@gajae-code/coding-agent 0.13.2 → 0.14.0

package/src/sdk/host/session-runtime.ts

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { execFile } from "node:child_process";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
@@ -6,16 +7,23 @@ import { promisify } from "node:util";
 import { ThinkingLevel } from "@gajae-code/agent-core";
 import type { Api, Model } from "@gajae-code/ai/core";
 import { logger } from "@gajae-code/utils";
+import { AsyncJobManager } from "../../async";
 import { isModelProfileProviderAvailable, projectModelProfileCatalog } from "../../config/model-profile-contract";
 import { type ModelProfileDefinition, resolveProfileBindings } from "../../config/model-profiles";
 import { resolveModelChainWithAuth, splitSelectorThinkingSuffix } from "../../config/model-resolver";
 import { type ModelSelectorValue, normalizeModelSelectorValue } from "../../config/model-selector-value";
 import { type Settings, validateSettingPatch } from "../../config/settings";
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from "../../extensibility/extensions";
+import {
+	boundTerminalRetentionState,
+	findOwnedRegistrationsForTurn,
+	isOwnedAttemptRegistrationIncomplete,
+	MAX_DURABLE_TERMINAL_RESERVATIONS,
+	settleOwnedWork,
+} from "../../session/terminal-abort";
 import { parseThinkingLevel } from "../../thinking";
 import { ensureBroker } from "../broker/ensure";
 import { SessionIndex } from "../broker/session-index";
-import { elevationAuthorityPath, verifyElevationCapability } from "../elevation/capability";
 import {
 	collectAuthenticatedProfileProviders,
 	parseSyntheticModelId,
@@ -25,11 +33,19 @@ import {
 	syntheticNamespaceCollision,
 } from "../model-profile-model";
 import { projectQ10Models } from "../models.js";
+import { PromptDeadlineManager } from "../prompt-deadline-manager";
 import { formatPromptFailureForLocalLog, sanitizePromptFailure } from "../prompt-failure";
 import { OPERATIONS } from "../protocol/operation-registry";
+import {
+	createKindAwareReconciliation,
+	createReconciliationStore,
+	type KindAwareReconciliation,
+	resolveReconciliationSessionFile,
+} from "../reconciliation-extensions";
 import { type ControlSurface, controlRequestFromFrame, dispatchControl } from "./control";
+import { BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD } from "./control/runtime-gate";
 import { SessionSdkHost, type SessionSdkHostOptions } from "./host";
-import { CursorRegistry, QueryHandlers, RevisionStore, type SdkCheckpointRecord, type SessionSurface } from "./query";
+import { CursorRegistry, QueryHandlers, RevisionStore, type SessionSurface } from "./query";
 import {
 	createSdkCapabilities,
 	createSdkSurfacePolicyForContext,
@@ -41,6 +57,35 @@ import {
 import type { BrokerIndexWriter, SdkFrame } from "./types";
 
 const execFileAsync = promisify(execFile);
+const sdkControlRequesterContext = new AsyncLocalStorage<string>();
+
+/**
+ * Thrown from a serialized durable terminal-scope transaction when the
+ * idempotency key is already owned by a DIFFERENT input (scope). After the
+ * dispatch cache evicts an in-flight entry, two concurrent requests can both
+ * pass the earlier snapshot check; the atomic recheck inside the transaction
+ * must reject the second instead of appending a duplicate-key row (review
+ * thread P2).
+ */
+class SdkOnlyIdempotencyConflictError extends Error {
+	constructor() {
+		super("Idempotency key was reused with different input.");
+	}
+}
+
+/** Bounded wait for the correlated agent_end lifecycle publication after a
+ *  terminal abort settles, before the durable row may claim
+ *  `terminalPublished` (review thread P2). The bus runtime needs no such wait:
+ *  it publishes the correlated event inline during terminalization and records
+ *  the outcome synchronously on its capture slot, while this runtime observes
+ *  the publication from the separate `agent_end` handler. */
+const SDK_ONLY_TERMINAL_PUBLICATION_WAIT_MS = 1_000;
+/** Bounded wait for in-flight workflow gate resolutions to settle during SDK
+ *  runtime shutdown before proceeding with cleanup. Unresolved resolutions
+ *  after this bound are abandoned — their durable broker state is the recovery
+ *  authority, and outcomes are inherently uncertain. */
+const GATE_RESOLUTION_QUIESCENCE_MS = 5_000;
+
 class DiffQueryError extends Error {
 	constructor(
 		readonly code: "not_git_repository" | "diff_too_large",
@@ -55,7 +100,10 @@ export interface SessionSdkTransport {
 	readonly sessionId: string;
 	readonly stateRoot: string;
 	readonly token: string;
-	sendFrame(connectionId: string, frame: SdkFrame): void | Promise<void>;
+	sendFrame(
+		connectionId: string,
+		frame: SdkFrame,
+	): void | "written" | "dropped" | Promise<void> | Promise<"written" | "dropped">;
 	onFrame(handler: (connectionId: string, frame: SdkFrame) => void): undefined | (() => void);
 	onMalformedFrame?(handler: (connectionId: string, message: string) => void): undefined | (() => void);
 	start(): Promise<{ url: string }>;
@@ -76,6 +124,110 @@ export interface SessionSdkRuntimeOptions
 	configOverrides?: Map<string, unknown>;
 }
 
+export interface SdkOnlyInvocationRecord extends InvocationCorrelation {
+	kind: InvocationKind | "terminal" | "steer";
+	clientRef?: string;
+	status: InvocationStatus | "dispatching" | "rejected";
+	acceptedAt: number;
+	startedAt?: number;
+	terminalAt?: number;
+	error?: { code: string; message: string };
+	outcome?: unknown;
+	pendingOutcome?: unknown;
+	skillName?: string;
+	/** Steer records (origin/dev) carry their own dispatching lifecycle. */
+	textDigest?: string;
+	createdAt?: number;
+	settledAt?: number;
+}
+
+export interface SdkOnlyTerminalScopeRecord {
+	selection: "turn" | "owned";
+	idempotencyKeyHash?: string;
+	idempotencyInputHash?: string;
+	turnDisposition:
+		| "pending"
+		| "stopped"
+		| "uncertain"
+		| "no_effect"
+		| "no_effect_reserved"
+		| "no_effect_marker_failure";
+	terminalPublished?: boolean;
+	ownedWorkDisposition: "not_requested" | "left_running" | "stopped" | "uncertain";
+	automaticDeliveryDisposition: "enabled" | "none";
+	resumeOnOwnedCompletion: boolean;
+	turnContinuationFence: {
+		state: "retained" | "released";
+		abortedAttemptEpoch: number;
+		blockedContinuationIds: string[];
+		predecessorTombstones: string[];
+		ownedCompletionPolicy: "enabled" | "disabled";
+	};
+	responseState: "pending" | "sent" | "delivered" | "failed";
+	responsePayloadHash: string;
+	replayPayloadHash?: string;
+	acceptedAt: number;
+	terminalAt?: number;
+}
+
+export interface SdkOnlyEvictedTerminalKeyEntry {
+	keyHash: string;
+	inputHash: string;
+	turnDisposition?: "stopped" | "uncertain" | "no_effect" | "no_effect_reserved" | "no_effect_marker_failure";
+	ownedWorkDisposition?: "not_requested" | "left_running" | "stopped" | "uncertain";
+	responseState?: "pending" | "sent" | "delivered" | "failed";
+	responsePayloadHash?: string;
+	replayPayloadHash?: string;
+	terminalPublished?: boolean;
+}
+
+export interface SdkOnlyReconciliationStore {
+	readonly path: string | null;
+	load(): Promise<unknown[]>;
+	transact(mutator: (records: SdkOnlyInvocationRecord[]) => SdkOnlyInvocationRecord[]): Promise<void>;
+	snapshotTerminalScopes(): SdkOnlyTerminalScopeRecord[];
+	snapshotTerminalKeys(): SdkOnlyEvictedTerminalKeyEntry[];
+	transactTerminalScopes(
+		mutator: (scopes: SdkOnlyTerminalScopeRecord[]) => SdkOnlyTerminalScopeRecord[],
+	): Promise<void>;
+	transactTerminalState(
+		mutator: (state: { scopes: SdkOnlyTerminalScopeRecord[]; keys: SdkOnlyEvictedTerminalKeyEntry[] }) => {
+			scopes: SdkOnlyTerminalScopeRecord[];
+			keys: SdkOnlyEvictedTerminalKeyEntry[];
+		},
+	): Promise<void>;
+}
+
+export interface SdkOnlyTerminalAbortSeams {
+	getReconciliationStore?: () => SdkOnlyReconciliationStore | undefined;
+	getTerminalTurnEpoch: () => number | undefined;
+	getActivePromptHandle: () => string | undefined;
+	/** Re-read the active prompt's owning SDK connection for the owner-mismatch
+	 *  recheck; falls back to the runtime-tracked owner when absent (review
+	 *  thread P1). */
+	getActivePromptOwnerConnectionId?: () => string | undefined;
+	cancelPendingPreflightForTerminalAbort: () => void;
+	/** Capture the steering admission snapshot at abort ADMISSION (before any
+	 *  durable transaction), so steers admitted while the abort is in flight
+	 *  classify as post-snapshot (review thread P1). */
+	captureTerminalAbortSteeringSnapshot?: () => number | undefined;
+	/** Discard the steering snapshot when a replay-only abort never settles
+	 *  (review thread P1). */
+	discardTerminalAbortSteeringSnapshot?: (token: number) => void;
+	/** Rebind the snapshot to the current turn when the requester's turn
+	 *  wins the race (review thread P1). */
+	rebindTerminalAbortSteeringSnapshot?: (token: number) => void;
+	abortPromptAndWaitWithTerminal: (
+		handle: string,
+		options: {
+			graceMs: number;
+			terminal?: { scope: "turn" | "owned"; expectedEpoch?: number; steeringSnapshotToken?: number };
+		},
+	) => Promise<{ status: string; terminalScope?: unknown }>;
+	/** Test override for the maximum durable terminal reservation rows. */
+	maxDurableTerminalReservationsForTests?: number;
+}
+
 /**
  * The transport-neutral SDK session runtime.
  *
@@ -102,7 +254,11 @@ export class SessionSdkSessionRuntime {
 			sessionId: options.transport.sessionId,
 			stateRoot: options.transport.stateRoot,
 			token: options.transport.token,
-			sendFrame: options.transport.sendFrame,
+			sendFrame: (connectionId, frame) => {
+				const result = options.transport.sendFrame(connectionId, frame);
+				if (result instanceof Promise) return result.then(outcome => outcome ?? "written");
+				return result ?? "written";
+			},
 			onFrame: options.transport.onFrame,
 		});
 		this.#connectionDisposer = options.transport.onConnectionClose?.(connectionId => {
@@ -234,6 +390,10 @@ export interface CreateSdkSessionRuntimeOptions {
 	settings?: Settings;
 	/** Mutable shadow of patched config values merged into query readback. */
 	configOverrides?: Map<string, unknown>;
+	/** Private session-owned terminal-abort capabilities; never exposed on ExtensionContext. */
+	terminalAbortSeams?: SdkOnlyTerminalAbortSeams;
+	/** Callback when a frame is admitted to the runtime (test harness). */
+	onFrameAdmitted?: () => void;
 }
 
 function unavailable(operation: string): () => never {
@@ -249,8 +409,8 @@ export interface InvocationCorrelation {
 	turnId: string;
 }
 
-export type InvocationKind = "prompt" | "skill";
-type InvocationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed";
+export type InvocationKind = "prompt" | "skill" | "steer";
+type InvocationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed" | "uncertain";
 interface InvocationRecord extends InvocationCorrelation {
 	kind: InvocationKind;
 	clientRef?: string;
@@ -261,6 +421,8 @@ interface InvocationRecord extends InvocationCorrelation {
 	error?: { code: string; message: string };
 }
 export interface InvocationReconciliation {
+	/** Shared v2 reconciliation owner; present for durable terminal admission. */
+	readonly store?: SdkOnlyReconciliationStore;
 	admit(kind: InvocationKind, clientRef?: string): void;
 	release(kind: InvocationKind, clientRef?: string): void;
 	noteAccepted(kind: InvocationKind, correlation: InvocationCorrelation, clientRef?: string): Promise<void>;
@@ -272,31 +434,49 @@ export interface InvocationReconciliation {
 	lookup(kind: InvocationKind, selector: { commandId?: string; turnId?: string; clientRef?: string }): unknown;
 	lookupResult(kind: InvocationKind, selector: { commandId?: string; turnId?: string; clientRef?: string }): unknown;
 	hydrate(): Promise<void>;
+	claimPendingOutcome(
+		kind: InvocationKind,
+		correlation: InvocationCorrelation,
+		outcome: { kind: string; code: string; message: string; provenance?: string },
+	): Promise<unknown>;
+	finalizeOutcome(
+		kind: InvocationKind,
+		correlation: InvocationCorrelation,
+		outcome?: { kind: string; code: string; message: string; provenance?: string },
+	): Promise<void>;
 }
 
 export function createInvocationReconciliation(
-	options: { stateRoot?: string; sessionId?: string } = {},
+	options: { stateRoot?: string; sessionId?: string; store?: SdkOnlyReconciliationStore } = {},
 ): InvocationReconciliation {
 	const ACTIVE_CAPACITY = 256;
 	const TERMINAL_CAPACITY = 512;
-	const TERMINAL_TTL_MS = 15 * 60_000;
 	const records = new Map<string, InvocationRecord>();
 	const reservations = new Map<string, InvocationKind>();
 	const reservationCounts = new Map<InvocationKind, number>([
 		["prompt", 0],
 		["skill", 0],
+		["steer", 0],
 	]);
 	const key = (kind: InvocationKind, correlation: InvocationCorrelation) =>
 		`${kind}:${correlation.commandId}:${correlation.turnId}`;
 	const ref = (kind: InvocationKind, clientRef: string) => `${kind}\\0${clientRef}`;
 	if (options.sessionId && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(options.sessionId))
 		throw Object.assign(new Error("Unsafe SDK reconciliation session id."), { code: "invalid_input" });
+	const store = options.store;
+	// Legacy fs-backed path retained for callers that pass stateRoot/sessionId
+	// without a store (origin/dev behavior); the store path is authoritative
+	// when present (shared v2 reconciliation owner).
 	const reconciliationFile =
-		options.stateRoot && options.sessionId
+		options.stateRoot && options.sessionId && !store
 			? path.join(options.stateRoot, ".sdk-reconciliation", `${options.sessionId}.json`)
 			: undefined;
 	let persistenceChain: Promise<void> = Promise.resolve();
 	const persist = async (): Promise<void> => {
+		if (store) {
+			await store.transact(() => [...records.values()]);
+			return;
+		}
 		if (!reconciliationFile) return;
 		const run = async (): Promise<void> => {
 			const directory = path.dirname(reconciliationFile);
@@ -317,11 +497,11 @@ export function createInvocationReconciliation(
 		);
 		await pending;
 	};
+	// Retention contract (#4547): terminal records are never age-evicted; only
+	// the per-kind oldest-terminal-first capacity trim removes them, so a
+	// fire-and-wake consumer can still query the canonical terminal outcome
+	// until capacity eviction honestly reports `unknown`.
 	const cleanup = (): void => {
-		const now = Date.now();
-		for (const [recordKey, record] of records) {
-			if (record.terminalAt !== undefined && record.terminalAt + TERMINAL_TTL_MS <= now) records.delete(recordKey);
-		}
 		for (const kind of ["prompt", "skill"] as const) {
 			const terminal = [...records.entries()]
 				.filter(([, record]) => record.kind === kind && record.terminalAt !== undefined)
@@ -341,6 +521,21 @@ export function createInvocationReconciliation(
 		return records.get(key(kind, { commandId: selector.commandId, turnId: selector.turnId }));
 	};
 	const hydrate = async (): Promise<void> => {
+		if (store) {
+			const loaded = (await store.load()) as SdkOnlyInvocationRecord[];
+			for (const candidate of loaded) {
+				if (candidate.kind !== "prompt" && candidate.kind !== "skill") continue;
+				if (!candidate.commandId || !candidate.turnId || typeof candidate.acceptedAt !== "number") continue;
+				const kind = candidate.kind as InvocationKind;
+				const record: InvocationRecord = { ...candidate, kind } as InvocationRecord;
+				// Never re-hydrate a failure reason that could contain provider secrets
+				// into a fresh process (origin/dev sanitization preserved).
+				if (record.status === "failed") record.error = sanitizePromptFailure(record.error);
+				records.set(key(kind, candidate), record);
+			}
+			cleanup();
+			return;
+		}
 		if (!reconciliationFile) return;
 		let raw: string;
 		try {
@@ -377,6 +572,7 @@ export function createInvocationReconciliation(
 		cleanup();
 	};
 	return {
+		store,
 		admit(kind, clientRef) {
 			cleanup();
 			const active = [...records.values()].filter(
@@ -479,6 +675,31 @@ export function createInvocationReconciliation(
 			return result.status === "unknown" ? result : { kind, ...result };
 		},
 		hydrate,
+		async claimPendingOutcome(kind, correlation, outcome) {
+			const record = records.get(key(kind, correlation));
+			if (!record || record.terminalAt !== undefined || record.kind !== kind) return outcome;
+			const pending = (record as unknown as { pendingOutcome?: unknown }).pendingOutcome;
+			if (pending !== undefined) return pending;
+			(record as unknown as Record<string, unknown>).pendingOutcome = outcome;
+			await persist();
+			return outcome;
+		},
+		async finalizeOutcome(kind, correlation, outcome) {
+			const record = records.get(key(kind, correlation));
+			if (!record || record.terminalAt !== undefined || record.kind !== kind) return;
+			const finalOutcome = (outcome ??
+				(record as unknown as { pendingOutcome?: { kind: string; code: string; message: string } })
+					.pendingOutcome) as { kind: string; code: string; message: string } | undefined;
+			record.terminalAt = Date.now();
+			if (finalOutcome?.kind === "failed") {
+				record.status = "failed";
+				record.error = { code: finalOutcome.code, message: finalOutcome.message };
+			} else {
+				record.status = "terminal_ok";
+			}
+			(record as unknown as Record<string, unknown>).pendingOutcome = undefined;
+			await persist();
+		},
 	};
 }
 
@@ -498,9 +719,8 @@ export interface SdkSurfaceFactoryOptions {
 		turnId?: string;
 		clientRef?: string;
 	}) => unknown;
+	steerStatusLookup?: (selector: { commandId?: string; turnId?: string; clientRef?: string }) => unknown;
 	hostTools?: boolean | (() => boolean);
-	/** Q30 event-ring watermark source (the live session event stream); synchronous. */
-	getEventWatermark?: () => { generation: number; seq: number };
 }
 
 /** Shared policy, capability, and query-surface factory for every SDK transport. */
@@ -528,9 +748,8 @@ function createQuerySurface(
 			turnId?: string;
 			clientRef?: string;
 		}) => unknown;
+		steerStatusLookup?: (selector: { commandId?: string; turnId?: string; clientRef?: string }) => unknown;
 		hostTools?: boolean | (() => boolean);
-		/** Q30 event-ring watermark source (the live session event stream); synchronous. */
-		getEventWatermark?: () => { generation: number; seq: number };
 	} = {},
 ): SessionSurface {
 	const policy =
@@ -804,6 +1023,8 @@ function createQuerySurface(
 			turnId?: string;
 			clientRef?: string;
 		}) => (options.turnResultLookup ?? (value => reconciliation.lookupResult(value.kind, value)))(selector),
+		getSteerStatus: (selector: { commandId?: string; turnId?: string; clientRef?: string }) =>
+			(options.steerStatusLookup ?? (value => reconciliation.lookup("steer", value)))(selector),
 		getModelProfiles: async () => {
 			const profiles = ctx.modelRegistry.getModelProfiles();
 			const authenticatedProviders = await collectAuthenticatedProfileProviders(profiles, provider =>
@@ -820,23 +1041,6 @@ function createQuerySurface(
 				})),
 			)) as unknown[];
 		},
-		getCheckpointSnapshot: (): { entries: unknown[]; watermark: SdkCheckpointRecord } => {
-			// Q30 atomic checkpoint capture (C9): the transcript entries and the
-			// event-ring watermark are read in one synchronous call from the host
-			// event stream, so the snapshot revision and the subscribe position
-			// can never straddle a concurrent append.
-			const entries =
-				typeof (ctx as Partial<ExtensionContext>).getTranscript === "function" ? ctx.getTranscript() : [];
-			const watermark = options.getEventWatermark?.() ?? { generation: 0, seq: 0 };
-			return {
-				entries,
-				watermark: {
-					revision: Array.isArray(entries) ? entries.length : 0,
-					generation: watermark.generation,
-					seq: watermark.seq,
-				},
-			};
-		},
 		installedQueries: policy.installedQueries,
 	};
 }
@@ -865,8 +1069,8 @@ export function createSdkSurfaceFactory(
 		configOverrides: options.configOverrides,
 		settings: options.settings,
 		turnResultLookup: options.turnResultLookup,
+		steerStatusLookup: options.steerStatusLookup,
 		hostTools: options.hostTools,
-		getEventWatermark: options.getEventWatermark,
 	});
 	return {
 		policy,
@@ -957,7 +1161,13 @@ async function resolveSdkWorkflowGate(
 	const completed = workflowGate.lookupCompletedResolution(response);
 	if (completed.kind === "completed") return completed.resolution;
 	if (completed.kind === "accepted_incomplete") {
-		await workflowGate.recoverAcceptedGates();
+		try {
+			await workflowGate.recoverAcceptedGates();
+		} catch {
+			throw Object.assign(new Error("Workflow gate resolution outcome is uncertain."), {
+				code: "terminal_uncertain",
+			});
+		}
 		const recovered = workflowGate.lookupCompletedResolution(response);
 		if (recovered.kind === "completed") return recovered.resolution;
 		throw Object.assign(new Error("Workflow gate resolution outcome is uncertain."), { code: "terminal_uncertain" });
@@ -969,6 +1179,22 @@ async function resolveSdkWorkflowGate(
 		if ((resolution as { status?: unknown }).status === "rejected") workflowGate.clearPreparedTerminalization(id);
 		return resolution;
 	} catch (error) {
+		const completedAfterFailure = workflowGate.lookupCompletedResolution(response);
+		if (completedAfterFailure.kind === "completed") return completedAfterFailure.resolution;
+		if (completedAfterFailure.kind === "accepted_incomplete") {
+			try {
+				await workflowGate.recoverAcceptedGates();
+			} catch {
+				throw Object.assign(new Error("Workflow gate resolution outcome is uncertain."), {
+					code: "terminal_uncertain",
+				});
+			}
+			const recovered = workflowGate.lookupCompletedResolution(response);
+			if (recovered.kind === "completed") return recovered.resolution;
+			throw Object.assign(new Error("Workflow gate resolution outcome is uncertain."), {
+				code: "terminal_uncertain",
+			});
+		}
 		const stillPending = workflowGate.listPendingGates?.().some(gate => gate.gate_id === id) === true;
 		if (stillPending) workflowGate.clearPreparedTerminalization(id);
 		else workflowGate.quarantineGate?.(id);
@@ -980,12 +1206,26 @@ function createControlSurface(
 	ctx: ExtensionContext,
 	api: ExtensionAPI,
 	reconciliation: InvocationReconciliation,
-	onAccepted: (kind: InvocationKind, correlation: InvocationCorrelation) => void,
+	onAccepted: (
+		kind: InvocationKind,
+		correlation: InvocationCorrelation,
+		connectionId: string | undefined,
+		startsOwnTurn: boolean,
+	) => void,
+	steerReconciliation: KindAwareReconciliation,
+	onPromotedTurn?: (
+		kind: InvocationKind,
+		correlation: InvocationCorrelation,
+		connectionId: string | undefined,
+	) => void,
 	policy?: SdkSurfacePolicy,
 	settings?: Settings,
 	configOverrides?: Map<string, unknown>,
 	configRevision: { current: number } = { current: 0 },
-	elevationAuthorityToken?: string,
+	terminalAbortSeams?: SdkOnlyTerminalAbortSeams,
+	terminalPublicationCapture?: { resolvers?: Array<(observed: boolean) => void> },
+	activePromptOwnerHolder?: { connectionIds?: ReadonlySet<string> },
+	retirePendingOwner?: (correlation: InvocationCorrelation) => void,
 	canResolveGate: () => boolean = () => true,
 	trackGateResolution: <T>(resolution: Promise<T>) => Promise<T> = async resolution => await resolution,
 ): ControlSurface {
@@ -1042,6 +1282,24 @@ function createControlSurface(
 			: { changed: true };
 	};
 	const newCorrelation = () => ({ commandId: crypto.randomUUID(), turnId: crypto.randomUUID() });
+	const pendingPreflights = new Map<string, Set<() => void>>();
+	// The SDK connection that accepted the currently active prompt/skill, if
+	// any: terminal aborts are requester-scoped, so another connection must
+	// never stop it, and an agent-initiated turn (monitor/cron follow-up) has
+	// no owner — every client is refused (review thread P1). Shared with the
+	// runtime extension so agent_end clears it: a stale owner must not
+	// authorize its old client against a later turn it did not submit (review
+	// thread P1).
+	const activePromptOwner = activePromptOwnerHolder ?? { connectionIds: new Set<string>() };
+	const currentRequesterPreflights = (): Set<() => void> => {
+		const key = sdkControlRequesterContext.getStore() ?? "";
+		let pending = pendingPreflights.get(key);
+		if (!pending) {
+			pending = new Set();
+			pendingPreflights.set(key, pending);
+		}
+		return pending;
+	};
 	const normalizeClientRef = (clientRef: string | undefined): string | undefined => {
 		if (clientRef === undefined) return undefined;
 		const trimmed = clientRef.trim();
@@ -1057,25 +1315,48 @@ function createControlSurface(
 		run: (options: {
 			onPreflightAccepted: () => void;
 			onPreflightAcceptCommit: () => Promise<void>;
+			/** Fired when a queued submission (steering or follow-up) is promoted to its own run (SDK ownership correlation). */
+			onQueuedPromoted: () => void;
+			queuedAtDispatch: boolean;
 		}) => Promise<unknown>,
 		acceptedFields?: () => Record<string, unknown>,
 		allowCompletionFallback = false,
 		alwaysQueued = false,
 	): Promise<unknown> => {
+		// Capture the REQUESTING connection at admission: a terminal abort from
+		// another SDK connection must never stop the prompt this one accepts
+		// (review thread P1).
+		const requesterConnectionId = sdkControlRequesterContext.getStore();
 		const retainedClientRef = normalizeClientRef(clientRef);
 		reconciliation.admit(kind, retainedClientRef);
 		const correlation = newCorrelation();
 		const preflight = Promise.withResolvers<void>();
 		let accepted = false;
 		let settled = false;
+		const cancelPreflight = () => {
+			if (settled) return;
+			settled = true;
+			preflight.reject(
+				Object.assign(new Error("Prompt preflight was cancelled before execution."), { code: "busy" }),
+			);
+		};
+		const requesterPreflights = currentRequesterPreflights();
+		requesterPreflights.add(cancelPreflight);
 		const accept = async (): Promise<void> => {
 			if (settled) return;
-
+			// startsOwnTurn is captured from the pre-dispatch idle snapshot (see
+			// below): re-reading ctx.isIdle() here would observe the session as
+			// already streaming, because the production AgentSession begins its
+			// in-flight bookkeeping before the preflight acceptance callback
+			// (review thread P1).
 			try {
 				await reconciliation.noteAccepted(kind, correlation, retainedClientRef);
 				accepted = true;
 				settled = true;
-				onAccepted(kind, correlation);
+				// The accepted submission does NOT own the active turn until its run
+				// actually STARTS: the connection is carried on the pending entry and
+				// associated at agent_start instead (review thread P1).
+				onAccepted(kind, correlation, requesterConnectionId, startsOwnTurn);
 				preflight.resolve();
 			} catch (error) {
 				settled = true;
@@ -1087,12 +1368,32 @@ function createControlSurface(
 		// sendUserMessage will divert to steer-queue and resolve before the turn runs.
 		// Re-reading ctx.isIdle() after run() would race — accept() does async fs I/O that
 		// yields, so isStreaming can flip during the persist window.
-		const queuedAtDispatch = alwaysQueued || !ctx.isIdle();
+		// Queued when the submission is always-queued or the session is NOT idle; the
+		// optional chaining keeps harness contexts without isIdle working (the branch
+		// model treats an absent isIdle as idle).
+		const queuedAtDispatch = alwaysQueued || ctx.isIdle?.() === false;
+		// Decide whether this submission ever starts its OWN turn from the SAME
+		// pre-dispatch snapshot: a plain prompt accepted while another turn
+		// streams is queued as STEERING and consumed inside the current run — it
+		// emits no agent_start, so its pending entry would be wrongly consumed
+		// (and its connection associated as owner) by a later agent-initiated
+		// monitor/cron turn (review thread P1). A follow-up is ALWAYS queued
+		// (never started inline): its ownership entry is created only when the
+		// queued follow-up is actually promoted to a run (review thread P1).
+		// Skills always start their own invocation; a plain prompt starts one
+		// only when idle at dispatch time.
+		const startsOwnTurn = kind === "skill" || (kind === "prompt" && !alwaysQueued && !queuedAtDispatch);
 		try {
 			const submission = Promise.resolve(
 				run({
-					onPreflightAccepted: () => void accept().catch(error => preflight.reject(error)),
+					onPreflightAccepted: () => void accept().catch(() => undefined),
 					onPreflightAcceptCommit: accept,
+					// A queued submission (busy-accepted steering, or a follow-up) that
+					// is later PROMOTED to its own run needs its pending ownership entry
+					// created at promotion so the submitting connection can
+					// terminal-abort that turn (review threads P1/P2).
+					onQueuedPromoted: () => onPromotedTurn?.(kind, correlation, requesterConnectionId),
+					queuedAtDispatch,
 				}),
 			);
 			void submission.then(
@@ -1113,7 +1414,7 @@ function createControlSurface(
 						return;
 					}
 					if (allowCompletionFallback) {
-						void accept().catch(error => preflight.reject(error));
+						void accept().catch(() => undefined);
 						return;
 					}
 					settled = true;
@@ -1127,8 +1428,12 @@ function createControlSurface(
 					if (settled) {
 						// The submission promise rejects after preflight acceptance only when the
 						// work itself is over (provider stream interrupt, abort, queue failure).
-						// Every kind must terminalize here or the record stays non-terminal
-						// forever; `noteTransition` ignores an already-terminal record.
+						// The accepted run never started (agent_start never fired), so its pending
+						// entry must be retired — otherwise a later agent-initiated
+						// monitor/cron turn's agent_start would shift the stale entry and
+						// associate the failed submission's connection as owner (review
+						// thread P1).
+						retirePendingOwner?.(correlation);
 						void reconciliation.noteTransition(kind, correlation, { type: "agent_failed", error });
 						return;
 					}
@@ -1146,22 +1451,895 @@ function createControlSurface(
 		} catch (error) {
 			if (!accepted) reconciliation.release(kind, retainedClientRef);
 			throw error;
+		} finally {
+			requesterPreflights.delete(cancelPreflight);
+			if (requesterPreflights.size === 0) pendingPreflights.delete(sdkControlRequesterContext.getStore() ?? "");
+		}
+	};
+	const terminalAbort = async (
+		input: { mode: "terminal"; scope?: "turn" | "owned" },
+		idempotencyKey?: string,
+	): Promise<unknown> => {
+		const scope = input.scope === "owned" ? "owned" : "turn";
+		// Capture the steering snapshot at ADMISSION (before any durable
+		// transaction): client steering admitted while the abort is in flight
+		// classifies as post-snapshot and is preserved at abortPromptAndWait
+		// (review thread P1).
+		const steeringSnapshotToken = terminalAbortSeams?.captureTerminalAbortSteeringSnapshot?.();
+		let steeringSnapshotConsumed = false;
+		const terminalReservationLimit =
+			terminalAbortSeams?.maxDurableTerminalReservationsForTests ?? MAX_DURABLE_TERMINAL_RESERVATIONS;
+		try {
+			// Hash the EXACT response payload this abort will return: the durable row
+			// stores it at finalization so the response-state advance requires
+			// equality instead of trusting a non-pending placeholder (review thread P2).
+			const hashResult = (value: unknown): string =>
+				crypto.createHash("sha256").update(JSON.stringify(value)).digest("hex");
+			const store = reconciliation.store;
+			if (!store?.path || !terminalAbortSeams) {
+				return {
+					ok: true,
+					selection: scope,
+					turn: "no_store",
+					terminal: "terminal_no_effect",
+				};
+			}
+			const keyHash =
+				typeof idempotencyKey === "string"
+					? crypto.createHash("sha256").update(idempotencyKey).digest("hex")
+					: undefined;
+			const inputHash = crypto
+				.createHash("sha256")
+				.update(JSON.stringify({ mode: "terminal", scope }))
+				.digest("hex");
+			const stored = (record: SdkOnlyTerminalScopeRecord | SdkOnlyEvictedTerminalKeyEntry) => ({
+				responseState: record.responseState ?? "pending",
+				responsePayloadHash: record.responsePayloadHash ?? inputHash,
+				terminalPublished: record.terminalPublished === true,
+			});
+			// The exact response a same-key retry delivers appends the replay envelope
+			// (and, for uncertainty, the replay reason). The delivery hash check
+			// requires exact equality, so the durable row must store BOTH the original
+			// response hash (first write) and the replay-shaped hash (retry write) or a
+			// successfully written replay could never advance a pending row to sent
+			// (review thread P2).
+			const replayShapedHash = (
+				record: SdkOnlyTerminalScopeRecord,
+				result: Record<string, unknown>,
+				payloadHash: string,
+			): string =>
+				crypto
+					.createHash("sha256")
+					.update(
+						JSON.stringify({
+							...result,
+							...(result.turn === "uncertain" && typeof result.reason === "string"
+								? { reason: "replay_uncertain" }
+								: {}),
+							replay: {
+								responseState: record.responseState ?? "pending",
+								responsePayloadHash: payloadHash,
+								terminalPublished: record.terminalPublished === true,
+							},
+						}),
+					)
+					.digest("hex");
+			const replay = (): unknown => {
+				const scopes = store.snapshotTerminalScopes();
+				const existing = keyHash ? scopes.find(record => record.idempotencyKeyHash === keyHash) : undefined;
+				if (existing) {
+					if (existing.idempotencyInputHash !== inputHash)
+						throw Object.assign(new Error("Idempotency key was reused with different input."), {
+							code: "idempotency_conflict",
+						});
+					const persisted = stored(existing);
+					if (existing.turnDisposition === "stopped")
+						return {
+							ok: true,
+							selection: scope,
+							turn: "stopped",
+							...(scope === "owned"
+								? {
+										ownedWork: existing.ownedWorkDisposition === "stopped" ? "stopped" : "uncertain",
+										automaticDelivery: "none",
+										resumeOnOwnedCompletion: false,
+									}
+								: { ownedWork: "left_running", automaticDelivery: "enabled", resumeOnOwnedCompletion: true }),
+							replay: persisted,
+						};
+					if (existing.turnDisposition === "no_effect")
+						return {
+							ok: true,
+							selection: scope,
+							turn: "no_active_turn",
+							terminal: "terminal_no_effect",
+							replay: persisted,
+						};
+					if (existing.turnDisposition === "no_effect_marker_failure")
+						// The initial marker write failed before any destructive work;
+						// replay the SAME no_effect result the request returned, never
+						// a no_active_turn fabrication (review thread P2).
+						return {
+							ok: true,
+							selection: scope,
+							turn: "no_effect",
+							terminal: "terminal_no_effect",
+							replay: persisted,
+						};
+					if (existing.turnDisposition === "no_effect_reserved")
+						// A no-effect reservation that may still transition to active: a
+						// duplicate must never claim no_active_turn over a provisional row
+						// (review thread P2).
+						return {
+							ok: true,
+							selection: scope,
+							turn: "uncertain",
+							ownedWork: scope === "turn" ? "left_running" : "uncertain",
+							automaticDelivery: scope === "turn" ? "enabled" : "none",
+							resumeOnOwnedCompletion: scope === "turn",
+							reason: "reservation_in_flight",
+							replay: persisted,
+						};
+					return {
+						ok: true,
+						selection: scope,
+						turn: "uncertain",
+						ownedWork: scope === "turn" ? "left_running" : "uncertain",
+						automaticDelivery: scope === "turn" ? "enabled" : "none",
+						resumeOnOwnedCompletion: scope === "turn",
+						reason: existing.turnDisposition === "pending" ? "replay_pending" : "replay_uncertain",
+						replay: persisted,
+					};
+				}
+				if (keyHash) {
+					const tombstone = store.snapshotTerminalKeys().find(record => record.keyHash === keyHash);
+					if (tombstone) {
+						if (tombstone.inputHash !== inputHash)
+							throw Object.assign(new Error("Idempotency key was reused with different input."), {
+								code: "idempotency_conflict",
+							});
+						return tombstone.turnDisposition === "stopped"
+							? {
+									ok: true,
+									selection: scope,
+									turn: "stopped",
+									...(scope === "owned"
+										? {
+												ownedWork: tombstone.ownedWorkDisposition === "stopped" ? "stopped" : "uncertain",
+												automaticDelivery: "none",
+												resumeOnOwnedCompletion: false,
+											}
+										: {
+												ownedWork: "left_running",
+												automaticDelivery: "enabled",
+												resumeOnOwnedCompletion: true,
+											}),
+									replay: stored(tombstone),
+								}
+							: tombstone.turnDisposition === "no_effect"
+								? {
+										ok: true,
+										selection: scope,
+										turn: "no_active_turn",
+										terminal: "terminal_no_effect",
+										replay: stored(tombstone),
+									}
+								: tombstone.turnDisposition === "no_effect_marker_failure"
+									? {
+											ok: true,
+											selection: scope,
+											turn: "no_effect",
+											terminal: "terminal_no_effect",
+											replay: stored(tombstone),
+										}
+									: {
+											ok: true,
+											selection: scope,
+											turn: "uncertain",
+											ownedWork: scope === "turn" ? "left_running" : "uncertain",
+											automaticDelivery: scope === "turn" ? "enabled" : "none",
+											resumeOnOwnedCompletion: scope === "turn",
+											replay: stored(tombstone),
+										};
+					}
+				}
+				return undefined;
+			};
+			const prior = replay();
+			if (prior !== undefined) return prior;
+			const writeNoEffect = async (markerFailure = false): Promise<"ok" | "conflict"> => {
+				try {
+					await store.transactTerminalState(state => {
+						// Atomic recheck: a concurrent request may have committed a
+						// DIFFERENT input under this key after the earlier snapshot
+						// check; appending a second same-key row would make later
+						// replay's .find() by key hash ambiguous (review thread P2).
+						const conflicting = state.scopes.find(record => keyHash && record.idempotencyKeyHash === keyHash);
+						if (conflicting && conflicting.idempotencyInputHash !== inputHash)
+							throw new SdkOnlyIdempotencyConflictError();
+						// A SAME-input live row is durable replay authority (the original
+						// in-flight abort's marker): never replace it with a no-effect
+						// reservation, or the successful abort would replay later as
+						// no_active_turn. Leave the store unchanged and let the caller
+						// re-run the replay snapshot (review thread P2).
+						if (conflicting) {
+							existingReplay = conflicting;
+							return { scopes: state.scopes, keys: state.keys };
+						}
+						// A concurrent admission may ALSO have evicted a same-key row into
+						// the tombstone collection after this request's snapshot; recheck
+						// keys so a different input can never install a fresh marker over
+						// existing durable replay authority (review thread P2). A
+						// same-input tombstone already carries the reservation: leave the
+						// store unchanged and replay it.
+						const tombstone = state.keys.find(record => keyHash && record.keyHash === keyHash);
+						if (tombstone) {
+							if (tombstone.inputHash !== inputHash) throw new SdkOnlyIdempotencyConflictError();
+							existingReplay = tombstone;
+							return { scopes: state.scopes, keys: state.keys };
+						}
+						const preBound: SdkOnlyTerminalScopeRecord[] = [
+							...state.scopes.filter(record => !(keyHash && record.idempotencyKeyHash === keyHash)),
+							{
+								selection: scope,
+								...(keyHash ? { idempotencyKeyHash: keyHash, idempotencyInputHash: inputHash } : {}),
+								// A marker-failure reservation must replay as the SAME
+								// no_effect result it was returned with, so one idempotency
+								// key can never produce no_effect first and no_active_turn
+								// after eviction/restart (review thread P2). The idle-abort
+								// path writes a TRANSITIONAL reserved disposition: the
+								// requester's prompt may become active while the reservation
+								// is awaited, and a duplicate must never claim no_active_turn
+								// over a provisional row — the reserved row is finalized to
+								// plain no_effect only when the recheck confirms no active
+								// turn (review thread P2).
+								turnDisposition: markerFailure
+									? "no_effect_marker_failure"
+									: keyHash
+										? "no_effect_reserved"
+										: "no_effect",
+								ownedWorkDisposition: "not_requested",
+								automaticDeliveryDisposition: scope === "turn" ? "enabled" : "none",
+								resumeOnOwnedCompletion: scope === "turn",
+								turnContinuationFence: {
+									state: "retained",
+									abortedAttemptEpoch: 0,
+									blockedContinuationIds: [],
+									predecessorTombstones: [],
+									ownedCompletionPolicy: scope === "turn" ? "enabled" : "disabled",
+								},
+								responseState: "pending",
+								// marker_failure rows are FINAL as written (the abort returns the
+								// public no_effect disposition immediately, no later
+								// finalization), so store the public payload hash; idle
+								// reservations are finalized by finalizeNoEffectReservation
+								// (review thread P2). The replay-shaped hash is stored too so a
+								// same-key retry's metadata-bearing replay can still advance the
+								// row on delivery (review thread P2).
+								responsePayloadHash: markerFailure
+									? hashResult({
+											ok: true,
+											selection: scope,
+											turn: "no_effect",
+											terminal: "terminal_no_effect",
+										})
+									: inputHash,
+								replayPayloadHash: markerFailure
+									? hashResult({
+											ok: true,
+											selection: scope,
+											turn: "no_effect",
+											terminal: "terminal_no_effect",
+											replay: {
+												responseState: "pending",
+												responsePayloadHash: hashResult({
+													ok: true,
+													selection: scope,
+													turn: "no_effect",
+													terminal: "terminal_no_effect",
+												}),
+												terminalPublished: false,
+											},
+										})
+									: undefined,
+								acceptedAt: Date.now(),
+							},
+						];
+						return boundTerminalRetentionState(state.keys, preBound, terminalReservationLimit);
+					});
+					return "ok";
+				} catch (error) {
+					if (error instanceof SdkOnlyIdempotencyConflictError) return "conflict";
+					throw error;
+				}
+			};
+			// Finalize THIS abort's transitional no_effect_reserved reservation to
+			// plain no_effect once the recheck confirms there is no active turn to
+			// stop: a later same-key retry then replays the deterministic
+			// no_active_turn result instead of reservation_in_flight uncertainty
+			// (review thread P2). Only OUR row (exact key+input, still reserved) is
+			// touched — a concurrent transition that already replaced it is left
+			// alone. The EXACT final response payload hash is stored so the
+			// response-state advance can require equality instead of trusting a
+			// non-pending placeholder (review thread P2).
+			const finalizeNoEffectReservation = async (result: {
+				ok: boolean;
+				selection: string;
+				turn: string;
+				terminal: string;
+			}): Promise<void> => {
+				if (!keyHash) return;
+				const payloadHash = hashResult(result);
+				// The same-key retry delivers the metadata-bearing replay envelope;
+				// store its hash too so the retry's written response can advance the
+				// finalized row (review thread P2).
+				const replayPayloadHash = hashResult({
+					...result,
+					replay: { responseState: "pending", responsePayloadHash: payloadHash, terminalPublished: false },
+				});
+				try {
+					await store.transactTerminalState(state => {
+						const scopes: SdkOnlyTerminalScopeRecord[] = state.scopes.map(record =>
+							record.idempotencyKeyHash === keyHash &&
+							record.idempotencyInputHash === inputHash &&
+							record.turnDisposition === "no_effect_reserved"
+								? {
+										...record,
+										turnDisposition: "no_effect",
+										responsePayloadHash: payloadHash,
+										replayPayloadHash,
+									}
+								: record,
+						);
+						// Finalized reservations become evictable completed rows: apply
+						// the SAME bounded retention as writeNoEffect so a burst of idle
+						// aborts cannot grow the document (review thread P2).
+						return boundTerminalRetentionState(state.keys, scopes, terminalReservationLimit);
+					});
+				} catch {
+					// Best-effort: the row stays reserved (replays as uncertainty)
+					// rather than failing the abort (review thread P2).
+				}
+			};
+			// Finalize pending markers through the SAME bounded retention as the
+			// admission writes: mapping pending rows to completed dispositions
+			// (uncertain/stopped) must evict the oldest completed rows and retain
+			// tombstones, or a burst of concurrent distinct-key aborts of one slow
+			// turn leaves an arbitrarily large reconciliation document (review
+			// thread P2).
+			const transactBoundedTerminalScopes = async (
+				mutate: (scopes: SdkOnlyTerminalScopeRecord[]) => SdkOnlyTerminalScopeRecord[],
+			): Promise<void> => {
+				await store.transactTerminalState(state => {
+					return boundTerminalRetentionState(state.keys, mutate(state.scopes), terminalReservationLimit);
+				});
+			};
+			let handle = terminalAbortSeams.getActivePromptHandle();
+			let epoch = terminalAbortSeams.getTerminalTurnEpoch();
+			// Set when the no-effect reservation found an existing SAME-input row or
+			// tombstone: the caller re-runs the replay snapshot instead of returning
+			// a no-active result over the original row's replay authority (review
+			// thread P2).
+			let existingReplay: SdkOnlyTerminalScopeRecord | SdkOnlyEvictedTerminalKeyEntry | undefined;
+			// Read the requester's preflight bucket WITHOUT creating one: an
+			// abort-only request that returns via an early replay/marker path (which
+			// never runs the bucket cleanup) must not leave an empty per-connection
+			// entry behind — reconnecting clients would otherwise accumulate buckets
+			// indefinitely (review thread P2).
+			const requesterBucketKey = sdkControlRequesterContext.getStore() ?? "";
+			const requesterPreflights = pendingPreflights.get(requesterBucketKey);
+			// Snapshot the requester's preflight callbacks AT ADMISSION: a successor
+			// turn.prompt pipelined by the same connection while the abort awaits
+			// (e.g. the reconciliation transaction) must never be cancelled as part
+			// of this abort — only the callbacks present when it was admitted are
+			// its to cancel, mirroring the full-bus capture (review thread P1).
+			const admittedRequesterPreflights = new Set(requesterPreflights ?? []);
+			const cancelRequesterPreflights = () => {
+				for (const cancel of [...admittedRequesterPreflights]) cancel();
+				if (admittedRequesterPreflights.size > 0) {
+					// Remove the admitted callbacks from the live set so a preflight
+					// added by a LATER submission is untouched by this abort (and the
+					// bucket cleanup below reflects what actually remains).
+					for (const cancel of admittedRequesterPreflights) requesterPreflights?.delete(cancel);
+					// The seam cancels the SESSION-WIDE preflight controller, so only
+					// invoke it when NO OTHER connection has a pending admission: a
+					// queued requester's abort must reject its own wrapper callback
+					// (above) without cancelling another connection's active
+					// preflight — the aborting requester's admission is already
+					// rejected, so the session-wide abort is never required for it
+					// (review thread P1).
+					const otherConnectionPreflights = [...pendingPreflights.entries()].some(
+						([bucket, callbacks]) => bucket !== requesterBucketKey && callbacks.size > 0,
+					);
+					if (!otherConnectionPreflights) terminalAbortSeams.cancelPendingPreflightForTerminalAbort();
+				}
+				if (requesterPreflights && requesterPreflights.size === 0) {
+					// Abort-only lookups must not retain an empty per-connection bucket:
+					// connections are ephemeral UUIDs and nothing else removes the
+					// bucket when no prompt submission ever registered on it, so a
+					// long-lived runtime handling aborts from reconnecting clients
+					// would accumulate one entry per connection forever (review
+					// thread P2).
+					if (pendingPreflights.get(requesterBucketKey) === requesterPreflights)
+						pendingPreflights.delete(requesterBucketKey);
+				}
+			};
+			if (!handle || epoch === undefined) {
+				if ((await writeNoEffect()) === "conflict") {
+					throw Object.assign(new Error("Idempotency key was reused with different input."), {
+						code: "idempotency_conflict",
+					});
+				}
+				// A SAME-input row or tombstone existed while the reservation
+				// awaited the store: it is durable replay authority, so replay its
+				// stored result (stopped/pending/uncertain/no_effect) instead of
+				// returning no_active_turn over it (review thread P2).
+				if (existingReplay) {
+					const replayed = replay();
+					if (replayed !== undefined) return replayed;
+				}
+				cancelRequesterPreflights();
+				// A prompt for this requester may have become ACTIVE while the
+				// reservation awaited the filesystem transaction: its submit()
+				// cleanup already removed the preflight callback, so cancelling here
+				// saw an empty set and never reached the session cancellation seam —
+				// and the durable no-effect row would prevent a same-key retry from
+				// ever stopping the now-running prompt. Re-read the active prompt and
+				// fall through to ACTIVE terminalization when it won the race
+				// (review thread P1); the active-turn marker write replaces the
+				// no-effect reservation.
+				const recheckedHandle = terminalAbortSeams.getActivePromptHandle();
+				const recheckedEpoch = terminalAbortSeams.getTerminalTurnEpoch();
+				if (!recheckedHandle || recheckedEpoch === undefined) {
+					// No prompt won the race: finalize the reserved row so a later
+					// same-key retry replays this deterministic no_active_turn result
+					// (review thread P2).
+					const noActiveTurnResult = {
+						ok: true,
+						selection: scope,
+						turn: "no_active_turn",
+						terminal: "terminal_no_effect",
+					};
+					await finalizeNoEffectReservation(noActiveTurnResult);
+					return noActiveTurnResult;
+				}
+				handle = recheckedHandle;
+				epoch = recheckedEpoch;
+				// The requester's OWN prompt won the race: rebind the snapshot
+				// to the current turn so the settlement classifies steering
+				// admitted since admission as post-snapshot (review thread P1).
+				if (steeringSnapshotToken !== undefined) {
+					terminalAbortSeams?.rebindTerminalAbortSteeringSnapshot?.(steeringSnapshotToken);
+				}
+			}
+			// Requester ownership: the active prompt belongs to the SDK connection
+			// that accepted it. Another connection's terminal abort must not stop it
+			// (review thread P1) — no-op with an idle reservation, mirroring the
+			// per-connection selection of the full bus path. The owner is re-read
+			// through the seam when provided (deterministic tests) and otherwise
+			// from the runtime-tracked accepting connection.
+			const abortingConnectionId = sdkControlRequesterContext.getStore();
+			const currentOwnerConnectionIds = (): ReadonlySet<string> => {
+				const seam = terminalAbortSeams.getActivePromptOwnerConnectionId?.();
+				// The seam reports a single deterministic owner (test harnesses); the
+				// runtime holder may carry every connection whose follow-up was
+				// promoted into the current run (review thread P2).
+				return seam === undefined ? (activePromptOwner.connectionIds ?? new Set<string>()) : new Set([seam]);
+			};
+			// FAIL CLOSED unless the active handle is POSITIVELY associated with the
+			// requester: an undefined owner (agent-initiated monitor/cron turn, or
+			// cleared after a terminal lifecycle boundary) authorizes no client, and
+			// a stale prior owner authorizes only that old client — never a later
+			// turn it did not submit (review thread P1).
+			if (handle && (abortingConnectionId === undefined || !currentOwnerConnectionIds().has(abortingConnectionId))) {
+				if ((await writeNoEffect()) === "conflict") {
+					throw Object.assign(new Error("Idempotency key was reused with different input."), {
+						code: "idempotency_conflict",
+					});
+				}
+				if (existingReplay) {
+					const replayed = replay();
+					if (replayed !== undefined) return replayed;
+				}
+				cancelRequesterPreflights();
+				// A prompt for this requester may have become ACTIVE while the
+				// no-effect reservation awaited the filesystem transaction: the
+				// owner-mismatch decision was taken against the OLD owner, and the
+				// newly active submission already removed its preflight callback, so
+				// cancelling here saw an empty set and never reached the session
+				// cancellation seam — and the durable no-effect row would prevent a
+				// same-key retry from ever stopping the now-running prompt. Re-read
+				// the active prompt, its epoch, and its owner; when the ABORTING
+				// connection now owns the turn, fall through to ACTIVE
+				// terminalization (the active-turn marker write replaces the
+				// no-effect reservation) (review thread P1).
+				const recheckedHandle = terminalAbortSeams.getActivePromptHandle();
+				const recheckedEpoch = terminalAbortSeams.getTerminalTurnEpoch();
+				const recheckedOwners = currentOwnerConnectionIds();
+				if (
+					!recheckedHandle ||
+					recheckedEpoch === undefined ||
+					abortingConnectionId === undefined ||
+					!recheckedOwners.has(abortingConnectionId)
+				) {
+					// The turn is still not the aborting connection's: finalize the
+					// reserved row so a later same-key retry replays no_active_turn
+					// deterministically (review thread P2).
+					const noActiveTurnResult = {
+						ok: true,
+						selection: scope,
+						turn: "no_active_turn",
+						terminal: "terminal_no_effect",
+					};
+					await finalizeNoEffectReservation(noActiveTurnResult);
+					return noActiveTurnResult;
+				}
+				handle = recheckedHandle;
+				epoch = recheckedEpoch;
+				// The requester's OWN prompt won the race: rebind the snapshot
+				// to the current turn so the settlement classifies steering
+				// admitted since admission as post-snapshot (review thread P1).
+				if (steeringSnapshotToken !== undefined) {
+					terminalAbortSeams?.rebindTerminalAbortSteeringSnapshot?.(steeringSnapshotToken);
+				}
+			}
+			let pendingReplay: SdkOnlyTerminalScopeRecord | undefined;
+			let tombstoneReplay: SdkOnlyEvictedTerminalKeyEntry | undefined;
+			try {
+				await store.transactTerminalState(state => {
+					// Atomic recheck (same rationale as writeNoEffect): never wipe a
+					// row a concurrent request committed under this key (review thread
+					// P2). A same-input PENDING row is an in-flight duplicate admitted
+					// past the snapshot (dispatch-cache eviction): replay it instead of
+					// replacing the marker, so the duplicate cannot race terminalization
+					// and flip the row to uncertain while the original returns stopped
+					// (or execute the abort twice).
+					const conflicting = state.scopes.find(record => keyHash && record.idempotencyKeyHash === keyHash);
+					if (conflicting) {
+						if (conflicting.idempotencyInputHash !== inputHash) throw new SdkOnlyIdempotencyConflictError();
+						if (conflicting.turnDisposition === "pending") {
+							pendingReplay = conflicting;
+							return { scopes: state.scopes, keys: state.keys };
+						}
+					}
+					// A concurrent admission may ALSO have evicted a same-key row into
+					// the tombstone collection after this request's snapshot. Recheck
+					// keys so a different input can never install a fresh marker over
+					// existing durable replay authority; a same-input tombstone already
+					// carries replay authority, so never install a second marker here
+					// (review thread P2).
+					const tombstone = state.keys.find(record => keyHash && record.keyHash === keyHash);
+					if (tombstone) {
+						if (tombstone.inputHash !== inputHash) throw new SdkOnlyIdempotencyConflictError();
+						tombstoneReplay = tombstone;
+						return { scopes: state.scopes, keys: state.keys };
+					}
+					const preBound: SdkOnlyTerminalScopeRecord[] = [
+						...state.scopes.filter(record => !(keyHash && record.idempotencyKeyHash === keyHash)),
+						{
+							selection: scope,
+							...(keyHash ? { idempotencyKeyHash: keyHash, idempotencyInputHash: inputHash } : {}),
+							turnDisposition: "pending",
+							terminalPublished: false,
+							ownedWorkDisposition: "not_requested",
+							automaticDeliveryDisposition: scope === "turn" ? "enabled" : "none",
+							resumeOnOwnedCompletion: scope === "turn",
+							turnContinuationFence: {
+								state: "retained",
+								abortedAttemptEpoch: epoch,
+								blockedContinuationIds: [],
+								predecessorTombstones: [],
+								ownedCompletionPolicy: scope === "turn" ? "enabled" : "disabled",
+							},
+							responseState: "pending",
+							responsePayloadHash: inputHash,
+							acceptedAt: Date.now(),
+						},
+					];
+					return boundTerminalRetentionState(state.keys, preBound, terminalReservationLimit);
+				});
+			} catch (error) {
+				if (error instanceof SdkOnlyIdempotencyConflictError) {
+					throw Object.assign(new Error("Idempotency key was reused with different input."), {
+						code: "idempotency_conflict",
+					});
+				}
+				// Marker persistence failed before any destructive work: reserve a
+				// distinct marker-failure disposition so replay returns the same
+				// no_effect result (review thread P2).
+				if ((await writeNoEffect(true)) === "conflict") {
+					throw Object.assign(new Error("Idempotency key was reused with different input."), {
+						code: "idempotency_conflict",
+					});
+				}
+				if (existingReplay) {
+					const replayed = replay();
+					if (replayed !== undefined) return replayed;
+				}
+				return {
+					ok: true,
+					selection: scope,
+					turn: "no_effect",
+					terminal: "terminal_no_effect",
+				};
+			}
+			if (pendingReplay) {
+				// An in-flight duplicate of this exact key+input was already admitted;
+				// replay its pending row WITHOUT touching the seam, so the duplicate
+				// cannot abort the run a second time or race the terminalization.
+				return {
+					ok: true,
+					selection: scope,
+					turn: "uncertain",
+					ownedWork: scope === "turn" ? "left_running" : "uncertain",
+					automaticDelivery: scope === "turn" ? "enabled" : "none",
+					resumeOnOwnedCompletion: scope === "turn",
+					reason: "replay_pending",
+					replay: {
+						responseState: pendingReplay.responseState,
+						responsePayloadHash: pendingReplay.responsePayloadHash,
+						terminalPublished: pendingReplay.terminalPublished === true,
+					},
+				};
+			}
+			if (tombstoneReplay) {
+				// The key gained durable replay authority via an eviction tombstone
+				// while this request was in flight; never install a second marker or
+				// run the abort. Re-run the replay snapshot (the tombstone is now
+				// visible) so the STORED result is returned (review thread P2).
+				const replayed = replay();
+				if (replayed !== undefined) return replayed;
+			}
+			// A new prompt won the race while the marker was being persisted. Never
+			// apply this request to that later handle; replay remains a safe uncertainty.
+			if (
+				terminalAbortSeams.getActivePromptHandle() !== handle ||
+				terminalAbortSeams.getTerminalTurnEpoch() !== epoch
+			) {
+				const result = {
+					ok: true,
+					selection: scope,
+					turn: "uncertain",
+					ownedWork: scope === "turn" ? "left_running" : "uncertain",
+					automaticDelivery: scope === "turn" ? "enabled" : "none",
+					resumeOnOwnedCompletion: scope === "turn",
+					reason: "active_turn_changed",
+				};
+				const activeTurnPayloadHash = hashResult(result);
+				await transactBoundedTerminalScopes(scopes =>
+					scopes.map(record =>
+						(keyHash
+							? record.idempotencyKeyHash === keyHash
+							: record.turnContinuationFence.abortedAttemptEpoch === epoch) &&
+						record.turnDisposition === "pending"
+							? {
+									...record,
+									turnDisposition: "uncertain",
+									responsePayloadHash: activeTurnPayloadHash,
+									replayPayloadHash: replayShapedHash(record, result, activeTurnPayloadHash),
+									terminalAt: Date.now(),
+								}
+							: record,
+					),
+				);
+				return result;
+			}
+			cancelRequesterPreflights();
+			// Observe the correlated agent_end publication (AC 19) instead of
+			// assuming it: the aborted run's lifecycle event is published
+			// independently by emitLifecycle, so the durable stopped row must only
+			// claim terminalPublished when the publication was actually observed
+			// (review thread P2). Multiple concurrent aborts of the SAME turn (distinct
+			// idempotency keys, same scope) are all admitted and all await the ONE
+			// agent_end the turn emits, so every waiter is registered — a single slot
+			// would resolve only the latest and leave the earlier abort to record a
+			// false negative (review thread P2).
+			const terminalPublication = Promise.withResolvers<boolean>();
+			const removeTerminalPublicationWaiter = () => {
+				const resolvers = terminalPublicationCapture?.resolvers;
+				if (!resolvers) return;
+				const index = resolvers.indexOf(terminalPublication.resolve);
+				if (index >= 0) resolvers.splice(index, 1);
+			};
+			if (terminalPublicationCapture) {
+				if (!terminalPublicationCapture.resolvers) terminalPublicationCapture.resolvers = [];
+				terminalPublicationCapture.resolvers.push(terminalPublication.resolve);
+			}
+			let proof: { status: string; terminalScope?: unknown };
+			try {
+				proof = await terminalAbortSeams.abortPromptAndWaitWithTerminal(handle, {
+					graceMs: 10_000,
+					terminal: {
+						scope,
+						expectedEpoch: epoch,
+						...(steeringSnapshotToken !== undefined ? { steeringSnapshotToken } : {}),
+					},
+				});
+			} catch {
+				proof = { status: "unfenced" };
+			}
+			steeringSnapshotConsumed = proof.status === "settled";
+			if (proof.status !== "settled" || proof.terminalScope === undefined) {
+				removeTerminalPublicationWaiter();
+				const result = {
+					ok: true,
+					selection: scope,
+					turn: "uncertain",
+					ownedWork: scope === "turn" ? "left_running" : "uncertain",
+					automaticDelivery: scope === "turn" ? "enabled" : "none",
+					resumeOnOwnedCompletion: scope === "turn",
+					reason: "worker_unsettled",
+				};
+				const workerUnsettledPayloadHash = hashResult(result);
+				await transactBoundedTerminalScopes(scopes =>
+					scopes.map(record =>
+						(keyHash
+							? record.idempotencyKeyHash === keyHash
+							: record.turnContinuationFence.abortedAttemptEpoch === epoch) &&
+						record.turnDisposition === "pending"
+							? {
+									...record,
+									turnDisposition: "uncertain",
+									ownedWorkDisposition: "uncertain",
+									responsePayloadHash: workerUnsettledPayloadHash,
+									replayPayloadHash: replayShapedHash(record, result, workerUnsettledPayloadHash),
+									terminalAt: Date.now(),
+								}
+							: record,
+					),
+				);
+				return result;
+			}
+			// scope:"owned" must generation-verify and CANCEL the exact owned work
+			// before reporting it stopped: abortPromptAndWaitWithTerminal only aborts
+			// the foreground run and registers the disabled-delivery scope — a
+			// background Bash/task/detached subagent would otherwise keep running
+			// while the client receives stopped_owned (review thread P1).
+			const ownedStopped = true;
+			if (scope === "owned") {
+				const terminalScope = proof.terminalScope as
+					| { abortedAttemptEpoch?: number; lineageIdHash?: string }
+					| undefined;
+				const failOwnedUncertain = async (): Promise<unknown> => {
+					removeTerminalPublicationWaiter();
+					const result = {
+						ok: true,
+						selection: scope,
+						turn: "uncertain",
+						ownedWork: "uncertain",
+						automaticDelivery: "none",
+						resumeOnOwnedCompletion: false,
+						reason: "owned_unsettled",
+					};
+					const ownedUnsettledPayloadHash = hashResult(result);
+					await transactBoundedTerminalScopes(scopes =>
+						scopes.map(record =>
+							(keyHash
+								? record.idempotencyKeyHash === keyHash
+								: record.turnContinuationFence.abortedAttemptEpoch === epoch) &&
+							record.turnDisposition === "pending"
+								? {
+										...record,
+										turnDisposition: "uncertain",
+										ownedWorkDisposition: "uncertain",
+										responsePayloadHash: ownedUnsettledPayloadHash,
+										replayPayloadHash: replayShapedHash(record, result, ownedUnsettledPayloadHash),
+										terminalAt: Date.now(),
+									}
+								: record,
+						),
+					);
+					return result;
+				};
+				if (
+					!terminalScope ||
+					terminalScope.abortedAttemptEpoch === undefined ||
+					!terminalScope.lineageIdHash ||
+					isOwnedAttemptRegistrationIncomplete(terminalScope.lineageIdHash, terminalScope.abortedAttemptEpoch)
+				) {
+					// The attempt's registration set may be KNOWN incomplete (registry
+					// saturation or an evicted in-flight binding): never claim
+					// stopped_owned over an incomplete causal set.
+					return await failOwnedUncertain();
+				}
+				const exactJobs = findOwnedRegistrationsForTurn(
+					terminalScope.lineageIdHash,
+					terminalScope.abortedAttemptEpoch,
+				);
+				if (exactJobs.length > 0) {
+					// Resolve the manager from the ABORTING ENDPOINT captured on the
+					// registrations — never the process-global last-created session,
+					// which could cancel a foreign same-id job and report stopped_owned
+					// while the aborting session's job keeps running (review thread P1).
+					const endpointId = exactJobs[0]?.endpointId;
+					const manager = AsyncJobManager.forEndpoint(endpointId) ?? AsyncJobManager.instance();
+					if (!manager || (await settleOwnedWork(manager, exactJobs, 500)) !== "stopped") {
+						return await failOwnedUncertain();
+					}
+				}
+			}
+			// The worker settled; await the correlated agent_end publication for a
+			// bounded window and persist the OBSERVED result (review thread P2). A
+			// publication that never lands (lifecycle listener absent, still
+			// pending, or failed) yields observed=false — the durable row never
+			// claims a terminal event reached clients unless it was actually
+			// published.
+			const observed = await Promise.race([
+				terminalPublication.promise,
+				Bun.sleep(SDK_ONLY_TERMINAL_PUBLICATION_WAIT_MS).then(() => false as const),
+			]);
+			removeTerminalPublicationWaiter();
+			const terminalPublished = observed === true;
+			const result = {
+				ok: true,
+				selection: scope,
+				turn: "stopped",
+				...(scope === "turn"
+					? { ownedWork: "left_running", automaticDelivery: "enabled", resumeOnOwnedCompletion: true }
+					: {
+							ownedWork: ownedStopped ? "stopped" : "uncertain",
+							automaticDelivery: "none",
+							resumeOnOwnedCompletion: false,
+						}),
+			};
+			const payloadHash = crypto.createHash("sha256").update(JSON.stringify(result)).digest("hex");
+			await transactBoundedTerminalScopes(scopes =>
+				scopes.map(record =>
+					(keyHash
+						? record.idempotencyKeyHash === keyHash
+						: record.turnContinuationFence.abortedAttemptEpoch === epoch) && record.turnDisposition === "pending"
+						? {
+								...record,
+								turnDisposition: "stopped",
+								terminalPublished,
+								ownedWorkDisposition:
+									scope === "turn" ? "left_running" : ownedStopped ? "stopped" : "uncertain",
+								responsePayloadHash: payloadHash,
+								// The replay envelope carries the POST-CAS publication
+								// flag; the replay-shaped hash must be computed from the
+								// updated row or a written replay could never match it
+								// (review thread P2).
+								replayPayloadHash: replayShapedHash({ ...record, terminalPublished }, result, payloadHash),
+								terminalAt: Date.now(),
+							}
+						: record,
+				),
+			);
+			return result;
+		} finally {
+			// A replay-only abort (or any pre-settlement failure) never consumed its
+			// snapshot: discard it so a later real abort cannot consume the stale
+			// entry and treat steering admitted since the replay as post-abort
+			// (review thread P1).
+			if (steeringSnapshotToken !== undefined && !steeringSnapshotConsumed) {
+				terminalAbortSeams?.discardTerminalAbortSteeringSnapshot?.(steeringSnapshotToken);
+			}
 		}
 	};
 	return {
-		authorizeElevationClaim: (sdkId, input, capability) =>
-			elevationAuthorityToken !== undefined &&
-			verifyElevationCapability(elevationAuthorityToken, capability, sdkId, input),
 		prompt: async (text, images, clientRef) =>
-			submit("prompt", clientRef, options =>
+			submit("prompt", clientRef, ({ queuedAtDispatch, ...options }) =>
 				api.sendUserMessage(
 					typeof images === "undefined" ? text : ([{ type: "text", text }, ...(images as never[])] as never),
-					options,
+					queuedAtDispatch ? { ...options, queuedAtDispatch: true } : options,
 				),
 			),
-		steer: async text => {
-			await api.sendUserMessage(text, { deliverAs: "steer" });
-			return { commandId: crypto.randomUUID(), accepted: true };
+		steer: async (text, clientRef) => {
+			const retainedClientRef = normalizeClientRef(clientRef);
+			if (retainedClientRef === undefined) {
+				const correlation = newCorrelation();
+				await api.sendUserMessage(text, { deliverAs: "steer" });
+				return { accepted: true, ...correlation };
+			}
+			const durable = steerReconciliation;
+			const reservation = await durable.reserveSteer(retainedClientRef, text);
+			if (reservation.replay) return { accepted: reservation.result.status === "accepted", ...reservation.result };
+			try {
+				await api.sendUserMessage(text, { deliverAs: "steer" });
+				return { accepted: true, ...(await durable.settleSteer(retainedClientRef, "accepted")) };
+			} catch (error) {
+				return { accepted: false, ...(await durable.settleSteer(retainedClientRef, "rejected", error)) };
+			}
 		},
 		followUp: async text =>
 			submit(
@@ -1170,14 +2348,16 @@ function createControlSurface(
 				options => api.sendUserMessage(text, { ...options, deliverAs: "followUp" }),
 				undefined,
 				false,
+				// Follow-ups never start inline; ownership correlates at promotion.
 				true,
 			),
 		abort: () => {
 			ctx.abort();
 			return { aborted: true };
 		},
+		abortTerminal: terminalAbort,
 		abortAndPrompt: async text => {
-			ctx.abort();
+			await ctx.abort();
 			return await submit("prompt", undefined, options => api.sendUserMessage(text, options));
 		},
 		answerAsk: unavailable("ask.answer"),
@@ -1271,7 +2451,11 @@ function createControlSurface(
 		newSession: () => typed("session.new"),
 		forkSession: () => typed("session.fork"),
 		resumeSession: id => typed("session.resume", { id }),
-		closeSession: () => typed("session.close"),
+		closeSession: capability =>
+			typed(
+				"session.close",
+				capability === undefined ? {} : { [BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD]: capability },
+			),
 		switchSession: id => typed("session.switch", { id }),
 		branchSession: entryId => typed("session.branch", { entryId }),
 		renameSession: name => typed("session.rename", { name }),
@@ -1377,25 +2561,108 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				revisions: RevisionStore;
 				cursors: CursorRegistry;
 				reconciliation: InvocationReconciliation;
-				pending: Array<{ kind: InvocationKind; correlation: InvocationCorrelation }>;
+				steerReconciliation: KindAwareReconciliation;
+				deadlineManager: PromptDeadlineManager;
+				pending: Array<{
+					kind: InvocationKind;
+					correlation: InvocationCorrelation;
+					connectionId: string | undefined;
+				}>;
 				registerBroker: () => Promise<void>;
 				fenceGateResolutions: () => void;
 				waitForGateResolutionQuiescence: () => Promise<void>;
 				activeInvocation?: { kind: InvocationKind; correlation: InvocationCorrelation };
+				drainedInvocations?: Array<{ kind: InvocationKind; correlation: InvocationCorrelation }>;
 				disposeGate?: () => void;
 		  }
 		| undefined;
+	// Shared with the control surface's terminal abort: the correlated
+	// agent_end publication capture (AC 19). terminalAbort installs a fresh
+	// resolver before settling the abort; emitLifecycle resolves it with the
+	// OBSERVED publication result when the aborted run's lifecycle event
+	// lands, so the durable stopped row never claims terminalPublished without
+	// observing it (review thread P2). Single slot: only the abort that
+	// reaches the stopped path awaits it; a concurrent abort for the same turn
+	// is settled by the durable marker transaction instead.
+	const terminalPublicationCapture: { resolvers?: Array<(observed: boolean) => void> } = {};
+	// Shared with the control surface: the SDK connection owning the currently
+	// active prompt/skill turn. Cleared at every agent_end (terminal lifecycle
+	// boundary) so a stale owner never authorizes an abort against a later
+	// turn it did not submit, and never set for agent-initiated turns (review
+	// thread P1).
+	const activePromptOwnerHolder: { connectionIds?: Set<string> } = {};
 	const emitLifecycle = async (type: "agent_start" | "agent_end", ctx: ExtensionContext): Promise<void> => {
 		const current = active;
 		if (!current) return;
-		if (type === "agent_start") current.activeInvocation = current.pending.shift();
-		await current.reconciliation.noteTransition(
-			current.activeInvocation?.kind ?? "prompt",
-			current.activeInvocation?.correlation,
-			{ type },
-		);
-		current.runtime.emitEvent({ type, sessionId: ctx.sessionManager.getSessionId() });
-		if (type === "agent_end") current.activeInvocation = undefined;
+		if (type === "agent_start") {
+			// Drain EVERY entry admitted for this run: a continuation may promote
+			// several follow-ups (each with its own requester correlation) into one
+			// run, and each submitting connection must be able to terminal-abort it.
+			// Entries are only created for submissions that actually start their own
+			// turn (queued-while-streaming submissions never push), so a mid-prompt
+			// continuation agent_start with an empty queue leaves the current owner
+			// untouched (review thread P1).
+			const drained = current.pending.splice(0);
+			current.activeInvocation = drained[0];
+			if (drained.length > 0) {
+				const owners = new Set<string>();
+				for (const entry of drained) if (entry.connectionId !== undefined) owners.add(entry.connectionId);
+				activePromptOwnerHolder.connectionIds = owners;
+				// A single run may drain several follow-ups promoted together; each
+				// has its own durable record that must reach terminal state, so keep
+				// the full batch for the transition pass below (review thread P1).
+				current.drainedInvocations = drained.map(({ kind, correlation }) => ({ kind, correlation }));
+			}
+			if (current.activeInvocation?.kind === "prompt") {
+				current.deadlineManager.onAccepted(current.activeInvocation.correlation);
+			}
+		}
+		// Observe whether the lifecycle publication actually landed: a terminal
+		// abort awaits this result so its durable row only claims
+		// terminalPublished when the correlated agent_end event reached the
+		// ring/broadcast (review thread P2). Reconciliation or event failure is
+		// recorded as observed=false, never rethrown into the api handler.
+		let observed = true;
+		try {
+			const transitions =
+				current.drainedInvocations && current.drainedInvocations.length > 0
+					? current.drainedInvocations
+					: current.activeInvocation
+						? [current.activeInvocation]
+						: [];
+			for (const invocation of transitions) {
+				await current.reconciliation.noteTransition(invocation.kind, invocation.correlation, { type } as never);
+				if ((type as string) === "agent_end" || (type as string) === "agent_failed") {
+					if (invocation.kind === "prompt") current.deadlineManager.clear(invocation.correlation);
+				}
+			}
+			current.runtime.emitEvent({ type, sessionId: ctx.sessionManager.getSessionId() });
+		} catch {
+			observed = false;
+		}
+		if (type === "agent_end") {
+			if (current.activeInvocation?.kind === "prompt") {
+				current.deadlineManager.clear(current.activeInvocation.correlation);
+			} else if (current.drainedInvocations) {
+				for (const inv of current.drainedInvocations)
+					if (inv.kind === "prompt") current.deadlineManager.clear(inv.correlation);
+			}
+			current.activeInvocation = undefined;
+			current.drainedInvocations = undefined;
+			// The turn is over: no connection owns it anymore. Clearing here means
+			// an abort against a later agent-initiated turn (monitor/cron
+			// follow-up) finds no owner and fails closed, instead of letting the
+			// previous prompt's owner stop a turn it did not submit (review
+			// thread P1).
+			activePromptOwnerHolder.connectionIds = undefined;
+			// Resolve EVERY concurrent waiter for the aborted turn: the turn emits
+			// exactly one agent_end, and each admitted abort of it must observe the
+			// same publication result rather than a single latest-wins slot (review
+			// thread P2).
+			const resolvers = terminalPublicationCapture.resolvers;
+			terminalPublicationCapture.resolvers = undefined;
+			for (const resolve of resolvers ?? []) resolve(observed);
+		}
 	};
 	api.on("agent_start", async (_event, ctx) => await emitLifecycle("agent_start", ctx));
 	api.on("agent_end", async (_event, ctx) => await emitLifecycle("agent_end", ctx));
@@ -1408,6 +2675,18 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 	api.on("turn_end", (_event, ctx) =>
 		active?.runtime.emitEvent({ type: "turn_end", sessionId: ctx.sessionManager.getSessionId() }),
 	);
+	api.on("tool_execution_start", async (_event, ctx) => {
+		const current = active;
+		if (current?.activeInvocation?.kind !== "prompt") return;
+		current.deadlineManager.onAttributableEvent(current.activeInvocation.correlation, "tool_execution_start");
+		void ctx;
+	});
+	api.on("tool_execution_end", async (_event, ctx) => {
+		const current = active;
+		if (current?.activeInvocation?.kind !== "prompt") return;
+		current.deadlineManager.onAttributableEvent(current.activeInvocation.correlation, "tool_execution_end");
+		void ctx;
+	});
 	const errorCode = (error: unknown): string | undefined =>
 		typeof error === "object" &&
 		error !== null &&
@@ -1420,23 +2699,36 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		const sessionId = ctx.sessionManager.getSessionId();
 		const stateRoot = path.join(ctx.cwd, ".gjc", "state");
 		const token = crypto.randomBytes(24).toString("base64url");
-		const elevationAuthorityToken = crypto.randomBytes(32).toString("base64url");
-		const elevationAuthorityFile = elevationAuthorityPath(stateRoot, sessionId);
-		await fs.mkdir(path.dirname(elevationAuthorityFile), { recursive: true, mode: 0o700 });
-		await Bun.write(elevationAuthorityFile, `${JSON.stringify({ version: 1, token: elevationAuthorityToken })}\n`);
-		await fs.chmod(elevationAuthorityFile, 0o600);
 		const transport = await options.createTransport({ sessionId, stateRoot, token });
 		const revisions = new RevisionStore(sessionId, Date.now, { storageDir: stateRoot });
 		const cursors = new CursorRegistry(token, revisions);
-		const reconciliation = createInvocationReconciliation({ stateRoot, sessionId });
+		const reconciliationStore = options.terminalAbortSeams?.getReconciliationStore?.();
+		const reconciliation = createInvocationReconciliation({ store: reconciliationStore });
 		await reconciliation.hydrate();
-		const pending: Array<{ kind: InvocationKind; correlation: InvocationCorrelation }> = [];
+		const sessionFile =
+			(typeof ctx.sessionManager.getSessionFile === "function" ? ctx.sessionManager.getSessionFile() : undefined) ??
+			resolveReconciliationSessionFile(undefined, stateRoot, sessionId);
+		const steerReconciliation = createKindAwareReconciliation({
+			store: createReconciliationStore({ sessionFile, sessionId }),
+		});
+		await steerReconciliation.hydrateFromStore();
+		const deadlineManager = new PromptDeadlineManager({
+			reconciliation,
+			getLeaseMs: () => {
+				const v = options.settings?.get("sdk.promptDeadlineMs" as never) as number | undefined;
+				return typeof v === "number" && Number.isFinite(v) ? v : 1_800_000;
+			},
+			getMaxMs: () => {
+				const v = options.settings?.get("sdk.promptMaxRuntimeMs" as never) as number | undefined;
+				return typeof v === "number" && Number.isFinite(v) ? v : 21_600_000;
+			},
+		});
+		const pending: Array<{
+			kind: InvocationKind;
+			correlation: InvocationCorrelation;
+			connectionId: string | undefined;
+		}> = [];
 		const configRevision = { current: 0 };
-		// The event-ring watermark lives on the runtime host, which is constructed
-		// after the surface factory; the lazy source indirection lets the surface
-		// read the live generation/seq once the runtime exists (Q30 atomic
-		// capture, C9).
-		let eventWatermarkSource: () => { generation: number; seq: number } = () => ({ generation: 0, seq: 0 });
 		let acceptingGateResolutions = true;
 		const inFlightGateResolutions = new Set<Promise<unknown>>();
 		const trackGateResolution = <T>(resolution: Promise<T>): Promise<T> => {
@@ -1446,8 +2738,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		};
 		const waitForGateResolutionQuiescence = async (): Promise<void> => {
 			const settled = Promise.allSettled(inFlightGateResolutions);
-			const timeout = Bun.sleep(5_000).then(() => {
-				throw new Error("Timed out waiting for SDK workflow gate resolutions to settle.");
+			const timeout = Bun.sleep(GATE_RESOLUTION_QUIESCENCE_MS).then(() => {
+				logger.warn("SDK workflow gate resolution drain timed out; proceeding with uncertain outcomes.");
 			});
 			await Promise.race([settled, timeout]);
 		};
@@ -1457,23 +2749,47 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			api,
 			reconciliation,
 			turnResultLookup: selector => reconciliation.lookupResult(selector.kind, selector),
+			steerStatusLookup: selector => steerReconciliation.lookupSteer(selector),
 			configOverrides: options.configOverrides,
 			settings: options.settings,
-			getEventWatermark: () => eventWatermarkSource(),
 		});
 		const queryHandlers = new QueryHandlers(surfaceFactory.query, sessionId, revisions, cursors);
 		const controlSurface = createControlSurface(
 			ctx,
 			api,
 			reconciliation,
-			(kind, correlation) => {
-				pending.push({ kind, correlation });
+			(kind, correlation, connectionId, startsOwnTurn) => {
+				// Only submissions that start their OWN turn get a pending entry: a
+				// steering-queued submission consumed inside the current run never
+				// emits the agent_start that would consume the entry, so leaving it
+				// queued would assign its stale connection as owner of a later
+				// agent-initiated turn (review thread P1).
+				if (startsOwnTurn) pending.push({ kind, correlation, connectionId });
+			},
+			steerReconciliation,
+			(kind, correlation, connectionId) => {
+				// A steering-queued submission PROMOTED to its own run (finished
+				// prompt unwinding) starts with an empty pending queue at its
+				// agent_start; create the entry at promotion so the submitting
+				// connection owns that turn (review thread P2).
+				pending.push({ kind, correlation, connectionId });
 			},
 			surfaceFactory.policy,
 			options.settings,
 			options.configOverrides,
 			configRevision,
-			elevationAuthorityToken,
+			options.terminalAbortSeams,
+			terminalPublicationCapture,
+			activePromptOwnerHolder,
+			correlation => {
+				// An accepted submission that settles WITHOUT starting (a rejection
+				// after acceptance) must not leave its pending entry behind: remove
+				// the matching correlation so a later agent-initiated turn never
+				// inherits the failed submission's connection as owner (review
+				// thread P1).
+				const index = pending.findIndex(entry => entry.correlation === correlation);
+				if (index >= 0) pending.splice(index, 1);
+			},
 			() => acceptingGateResolutions,
 			trackGateResolution,
 		);
@@ -1544,24 +2860,23 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		};
 		runtime = new SessionSdkSessionRuntime({
 			transport,
-			control: async (_connectionId, frame) => {
+			control: async (connectionId, frame) => {
+				options.onFrameAdmitted?.();
 				const request = controlRequestFromFrame(frame as Record<string, unknown>);
-				return dispatchControl(
-					controlSurface,
-					OPERATIONS.find(operation => operation.kind === "control" && operation.sdkId === request.operation),
-					request,
+				// Scope preflight cancellation to the REQUESTING SDK connection: the
+				// requester preflight buckets are keyed by this context, so a
+				// terminal abort from one client must never cancel another client's
+				// pending preflight (review thread P1).
+				return sdkControlRequesterContext.run(connectionId, () =>
+					dispatchControl(
+						controlSurface,
+						OPERATIONS.find(operation => operation.kind === "control" && operation.sdkId === request.operation),
+						request,
+					),
 				);
 			},
 			query: async (connectionId, frame) => {
 				const request = frame as Record<string, unknown>;
-				// D1: a non-string top-level cursor is rejected, never silently
-				// dropped into a fresh-snapshot query.
-				if (request.cursor !== undefined && typeof request.cursor !== "string")
-					return {
-						id: typeof request.id === "string" ? request.id : undefined,
-						ok: false,
-						error: { code: "invalid_input", message: "cursor must be a non-empty string" },
-					};
 				return queryHandlers.dispatch({
 					id: typeof request.id === "string" ? request.id : undefined,
 					query: typeof request.query === "string" ? request.query : "",
@@ -1574,18 +2889,86 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				});
 			},
 			onRequest: options.onSdkRequest,
+			onControlResponseDelivery: async (_connectionId, request, response, outcome) => {
+				// Strict key validation: a malformed retry (e.g. numeric
+				// idempotencyKey) rejected by dispatch must NEVER hash to the same
+				// key as a legitimate stored string and advance its response state
+				// (review thread P2).
+				if (
+					!reconciliationStore ||
+					request.operation !== "turn.abort" ||
+					typeof request.idempotencyKey !== "string" ||
+					typeof request.input !== "object" ||
+					request.input === null ||
+					(request.input as { mode?: unknown }).mode !== "terminal"
+				)
+					return;
+				const input = request.input as Record<string, unknown>;
+				const mode = input.mode;
+				const rawScope = input.scope;
+				if (mode !== "terminal") return;
+				if (rawScope !== undefined && rawScope !== "turn" && rawScope !== "owned") return;
+				// A malformed retry (e.g. {mode:"terminal", scope:"turn", extra:true})
+				// rejected by dispatch must never hash as the valid turn input and
+				// advance the legitimate stored row (review thread P2).
+				for (const key of Object.keys(input)) if (key !== "mode" && key !== "scope") return;
+				const scopeInput = rawScope === "owned" ? "owned" : "turn";
+				const keyHash = crypto.createHash("sha256").update(String(request.idempotencyKey)).digest("hex");
+				const inputHash = crypto
+					.createHash("sha256")
+					.update(JSON.stringify({ mode: "terminal", scope: scopeInput }))
+					.digest("hex");
+				// Hash the ACTUAL written response payload: the durable state may only
+				// advance when the written response corresponds to the row's payload.
+				// When more than 256 concurrent requests evict an in-flight abort from
+				// the dispatch cache, a same-key retry can return pending_replay while
+				// the original is still terminalizing — matching only key+input would
+				// mark the original marker sent for the retry's uncertainty response,
+				// and the original's later stopped CAS would replace the payload hash
+				// without resetting the state, making durable replay claim the stopped
+				// payload was sent when only the pending response was written (review
+				// thread P2). A final non-pending row whose stored hash is the input
+				// placeholder (no_effect/uncertain) still advances: its own response is
+				// the only one written for it.
+				const responsePayloadHash =
+					response && typeof response === "object" && "result" in response
+						? crypto
+								.createHash("sha256")
+								.update(JSON.stringify((response as { result: unknown }).result))
+								.digest("hex")
+						: undefined;
+				// Require EXACT payload equality: finalization now stores the precise
+				// final response hash for every disposition (including uncertainty and
+				// no-effect), so a pending_replay retry whose payload differs can never
+				// mark the durable row sent (review thread P2).
+				const payloadMatches = (record: { responsePayloadHash?: string; replayPayloadHash?: string }) =>
+					responsePayloadHash !== undefined &&
+					(record.responsePayloadHash === responsePayloadHash || record.replayPayloadHash === responsePayloadHash);
+				await reconciliationStore.transactTerminalState(state => ({
+					scopes: state.scopes.map(record =>
+						record.idempotencyKeyHash === keyHash &&
+						record.idempotencyInputHash === inputHash &&
+						record.responseState === "pending" &&
+						payloadMatches(record)
+							? { ...record, responseState: outcome === "written" ? "sent" : "failed" }
+							: record,
+					),
+					keys: state.keys.map(record =>
+						record.keyHash === keyHash &&
+						record.inputHash === inputHash &&
+						record.responseState === "pending" &&
+						payloadMatches(record)
+							? { ...record, responseState: outcome === "written" ? "sent" : "failed" }
+							: record,
+					),
+				}));
+			},
 			installProviderDefinitions,
 			onProviderDefinitionsRemoved: removeProviderDefinitions,
 			afterControlResponse: async (_connectionId, request, response) => {
 				if (request.operation === "session.close" && response.ok === true) ctx.shutdown();
 			},
 		});
-		// The runtime host now owns the live event stream; point the surface's
-		// checkpoint watermark at the real generation/seq (C9).
-		eventWatermarkSource = () => ({
-			generation: runtime.host.events.generation,
-			seq: runtime.host.events.sequence,
-		});
 		const disposeGate = ctx.workflowGate?.onGateEmitted?.(gate =>
 			runtime.emitEvent({ kind: "workflow_gate", payload: gate }),
 		);
@@ -1617,6 +3000,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			revisions,
 			cursors,
 			reconciliation,
+			steerReconciliation,
+			deadlineManager,
 			pending,
 			registerBroker,
 			fenceGateResolutions: () => {
@@ -1643,6 +3028,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 					revisions,
 					cursors,
 					reconciliation,
+					steerReconciliation,
+					deadlineManager,
 					pending,
 					registerBroker,
 					fenceGateResolutions: () => {
@@ -1661,6 +3048,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 	const stopActive = async (): Promise<void> => {
 		const current = active;
 		if (!current) return;
+		current.deadlineManager.clearAll();
 		current.fenceGateResolutions();
 		try {
 			await current.waitForGateResolutionQuiescence();