+  }
+  if (signal?.aborted) onAbort();
+  else if (deadlineAt !== undefined && Date.now() >= deadlineAt)
+    stop("deadline");
+
+  try {
+    return await Promise.race([
+      acquisition.then((value): AcquisitionOutcome => ({
+        status: "acquired",
+        value,
+      })),
+      stopped.then((reason): AcquisitionOutcome => ({
+        status: "abandoned",
+        reason,
+      })),
+    ]);
+  } finally {
+    clearDeadline?.();
+    signal?.removeEventListener("abort", onAbort);
+  }
+}
+
+/** Publish ownership for an acquisition that outlived its task. The safety
+ * promise intentionally uses no polling timer: a construction promise that
+ * never settles retains the reservation but cannot by itself keep Node alive.
+ * A late lifecycle-owned session must finish disposal before safety fulfills. */
+function quarantineAbandonedAcquisition(
+  task: ResolvedTask,
+  acquisition: Promise<AcquireResult>,
+): SessionQuarantine {
+  const safe = acquisition.then(
+    async (late) => {
+      if ("error" in late || !late.lifecycleOwnsSession) return;
+      try {
+        // AgentSession.dispose is currently synchronous, but awaiting its
+        // runtime return also handles extension implementations that perform
+        // asynchronous teardown or reject.
+        await (late.session.dispose as unknown as () => void | Promise<void>)();
+      } catch (error) {
+        console.error(
+          "[delegate] late abandoned subagent disposal failed; retaining quarantine",
+          error,
+        );
+        throw error;
+      }
+    },
+    (error) => {
+      // Rejection proves that acquisition produced no session. Handle it here
+      // so the abandoned promise can never become an unhandled rejection.
+      try {
+        console.error(
+          "[delegate] abandoned subagent acquisition settled with an error",
+          error,
+        );
+      } catch {
+        // Logging replacements must not turn a safely settled acquisition into
+        // a rejected safety proof.
+      }
+    },
+  );
+  const quarantine = { safe };
+  // Publish before returning the terminal task result. This bridges shared
+  // admission from the active dispatch reservation to quarantine atomically.
+  // task.resumeFrom is the exact identity supplied to acquisition.
+  reserveSessionQuarantine(task, quarantine, task.resumeFrom);
+  return quarantine;
+}
+
 /** Acquire, prompt, and settle one attempt. Mutates `accounting` on success. */
 async function runTaskAttempt(
   env: TaskRunEnv,
@@ -1032,7 +1472,24 @@ async function runTaskAttempt(
     noteAttemptProgress(env, p, u, timing, accounting);
   };
 
-  const acquired = await acquireAgentSession(env, task, p);
+  const acquisition = acquireAgentSessionForTesting(env, task, p);
+  const acquisitionOutcome = await awaitSessionAcquisition(
+    acquisition,
+    env.signal,
+    timing.deadlineAt,
+  );
+  if (acquisitionOutcome.status === "abandoned") {
+    // Acquisition itself is not cancellable upstream. Its quarantine remains
+    // active until the promise settles and any late session finishes disposal.
+    const quarantine = quarantineAbandonedAcquisition(task, acquisition);
+    const result = abandonedAcquisitionResult(
+      task,
+      timing,
+      acquisitionOutcome.reason,
+    );
+    return markSessionQuarantined(result, quarantine);
+  }
+  const acquired = acquisitionOutcome.value;
   if ("error" in acquired) return acquired.error;
 
   // A pool hit is already owned by the pool. Fresh/resumed sessions belong
@@ -1045,7 +1502,7 @@ async function runTaskAttempt(
     // cancelled ticket should not even start the subagent (no file writes, no
     // pool insert).
     if (env.signal?.aborted) {
-      return failTask(task, "Aborted");
+      return failTask(task, "Aborted", undefined, "cancelled");
     }
 
     // Snapshot git status before the run so touchedFiles can diff after.
@@ -1072,21 +1529,33 @@ async function runTaskAttempt(
     // collecting post-prompt evidence. Keep cancellation from looking like
     // success; finally below releases any uncommitted session.
     if (env.signal?.aborted && !r.error) {
-      r = { ...r, error: "Aborted" };
+      r = { ...r, error: "Aborted", failureKind: "cancelled" };
     }
 
-    const sessionFile = resolveResumableSessionFile(
-      acquired.sessionFile,
-      acquired.sessionManager,
-      r.error,
-    );
-
-    sessionReleased = await settlePooledAttempt(
-      task,
-      acquired,
-      r,
-      sessionReleased,
-    );
+    const quarantine = sessionQuarantineOf(r);
+    // Persisting or advertising a resumable transcript while its session is
+    // still mutating would create another owner of unsafe state.
+    const sessionFile = quarantine
+      ? undefined
+      : resolveResumableSessionFile(
+          acquired.sessionFile,
+          acquired.sessionManager,
+          r.error,
+        );
+
+    if (quarantine) {
+      quarantineAcquiredSession(task, acquired, quarantine);
+      // Neither lifecycle nor pool owns it now. The deferred safety callback is
+      // the sole owner and finally below must not dispose it early.
+      sessionReleased = true;
+    } else {
+      sessionReleased = await settlePooledAttempt(
+        task,
+        acquired,
+        r,
+        sessionReleased,
+      );
+    }
 
     accounting.accumulatedUsage = addUsage(
       accounting.accumulatedUsage,
@@ -1094,7 +1563,7 @@ async function runTaskAttempt(
     );
     accounting.cumulativeToolUses += attemptToolUsesObserved;
 
-    return {
+    return propagateSessionQuarantine(r, {
       id: task.id,
       agent: task.agentName,
       output: r.output,
@@ -1110,13 +1579,15 @@ async function runTaskAttempt(
         (r.error && isModelAttributableError(r.error)
           ? "model_error"
           : undefined),
+      incomplete: r.incomplete,
       durationMs: r.durationMs,
       tokens: r.tokens,
       usage: r.usage,
       sessionFile,
       touchedFiles: r.touchedFiles,
       attributedFiles: r.attributedFiles ?? [],
-    };
+      fileAttributions: r.fileAttributions,
+    });
   } finally {
     // This runs for ordinary success, normal provider failure, whole-task
     // retry attempts, abort races, stalls, and unexpected throws. Pool hits
@@ -1210,7 +1681,7 @@ async function runWithWholeTaskRetries(
       // while recording that the retry loop was aborted. The task already
       // paid for every completed attempt, including the one before sleep;
       // counters are reconciled by the single return below.
-      result = { ...result, error: "Aborted" };
+      result = { ...result, error: "Aborted", failureKind: "cancelled" };
       break;
     }
 
@@ -1247,7 +1718,11 @@ async function runResolvedTaskCore(
 ): Promise<TaskOutcome> {
   try {
     if (env.signal?.aborted) {
-      return finishTask(env, p, failTask(task, "Aborted"));
+      return finishTask(
+        env,
+        p,
+        failTask(task, "Aborted", undefined, "cancelled"),
+      );
     }
 
     // Primary busy validation is in execute() before ticket creation.