@gajae-code/coding-agent 0.12.19 → 0.12.20

package/src/sdk/bus/conversation-store.ts

@@ -349,7 +349,7 @@ export class ConversationStore<T extends ConversationRecord> {
 		try {
 			await this.#fs.writeFile(temporary, `${JSON.stringify(document)}\n`, { mode: 0o600 });
 			await this.#fs.chmod(temporary, 0o600);
-			const handle = await this.#fs.open(temporary, "r");
+			const handle = await this.#fs.open(temporary, "r+");
 			try {
 				await handle.sync();
 			} finally {

package/src/sdk/bus/discord-daemon.ts

@@ -107,6 +107,7 @@ export interface DiscordNotificationInput {
 	threadName?: string;
 	actionId?: string;
 	options?: string[];
+	publicationId?: string;
 }
 
 type DiscordInboundEffectPayload =
@@ -326,7 +327,7 @@ export class DiscordNotificationDaemon {
 		// original post and preserves the original component route.
 		const effectId = pendingActionId
 			? authoritative.pendingActionEffectId!
-			: `notification:${authoritative.threadId}:${randomUUID()}`;
+			: `notification:${authoritative.threadId}:${input.publicationId ?? randomUUID()}`;
 		await this.#postEffect(effectId, authoritative, input.content, components, pendingActionId !== undefined);
 
 		return authoritative;

package/src/sdk/bus/discord-live-provider.ts

@@ -13,6 +13,7 @@ const GATEWAY_INTENTS = 1 + 512 + 32_768;
 const MAX_RATE_LIMIT_RETRIES = 2;
 const NONCE_PREFIX = "<!-- gjc-thread-nonce:";
 const INVALID_SESSION_RECONNECT_DELAY_MS = 1_000;
+const TERMINAL_GATEWAY_CLOSE_CODES: ReadonlySet<number> = new Set([4_004, 4_010, 4_011, 4_012, 4_013, 4_014]);
 
 const NONCE_SUFFIX = " -->";
 
@@ -329,15 +330,35 @@ export class DiscordLiveProvider implements DiscordProvider, DiscordDiagnosticPr
 		socket.addEventListener("message", event => {
 			void this.#handleGateway(socket, event).catch(error => this.#handleGatewayFailure(socket, error));
 		});
-		socket.addEventListener("close", () => this.#scheduleReconnect(socket));
+		socket.addEventListener("close", event => {
+			const code = typeof (event as CloseEvent).code === "number" ? (event as CloseEvent).code : 0;
+			if (TERMINAL_GATEWAY_CLOSE_CODES.has(code)) {
+				this.#gatewayError = new Error(`Discord gateway rejected the connection (close code ${code})`);
+				this.#heartbeat?.cancel();
+				this.#heartbeat = undefined;
+				this.#gatewayReady = false;
+				return;
+			}
+			this.#scheduleReconnect(socket);
+		});
 		socket.addEventListener("error", () => {
 			if (socket.readyState !== 3) socket.close();
 		});
 	}
 
 	async #handleGateway(socket: DiscordGatewaySocket, event: Event): Promise<void> {
-		const data = (event as MessageEvent).data;
-		if (typeof data !== "string") return;
+		const raw = (event as MessageEvent).data;
+		const data =
+			typeof raw === "string"
+				? raw
+				: raw instanceof ArrayBuffer
+					? Buffer.from(raw).toString("utf8")
+					: ArrayBuffer.isView(raw)
+						? Buffer.from(raw.buffer, raw.byteOffset, raw.byteLength).toString("utf8")
+						: raw instanceof Blob
+							? await raw.text()
+							: undefined;
+		if (data === undefined) return;
 		let frame: JsonRecord;
 		try {
 			frame = JSON.parse(data) as JsonRecord;
@@ -387,7 +408,7 @@ export class DiscordLiveProvider implements DiscordProvider, DiscordDiagnosticPr
 			this.#resumeGatewayUrl = this.#string(payload, "resume_gateway_url");
 		}
 		if (frame.t === "READY" || frame.t === "RESUMED") this.#gatewayReady = true;
-		const inbound = this.#inbound(frame.t, payload);
+		const inbound = await this.#inbound(frame.t, payload);
 		if (inbound && !inbound.bot && inbound.authorId !== this.#botUserId) await this.#onEvent?.(inbound);
 	}
 	#handleGatewayFailure(socket: DiscordGatewaySocket, error: unknown): void {
@@ -526,14 +547,21 @@ export class DiscordLiveProvider implements DiscordProvider, DiscordDiagnosticPr
 			this.#string(this.#record(data.channel), "parent_id")
 		);
 	}
-	#inbound(type: unknown, data: JsonRecord): DiscordInboundEvent | undefined {
+	async #inbound(type: unknown, data: JsonRecord): Promise<DiscordInboundEvent | undefined> {
 		if (type === "MESSAGE_CREATE") {
 			const id = this.#string(data, "id");
 			const guildId = this.#string(data, "guild_id");
 			const threadId = this.#string(data, "channel_id");
 			const author = this.#record(data.author);
 			const authorId = this.#string(author, "id");
-			const parentId = this.#parentId(data);
+			let parentId = this.#parentId(data);
+			if (!parentId && threadId) {
+				try {
+					parentId = this.#string(this.#record(await this.#request(`/channels/${threadId}`)), "parent_id");
+				} catch {
+					return undefined;
+				}
+			}
 			if (!id || !guildId || !threadId || !parentId || !authorId) return undefined;
 			return {
 				id,

package/src/sdk/bus/index.ts

@@ -80,6 +80,7 @@ import {
 } from "../../tools/ask-answer-registry";
 import { acpFinalTextFromMessage } from "../acp/final-text";
 import { ensureBroker } from "../broker/ensure";
+import { publishSessionHostRuntimeEvidence, type SessionHostRuntimePublication } from "../broker/lifecycle";
 import { SessionIndex } from "../broker/session-index";
 import { createSdkSurfaceFactory, type SessionSdkHost, SessionSdkSessionRuntime, shouldHostSdk } from "../host";
 import { type ControlSurface, dispatchControl } from "../host/control";
@@ -92,6 +93,7 @@ import {
 	syntheticModelInputError,
 	syntheticNamespaceCollision,
 } from "../model-profile-model";
+import { formatPromptFailureForLocalLog, sanitizePromptFailure } from "../prompt-failure";
 import { PROMPT_CLIENT_REF_MAX_LENGTH, type SdkPromptTerminalOutcome } from "../prompt-status";
 import { OPERATIONS } from "../protocol/operation-registry";
 import {
@@ -127,7 +129,7 @@ import { imageAttachmentsFromMessage, notificationActionPayload, summaryFromMess
 import { createKindAwareReconciliation } from "./kind-aware-reconciliation";
 import { assertNativeRuntimeCompatibility } from "./native-runtime-compatibility";
 import { proposedTelegramIdentity } from "./notification-orchestration";
-import { createPromptReconciliation, sanitizePromptFailure } from "./prompt-reconciliation";
+import { createPromptReconciliation } from "./prompt-reconciliation";
 import { createReconciliationStore } from "./reconciliation-store";
 import { NotificationSessionController, type NotificationSessionRuntime } from "./session-control";
 import type { SlackConversation } from "./slack-conversation";
@@ -153,6 +155,40 @@ export {
 
 const PROMPT_SETTLEMENT_DIAGNOSTIC_ENTRY_LIMIT = 8;
 const PROMPT_SETTLEMENT_DIAGNOSTIC_MAX_AGE_MS = 86_400_000;
+/**
+ * Upper bound on the failure reason copied into the local operator log. Mirrors
+ * the 512-char bound documented for reconciliation failure messages so a runaway
+ * provider error cannot flood the log file.
+ */
+const PROMPT_TERMINAL_FAILURE_REASON_LOG_MAX = 512;
+type PromptTerminalDiagnostic = {
+	reason?: unknown;
+	loopStopReason?: string;
+	assistantStopReason?: string;
+	errorKind?: string;
+	intentionalCancellation?: boolean;
+};
+
+type PromptTerminalExtra = {
+	finalText?: string;
+	error?: { code: string; message: string };
+	diagnostic?: PromptTerminalDiagnostic;
+	diagnosticAlreadyLogged?: boolean;
+};
+
+function formatPromptTerminalFailureReason(reason: unknown): string {
+	let rawReason: string;
+	if (reason instanceof Error) rawReason = reason.message;
+	else if (typeof reason === "string") rawReason = reason;
+	else if (reason === undefined || reason === null) return "unreported";
+	else
+		try {
+			rawReason = String(reason);
+		} catch {
+			return "unreported";
+		}
+	return rawReason ? rawReason.slice(0, PROMPT_TERMINAL_FAILURE_REASON_LOG_MAX) : "unreported";
+}
 
 export function formatPromptSettlementDiagnostic(
 	proof: Extract<RunSettlementProof, { status: "unfenced" }>,
@@ -1170,6 +1206,8 @@ interface SessionRuntime {
 	/** Terminal cleanup proof retained across retries; each owner is released at most once after proof. */
 	hostStopped: boolean;
 	serverStopped: boolean;
+	/** This runtime's own host-liveness publication; only its teardown may retract it. */
+	evidencePublication?: SessionHostRuntimePublication;
 	brokerRegistrationReleased: boolean;
 	/** Managed Telegram root registration released during terminal teardown. */
 	notificationRootRegistration?: { settings: Settings; cwd: string; registrationToken: string };
@@ -1192,11 +1230,8 @@ interface SessionRuntime {
 	terminalizePrompt: (
 		correlation: { commandId: string; turnId: string },
 		outcome: SdkPromptTerminalOutcome,
-		extra?: { finalText?: string },
+		extra?: PromptTerminalExtra,
 	) => Promise<void>;
-	/** Records a correlated prompt terminal boundary after agent unwind. */
-	/** Atomically claims a correlated prompt terminal boundary after agent unwind. */
-	recordPromptTerminal: (correlation: { commandId: string; turnId: string } | undefined) => boolean;
 	/** Transitions the authoritative reconciliation record at lifecycle ingress; terminal outcomes settle once. */
 	notePromptReconciliation: (
 		correlation: { commandId: string; turnId: string } | undefined,
@@ -3749,6 +3784,13 @@ export function createNotificationsExtension(
 				await rt.server.stopAndWait();
 				serverStopped = true;
 				rt.serverStopped = true;
+				// This runtime no longer serves an SDK endpoint, so it withdraws its
+				// own evidence — and only its own. A predecessor's deferred teardown
+				// runs while an identity successor is already serving, and clearing
+				// that live runtime's reader would manufacture "no evidence" for a
+				// host whose clients are still attached.
+				rt.evidencePublication?.retract();
+				rt.evidencePublication = undefined;
 			} catch (e) {
 				ownerReleaseFailures.push(e);
 				logger.warn(`notifications: stop failed: ${String(e)}`);
@@ -4047,7 +4089,6 @@ export function createNotificationsExtension(
 			connectionId: string;
 			abandoned: boolean;
 			failed: boolean;
-			error: unknown;
 			terminal: boolean;
 			retainCorrelation: boolean;
 			/** Fatal/uncertain closure: transport-level only, never a semantic terminal. */
@@ -4246,7 +4287,6 @@ export function createNotificationsExtension(
 				connectionId: requesterConnectionId,
 				abandoned: false,
 				failed: false,
-				error: undefined,
 				terminal: false,
 				retainCorrelation: trackReconciliation,
 				createdAt: Date.now(),
@@ -4268,6 +4308,7 @@ export function createNotificationsExtension(
 						provenance: "deadline",
 					},
 					{ fence: true },
+					{ diagnostic: { reason: "Prompt deadline exceeded." } },
 				);
 			}, submission.deadlineMs);
 		};
@@ -4354,7 +4395,7 @@ export function createNotificationsExtension(
 			// run and prove settlement. A natural `agent_end`/`agent_failed` already unwound,
 			// so aborting there would cancel the next turn instead of fencing this one.
 			options: { fence?: boolean } = {},
-			extra?: { finalText?: string; error?: { code: string; message: string } },
+			extra?: PromptTerminalExtra,
 		) => {
 			const submission = promptSubmissions.get(promptSubmissionKey(correlation));
 			if (!submission || submission.terminal || submission.phase !== "active") return;
@@ -4426,6 +4467,24 @@ export function createNotificationsExtension(
 			}
 			if (submission.deadlineTimer) clearTimeout(submission.deadlineTimer);
 			if (!recordPromptTerminal(correlation) || !runtime) return;
+			if (
+				winner.kind === "failed" &&
+				extra?.diagnostic?.intentionalCancellation !== true &&
+				extra?.diagnosticAlreadyLogged !== true
+			) {
+				const diagnostic = extra?.diagnostic;
+				logger.error("sdk_prompt_terminal_failed", {
+					sessionId: id,
+					commandId: correlation.commandId,
+					turnId: correlation.turnId,
+					code: winner.code,
+					provenance: winner.provenance,
+					...(diagnostic?.loopStopReason ? { loopStopReason: diagnostic.loopStopReason } : {}),
+					...(diagnostic?.assistantStopReason ? { assistantStopReason: diagnostic.assistantStopReason } : {}),
+					...(diagnostic?.errorKind ? { errorKind: diagnostic.errorKind } : {}),
+					reason: formatPromptTerminalFailureReason(diagnostic?.reason),
+				});
+			}
 			if (winner.kind === "failed") {
 				emitPromptLifecycle(correlation, {
 					type: "agent_failed",
@@ -4445,26 +4504,41 @@ export function createNotificationsExtension(
 			}
 		};
 		const emitPromptFailure = (correlation: { commandId: string; turnId: string }, error: unknown) => {
+			logger.error("SDK prompt submission failed", {
+				commandId: correlation.commandId,
+				turnId: correlation.turnId,
+				error: formatPromptFailureForLocalLog(error),
+			});
 			const sanitized = sanitizePromptFailure(error);
+			const outcome: SdkPromptTerminalOutcome = {
+				kind: "failed",
+				code: "prompt_failed",
+				message: sanitized.message,
+				provenance: "agent_failed",
+			};
+			// This rejection bypasses `agent_end`, so record its local-only reason at
+			// the accepted submission failure boundary before terminalization begins.
+			logger.error("sdk_prompt_terminal_failed", {
+				sessionId: id,
+				commandId: correlation.commandId,
+				turnId: correlation.turnId,
+				code: outcome.code,
+				provenance: outcome.provenance,
+				reason: formatPromptTerminalFailureReason(error),
+			});
 			void terminalizePrompt(
 				correlation,
-				{
-					kind: "failed",
-					code: "prompt_failed",
-					message: sanitized.message,
-					provenance: "agent_failed",
-				},
+				outcome,
 				{},
-				// The normalized outcome is the ACP contract; the wire error keeps the
-				// existing sanitized discriminator so SDK clients keep branching on it.
-				{ error: sanitized },
+				// The normalized outcome and wire error retain the fixed safe token.
+				// Mark the diagnostic as recorded so terminalization does not duplicate it.
+				{ error: sanitized, diagnostic: { reason: error }, diagnosticAlreadyLogged: true },
 			);
 		};
 		const recordPromptFailure = (correlation: { commandId: string; turnId: string }, error: unknown) => {
 			const submission = promptSubmissions.get(promptSubmissionKey(correlation));
 			if (!submission) return;
 			submission.failed = true;
-			submission.error = error;
 			removePendingPromptCorrelation(correlation);
 			if (
 				runtime?.activePromptCorrelation?.commandId === correlation.commandId &&
@@ -4894,7 +4968,6 @@ export function createNotificationsExtension(
 			bindPromptExecutionHandle,
 			peekPromptPendingOutcome: correlation => kindReconciliation.peekPendingOutcome(correlation),
 			terminalizePrompt: (correlation, outcome, extra) => terminalizePrompt(correlation, outcome, {}, extra),
-			recordPromptTerminal,
 			notePromptReconciliation: (correlation, frame) => {
 				void kindReconciliation.noteTransition("prompt", correlation, frame);
 			},
@@ -5503,6 +5576,14 @@ export function createNotificationsExtension(
 			};
 			host.emitEvent({ kind: identityHeader.type, payload: identityHeader });
 			const endpoint = await sdkRuntime.startTransport();
+			// The native server owns the only authoritative view of this host's live
+			// SDK client sockets; publish it so a detached session host can bound its
+			// own lifetime without probing the OS (#4010). The handle is this
+			// runtime's alone, so only this runtime's teardown can retract it.
+			initializedRuntime.evidencePublication = publishSessionHostRuntimeEvidence({
+				attachedClients: () => server.clientCount(),
+				workInFlight: () => initializedRuntime.busy || initializedRuntime.pendingPromptCorrelations.length > 0,
+			});
 			ephemeralTurns.configureAuthority({
 				sessionId: id,
 				endpointDigest: endpointAuthorityDigest(endpoint.url, token),
@@ -6283,7 +6364,7 @@ export function createNotificationsExtension(
 				message =>
 					(message as { stopReason?: unknown }).stopReason === "error" ||
 					(message as { stopReason?: unknown }).stopReason === "aborted",
-			) as { stopReason?: "error" | "aborted"; errorMessage?: unknown } | undefined;
+			) as { stopReason?: "error" | "aborted"; errorMessage?: unknown; errorKind?: unknown } | undefined;
 			const legacyCode =
 				event.stopReason === "cancelled"
 					? "cancelled"
@@ -6292,8 +6373,25 @@ export function createNotificationsExtension(
 						: terminalAssistant?.stopReason === "aborted"
 							? "aborted"
 							: undefined;
+			// The SDK wire outcome and ACP error envelope use a fixed safe token by
+			// contract (see `sanitizePromptFailure`). Assistant failure messages may
+			// still remain in the local session transcript; terminalization copies only
+			// a bounded reason into the local operator log.
 			void rt.terminalizePrompt(correlation, outcome, {
 				...(finalText ? { finalText } : {}),
+				...(outcome.kind === "failed"
+					? {
+							diagnostic: {
+								reason: terminalAssistant?.errorMessage,
+								loopStopReason: event.stopReason ?? "none",
+								assistantStopReason: terminalAssistant?.stopReason ?? "none",
+								...(event.stopReason === "cancelled" ? { intentionalCancellation: true } : {}),
+								...(typeof terminalAssistant?.errorKind === "string"
+									? { errorKind: terminalAssistant.errorKind }
+									: {}),
+							},
+						}
+					: {}),
 				...(outcome.kind === "failed" && legacyCode
 					? {
 							// Only the legacy discriminator is preserved; provider text is never

package/src/sdk/bus/kind-aware-reconciliation.ts

@@ -2,13 +2,14 @@
  * Kind-aware invocation reconciliation (prompt | skill) with optional durable store.
  * Preserves Q26 admit/first-terminal/capacity/TTL semantics; indexes and caps are per-kind.
  */
+
+import { sanitizePromptFailure } from "../prompt-failure";
 import type { PromptReconciliationStatus, SdkPromptTerminalOutcome, TurnPromptReconciliation } from "../prompt-status";
 import {
 	PROMPT_RECONCILIATION_ACTIVE_CAPACITY,
 	PROMPT_RECONCILIATION_TERMINAL_CAPACITY,
 	PROMPT_RECONCILIATION_TERMINAL_TTL_MS,
 	type PromptCorrelation,
-	sanitizePromptFailure,
 } from "./prompt-reconciliation";
 import type { DurableReconciliationRecord, ReconciliationKind, ReconciliationStore } from "./reconciliation-store";
 

package/src/sdk/bus/prompt-reconciliation.ts

@@ -19,10 +19,13 @@
  * - Terminal transitions settle once: the first terminal outcome wins.
  */
 
+import { PROMPT_FAILURE_CODE_MAX, sanitizePromptFailure } from "../prompt-failure";
+
+export { PROMPT_FAILURE_CODE_MAX, sanitizePromptFailure };
+
 export const PROMPT_RECONCILIATION_ACTIVE_CAPACITY = 128;
 export const PROMPT_RECONCILIATION_TERMINAL_CAPACITY = 256;
 export const PROMPT_RECONCILIATION_TERMINAL_TTL_MS = 15 * 60_000;
-export const PROMPT_FAILURE_CODE_MAX = 64;
 
 export type PromptReconciliationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed";
 
@@ -94,14 +97,6 @@ export interface PromptReconciliation {
 	activeCount(): number;
 }
 
-/** Safe-token code capped at 64; arbitrary failure text is never retained. */
-export function sanitizePromptFailure(error: unknown): { code: string; message: string } {
-	const candidate = error as { code?: unknown } | undefined;
-	const rawCode = typeof candidate?.code === "string" ? candidate.code : "";
-	const code = rawCode.length <= PROMPT_FAILURE_CODE_MAX && /^[A-Za-z0-9._-]+$/.test(rawCode) ? rawCode : "internal";
-	return { code, message: "Prompt submission failed." };
-}
-
 export function createPromptReconciliation(options: { now?: () => number } = {}): PromptReconciliation {
 	const now = options.now ?? Date.now;
 	const records = new Map<string, PromptReconciliationRecord>();

package/src/sdk/bus/slack-daemon.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { SdkClientError } from "../client/client";
 import { readSdkSessionEndpoint, type SdkSessionEndpoint } from "../client/discovery";
 import type { ChatDeliveryError } from "./chat-daemon-runtime";
@@ -35,7 +35,12 @@ class SlackReconciledAbsentEffectError extends Error {
 	}
 }
 
-import { type ChatEffect, ChatEffectJournal, type ChatEffectLease } from "./chat-effect-journal";
+import {
+	type ChatEffect,
+	ChatEffectJournal,
+	type ChatEffectLease,
+	MAX_TERMINAL_CHAT_EFFECTS,
+} from "./chat-effect-journal";
 import { SlackProviderError } from "./slack-live-provider";
 import type {
 	SlackMessageSearchResult,
@@ -44,6 +49,11 @@ import type {
 	SlackSocketEnvelope,
 } from "./slack-provider";
 
+function slackPublicationClientMsgId(publicationId: string): string {
+	const digest = createHash("sha256").update(publicationId).digest("hex");
+	return `${digest.slice(0, 8)}-${digest.slice(8, 12)}-${digest.slice(12, 16)}-${digest.slice(16, 20)}-${digest.slice(20, 32)}`;
+}
+
 // Durable filesystem publication leases must outlast one event-loop and persistence turn.
 const MIN_PUBLICATION_LEASE_MS = 100;
 
@@ -440,7 +450,12 @@ export class SlackNotificationDaemon {
 			throw new SlackThreadBindingError("root_not_found", "The Slack root was not found in the configured channel.");
 	}
 
-	async #postRoot(sessionId: string, body: string, endpointGeneration?: number): Promise<SlackRootPublication> {
+	async #postRoot(
+		sessionId: string,
+		body: string,
+		endpointGeneration?: number,
+		requestedClientMsgId?: string,
+	): Promise<SlackRootPublication> {
 		const endpoint = await this.#resolveEndpoint(sessionId);
 		if (!endpoint || (endpointGeneration !== undefined && endpoint.generation !== endpointGeneration))
 			throw new SlackEndpointBindingError("Slack root publication requires the current session endpoint.");
@@ -473,7 +488,7 @@ export class SlackNotificationDaemon {
 				teamId: this.options.teamId,
 				channelId: this.options.channelId,
 				sessionId,
-				clientMsgId: this.#randomId(),
+				clientMsgId: requestedClientMsgId ?? this.#randomId(),
 				rootPublicationOwner: this.#publicationOwnerId,
 				rootPublicationLeaseExpiresAt: now + this.#publicationLeaseMs,
 				rootPublicationFence: (current?.rootPublicationFence ?? 0) + 1,
@@ -570,27 +585,38 @@ export class SlackNotificationDaemon {
 		body: string,
 		actionId?: string,
 		endpointGeneration?: number,
+		publicationId?: string,
 	): Promise<SlackConversation> {
 		const endpoint = await this.#resolveEndpoint(sessionId);
 		if (!endpoint || (endpointGeneration !== undefined && endpoint.generation !== endpointGeneration))
 			throw new SlackEndpointBindingError("Slack notification requires the current session endpoint.");
 		const generation = endpoint.generation;
+		const rootPublication =
+			publicationId === undefined
+				? undefined
+				: await this.#publicationAttempt(
+						`root:${sessionId}:${publicationId}`,
+						clientMsgId => `root:${sessionId}:${clientMsgId}`,
+					);
 		const existing = await this.findSession(sessionId, false);
 		const usedExistingRoot =
 			existing?.record.state === "active" &&
 			!!existing.record.rootTs &&
 			existing.record.endpointGeneration === generation;
 		let conversation: SlackConversation;
-		let bodyWasUsedAsRoot = false;
+		let bodyWasUsedAsRoot =
+			usedExistingRoot &&
+			rootPublication !== undefined &&
+			existing.record.clientMsgId === rootPublication.clientMsgId;
 		if (usedExistingRoot) {
 			conversation = existing.record;
 		} else {
 			const publication =
 				existing?.record.state === "active"
-					? await this.#resumeWithRootPublication(sessionId, body, generation)
-					: await this.#postRoot(sessionId, body, generation);
+					? await this.#resumeWithRootPublication(sessionId, body, generation, rootPublication?.clientMsgId)
+					: await this.#postRoot(sessionId, body, generation, rootPublication?.clientMsgId);
 			conversation = publication.conversation;
-			bodyWasUsedAsRoot = publication.created;
+			bodyWasUsedAsRoot ||= publication.created;
 		}
 		if (!conversation.rootTs) return conversation;
 		const key = usedExistingRoot && existing ? existing.key : this.#intentKey(sessionId);
@@ -607,11 +633,21 @@ export class SlackNotificationDaemon {
 			return active;
 		}
 		if (!actionId) {
-			await this.#postDurable(`notification:${sessionId}:${this.#randomId()}`, sessionId, conversationGeneration, {
+			const publication =
+				publicationId === undefined
+					? {
+							effectId: `notification:${sessionId}:${this.#randomId()}`,
+							clientMsgId: this.#randomId(),
+						}
+					: await this.#publicationAttempt(
+							`notification:${sessionId}:${publicationId}`,
+							clientMsgId => `notification:${sessionId}:${clientMsgId}`,
+						);
+			await this.#postDurable(publication.effectId, sessionId, conversationGeneration, {
 				channel: conversation.channelId,
 				threadTs: conversation.rootTs,
 				text: body,
-				clientMsgId: this.#randomId(),
+				clientMsgId: publication.clientMsgId,
 			});
 			return conversation;
 		}
@@ -759,14 +795,28 @@ export class SlackNotificationDaemon {
 		return true;
 	}
 
-	async resume(sessionId: string, body: string, endpointGeneration?: number): Promise<SlackConversation> {
-		return (await this.#resumeWithRootPublication(sessionId, body, endpointGeneration)).conversation;
+	async resume(
+		sessionId: string,
+		body: string,
+		endpointGeneration?: number,
+		publicationId?: string,
+	): Promise<SlackConversation> {
+		const rootPublication =
+			publicationId === undefined
+				? undefined
+				: await this.#publicationAttempt(
+						`root:${sessionId}:${publicationId}`,
+						clientMsgId => `root:${sessionId}:${clientMsgId}`,
+					);
+		return (await this.#resumeWithRootPublication(sessionId, body, endpointGeneration, rootPublication?.clientMsgId))
+			.conversation;
 	}
 
 	async #resumeWithRootPublication(
 		sessionId: string,
 		body: string,
 		endpointGeneration?: number,
+		requestedClientMsgId?: string,
 	): Promise<SlackRootPublication> {
 		const inFlight = this.#rollovers.get(sessionId);
 		if (inFlight) {
@@ -776,9 +826,9 @@ export class SlackNotificationDaemon {
 				return { conversation: publication.conversation, created: false };
 			if (endpointGeneration < activeGeneration)
 				throw new SlackEndpointBindingError("Slack root belongs to a newer endpoint generation.");
-			return await this.#resumeWithRootPublication(sessionId, body, endpointGeneration);
+			return await this.#resumeWithRootPublication(sessionId, body, endpointGeneration, requestedClientMsgId);
 		}
-		const rollover = this.#resumeRoot(sessionId, body, endpointGeneration);
+		const rollover = this.#resumeRoot(sessionId, body, endpointGeneration, requestedClientMsgId);
 		this.#rollovers.set(sessionId, rollover);
 		try {
 			return await rollover;
@@ -787,7 +837,12 @@ export class SlackNotificationDaemon {
 		}
 	}
 
-	async #resumeRoot(sessionId: string, body: string, endpointGeneration?: number): Promise<SlackRootPublication> {
+	async #resumeRoot(
+		sessionId: string,
+		body: string,
+		endpointGeneration?: number,
+		requestedClientMsgId?: string,
+	): Promise<SlackRootPublication> {
 		const endpoint = await this.#resolveEndpoint(sessionId);
 		if (!endpoint || (endpointGeneration !== undefined && endpoint.generation !== endpointGeneration))
 			throw new SlackEndpointBindingError("Slack root rollover requires the current session endpoint.");
@@ -802,7 +857,7 @@ export class SlackNotificationDaemon {
 				previous = { key: previous.key, record: reconciled };
 				waitedForRollover = true;
 			}
-			if (!previous) return await this.#postRoot(sessionId, body, generation);
+			if (!previous) return await this.#postRoot(sessionId, body, generation, requestedClientMsgId);
 			if (previous.record.state !== "active") {
 				if (
 					previous.record.rootPublicationOwner !== this.#publicationOwnerId &&
@@ -812,7 +867,7 @@ export class SlackNotificationDaemon {
 					await Bun.sleep(10);
 					continue;
 				}
-				return await this.#postRoot(sessionId, body, generation);
+				return await this.#postRoot(sessionId, body, generation, requestedClientMsgId);
 			}
 			const previousGeneration = this.#requireEndpointGeneration(previous.record);
 			if (previousGeneration > generation)
@@ -873,7 +928,7 @@ export class SlackNotificationDaemon {
 				resumed.rootPublicationOwner === this.#publicationOwnerId &&
 				resumed.rootPublicationFence === fence
 			)
-				return await this.#postRoot(sessionId, body, generation);
+				return await this.#postRoot(sessionId, body, generation, requestedClientMsgId);
 			waitedForRollover = true;
 			await Bun.sleep(10);
 		}
@@ -1820,6 +1875,24 @@ export class SlackNotificationDaemon {
 		);
 	}
 
+	/**
+	 * Reuse one provider identity while its outcome is pending or uncertain. Only a
+	 * terminal definite refusal advances to a fresh attempt identity, so safe retries
+	 * remain possible without turning an ambiguous acknowledgement into a duplicate.
+	 */
+	async #publicationAttempt(
+		baseId: string,
+		effectIdForClientMsgId: (clientMsgId: string) => string,
+	): Promise<{ effectId: string; clientMsgId: string }> {
+		for (let attempt = 1; attempt <= MAX_TERMINAL_CHAT_EFFECTS + 1; attempt++) {
+			const occurrenceId = attempt === 1 ? baseId : `${baseId}:retry:${attempt}`;
+			const clientMsgId = slackPublicationClientMsgId(occurrenceId);
+			const effectId = effectIdForClientMsgId(clientMsgId);
+			const existing = await this.#journal.read(effectId);
+			if (existing?.state !== "terminal" || existing.receipt?.status === "posted") return { effectId, clientMsgId };
+		}
+		throw new Error("Slack publication exhausted its retained definite-failure identities");
+	}
 	async #providerEffectPayload(
 		id: string,
 		sessionId: string,

package/src/sdk/cli/session-cli.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 import { getAgentDir } from "@gajae-code/utils";
 import { ensureBroker } from "../broker/ensure";
+import { lifecycleRequestTimeoutMs } from "../broker/startup-budget";
 import {
 	listSdkSessionEndpoints,
 	readSdkBrokerDiscovery,
@@ -242,7 +243,13 @@ export async function runSdkSessionCli(
 				throw new SdkSessionCliError("invalid_input", "--idempotency-key is required for lifecycle operations.", 2);
 			const client = await connectBroker(agentDir);
 			try {
-				writeOutput(await client.global(operation, input, { idempotencyKey }));
+				const timeoutMs = lifecycleRequestTimeoutMs(operation, input);
+				writeOutput(
+					await client.global(operation, input, {
+						idempotencyKey,
+						...(timeoutMs === undefined ? {} : { timeoutMs }),
+					}),
+				);
 			} finally {
 				await client.close();
 			}