@caupulican/pi-adaptative 0.86.3 → 0.86.6

package/dist/core/delegation/worker-delegation-controller.js

@@ -1,12 +1,16 @@
 import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { getProcessWorkRun } from "../agent-paths.js";
 import { getPrivateLaneDeniedPaths } from "../autonomy/lane-private-paths.js";
 import { createLaneToolSurface } from "../autonomy/lane-tool-surface.js";
+import { isLaneTerminalStatus } from "../autonomy/lane-tracker.js";
 import { appendLaneRecordSnapshot } from "../autonomy/session-lane-record.js";
 import { AUTONOMY_TELEMETRY_EVENT_TYPES } from "../autonomy/telemetry-events.js";
 import { STABLE_SHELL_TOOL_NAME } from "../default-tool-surface.js";
 import { deriveModelCapabilityProfile } from "../model-capability.js";
 import { isLoopbackModelEndpoint } from "../models/model-endpoint.js";
 import { providerUsageFromAttemptUsage } from "../orchestration/attempt-usage.js";
+import { MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH, } from "../orchestration/contracts.js";
 import { SessionTaskProfileStore } from "../orchestration/session-task-profile-store.js";
 import { TaskProfileWriter, } from "../orchestration/task-profile-writer.js";
 import { createWorkerExecutionContract, verifierWorkerExecutionContract, } from "../orchestration/worker-execution-contract.js";
@@ -14,20 +18,25 @@ import { registerInFlightWork } from "../reload-blockers.js";
 import { createDelegateToolDefinition } from "../tools/delegate.js";
 import { disposePersistentShellSession } from "../tools/shell-session.js";
 import { wrapToolDefinition } from "../tools/tool-definition-wrapper.js";
+import { selectSanitizedContextFork } from "./sanitized-context-fork.js";
 import { applyWorkerActions } from "./worker-actions.js";
 import { WorkerAgentControlCoordinator } from "./worker-agent-control-coordinator.js";
 import { createWorkerAttemptExecutor } from "./worker-attempt-executor.js";
 import { resolveWorkerAuthority } from "./worker-authority-resolver.js";
+import { WorkerContextForkStore, WorkerContextForkStoreError } from "./worker-context-fork-store.js";
+import { resolveWorkerContextInheritanceMode } from "./worker-context-inheritance-policy.js";
 import { WorkerConversationStore, } from "./worker-conversation-store.js";
 import { parseWorkerDelegationAuthorityRequest } from "./worker-delegation-request.js";
 import { WorkerDispatchScheduler } from "./worker-dispatch-scheduler.js";
 import { buildWorkerExecutionPlan, compileWorkerExecutionGrant, narrowWorkerExecutionPlan, workerExecutionAuthorityFromPlan, } from "./worker-execution-policy.js";
+import { DEFAULT_WORKER_FLEET_LIMITS, evaluateNewWorkerAdmission, pendingVerifierSubjectTaskIds, } from "./worker-fleet-limits.js";
 import { createLocalWorkerProcessOwnerId } from "./worker-process-owner.js";
 import { WorkerProfileResolver } from "./worker-profile-resolver.js";
 import { WorkerRecoveryCoordinator } from "./worker-recovery-coordinator.js";
 import { selectWorkerResourcePointers } from "./worker-resource-catalog.js";
 import { materializeWorkerResourceBundle } from "./worker-resource-materializer.js";
 import { finalizeWorkerClaim } from "./worker-terminal-finalizer.js";
+import { WorkerTerminalHandoffCoordinator, } from "./worker-terminal-handoff-coordinator.js";
 import { collectWorkerTreeBudgetSeeds, WorkerTreeBudgetCoordinator } from "./worker-tree-budget-coordinator.js";
 import { WorkerWriteReservationCoordinator } from "./worker-write-reservation-coordinator.js";
 export function isLocalExecutionModel(model) {
@@ -57,36 +66,39 @@ function workerConversationRetentionPolicy(model, settingsManager) {
         keepRecentTokens: Math.max(1, Math.min(settings.keepRecentTokens, Math.floor(contextWindow * 0.5), maxContextTokens - 1)),
     };
 }
+function workerContextModelIdentity(modelRef) {
+    if (!modelRef)
+        throw new Error("Worker parent resume model is missing.");
+    const separator = modelRef.indexOf("/");
+    if (separator <= 0 || separator === modelRef.length - 1) {
+        throw new Error("Worker parent resume model is invalid.");
+    }
+    return { provider: modelRef.slice(0, separator), model: modelRef.slice(separator + 1) };
+}
 export class WorkerDelegationController {
     constructor(deps, notifications, lifecycle) {
         this.workerAbort = new AbortController();
         this.laneAbortControllers = new Map();
         this.shellSessionKeys = new Set();
         this.publishedTerminalAttemptIds = new Set();
-        this.yieldedCapacityAttemptIds = new Set();
+        this.yieldedCapacityAttemptIds = new Map();
         this.conversations = new WorkerConversationStore();
         this.treeBudgets = new WorkerTreeBudgetCoordinator();
         this.inFlightLedgers = new Map();
         this.deps = deps;
         this.notifications = notifications;
         this.lifecycle = lifecycle;
+        this.contextForks = new WorkerContextForkStore({
+            agentDir: this.deps.getAgentDir(),
+            parentSessionId: this.deps.getSessionId(),
+        });
         this.scheduler = new WorkerDispatchScheduler({
             agentDir: this.deps.getAgentDir?.() ?? "",
             isDisposed: () => this.deps.isDisposed(),
             admit: (request, record) => this.workerDispatchAdmission(request, record),
             getRecord: (laneId) => this.getWorkerLifecycle().getRecord(laneId),
             run: (request, record) => this.runOnce(request, undefined, record),
-            cancel: (laneId, reasonCode) => {
-                try {
-                    this.writeReservations.release(laneId);
-                    const terminal = this.getWorkerLifecycle().cancel(laneId, reasonCode);
-                    if (terminal)
-                        this.publishTerminalRecord(terminal);
-                }
-                catch (error) {
-                    this.safeWarn(`Failed to cancel durable worker ${laneId}: ${error instanceof Error ? error.message : String(error)}`);
-                }
-            },
+            cancel: (laneId, reasonCode) => this.cancelScheduledWorker(laneId, reasonCode),
             warn: (message) => this.safeWarn(message),
         });
         this.recovery = new WorkerRecoveryCoordinator({
@@ -94,19 +106,33 @@ export class WorkerDelegationController {
             scheduler: this.scheduler,
             recoverWriteReservations: () => this.writeReservations.recoverProvenStale(),
             publishTerminalRecord: (record) => this.publishTerminalRecord(record),
+            publishTerminalRecords: (records) => this.publishRecoveredTerminalRecords(records),
             dispatchVerification: (recovery) => this.dispatchRecoveredVerification(recovery),
+            recoverTaskBearingMailboxTurns: () => this.agentControl.reconcileTaskBearingMailboxTurns(),
+            recoverSessionRootReplies: () => this.agentControl.reconcileSessionRootReplies(),
+            retryReady: () => {
+                if (this.deps.isDisposed())
+                    return;
+                this.scheduler.drain();
+                this.terminalHandoffs.signal();
+                this.notifications.statusChanged();
+            },
             warn: (message) => this.safeWarn(message),
         });
         this.agentControl = new WorkerAgentControlCoordinator({
             agentDir: this.deps.getAgentDir(),
             parentSessionId: this.deps.getSessionId(),
             processOwnerId: createLocalWorkerProcessOwnerId(process.pid, randomUUID()),
+            conversationStore: this.conversations,
             isControlAvailable: () => this.deps.isDelegateToolActive(),
             getLifecycle: () => this.getWorkerLifecycle(),
             recoveredRequest: (attempt) => this.recovery.recoveredRequest(attempt),
             run: (request, record) => this.runOnce(request, undefined, record),
             scheduler: this.scheduler,
-            statusChanged: () => this.notifications.statusChanged(),
+            statusChanged: () => {
+                this.terminalHandoffs.signal();
+                this.notifications.statusChanged();
+            },
             abortLane: (laneId, reasonCode) => this.laneAbortControllers.get(laneId)?.abort(reasonCode),
             cancelLane: (laneId, reasonCode) => {
                 this.scheduler.dropQueued(laneId);
@@ -114,10 +140,26 @@ export class WorkerDelegationController {
                 const terminal = this.getWorkerLifecycle().cancel(laneId, reasonCode);
                 if (terminal)
                     this.publishTerminalRecord(terminal);
+                if (terminal && !this.deps.isDisposed())
+                    this.scheduler.drain();
                 return terminal;
             },
+            taskStartHeadroomSkipReason: (agent) => {
+                const contract = this.lifecycle.getLatestAgentAttempt(agent.agentId)?.dispatch.executionContract;
+                return contract
+                    ? this.workerProjectionHeadroomSkipReason(contract)
+                    : "orchestration_execution_contract_missing";
+            },
             yieldCapacity: (callerAgentId, targetAgentId) => this.yieldWorkerCapacity(callerAgentId, targetAgentId),
+            warn: (message) => this.safeWarn(message),
+        });
+        this.terminalHandoffs = new WorkerTerminalHandoffCoordinator({
+            deliver: (handoff) => this.deliverTerminalHandoff(handoff),
+            onDeliveryError: (handoff, error) => {
+                this.safeWarn(`Worker terminal handoff for ${handoff.record.laneId} failed: ${error instanceof Error ? error.message : String(error)}`);
+            },
         });
+        this.agentControl.reconcileSessionRootReplies();
         this.writeReservations = new WorkerWriteReservationCoordinator({
             agentDir: this.deps.getAgentDir(),
             getCwd: () => this.deps.getCwd(),
@@ -138,6 +180,33 @@ export class WorkerDelegationController {
             // Disposal and recovery diagnostics must never throw.
         }
     }
+    cancelScheduledWorker(laneId, reasonCode) {
+        try {
+            this.writeReservations.release(laneId);
+        }
+        catch (error) {
+            this.safeWarn(`Failed to release worker ${laneId} before cancellation: ${error instanceof Error ? error.message : String(error)}`);
+            throw error;
+        }
+        let terminal;
+        try {
+            terminal = this.getWorkerLifecycle().cancel(laneId, reasonCode);
+        }
+        catch (error) {
+            this.safeWarn(`Failed to cancel durable worker ${laneId}: ${error instanceof Error ? error.message : String(error)}`);
+            throw error;
+        }
+        if (!terminal)
+            return;
+        try {
+            this.publishTerminalRecord(terminal);
+        }
+        catch (error) {
+            // The durable cancellation is authoritative. Publication remains recoverable from its
+            // pending notification and must not make the scheduler requeue a terminal attempt.
+            this.safeWarn(`Failed to publish canceled worker ${laneId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     /** Narrow model-facing control port. It owns control state; this controller only composes it. */
     getAgentControl() {
         return this.agentControl;
@@ -173,12 +242,27 @@ export class WorkerDelegationController {
         this.lifecycle.markNotificationsDelivered(notificationIds);
     }
     abort() {
-        this.workerAbort.abort();
+        this.runTeardownStep("abort worker execution", () => this.workerAbort.abort());
         // Bound attempts have an authoritative transcript and agent identity. A normal owner-session
         // shutdown is an execution interruption, not an explicit worker cancellation: fence it into
         // suspended state before the abort continuation can observe the signal.
-        const suspendedAttemptIds = new Set(this.lifecycle.suspendBoundInProcessAttemptsForRestart(this.agentControl.getProcessOwnerId()));
-        for (const record of this.lifecycle.getRecords()) {
+        const suspendedAttemptIds = new Set();
+        try {
+            for (const attemptId of this.lifecycle.suspendBoundInProcessAttemptsForRestart(this.agentControl.getProcessOwnerId())) {
+                suspendedAttemptIds.add(attemptId);
+            }
+        }
+        catch (error) {
+            this.safeWarn(`Failed to persist worker restart suspension during teardown: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        let records = [];
+        try {
+            records = this.lifecycle.getRecords();
+        }
+        catch (error) {
+            this.safeWarn(`Failed to inspect durable worker records during teardown: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        for (const record of records) {
             if (record.status !== "queued" && record.status !== "running")
                 continue;
             const ledger = this.inFlightLedgers.get(record.laneId);
@@ -235,11 +319,24 @@ export class WorkerDelegationController {
                 this.safeWarn(`Failed to persist canceled worker claim ${record.laneId}: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
-        this.scheduler.cancelQueued();
-        this.writeReservations.dispose();
-        for (const shellSessionKey of this.shellSessionKeys)
-            disposePersistentShellSession(shellSessionKey);
+        this.inFlightLedgers.clear();
+        this.runTeardownStep("cancel queued worker dispatches", () => this.scheduler.cancelQueued());
+        this.runTeardownStep("dispose worker recovery", () => this.recovery.dispose());
+        this.runTeardownStep("dispose worker terminal handoffs", () => this.terminalHandoffs.dispose());
+        this.runTeardownStep("dispose worker write reservations", () => this.writeReservations.dispose());
+        for (const shellSessionKey of this.shellSessionKeys) {
+            this.runTeardownStep(`dispose worker shell ${shellSessionKey}`, () => disposePersistentShellSession(shellSessionKey));
+        }
         this.shellSessionKeys.clear();
+        this.runTeardownStep("clear worker conversation cache", () => this.conversations.clearCache());
+    }
+    runTeardownStep(label, step) {
+        try {
+            step();
+        }
+        catch (error) {
+            this.safeWarn(`Failed to ${label}: ${error instanceof Error ? error.message : String(error)}`);
+        }
     }
     getWorkerLifecycle() {
         return this.lifecycle;
@@ -285,6 +382,8 @@ export class WorkerDelegationController {
     /** Reconcile the session goal into an already-loaded worker runtime without defeating lazy UAC. */
     synchronizeGoalState(goal) {
         this.publishGoalTerminalRecords(this.lifecycle.synchronizeGoalState(goal));
+        if (goal.status === "active" && !this.deps.isDisposed())
+            this.scheduler.drain();
     }
     publishGoalTerminalRecords(records) {
         for (const record of records) {
@@ -292,6 +391,8 @@ export class WorkerDelegationController {
             this.laneAbortControllers.get(record.laneId)?.abort("goal_terminal");
             this.publishTerminalRecord(record);
         }
+        if (records.length > 0 && !this.deps.isDisposed())
+            this.scheduler.drain();
     }
     dispatchRecoveredVerification(recovery) {
         const legacyImplementation = recovery.verifierExecutionContract
@@ -334,9 +435,45 @@ export class WorkerDelegationController {
         if (!profile.requireIndependentVerification)
             return { ok: true };
         const resolved = this.getWorkerProfileResolver().resolveVerifier(profile);
-        return resolved.ok
-            ? { ok: true, shipment: resolved.resolved }
-            : { ok: false, skipReason: `independent_verifier_unavailable:${resolved.reason}` };
+        if (!resolved.ok)
+            return { ok: false, skipReason: `independent_verifier_unavailable:${resolved.reason}` };
+        // Fresh verifier profiles pass through the same shipment admission owner as fresh workers.
+        // Recovery-pinned verifier contracts bypass this path and preserve their immutable grant.
+        const admitted = resolveWorkerAuthority({
+            base: resolved.resolved,
+            modelRegistry: this.deps.getModelRegistry(),
+            isModelExhausted: (model) => this.deps.isModelExhausted(model),
+        });
+        return admitted.ok
+            ? { ok: true, shipment: admitted.shipment }
+            : { ok: false, skipReason: `independent_verifier_unavailable:${admitted.reason}` };
+    }
+    /**
+     * A descendant may select a different routing profile, but that preset cannot introduce context
+     * its ancestor never admitted. Pointer ids alone are insufficient authority: retain only pointers
+     * whose complete immutable metadata matches the ancestral contract, and require exact soul text.
+     */
+    narrowWorkerShipmentContext(shipment, boundary) {
+        const boundaryPointers = new Map(boundary.resourcePointers.map((pointer) => [pointer.id, pointer]));
+        const resourcePointers = [];
+        for (const pointer of shipment.resourcePointers) {
+            const inherited = boundaryPointers.get(pointer.id);
+            if (!inherited || !isDeepStrictEqual(inherited, pointer)) {
+                return { ok: false, skipReason: "orchestration_context_authority_exceeded" };
+            }
+            resourcePointers.push(structuredClone(inherited));
+        }
+        if (shipment.soul !== undefined && shipment.soul !== boundary.soul) {
+            return { ok: false, skipReason: "orchestration_context_authority_exceeded" };
+        }
+        return {
+            ok: true,
+            shipment: {
+                ...shipment,
+                resourcePointers,
+                ...(shipment.soul ? { soul: shipment.soul } : {}),
+            },
+        };
     }
     hasExactRecursiveCycle(parentAgentId, instructions, profileId) {
         const normalizedInstructions = instructions.trim();
@@ -355,6 +492,17 @@ export class WorkerDelegationController {
         }
         return false;
     }
+    /** Reject a new logical identity before creating its task, transcript, agent, or queue entry. */
+    newWorkerFleetSkipReason(request, requiredAgentSlots = 1) {
+        const decision = evaluateNewWorkerAdmission(this.lifecycle.getTaskRuntimeSnapshot().agents, request.parentAgentId, DEFAULT_WORKER_FLEET_LIMITS, requiredAgentSlots);
+        return decision.ok ? undefined : decision.reasonCode;
+    }
+    requiredAgentSlotsForAdmission(request, admission) {
+        const pendingVerifierSubjects = pendingVerifierSubjectTaskIds(this.lifecycle.getTaskRuntimeSnapshot());
+        if (request.verificationOfTaskId)
+            pendingVerifierSubjects.delete(request.verificationOfTaskId);
+        return 1 + pendingVerifierSubjects.size + (admission.verifierShipment ? 1 : 0);
+    }
     /** Single admission contract shared by enqueue, scheduler revalidation, and execution. */
     resolveWorkerAdmission(request, pinnedContract) {
         if (this.deps.isDisposed())
@@ -421,7 +569,13 @@ export class WorkerDelegationController {
             });
         if (!adaptive.ok)
             return { ok: false, skipReason: adaptive.reason };
-        const shipment = adaptive.shipment;
+        let shipment = adaptive.shipment;
+        if (parentContract) {
+            const narrowed = this.narrowWorkerShipmentContext(shipment, parentContract.worker);
+            if (!narrowed.ok)
+                return narrowed;
+            shipment = narrowed.shipment;
+        }
         if (parentAgent && this.hasExactRecursiveCycle(parentAgent.agentId, instructions, shipment.profile.profileId)) {
             return { ok: false, skipReason: "recursive_delegation_cycle" };
         }
@@ -445,6 +599,13 @@ export class WorkerDelegationController {
                 return verifier;
             verifierShipment = verifier.shipment;
         }
+        if (verifierShipment && parentContract) {
+            const verifierBoundary = parentContract.verifier ?? parentContract.worker;
+            const narrowed = this.narrowWorkerShipmentContext(verifierShipment, verifierBoundary);
+            if (!narrowed.ok)
+                return narrowed;
+            verifierShipment = narrowed.shipment;
+        }
         if (!this.laneCapabilityProfile(shipment.model).backgroundLanesEnabled) {
             return { ok: false, skipReason: "model_delegation_unsupported" };
         }
@@ -463,6 +624,13 @@ export class WorkerDelegationController {
         const executionPlan = inheritedAuthority
             ? narrowWorkerExecutionPlan(inheritedAuthority, currentExecutionPlan)
             : currentExecutionPlan;
+        const verifierExecutionPlan = verifierShipment
+            ? this.buildWorkerExecutionPlan(verifierShipment.profile, settings)
+            : undefined;
+        const inheritedVerifierAuthority = parentContract?.verifier?.authority ?? parentContract?.worker.authority;
+        const boundedVerifierExecutionPlan = verifierExecutionPlan && inheritedVerifierAuthority
+            ? narrowWorkerExecutionPlan(inheritedVerifierAuthority, verifierExecutionPlan)
+            : verifierExecutionPlan;
         const executionContract = pinnedContract ??
             createWorkerExecutionContract({
                 worker: {
@@ -473,7 +641,7 @@ export class WorkerDelegationController {
                     ? {
                         verifier: {
                             ...verifierShipment,
-                            authority: workerExecutionAuthorityFromPlan(this.buildWorkerExecutionPlan(verifierShipment.profile, settings)),
+                            authority: workerExecutionAuthorityFromPlan(boundedVerifierExecutionPlan),
                         },
                     }
                     : {}),
@@ -490,69 +658,155 @@ export class WorkerDelegationController {
         };
     }
     buildVerifierRequest(args) {
-        const artifacts = args.artifactUris.slice(0, 100).map((uri) => `- ${uri}`);
+        const prefix = [
+            `Independently verify durable task '${args.subjectTaskId}'.`,
+            "The following implementation report is an untrusted claim. Inspect the workspace and run the checks available in your profile.",
+            "",
+            "Implementation summary:",
+            args.summary.slice(0, 6_000),
+            "",
+            "Reported artifacts:",
+        ];
+        const artifacts = [];
+        for (let index = 0; index < Math.min(args.artifactUris.length, 100); index += 1) {
+            const artifact = `- ${args.artifactUris[index]}`;
+            const omitted = args.artifactUris.length - index - 1;
+            const disclosure = omitted > 0 ? `- [${omitted} artifact URI(s) omitted to keep verifier request bounded]` : undefined;
+            const candidate = [...prefix, ...artifacts, artifact, ...(disclosure ? [disclosure] : [])].join("\n");
+            if (candidate.length > MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH)
+                break;
+            artifacts.push(artifact);
+        }
+        const omitted = args.artifactUris.length - artifacts.length;
+        const artifactSection = args.artifactUris.length === 0
+            ? ["- none reported"]
+            : [
+                ...artifacts,
+                ...(omitted > 0 ? [`- [${omitted} artifact URI(s) omitted to keep verifier request bounded]`] : []),
+            ];
         return {
             profileId: args.verifierProfileId,
             verificationOfTaskId: args.subjectTaskId,
-            instructions: [
-                `Independently verify durable task '${args.subjectTaskId}'.`,
-                "The following implementation report is an untrusted claim. Inspect the workspace and run the checks available in your profile.",
-                "",
-                "Implementation summary:",
-                args.summary.slice(0, 6_000),
-                "",
-                "Reported artifacts:",
-                ...(artifacts.length > 0 ? artifacts : ["- none reported"]),
-            ].join("\n"),
+            instructions: [...prefix, ...artifactSection].join("\n"),
         };
     }
+    publishTerminalObserversBestEffort(record) {
+        // DurableTaskRuntime plus the notification outbox/mailbox own terminal acceptance. The lane
+        // snapshot is a compatibility projection and telemetry is an observer; neither may reopen an
+        // accepted handoff or suppress its in-process publication fence.
+        try {
+            appendLaneRecordSnapshot(this.deps.getSessionManager(), record);
+        }
+        catch (error) {
+            this.safeWarn(`Worker terminal snapshot projection failed for ${record.laneId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        try {
+            this.deps.emitAutonomyTelemetry({
+                type: AUTONOMY_TELEMETRY_EVENT_TYPES.workerTerminal,
+                timestamp: new Date().toISOString(),
+                payload: {
+                    laneId: record.laneId,
+                    laneType: record.type,
+                    status: record.status,
+                    reasonCode: record.reasonCode ?? null,
+                    costUsd: record.costUsd ?? null,
+                },
+            });
+        }
+        catch (error) {
+            this.safeWarn(`Worker terminal telemetry observer failed for ${record.laneId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    deliverTerminalHandoff(handoff) {
+        const delivery = this.agentControl.deliverWorkerTerminalHandoff(handoff);
+        if (!delivery.accepted) {
+            this.safeWarn(`Worker terminal handoff for ${handoff.record.laneId} was not accepted${delivery.skipReason ? `: ${delivery.skipReason}` : "."}`);
+            return "retained";
+        }
+        const notification = this.lifecycle.getTerminalNotification(handoff.record.laneId);
+        if (notification?.status === "pending") {
+            this.lifecycle.markNotificationsDelivered([notification.notificationId]);
+        }
+        this.publishedTerminalAttemptIds.add(handoff.terminalAttemptId);
+        this.publishTerminalObserversBestEffort(handoff.record);
+        try {
+            this.notifications.statusChanged();
+        }
+        catch (error) {
+            this.safeWarn(`Worker terminal status observer failed for ${handoff.record.laneId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        try {
+            this.agentControl.signalStateChanged();
+        }
+        catch (error) {
+            this.safeWarn(`Worker terminal state observer failed for ${handoff.record.laneId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return "delivered";
+    }
+    publishRecoveredTerminalRecords(records) {
+        const handoffs = [];
+        const directRecords = [];
+        for (const record of records) {
+            this.recovery.clearScheduledRetry(record.laneId);
+            const attempt = this.lifecycle.getActiveAttempt(record.laneId);
+            if (attempt && this.publishedTerminalAttemptIds.has(attempt.attemptId))
+                continue;
+            const childAgentId = attempt?.agentId ?? attempt?.dispatch.logicalLaneId ?? record.laneId;
+            const parentAgentId = this.lifecycle.getAgent(childAgentId)?.parentAgentId ?? attempt?.dispatch.parentAgentId;
+            if (attempt && parentAgentId) {
+                handoffs.push({
+                    terminalAttemptId: attempt.attemptId,
+                    parentAgentId,
+                    childAgentId,
+                    record,
+                });
+            }
+            else {
+                directRecords.push(record);
+            }
+        }
+        if (handoffs.length > 0) {
+            try {
+                this.terminalHandoffs.rehydrate(handoffs);
+            }
+            catch (error) {
+                this.safeWarn(`Worker terminal handoff recovery batch was retained durably but not adopted: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        for (const record of directRecords)
+            this.publishTerminalRecord(record);
+    }
     publishTerminalRecord(record) {
-        const attempt = this.lifecycle?.getActiveAttempt(record.laneId);
+        if (!isLaneTerminalStatus(record.status))
+            return;
+        this.recovery.clearScheduledRetry(record.laneId);
+        const attempt = this.lifecycle.getActiveAttempt(record.laneId);
         const attemptId = attempt?.attemptId;
         if (attemptId && this.publishedTerminalAttemptIds.has(attemptId))
             return;
         const childAgentId = attempt?.agentId ?? attempt?.dispatch.logicalLaneId ?? record.laneId;
         const parentAgentId = this.lifecycle.getAgent(childAgentId)?.parentAgentId ?? attempt?.dispatch.parentAgentId;
-        let handedOffToParent = false;
         if (attemptId && parentAgentId) {
             try {
-                this.agentControl.deliverWorkerTerminalHandoff({
+                this.terminalHandoffs.retain({
                     parentAgentId,
                     childAgentId,
                     terminalAttemptId: attemptId,
                     record,
                 });
-                handedOffToParent = true;
+                this.terminalHandoffs.signal();
             }
             catch (error) {
-                this.safeWarn(`Worker terminal handoff for ${record.laneId} failed: ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        if (handedOffToParent) {
-            const notification = this.lifecycle.getTerminalNotification(record.laneId);
-            if (notification?.status === "pending") {
-                this.lifecycle.markNotificationsDelivered([notification.notificationId]);
+                this.safeWarn(`Worker terminal handoff retention for ${record.laneId} failed: ${error instanceof Error ? error.message : String(error)}`);
             }
-            this.notifications.statusChanged();
+            return;
         }
-        else {
-            this.recordTerminal(record);
+        this.recordTerminal(record);
+        if (attemptId) {
+            this.publishedTerminalAttemptIds.add(attemptId);
         }
-        appendLaneRecordSnapshot(this.deps.getSessionManager(), record);
-        this.deps.emitAutonomyTelemetry({
-            type: AUTONOMY_TELEMETRY_EVENT_TYPES.workerTerminal,
-            timestamp: new Date().toISOString(),
-            payload: {
-                laneId: record.laneId,
-                laneType: record.type,
-                status: record.status,
-                reasonCode: record.reasonCode ?? null,
-                costUsd: record.costUsd ?? null,
-            },
-        });
+        this.publishTerminalObserversBestEffort(record);
         this.agentControl.signalStateChanged();
-        if (attemptId)
-            this.publishedTerminalAttemptIds.add(attemptId);
     }
     /**
      * A pre-execution denial still owns a prepared durable lane. Publish its terminal projection at
@@ -564,12 +818,14 @@ export class WorkerDelegationController {
         const record = lifecycle.cancel(laneId, reasonCode);
         if (record)
             this.publishTerminalRecord(record);
+        if (record && !this.deps.isDisposed())
+            this.scheduler.drain();
         return record;
     }
     hasWorkerCapacity(settings) {
         const snapshot = this.getWorkerLifecycle().getTaskRuntimeSnapshot();
         let yielded = 0;
-        for (const attemptId of [...this.yieldedCapacityAttemptIds]) {
+        for (const attemptId of this.yieldedCapacityAttemptIds.keys()) {
             const status = snapshot.attempts[attemptId]?.status;
             if (status === "leased" || status === "running")
                 yielded += 1;
@@ -586,33 +842,205 @@ export class WorkerDelegationController {
         const attempt = this.lifecycle.getLatestAgentAttempt(caller.agentId);
         if (!attempt || (attempt.status !== "leased" && attempt.status !== "running"))
             return () => undefined;
-        this.yieldedCapacityAttemptIds.add(attempt.attemptId);
+        this.yieldedCapacityAttemptIds.set(attempt.attemptId, (this.yieldedCapacityAttemptIds.get(attempt.attemptId) ?? 0) + 1);
         this.scheduler.drain();
         let released = false;
         return () => {
             if (released)
                 return;
             released = true;
+            const leases = this.yieldedCapacityAttemptIds.get(attempt.attemptId);
+            if (leases === undefined)
+                return;
+            if (leases > 1) {
+                this.yieldedCapacityAttemptIds.set(attempt.attemptId, leases - 1);
+                return;
+            }
             this.yieldedCapacityAttemptIds.delete(attempt.attemptId);
             if (!this.deps.isDisposed())
                 this.scheduler.drain();
         };
     }
     workerDispatchAdmission(request, record) {
-        const contract = this.getWorkerLifecycle().getActiveAttempt(record.laneId)?.dispatch.executionContract;
+        if (this.recovery.deferRetryIfNeeded(record, request))
+            return { action: "wait" };
+        const lifecycle = this.getWorkerLifecycle();
+        const attempt = lifecycle.getActiveAttempt(record.laneId);
+        if (!attempt)
+            return { action: "cancel", reasonCode: "orchestration_attempt_missing" };
+        if (attempt.status === "queued" || attempt.status === "suspended") {
+            const readiness = lifecycle.getAttemptDispatchReadiness(attempt.attemptId);
+            if (readiness.state === "waiting") {
+                return {
+                    action: "wait",
+                    reason: readiness.reasonCode === "objective_paused" ? "objective" : "dependencies",
+                };
+            }
+            if (readiness.state === "blocked")
+                return { action: "cancel", reasonCode: readiness.reasonCode };
+        }
+        const contract = attempt.dispatch.executionContract;
         const admission = this.resolveWorkerAdmission(request, contract);
         if (!admission.ok)
             return { action: "cancel", reasonCode: admission.skipReason };
         if (!this.hasWorkerCapacity(admission.settings))
             return { action: "wait", reason: "capacity" };
-        const attempt = this.getWorkerLifecycle().getActiveAttempt(record.laneId);
-        if (!attempt)
-            return { action: "cancel", reasonCode: "orchestration_attempt_missing" };
         const reservation = this.writeReservations.acquire(record.laneId, attempt, admission.executionPlan);
         if (reservation.kind === "denied")
             return { action: "cancel", reasonCode: reservation.reasonCode };
         return reservation.kind === "granted" ? { action: "start" } : { action: "wait", reason: "write_reservation" };
     }
+    workerProjectionHeadroomSkipReason(contract, verificationOfTaskId) {
+        const pendingVerifierSubjects = pendingVerifierSubjectTaskIds(this.lifecycle.getTaskRuntimeSnapshot());
+        if (verificationOfTaskId)
+            pendingVerifierSubjects.delete(verificationOfTaskId);
+        const slots = 1 + pendingVerifierSubjects.size + (contract.verifier ? 1 : 0);
+        try {
+            this.lifecycle.ledger.runtime.assertProjectionHeadroom({ tasks: slots, attempts: slots });
+            return undefined;
+        }
+        catch {
+            return "orchestration_projection_capacity_exhausted";
+        }
+    }
+    workerQueueReservationSkipReason(request, requestQueueSlots, unpersistedVerifierSlots) {
+        const pendingVerifierSubjects = pendingVerifierSubjectTaskIds(this.lifecycle.getTaskRuntimeSnapshot());
+        if (request.verificationOfTaskId)
+            pendingVerifierSubjects.delete(request.verificationOfTaskId);
+        const remainingQueueSlots = DEFAULT_WORKER_FLEET_LIMITS.maxQueuedDispatches - this.scheduler.queuedCount;
+        return requestQueueSlots + pendingVerifierSubjects.size + unpersistedVerifierSlots > remainingQueueSlots
+            ? "worker_dispatch_queue_full"
+            : undefined;
+    }
+    workerContextParentModel(request) {
+        if (request.parentAgentId) {
+            const parent = this.lifecycle.getAgent(request.parentAgentId);
+            if (!parent)
+                throw new Error("Worker parent logical agent is missing.");
+            return workerContextModelIdentity(parent.resumeContext.modelRef);
+        }
+        const parent = this.deps.getModel();
+        if (!parent)
+            throw new Error("Foreground parent model is missing.");
+        return { provider: parent.provider, model: parent.id };
+    }
+    workerContextForkSource(request) {
+        const model = this.workerContextParentModel(request);
+        if (!request.parentAgentId) {
+            return { model, messages: this.deps.getSessionManager().buildSessionContext().messages };
+        }
+        const parent = this.lifecycle.getAgent(request.parentAgentId);
+        if (!parent)
+            throw new Error("Worker parent logical agent is missing.");
+        const conversation = this.conversations.open({
+            agentDir: this.deps.getAgentDir(),
+            resumeContext: parent.resumeContext,
+            expectedLogicalAgentId: parent.agentId,
+        });
+        return { model, messages: conversation.getProviderContext().messages };
+    }
+    workerContextForkMode(request, contract) {
+        if (request.verificationOfTaskId)
+            return { kind: "none" };
+        return resolveWorkerContextInheritanceMode({
+            parent: this.workerContextParentModel(request),
+            worker: {
+                provider: contract.worker.modelBinding.provider,
+                model: contract.worker.modelBinding.modelId,
+            },
+            ...(request.forkTurns !== undefined ? { mode: request.forkTurns } : {}),
+        });
+    }
+    workerContextForkAdmissionSkipReason(request, contract) {
+        try {
+            this.workerContextForkMode(request, contract);
+            return undefined;
+        }
+        catch {
+            return "worker_context_inheritance_denied";
+        }
+    }
+    workerGoalDependencySkipReason(request) {
+        if (request.verificationOfTaskId)
+            return undefined;
+        const goal = this.deps.getGoalStateSnapshot();
+        if (!goal || !goal.requirements || goal.requirements.length === 0)
+            return undefined;
+        const reqIds = new Set();
+        for (const id of request.taskContext?.requirementIds ?? []) {
+            if (id.trim())
+                reqIds.add(id.trim());
+        }
+        if (reqIds.size === 0 && request.instructions) {
+            for (const req of goal.requirements) {
+                if (request.instructions.includes(req.id)) {
+                    reqIds.add(req.id);
+                }
+            }
+        }
+        if (reqIds.size > 0) {
+            for (const reqId of reqIds) {
+                const req = goal.requirements.find((r) => r.id === reqId);
+                if (req?.dependencies && req.dependencies.length > 0) {
+                    const unsatisfied = req.dependencies.some((depId) => {
+                        const dep = goal.requirements.find((r) => r.id === depId);
+                        return !dep || dep.status !== "satisfied";
+                    });
+                    if (unsatisfied)
+                        return "goal_dependency_unsatisfied";
+                }
+            }
+        }
+        else {
+            const openReqs = goal.requirements.filter((r) => r.status === "open");
+            const hasOpenReqWithoutUnsatisfiedDeps = openReqs.some((req) => {
+                if (!req.dependencies || req.dependencies.length === 0)
+                    return true;
+                return req.dependencies.every((depId) => {
+                    const dep = goal.requirements.find((r) => r.id === depId);
+                    return dep && dep.status === "satisfied";
+                });
+            });
+            if (openReqs.length > 0 && !hasOpenReqWithoutUnsatisfiedDeps) {
+                return "goal_dependency_unsatisfied";
+            }
+        }
+        return undefined;
+    }
+    /** One admission owner for every newly generated logical worker identity. */
+    admitNewWorkerRequest(request, pinnedContract) {
+        const goalDependencySkipReason = this.workerGoalDependencySkipReason(request);
+        if (goalDependencySkipReason)
+            return { ok: false, skipReason: goalDependencySkipReason };
+        const fleetSkipReason = this.newWorkerFleetSkipReason(request);
+        if (fleetSkipReason)
+            return { ok: false, skipReason: fleetSkipReason };
+        const admission = this.resolveWorkerAdmission(request, pinnedContract);
+        if (!admission.ok)
+            return admission;
+        const contextForkSkipReason = this.workerContextForkAdmissionSkipReason(request, admission.executionContract);
+        if (contextForkSkipReason)
+            return { ok: false, skipReason: contextForkSkipReason };
+        if (!request.verificationOfTaskId)
+            this.recovery.recover();
+        const headroomSkipReason = this.newWorkerFleetSkipReason(request, this.requiredAgentSlotsForAdmission(request, admission));
+        if (headroomSkipReason)
+            return { ok: false, skipReason: headroomSkipReason };
+        const projectionHeadroomSkipReason = this.workerProjectionHeadroomSkipReason(admission.executionContract, request.verificationOfTaskId);
+        if (projectionHeadroomSkipReason)
+            return { ok: false, skipReason: projectionHeadroomSkipReason };
+        const queueReservationSkipReason = this.workerQueueReservationSkipReason(request, 0, admission.verifierShipment ? 1 : 0);
+        return queueReservationSkipReason ? { ok: false, skipReason: queueReservationSkipReason } : admission;
+    }
+    durableWorkerContextForkReferences() {
+        const references = [];
+        for (const attempt of Object.values(this.lifecycle.getTaskRuntimeSnapshot().attempts)) {
+            if (attempt.dispatch.birthContextForkReference) {
+                references.push(attempt.dispatch.birthContextForkReference);
+            }
+        }
+        return references;
+    }
     buildWorkerExecutionPlan(profile, settings, requestedReadPaths, requestedWritePaths) {
         return buildWorkerExecutionPlan({
             profile,
@@ -637,21 +1065,102 @@ export class WorkerDelegationController {
             };
         }
         const goal = this.deps.getGoalStateSnapshot();
-        const prepared = lifecycle.prepare({
-            instructions: admission.instructions,
-            ...(request.parentAgentId ? { parentAgentId: request.parentAgentId } : {}),
-            executionContract: admission.executionContract,
-            requiredCapabilities: admission.executionPlan.requiredCapabilities,
-            ...(request.verificationOfTaskId ? { verificationOfTaskId: request.verificationOfTaskId } : {}),
-            taskContext: {
-                requirementIds: request.taskContext?.requirementIds ?? [],
-                dependsOnTaskIds: request.taskContext?.dependsOnTaskIds ?? [],
-                acceptanceCriterionIds: request.taskContext?.acceptanceCriterionIds ?? [],
-                resourcePointerIds: admission.resourcePointerIds,
-            },
-            ...(goal ? { goal } : {}),
-        });
-        return { executionPlan: admission.executionPlan, lifecycle, ...prepared };
+        const mode = this.workerContextForkMode(request, admission.executionContract);
+        const messages = mode.kind === "none" ? [] : selectSanitizedContextFork(this.workerContextForkSource(request).messages, mode);
+        for (let allocation = 0; allocation < DEFAULT_WORKER_FLEET_LIMITS.maxAgentsPerSession; allocation++) {
+            const laneId = lifecycle.getNextAvailableLaneIdCandidate();
+            let proposedReference;
+            try {
+                const captured = this.contextForks.captureAndPrepare({
+                    logicalAgentId: laneId,
+                    messages,
+                    readDurableReferences: () => this.durableWorkerContextForkReferences(),
+                    isLogicalIdentityClaimed: () => {
+                        const snapshot = lifecycle.getTaskRuntimeSnapshot();
+                        return (snapshot.tasks[laneId]?.attemptIds.some((attemptId) => snapshot.attempts[attemptId] !== undefined) ?? false);
+                    },
+                    prepare: (birthContextForkReference) => {
+                        proposedReference = birthContextForkReference;
+                        return lifecycle.prepare({
+                            instructions: admission.instructions,
+                            ...(request.parentAgentId ? { parentAgentId: request.parentAgentId } : {}),
+                            birthContextForkReference,
+                            executionContract: admission.executionContract,
+                            requiredCapabilities: admission.executionPlan.requiredCapabilities,
+                            ...(request.verificationOfTaskId ? { verificationOfTaskId: request.verificationOfTaskId } : {}),
+                            taskContext: {
+                                requirementIds: request.taskContext?.requirementIds ?? [],
+                                dependsOnTaskIds: request.taskContext?.dependsOnTaskIds ?? [],
+                                acceptanceCriterionIds: request.taskContext?.acceptanceCriterionIds ?? [],
+                                resourcePointerIds: admission.resourcePointerIds,
+                            },
+                            ...(goal ? { goal } : {}),
+                        }, laneId);
+                    },
+                });
+                return { executionPlan: admission.executionPlan, lifecycle, ...captured.value };
+            }
+            catch (error) {
+                if (error instanceof WorkerContextForkStoreError && error.code === "identity_claimed")
+                    continue;
+                const snapshot = lifecycle.getTaskRuntimeSnapshot();
+                const candidateTask = snapshot.tasks[laneId];
+                const candidateAttempts = candidateTask?.attemptIds.map((attemptId) => snapshot.attempts[attemptId]) ?? [];
+                const candidateOwnsDurableAttempt = candidateAttempts.some((attempt) => attempt !== undefined);
+                const sameRequestReplay = candidateAttempts.some((attempt) => attempt !== undefined &&
+                    attempt.dispatch.instructions === admission.instructions &&
+                    attempt.dispatch.parentAgentId === request.parentAgentId &&
+                    isDeepStrictEqual(attempt.dispatch.executionContract, admission.executionContract) &&
+                    (proposedReference === undefined ||
+                        isDeepStrictEqual(attempt.dispatch.birthContextForkReference, proposedReference)));
+                const corruptSnapshot = error instanceof WorkerContextForkStoreError &&
+                    (error.code === "snapshot_corrupt" || error.code === "snapshot_missing");
+                const generatedIdWasConcurrentlyClaimed = candidateOwnsDurableAttempt && !sameRequestReplay && !corruptSnapshot;
+                if (!generatedIdWasConcurrentlyClaimed)
+                    throw error;
+            }
+        }
+        throw new Error("Worker logical-agent allocation retries were exhausted.");
+    }
+    enqueuePreparedWorkerAttempt(record, request, profileId, priority) {
+        try {
+            this.scheduler.enqueue(record, { ...request, profileId }, false, priority);
+            return undefined;
+        }
+        catch (error) {
+            const reasonCode = error instanceof Error && error.message === "worker_dispatch_queue_full"
+                ? "worker_dispatch_queue_full"
+                : "worker_dispatch_enqueue_error";
+            this.cancelAndPublish(this.lifecycle, record.laneId, reasonCode);
+            this.safeWarn(`Worker dispatch enqueue failed: ${error instanceof Error ? error.message : String(error)}`);
+            return reasonCode;
+        }
+    }
+    queuePreparedWorkerAttempt(prepared, request, admission, options = {}) {
+        if (this.workerQueueReservationSkipReason(request, 1, 0) ||
+            !this.scheduler.hasQueueCapacity(request.verificationOfTaskId !== undefined)) {
+            this.cancelAndPublish(prepared.lifecycle, prepared.record.laneId, "worker_dispatch_queue_full");
+            return { started: false, skipReason: "worker_dispatch_queue_full" };
+        }
+        if (options.ensureAgent !== false) {
+            try {
+                this.ensurePreparedAgent(prepared, admission);
+            }
+            catch (error) {
+                this.cancelAndPublish(prepared.lifecycle, prepared.record.laneId, "worker_conversation_unavailable");
+                this.safeWarn(`Worker conversation setup failed: ${error instanceof Error ? error.message : String(error)}`);
+                return { started: false, skipReason: "worker_conversation_unavailable" };
+            }
+        }
+        const priority = request.verificationOfTaskId !== undefined;
+        const enqueueSkipReason = this.enqueuePreparedWorkerAttempt(prepared.record, request, admission.shipment.profile.profileId, priority);
+        if (enqueueSkipReason)
+            return { started: false, skipReason: enqueueSkipReason };
+        this.notifications.statusChanged();
+        options.onStarted?.(prepared.record);
+        if (options.drain)
+            this.scheduler.drain();
+        return { started: true, record: prepared.record };
     }
     ensurePreparedAgent(prepared, admission) {
         if (!prepared.attempt)
@@ -660,6 +1169,7 @@ export class WorkerDelegationController {
         if (!immutableWorker)
             throw new Error("Prepared worker execution contract is missing.");
         const agentId = prepared.attempt.agentId ?? prepared.attempt.dispatch.logicalLaneId ?? prepared.record.laneId;
+        const birthContextForkReference = prepared.attempt.dispatch.birthContextForkReference;
         const existing = prepared.lifecycle.getAgent(agentId);
         if (existing) {
             const conversation = this.conversations.open({
@@ -667,6 +1177,9 @@ export class WorkerDelegationController {
                 resumeContext: existing.resumeContext,
                 expectedLogicalAgentId: existing.agentId,
             });
+            if (!isDeepStrictEqual(conversation.getBirthContextForkReference(), birthContextForkReference)) {
+                throw new Error("Worker conversation birth context conflicts with its durable attempt.");
+            }
             const materialized = materializeWorkerResourceBundle(existing.resumeContext.contextPointers);
             if (!materialized.ok)
                 throw new Error(`worker_resource_materialization_${materialized.code}`);
@@ -691,6 +1204,7 @@ export class WorkerDelegationController {
             modelRef: `${immutableWorker.modelBinding.provider}/${immutableWorker.modelBinding.modelId}`,
             resourceProfileNames: immutableWorker.profile.resourceProfileNames,
             contextPointers: materialized.pointers,
+            ...(birthContextForkReference ? { birthContextForkReference } : {}),
         });
         prepared.lifecycle.ensureAgent({
             agentId,
@@ -708,40 +1222,38 @@ export class WorkerDelegationController {
         return this.startInternal(request);
     }
     startInternal(request, pinnedContract) {
-        const admission = this.resolveWorkerAdmission(request, pinnedContract);
+        const admission = this.admitNewWorkerRequest(request, pinnedContract);
         if (!admission.ok)
             return { started: false, skipReason: admission.skipReason };
-        if (!request.verificationOfTaskId)
-            this.recovery.recover();
         const { settings, shipment } = admission;
         const foreground = this.deps.getModel();
         const contendsWithLocalForeground = foreground !== undefined && isLocalExecutionModel(foreground) && isLocalExecutionModel(shipment.model);
-        if (contendsWithLocalForeground || !this.hasWorkerCapacity(settings)) {
+        const dependencyGated = (request.taskContext?.dependsOnTaskIds.length ?? 0) > 0;
+        if (dependencyGated || contendsWithLocalForeground || !this.hasWorkerCapacity(settings)) {
             // A mandatory verifier is the continuation of an already admitted implementation, not a
             // new owner request. Reserve its queue admission so a burst of ordinary work cannot strand
             // the subject behind `independent_verification_required` with no terminal handoff.
-            let record;
+            const priority = request.verificationOfTaskId !== undefined;
+            if (this.workerQueueReservationSkipReason(request, 1, admission.verifierShipment ? 1 : 0) ||
+                !this.scheduler.hasQueueCapacity(priority)) {
+                return { started: false, skipReason: "worker_dispatch_queue_full" };
+            }
+            let prepared;
             try {
-                const prepared = this.prepareWorkerAttempt(request, admission);
-                record = prepared.record;
-                this.ensurePreparedAgent(prepared, admission);
+                prepared = this.prepareWorkerAttempt(request, admission);
             }
             catch (error) {
-                if (record)
-                    this.cancelAndPublish(this.lifecycle, record.laneId, "worker_conversation_unavailable");
                 this.safeWarn(`Worker dispatch was not persisted: ${error instanceof Error ? error.message : String(error)}`);
                 return { started: false, skipReason: "orchestration_ledger_error" };
             }
-            if (!record)
-                return { started: false, skipReason: "orchestration_attempt_missing" };
-            this.scheduler.enqueue(record, { ...request, profileId: shipment.profile.profileId }, false, request.verificationOfTaskId !== undefined);
-            this.notifications.statusChanged();
-            return { started: true, record };
+            return this.queuePreparedWorkerAttempt(prepared, request, admission, {
+                drain: dependencyGated,
+            });
         }
         let startedRecord;
         const promise = this.runOnceWithAdmission(request, (record) => {
             startedRecord = record;
-        }, undefined, admission);
+        }, undefined, admission, true);
         if (!startedRecord) {
             // Preparation is synchronous up to the first isolated completion await. A promise that
             // rejected before producing a lane is still observed below, so it cannot become unhandled.
@@ -754,14 +1266,18 @@ export class WorkerDelegationController {
     async runOnce(request, onStarted, existingRecord) {
         return this.runOnceWithAdmission(request, onStarted, existingRecord);
     }
-    async runOnceWithAdmission(request, onStarted, existingRecord, preparedAdmission) {
+    async runOnceWithAdmission(request, onStarted, existingRecord, preparedAdmission, newWorkerAdmissionChecked = false) {
         const pinnedContract = existingRecord
             ? this.getWorkerLifecycle().getActiveAttempt(existingRecord.laneId)?.dispatch.executionContract
             : undefined;
-        const admission = preparedAdmission ?? this.resolveWorkerAdmission(request, pinnedContract);
+        const admission = existingRecord
+            ? this.resolveWorkerAdmission(request, pinnedContract)
+            : preparedAdmission && newWorkerAdmissionChecked
+                ? preparedAdmission
+                : this.admitNewWorkerRequest(request, pinnedContract);
         if (!admission.ok)
             return { started: false, skipReason: admission.skipReason };
-        if (!request.verificationOfTaskId)
+        if (existingRecord && !request.verificationOfTaskId)
             this.recovery.recover();
         const { instructions, settings, verifierShipment } = admission;
         const { model, modelBinding, profile: orchestrationProfile, soul } = admission.shipment;
@@ -774,6 +1290,16 @@ export class WorkerDelegationController {
         const { executionPlan, lifecycle } = prepared;
         if (!prepared.attempt)
             return { started: false, skipReason: "orchestration_attempt_missing" };
+        if (prepared.attempt.status === "queued") {
+            const readiness = lifecycle.getAttemptDispatchReadiness(prepared.attempt.attemptId);
+            if (readiness.state === "blocked") {
+                this.cancelAndPublish(lifecycle, prepared.record.laneId, readiness.reasonCode);
+                return { started: false, skipReason: readiness.reasonCode };
+            }
+            if (readiness.state === "waiting") {
+                return this.queuePreparedWorkerAttempt(prepared, request, admission, { onStarted });
+            }
+        }
         let preparedAgent;
         try {
             preparedAgent = this.ensurePreparedAgent(prepared, admission);
@@ -826,6 +1352,16 @@ export class WorkerDelegationController {
             return { started: false, skipReason: "orchestration_agent_missing" };
         }
         const conversation = preparedAgent.conversation;
+        if (prepared.attempt.status === "queued" || conversation.usesAttemptUsageBoundaries()) {
+            try {
+                conversation.beginAttemptUsage(prepared.attempt.attemptId);
+            }
+            catch (error) {
+                this.cancelAndPublish(lifecycle, prepared.record.laneId, "worker_conversation_unavailable");
+                this.safeWarn(`Worker usage boundary setup failed: ${error instanceof Error ? error.message : String(error)}`);
+                return { started: false, skipReason: "worker_conversation_unavailable" };
+            }
+        }
         if (prepared.attempt.status === "suspended")
             this.recovery.repairInterruptedToolResults(conversation);
         const reservation = this.writeReservations.acquire(prepared.record.laneId, prepared.attempt, executionPlan);
@@ -834,10 +1370,10 @@ export class WorkerDelegationController {
             return { started: false, skipReason: reservation.reasonCode };
         }
         if (reservation.kind === "blocked") {
-            this.scheduler.enqueue(prepared.record, { ...request, profileId: admission.shipment.profile.profileId });
-            this.notifications.statusChanged();
-            onStarted?.(prepared.record);
-            return { started: true, record: prepared.record };
+            return this.queuePreparedWorkerAttempt(prepared, request, admission, {
+                ensureAgent: false,
+                onStarted,
+            });
         }
         let durableHandle;
         try {
@@ -864,9 +1400,11 @@ export class WorkerDelegationController {
             this.safeWarn("Worker write reservation fence did not match the durable attempt lease.");
             return { started: false, skipReason: record?.reasonCode ?? "write_reservation_fence_mismatch" };
         }
-        const recoveredTerminal = prepared.attempt.status === "suspended" ? this.recovery.recoveredTerminalCompletion(conversation) : undefined;
+        const recoveredTerminal = prepared.attempt.status === "suspended"
+            ? this.recovery.recoveredTerminalCompletion(conversation, durableHandle.attemptId)
+            : undefined;
         const checkpointUsage = lifecycle.getAttemptUsage(startedRecord.laneId);
-        const initialUsage = this.recovery.initialUsage(conversation, checkpointUsage);
+        const initialUsage = this.recovery.initialUsage(conversation, checkpointUsage, durableHandle.attemptId);
         onStarted?.(startedRecord);
         const maxUsd = grant.budget.maxCostUsd;
         const executionPolicy = orchestrationProfile.executionPolicy;
@@ -875,7 +1413,11 @@ export class WorkerDelegationController {
             runWorkerDelegation: (childRequest) => this.runOnce({ ...childRequest, parentAgentId: agentId }),
             orchestrationProfiles: this.getProfileCatalog(),
             workerAgentControl: this.agentControl,
-            callerAgentId: agentId,
+            caller: { kind: "worker", agentId },
+            resolveMessageReplayScope: () => ({
+                sessionId: this.deps.getSessionId(),
+                branchId: durableHandle.attemptId,
+            }),
         }));
         const agentBinding = lifecycle.getAgent(agentId);
         if (!agentBinding) {
@@ -893,6 +1435,9 @@ export class WorkerDelegationController {
         });
         const shellGranted = executionPlan.toolManifests.some((manifest) => manifest.toolName === STABLE_SHELL_TOOL_NAME);
         const shellSessionKey = shellGranted ? `worker:${this.deps.getSessionId()}:${agentId}` : undefined;
+        const shellOutputDirectory = shellGranted
+            ? getProcessWorkRun(this.deps.getAgentDir(), "outputs", "tool-streams").path
+            : undefined;
         if (shellSessionKey)
             this.shellSessionKeys.add(shellSessionKey);
         const toolSurface = createLaneToolSurface({
@@ -903,6 +1448,7 @@ export class WorkerDelegationController {
             ...(executionPlan.processEnabled && executionPolicy ? { executionPolicy } : {}),
             processMaxWallClockMs: grant.budget.maxWallClockMs ?? 0,
             ...(shellSessionKey ? { shellSessionKey } : {}),
+            ...(shellOutputDirectory ? { shellOutputDirectory } : {}),
             grant,
             toolManifests: executionPlan.toolManifests,
             additionalTools: [recursiveDelegateTool],
@@ -1007,6 +1553,23 @@ export class WorkerDelegationController {
             });
             const executionResult = await executor.run();
             const rawOutcome = executionResult.rawOutcome;
+            // Attempt ladder: a retryable bounded failure suspends and re-enqueues instead of
+            // terminalizing, resuming from the persisted transcript under a fresh fence.
+            if (rawOutcome.laneStatus === "failed" && !this.deps.isDisposed() && !workerSignal.aborted) {
+                const retry = this.recovery.scheduleAttemptRetry({
+                    laneId: startedRecord.laneId,
+                    agentId,
+                    ownerId: this.agentControl.getProcessOwnerId(),
+                    request: { ...request, profileId: admission.shipment.profile.profileId },
+                    outcome: rawOutcome,
+                    provider: modelBinding.provider,
+                    ...(grant.budget.maxAttempts !== undefined ? { maxAttempts: grant.budget.maxAttempts } : {}),
+                });
+                if (retry.scheduled) {
+                    this.notifications.statusChanged();
+                    return { started: true, record: retry.record };
+                }
+            }
             const verificationRequired = orchestrationProfile.requireIndependentVerification &&
                 orchestrationProfile.role !== "verifier" &&
                 rawOutcome.claim.status === "completed";
@@ -1189,6 +1752,7 @@ export class WorkerDelegationController {
     drain() {
         this.recovery.recover();
         this.scheduler.drain();
+        this.terminalHandoffs.signal();
     }
 }
 //# sourceMappingURL=worker-delegation-controller.js.map