@coool/opencode-adaptive 1.0.0 → 1.2.0

package/dist/supervisor/supervisor.js

@@ -20,13 +20,13 @@ var _a;
  *   (a later episode supersedes it); no outcome is ever fabricated.
  * - escalation (ADP-015..017) triggers only on capability-classified unit
  *   failures (context overflow, content policy); infrastructure failures
- *   never escalate, and the per-unit budget is finite.
+ *   never escalate, and the per-task budget is finite.
  */
 import { WorkUnitTracker } from "../core/work-unit/tracker.js";
 import { sameModelRef, } from "../core/work-unit/types.js";
 import { INTERRUPT_REASONS } from "../core/work-unit/interruption.js";
 import { resolveRouting } from "../core/tier-policy/resolve.js";
-import { TIERS, nextTier } from "../core/tier-policy/types.js";
+import { isTierName, nextTier } from "../core/tier-policy/types.js";
 import { admit, forMode as schedulerForMode, planEscalation, schedulerHealthKey, } from "../core/scheduler/index.js";
 import { MAX_ESCALATION_EVIDENCE } from "../core/scheduler/types.js";
 import { checkCompatibility } from "../core/compatibility/gate.js";
@@ -38,6 +38,7 @@ import { mergeReadings } from "../health/capacity/merge.js";
 import { resourceChain, resourceKeyID } from "../health/resource-health/key.js";
 import { SettingsStore, SETTINGS_KEY } from "../state/settings/index.js";
 import { SessionModeStore, SESSION_MODES_KEY } from "../state/session-modes/index.js";
+import { TierRequestStore, TIER_REQUESTS_KEY } from "../state/tier-requests/index.js";
 import { ReceiptStore, RECEIPTS_KEY } from "../state/receipts/index.js";
 import { buildStatus } from "../rpc/status.js";
 import { RECEIPTS_VIEW_LIMIT } from "./view.js";
@@ -48,11 +49,8 @@ import { listCandidates, sessionOps, storageSeam } from "../adapters/opencode/in
 import { CodexCapacitySensor } from "../adapters/codex-capacity/index.js";
 import { logFailOpen } from "./log.js";
 import { CODEX_PROVIDER_ID } from "./types.js";
+import { TIERS } from "../core/tier-policy/types.js";
 /** Which tiers currently have configured resources (ADP-005). */
-/** Vocabulary guard without a cast: strict member equality. */
-function isTierName(tier) {
-    return TIERS.some((name) => name === tier);
-}
 function configuredTiers(settings) {
     return TIERS.filter((tier) => settings.tiers[tier].length > 0);
 }
@@ -71,8 +69,20 @@ const CAPABILITY_EVIDENCE_CATEGORIES = [
     "context_overflow",
     "content_policy",
 ];
-/** Finite per-unit escalation budget (ADP-017). */
-const MAX_ESCALATIONS_PER_UNIT = 2;
+/** Finite per-task escalation budget (ADP-017). */
+const MAX_ESCALATIONS_PER_TASK = 2;
+/**
+ * The recovery's post-settle guard aborted it (the session went OFF or the
+ * user interrupted while the host settle was in flight). Callers use it to
+ * skip the ordinary ops-failure degradation (parking) — an aborted recovery
+ * is a steering change, not an infrastructure failure.
+ */
+export class RecoveryAbortedError extends Error {
+    constructor(sessionID) {
+        super(`recovery aborted for session ${sessionID}`);
+        this.name = "RecoveryAbortedError";
+    }
+}
 export class Supervisor {
     #options;
     #settings;
@@ -86,6 +96,12 @@ export class Supervisor {
     #capacity;
     #codex;
     #vetoes = new Map();
+    /**
+     * Escalations spent per session on the current task (one user prompt and
+     * the owned continuations it spawns). Keyed by session, not unit: every
+     * escalation continues on a NEW unit, so a per-unit count would restart
+     * the budget at each step. A fresh user prompt starts a new task.
+     */
     #escalations = new Map();
     #admissionTiers = new Map();
     /** Recorded escalation-tool requests per unit (ADP-015 agent self-reports). */
@@ -100,10 +116,20 @@ export class Supervisor {
      * Per-session tier requests (agent-declared via the adaptive_tier tool):
      * the request is STICKY — it steers the session's next and following
      * admissions until cleared or the session dies — because an agent works
-     * across many units in one task. Insertion order gives the eviction.
+     * across many units in one task. Persisted like the session-mode
+     * overrides: the host's double plugin instance (hooks vs RPC) must not
+     * strand a request on the instance that never routes.
      */
-    static MAX_TIER_REQUESTS = 1024;
-    #tierRequests = new Map();
+    #tierRequests;
+    /**
+     * Sessions whose last model change was the user's own pick
+     * (`selected-external`): prompt admission does not re-route them —
+     * switching would undo the user's `/model` choice (ADP-028). Cleared by an
+     * adaptive switch, a tier request, or a mode change; a standing settings
+     * pin overrides the suppression (the pin is manual intent too).
+     */
+    static MAX_MANUAL_SELECTIONS = 1024;
+    #manualSelections = new Map();
     /**
      * Sessions with an owned continuation prompt in flight: the prompt hook
      * will fire for it, but that prompt belongs to the active unit — it must
@@ -119,6 +145,15 @@ export class Supervisor {
      * make the continuation re-admit (admission ping-pong).
      */
     #continuationsInFlight = new Map();
+    /**
+     * Sessions with an owned recovery in flight (between veto/resume and the
+     * delivered continuation prompt). The host settle inside it can take
+     * unbounded time; an interruption arriving during that window must abort
+     * the stale decision instead of acting after it.
+     */
+    #recoveryPending = new Set();
+    /** Interruptions observed while a recovery was pending on the session. */
+    #recoveryInterrupted = new Set();
     /**
      * Half-open probe tickets by session: a probe admitted while computing the
      * recovery for a veto belongs to the continuation episode that follows, so
@@ -132,6 +167,21 @@ export class Supervisor {
      * it — otherwise a lost probe would wedge the resource in half_open.
      */
     #probeTickets = new Map();
+    /**
+     * Per-unit dedup for breaker failure evidence (ADP-019). One failed attempt
+     * surfaces through up to three host signals — the pumped `http.response`
+     * event, the `retry` hook (the same request), and the terminal
+     * `execution-failed` (the last attempt) — and counting each would trip the
+     * breaker after ~2 real failures instead of `failureThreshold`. The exact
+     * arrival order of a pair is not guaranteed (the retry hook runs in the
+     * request lifecycle, the event pump lags), so the dedup is order-symmetric:
+     * the first signal of a pair counts and arms, the matching counterpart
+     * consumes it, a completed pair closes the attempt, and the terminal
+     * repeats only when the last attempt left no live evidence. A same-category
+     * observation with nothing armed is a NEW attempt (consecutive http-only
+     * failures each count). Cleared at unit close.
+     */
+    #attemptFailures = new Map();
     /**
      * Session → tier admitted by the prompt hook for the unit that is about to
      * open. Consumed by execution-started, which then skips re-routing (the
@@ -162,6 +212,7 @@ export class Supervisor {
         this.#healthRecords = new HealthRecordStore(storageSeam(HEALTH_KEY, options.storage));
         this.#capacityStore = new CapacityReadingStore(storageSeam(CAPACITY_KEY, options.storage));
         this.#sessionModes = new SessionModeStore(storageSeam(SESSION_MODES_KEY, options.storage), options.clock);
+        this.#tierRequests = new TierRequestStore(storageSeam(TIER_REQUESTS_KEY, options.storage), options.clock);
         this.#ops = sessionOps(options.session, {
             beforeSwitch: (sessionID, model) => {
                 this.#tracker.noteOwnSwitch(sessionID, model);
@@ -234,6 +285,10 @@ export class Supervisor {
             // host's double-instance reconciliation) must keep steering sessions
             // under the modes the user set for them.
             await this.#sessionModes.load();
+            // Tier requests hydrate the same way: a tier request recorded through
+            // the host's other plugin instance (or before a restart) must still
+            // steer this instance's admissions.
+            await this.#tierRequests.load();
             await this.#capacityStore.load();
             return this.#settings.load();
         };
@@ -270,6 +325,42 @@ export class Supervisor {
             logFailOpen("report", error);
         }
     }
+    /** Marks the session's manual-selection state from an external selection event. */
+    #noteManualSelection(sessionID) {
+        if (!this.#manualSelections.has(sessionID) &&
+            this.#manualSelections.size >= _a.MAX_MANUAL_SELECTIONS) {
+            // The guard above ensures the map is at its cap (>= 1 entries), so the
+            // first key always exists; the assertion avoids a branch the coverage
+            // gate would reject as unreachable.
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            const oldest = this.#manualSelections.keys().next().value;
+            this.#manualSelections.delete(oldest);
+        }
+        this.#manualSelections.set(sessionID, true);
+    }
+    /**
+     * True while the session's last model change was the user's own pick.
+     * A standing settings pin is explicit manual intent as well (ADP-002):
+     * honoring it does not fight the pick, so suppression is skipped there.
+     */
+    #manuallySelected(sessionID, settings) {
+        return settings.pin === null && this.#manualSelections.has(sessionID);
+    }
+    /**
+     * The manual-pick suppression actually applied at an admission. It yields
+     * when the picked model is health-blocked: keeping the session on a
+     * quarantined resource does not honor the pick — the configured fallback
+     * takes over instead (the pick is re-honored only if the user picks again).
+     * Uses the non-mutating evaluation, never a probe admission.
+     */
+    #manualSuppressionHolds(sessionID, settings) {
+        if (!this.#manuallySelected(sessionID, settings))
+            return false;
+        const current = this.#tracker.lastModel(sessionID)?.model;
+        if (current === undefined)
+            return true;
+        return this.#health.evaluate(refKey(current)).kind !== "blocked";
+    }
     /**
      * Handle one `retry` hook invocation. On a veto this mutates
      * `input.decision` to `{ retry: false }`; otherwise the decision is left
@@ -308,33 +399,38 @@ export class Supervisor {
      * tool). STICKY: it steers the session's next and following admissions
      * until cleared — an agent works across many units in one task. Returns
      * false on an unknown tier (the tool re-validates before calling).
+     *
+     * Fire-and-forget persistence: the recorder signature is sync on both the
+     * tool and the RPC source interfaces, so the write is enqueued without
+     * awaiting it. Readers (routing, getTierRequest, the idle sweep) flush the
+     * store's queue before reading, which makes the record visible
+     * deterministically; a write failure drops the record fail-open (the tool
+     * told the agent "recorded", the persisted mirror simply never sees it —
+     * the same degradation the in-memory map had on restart).
      */
     noteTierRequest(sessionID, tier) {
         if (!isTierName(tier))
             return false;
-        if (!this.#tierRequests.has(sessionID) &&
-            this.#tierRequests.size >= _a.MAX_TIER_REQUESTS) {
-            // The map is non-empty here (size >= MAX_TIER_REQUESTS > 0): Map
-            // preserves insertion order, so the first key is the oldest request.
-            for (const oldest of this.#tierRequests.keys()) {
-                this.#tierRequests.delete(oldest);
-                break;
-            }
-        }
-        this.#tierRequests.set(sessionID, { tier, via: "manual-command" });
+        void this.#tierRequests.set(sessionID, tier).catch(() => undefined);
+        // The user/agent explicitly asked Adaptive to route again (ADP-028).
+        this.#manualSelections.delete(sessionID);
         return true;
     }
     /** The session's tier request, or `null` when it follows the routing ladder. */
     async getTierRequest(sessionID) {
         await this.#ready;
-        return this.#tierRequests.get(sessionID)?.tier ?? null;
+        // A fire-and-forget note may still be in the queue: flush before reading.
+        await this.#tierRequests.flush();
+        return this.#tierRequests.get(sessionID);
     }
     /** Clear one session's tier request (`null` is the only valid input). */
     async setTierRequest(sessionID, tier) {
         await this.#ready;
         if (tier !== null)
             throw new Error("only null clears a tier request");
-        this.#tierRequests.delete(sessionID);
+        await this.#tierRequests.set(sessionID, null);
+        // Clearing through the control surface is the user asking Adaptive back.
+        this.#manualSelections.delete(sessionID);
     }
     // ---------- state API for the control surfaces (ADP-033/034/036) ----------
     /** Current settings (awaits the constructor load). */
@@ -344,7 +440,13 @@ export class Supervisor {
     /** Validate and persist a settings patch; returns per-field errors. */
     async updateSettings(patch) {
         await this.#ready;
-        return this.#settings.update(patch);
+        const result = await this.#settings.update(patch);
+        if (result.ok && patch.mode !== undefined) {
+            // A global mode change is the user steering Adaptive explicitly
+            // (ADP-028): manual-selection suppression lifts for every session.
+            this.#manualSelections.clear();
+        }
+        return result;
     }
     /** The session's mode override, or `null` when it follows the global mode. */
     async getSessionMode(sessionID) {
@@ -359,6 +461,8 @@ export class Supervisor {
     async setSessionMode(sessionID, mode) {
         await this.#ready;
         await this.#sessionModes.set(sessionID, mode);
+        // A mode change is the user steering Adaptive explicitly (ADP-028).
+        this.#manualSelections.delete(sessionID);
     }
     /**
      * Bounded status snapshot for the status view (ADP-033). Health is read
@@ -416,14 +520,24 @@ export class Supervisor {
             case "execution-interrupted":
                 await this.#onExecutionInterrupted(report);
                 return;
-            case "model-selected":
-                this.#tracker.apply({
+            case "model-selected": {
+                const result = this.#tracker.apply({
                     kind: "model-selected",
                     sessionID: report.sessionID,
                     at: report.at,
                     model: report.model,
                 });
+                // Whether the change was the user's pick or Adaptive's own switch
+                // decides who controls the session's model (ADP-028); the result
+                // carries the attribution the tracker resolved. Only the two
+                // selection sources reach this event kind.
+                const { source } = result.transition;
+                if (source === "selected-adaptive")
+                    this.#manualSelections.delete(report.sessionID);
+                else
+                    this.#noteManualSelection(report.sessionID);
                 return;
+            }
             case "model-request":
                 if (report.agent !== undefined) {
                     if (!this.#agents.has(report.sessionID) &&
@@ -437,12 +551,20 @@ export class Supervisor {
                     }
                     this.#agents.set(report.sessionID, report.agent);
                 }
-                this.#tracker.apply({
-                    kind: "model-request",
-                    sessionID: report.sessionID,
-                    at: this.#options.clock(),
-                    model: report.model,
-                });
+                // Only the agent loop's own request reports the model actually
+                // executing the unit's work. An auxiliary request (title, compaction,
+                // generate — ADP-027) carries the host's own cheap pick for that side
+                // request; adopting it as the session's model would misattribute the
+                // primary unit's health evidence and leave the next admission
+                // believing the unit runs on the wrong resource.
+                if (report.requestKind === "primary") {
+                    this.#tracker.apply({
+                        kind: "model-request",
+                        sessionID: report.sessionID,
+                        at: this.#options.clock(),
+                        model: report.model,
+                    });
+                }
                 return;
             case "http-response":
                 await this.#onHttpResponse(report);
@@ -481,14 +603,26 @@ export class Supervisor {
         // this admission re-routes from scratch.
         this.#continuationTiers.delete(sessionID);
         this.#promptAdmission.delete(sessionID);
+        this.#escalations.delete(sessionID);
         // A pending probe ticket from an earlier prompt admission (or a failed
         // recovery) can only be carried by the unit the ORIGINAL prompt opens;
-        // a fresh admission means that episode never ran, so the ticket re-arms
-        // here instead of being adopted by whichever unit opens next.
+        // a fresh admission means that episode never ran, so the ticket is
+        // released here instead of being adopted by whichever unit opens next.
         const stale = this.#sessionProbeTickets.get(sessionID);
         if (stale !== undefined) {
             this.#sessionProbeTickets.delete(sessionID);
-            this.#reportProbeOutcome(stale, { success: false, category: "user_cancelled" });
+            this.#health.releaseProbe(stale);
+        }
+        if (this.#manualSuppressionHolds(sessionID, settings)) {
+            // ADP-028: the user's own model pick stands (yielded to health if the
+            // picked resource is quarantined). Recording the defer (no switch, no
+            // marker) leaves OpenCode's choice — the picked model — in place;
+            // execution-started will skip routing the same way.
+            await this.#recordReceipt({
+                sessionID,
+                decision: { kind: "defer", reason: "routing-defer", detail: "manual-selection" },
+            });
+            return;
         }
         let probeTicket;
         try {
@@ -513,9 +647,9 @@ export class Supervisor {
         }
         catch (error) {
             // A probe admitted for this turn is lost when the admission fails (the
-            // switch threw): no unit will ever carry the ticket, so re-arm it.
+            // switch threw): no unit will ever carry the ticket, so release it.
             if (probeTicket !== undefined) {
-                this.#reportProbeOutcome(probeTicket, { success: false, category: "user_cancelled" });
+                this.#health.releaseProbe(probeTicket);
             }
             // Fail-open: no marker → execution-started re-routes the unit itself.
             logFailOpen("admission", error);
@@ -582,14 +716,22 @@ export class Supervisor {
         }
     }
     /** Fresh admission: routing ladder → scheduler, raw (unwrapped). */
-    async #admit(settings, sessionID) {
+    async #admit(settings, sessionID, requiredTier) {
+        // The agent-declared tier request (adaptive_tier tool) outranks the
+        // role hints but stays below the pin (ADP-002 ladder). The note is
+        // recorded fire-and-forget, so flush the store's queue before reading.
+        await this.#tierRequests.flush();
+        const tierRequest = this.#tierRequests.get(sessionID);
+        let routedTier;
+        if (requiredTier !== undefined) {
+            routedTier = { tier: requiredTier, via: "manual-command" };
+        }
+        else if (tierRequest !== null) {
+            routedTier = { tier: tierRequest, via: "manual-command" };
+        }
         const routing = resolveRouting({
             ...(settings.pin !== null ? { pin: settings.pin } : {}),
-            // The agent-declared tier request (adaptive_tier tool) outranks the
-            // role hints but stays below the pin (ADP-002 ladder).
-            ...(this.#tierRequests.has(sessionID)
-                ? { tierRequest: this.#tierRequests.get(sessionID) }
-                : {}),
+            ...(routedTier !== undefined ? { tierRequest: routedTier } : {}),
             // The agent-role hint is the session's last observed agent — the host
             // reports it on every model request (ADP-002 level 3).
             ...(this.#agents.has(sessionID) ? { agent: this.#agents.get(sessionID) } : {}),
@@ -603,10 +745,13 @@ export class Supervisor {
         await this.#capacity.refresh();
         const health = {};
         const capacity = {};
-        // Tickets issued by this assessment sweep (see the re-arm below).
+        // Tickets issued by this assessment sweep (see the release below).
         const issued = [];
-        for (const candidate of inventory) {
-            const ref = candidateRef(candidate);
+        // Only the routed candidates are assessed: assess flips a due breaker to
+        // half_open, and admitting a quick unit has no business touching an
+        // advanced-tier resource's breaker.
+        const routed = routing.kind === "pin" ? [routing.model] : tierCandidates;
+        for (const ref of routed) {
             const mapKey = schedulerHealthKey(ref);
             const assessment = this.#health.assess(refKey(ref));
             health[mapKey] = assessment;
@@ -630,12 +775,12 @@ export class Supervisor {
         };
         const decision = admit(input);
         // Assess admits a half-open probe for every due breaker it touches —
-        // including candidates this decision passed over (a ready sibling wins)
-        // or dispatched nothing for (defer/park). An issued-but-undispatched
-        // probe would wedge its resource in half_open: no unit ever carries the
-        // ticket, so nothing reports it and the resource never recovers. Re-arm
-        // each unselected ticket with the breaker's same backoff window — a
-        // probe that never ran is no health evidence.
+        // including candidates this decision passed over (an earlier ready
+        // candidate wins) or dispatched nothing for (defer/park). An
+        // issued-but-undispatched probe would wedge its resource in half_open:
+        // no unit ever carries the ticket. Release each unselected ticket — it
+        // stays due, because a probe that never ran is no health evidence and
+        // restarting its backoff would push it back on every admission.
         const selectedId = decision.kind === "apply" ? decision.evidence.probeId : undefined;
         let probeTicket;
         for (const ticket of issued) {
@@ -643,12 +788,22 @@ export class Supervisor {
                 probeTicket = ticket;
             }
             else {
-                this.#health.reportProbe(ticket, { success: false, category: "user_cancelled" });
+                this.#health.releaseProbe(ticket);
             }
         }
         return { routing, decision, ...(probeTicket !== undefined ? { probeTicket } : {}) };
     }
     async #routeAdmission(unit, settings, mode) {
+        if (this.#manualSuppressionHolds(unit.sessionID, settings)) {
+            // ADP-028: the session runs on the user's own pick (yielded to health
+            // if the picked resource is quarantined) — no re-route.
+            await this.#recordReceipt({
+                sessionID: unit.sessionID,
+                unitID: unit.id,
+                decision: { kind: "defer", reason: "routing-defer", detail: "manual-selection" },
+            });
+            return;
+        }
         const { routing, decision, probeTicket } = await this.#admit(settings, unit.sessionID);
         // The tier the unit was admitted under is escalation context (ADP-015);
         // recorded for every tiered routing outcome (including a defer, which
@@ -663,9 +818,9 @@ export class Supervisor {
             }
             catch (error) {
                 // The episode cannot carry the probe when the switch itself failed —
-                // re-arm the ticket instead of wedging the resource half-open.
+                // release the ticket instead of wedging the resource half-open.
                 if (probeTicket !== undefined) {
-                    this.#reportProbeOutcome(probeTicket, { success: false, category: "user_cancelled" });
+                    this.#health.releaseProbe(probeTicket);
                 }
                 throw error;
             }
@@ -675,8 +830,8 @@ export class Supervisor {
         }
         if (probeTicket !== undefined) {
             // OBSERVE wraps an apply — including a probe admission — without
-            // running it: no episode will ever report the ticket, so re-arm it.
-            this.#reportProbeOutcome(probeTicket, { success: false, category: "user_cancelled" });
+            // running it: no episode will ever report the ticket, so release it.
+            this.#health.releaseProbe(probeTicket);
         }
         // Observe-only records the identical decision; defer and park leave the
         // episode on OpenCode's own model (admission cannot hold an episode).
@@ -702,7 +857,7 @@ export class Supervisor {
     async #onExecutionSucceeded(report) {
         const unit = this.#tracker.active(report.sessionID);
         const model = unit?.model ?? this.#tracker.lastModel(report.sessionID)?.model;
-        const probeTicket = unit !== undefined ? this.#probeTickets.get(unit.id) : undefined;
+        const probeTicket = this.#takeProbeTicket(unit?.id);
         const closed = this.#tracker.apply({
             kind: "execution-succeeded",
             sessionID: report.sessionID,
@@ -714,7 +869,6 @@ export class Supervisor {
         }
         if (unit !== undefined) {
             if (probeTicket !== undefined) {
-                this.#probeTickets.delete(unit.id);
                 this.#reportProbeOutcome(probeTicket, { success: true });
             }
             await this.#attachOutcome(unit, { status: "succeeded" });
@@ -724,19 +878,16 @@ export class Supervisor {
         const unit = this.#tracker.active(report.sessionID);
         const model = unit?.model ?? this.#tracker.lastModel(report.sessionID)?.model;
         const unitID = unit?.id;
-        // Budget and tier are read before the close clears the per-unit maps.
+        // The tier is read before the close clears the per-unit maps.
         const admissionTier = unitID !== undefined ? this.#admissionTiers.get(unitID) : undefined;
-        const escalationUsed = unitID !== undefined ? (this.#escalations.get(unitID) ?? 0) : 0;
+        const escalationUsed = this.#escalations.get(report.sessionID) ?? 0;
         // Tool evidence is captured pre-close like the other per-unit maps.
         const toolEvidence = unitID !== undefined ? (this.#escalationEvidence.get(unitID) ?? []) : [];
-        const probeTicket = unitID !== undefined ? this.#probeTickets.get(unitID) : undefined;
-        const closed = this.#tracker.apply({
-            kind: "execution-failed",
-            sessionID: report.sessionID,
-            at: report.at,
-            error: report.error,
-        });
-        this.#afterUnitClose(closed);
+        const probeTicket = this.#takeProbeTicket(unitID);
+        // The terminal classifies and dedups BEFORE the close: the close clears
+        // the unit's attempt-failure entry, and the terminal must consult it —
+        // it repeats the episode's last attempt, which an attempt signal
+        // (http-response or retry hook) already counted.
         const classification = classifyFailure({
             structured: {
                 type: report.error.type,
@@ -750,13 +901,20 @@ export class Supervisor {
             // The retry hook deliberately omits text: it must stay conservative.
             text: report.error.message,
         });
-        if (model !== undefined) {
+        const countTerminal = this.#countTerminalFailure(unitID, classification.category);
+        const closed = this.#tracker.apply({
+            kind: "execution-failed",
+            sessionID: report.sessionID,
+            at: report.at,
+            error: report.error,
+        });
+        this.#afterUnitClose(closed);
+        if (model !== undefined && countTerminal) {
             this.#observeHealth(failureEvent(refKey(model), classification));
         }
         if (unit !== undefined) {
             await this.#attachOutcome(unit, { status: "failed", category: classification.category });
             if (probeTicket !== undefined) {
-                this.#probeTickets.delete(unit.id);
                 this.#reportProbeOutcome(probeTicket, { success: false, category: classification.category });
             }
         }
@@ -783,8 +941,11 @@ export class Supervisor {
             return [];
         }
         const eligible = [];
+        // Compared by resource key: the host reports base-model calls as variant
+        // "default", which is the same resource as the bare tier entry.
+        const failedID = resourceKeyID(refKey(failed));
         for (const ref of refs) {
-            if (sameModelRef(ref, failed))
+            if (resourceKeyID(refKey(ref)) === failedID)
                 continue;
             const candidate = inventory.find((entry) => sameModelRef(candidateRef(entry), ref));
             if (candidate === undefined)
@@ -822,11 +983,11 @@ export class Supervisor {
             currentTier: admissionTier,
             nextTierResources: eligible,
             evidence,
-            budget: { used: escalationUsed, max: MAX_ESCALATIONS_PER_UNIT },
+            budget: { used: escalationUsed, max: MAX_ESCALATIONS_PER_TASK },
         });
         const wrapped = schedulerForMode(plan, this.#modeFor(report.sessionID, settings));
         if (wrapped.kind === "escalate") {
-            this.#escalations.set(unitID, escalationUsed + 1);
+            this.#escalations.set(report.sessionID, escalationUsed + 1);
             // Recorded unit-less on purpose: the receipt describes the CONTINUATION
             // decision, so the continuation unit adopts it and its outcome attaches
             // here (the failed unit's own outcome attaches to its apply receipt).
@@ -838,10 +999,11 @@ export class Supervisor {
             // Continue the interrupted work on the escalated resource; the unit is
             // terminally failed, so an ops failure is only logged (never parked).
             try {
-                await this.#ownRecovery(report.sessionID, wrapped.target, wrapped.tier);
+                await this.#ownRecovery(report.sessionID, wrapped.target, wrapped.tier, () => this.#modeFor(report.sessionID, settings) !== "off");
             }
             catch (error) {
-                logFailOpen("escalation-ops", error);
+                if (!(error instanceof RecoveryAbortedError))
+                    logFailOpen("escalation-ops", error);
             }
             return;
         }
@@ -858,7 +1020,13 @@ export class Supervisor {
             return;
         }
         const unit = this.#tracker.active(report.sessionID);
-        const probeTicket = unit !== undefined ? this.#probeTickets.get(unit.id) : undefined;
+        const probeTicket = this.#takeProbeTicket(unit?.id);
+        // An interruption while a recovery is pending on this session aborts it
+        // at its post-settle guard (the pending recovery's decision predates the
+        // interruption and must not act after it).
+        if (this.#recoveryPending.has(report.sessionID)) {
+            this.#recoveryInterrupted.add(report.sessionID);
+        }
         const closed = this.#tracker.apply({
             kind: "execution-interrupted",
             sessionID: report.sessionID,
@@ -872,7 +1040,6 @@ export class Supervisor {
             // An interrupted probe is no evidence about resource health: re-arm the
             // breaker's same window rather than doubling it.
             if (probeTicket !== undefined) {
-                this.#probeTickets.delete(unit.id);
                 this.#reportProbeOutcome(probeTicket, { success: false, category: "user_cancelled" });
             }
             await this.#attachOutcome(unit, { status: "interrupted", reason });
@@ -889,23 +1056,81 @@ export class Supervisor {
         // unknown ticket) are reported by its boolean return, not by throwing.
         this.#health.reportProbe(ticket, outcome);
     }
+    /**
+     * One attempt's failure evidence (http-response event or retry hook):
+     * returns whether THIS observation is the attempt's first count.
+     */
+    #countAttemptFailure(unitID, source, category) {
+        if (unitID === undefined)
+            return true;
+        const ev = this.#attemptFailures.get(unitID) ?? {};
+        if (source === "http" ? ev.retry === category : ev.http === category) {
+            // The other host signal already counted this attempt: consume it.
+            const closed = { ...ev, http: undefined, retry: undefined, closed: category };
+            this.#attemptFailures.set(unitID, closed);
+            return false;
+        }
+        this.#attemptFailures.set(unitID, source === "http" ? { ...ev, http: category } : { ...ev, retry: category });
+        return true;
+    }
+    /**
+     * The terminal `execution-failed` repeats the episode's last attempt: it
+     * counts only when the last attempt left no live evidence (e.g. a
+     * capability failure that never produced an HTTP response or retry hook).
+     */
+    #countTerminalFailure(unitID, category) {
+        if (unitID === undefined)
+            return true;
+        const ev = this.#attemptFailures.get(unitID) ?? {};
+        if (ev.http === category) {
+            this.#attemptFailures.set(unitID, { ...ev, http: undefined });
+            return false;
+        }
+        if (ev.retry === category) {
+            this.#attemptFailures.set(unitID, { ...ev, retry: undefined });
+            return false;
+        }
+        if (ev.closed === category) {
+            this.#attemptFailures.set(unitID, { ...ev, closed: undefined });
+            return false;
+        }
+        this.#attemptFailures.set(unitID, { ...ev, closed: category });
+        return true;
+    }
+    /**
+     * Hands a closing unit's probe ticket to its explicit outcome reporter.
+     * Taken BEFORE the close: #afterUnitClose treats any ticket still held as
+     * lost and re-opens the breaker, which would turn a probe's real outcome
+     * into a stale report.
+     */
+    #takeProbeTicket(unitID) {
+        if (unitID === undefined)
+            return undefined;
+        const ticket = this.#probeTickets.get(unitID);
+        this.#probeTickets.delete(unitID);
+        return ticket;
+    }
     /** Bounded per-unit bookkeeping once the tracker closed the unit. */
     #afterUnitClose(closed) {
         const unitID = closedUnitID(closed);
         if (unitID !== undefined) {
             this.#vetoes.delete(unitID);
-            this.#escalations.delete(unitID);
             this.#admissionTiers.delete(unitID);
             this.#escalationEvidence.delete(unitID);
             const leftover = this.#probeTickets.get(unitID);
             if (leftover !== undefined) {
-                // The explicit outcome reporters run before this cleanup; reaching
-                // here means the unit ended without one (superseded or lost).
+                // The explicit outcome reporters take their ticket before this
+                // cleanup; reaching here means the unit ended without one
+                // (superseded or lost).
                 this.#reportProbeOutcome(leftover, { success: false, category: "user_cancelled" });
                 this.#probeTickets.delete(unitID);
             }
         }
         if (closed.kind === "opened" || closed.kind === "closed") {
+            const unitID = closedUnitID(closed);
+            if (unitID !== undefined) {
+                this.#attemptFailures.delete(unitID);
+            }
             // Per-session flags for a unit that will never open again must not
             // leak: a stale continuation mark would swallow a real user prompt's
             // admission; a stale admission marker would skip routing. The guard
@@ -939,7 +1164,11 @@ export class Supervisor {
                 ? { headers: { "retry-after": report.retryAfterHeader } }
                 : {}),
         });
-        this.#observeHealth(failureEvent(refKey(model), classification));
+        // The retry hook classifies the same request for the host's retry
+        // decision; counting both would double every attempt (ADP-019).
+        if (this.#countAttemptFailure(unit?.id, "http", classification.category)) {
+            this.#observeHealth(failureEvent(refKey(model), classification));
+        }
     }
     // ---------- retry hook ----------
     async #handleRetry(input, settings) {
@@ -952,7 +1181,12 @@ export class Supervisor {
             },
             status: input.error.status,
         });
-        this.#observeHealth(failureEvent(refKey(input.model), classification));
+        const unitID = this.#tracker.active(input.sessionID)?.id;
+        // The pumped http-response event describes the same failed request;
+        // counting both would double every attempt (ADP-019).
+        if (this.#countAttemptFailure(unitID, "retry", classification.category)) {
+            this.#observeHealth(failureEvent(refKey(input.model), classification));
+        }
         // Recovery = fresh admission; the failed resource is already health-blocked.
         let recovery = { kind: "none" };
         let routingTier;
@@ -976,7 +1210,6 @@ export class Supervisor {
         catch (error) {
             logFailOpen("recovery", error);
         }
-        const unitID = this.#tracker.active(input.sessionID)?.id;
         const vetoesUsed = unitID !== undefined ? (this.#vetoes.get(unitID) ?? 0) : 0;
         const core = decideRetry({
             classification,
@@ -988,10 +1221,10 @@ export class Supervisor {
         const wrapped = retryForMode(core, this.#modeFor(input.sessionID, settings));
         if (wrapped.kind !== "veto") {
             // OBSERVE (and a declined veto) never runs the recovery episode, so an
-            // admitted probe has no continuation to report it — re-arm it here or
+            // admitted probe has no continuation to report it — release it here or
             // the resource wedges half-open.
             if (probeTicket !== undefined) {
-                this.#reportProbeOutcome(probeTicket, { success: false, category: "user_cancelled" });
+                this.#health.releaseProbe(probeTicket);
             }
             return;
         }
@@ -1004,10 +1237,10 @@ export class Supervisor {
         if (probeTicket !== undefined) {
             // The session holds one pending probe slot. A still-pending older
             // ticket belongs to a recovery whose continuation has not started (its
-            // episode can no longer claim this slot) — re-arm it before replacing.
+            // episode can no longer claim this slot) — release it before replacing.
             const stale = this.#sessionProbeTickets.get(input.sessionID);
             if (stale !== undefined && stale !== probeTicket) {
-                this.#reportProbeOutcome(stale, { success: false, category: "user_cancelled" });
+                this.#health.releaseProbe(stale);
             }
             this.#sessionProbeTickets.set(input.sessionID, probeTicket);
         }
@@ -1024,17 +1257,28 @@ export class Supervisor {
             // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- a veto implies the admission was an apply (the recovery exists only then)
             decision: admission,
         });
-        void this.#ownRecovery(input.sessionID, wrapped.model, routingTier)
+        void this.#ownRecovery(input.sessionID, wrapped.model, routingTier, () => this.#modeFor(input.sessionID, settings) !== "off")
             .then(() => undefined)
             .catch(async (error) => {
+            if (error instanceof RecoveryAbortedError) {
+                // The user steered away (interruption / OFF) during the settle: the
+                // veto stands, but no continuation episode will ever carry the
+                // probe it admitted — release it instead of wedging half-open.
+                if (probeTicket !== undefined &&
+                    this.#sessionProbeTickets.get(input.sessionID) === probeTicket) {
+                    this.#sessionProbeTickets.delete(input.sessionID);
+                    this.#health.releaseProbe(probeTicket);
+                }
+                return;
+            }
             logFailOpen("recovery-ops", error);
             // The recovery rejected before (or while) delivering its continuation
-            // prompt, so no unit will ever carry the probe it admitted — re-arm
+            // prompt, so no unit will ever carry the probe it admitted — release
             // it instead of wedging the resource half-open.
             if (probeTicket !== undefined &&
                 this.#sessionProbeTickets.get(input.sessionID) === probeTicket) {
                 this.#sessionProbeTickets.delete(input.sessionID);
-                this.#reportProbeOutcome(probeTicket, { success: false, category: "user_cancelled" });
+                this.#health.releaseProbe(probeTicket);
             }
             if (unitID === undefined || routingTier === undefined)
                 return;
@@ -1059,17 +1303,33 @@ export class Supervisor {
      * continuation's prompt hook re-arms the admission marker (the unit must
      * not be re-routed: that would discard the recovery/escalation decision).
      */
-    async #ownRecovery(sessionID, model, tier) {
+    async #ownRecovery(sessionID, model, tier, stillValid) {
         if (tier !== undefined)
             this.#continuationTiers.set(sessionID, tier);
-        const alive = await this.#isSessionAlive(sessionID);
-        const recovery = { kind: "switch", model };
-        const action = planContinuation({
-            recovery,
-            continuationPossible: alive,
-        });
+        // The guard window opens before the first await so an interrupt pumped
+        // during the admission race is still seen.
+        this.#recoveryPending.add(sessionID);
         try {
-            await executeContinuation({ sessionID, action, ops: this.#ops });
+            const alive = await this.#isSessionAlive(sessionID);
+            const recovery = { kind: "switch", model };
+            const action = planContinuation({
+                recovery,
+                continuationPossible: alive,
+            });
+            // executeContinuation settles first; the supervisor settles here so the
+            // post-settle guard (mode OFF, user interruption) can abort before any
+            // switch or prompt — the settle is the only step that can take
+            // unbounded time, and a decision made before it may be stale after it.
+            await this.#ops.settle(sessionID);
+            if (!stillValid() || this.#recoveryInterrupted.delete(sessionID)) {
+                throw new RecoveryAbortedError(sessionID);
+            }
+            // Already settled above; the action's own settle is a no-op.
+            await executeContinuation({
+                sessionID,
+                action,
+                ops: { ...this.#ops, settle: () => Promise.resolve() },
+            });
         }
         catch (error) {
             // The continuation prompt never reached the host, so no unit will open
@@ -1079,6 +1339,9 @@ export class Supervisor {
                 this.#continuationTiers.delete(sessionID);
             throw error;
         }
+        finally {
+            this.#recoveryPending.delete(sessionID);
+        }
     }
     // ---------- parked-work resume (safe boundary: idle) ----------
     async #onIdle(settings) {
@@ -1087,7 +1350,8 @@ export class Supervisor {
         // pruned here (its per-session steering is worthless once the session is
         // gone), in the same sweep that clears the other per-session maps.
         const overrideIDs = this.#sessionModes.snapshot().map((record) => record.sessionID);
-        if (records.length === 0 && overrideIDs.length === 0 && this.#tierRequests.size === 0)
+        const tierRequestIDs = this.#tierRequests.snapshot().map((record) => record.sessionID);
+        if (records.length === 0 && overrideIDs.length === 0 && tierRequestIDs.length === 0)
             return;
         // OFF sessions are not supervised: their parked records are neither
         // dropped nor resumed, and no alive probe runs for them.
@@ -1100,7 +1364,7 @@ export class Supervisor {
         }
         // Tier-request holders join the alive sweep too: a dead session's sticky
         // tier request dies with its session, like the other per-session maps.
-        for (const sessionID of this.#tierRequests.keys()) {
+        for (const sessionID of tierRequestIDs) {
             if (!alive.has(sessionID))
                 alive.set(sessionID, await this.#isSessionAlive(sessionID));
         }
@@ -1114,9 +1378,18 @@ export class Supervisor {
             await this.#dropParked(dropped);
         }
         // Tier requests die with their session, like the other per-session maps.
-        for (const sessionID of this.#tierRequests.keys()) {
-            if (alive.get(sessionID) === false)
-                this.#tierRequests.delete(sessionID);
+        // The fire-and-forget note means the queue may still hold writes; the
+        // serialized set applies after them. A write failure just leaves the
+        // record (fail-open — it will die with the session on the next sweep).
+        for (const sessionID of tierRequestIDs) {
+            if (alive.get(sessionID) === false) {
+                try {
+                    await this.#tierRequests.set(sessionID, null);
+                }
+                catch (error) {
+                    logFailOpen("tier-requests", error);
+                }
+            }
         }
         // At most ONE continuation per session per sweep: prompting a session
         // with an active unit would supersede the user's in-flight episode (not
@@ -1138,6 +1411,7 @@ export class Supervisor {
                 this.#continuationTiers.delete(sessionID);
                 this.#promptAdmission.delete(sessionID);
                 this.#continuationPending.delete(sessionID);
+                this.#escalations.delete(sessionID);
                 if (this.#sessionModes.get(sessionID) !== null) {
                     try {
                         await this.#sessionModes.set(sessionID, null);
@@ -1163,14 +1437,19 @@ export class Supervisor {
         // report's session's mode.
         const mode = this.#modeFor(record.sessionID, settings);
         let decision;
+        let probeTicket;
         try {
-            decision = (await this.#admit(settings, record.sessionID)).decision;
+            const admission = await this.#admit(settings, record.sessionID, record.tier);
+            decision = admission.decision;
+            probeTicket = admission.probeTicket;
         }
         catch (error) {
             logFailOpen("resume", error);
             return;
         }
         if (mode === "observe") {
+            if (probeTicket !== undefined)
+                this.#health.releaseProbe(probeTicket);
             await this.#recordReceipt({
                 sessionID: record.sessionID,
                 unitID: record.id,
@@ -1180,7 +1459,9 @@ export class Supervisor {
             return;
         }
         if (decision.kind !== "apply") {
-            // Still no usable resource (or the routing deferred) — stay parked.
+            // Still no usable resource (or the routing deferred) — stay parked. The
+            // admission held no probe ticket: #admit keeps a ticket only for apply
+            // decisions and releases every other one itself.
             await this.#recordReceipt({
                 sessionID: record.sessionID,
                 unitID: record.id,
@@ -1190,8 +1471,11 @@ export class Supervisor {
             return;
         }
         const popped = await this.#popParked(record);
-        if (popped === undefined)
+        if (popped === undefined) {
+            if (probeTicket !== undefined)
+                this.#health.releaseProbe(probeTicket);
             return;
+        }
         // The resume continuation is not re-admitted (owned continuation), so
         // the freshly routed admission is recorded here, unit-less; the unit
         // that opens next adopts it and carries the outcome.
@@ -1204,10 +1488,23 @@ export class Supervisor {
         // freshly routed model, then prompt — the episode's first LLM call must
         // not hit the model the work was parked away from.
         try {
-            await this.#ownRecovery(record.sessionID, decision.model, record.tier);
+            if (probeTicket !== undefined)
+                this.#sessionProbeTickets.set(record.sessionID, probeTicket);
+            await this.#ownRecovery(record.sessionID, decision.model, record.tier, 
+            // The parked session's own effective mode and its still-open unit
+            // window are re-checked after the settle; a session that gained an
+            // active unit must not be prompted (not a safe boundary).
+            () => this.#modeFor(record.sessionID, settings) !== "off" &&
+                this.#tracker.active(record.sessionID) === undefined);
         }
         catch (error) {
-            logFailOpen("resume", error);
+            if (probeTicket !== undefined &&
+                this.#sessionProbeTickets.get(record.sessionID) === probeTicket) {
+                this.#sessionProbeTickets.delete(record.sessionID);
+                this.#health.releaseProbe(probeTicket);
+            }
+            if (!(error instanceof RecoveryAbortedError))
+                logFailOpen("resume", error);
             await this.#rePark(record);
         }
     }
@@ -1238,8 +1535,14 @@ export class Supervisor {
             await this.#options.session.get({ sessionID });
             return true;
         }
-        catch {
-            return false;
+        catch (error) {
+            // The host rejects `session.get` for a missing session with a plain
+            // error and exposes no typed status; only a definitive not-found
+            // counts as dead. Anything else is treated as alive (fail open toward
+            // keeping durable user state, ADP-031): a transient storage or host
+            // error must never prune parked work, mode overrides, or tier
+            // requests — the next sweep re-probes instead.
+            return !/not found/i.test(String(error));
         }
     }
     async #recordReceipt(input) {