@caupulican/pi-adaptative 0.81.37 → 0.81.39

package/dist/core/background-lane-controller.js

@@ -14,7 +14,9 @@
  * delegations; goal auto-continue itself only ever asks the session to `continueGoalLoop`, so this
  * controller never touches `prompt()`, the last-assistant-message, retry, or streaming state.
  */
+import { createHash } from "node:crypto";
 import path from "node:path";
+import { configFile, getWorkRoot, sessionsDir, stateDir } from "./agent-paths.js";
 import { createLaneToolSurface } from "./autonomy/lane-tool-surface.js";
 import { LaneTracker } from "./autonomy/lane-tracker.js";
 import { safeRealpathSync } from "./autonomy/path-scope.js";
@@ -22,30 +24,89 @@ import { appendLaneRecordSnapshot, getLaneRecordSnapshots } from "./autonomy/ses
 import { composeSubagentSystemPrompt } from "./autonomy/subagent-prompt.js";
 import { AUTONOMY_TELEMETRY_EVENT_TYPES } from "./autonomy/telemetry-events.js";
 import { applyWorkerActions } from "./delegation/worker-actions.js";
+import { reviewManagedLaneChangedFiles } from "./delegation/worker-result.js";
 import { runWorker } from "./delegation/worker-runner.js";
 import { deriveModelCapabilityProfile, scaleContinuationBudgetsForCapability, } from "./model-capability.js";
 import { resolveCliModel } from "./model-resolver.js";
 import { FitnessStore } from "./models/fitness-store.js";
+import { registerInFlightWork } from "./reload-blockers.js";
 import { runModelFitnessProbe } from "./research/model-fitness.js";
 import { runResearch } from "./research/research-runner.js";
 const WORKER_HANDOFF_TIMEOUT_MS = 30_000;
 export function clampLaneMaxUsd(settingsMaxUsd, foregroundMaxEstimatedUsd) {
     return Math.min(settingsMaxUsd, foregroundMaxEstimatedUsd ?? Number.POSITIVE_INFINITY);
 }
+/**
+ * Deterministic `addSpawnedUsage` reportId: `kind` + session id + a content hash of `identity`
+ * (never `Date.now`/random). Same identity on a retry of the same logical work unit yields the same
+ * id, so the ledger's `seenSubagentReportIds` dedupe catches a duplicate report instead of
+ * double-counting spend.
+ */
+function deriveSpawnedUsageReportId(kind, sessionId, identity) {
+    const digest = createHash("sha256").update(identity).digest("hex").slice(0, 16);
+    return `${kind}:${sessionId}:${digest}`;
+}
 export function getPrivateLaneDeniedPaths(cwd, agentDir) {
     return [
-        "auth.json",
-        "MEMORY.md",
-        "USER.md",
-        "settings.json",
-        "models.json",
-        "trust.json",
-        "sessions",
-        "state",
-        "work",
-    ]
-        .map((entry) => path.join(agentDir, entry))
-        .concat(path.join(cwd, ".pi", "settings.json"));
+        configFile(agentDir, "auth.json"),
+        configFile(agentDir, "MEMORY.md"),
+        configFile(agentDir, "USER.md"),
+        configFile(agentDir, "settings.json"),
+        configFile(agentDir, "models.json"),
+        // trust.json now lives under state/ -- covered by the whole-state-dir
+        // denial below instead of its own root-level entry.
+        sessionsDir(agentDir),
+        stateDir(agentDir),
+        getWorkRoot(agentDir),
+    ].concat(path.join(cwd, ".pi", "settings.json"));
+}
+const KNOWN_LANE_TERMINAL_STATUSES = new Set([
+    "succeeded",
+    "failed",
+    "canceled",
+    "timeout",
+    "budget_exhausted",
+]);
+/**
+ * Resolves a managed lane's caller-reported terminal `status` (a free-form CLAIM — e.g. a tmux job's
+ * own "done"/"blocked" completion marker, a lifecycle tag like "dismissed", or a raw
+ * {@link WorkerResultStatus} spelling) onto the LaneTracker's {@link LaneTerminalStatus} vocabulary.
+ * Mirrors the same success/blocked mapping direction `worker-runner.ts` already uses for in-process
+ * workers ("completed"/"done" -> succeeded, "blocked" -> failed). An unrecognized or missing status is
+ * conservatively reported as `"failed"` rather than silently assumed successful (claims-to-review).
+ */
+export function resolveManagedLaneTerminalStatus(status) {
+    if (status !== undefined && KNOWN_LANE_TERMINAL_STATUSES.has(status)) {
+        return status;
+    }
+    switch (status) {
+        case "done":
+        case "completed":
+            return "succeeded";
+        case "blocked":
+            return "failed";
+        case "dismissed":
+        case "cancelled":
+            return "canceled";
+        default:
+            return "failed";
+    }
+}
+/** Maps a LaneTracker terminal status onto the WorkerResult status vocabulary a managed-lane claim
+ * snapshot is persisted under — the two enums use different spellings/values, never interchangeable
+ * (e.g. `"canceled"` vs `"cancelled"`); `timeout`/`budget_exhausted` have no dedicated WorkerResult
+ * counterpart and are conservatively reported as `"failed"`. */
+export function mapManagedLaneTerminalStatus(status) {
+    switch (status) {
+        case "succeeded":
+            return "completed";
+        case "canceled":
+            return "cancelled";
+        case "failed":
+        case "timeout":
+        case "budget_exhausted":
+            return "failed";
+    }
 }
 export function isLocalExecutionModel(model) {
     if (model.provider === "ollama" || model.provider === "transformers" || model.provider === "llama-cpp") {
@@ -89,7 +150,35 @@ export class BackgroundLaneController {
     _workersCompletedSinceFlush = 0;
     _workersFailedSinceFlush = 0;
     _workerTerminalSinceFlush = [];
+    /** Live per-lane mutation ledger for a RUNNING worker — the SAME `toolChangedFiles` Set its
+     * `afterToolCall` hook mutates, plus a spend getter and the originating request. Read
+     * synchronously by `abortInFlightLanes()`'s disposal cutoff, the only provably-safe write window
+     * for a mid-flight cancellation (see that method); deleted there (consumed-ledger guard against
+     * the post-await disposed branch re-persisting) or in the lane's own `finally` on a normal exit. */
+    _inFlightWorkerLedgers = new Map();
+    /** Reload-gate deregister function for a worker queued (not yet running) behind a
+     * contending local-execution foreground model. Registered at enqueue so `/reload` waits for
+     * queued work too, not just running work; deregistered exactly once, either on disposal
+     * (`abortInFlightLanes`) or at the running handoff (`drainQueuedWorkerDelegations`). A laneId with
+     * no entry here (e.g. seeded directly into `_queuedWorkers` by a test) is simply untracked —
+     * deregistration is best-effort by design, never required. */
+    _queuedWorkerDeregisters = new Map();
+    /** Dispatch -> terminal correlation for out-of-process managed lanes (`pi.reportManagedLane`
+     * host bridge), keyed by the CALLER's own `laneId` (e.g. a tmux job id) — distinct from the
+     * internal `LaneTracker` id it maps to. Removed on the matching terminal report so a duplicate or
+     * unmatched terminal call is a safe no-op instead of a double-deregister or an orphaned entry. */
+    _managedLaneDispatches = new Map();
     deps;
+    /** Emit a warning without ever throwing — used from disposal-adjacent persistence where a
+     * listener failure (or a bare test double missing `emit`) must never block or crash cleanup. */
+    _safeWarn(message) {
+        try {
+            this.deps.emit({ type: "warning", message });
+        }
+        catch {
+            // Dispose must never throw.
+        }
+    }
     _scheduleWorkerNotification() {
         if (this._disposed || this._workerNotificationScheduled)
             return;
@@ -174,28 +263,181 @@ export class BackgroundLaneController {
     getLaneRecords() {
         return this._laneTracker.getRecords();
     }
+    /**
+     * Resolve a tracked managed-lane dispatch's internal `LaneTracker` id from the CALLER's own
+     * `laneId` (the id passed to `recordManagedLane`'s `phase: "dispatch"`, e.g. a reconstructed
+     * `tmux:jobId:agentId`). A deterministic, non-racy keyed lookup against `_managedLaneDispatches` —
+     * NOT a `getLaneRecords()` diff — for a caller (e.g. the goal-to-tmux dispatch adapter) that just
+     * minted the dispatch and needs the internal id `Requirement.boundLaneId`/`inFlightGoalLaneIds`
+     * actually match. `undefined` once the dispatch has gone terminal (removed from the map) or was
+     * never tracked.
+     */
+    resolveManagedLaneId(callerLaneId) {
+        return this._managedLaneDispatches.get(callerLaneId)?.laneId;
+    }
     /** Live count of active lanes — the real source for AutonomyStatusSnapshot.activeLaneCount. */
     getActiveLaneCount() {
         return this._laneTracker.getActiveCount();
     }
+    /** Belt-and-braces guard: whether ANY queued/running lane is tagged with this goalId. */
+    _hasInFlightLaneForGoal(goalId) {
+        return this.getLaneRecords().some((record) => record.goalId === goalId && (record.status === "queued" || record.status === "running"));
+    }
+    /**
+     * Host-side bridge for `pi.reportManagedLane`: makes an out-of-process managed lane (e.g. a tmux
+     * worker) a first-class lane in THIS process's LaneTracker. HONEST cross-process seam — the
+     * extension only ever REPORTS a claim; this controller stays the lane-tracking SSOT (no in-process
+     * sandboxing is implied by accepting the report).
+     *
+     * `phase: "dispatch"` mints a `tmux-worker` lane record (goalId-tagged) and registers exactly one
+     * reload-quiesce unit for it. `phase: "terminal"` resolves the caller's free-form `status` claim
+     * onto {@link LaneTerminalStatus} (see {@link resolveManagedLaneTerminalStatus}), completes that
+     * same record, deregisters the quiesce unit (inside a `finally` — never left stuck regardless of
+     * what persistence below does), and persists a bounded worker-result CLAIM snapshot from the
+     * reported `changedFiles`. Host re-review: the reported `changedFiles` are re-checked against
+     * the session's active capability envelope ({@link reviewManagedLaneChangedFiles}, reusing
+     * `validateWorkerResult`'s symlink-safe scope check verbatim) and `parentReviewRequired` is
+     * stamped on the persisted claim whenever that check does not cleanly "allow" -- an out-of-scope
+     * (or no-scope-configured) path is flagged exactly like an in-scope one, since a tmux worker's
+     * write never passed through this process's enforcement in the first place. This is the SESSION
+     * envelope, not a per-launch tmux standing grant (that is a narrower, launch-specific scope;
+     * documented follow-up, not yet implemented). `event.request` stays an unvalidated
+     * caller-supplied bag (per its own doc comment) and is deliberately never read for scoping. A
+     * terminal report for an unknown `laneId` (no matching dispatch tracked) and a duplicate dispatch
+     * for an already-tracked `laneId` are both safe no-ops — never a double registration, a double
+     * persisted claim, or a crash.
+     *
+     * Returns the minted (`phase: "dispatch"`) or completed (`phase: "terminal"`) LaneRecord for an
+     * in-process caller that wants the record without a second `getLaneRecords()` read (e.g. a
+     * faux-bridge test, or the goal-to-tmux dispatch adapter via `resolveManagedLaneId`); `undefined`
+     * on every no-op path (disposed controller, duplicate dispatch, unknown-laneId terminal). The
+     * extension-facing `ExtensionActions.reportManagedLane` TYPE stays `=> void` -- that call site is a
+     * fire-and-forget statement and is unaffected by this return.
+     */
+    recordManagedLane(event) {
+        if (this.deps.isDisposed())
+            return undefined;
+        if (event.phase === "dispatch") {
+            if (this._managedLaneDispatches.has(event.laneId))
+                return undefined;
+            this._seedLaneHistory();
+            const record = this._laneTracker.start({
+                type: "tmux-worker",
+                goalId: event.goalId,
+                worktreeLaneKey: event.worktreeLaneKey,
+            });
+            const deregister = registerInFlightWork(this.deps.getAgentDir(), "lane", `tmux:${record.laneId}`);
+            this._managedLaneDispatches.set(event.laneId, { laneId: record.laneId, deregister });
+            return record;
+        }
+        const dispatch = this._managedLaneDispatches.get(event.laneId);
+        if (!dispatch)
+            return undefined;
+        this._managedLaneDispatches.delete(event.laneId);
+        try {
+            const resolvedStatus = resolveManagedLaneTerminalStatus(event.status);
+            const record = this._laneTracker.complete(dispatch.laneId, {
+                status: resolvedStatus,
+                reasonCode: event.reasonCode,
+                costUsd: event.usage?.cost.total,
+            });
+            if (!record)
+                return undefined;
+            appendLaneRecordSnapshot(this.deps.getSessionManager(), record);
+            const changedFiles = event.changedFiles ? [...event.changedFiles] : [];
+            const review = reviewManagedLaneChangedFiles({
+                changedFiles,
+                envelope: this.deps.getCapabilityEnvelope() ?? {},
+                cwd: this.deps.getCwd(),
+            });
+            const result = {
+                requestId: dispatch.laneId,
+                status: mapManagedLaneTerminalStatus(resolvedStatus),
+                summary: `Managed tmux-worker lane ${dispatch.laneId} reported terminal status "${event.status ?? "unknown"}"${event.reasonCode ? ` (${event.reasonCode})` : ""}.${review.reviewRequired ? ` Changed files require parent review (${review.reasonCode}).` : ""}`,
+                changedFiles,
+                parentReviewRequired: review.reviewRequired,
+                createdAt: new Date().toISOString(),
+            };
+            this.deps.saveWorkerResultSnapshot(result);
+            return record;
+        }
+        finally {
+            dispatch.deregister();
+        }
+    }
     /** Why the last idle research-lane evaluation skipped, for /autonomy diagnostics. */
     getLastResearchLaneSkipReason() {
         return this._lastResearchLaneSkipReason;
     }
-    /** Abort any in-flight research pass or delegated worker (called on session dispose). */
+    /**
+     * Abort any in-flight research pass or delegated worker (called on session dispose).
+     *
+     * This synchronous body is the LAST provably-safe write window for canceled/in-flight work.
+     * `dispose()` (agent-session.ts) has already set the session's own disposed flag but has not yet
+     * returned — no successor session (e.g. a `/reload` adoption) can exist yet, so an append here
+     * cannot interleave with one; a post-await continuation resuming AFTER this method returns must
+     * not append (see the disposed branch in `runWorkerDelegationOnce`). Persist FIRST, then
+     * complete-in-memory, so a throw from one lane's persist cannot skip another's; each persist gets
+     * its own try/catch — dispose must never throw.
+     */
     abortInFlightLanes() {
         this._disposed = true;
         this._researchLaneAbort.abort();
         this._workerDelegationAbort.abort();
-        this._queuedWorkers.clear();
         for (const record of this._laneTracker.getRecords()) {
-            if (record.status === "queued" || record.status === "running") {
-                this._laneTracker.complete(record.laneId, {
-                    status: "canceled",
-                    reasonCode: "session_disposed",
-                });
+            if (record.status !== "queued" && record.status !== "running")
+                continue;
+            const canceled = this._laneTracker.complete(record.laneId, {
+                status: "canceled",
+                reasonCode: "session_disposed",
+            });
+            if (!canceled)
+                continue;
+            try {
+                appendLaneRecordSnapshot(this.deps.getSessionManager(), canceled);
+            }
+            catch (error) {
+                this._safeWarn(`Failed to persist canceled lane record ${canceled.laneId}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (canceled.type !== "worker")
+                continue;
+            // Only a RUNNING worker ever registers a ledger (a queued-never-started worker has none;
+            // its cancellation is already fully captured by the lane record above). Consumed
+            // (deleted) here so the post-await disposed branch never re-persists it.
+            const ledger = this._inFlightWorkerLedgers.get(record.laneId);
+            if (!ledger)
+                continue;
+            this._inFlightWorkerLedgers.delete(record.laneId);
+            try {
+                const spend = ledger.getSpend();
+                const reportId = `worker:${this.deps.getSessionId()}:${record.laneId}`;
+                const result = {
+                    requestId: ledger.request.id,
+                    status: "cancelled",
+                    summary: "canceled on session dispose",
+                    changedFiles: [...ledger.changedFiles],
+                    usageReportId: reportId,
+                    createdAt: new Date().toISOString(),
+                };
+                // Bounded honesty: spend may be incomplete (it lands only when the isolated completion
+                // returns, which a mid-flight abort preempts) — record what `getSpend()` knows. Same
+                // deterministic reportId scheme as the normal path, so a later duplicate report (there
+                // is none in practice here, since the lane is now terminal) stays idempotent.
+                this.deps.saveWorkerResultSnapshot(result, ledger.request);
+                if (spend && (spend.cost.total > 0 || spend.totalTokens > 0)) {
+                    this.deps.addSpawnedUsage(spend, { label: "worker-delegation", reportId });
+                }
+            }
+            catch (error) {
+                this._safeWarn(`Failed to persist canceled worker result ${record.laneId}: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
+        // A queued (never-started) worker's reload-gate registration ends here on cancellation;
+        // the other end is the running handoff in `drainQueuedWorkerDelegations`.
+        for (const deregister of this._queuedWorkerDeregisters.values())
+            deregister();
+        this._queuedWorkerDeregisters.clear();
+        this._queuedWorkers.clear();
         this._workerNotificationScheduled = false;
         this._workerTerminalSinceFlush.length = 0;
     }
@@ -219,6 +461,14 @@ export class BackgroundLaneController {
         const snapshot = this.deps.getGoalRuntimeSnapshot({ maxStallTurns });
         if (snapshot.continuation.action !== "continue")
             return;
+        // Belt-and-braces: the snapshot above is already lane-aware (a bound in-flight worker
+        // yields action:"waiting", already caught by the check above), so this direct lane check is
+        // redundant in the normal case. It stays as an explicit second gate so a future change that
+        // decouples the lane injection from THIS snapshot read can never silently reopen the idle
+        // re-dispatch race this guard closes.
+        const activeGoalId = snapshot.goalState?.goalId;
+        if (activeGoalId !== undefined && this._hasInFlightLaneForGoal(activeGoalId))
+            return;
         this.clearGoalAutoContinueTimer();
         this._goalAutoContinueTimer = setTimeout(() => {
             this._goalAutoContinueTimer = undefined;
@@ -241,14 +491,16 @@ export class BackgroundLaneController {
         const snapshot = this.deps.getGoalRuntimeSnapshot({ maxStallTurns });
         if (snapshot.continuation.action !== "continue")
             return;
-        // Lean-window models (16-32k) keep autosteer but at a reduced budget; full passes through.
+        // Budget scaling by capability class; note that since the lean class stopped exposing the
+        // goal tool at all, sub-full sessions are skipped outright by the goal_tool_unavailable
+        // guard in continueGoalLoopExclusive -- the lean budget branch below only matters if that
+        // blocklist is ever relaxed. Full passes through unchanged.
         const scaled = scaleContinuationBudgetsForCapability(this.deps.getModelCapabilityProfile(), {
             maxTurns: goalContinueTurns,
             maxWallClockMinutes: goalContinueMaxWallClockMinutes,
         });
-        this._isGoalAutoContinuing = true;
         try {
-            await this.deps.continueGoalLoop({
+            await this.continueGoalLoopExclusive({
                 maxTurns: scaled.maxTurns,
                 maxStallTurns,
                 maxWallClockMinutes: scaled.maxWallClockMinutes,
@@ -258,10 +510,48 @@ export class BackgroundLaneController {
             const message = error instanceof Error ? error.message : String(error);
             this.deps.emit({ type: "warning", message: `Goal auto-continuation failed: ${message}` });
         }
+    }
+    /**
+     * Single-flight entry point for EVERY goal-continuation loop invocation — idle autosteer
+     * ({@link _runScheduledGoalAutoContinue}) AND the manual `/goal start` / `/goal-continue`
+     * commands (reached through `AgentSession.continueGoalLoop`). Both paths ultimately submit
+     * continuation prompts through the session's single `prompt()` path, so two loops racing throws
+     * "Agent is already processing" from whichever submits second. `_isGoalAutoContinuing` is the
+     * ONE owner of that mutex; `deps.continueGoalLoop` (the raw {@link GoalLoopController} loop)
+     * must never be called directly outside this method, or the guard is bypassed.
+     */
+    async continueGoalLoopExclusive(options) {
+        if (this._isGoalAutoContinuing)
+            return this._skippedGoalResult(options, "already_continuing");
+        if (this.deps.isDisposed())
+            return this._skippedGoalResult(options, "session_disposed");
+        // Adaptative prevails: a session whose active surface lacks the goal tool cannot execute
+        // continuation prompts -- driving the loop anyway would ENFORCE complex agentic work on a
+        // model/role that cannot perform it. One gate here covers idle autosteer AND manual /goal
+        // paths (both funnel through this single-flight guard).
+        if (!this.deps.isGoalToolActive())
+            return this._skippedGoalResult(options, "goal_tool_unavailable");
+        this._isGoalAutoContinuing = true;
+        try {
+            return await this.deps.continueGoalLoop(options);
+        }
         finally {
             this._isGoalAutoContinuing = false;
         }
     }
+    /**
+     * A full {@link GoalContinuationLoopResult} for a continuation request that never ran a pass
+     * (another loop already owns the mutex, or the session is disposed). Keeps the skip path
+     * type-identical to a real pass — no separate skip union — so every caller keeps reading
+     * `result.stopReason`/`result.finalSnapshot` unchanged.
+     */
+    _skippedGoalResult(options, stopReason) {
+        return {
+            turnsSubmitted: 0,
+            stopReason,
+            finalSnapshot: this.deps.getGoalRuntimeSnapshot({ maxStallTurns: options.maxStallTurns }),
+        };
+    }
     clearResearchLaneTimer() {
         if (this._researchLaneTimer !== undefined) {
             clearTimeout(this._researchLaneTimer);
@@ -482,6 +772,9 @@ export class BackgroundLaneController {
         this._seedLaneHistory();
         const startedRecord = this._laneTracker.start({ type: "research", goalId: demand.goalId });
         this._persistedResearchRunCount++;
+        // Registered for the lane's full run so the reload gate waits it out; deregistered in the
+        // finally below no matter how this lane terminates (success, disposal, or a thrown error).
+        const deregisterInFlight = registerInFlightWork(this.deps.getAgentDir(), "lane", `research:${startedRecord.laneId}`);
         try {
             let spentUsage;
             // Best-effort, pointer-first workspace evidence. Derives search terms from the goal/requirement
@@ -527,6 +820,9 @@ export class BackgroundLaneController {
                         signal,
                         // Core/soul/role are all static per configuration — the provider can cache the prefix.
                         cacheRetention: "short",
+                        // Stable per-lane synthetic affinity key so repeat research calls route to the
+                        // same cache-warm backend without carrying the real session id.
+                        laneKind: "research",
                     });
                     spentUsage = completion.usage;
                     return {
@@ -536,7 +832,7 @@ export class BackgroundLaneController {
                     };
                 },
             });
-            // Bug #21 pattern: if the session was disposed while the completion was in flight, do NOT
+            // If the session was disposed while the completion was in flight, do NOT
             // persist evidence/records/usage against the dead session.
             if (this.deps.isDisposed()) {
                 const record = this._laneTracker.complete(startedRecord.laneId, {
@@ -563,7 +859,7 @@ export class BackgroundLaneController {
             });
             if (record) {
                 appendLaneRecordSnapshot(this.deps.getSessionManager(), record);
-                // G3: a research lane's product is an evidence bundle, so its terminal record maps to
+                // A research lane's product is an evidence bundle, so its terminal record maps to
                 // the evidence_bundle event. Lane outcome only (status/reasonCode/cost) — no findings text.
                 this.deps.emitAutonomyTelemetry({
                     type: AUTONOMY_TELEMETRY_EVENT_TYPES.evidenceBundle,
@@ -606,6 +902,7 @@ export class BackgroundLaneController {
         }
         finally {
             this._isResearchLaneRunning = false;
+            deregisterInFlight();
         }
     }
     /**
@@ -637,8 +934,11 @@ export class BackgroundLaneController {
                 this._laneTracker.getActiveCount("worker") >= settings.maxConcurrent + 8) {
                 return { started: false, skipReason: "worker_delegation_queue_full" };
             }
-            const record = this._laneTracker.enqueue({ type: "worker" });
+            const record = this._laneTracker.enqueue({ type: "worker", goalId: this.deps.getGoalStateSnapshot()?.goalId });
             this._queuedWorkers.set(record.laneId, request);
+            // Register the reload-gate quiesce unit at ENQUEUE (not at the later running handoff)
+            // so `/reload` waits for queued-but-not-yet-started work too, matching running workers.
+            this._queuedWorkerDeregisters.set(record.laneId, registerInFlightWork(this.deps.getAgentDir(), "lane", `worker-queued:${record.laneId}`));
             this._scheduleWorkerNotification();
             return { started: true, record };
         }
@@ -689,7 +989,8 @@ export class BackgroundLaneController {
             return { started: false, skipReason: "model_delegation_unsupported" };
         }
         this._seedLaneHistory();
-        const startedRecord = existingRecord ?? this._laneTracker.start({ type: "worker" });
+        const startedRecord = existingRecord ??
+            this._laneTracker.start({ type: "worker", goalId: this.deps.getGoalStateSnapshot()?.goalId });
         if (existingRecord)
             this._laneTracker.markRunning(existingRecord.laneId);
         onStarted?.(startedRecord);
@@ -737,7 +1038,7 @@ export class BackgroundLaneController {
             maxEstimatedUsd: maxUsd,
             createdAt: new Date().toISOString(),
         };
-        // G8: worker delegation START. Routing/scope codes + budget only — never the instructions text.
+        // Worker delegation START. Routing/scope codes + budget only — never the instructions text.
         this.deps.emitAutonomyTelemetry({
             type: AUTONOMY_TELEMETRY_EVENT_TYPES.workerRequest,
             timestamp: new Date().toISOString(),
@@ -749,10 +1050,25 @@ export class BackgroundLaneController {
             },
         });
         const usageReportId = `worker:${this.deps.getSessionId()}:${startedRecord.laneId}`;
+        // Registered for the lane's full run so the reload gate waits it out; deregistered in the
+        // finally below no matter how this lane terminates (success, disposal, or a thrown error).
+        // registerInFlightWork is a pure sync map op (cannot throw), so placing it as the last
+        // statement before `try` still guarantees the matching finally always runs.
+        const deregisterInFlight = registerInFlightWork(this.deps.getAgentDir(), "lane", `worker:${startedRecord.laneId}`);
         try {
             let spentUsage;
             const toolChangedFiles = new Set();
             const toolIssues = new Set();
+            // Register the live mutation ledger BEFORE the suspend point below so a synchronous
+            // disposal cutoff (`abortInFlightLanes`) can read a race-free snapshot of whatever this
+            // worker has already applied — the worker is suspended at the `await runWorker(...)` below
+            // whenever abort runs, and the abort signal stops further tool calls. Deleted in the
+            // `finally` on every exit path (normal completion, throw, or already consumed by abort).
+            this._inFlightWorkerLedgers.set(startedRecord.laneId, {
+                changedFiles: toolChangedFiles,
+                getSpend: () => spentUsage,
+                request: workerRequest,
+            });
             const outcome = await runWorker({
                 request: workerRequest,
                 maxUsd,
@@ -762,7 +1078,7 @@ export class BackgroundLaneController {
                 signal: this._workerDelegationAbort.signal,
                 // Parent validation must use the same relative-path baseline the runner reports in.
                 cwd: this.deps.getCwd(),
-                // Write lane (G2): runner-side action application through the envelope path scope.
+                // Write lane: runner-side action application through the envelope path scope.
                 applyActions: workerRequest.envelope.capabilities.includes("write_files")
                     ? (actions) => {
                         const permitted = actions.filter((action) => allowedActionOps.has(action.op));
@@ -827,7 +1143,7 @@ export class BackgroundLaneController {
                                         catch {
                                             // Execution was attempted; preserve conservative accounting with the lexical path.
                                         }
-                                        toolChangedFiles.add(path.relative(this.deps.getCwd(), canonicalPath));
+                                        toolChangedFiles.add(path.relative(this.deps.getCwd(), canonicalPath).split(path.sep).join("/"));
                                     }
                                 }
                             }
@@ -840,6 +1156,9 @@ export class BackgroundLaneController {
                         signal,
                         // Core/soul/role are all static per configuration — the provider can cache the prefix.
                         cacheRetention: "short",
+                        // Stable per-lane synthetic affinity key so repeat worker-delegation calls route to
+                        // the same cache-warm backend without carrying the real session id.
+                        laneKind: "worker",
                     });
                     spentUsage = completion.usage;
                     return {
@@ -851,7 +1170,11 @@ export class BackgroundLaneController {
                     };
                 },
             });
-            // Bug #21 pattern: never persist against a disposed session.
+            // Never persist against a disposed session. When disposal raced this
+            // await, `abortInFlightLanes()`'s synchronous cutoff already completed this lane, persisted
+            // its durable lane record + bounded WorkerResult, and consumed (deleted) the ledger —
+            // `.complete()` below is then a no-op (the lane is already terminal, so it returns
+            // undefined) and no double persistence or duplicate terminal notification can happen here.
             if (this.deps.isDisposed()) {
                 const record = this._laneTracker.complete(startedRecord.laneId, {
                     status: "canceled",
@@ -873,7 +1196,7 @@ export class BackgroundLaneController {
             if (record) {
                 this._recordWorkerTerminal(record);
                 appendLaneRecordSnapshot(this.deps.getSessionManager(), record);
-                // G3: worker lane terminal record -> worker_result event. Lane outcome only
+                // Worker lane terminal record -> worker_result event. Lane outcome only
                 // (status/reasonCode/cost) — never the worker's summary/changed-file text.
                 this.deps.emitAutonomyTelemetry({
                     type: AUTONOMY_TELEMETRY_EVENT_TYPES.workerResult,
@@ -915,6 +1238,8 @@ export class BackgroundLaneController {
             return { started: true, record };
         }
         finally {
+            this._inFlightWorkerLedgers.delete(startedRecord.laneId);
+            deregisterInFlight();
         }
     }
     /**
@@ -930,69 +1255,93 @@ export class BackgroundLaneController {
         if (!resolved)
             return { started: false, skipReason: "model_unresolved_or_unauthenticated" };
         const capability = this._laneCapabilityProfile(resolved);
-        const spent = {
-            input: 0,
-            output: 0,
-            cacheRead: 0,
-            cacheWrite: 0,
-            totalTokens: 0,
-            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
-        };
-        const report = await runModelFitnessProbe({
-            trials: args.trials,
-            signal: this._researchLaneAbort.signal,
-            capacityProbe: resolved.provider === "ollama" && resolved.contextWindow > 0
-                ? { registeredContextWindow: resolved.contextWindow }
-                : undefined,
-            complete: async ({ systemPrompt, userPrompt, signal }) => {
-                const callStarted = Date.now();
-                const completion = await this.deps.runIsolatedCompletion({
-                    systemPrompt,
-                    messages: [{ role: "user", content: [{ type: "text", text: userPrompt }], timestamp: Date.now() }],
-                    model: resolved,
-                    thinkingLevel: "off",
-                    maxTokens: capability.laneMaxOutputTokens,
-                    signal,
-                    cacheRetention: "short",
-                });
-                const callMs = Date.now() - callStarted;
-                spent.input += completion.usage.input;
-                spent.output += completion.usage.output;
-                spent.cacheRead += completion.usage.cacheRead;
-                spent.cacheWrite += completion.usage.cacheWrite;
-                spent.totalTokens += completion.usage.totalTokens;
-                spent.cost.input += completion.usage.cost.input;
-                spent.cost.output += completion.usage.cost.output;
-                spent.cost.cacheRead += completion.usage.cost.cacheRead;
-                spent.cost.cacheWrite += completion.usage.cost.cacheWrite;
-                spent.cost.total += completion.usage.cost.total;
-                return {
-                    text: completion.text,
-                    costUsd: completion.usage.cost.total,
-                    stopReason: String(completion.stopReason),
-                    // Wall-clock fallback for tok/s: providers don't expose pure eval time, so the
-                    // measured call time stands in — slightly conservative (includes network/queue).
-                    outputTokens: completion.usage.output,
-                    evalMs: callMs,
-                };
-            },
-        });
-        if (!this.deps.isDisposed() && (spent.cost.total > 0 || spent.totalTokens > 0)) {
-            this.deps.addSpawnedUsage(spent, { label: "model-fitness" });
-        }
-        const modelRef = `${resolved.provider}/${resolved.id}`;
-        // Fitness is a property of a model ON a host — persist the report host-keyed so role
-        // assignments stay per-machine (a model can await better hardware without being forgotten).
-        // Best-effort: a disk problem must not fail the probe itself.
+        // Registered for the probe's full run (it can execute several isolated-completion trials)
+        // so the reload gate waits it out; deregistered in the finally below on any exit path. Unlike
+        // research/worker, a fitness probe is not tracked in `_laneTracker` (it has no persisted lane
+        // record), so this registry is its ONLY reload-gate visibility.
+        const deregisterInFlight = registerInFlightWork(this.deps.getAgentDir(), "lane", `fitness:${resolved.provider}/${resolved.id}`);
         try {
-            if (!this.deps.isDisposed()) {
-                FitnessStore.forAgentDir(this.deps.getAgentDir()).save(modelRef, report);
+            const spent = {
+                input: 0,
+                output: 0,
+                cacheRead: 0,
+                cacheWrite: 0,
+                totalTokens: 0,
+                cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+            };
+            const report = await runModelFitnessProbe({
+                trials: args.trials,
+                signal: this._researchLaneAbort.signal,
+                capacityProbe: resolved.provider === "ollama" && resolved.contextWindow > 0
+                    ? { registeredContextWindow: resolved.contextWindow }
+                    : undefined,
+                complete: async ({ systemPrompt, userPrompt, signal }) => {
+                    const callStarted = Date.now();
+                    const completion = await this.deps.runIsolatedCompletion({
+                        systemPrompt,
+                        messages: [{ role: "user", content: [{ type: "text", text: userPrompt }], timestamp: Date.now() }],
+                        model: resolved,
+                        thinkingLevel: "off",
+                        maxTokens: capability.laneMaxOutputTokens,
+                        signal,
+                        cacheRetention: "short",
+                        // Stable per-lane synthetic affinity key so repeat fitness-probe trials against the
+                        // same candidate model route to the same cache-warm backend without carrying the real
+                        // session id.
+                        laneKind: "fitness",
+                    });
+                    const callMs = Date.now() - callStarted;
+                    spent.input += completion.usage.input;
+                    spent.output += completion.usage.output;
+                    spent.cacheRead += completion.usage.cacheRead;
+                    spent.cacheWrite += completion.usage.cacheWrite;
+                    spent.totalTokens += completion.usage.totalTokens;
+                    spent.cost.input += completion.usage.cost.input;
+                    spent.cost.output += completion.usage.cost.output;
+                    spent.cost.cacheRead += completion.usage.cost.cacheRead;
+                    spent.cost.cacheWrite += completion.usage.cost.cacheWrite;
+                    spent.cost.total += completion.usage.cost.total;
+                    return {
+                        text: completion.text,
+                        costUsd: completion.usage.cost.total,
+                        stopReason: String(completion.stopReason),
+                        // Wall-clock fallback for tok/s: providers don't expose pure eval time, so the
+                        // measured call time stands in — slightly conservative (includes network/queue).
+                        outputTokens: completion.usage.output,
+                        evalMs: callMs,
+                    };
+                },
+            });
+            const modelRef = `${resolved.provider}/${resolved.id}`;
+            if (!this.deps.isDisposed() && (spent.cost.total > 0 || spent.totalTokens > 0)) {
+                // Prefer the LLM tool-call id as the idempotency token: it is assigned once per
+                // distinct model_fitness tool call, so two deliberately separate calls on the same
+                // (model, trials) get DISTINCT ids (both count) while a retry of the same tool call
+                // (same toolCallId) keeps the same id (deduped). Callers with no toolCallId (the manual
+                // /fitness command, the auto-probe-on-model-add flows in local-model-commands.ts) fall
+                // back to the (model, trials) identity, unchanged from before.
+                const identity = args.toolCallId
+                    ? `toolcall:${args.toolCallId}`
+                    : `${modelRef} ${args.trials ?? "default"}`;
+                const reportId = deriveSpawnedUsageReportId("model-fitness", this.deps.getSessionId(), identity);
+                this.deps.addSpawnedUsage(spent, { label: "model-fitness", reportId });
             }
+            // Fitness is a property of a model ON a host — persist the report host-keyed so role
+            // assignments stay per-machine (a model can await better hardware without being forgotten).
+            // Best-effort: a disk problem must not fail the probe itself.
+            try {
+                if (!this.deps.isDisposed()) {
+                    FitnessStore.forAgentDir(this.deps.getAgentDir()).save(modelRef, report);
+                }
+            }
+            catch {
+                // best-effort persistence
+            }
+            return { started: true, model: modelRef, report };
         }
-        catch {
-            // best-effort persistence
+        finally {
+            deregisterInFlight();
         }
-        return { started: true, model: modelRef, report };
     }
     /** Start queued local workers at the owner session's foreground-idle boundary. */
     drainQueuedWorkerDelegations() {
@@ -1001,11 +1350,19 @@ export class BackgroundLaneController {
                 this.deps.getSettingsManager().getWorkerDelegationSettings().maxConcurrent)
                 break;
             const record = this._laneTracker.getRecords().find((candidate) => candidate.laneId === laneId);
+            // The queued-phase reload-gate registration ends here, at the running handoff, no
+            // matter which branch below runs. `runWorkerDelegationOnce` registers its OWN "running"
+            // unit independently and synchronously (no `await` separates the two calls), so there is
+            // no window where this lane is invisible to the reload gate.
+            const deregisterQueued = this._queuedWorkerDeregisters.get(laneId);
+            this._queuedWorkerDeregisters.delete(laneId);
             if (!record) {
                 this._queuedWorkers.delete(laneId);
+                deregisterQueued?.();
                 continue;
             }
             this._queuedWorkers.delete(laneId);
+            deregisterQueued?.();
             const promise = this.runWorkerDelegationOnce(request, undefined, record);
             this._workerPromises.set(laneId, promise);
             void promise.then((outcome) => {