@gajae-code/coding-agent 0.13.3 → 0.14.0

package/src/session/agent-session.ts

@@ -33,7 +33,9 @@ import {
 	assertImagePlaceholdersHavePayload,
 	type ContextMaintenanceResult,
 	canContinuePersistedHistory,
+	dispatchedToolIdentity,
 	getAgentTerminalOwnerContext,
+	isNonDispatchedToolEvent,
 	type ManagedAttemptContinuationOwnership,
 	type ManagedAttemptDecision,
 	type ManagedAttemptOutcome,
@@ -175,6 +177,7 @@ export interface ForkContextSeedOptions {
 	signal?: AbortSignal;
 }
 
+import type { AuthCredentialSelector } from "@gajae-code/ai/core";
 import type { MacOSPowerAssertion } from "@gajae-code/natives";
 import {
 	extractRetryHint,
@@ -186,9 +189,14 @@ import {
 	prompt,
 	Snowflake,
 } from "@gajae-code/utils";
-
 import { createAppendOnlyContextManager, resolveAppendOnlyMode } from "../append-only-mode";
-import { type AsyncJob, type AsyncJobDeliveryState, AsyncJobManager, type OwnerSubagentShutdownLease } from "../async";
+import {
+	type AsyncJob,
+	type AsyncJobDeliveryState,
+	AsyncJobManager,
+	asyncJobEndpointId as deriveAsyncJobEndpointId,
+	type OwnerSubagentShutdownLease,
+} from "../async";
 import { reset as resetCapabilities } from "../capability";
 import type { Rule } from "../capability/rule";
 import type { CasReceipt } from "../config/atomic-yaml-patch";
@@ -224,6 +232,7 @@ import type { Settings, SkillsSettings } from "../config/settings";
 import { onAppendOnlyModeChanged } from "../config/settings";
 import type { SettingPath } from "../config/settings-schema";
 import { getDefault } from "../config/settings-schema";
+import { resolveEagerTaskDelegation } from "../config/task-delegation";
 import { RawSseDebugBuffer } from "../debug/raw-sse-buffer";
 import { loadCapability } from "../discovery";
 import { expandApplyPatchToEntries, normalizeDiff, normalizeToLF, ParseError, previewPatch, stripBom } from "../edit";
@@ -294,16 +303,23 @@ import {
 	sessionStateDir,
 } from "../gjc-runtime/session-layout";
 import {
+	type CoordinatorToolObservation,
 	ownerTerminalContextFromEnvironment,
 	persistCoordinatorRuntimeStateFromEvent,
 	registerCoordinatorRuntimeStateFinalizer,
+	UNPROVEN_TOOL_LABEL,
 } from "../gjc-runtime/session-state-sidecar";
 import { requestGjcWorkerIntegrationAttempt } from "../gjc-runtime/team-runtime";
 import { GjcTeamWorkerHeartbeatReporter } from "../gjc-runtime/team-worker-heartbeat";
 import { GoalRuntime } from "../goals/runtime";
 import type { Goal, GoalModeState } from "../goals/state";
 import type { HindsightSessionState } from "../hindsight/state";
-import { buildSkillStopOutput, ensureWorkflowSkillActivationState } from "../hooks/skill-state";
+import {
+	buildSkillStopOutput,
+	ensureWorkflowSkillActivationSeed,
+	ensureWorkflowSkillActivationState,
+	type WorkflowSkillActivationSeed,
+} from "../hooks/skill-state";
 import { initializeLocalRoot, type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { shutdownAll as shutdownAllLspClients } from "../lsp/client";
 import { resolveMemoryBackendId } from "../memory-backend/resolve";
@@ -410,6 +426,7 @@ import {
 	type ContributionPrepResult,
 	prepareContributionPrep,
 } from "./contribution-prep";
+import { canonicalCoordinatorToolLabel } from "./coordinator-tool-label";
 import { pruneStaleFileMentions } from "./file-mention-pruning";
 import type { MemoryGuardRestoreResult } from "./memory-guard-checkpoint-participant";
 import {
@@ -448,9 +465,22 @@ import {
 	SessionAppendPersistenceError,
 	SessionContextTooLargeError,
 	SessionManager,
+	SessionNearLimitAppendError,
 	transferSessionMessageIdentity,
 } from "./session-manager";
 import { getEntriesForInternalRead, getSessionContextForInternalRead } from "./session-manager-internal";
+import {
+	bindToolLineage,
+	classifyOwnedEnvelope,
+	isOwnedCompletionEnvelope,
+	lookupTerminalScope,
+	mintTurnLineageIdHash,
+	type OwnedCompletionEnvelope,
+	registerTerminalTurnScope,
+	retireOwnedRegistrationsForEndpoint,
+	settleToolLineageRegistrationWindow,
+	unregisterOwnedRegistration,
+} from "./terminal-abort";
 
 import { ToolChoiceQueue } from "./tool-choice-queue";
 import { pruneSupersededMaintenanceReminders, pruneSupersededVolatileProjectContext } from "./volatile-context-pruning";
@@ -479,6 +509,37 @@ function appendCompactionStateContext(summary: string, stateContext: string[]):
 	if (stateContext.length === 0) return summary;
 	return `${summary}\n\n<compaction-state>\n${stateContext.join("\n")}\n</compaction-state>`;
 }
+/**
+ * Classify an async-result delivery against terminal-abort ownership:
+ * - "ordinary": no owned-completion envelope — deliver as before.
+ * - "fresh": an exact registered owned-completion the owning scope's gate
+ *   authorizes as a fresh-turn resume (scope:"turn", policy enabled).
+ * - "drop": a recognized owned-completion the gate denies — scope:"owned"
+ *   (policy disabled, stopped work must never call followUp/prompt), a
+ *   forged/unregistered tuple, or an envelope whose terminal scope no longer
+ *   exists. Dropped entries never reach the agent (AC 36 zero final calls
+ *   from stopped work), even if a delivery races the settlement purge.
+ */
+export function ownedCompletionResumeAction(message: AgentMessage): "ordinary" | "fresh" | "drop" {
+	const details = (message as { details?: { ownedCompletions?: unknown } }).details;
+	const envelopes = details?.ownedCompletions;
+	// Extension-provided details are untrusted: the field must be an array of
+	// structurally valid internal envelopes, or it is ignored entirely —
+	// malformed metadata must never crash idle triggerTurn delivery or the
+	// agent loop (review thread P2).
+	if (!Array.isArray(envelopes) || envelopes.length === 0) return "ordinary";
+	// Three states per envelope: no terminal scope (no abort) is ORDINARY,
+	// turn-scope enabled is FRESH, owned-scope disabled is DROP. ANY drop in a
+	// mixed batch drops the whole delivery (defense in depth).
+	let anyFresh = false;
+	for (const envelope of envelopes) {
+		if (!isOwnedCompletionEnvelope(envelope)) continue;
+		const action = classifyOwnedEnvelope(envelope);
+		if (action === "drop") return "drop";
+		if (action === "fresh") anyFresh = true;
+	}
+	return anyFresh ? "fresh" : "ordinary";
+}
 
 const PRUNED_ARTIFACT_REF_MAX_CHARS = 64;
 
@@ -571,6 +632,9 @@ export interface AgentSessionConfig {
 	agent: Agent;
 	sessionManager: SessionManager;
 	settings: Settings;
+	/** The session's REQUESTED effective agent directory, independent of the
+	 * global Settings singleton (which may be reused across sessions). */
+	agentDir?: string;
 	/** Lazy memory backend service; omitted callers receive a session-local default. */
 	memoryBackend?: LazyService<MemoryBackend>;
 	/** Lazy workspace-tree service; omitted callers retain the legacy direct-scan path. */
@@ -614,6 +678,12 @@ export interface AgentSessionConfig {
 	workflowGatePublication?: "endpoint" | "local";
 	/** Tool registry for LSP and settings */
 	toolRegistry?: Map<string, AgentTool>;
+	/**
+	 * Tool objects this session's builder constructed from built-in descriptors, captured
+	 * before any extension, MCP, or dynamically registered tool could claim their registry
+	 * names. Absent means no provenance was proven and every tool reports as `custom`.
+	 */
+	builtinToolIdentities?: ReadonlySet<object>;
 	/** Tool-session factory context used to lazily attach workflow-gate-only tools. */
 	workflowGateToolSession?: ToolSession;
 	/** Current session pre-LLM message transform pipeline */
@@ -695,6 +765,8 @@ export interface AgentSessionConfig {
 	 * **MUST NOT** dispose it on their own teardown.
 	 */
 	ownedAsyncJobManager?: AsyncJobManager;
+	/** False when a child borrows its parent's manager and must not dispose it. */
+	disposeAsyncJobManager?: boolean;
 	/** Cheap TUI retained-memory counters; absent for headless sessions. */
 	retainedMemorySampler?: () => RetainedMemorySample;
 	/**
@@ -723,8 +795,12 @@ export interface AgentSessionConfig {
 	providerSessionId?: string;
 	/** Optional auth-selection identity, distinct from logical/canonical and provider-cache identity. */
 	credentialSessionId?: string;
+	/** Opaque credential-store authority fingerprint for durable numeric session pins. */
+	credentialStoreIdentity?: string;
 	/** Optional provider-facing cache identity, distinct from logical session identity. */
 	providerCacheSessionId?: string;
+	/** Explicit provider affinity whose persisted transcript path scopes async ownership. */
+	asyncJobProviderSessionId?: string;
 }
 
 export interface AgentSessionMemoryGuardRestoreInput
@@ -802,6 +878,8 @@ export interface PromptOptions {
 	onPreflightAcceptCommit?: () => void | Promise<void>;
 	/** Skill-only: prepared metadata before the durable fence (path/lineCount/cleanedArgs). */
 	onSkillPrepared?: (meta: { name: string; path: string; lineCount?: number; cleanedArgs?: string }) => void;
+	/** Optional invocation-scoped cancellation fence used before an accepted skill starts execution. */
+	preflightSignal?: AbortSignal;
 }
 
 function promptPreflightCancelledError(): Error {
@@ -809,6 +887,18 @@ function promptPreflightCancelledError(): Error {
 	error.name = "PromptPreflightCancelledError";
 	return error;
 }
+async function awaitPromptInvocationPreflight<T>(pending: Promise<T>, signal?: AbortSignal): Promise<T> {
+	if (!signal) return await pending;
+	if (signal.aborted) throw promptPreflightCancelledError();
+	const cancellation = Promise.withResolvers<never>();
+	const cancel = () => cancellation.reject(promptPreflightCancelledError());
+	signal.addEventListener("abort", cancel, { once: true });
+	try {
+		return await Promise.race([pending, cancellation.promise]);
+	} finally {
+		signal.removeEventListener("abort", cancel);
+	}
+}
 
 function isPromptPreflightCancelledError(error: unknown): boolean {
 	return error instanceof Error && error.name === "PromptPreflightCancelledError";
@@ -950,17 +1040,12 @@ type RetryErrorClassification =
 	| "empty_response"
 	| "transient"
 	| "local_unavailable"
+	| "local_snapshot"
+	| "local_buffer_overflow"
 	| "unknown";
 
 const BARE_DEFAULT_WATCHDOG_ERROR =
 	/^(?:[A-Za-z][A-Za-z0-9-]*(?: [A-Za-z][A-Za-z0-9-]*){0,3} )stream (?:timed out while waiting for the first event|stalled while waiting for the next event)$/;
-/**
- * Consecutive same-model retries allowed for `escaped_arguments_discarded`
- * managed outcomes before the run terminates. Mirrors the agent loop's
- * escaped-non-ASCII resample budget on dev; enforced session-side here because
- * a managed retry re-enters the loop as a fresh run.
- */
-const MAX_ESCAPED_ARGUMENT_RETRIES = 2;
 const PROVIDER_FIRST_EVENT_TIMEOUT_ERROR = "Provider stream timed out while waiting for the first event";
 const WRAPPED_PROVIDER_FIRST_EVENT_TIMEOUT_ERROR = `Error: ${PROVIDER_FIRST_EVENT_TIMEOUT_ERROR}`;
 const PROVIDER_FIRST_EVENT_TIMEOUT_WITHOUT_ARTICLE_ERROR = "Provider stream timed out while waiting for first event";
@@ -1047,7 +1132,12 @@ function assistantMessageHasVisibleOrToolContent(message: AssistantMessage): boo
 
 function isLocalModelEndpoint(model: Model | undefined): boolean {
 	if (!model) return false;
-	if (model.provider === "ollama" || model.provider === "lm-studio" || model.provider === "llama.cpp") {
+	if (
+		model.provider === "ollama" ||
+		model.provider === "lm-studio" ||
+		model.provider === "llama.cpp" ||
+		model.provider === "omlx"
+	) {
 		return true;
 	}
 	try {
@@ -1511,6 +1601,7 @@ function extractPermissionLocations(
  *  stable edit id while the display arrays preserve delivery order. */
 type QueuedDisplayEntry = { text: string; tag?: string; sequence: number };
 type IrcRosterClaim = { token: symbol; signature: string; epoch: number; message: CustomMessage };
+type QueuedFollowUpOwner = { cancel(): boolean };
 export type QueuedMessageEditMode = "steer" | "followUp";
 
 export interface QueuedMessageEditEntry {
@@ -1801,12 +1892,19 @@ type SessionAdmissionEntry = {
 	ready: PromiseWithResolvers<void>;
 	settled: PromiseWithResolvers<void>;
 	released: boolean;
+	selectionFenceGeneration: number;
+	continuationCapability?: symbol;
 };
 
 type SessionAdmissionLease = {
 	release(): void;
 };
 
+type ScheduledContinuationAdmission = {
+	entry: SessionAdmissionEntry;
+	capability: symbol;
+};
+
 export interface DefaultFallbackRuntimeState {
 	chain: ConfiguredFallbackChain;
 	controller: FallbackChainRuntimeState;
@@ -1838,10 +1936,37 @@ function deobfuscateSessionContext(context: SessionContext, obfuscator: SecretOb
 	return { ...context, messages };
 }
 
+/**
+ * Canonical message_end admission slot. A reservation whose slot is already
+ * `released` needs no await at the canonical append site, so an uncontended
+ * admission never costs a microtask and external emitters keep synchronous
+ * visibility of the persisted append.
+ */
+interface CanonicalMessageAdmissionSlot {
+	promise: Promise<void>;
+	released: boolean;
+}
+
+interface CanonicalMessageAdmission {
+	predecessor: CanonicalMessageAdmissionSlot;
+	release: () => void;
+}
+
 export class AgentSession {
+	#provisionalStreamingToolCallIds = new Set<string>();
 	readonly agent: Agent;
 	sessionManager: SessionManager;
 	readonly settings: Settings;
+	readonly #requestedAgentDir: string | undefined;
+
+	/**
+	 * The session's effective agent directory: its REQUESTED directory when
+	 * provided, else the global Settings singleton's (which may be reused
+	 * across sessions and therefore not the requesting session's own).
+	 */
+	getSessionAgentDir(): string {
+		return this.#requestedAgentDir ?? this.settings.getAgentDir();
+	}
 	readonly memoryBackend: LazyService<MemoryBackend>;
 	readonly notificationSessionController: NotificationSessionController | undefined;
 	readonly taskDepth: number;
@@ -1866,8 +1991,20 @@ export class AgentSession {
 	#preProfileModel: Model | undefined;
 	#sessionAdmissionQueue: SessionAdmissionEntry[] = [];
 	#activeSessionAdmission: SessionAdmissionEntry | undefined;
+	#sessionAdmissionClosing = false;
 	#sessionAdmissionClosed = false;
 	#sessionAdmissionContext = new AsyncLocalStorage<SessionAdmissionEntry>();
+	#selectionFenceGenerationContext = new AsyncLocalStorage<number>();
+	#selectionFenceTail: Promise<void> = Promise.resolve();
+	#pendingSelectionFences = 0;
+	#selectionFenceDeferredContinuations = new Map<number, number>();
+	#scopedSettlementWaiters = new Set<() => void>();
+	#oldestPendingSelectionFenceGeneration = 0;
+	#followUpReservationEpoch = 0;
+	/** Epochs of follow-up reservations still between reservation and durable enqueue. */
+	#activeFollowUpReservationEpochs = new Set<number>();
+	#followUpReservationDrainWaiters = new Set<() => void>();
+	#selectionFenceGeneration = 0;
 	#defaultModelSelectionMutationRevision = 0;
 	#thinkingLevelMutationRevision = 0;
 	#thinkingVisibilityMutationRevision = 0;
@@ -1937,9 +2074,62 @@ export class AgentSession {
 	/** Tracks pending follow-up messages for UI display. Removed when delivered.
 	 *  See `#steeringMessages` for entry shape. */
 	#followUpMessages: QueuedDisplayEntry[] = [];
+	/** User/SDK-requested next turns, distinct from aborted-turn continuations. */
+	readonly #externalFollowUps = new WeakSet<AgentMessage>();
+	// SDK requester-ownership correlation per queued follow-up message: the hook
+	// fires when the message is actually DEQUEUED into a run (onFollowUpConsumed),
+	// not when an independently scheduled continuation is accepted — a skipped
+	// continuation must never discard the correlation of work that is still
+	// consumed (review thread P2).
+	readonly #followUpPromotionHooks = new Map<AgentMessage, () => void>();
+	/** SDK-owned follow-ups held outside Agent's live queue until the active run ends. */
+	#deferredSdkFollowUps: AgentMessage[] = [];
+	// Client/SDK steering (turn.prompt diverted to steer while streaming, or an
+	// explicit turn.steer) is an independent root-turn request ONLY when it is
+	// admitted AFTER the terminal abort snapshot: a terminal abort admitted
+	// earlier must never purge it, or the acknowledged submission would never
+	// run and its reconciliation record would stay accepted indefinitely —
+	// while a steer admitted BEFORE the abort is an accepted-pre-close
+	// continuation of the aborted attempt that the contract requires to be
+	// blocked (review thread P1).
+	readonly #externalSteerMessages = new WeakSet<AgentMessage>();
+	/** Per-message SDK requester-ownership correlation for queued client steers:
+	 *  fired exactly once when the steer's run accepts it — via the idle
+	 *  auto-continue or the terminal-abort rearm (review thread P1). */
+	readonly #steerPromotionHooks = new WeakMap<AgentMessage, () => void>();
+	/** Monotonic steering admission sequence; the terminal abort snapshots it. */
+	#steeringAdmissionSeq = 0;
+	readonly #externalSteerAdmissionSeq = new WeakMap<AgentMessage, number>();
+	/**
+	 * Per-admission terminal-abort steering snapshots, FIFO per aborted turn
+	 * key (lineage:epoch). Each admission pushes { sequence, token } here; the
+	 * settlement of THAT admission consumes (shifts) it, so overlapping aborts
+	 * of the same turn never overwrite an earlier admission's snapshot (review
+	 * thread P1). A replay-only abort discards its own token — the durable
+	 * replay path never settles, so without the discard a later real abort
+	 * would consume the stale entry and treat steering admitted since the
+	 * replay as post-abort (review thread P1).
+	 */
+	readonly #terminalAbortSteeringSnapshots = new Map<string, Array<{ seq: number; token: number }>>();
+	readonly #terminalAbortSteeringSnapshotKeys = new Map<number, string>();
+	#terminalAbortAdmissionSeq = 0;
 	#queuedDisplaySequence = 0;
+	#fireQueuedPromotionHooks(messages: readonly AgentMessage[]): void {
+		for (const message of messages) {
+			const steerHook = this.#steerPromotionHooks.get(message);
+			if (steerHook) {
+				this.#steerPromotionHooks.delete(message);
+				steerHook();
+			}
+			const followUpHook = this.#followUpPromotionHooks.get(message);
+			if (followUpHook) {
+				this.#followUpPromotionHooks.delete(message);
+				followUpHook();
+			}
+		}
+	}
 	/** Messages queued to be included with the next user prompt as context ("asides"). */
-	#pendingNextTurnMessages: CustomMessage[] = [];
+	#pendingNextTurnMessages: Array<{ message: CustomMessage; origin: "turn" | "external" }> = [];
 	#scheduledHiddenNextTurnGeneration: number | undefined = undefined;
 	#planModeState: PlanModeState | undefined;
 	#goalModeState: GoalModeState | undefined;
@@ -1996,6 +2186,7 @@ export class AgentSession {
 		this.#retryReplayEpoch++;
 		this.#retryReplayUnsafeEpoch = undefined;
 		this.#firstEventTimeoutRetryStartedAt = Date.now();
+		this.#providerRetryMaxAttempts = undefined;
 	}
 
 	#markRetryReplayUnsafe(): void {
@@ -2033,11 +2224,11 @@ export class AgentSession {
 	#retryAbortController: AbortController | undefined = undefined;
 	#retryNowRequested = false;
 	#firstEventTimeoutRetryStartedAt: number | undefined;
+	#providerRetryMaxAttempts: number | undefined;
 	#retryAttempt = 0;
 	#retryPromise: Promise<void> | undefined = undefined;
 	#retryResolve: (() => void) | undefined = undefined;
 	#defaultFallbackController: FallbackChainController | undefined;
-	#consecutiveEscapedArgumentRetries = 0;
 	#overflowMaintenanceAttempts = 0;
 	#defaultFallbackExhaustedLastTurn = false;
 	#fallbackInvocationId = 0;
@@ -2077,6 +2268,7 @@ export class AgentSession {
 	 * this undefined and **MUST NOT** dispose the global instance on teardown.
 	 */
 	readonly #ownedAsyncJobManager: AsyncJobManager | undefined;
+	readonly #disposeAsyncJobManager: boolean;
 	readonly #ownedMcpManager: MCPManager | undefined;
 	#startupTurnBarrier: Promise<void> | undefined;
 	#pendingPythonMessages: Array<{
@@ -2099,7 +2291,9 @@ export class AgentSession {
 	#ircRosterClaim: IrcRosterClaim | null = null;
 	#providerSessionId: string | undefined;
 	#credentialSessionId: string | undefined;
+	#credentialStoreIdentity: string | undefined;
 	#providerCacheSessionId: string | undefined;
+	readonly #asyncJobProviderSessionId: string | undefined;
 	#isDisposed = false;
 	#disposePromise: Promise<void> | undefined;
 	readonly #toolSessionCleanups = new Set<() => Promise<void> | void>();
@@ -2108,6 +2302,9 @@ export class AgentSession {
 	#newSessionTransition: Promise<boolean> | undefined;
 	// Extension system
 	#extensionRunner: ExtensionRunner | undefined = undefined;
+	/** SDK follow-up ownership by queued message and the attempt that dequeues it. */
+	#sdkRunTokensByQueuedMessage = new WeakMap<AgentMessage, string>();
+	#sdkRunTokensByAttemptScope = new WeakMap<AttemptScope, string>();
 	#attemptAuthority!: AttemptScopeAuthority;
 	#attemptRecordStore!: AttemptRecordStore;
 	#activeLogicalRunId: AttemptRunHandle["logicalRunId"] | undefined;
@@ -2145,6 +2342,17 @@ export class AgentSession {
 
 	// Tool registry and prompt builder for extensions
 	#toolRegistry: Map<string, AgentTool>;
+	/**
+	 * Session-owned provenance for tool OBJECTS built from a built-in descriptor.
+	 *
+	 * Copy-owned so this session can extend it with built-ins it creates or refreshes
+	 * later (the execution guard wrapper, an SSH reload, the lazily attached workflow-gate
+	 * `ask`) without mutating the builder's set. Weak because it holds no opinion about a
+	 * tool's lifetime: an object that is no longer reachable can never be dispatched
+	 * again. Custom, MCP, and dynamically registered tools never enter it, so a name
+	 * collision cannot inherit a built-in's label.
+	 */
+	#builtinToolIdentities: WeakSet<object>;
 	#workflowGateToolSession: ToolSession | undefined;
 	#transformContext: (
 		messages: AgentMessage[],
@@ -2242,6 +2450,7 @@ export class AgentSession {
 	/** Test-only abort outcome override for cancel-and-submit rollback coverage. */
 	#cancelAndSubmitAbortOutcomeProviderForTests: (() => Promise<AbortOutcome>) | undefined = undefined;
 	#postPromptTasks = new Set<Promise<void>>();
+	#postPromptTaskSelectionFenceGenerations = new Map<Promise<void>, number>();
 	#postPromptTasksPromise: Promise<void> | undefined = undefined;
 	#postPromptTasksResolve: (() => void) | undefined = undefined;
 	#postPromptTasksAbortController = new AbortController();
@@ -2305,8 +2514,18 @@ export class AgentSession {
 
 	#pendingRewindReport: string | undefined = undefined;
 	#lastSuccessfulYieldToolCallId: string | undefined = undefined;
+	// Private terminal-abort machinery (C04 mode:"terminal"). The lineage id is
+	// minted per prompt turn before the model runs; tool-call bindings attach
+	// the attempt epoch so background registrations can later be classified as
+	// exact owned work (turn-continuation vs owned-completion) by source, never
+	// by timing. Endpoint generation is 0 for local/non-SDK sessions and is
+	// bound by the SDK host layer when a terminal endpoint is known.
+	#terminalEndpointGeneration = 0;
+	#turnLineageIdHash: string | undefined;
+	#terminalLineageSecret = crypto.randomUUID();
 	#promptGeneration = 0;
 	#promptPreflightAbortController = new AbortController();
+	#promptPreflightCancellationGeneration = 0;
 
 	#providerSessionState = new Map<string, ProviderSessionState>();
 	#temporaryProviderSessionScopes: TemporaryProviderSessionScopeRecord[] = [];
@@ -2372,6 +2591,12 @@ export class AgentSession {
 		});
 	}
 
+	#assertSessionAdmissionOpen(): void {
+		if (this.#sessionAdmissionClosing || this.#sessionAdmissionClosed || this.#isDisposed) {
+			throw this.#sessionAdmissionBusyError();
+		}
+	}
+
 	/**
 	 * Reject a turn start while a handoff transition owns the session. Handoff never
 	 * routes its own generation/injection through these turn-start chokepoints, and
@@ -2420,6 +2645,18 @@ export class AgentSession {
 		next.ready.resolve();
 	}
 
+	#captureScheduledContinuationAdmission(): ScheduledContinuationAdmission | undefined {
+		const entry = this.#sessionAdmissionContext.getStore();
+		if (
+			entry?.kind !== "prompt" ||
+			entry.released ||
+			this.#activeSessionAdmission !== entry ||
+			entry.continuationCapability === undefined
+		)
+			return undefined;
+		return { entry, capability: entry.continuationCapability };
+	}
+
 	async #awaitStartupTurnBarrier(): Promise<void> {
 		const barrier = this.#startupTurnBarrier;
 		if (!barrier) return;
@@ -2435,11 +2672,43 @@ export class AgentSession {
 	async #withSessionAdmission<T>(
 		kind: SessionAdmissionKind,
 		body: (lease: SessionAdmissionLease) => Promise<T>,
+		signal?: AbortSignal,
+		continuationAdmission?: ScheduledContinuationAdmission,
+		options?: {
+			allowDuringClosing?: boolean;
+			bypassSelectionFenceGeneration?: number;
+			allowPromptContinuationReentry?: boolean;
+		},
 	): Promise<T> {
-		if (kind === "prompt") await this.#awaitStartupTurnBarrier();
 		const owner = this.#sessionAdmissionContext.getStore();
-		if (owner && !owner.released) throw this.#sessionAdmissionBusyError();
-		if (this.#sessionAdmissionClosed || this.#isDisposed) throw this.#sessionAdmissionBusyError();
+		if (owner && !owner.released) {
+			if (
+				continuationAdmission?.entry === owner &&
+				continuationAdmission.capability === owner.continuationCapability
+			)
+				return await body({ release: () => {} });
+			if (options?.allowPromptContinuationReentry === true && owner.kind === "prompt") {
+				return await body({ release: () => {} });
+			}
+			throw this.#sessionAdmissionBusyError();
+		}
+		if (kind === "prompt") await awaitPromptInvocationPreflight(this.#awaitStartupTurnBarrier(), signal);
+		const bypassesSelectionFence =
+			options?.bypassSelectionFenceGeneration !== undefined &&
+			options.bypassSelectionFenceGeneration < this.#selectionFenceGeneration;
+		if (
+			kind === "prompt" &&
+			continuationAdmission === undefined &&
+			!bypassesSelectionFence &&
+			this.#pendingSelectionFences > 0
+		) {
+			await awaitPromptInvocationPreflight(this.#selectionFenceTail, signal);
+		}
+		if (
+			this.#sessionAdmissionClosed ||
+			((this.#sessionAdmissionClosing || this.#isDisposed) && options?.allowDuringClosing !== true)
+		)
+			throw this.#sessionAdmissionBusyError();
 		// Reject new external turns for the whole handoff transition. The handoff
 		// itself never acquires prompt admission (it generates via generateHandoff and
 		// injects via appendCustomMessageEntry), so this fences external entrants —
@@ -2456,11 +2725,30 @@ export class AgentSession {
 			ready: Promise.withResolvers<void>(),
 			settled: Promise.withResolvers<void>(),
 			released: false,
+			selectionFenceGeneration: this.#selectionFenceGeneration,
+			...(kind === "prompt" ? { continuationCapability: Symbol("scheduled-continuation") } : {}),
+		};
+		const releaseEntry = () => {
+			if (entry.released) return;
+			entry.released = true;
+			entry.settled.resolve();
+			const queuedIndex = this.#sessionAdmissionQueue.indexOf(entry);
+			if (queuedIndex >= 0) this.#sessionAdmissionQueue.splice(queuedIndex, 1);
+			if (this.#activeSessionAdmission === entry) this.#activeSessionAdmission = undefined;
+			this.#activateNextSessionAdmission();
 		};
 		this.#sessionAdmissionQueue.push(entry);
 		this.#activateNextSessionAdmission();
-		await entry.ready.promise;
-		if (this.#sessionAdmissionClosed || this.#isDisposed) {
+		try {
+			await awaitPromptInvocationPreflight(entry.ready.promise, signal);
+		} catch (error) {
+			releaseEntry();
+			throw error;
+		}
+		if (
+			this.#sessionAdmissionClosed ||
+			((this.#sessionAdmissionClosing || this.#isDisposed) && options?.allowDuringClosing !== true)
+		) {
 			entry.released = true;
 			entry.settled.resolve();
 			if (this.#activeSessionAdmission === entry) this.#activeSessionAdmission = undefined;
@@ -2480,11 +2768,7 @@ export class AgentSession {
 		}
 
 		const release = () => {
-			if (entry.released) return;
-			entry.released = true;
-			entry.settled.resolve();
-			if (this.#activeSessionAdmission === entry) this.#activeSessionAdmission = undefined;
-			this.#activateNextSessionAdmission();
+			releaseEntry();
 		};
 		try {
 			return await this.#sessionAdmissionContext.run(entry, () => body({ release }));
@@ -2494,19 +2778,22 @@ export class AgentSession {
 	}
 
 	async #closeSessionAdmission(): Promise<void> {
-		this.#sessionAdmissionClosed = true;
-		const queued = this.#sessionAdmissionQueue.splice(0);
-		for (const entry of queued) {
-			entry.released = true;
-			entry.ready.reject(this.#sessionAdmissionBusyError());
-			entry.settled.resolve();
-		}
+		this.#sessionAdmissionClosing = true;
 		const active = this.#activeSessionAdmission;
 		if (active?.kind === "prompt") {
 			this.#promptGeneration++;
+			this.#promptPreflightCancellationGeneration++;
 			this.#promptPreflightAbortController.abort();
 		}
 		if (active) await active.settled.promise;
+		await this.#selectionFenceTail;
+		this.#sessionAdmissionClosed = true;
+		const queued = this.#sessionAdmissionQueue.splice(0);
+		for (const entry of queued) {
+			entry.released = true;
+			entry.ready.resolve();
+			entry.settled.resolve();
+		}
 	}
 
 	#beginInFlight(): void {
@@ -2517,6 +2804,50 @@ export class AgentSession {
 			// in #refreshTeamWorkerHeartbeat(), including internally dispatched turns.
 		}
 	}
+	/**
+	 * Allocate a FRESH prompt attempt/lineage for an allowed owned-completion
+	 * delivery (corrected turn semantics). The new turn gets a new attempt epoch
+	 * and an opaque lineage id; it never reuses the aborted attempt's epoch and
+	 * is not a retry/TTSR/steering/successor of the aborted turn. The caller
+	 * then invokes the existing followUp/prompt path.
+	 */
+	#resumeFromOwnedCompletion(): void {
+		// Allocate the fresh epoch from the SESSION prompt epoch, not the
+		// module-global counter (root admissions never advance it, so after a
+		// normal root prompt at epoch N the counter could still be <= N and mint
+		// the SAME lineage as the aborted turn — review thread P1). A
+		// session-relative +1 is always distinct from the current turn's epoch.
+		const freshEpoch = this.#promptGeneration + 1;
+		this.#promptGeneration = freshEpoch;
+		this.#turnLineageIdHash = mintTurnLineageIdHash(
+			this.sessionManager.getSessionId?.() ?? "local",
+			freshEpoch,
+			this.#terminalLineageSecret,
+		);
+	}
+	/**
+	 * Whether a same-turn continuation of the current turn is blocked by a
+	 * terminal-abort fence. Fails open (false) when no terminal scope exists for
+	 * the current lineage+epoch, so ordinary sessions never consult a gate.
+	 * Post-close continuations (retry/TTSR/steering/hidden-next-turn/
+	 * maintenance/worker successor) are denied at the final synchronous boundary
+	 * before method entry; a continuation already linearized as a predecessor
+	 * before close stays allowed to finish.
+	 */
+	#isTurnContinuationBlocked(): boolean {
+		const lineageIdHash = this.#turnLineageIdHash;
+		if (!lineageIdHash) return false;
+		const scope = lookupTerminalScope(lineageIdHash, this.#promptGeneration);
+		if (!scope) return false;
+		return (
+			scope.gate.authorizeContinuation({
+				kind: "turn-continuation",
+				lineageIdHash,
+				attemptEpoch: this.#promptGeneration,
+				continuationId: crypto.randomUUID(),
+			}) === "deny"
+		);
+	}
 
 	#isPromptPreflightCancelled(generation: number, signal: AbortSignal): boolean {
 		return signal.aborted || this.#promptGeneration !== generation;
@@ -2550,6 +2881,17 @@ export class AgentSession {
 		return hold;
 	}
 
+	#restoreAndReserveDeferredAgentEndForContinuation(pending: AgentSessionEvent | undefined): symbol | undefined {
+		if (!pending) return undefined;
+		if (this.#pendingAgentEndEmit && this.#pendingAgentEndEmit !== pending) {
+			throw new Error("Cannot restore a deferred agent_end over a different pending terminal event");
+		}
+		this.#pendingAgentEndEmit = pending;
+		const hold = Symbol("deferred-agent-end-continuation");
+		this.#pendingAgentEndContinuationHolds.set(hold, pending);
+		return hold;
+	}
+
 	#claimDeferredAgentEndForContinuation(hold: symbol | undefined): AgentSessionEvent | undefined {
 		if (!hold) return undefined;
 		const pending = this.#pendingAgentEndContinuationHolds.get(hold);
@@ -2607,33 +2949,159 @@ export class AgentSession {
 		}
 		lease.closeDiscovery();
 	}
+	/**
+	 * Keep a continuation parked behind a pending selection fence observable to
+	 * external idle waits. The deferral window is bounded: it ends when the
+	 * deferred invocation synchronously re-reserves its settlement markers
+	 * inside the scheduler (`#endSelectionFenceDeferralTracking`); the
+	 * promise-settled release is only the safety net for a deferral whose
+	 * re-entry never ran (disposed/aborted session).
+	 *
+	 * The counter is keyed by the fence generation it parks behind. The
+	 * selection that owns that fence must not wait on its own parked
+	 * continuations: its mid-selection `waitForIdle` is exactly what lets an
+	 * inherited continuation settle before the durable mutation, and waiting on
+	 * a continuation parked behind the fence the selection itself holds would
+	 * reintroduce the selection self-deadlock (#4519).
+	 */
+	#trackSelectionFenceDeferredContinuation(fenceGeneration: number, deferred: Promise<void>): void {
+		this.#selectionFenceDeferredContinuations.set(
+			fenceGeneration,
+			(this.#selectionFenceDeferredContinuations.get(fenceGeneration) ?? 0) + 1,
+		);
+		void deferred
+			.catch(() => {})
+			.finally(() => {
+				this.#endSelectionFenceDeferralTracking(fenceGeneration);
+			});
+	}
+
+	/**
+	 * End the deferral-limbo tracking window: called synchronously by the
+	 * deferred scheduling path once it has re-reserved its own settlement
+	 * markers (the predecessor hold and post-prompt task), so the counter no
+	 * longer covers the continuation's own execution.
+	 */
+	#endSelectionFenceDeferralTracking(fenceGeneration: number): void {
+		const pending = this.#selectionFenceDeferredContinuations.get(fenceGeneration) ?? 0;
+		if (pending <= 0) return;
+		if (pending === 1) this.#selectionFenceDeferredContinuations.delete(fenceGeneration);
+		else this.#selectionFenceDeferredContinuations.set(fenceGeneration, pending - 1);
+		this.#resolveSessionSettlement();
+	}
+
+	/**
+	 * Continuations parked behind selection fences that idle waits must observe.
+	 *
+	 * Only deferrals whose fence has already settled are counted: their
+	 * deferred scheduling tail is (re-)entering within microtask time and the
+	 * session is not idle until it does. A deferral behind a still-pending
+	 * fence is invisible by construction — the fence owner's own completion may
+	 * causally depend on the very settlement the waiter would block on, so
+	 * counting it would reintroduce the selection self-deadlock (#4519). It
+	 * becomes observable the moment its fence settles, and either the
+	 * synchronous re-entry (`#endSelectionFenceDeferralTracking`) or the
+	 * promise-settled safety net clears it.
+	 */
+	#pendingSelectionFenceDeferredContinuations(ignoreGenerationFrom?: number): number {
+		let total = 0;
+		for (const [generation, count] of this.#selectionFenceDeferredContinuations) {
+			if (ignoreGenerationFrom !== undefined && generation >= ignoreGenerationFrom) continue;
+			total += count;
+		}
+		return total;
+	}
+
+	/**
+	 * Deferral generations that causally-upstream settlement work must ignore:
+	 * a deferral parked behind a still-pending selection fence cannot settle
+	 * before that fence resolves, and the fence owner's completion may itself
+	 * depend on this very settlement. Returns the oldest still-pending fence
+	 * generation, or undefined when no fence is pending.
+	 */
+	#turnSettlementDeferralFloor(): number | undefined {
+		return this.#pendingSelectionFences > 0 ? this.#oldestPendingSelectionFenceGeneration : undefined;
+	}
 
-	#isSessionSettlementPending(): boolean {
+	/**
+	 * Wait until every follow-up reservation minted before `ownEpoch` has been
+	 * released, so a later dispatch can never durably enqueue ahead of an
+	 * earlier reserved follow-up. Resolves immediately when no earlier
+	 * reservation remains.
+	 */
+	async #waitForEarlierFollowUpReservations(
+		ownEpoch: number,
+		requesterSignal?: AbortSignal,
+		admissionSignal?: AbortSignal,
+	): Promise<void> {
+		while ([...this.#activeFollowUpReservationEpochs].some(epoch => epoch < ownEpoch)) {
+			if (requesterSignal?.aborted || admissionSignal?.aborted) throw promptPreflightCancelledError();
+			const drained = Promise.withResolvers<void>();
+			this.#followUpReservationDrainWaiters.add(drained.resolve);
+			await drained.promise;
+		}
+	}
+
+	#isSessionSettlementPending(ignoreSelectionFenceGeneration?: number): boolean {
 		return (
 			this.#promptInFlightCount > 0 ||
 			this.#agentEventHandlersInFlight > 0 ||
 			this.#agentEndPublicationInFlight > 0 ||
 			this.#pendingAgentEndContinuationHolds.size > 0 ||
+			this.#pendingSelectionFenceDeferredContinuations(ignoreSelectionFenceGeneration) > 0 ||
 			this.#pendingAgentEndEmit !== undefined
 		);
 	}
 
 	#resolveSessionSettlement(): void {
-		if (this.#isSessionSettlementPending() || !this.#sessionSettlementResolve) return;
+		if (this.#isSessionSettlementPending() || !this.#sessionSettlementResolve) {
+			this.#wakeScopedSettlementWaiters();
+			return;
+		}
 		const resolve = this.#sessionSettlementResolve;
 		this.#sessionSettlementResolve = undefined;
 		this.#sessionSettlementPromise = undefined;
 		resolve();
+		this.#wakeScopedSettlementWaiters();
+	}
+	/** Re-evaluate every scoped settlement waiter (selection-internal drains). */
+	#wakeScopedSettlementWaiters(): void {
+		for (const check of [...this.#scopedSettlementWaiters]) check();
 	}
 
-	async #waitForSessionSettlement(): Promise<void> {
-		while (this.#isSessionSettlementPending()) {
-			if (!this.#sessionSettlementPromise) {
-				const { promise, resolve } = Promise.withResolvers<void>();
-				this.#sessionSettlementPromise = promise;
-				this.#sessionSettlementResolve = resolve;
+	/**
+	 * Wait for session settlement. `ignoreSelectionFenceGeneration` carries the
+	 * selection's own fence generation for its internal drain only (see
+	 * {@link waitForIdle}); external callers observe every unresolved
+	 * fence-deferred continuation.
+	 *
+	 * A scoped waiter registers a wake callback instead of sharing the strict
+	 * settlement promise: the strict promise may stay pending on a
+	 * fence-deferred continuation (correctly), and the selection that owns that
+	 * fence must not block behind it (#4519).
+	 */
+	async #waitForSessionSettlement(ignoreSelectionFenceGeneration?: number): Promise<void> {
+		while (this.#isSessionSettlementPending(ignoreSelectionFenceGeneration)) {
+			if (ignoreSelectionFenceGeneration === undefined) {
+				if (!this.#sessionSettlementPromise) {
+					const { promise, resolve } = Promise.withResolvers<void>();
+					this.#sessionSettlementPromise = promise;
+					this.#sessionSettlementResolve = resolve;
+				}
+				await this.#sessionSettlementPromise;
+				continue;
+			}
+			const wake = Promise.withResolvers<void>();
+			const check = () => {
+				if (!this.#isSessionSettlementPending(ignoreSelectionFenceGeneration)) wake.resolve();
+			};
+			this.#scopedSettlementWaiters.add(check);
+			check();
+			try {
+				await wake.promise;
+			} finally {
+				this.#scopedSettlementWaiters.delete(check);
 			}
-			await this.#sessionSettlementPromise;
 		}
 	}
 
@@ -2670,7 +3138,12 @@ export class AgentSession {
 		// A post-prompt continuation runs before its predecessor prompt returns. Its
 		// publication must settle, but session-wide settlement can still be owned by
 		// that predecessor; waiting here would make each prompt wait on the other.
-		if (!predecessorPromptStillInFlight) await this.#waitForSessionSettlement();
+		// Deferrals behind still-pending selection fences are excluded here: they
+		// cannot settle before their fence resolves, and the fence owner may be
+		// waiting on this very settlement (#4519).
+		if (!predecessorPromptStillInFlight) {
+			await this.#waitForSessionSettlement(this.#turnSettlementDeferralFloor());
+		}
 		if (flushError) throw flushError;
 	}
 
@@ -2746,7 +3219,14 @@ export class AgentSession {
 			// Persist before notifying synchronous subscribers: a subscriber may start a
 			// successor prompt from agent_end, whose running state must serialize after
 			// this terminal boundary rather than be overwritten by it.
-			void this.#persistRuntimeStateInBackground(pending);
+			//
+			// Awaited, not fire-and-forget: this is the terminal boundary, and the write
+			// runs under the native identity-bound state-file lock. A detached write
+			// outlives the session that owns it — under `bun test --isolate` the pending
+			// unlink lands after the runtime has torn down the context it was scheduled in
+			// and segfaults the process, and in production it lets a settled session's
+			// last write race whatever reclaims its lock next.
+			await this.#queueCoordinatorRuntimeStatePersist(pending);
 			this.#emit(pending);
 			extensionDelivery = this.#queueExtensionEvent(
 				pending,
@@ -2768,9 +3248,31 @@ export class AgentSession {
 
 	constructor(config: AgentSessionConfig) {
 		this.agent = config.agent;
+		this.agent.setProvisionalAssistantMessageEventInterceptor((message, assistantMessageEvent) => {
+			const contentIndex = assistantMessageEvent.contentIndex ?? 0;
+			const block = message.content[contentIndex];
+			if (block?.type === "toolCall" && block.id) this.#provisionalStreamingToolCallIds.add(block.id);
+			if (
+				assistantMessageEvent.type !== "toolcall_start" &&
+				assistantMessageEvent.type !== "toolcall_delta" &&
+				assistantMessageEvent.type !== "toolcall_end"
+			) {
+				return;
+			}
+			const event: AgentEvent = {
+				type: "message_update",
+				message,
+				assistantMessageEvent,
+			};
+			void this.#preCacheStreamingEditFile(event);
+			if (assistantMessageEvent.type === "toolcall_delta" || assistantMessageEvent.type === "toolcall_end") {
+				this.#maybeAbortStreamingEdit(event, this.#promptGeneration);
+			}
+		});
 		this.agent.bindRunCancellationDomainBridge(this.#runCancellationDomains, this.#agentSessionClaimKey);
 		this.sessionManager = config.sessionManager;
 		this.settings = config.settings;
+		this.#requestedAgentDir = config.agentDir ? path.resolve(config.agentDir) : undefined;
 		this.sessionManager.setSessionMemoryMode(this.settings.get("sessionMemory.mode"));
 		this.#unregisterSessionMemorySettings = this.settings.onChanged(settingPath => {
 			if (settingPath === "sessionMemory.mode") {
@@ -2819,6 +3321,7 @@ export class AgentSession {
 		this.#evalKernelOwnerId = config.evalKernelOwnerId ?? `agent-session:${Snowflake.next()}`;
 		this.#recoveryHydrationContext = config.recoveryHydrationContext;
 		this.#ownedAsyncJobManager = config.ownedAsyncJobManager;
+		this.#disposeAsyncJobManager = config.disposeAsyncJobManager ?? true;
 		this.#retainedMemorySampler = config.retainedMemorySampler;
 		this.#ownedMcpManager = config.ownedMcpManager;
 		this.#startupTurnBarrier = config.startupTurnBarrier;
@@ -2842,6 +3345,7 @@ export class AgentSession {
 			this.#providerSessionState = config.providerSessionState;
 		}
 		this.#toolRegistry = config.toolRegistry ?? new Map();
+		this.#builtinToolIdentities = new WeakSet(config.builtinToolIdentities ?? []);
 		this.#workflowGateToolSession = config.workflowGateToolSession;
 		this.#requestedToolNames = config.requestedToolNames;
 		this.#transformContext = config.transformContext ?? (messages => messages);
@@ -2878,16 +3382,80 @@ export class AgentSession {
 		this.#bindWorkflowGateEmitter();
 		this.yieldQueue = new YieldQueue({
 			isStreaming: () => this.isStreaming || this.#handoffTransitionActive,
-			injectStreaming: message => this.agent.followUp(message),
+			injectStreaming: message => {
+				// Mandated boundary comment (corrected turn semantics): turn-scope
+				// abort blocks only deliveries whose origin is a continuation of the
+				// aborted turn. Owned-completion deliveries from work deliberately
+				// left running are intentionally allowed to resume the agent through
+				// the normal followUp/prompt path and receive a fresh turn attempt.
+				// A denied owned-completion entry (owned scope, forged tuple, or
+				// missing scope) is DROPPED here — it must never call followUp/prompt.
+				const action = ownedCompletionResumeAction(message);
+				if (action === "drop") {
+					// A denied owned-completion entry is terminal: settle its
+					// registration before discarding it. An owned_unsettled abort
+					// (e.g. a job missing the settlement grace) leaves the tuple in
+					// the registry, and without this settlement repeated occurrences
+					// would retain terminal registrations until the bounded registry
+					// saturates and later owned aborts fail closed (review thread
+					// P2).
+					this.#settleDeliveredOwnedRegistrations([message]);
+					return;
+				}
+				// Defer the fresh lineage allocation to the ACTUAL resume admission:
+				// while another prompt is streaming, followUp only queues, so
+				// mutating the session-wide epoch/lineage here would corrupt the
+				// ACTIVE turn's lineage if it is terminal-aborted meanwhile (review
+				// thread P2). The queued resume is admitted through
+				// #promptWithMessage (resetRetryReplaySafety), which allocates the
+				// fresh attempt epoch at turn start. The idle injector, which calls
+				// agent.prompt directly, allocates right before admission.
+				this.agent.followUp(message);
+			},
 			injectIdle: async messages => {
-				const first = messages[0];
+				// Mandated boundary comment (corrected turn semantics): same origin
+				// split as the streaming injector — an allowed owned-completion
+				// delivery starts a fresh turn attempt/lineage and is not a
+				// continuation of the aborted turn. Denied owned-completion entries
+				// are dropped (mixed batches split before injection).
+				const dropped = messages.filter(message => ownedCompletionResumeAction(message) === "drop");
+				const survivors = messages.filter(message => ownedCompletionResumeAction(message) !== "drop");
+				// Settle the dropped subset (owned scope, forged tuple, vanished
+				// scope): the denied envelopes are terminal and their registrations
+				// must not occupy the bounded registry (review thread P2).
+				if (dropped.length > 0) this.#settleDeliveredOwnedRegistrations(dropped);
+				const first = survivors[0];
 				if (!first) return;
 				await this.#awaitStartupTurnBarrier();
 				if (this.#isDisposed) return;
-				if (messages.length === 1) {
-					await this.agent.prompt(first, this.#managedFallbackPromptOptions());
-				} else {
-					await this.agent.prompt(messages, this.#managedFallbackPromptOptions());
+				// A user prompt may have started during the barrier/scheduling
+				// delay: if the session is now streaming, mutating the epoch and
+				// lineage here would corrupt the ACTIVE user turn (and
+				// agent.prompt would then reject as busy, losing the drained
+				// completion). Route the survivors through followUp — the
+				// streaming injector's path — which allocates the fresh resume
+				// lineage at actual admission (review thread P1).
+				if (this.isStreaming) {
+					for (const message of survivors) this.agent.followUp(message);
+					return;
+				}
+				if (survivors.some(message => ownedCompletionResumeAction(message) === "fresh"))
+					this.#resumeFromOwnedCompletion();
+				try {
+					if (survivors.length === 1) {
+						await this.agent.prompt(first, this.#managedFallbackPromptOptions());
+					} else {
+						await this.agent.prompt(survivors, this.#managedFallbackPromptOptions());
+					}
+				} finally {
+					// The owned completions were delivered OR the prompt attempt
+					// failed (e.g. provider rejection): either way the yield
+					// queue already drained the entries, so this is their only
+					// delivery boundary — settle the registrations even on
+					// failure, otherwise repeated failed idle resumptions leak
+					// terminal tuples into the global registries until capacity
+					// is exhausted (review thread P2).
+					this.#settleDeliveredOwnedRegistrations(survivors);
 				}
 			},
 			scheduleIdleFlush: run => {
@@ -2980,9 +3548,83 @@ export class AgentSession {
 		this.#agentRegistry = config.agentRegistry;
 		this.#providerSessionId = config.providerSessionId;
 		this.#credentialSessionId = config.credentialSessionId;
+		this.#credentialStoreIdentity = config.credentialStoreIdentity;
 		this.#providerCacheSessionId = config.providerCacheSessionId;
+		this.#asyncJobProviderSessionId = config.asyncJobProviderSessionId;
 		// Per-tool TTSR reminders are folded into the matched tool's result via this hook.
-		this.agent.afterToolCall = ctx => this.#ttsrAfterToolCall(ctx);
+		this.agent.afterToolCall = ctx => {
+			settleToolLineageRegistrationWindow(ctx.toolCall.id, this.#ownedRegistrationEndpoint());
+			return this.#ttsrAfterToolCall(ctx);
+		};
+		// Bind immutable lineage/attempt metadata to each tool call id before the
+		// tool executes. Background registrations made inside the tool (task, Bash)
+		// read this binding synchronously so their completion can later be
+		// classified as exact owned work instead of a turn continuation. Bindings
+		// intentionally survive the tool call: resumed registrations re-use the
+		// original tool call id and must retain the same owned-completion origin.
+		// They are superseded by a rebind on the same id or by bounded eviction.
+		this.agent.beforeToolCall = ctx => {
+			const lineageIdHash = this.#turnLineageIdHash;
+			if (lineageIdHash) {
+				bindToolLineage(ctx.toolCall.id, {
+					lineageIdHash,
+					promptAttemptEpoch: this.#promptGeneration,
+					endpointGeneration: this.#terminalEndpointGeneration,
+					// Endpoint identity: the owned-registration registry is
+					// process-global and job ids restart per manager, so
+					// concurrent sessions must not collide (review thread P1).
+					// Subagents inherit the parent's manager, so the key follows
+					// the MANAGER's registered endpoint — the child's own
+					// sessionManager id is never registered, and the inherited
+					// manager's completion callback resolves registrations via
+					// AsyncJobManager.endpointIdOf(manager) (review thread P1).
+					endpointId: this.#ownedRegistrationEndpoint(),
+				});
+			}
+			return undefined;
+		};
+		// A queued owned-completion follow-up is consumed by the agent loop
+		// DIRECTLY (getFollowUpMessages), never through #promptWithMessage, so
+		// the fresh attempt/lineage promised for the resume is allocated HERE at
+		// actual resume admission — when the loop dequeues the follow-up for the
+		// next turn, the previously streaming turn has ended, so mutating the
+		// session-wide epoch/lineage is safe and its tools bind the fresh lineage.
+		this.agent.onFollowUpConsumed = messages => {
+			// A follow-up whose owned-completion origin is DENIED — an owned
+			// scope landed after the result was queued, or the tuple is
+			// forged/vanished-disabled — must NOT resume the agent: remove it
+			// from the dequeued batch before the loop processes it (review
+			// thread P1). This is the final consumption boundary for
+			// follow-up-delivered owned completions.
+			const dropped: AgentMessage[] = [];
+			for (let i = messages.length - 1; i >= 0; i--) {
+				if (ownedCompletionResumeAction(messages[i]) === "drop") {
+					dropped.push(messages[i]);
+					messages.splice(i, 1);
+				}
+			}
+			// An allowed owned-completion resume allocates the fresh lineage at
+			// actual admission (see the comment above).
+			if (messages.some(message => ownedCompletionResumeAction(message) === "fresh")) {
+				this.#resumeFromOwnedCompletion();
+			}
+			// Monitor task-notifications now carry the owned-completion envelope
+			// (see tools/monitor.ts), so the general drop + fresh-admission paths
+			// above cover them exactly like async results — no monitor-specific
+			// filter is needed.
+			// Every consumed envelope (delivered OR dropped) is settled: the
+			// dropped ones are captured above so their now-terminal
+			// registrations are retired too — otherwise an owned_unsettled
+			// abort's later drop would keep occupying the global registration
+			// and retained-policy capacities (review thread P2).
+			this.#settleDeliveredOwnedRegistrations([...messages, ...dropped]);
+			// Transfer SDK requester ownership correlation at the ACTUAL dequeue:
+			// every follow-up consumed by this batch's run fires its hook — even
+			// when the batch is drained by a continuation the message did not
+			// schedule (a skipped continuation must never discard the correlation
+			// of work that is still consumed; review thread P2).
+			this.#fireQueuedPromotionHooks(messages);
+		};
 		this.agent.providerSessionState = this.#providerSessionState;
 		this.#syncAgentSessionId();
 		this.#removeEphemeralCustomMessages();
@@ -3639,7 +4281,12 @@ export class AgentSession {
 	}
 
 	getAsyncJobSnapshot(options?: { recentLimit?: number }): AsyncJobSnapshot | null {
-		const manager = AsyncJobManager.instance();
+		// The session's OWNED manager first: /jobs, the status header, and the
+		// active-background count must reflect THIS session's jobs — with
+		// concurrent top-level sessions the process-global instance belongs to
+		// a different session and would report no running jobs for A or show
+		// B's (review thread P2).
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		if (!manager) return null;
 		const ownerFilter = this.#agentId ? { ownerId: this.#agentId } : undefined;
 		const running = manager.getRunningJobs(ownerFilter).map(job => ({
@@ -3672,7 +4319,12 @@ export class AgentSession {
 	 */
 	#cancelOwnAsyncJobs(): void {
 		if (!this.#agentId) return;
-		const manager = AsyncJobManager.instance();
+		// The session's OWNED manager first: with concurrent top-level sessions
+		// the process-global instance may belong to a different session, and a
+		// transition (newSession/fork/handoff/switch) must cancel THIS session's
+		// jobs — otherwise the predecessor's stale completion reaches the
+		// successor as ordinary work (review thread P1).
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		if (!manager) return;
 		// Run owner cleanups first so cron timers (and any other owner-scoped
 		// resource cleanup) cannot register fresh jobs while we tear down the
@@ -3683,7 +4335,7 @@ export class AgentSession {
 
 	async #settleOwnAsyncJobsBeforeArtifactRetirement(): Promise<void> {
 		const ownerId = this.#agentId;
-		const manager = AsyncJobManager.instance();
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		if (!ownerId || !manager) return;
 		const lease = manager.beginOwnerSubagentShutdown(ownerId);
 		if (!lease) throw new Error("Owned async cleanup is already in progress before artifact retirement.");
@@ -3707,6 +4359,7 @@ export class AgentSession {
 		manager: AsyncJobManager,
 		lease: OwnerSubagentShutdownLease,
 		ownerId: string,
+		predecessorEndpointId: string,
 	): void {
 		const finalization = (async () => {
 			while (!this.#isDisposed) {
@@ -3717,7 +4370,11 @@ export class AgentSession {
 					if (!(await manager.waitForOwnerInFlightDeliveries(ownerId)))
 						throw new Error("owner_delivery_settlement_timeout");
 					if (!(await manager.cancelAndSettleOwnerJobs(ownerId))) throw new Error("owner_job_settlement_timeout");
-					if (this.#isDisposed) break;
+					if (this.#isDisposed) {
+						retireOwnedRegistrationsForEndpoint(predecessorEndpointId);
+						break;
+					}
+					retireOwnedRegistrationsForEndpoint(predecessorEndpointId);
 					this.sessionManager.retireEphemeralArtifactsAfterTransition();
 					await this.#runToolSessionTransitionCleanups();
 					manager.finishOwnerSubagentShutdown(lease, "commit");
@@ -3738,7 +4395,14 @@ export class AgentSession {
 
 	#suppressOwnAsyncJobDeliveries(): void {
 		if (!this.#agentId) return;
-		const manager = AsyncJobManager.instance();
+		// The session's OWNED manager first: with concurrent top-level sessions
+		// the process-global instance belongs to a different session, and a
+		// transition (clearContext/handoff/switch) must acknowledge THIS
+		// session's pending deliveries — otherwise an already-completed
+		// delivery pending in A's manager is injected after A's context was
+		// cleared while a same-owner delivery in B's manager is discarded
+		// (review thread P2).
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		if (!manager) return;
 		const pendingJobIds = manager.getDeliveryState({ ownerId: this.#agentId }).pendingJobIds;
 		if (pendingJobIds.length > 0) {
@@ -3808,7 +4472,78 @@ export class AgentSession {
 		return queued;
 	}
 
+	/**
+	 * Immutable coordinator observations, keyed by the exact agent event object they were
+	 * taken for.
+	 *
+	 * Weak because an observation only matters for an event that is eventually published:
+	 * a maintenance checkpoint, a rejected terminal, and a superseded run's late event are
+	 * observed here but never emitted, and must not be persisted merely because they were
+	 * seen.
+	 */
+	#coordinatorToolObservations = new WeakMap<object, CoordinatorToolObservation>();
+
+	/**
+	 * Capture what is true at the SYNCHRONOUS agent-event boundary, before any async work.
+	 *
+	 * The label comes from the tool OBJECT the producer bound to this exact event when it
+	 * dispatched the call — never from re-resolving `event.toolName` here. `agent.state.tools`
+	 * is mutable: a tool refresh or MCP reload between dispatch and this observation would
+	 * otherwise attribute the call to whatever happens to hold its wire name now, publishing
+	 * a built-in label for a colliding custom tool that actually ran, or the reverse.
+	 *
+	 * The clock is captured here for the same reason: it keeps moving while subscribers run.
+	 *
+	 * A tool END is deliberately NOT labelled: its label comes from the correlation its own
+	 * START recorded, so one call cannot open under one label and close under another.
+	 *
+	 * A pairing-only event is not observed at all. The loop emits a start/end pair for a
+	 * call it skipped or aborted before dispatch so the stream keeps its shape, but this
+	 * snapshot is a claim about what is RUNNING — and nothing ran. Observing it would put a
+	 * tool into `active_tools` for the window between the two synthetic writes.
+	 */
+	#observeCoordinatorToolEvent(event: AgentEvent): void {
+		if (event.type !== "tool_execution_start" && event.type !== "tool_execution_end") return;
+		if (isNonDispatchedToolEvent(event)) return;
+		const label =
+			event.type === "tool_execution_start"
+				? canonicalCoordinatorToolLabel(dispatchedToolIdentity(event), tool =>
+						this.#builtinToolIdentities.has(tool),
+					)
+				: UNPROVEN_TOOL_LABEL;
+		this.#coordinatorToolObservations.set(event, Object.freeze({ label, observedAt: new Date().toISOString() }));
+	}
+
+	#canonicalMessageAdmissionTail: CanonicalMessageAdmissionSlot = { promise: Promise.resolve(), released: true };
+
+	#reserveCanonicalMessageAdmission(event: AgentEvent): CanonicalMessageAdmission | undefined {
+		if (event.type !== "message_end") return undefined;
+		const predecessor = this.#canonicalMessageAdmissionTail;
+		const settled = Promise.withResolvers<void>();
+		const slot: CanonicalMessageAdmissionSlot = { promise: settled.promise, released: false };
+		let released = false;
+		const release = () => {
+			if (released) return;
+			released = true;
+			slot.released = true;
+			settled.resolve();
+		};
+		// The reservation is owned by this emission's handler: keying it by the
+		// event object would let a replayed/bridged duplicate emission overwrite
+		// it and leave the first handler awaiting a promise only its own handler
+		// will ever release.
+		this.#canonicalMessageAdmissionTail = slot;
+		return { predecessor, release };
+	}
+
 	#trackAgentEvent = (event: AgentEvent): Promise<void> => {
+		// First statement of the listener: the observation must precede every claim,
+		// reservation, and async hop this handler performs.
+		this.#observeCoordinatorToolEvent(event);
+		// Reserve canonical message order synchronously. Agent listeners are not
+		// awaited, so a tool-result spill may yield while a later continuation
+		// otherwise overtakes it in persisted/display context.
+		const canonicalAdmission = this.#reserveCanonicalMessageAdmission(event);
 		const terminalOwner = event.type === "agent_end" ? getAgentTerminalOwnerContext(event) : undefined;
 		const maintenanceCheckpoint =
 			event.type === "agent_end" && event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted";
@@ -3862,14 +4597,15 @@ export class AgentSession {
 					this.#postPromptLeases.set(eventLease.resourceRunId, eventLease);
 				if (eventLease) {
 					await this.#runResourceLeaseContext.run(eventLease, () =>
-						this.#handleAgentEvent(event, activePromptHandle),
+						this.#handleAgentEvent(event, activePromptHandle, canonicalAdmission),
 					);
 				} else {
-					await this.#handleAgentEvent(event, activePromptHandle);
+					await this.#handleAgentEvent(event, activePromptHandle, canonicalAdmission);
 				}
 			} catch (error) {
 				logger.warn("Agent event handler failed", { event: event.type, error: String(error) });
 			} finally {
+				canonicalAdmission?.release();
 				if (eventLease) {
 					const pendingAgentEnd =
 						event.type === "agent_end" && !maintenanceCheckpoint && this.#pendingAgentEndEmit === event
@@ -3892,13 +4628,43 @@ export class AgentSession {
 		return handler;
 	};
 
-	async #persistRuntimeStateInBackground(event: AgentSessionEvent): Promise<void> {
+	/** Serializes sidecar writes in publication order, independent of write latency. */
+	#coordinatorPersistQueue: Promise<void> = Promise.resolve();
+
+	/**
+	 * Reserve this event's place in the sidecar write order.
+	 *
+	 * Called immediately BEFORE local delivery so a synchronous subscriber that re-enters
+	 * the session cannot get its own, later event persisted first. The returned promise is
+	 * only awaited where durability must precede delivery (terminal `agent_end`).
+	 *
+	 * A pairing-only tool event takes no place in that order at all — neither its start nor
+	 * its end. It describes a call that was never dispatched, and this file is read as the
+	 * answer to "what is this session doing right now".
+	 */
+	#queueCoordinatorRuntimeStatePersist(event: AgentSessionEvent): Promise<void> {
+		if (isNonDispatchedToolEvent(event)) return Promise.resolve();
+		const observation = this.#coordinatorToolObservations.get(event);
+		const run = () => this.#persistRuntimeStateInBackground(event, observation);
+		const queued = this.#coordinatorPersistQueue.then(run, run);
+		this.#coordinatorPersistQueue = queued.catch(() => {});
+		return queued;
+	}
+
+	async #persistRuntimeStateInBackground(
+		event: AgentSessionEvent,
+		observation: CoordinatorToolObservation | undefined,
+	): Promise<void> {
 		try {
-			await persistCoordinatorRuntimeStateFromEvent(event, {
-				sessionId: this.sessionId,
-				cwd: this.sessionManager.getCwd(),
-				sessionFile: this.sessionManager.getSessionFile(),
-			});
+			await persistCoordinatorRuntimeStateFromEvent(
+				event,
+				{
+					sessionId: this.sessionId,
+					cwd: this.sessionManager.getCwd(),
+					sessionFile: this.sessionManager.getSessionFile(),
+				},
+				observation,
+			);
 		} catch {
 			logger.warn("Failed to persist coordinator runtime state", { event: event.type });
 		}
@@ -3946,7 +4712,6 @@ export class AgentSession {
 		if (event.type === "agent_end" && event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted")
 			return;
 
-		const persistRuntimeState = () => this.#persistRuntimeStateInBackground(event);
 		// Hold agent_end until the prompt's finally and all earlier async event work
 		// have unwound. Subscribers treat this event as the ready signal; flushing it
 		// from abort while either barrier is active permits a successor to race the
@@ -3959,7 +4724,7 @@ export class AgentSession {
 		if (event.type === "agent_end") {
 			// Start the durable terminal write before synchronous subscribers can
 			// re-enter prompt(), so a successor's running transition serializes after it.
-			await persistRuntimeState();
+			await this.#queueCoordinatorRuntimeStatePersist(event);
 			this.#emit(event);
 			await this.#emitExtensionEvent(event);
 			return;
@@ -3969,13 +4734,22 @@ export class AgentSession {
 		// auto-continuation gates, goal reminders, and tests all observe these events
 		// synchronously. Coordinator sidecar writes and extension hooks are secondary
 		// sinks, so they must not delay or suppress local delivery.
+		//
+		// The sidecar write is ENQUEUED before delivery and awaited by nobody: a
+		// synchronous subscriber that re-enters the session and emits its own event still
+		// lands behind this one, while nothing about that subscriber's latency reaches the
+		// snapshot.
+		void this.#queueCoordinatorRuntimeStatePersist(event);
 		this.#emit(event);
-		void persistRuntimeState();
 		await this.#emitExtensionEvent(event);
 	}
 
 	// Track last assistant message for auto-compaction check
 	#lastAssistantMessage: AssistantMessage | undefined = undefined;
+	// Admission slot of the last message_end per assistant message, so the
+	// agent_end handler can join the terminal's canonical admission before any
+	// post-turn write reaches the branch.
+	#lastAssistantAdmissionByMessage = new WeakMap<AssistantMessage, CanonicalMessageAdmission | undefined>();
 	// Provider context construction must wait for this chain. Agent event listeners
 	// are synchronous dispatch only; their async work cannot otherwise gate the
 	// next tool-result provider request.
@@ -4043,7 +4817,11 @@ export class AgentSession {
 	}
 
 	/** Internal handler for agent events - shared by subscribe and reconnect */
-	#handleAgentEvent = async (event: AgentEvent, activePromptHandle?: string): Promise<void> => {
+	#handleAgentEvent = async (
+		event: AgentEvent,
+		activePromptHandle?: string,
+		canonicalAdmission?: CanonicalMessageAdmission,
+	): Promise<void> => {
 		const attemptScope = (event as AgentEvent & { scope?: AttemptScope }).scope;
 
 		if (
@@ -4190,10 +4968,31 @@ export class AgentSession {
 			this.#silentAbortPending = false;
 		}
 
-		// Canonical persistence must happen synchronously before listener work can
-		// await: the EventStream FIFO drain then guarantees tool results and every
-		// steering message are in the branch before a maintenance rewrite starts.
+		// Canonical persistence follows synchronous message_end reservation order.
+		// Only the admission predecessor and this event's own pre-admission work are
+		// inside the lane; release before extension delivery and unrelated post-work.
+		// An already-released predecessor must not cost a microtask: external emitters
+		// and tests rely on canonical append being visible synchronously after
+		// emitExternalEvent returns whenever no admission is actually contended.
+		// Track the terminal assistant synchronously, before any admission wait:
+		// externally emitted terminals (host bridges, replays, tests) dispatch
+		// agent_end immediately after message_end, and the agent_end handler's
+		// post-turn read must see THIS stop even when this admission is still
+		// parked behind a contended predecessor — otherwise post-turn logic
+		// (deep-interview continuation, compaction, retry classification) runs
+		// against the previous turn's assistant. The per-message admission slot
+		// also lets agent_end processing wait for this admission to finish, so
+		// post-turn writes (continuation reminders, compaction rewrites) never
+		// reorder ahead of the branch entries they respond to.
+		if (event.type === "message_end" && event.message.role === "assistant") {
+			this.#lastAssistantMessage = event.message;
+			this.#lastAssistantAdmissionByMessage.set(event.message, canonicalAdmission);
+		}
+
 		if (event.type === "message_end") {
+			if (canonicalAdmission && !canonicalAdmission.predecessor.released) {
+				await canonicalAdmission.predecessor.promise;
+			}
 			if (
 				(event.message.role === "hookMessage" || event.message.role === "custom") &&
 				!(event.message.role === "custom" && event.message.customType === "hindsight-recall")
@@ -4224,6 +5023,47 @@ export class AgentSession {
 				try {
 					this.sessionManager.appendMessage(event.message);
 				} catch (error) {
+					// Typed near-limit append (#4566): the transcript hit the managed
+					// per-file cap and even the live-entry rewrite could not hold this
+					// entry. The edit/effect itself may already be committed; surface a
+					// structured tool-result outcome stating that and the exact
+					// continuation path instead of a generic fatal abort. The typed
+					// error already performed deterministic recovery, so the session is
+					// not poisoned and the turn ends with actionable state.
+					if (error instanceof SessionNearLimitAppendError) {
+						this.agent.abort();
+						if (event.message.role === "toolResult") {
+							event.message.isError = true;
+							const committed = error.entryRetained
+								? "The edit committed and its receipt is retained in the live session; it will persist on the next successful write."
+								: "The edit committed on disk but its receipt could not be retained in the live session.";
+							event.message.content = [
+								{
+									type: "text",
+									text: [
+										"Session transcript reached the managed per-file limit; this result could not be recorded durably.",
+										committed,
+										"Continue by compacting the session (`/compact`) or exporting to a fresh session (`gjc export <session-file>`); re-verify the edited file before relying on it.",
+									].join("\n"),
+								},
+							];
+							event.message.details = {
+								...(event.message.details && typeof event.message.details === "object"
+									? event.message.details
+									: {}),
+								failureKind: "persistence",
+								nearLimitAppend: {
+									code: error.code,
+									entryBytes: error.entryBytes,
+									liveBytes: error.liveBytes,
+									capBytes: error.capBytes,
+									entryRetained: error.entryRetained,
+								},
+							};
+							this.agent.touchContext();
+						}
+						return;
+					}
 					if (
 						event.message.role !== "toolResult" ||
 						event.message.toolName !== "todo_write" ||
@@ -4289,6 +5129,7 @@ export class AgentSession {
 					}
 				}
 			}
+			canonicalAdmission?.release();
 		}
 
 		// Deobfuscate assistant message content for display emission — the LLM echoes back
@@ -4486,6 +5327,7 @@ export class AgentSession {
 
 		if (
 			event.type === "message_update" &&
+			!this.#isProvisionalStreamingToolEvent(event) &&
 			(event.assistantMessageEvent.type === "toolcall_start" ||
 				event.assistantMessageEvent.type === "toolcall_delta" ||
 				event.assistantMessageEvent.type === "toolcall_end")
@@ -4495,6 +5337,7 @@ export class AgentSession {
 
 		if (
 			event.type === "message_update" &&
+			!this.#isProvisionalStreamingToolEvent(event) &&
 			(event.assistantMessageEvent.type === "toolcall_end" || event.assistantMessageEvent.type === "toolcall_delta")
 		) {
 			this.#maybeAbortStreamingEdit(event, this.#promptGeneration);
@@ -4506,9 +5349,9 @@ export class AgentSession {
 				this.#markTtsrInjected(this.#extractTtsrRuleNames(event.message.details));
 			}
 
-			// Track assistant message for auto-compaction (checked on agent_end)
+			// (#lastAssistantMessage is captured synchronously before the admission
+			// wait above; the block below handles assistant side effects only.)
 			if (event.message.role === "assistant") {
-				this.#lastAssistantMessage = event.message;
 				const assistantMsg = event.message as AssistantMessage;
 				const currentGrantsAnthropicPriority =
 					this.serviceTier === "priority" || this.serviceTier === "claude-only";
@@ -4558,6 +5401,9 @@ export class AgentSession {
 					// #resolveRetry() is idempotent, so the later tail call is a no-op.
 					this.#resolveRetry();
 				}
+				if (assistantMsg.stopReason !== "error" && assistantMsg.stopReason !== "aborted") {
+					this.#providerRetryMaxAttempts = undefined;
+				}
 			}
 
 			if (event.message.role === "toolResult") {
@@ -4631,6 +5477,13 @@ export class AgentSession {
 			}
 		}
 
+		if (
+			event.type === "agent_end" &&
+			!(event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted")
+		) {
+			this.#releaseDeferredSdkFollowUps();
+		}
+
 		// Check auto-retry and auto-compaction after agent completes
 		if (event.type === "agent_end") {
 			// Cooperative mid-run maintenance interruption (issue #2035). The loop
@@ -4685,6 +5538,16 @@ export class AgentSession {
 				.find((message): message is AssistantMessage => message.role === "assistant");
 			const msg = this.#lastAssistantMessage ?? fallbackAssistant;
 			this.#lastAssistantMessage = undefined;
+			// Join the terminal's canonical admission before any post-turn write:
+			// an externally emitted terminal dispatches agent_end while its own
+			// admission may still be parked behind a contended predecessor, and a
+			// continuation reminder or compaction rewrite that runs first would
+			// persist ahead of the branch entries it responds to.
+			const terminalAdmission = msg ? this.#lastAssistantAdmissionByMessage.get(msg) : undefined;
+			if (msg) this.#lastAssistantAdmissionByMessage.delete(msg);
+			if (terminalAdmission && !terminalAdmission.predecessor.released) {
+				await terminalAdmission.predecessor.promise;
+			}
 			if (!msg) {
 				this.#lastSuccessfulYieldToolCallId = undefined;
 				this.#resolveRetry();
@@ -4813,8 +5676,14 @@ export class AgentSession {
 		this.#postPromptTasksPromise = undefined;
 	}
 
-	#trackPostPromptTask(task: Promise<void>, lease?: RunResourceProducerLease, leaseTask: Promise<void> = task): void {
+	#trackPostPromptTask(
+		task: Promise<void>,
+		selectionFenceGeneration: number,
+		lease?: RunResourceProducerLease,
+		leaseTask: Promise<void> = task,
+	): void {
 		this.#postPromptTasks.add(task);
+		this.#postPromptTaskSelectionFenceGenerations.set(task, selectionFenceGeneration);
 		this.#ensurePostPromptTasksPromise();
 		if (lease) {
 			lease.track("post_prompt", "agent-session", leaseTask);
@@ -4824,6 +5693,7 @@ export class AgentSession {
 			.catch(() => {})
 			.finally(() => {
 				this.#postPromptTasks.delete(task);
+				this.#postPromptTaskSelectionFenceGenerations.delete(task);
 				if (this.#postPromptTasks.size === 0) this.#resolvePostPromptTasks();
 			});
 	}
@@ -4836,8 +5706,14 @@ export class AgentSession {
 			onSkip?: () => void;
 			resourceRunId?: string;
 			leaseTask?: Promise<void>;
+			selectionFenceGeneration?: number;
 		},
 	): Promise<void> {
+		const selectionFenceGeneration =
+			options?.selectionFenceGeneration ??
+			this.#selectionFenceGenerationContext.getStore() ??
+			this.#sessionAdmissionContext.getStore()?.selectionFenceGeneration ??
+			this.#selectionFenceGeneration;
 		const delayMs = options?.delayMs ?? 0;
 		const resourceRunId = options?.resourceRunId;
 		const contextualLease = this.#runResourceLeaseContext.getStore();
@@ -4875,12 +5751,17 @@ export class AgentSession {
 				options.onSkip?.();
 				return;
 			}
-			await task(signal);
+			await this.#selectionFenceGenerationContext.run(selectionFenceGeneration, () => task(signal));
 		};
 		const scheduled = reservation?.ok
 			? this.#runResourceLeaseContext.run(reservation.lease, runScheduled)
 			: runScheduled();
-		this.#trackPostPromptTask(scheduled, reservation?.ok ? reservation.lease : undefined, options?.leaseTask);
+		this.#trackPostPromptTask(
+			scheduled,
+			selectionFenceGeneration,
+			reservation?.ok ? reservation.lease : undefined,
+			options?.leaseTask,
+		);
 		return scheduled;
 	}
 
@@ -4894,9 +5775,10 @@ export class AgentSession {
 		skipCompactionCheck?: boolean;
 		suppressPredecessorAgentEnd?: boolean;
 		shouldContinue?: () => boolean;
-		onSkip?: (reason: "generation_changed" | "aborted_signal" | "queue_drained" | "handoff_in_progress") => void;
+		onSkip?: (
+			reason: "generation_changed" | "aborted_signal" | "queue_drained" | "handoff_in_progress" | "terminal_turn",
+		) => void;
 		allowDuringCancelAndSubmit?: boolean;
-		rescheduleOnBusy?: boolean;
 		onError?: (error: unknown) => void;
 		resourceRunId?: string;
 		maintenanceContinuation?: boolean;
@@ -4905,14 +5787,63 @@ export class AgentSession {
 		// queued turn without replaying the non-assistant tail. Every other
 		// scheduled continuation keeps continue() semantics.
 		continueQueuedOnly?: boolean;
+		/** Reschedule with capped exponential backoff when the continuation hits AgentBusyError. */
+		rescheduleOnBusy?: boolean;
+		/** Called when the scheduled continuation accepts its run (before agent_start). */
+		onRunAccepted?: (handle: AttemptRunHandle) => void;
+		/** Internal causal generation retained when a later continuation is deferred behind selection. */
+		selectionFenceGeneration?: number;
+		/** Internal predecessor publication hold retained across selection-fence deferral. */
+		predecessorAgentEndHold?: symbol;
+		/** Internal predecessor terminal event sequestered while waiting behind selection. */
+		deferredPredecessorAgentEnd?: AgentSessionEvent;
 	}): Promise<void> {
-		const predecessorAgentEndHold = options?.suppressPredecessorAgentEnd
-			? this.#reserveDeferredAgentEndForContinuation()
-			: undefined;
-		let terminalized = false;
-		const skip = (reason: "generation_changed" | "aborted_signal" | "queue_drained" | "handoff_in_progress") => {
-			if (terminalized) return;
-			terminalized = true;
+		const continuationAdmission = this.#captureScheduledContinuationAdmission();
+		const selectionFenceGeneration =
+			options?.selectionFenceGeneration ??
+			this.#selectionFenceGenerationContext.getStore() ??
+			this.#sessionAdmissionContext.getStore()?.selectionFenceGeneration ??
+			continuationAdmission?.entry.selectionFenceGeneration ??
+			this.#selectionFenceGeneration;
+		if (this.#pendingSelectionFences > 0 && selectionFenceGeneration === this.#selectionFenceGeneration) {
+			const deferredPredecessorAgentEnd =
+				options?.deferredPredecessorAgentEnd ??
+				(options?.suppressPredecessorAgentEnd
+					? this.#claimDeferredAgentEndForContinuation(this.#reserveDeferredAgentEndForContinuation())
+					: undefined);
+			const precedingSelectionFence = this.#selectionFenceTail;
+			const deferredPromptGeneration = options?.generation ?? this.#promptGeneration;
+			const deferredScheduling = precedingSelectionFence.then(() => {
+				try {
+					this.#scheduleAgentContinue({
+						...options,
+						generation: deferredPromptGeneration,
+						selectionFenceGeneration,
+						deferredPredecessorAgentEnd,
+					});
+				} finally {
+					// The recursive call synchronously re-reserved its settlement
+					// markers (predecessor hold / post-prompt task); end the limbo
+					// window so the counter never spans the continuation run itself.
+					this.#endSelectionFenceDeferralTracking(selectionFenceGeneration);
+				}
+			});
+			this.#trackSelectionFenceDeferredContinuation(selectionFenceGeneration, deferredScheduling);
+			return Promise.resolve();
+		}
+		const predecessorAgentEndHold =
+			options?.predecessorAgentEndHold ??
+			(options?.deferredPredecessorAgentEnd
+				? this.#restoreAndReserveDeferredAgentEndForContinuation(options.deferredPredecessorAgentEnd)
+				: options?.suppressPredecessorAgentEnd
+					? this.#reserveDeferredAgentEndForContinuation()
+					: undefined);
+		let terminalized = false;
+		const skip = (
+			reason: "generation_changed" | "aborted_signal" | "queue_drained" | "handoff_in_progress" | "terminal_turn",
+		) => {
+			if (terminalized) return;
+			terminalized = true;
 			this.#releaseDeferredAgentEndContinuation(predecessorAgentEndHold);
 			options?.onSkip?.(reason);
 		};
@@ -4932,126 +5863,161 @@ export class AgentSession {
 			const settleLease = () => leaseSettlement.resolve();
 			return this.#schedulePostPromptTask(
 				async scheduledSignal => {
-					const canContinue = (): boolean => {
-						if (scheduledSignal.aborted || this.#isDisposed) {
-							skip("aborted_signal");
-							return false;
-						}
-						if (scheduledGeneration !== undefined && this.#promptGeneration !== scheduledGeneration) {
-							skip("generation_changed");
-							return false;
-						}
-						if (this.#cancelAndSubmitInProgress && !options?.allowDuringCancelAndSubmit) {
-							skip("queue_drained");
-							return false;
-						}
-						if (options?.shouldContinue && !options.shouldContinue()) {
-							skip("queue_drained");
-							return false;
-						}
-						return true;
-					};
-					if (!canContinue()) {
-						settleLease();
-						return;
-					}
-					await this.#awaitStartupTurnBarrier();
-					if (!canContinue()) {
-						settleLease();
-						return;
-					}
 					try {
-						if (!options?.skipCompactionCheck) {
-							await this.#checkEstimatedContextBeforePrompt();
-							if (!canContinue()) return;
-						}
-						if (scheduledSignal.aborted) {
-							skip("aborted_signal");
-							return;
-						}
-						if (scheduledGeneration !== undefined && this.#promptGeneration !== scheduledGeneration) {
-							skip("generation_changed");
-							return;
-						}
-						if (options?.shouldContinue && !options.shouldContinue()) {
-							skip("queue_drained");
-							return;
-						}
-						// A continuation scheduled before a handoff engaged must not start a
-						// turn against the session being handed off (or the restored
-						// predecessor). rearmIdle / normal delivery resumes after the fence.
-						if (this.#handoffTransitionActive) {
-							skip("handoff_in_progress");
-							return;
-						}
-						const predecessorAgentEnd = this.#claimDeferredAgentEndForContinuation(predecessorAgentEndHold);
-						let predecessorAccepted = false;
-						const releasePredecessor = () => {
-							if (predecessorAccepted) return;
-							predecessorAccepted = true;
-							this.#releaseDeferredAgentEndLease(predecessorAgentEnd);
-						};
-						const hasQueuedMessages = this.agent.hasQueuedMessages();
-						const startsQueuedSuccessor =
-							hasQueuedMessages &&
-							(options?.continueQueuedOnly === true || this.agent.state.messages.at(-1)?.role === "assistant");
-						const continueQueued = options?.continueQueuedOnly
-							? this.agent.continueQueuedMessages.bind(this.agent)
-							: this.agent.continue.bind(this.agent);
-						try {
-							await continueQueued({
-								...this.#managedFallbackPromptOptions(),
-								maintenanceContinuation: options?.maintenanceContinuation,
-								// Reset only after continue() has claimed the queued turn. Skipped or stale
-								// continuations retain predecessor accounting, and resetAttemptBudget keeps
-								// the sticky fallback cursor unchanged.
-								onRunAccepted: (handle: AttemptRunHandle) => {
-									this.#acceptRunHandle(handle);
-									settleLease();
-									releasePredecessor();
-									if (startsQueuedSuccessor) {
-										this.#defaultFallbackChain().resetAttemptBudget();
-										this.#overflowMaintenanceAttempts = 0;
+						await this.#withSessionAdmission(
+							"prompt",
+							async () => {
+								const canContinue = (): boolean => {
+									if (scheduledSignal.aborted || this.#isDisposed) {
+										skip("aborted_signal");
+										return false;
 									}
-								},
-							});
-							releasePredecessor();
-						} catch (error) {
-							if (
-								options?.rescheduleOnBusy &&
-								this.#isAgentBusyError(error) &&
-								!predecessorAccepted &&
-								!terminalized &&
-								canContinue()
-							) {
-								if (busyReschedules < AGENT_CONTINUE_BUSY_MAX_RESCHEDULES) {
-									busyReschedules += 1;
-									const nextDelayMs = agentContinueBusyRescheduleDelayMs(busyReschedules);
-									this.#retainDeferredAgentEndAfterContinuationBusy(
-										predecessorAgentEndHold,
-										predecessorAgentEnd,
-									);
-									logger.debug("agent.continue busy after scheduling; rescheduling", {
-										error: error.message,
-										attempt: busyReschedules,
-										delayMs: nextDelayMs,
-									});
-									void scheduleAttempt(nextDelayMs);
+									if (scheduledGeneration !== undefined && this.#promptGeneration !== scheduledGeneration) {
+										skip("generation_changed");
+										return false;
+									}
+									if (this.#cancelAndSubmitInProgress && !options?.allowDuringCancelAndSubmit) {
+										skip("queue_drained");
+										return false;
+									}
+									if (options?.shouldContinue && !options.shouldContinue()) {
+										skip("queue_drained");
+										return false;
+									}
+									return true;
+								};
+								if (!canContinue()) {
+									settleLease();
 									return;
 								}
-								logger.warn("agent.continue busy reschedule budget exhausted; giving up", {
-									attempts: busyReschedules,
-									error: error.message,
-								});
-							}
-							if (!predecessorAccepted)
-								this.#restoreDeferredAgentEndAfterContinuationFailure(predecessorAgentEnd);
-							throw error;
-						}
+								await this.#awaitStartupTurnBarrier();
+								if (!canContinue()) {
+									settleLease();
+									return;
+								}
+								try {
+									if (!options?.skipCompactionCheck) {
+										await this.#checkEstimatedContextBeforePrompt();
+										if (!canContinue()) return;
+									}
+									if (scheduledSignal.aborted) {
+										skip("aborted_signal");
+										return;
+									}
+									if (scheduledGeneration !== undefined && this.#promptGeneration !== scheduledGeneration) {
+										skip("generation_changed");
+										return;
+									}
+									if (options?.shouldContinue && !options.shouldContinue()) {
+										skip("queue_drained");
+										return;
+									}
+									// A scheduled same-turn continuation of a terminally aborted turn is
+									// denied at the final synchronous boundary before agent.continue
+									// entry; no await intervenes between this check and method entry.
+									// Owned-completion deliveries are NOT affected (they use followUp).
+									if (this.#isTurnContinuationBlocked()) {
+										skip("terminal_turn");
+										return;
+									}
+									// A continuation scheduled before a handoff engaged must not start a
+									// turn against the session being handed off (or the restored
+									// predecessor). rearmIdle / normal delivery resumes after the fence.
+									if (this.#handoffTransitionActive) {
+										skip("handoff_in_progress");
+										return;
+									}
+									const predecessorAgentEnd =
+										this.#claimDeferredAgentEndForContinuation(predecessorAgentEndHold);
+									let predecessorAccepted = false;
+									const releasePredecessor = () => {
+										if (predecessorAccepted) return;
+										predecessorAccepted = true;
+										this.#releaseDeferredAgentEndLease(predecessorAgentEnd);
+									};
+									const hasQueuedMessages = this.agent.hasQueuedMessages();
+									const startsQueuedSuccessor =
+										hasQueuedMessages &&
+										(options?.continueQueuedOnly === true ||
+											this.agent.state.messages.at(-1)?.role === "assistant");
+									const continueQueued = options?.continueQueuedOnly
+										? this.agent.continueQueuedMessages.bind(this.agent)
+										: this.agent.continue.bind(this.agent);
+									try {
+										await continueQueued({
+											...this.#managedFallbackPromptOptions(),
+											maintenanceContinuation: options?.maintenanceContinuation,
+											// Reset only after continue() has claimed the queued turn. Skipped or stale
+											// continuations retain predecessor accounting, and resetAttemptBudget keeps
+											// the sticky fallback cursor unchanged.
+											onRunAccepted: (handle: AttemptRunHandle, acceptance) => {
+												this.#fireQueuedPromotionHooks(acceptance.consumedQueuedMessages);
+												for (const message of acceptance.consumedQueuedMessages) {
+													const sdkRunToken = this.#sdkRunTokensByQueuedMessage.get(message);
+													if (sdkRunToken) {
+														this.#sdkRunTokensByAttemptScope.set(handle.scope, sdkRunToken);
+														break;
+													}
+												}
+												this.#acceptRunHandle(handle);
+												options?.onRunAccepted?.(handle);
+												settleLease();
+												releasePredecessor();
+												if (startsQueuedSuccessor) {
+													this.#defaultFallbackChain().resetAttemptBudget();
+													this.#overflowMaintenanceAttempts = 0;
+												}
+											},
+										});
+										releasePredecessor();
+									} catch (error) {
+										if (
+											options?.rescheduleOnBusy &&
+											this.#isAgentBusyError(error) &&
+											!predecessorAccepted &&
+											!terminalized &&
+											canContinue()
+										) {
+											if (busyReschedules < AGENT_CONTINUE_BUSY_MAX_RESCHEDULES) {
+												busyReschedules += 1;
+												const nextDelayMs = agentContinueBusyRescheduleDelayMs(busyReschedules);
+												this.#retainDeferredAgentEndAfterContinuationBusy(
+													predecessorAgentEndHold,
+													predecessorAgentEnd,
+												);
+												logger.debug("agent.continue busy after scheduling; rescheduling", {
+													error: error.message,
+													attempt: busyReschedules,
+													delayMs: nextDelayMs,
+												});
+												void scheduleAttempt(nextDelayMs);
+												return;
+											}
+											logger.warn("agent.continue busy reschedule budget exhausted; giving up", {
+												attempts: busyReschedules,
+												error: error.message,
+											});
+										}
+										if (!predecessorAccepted)
+											this.#restoreDeferredAgentEndAfterContinuationFailure(predecessorAgentEnd);
+										throw error;
+									}
+								} catch (error) {
+									fail(error);
+								} finally {
+									settleLease();
+								}
+							},
+							scheduledSignal,
+							continuationAdmission,
+							{
+								bypassSelectionFenceGeneration: selectionFenceGeneration,
+								allowPromptContinuationReentry: true,
+							},
+						);
 					} catch (error) {
-						fail(error);
-					} finally {
-						settleLease();
+						if (scheduledSignal.aborted) skip("aborted_signal");
+						else fail(error);
 					}
 				},
 				{
@@ -5062,12 +6028,12 @@ export class AgentSession {
 					},
 					resourceRunId: options?.resourceRunId,
 					leaseTask: leaseSettlement.promise,
+					selectionFenceGeneration,
 				},
 			);
 		};
 		return scheduleAttempt();
 	}
-
 	#logCompactionContinuationSkipped(
 		source: "auto_continue_prompt" | "queued_continue" | "overflow_retry",
 		reason: string,
@@ -5128,7 +6094,6 @@ export class AgentSession {
 				generation,
 				suppressPredecessorAgentEnd: true,
 				resourceRunId,
-				rescheduleOnBusy: true,
 				onSkip: reason => this.#logCompactionContinuationSkipped("overflow_retry", reason),
 				onError: error => this.#logCompactionContinuationError("overflow_retry", error),
 			});
@@ -5145,8 +6110,13 @@ export class AgentSession {
 		return false;
 	}
 
-	#scheduleAutoContinuePrompt(generation: number, requireUnfinishedWork = true, resourceRunId?: string): void {
-		const predecessorAgentEndHold = this.#reserveDeferredAgentEndForContinuation();
+	#scheduleAutoContinuePrompt(
+		generation: number,
+		requireUnfinishedWork = true,
+		resourceRunId?: string,
+		deferredSelectionFenceGeneration?: number,
+		deferredPredecessorAgentEnd?: AgentSessionEvent,
+	): void {
 		const scheduledGeneration = generation;
 		const continuationAuthorized = async (
 			signal: AbortSignal,
@@ -5164,6 +6134,13 @@ export class AgentSession {
 				);
 				return false;
 			}
+			// A same-turn auto-continue of a terminally aborted turn is denied
+			// (corrected turn semantics); owned-completion deliveries are not
+			// affected — they flow through followUp as fresh turns.
+			if (this.#isTurnContinuationBlocked()) {
+				this.#logCompactionContinuationSkipped("auto_continue_prompt", "terminal_turn");
+				return false;
+			}
 			const authorized = requireUnfinishedWork
 				? this.#hasUnfinishedWork(snapshot) || hasPendingNextTurnMessages
 				: snapshot.queuedMessages ||
@@ -5173,81 +6150,95 @@ export class AgentSession {
 			if (!authorized) this.emitNotice("info", "Auto-continue skipped: no unfinished work detected");
 			return authorized;
 		};
-		let busyReschedules = 0;
-		const scheduleAttempt = (delayMs = 0) => {
-			let rescheduled = false;
-			void this.#schedulePostPromptTask(
-				async signal => {
-					try {
-						await Promise.resolve();
-						if (signal.aborted) {
-							this.#logCompactionContinuationSkipped("auto_continue_prompt", "aborted_signal");
-							return;
-						}
-						if (this.#promptGeneration !== scheduledGeneration) {
-							this.#logCompactionContinuationSkipped("auto_continue_prompt", "generation_changed");
-							return;
-						}
-						if (!(await continuationAuthorized(signal))) return;
-						await this.#promptWithMessage(
-							{
-								role: "developer",
-								content: [{ type: "text", text: autoContinuePrompt }],
-								attribution: "agent",
-								timestamp: Date.now(),
-							},
-							autoContinuePrompt,
-							{
-								skipPostPromptRecoveryWait: true,
-								skipCompactionCheck: true,
-								predecessorAgentEndHold,
-								onFinalPreflight: ({ hasPendingNextTurnMessages }) =>
-									continuationAuthorized(signal, hasPendingNextTurnMessages),
-							},
-						);
-					} catch (error) {
-						if (signal.aborted) {
-							this.#logCompactionContinuationSkipped("auto_continue_prompt", "aborted_signal");
-							return;
-						}
-						if (this.#isAgentBusyError(error) && this.#promptGeneration === scheduledGeneration) {
-							if (busyReschedules < AGENT_CONTINUE_BUSY_MAX_RESCHEDULES) {
-								busyReschedules += 1;
-								const nextDelayMs = agentContinueBusyRescheduleDelayMs(busyReschedules);
-								logger.debug("Auto-compaction continuation busy; rescheduling", {
-									source: "auto_continue_prompt",
-									reason: "queue_drained",
-									error: error.message,
-									attempt: busyReschedules,
-									delayMs: nextDelayMs,
-								});
-								rescheduled = true;
-								scheduleAttempt(nextDelayMs);
+		const continuationAdmission = this.#captureScheduledContinuationAdmission();
+		const selectionFenceGeneration =
+			deferredSelectionFenceGeneration ??
+			this.#selectionFenceGenerationContext.getStore() ??
+			this.#sessionAdmissionContext.getStore()?.selectionFenceGeneration ??
+			continuationAdmission?.entry.selectionFenceGeneration ??
+			this.#selectionFenceGeneration;
+		if (this.#pendingSelectionFences > 0 && selectionFenceGeneration === this.#selectionFenceGeneration) {
+			const predecessorAgentEnd =
+				deferredPredecessorAgentEnd ??
+				this.#claimDeferredAgentEndForContinuation(this.#reserveDeferredAgentEndForContinuation());
+			const precedingSelectionFence = this.#selectionFenceTail;
+			const deferredScheduling = precedingSelectionFence.then(() => {
+				try {
+					this.#scheduleAutoContinuePrompt(
+						generation,
+						requireUnfinishedWork,
+						resourceRunId,
+						selectionFenceGeneration,
+						predecessorAgentEnd,
+					);
+				} finally {
+					this.#endSelectionFenceDeferralTracking(selectionFenceGeneration);
+				}
+			});
+			this.#trackSelectionFenceDeferredContinuation(selectionFenceGeneration, deferredScheduling);
+			return;
+		}
+		const predecessorAgentEndHold = deferredPredecessorAgentEnd
+			? this.#restoreAndReserveDeferredAgentEndForContinuation(deferredPredecessorAgentEnd)
+			: this.#reserveDeferredAgentEndForContinuation();
+		void this.#schedulePostPromptTask(
+			async signal => {
+				try {
+					await this.#withSessionAdmission(
+						"prompt",
+						async () => {
+							await Promise.resolve();
+							if (signal.aborted) {
+								this.#logCompactionContinuationSkipped("auto_continue_prompt", "aborted_signal");
 								return;
 							}
-							logger.warn("Auto-compaction continuation busy reschedule budget exhausted; giving up", {
-								source: "auto_continue_prompt",
-								attempts: busyReschedules,
-								error: error.message,
-							});
-						}
-						this.#logCompactionContinuationError("auto_continue_prompt", error);
-					} finally {
-						if (!rescheduled) this.#releaseDeferredAgentEndContinuation(predecessorAgentEndHold);
-					}
-				},
-				{
-					delayMs,
-					generation: scheduledGeneration,
-					resourceRunId,
-					onSkip: () => {
+							if (this.#promptGeneration !== scheduledGeneration) {
+								this.#logCompactionContinuationSkipped("auto_continue_prompt", "generation_changed");
+								return;
+							}
+							if (!(await continuationAuthorized(signal))) return;
+							await this.#promptWithMessage(
+								{
+									role: "developer",
+									content: [{ type: "text", text: autoContinuePrompt }],
+									attribution: "agent",
+									timestamp: Date.now(),
+								},
+								autoContinuePrompt,
+								{
+									skipPostPromptRecoveryWait: true,
+									skipCompactionCheck: true,
+									predecessorAgentEndHold,
+									onFinalPreflight: ({ hasPendingNextTurnMessages }) =>
+										continuationAuthorized(signal, hasPendingNextTurnMessages),
+								},
+							);
+						},
+						signal,
+						continuationAdmission,
+						{ bypassSelectionFenceGeneration: selectionFenceGeneration },
+					);
+				} catch (error) {
+					if (signal.aborted) {
 						this.#logCompactionContinuationSkipped("auto_continue_prompt", "aborted_signal");
-						this.#releaseDeferredAgentEndContinuation(predecessorAgentEndHold);
-					},
+						return;
+					}
+					this.#logCompactionContinuationError("auto_continue_prompt", error);
+				} finally {
+					this.#releaseDeferredAgentEndContinuation(predecessorAgentEndHold);
+				}
+			},
+			{
+				delayMs: 0,
+				generation: scheduledGeneration,
+				resourceRunId,
+				selectionFenceGeneration,
+				onSkip: () => {
+					this.#logCompactionContinuationSkipped("auto_continue_prompt", "aborted_signal");
+					this.#releaseDeferredAgentEndContinuation(predecessorAgentEndHold);
 				},
-			);
-		};
-		scheduleAttempt();
+			},
+		);
 	}
 
 	async #cancelPostPromptTasks(): Promise<void> {
@@ -5273,6 +6264,7 @@ export class AgentSession {
 		this.#postPromptTasksAbortController.abort();
 		this.#postPromptTasksAbortController = new AbortController();
 		this.#postPromptTasks.clear();
+		this.#postPromptTaskSelectionFenceGenerations.clear();
 		this.#releaseDeferredAgentEndContinuations();
 		this.#resolveTtsrResume();
 		this.#resolvePostPromptTasks();
@@ -5309,6 +6301,19 @@ export class AgentSession {
 		}
 	}
 
+	/**
+	 * A selection's scoped idle drain must not wait on work parked behind its
+	 * own fence, but it still needs to yield to post-prompt work that predates
+	 * that fence. Otherwise the drain can repeatedly await already-settled
+	 * session work while a timer-backed predecessor task is starved.
+	 */
+	async #waitForPostPromptTasksBeforeSelectionFence(selectionFenceGeneration: number): Promise<void> {
+		const precedingTasks = [...this.#postPromptTasks].filter(
+			task => (this.#postPromptTaskSelectionFenceGenerations.get(task) ?? 0) < selectionFenceGeneration,
+		);
+		if (precedingTasks.length > 0) await Promise.allSettled(precedingTasks);
+	}
+
 	/** Get TTSR injection payload and clear pending injections. */
 	#getTtsrInjectionContent(): { content: string; rules: Rule[] } | undefined {
 		if (this.#pendingTtsrInjections.length === 0) return undefined;
@@ -5667,6 +6672,13 @@ export class AgentSession {
 		}
 	}
 
+	#isProvisionalStreamingToolEvent(event: AgentEvent): boolean {
+		if (event.type !== "message_update") return false;
+		const contentIndex = event.assistantMessageEvent.contentIndex ?? 0;
+		const block = event.message.role === "assistant" ? event.message.content[contentIndex] : undefined;
+		return block?.type === "toolCall" && this.#provisionalStreamingToolCallIds.has(block.id);
+	}
+
 	#streamingEditPrecachePending = new Set<string>();
 	async #preCacheFileAsync(resolvedPath: string): Promise<void> {
 		if (this.#streamingEditFileCache.has(resolvedPath)) return;
@@ -6013,7 +7025,16 @@ export class AgentSession {
 		try {
 			if (event.type === "agent_start") {
 				this.#turnIndex = 0;
-				await this.#extensionRunner.emit({ type: "agent_start" }, undefined, deliveryScope);
+				await this.#extensionRunner.emit(
+					{
+						type: "agent_start",
+						...(deliveryScope
+							? { sdkRunToken: this.#sdkRunTokensByAttemptScope.get(deliveryScope as AttemptScope) }
+							: {}),
+					},
+					undefined,
+					deliveryScope,
+				);
 			} else if (event.type === "agent_end") {
 				await this.#extensionRunner.emit(
 					{
@@ -6251,6 +7272,81 @@ export class AgentSession {
 		);
 	}
 
+	/**
+	 * Re-register the session's AsyncJobManager under the successor endpoint
+	 * id after a committed session-identity transition (newSession, fork,
+	 * handoff, branch, switchSession). Tool-side lineage bindings made after
+	 * the transition use the successor id; the process-global endpoint
+	 * registry must follow, otherwise AsyncJobManager.endpointIdOf() keeps
+	 * resolving the predecessor and a queued subagent resume can neither
+	 * resolve its lineage nor register its owned tuple (review thread P1).
+	 */
+	#asyncJobEndpointId(sessionId: string, sessionFile: string | undefined): string {
+		return deriveAsyncJobEndpointId(this.#asyncJobProviderSessionId, sessionId, sessionFile);
+	}
+
+	#assertJobManagerEndpointAdmission(successorSessionId: string, successorSessionFile: string | undefined): void {
+		const successorEndpointId = this.#asyncJobEndpointId(successorSessionId, successorSessionFile);
+		const ownManager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
+		const successorOwner = AsyncJobManager.forEndpoint(successorEndpointId);
+		if (ownManager && successorOwner !== undefined && successorOwner !== ownManager) {
+			throw new Error(
+				`Session identity transition rejected: endpoint "${successorEndpointId}" is owned by another live session's job manager.`,
+			);
+		}
+	}
+
+	#rekeyJobManagerForSessionIdentity(
+		previousSessionId: string,
+		previousSessionFile: string | undefined,
+		options: { retirePredecessorRegistrations?: boolean } = {},
+	): void {
+		const previousEndpointId = this.#asyncJobEndpointId(previousSessionId, previousSessionFile);
+		const currentEndpointId = this.#asyncJobEndpointId(
+			this.sessionManager.getSessionId(),
+			this.sessionManager.getSessionFile(),
+		);
+		const predecessorOwner = AsyncJobManager.forEndpoint(previousEndpointId);
+		// Rekey and retire ONLY when the predecessor key belongs to THIS
+		// session's manager (the session-owned manager, else the process-global
+		// fallback the session uses). A predecessor key held by a FOREIGN
+		// manager means another live session currently carries this id —
+		// neither the mapping nor the tuples keyed under it are ours to move
+		// or retire (review thread P1).
+		const ownManager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
+		if (predecessorOwner !== undefined && predecessorOwner !== ownManager) return;
+		if (predecessorOwner !== undefined) {
+			const rekeyed = AsyncJobManager.rekeyForEndpoint(previousEndpointId, currentEndpointId, predecessorOwner);
+			if (!rekeyed) {
+				// The successor endpoint is owned by a FOREIGN live manager. A
+				// silent no-op would leave THIS manager registered under the
+				// predecessor while tools resolve the successor to the foreign
+				// manager — jobs queried or registered in the wrong session and
+				// owned aborts losing their causal set — and retiring the
+				// predecessor tuples afterwards would destroy the registration
+				// evidence of this session's still-live owned work. Fail the
+				// transition: every caller routes throws into the existing
+				// rollback (discardPreparedNewSessionAfterFailure /
+				// restoreState) BEFORE any predecessor state is retired
+				// (review thread P1).
+				throw new Error(
+					`Session identity transition rejected: endpoint "${currentEndpointId}" is owned by another live session's job manager.`,
+				);
+			}
+		}
+		// Owned registrations created before the transition are keyed by the
+		// PREDECESSOR endpoint. The transitions settle/cancel the session's
+		// owned jobs before committing identity, so no live delivery boundary
+		// depends on them; leaving them behind leaks tuples that disposal (now
+		// keyed by the successor) can never retire, saturating the global
+		// registry across repeated transitions. Retire them as part of the
+		// rekey (review thread P2). A same-id transition (no-op rekey) keeps
+		// the session's own live tuples.
+		if (previousEndpointId !== currentEndpointId && options.retirePredecessorRegistrations !== false) {
+			retireOwnedRegistrationsForEndpoint(previousEndpointId);
+		}
+	}
+
 	#rekeyHindsightMemoryForCurrentSessionId(): void {
 		if (resolveMemoryBackendId(this.settings) !== "hindsight") return;
 
@@ -6322,7 +7418,13 @@ export class AgentSession {
 		await admissionClosed;
 		await this.#agentEndPublicationPromise;
 		await this.#queuedExtensionEvents;
-		this.#workflowGateEmitter?.fence?.();
+		// Drain the sidecar write order for the same reason the two queues above are
+		// drained: each entry writes under the native identity-bound state-file lock, so a
+		// still-queued write would run after the session that owns it is gone — releasing
+		// a lock whose owner no longer exists, and under `bun test --isolate` calling into
+		// the addon after the runtime tore down the context it was scheduled in. The chain
+		// is already failure-absorbing, so this only waits.
+		await this.#coordinatorPersistQueue;
 		this.#pendingBackgroundExchanges = [];
 		this.yieldQueue.clear();
 
@@ -6334,6 +7436,7 @@ export class AgentSession {
 		} catch (error) {
 			logger.warn("Failed to emit session_shutdown event", { error: String(error) });
 		}
+		this.#workflowGateEmitter?.fence?.();
 		this.#workflowGateEmitter = undefined;
 		this.#notifyWorkflowGateEmitterChanged(this.sessionId, undefined);
 		await this.#flushWorkerIntegrationAttempt();
@@ -6345,7 +7448,7 @@ export class AgentSession {
 		this.#cancelOwnAsyncJobs();
 		await Promise.allSettled(this.#deferredOwnerShutdownFinalizations);
 		const ownedAsyncManager = this.#ownedAsyncJobManager;
-		if (ownedAsyncManager) {
+		if (ownedAsyncManager && this.#disposeAsyncJobManager) {
 			const drained = await ownedAsyncManager.dispose({ timeoutMs: 3_000 });
 			const deliveryState = ownedAsyncManager.getDeliveryState();
 			if (drained === false && deliveryState) {
@@ -6400,6 +7503,7 @@ export class AgentSession {
 		await this.memoryBackend.dispose();
 		if (this.#workspaceTreeService) await this.#workspaceTreeService.dispose();
 		if (this.#networkPrewarmService) await this.#networkPrewarmService.dispose();
+		this.#modelRegistry.authStorage?.releaseCredentialScope(this.credentialSessionId);
 		await this.sessionManager.close();
 		this.#closeAllProviderSessions("dispose");
 		const hindsightState = this.getHindsightSessionState();
@@ -6514,24 +7618,58 @@ export class AgentSession {
 	}
 
 	/** Wait until streaming and session settlement work are fully settled. */
-	async waitForIdle(): Promise<void> {
+	/**
+	 * Wait until streaming and session settlement work are fully settled.
+	 *
+	 * The internal-only `ignoreSelectionFenceGeneration` is used exclusively by
+	 * `setDefaultModelSelection`'s mid-selection drain: the selection must not
+	 * wait on work parked behind its own (or a later) fence — its agent run,
+	 * recovery, and deferrals — because that work is waiting on the selection
+	 * itself (#4519). External callers observe everything.
+	 */
+	async waitForIdle(ignoreSelectionFenceGeneration?: number): Promise<void> {
 		while (true) {
-			await this.agent.waitForIdle();
-			await this.#waitForPostPromptRecovery();
-			await this.#waitForSessionSettlement();
+			if (ignoreSelectionFenceGeneration === undefined) {
+				await this.agent.waitForIdle();
+				await this.#waitForPostPromptRecovery();
+			} else {
+				await this.#waitForPostPromptTasksBeforeSelectionFence(ignoreSelectionFenceGeneration);
+			}
+			await this.#waitForSessionSettlement(ignoreSelectionFenceGeneration);
 			if (
 				!this.agent.state.isStreaming &&
 				!this.#retryPromise &&
 				!this.#ttsrResumePromise &&
 				!this.#postPromptTasksPromise &&
-				!this.#isSessionSettlementPending()
+				!this.#isSessionSettlementPending(ignoreSelectionFenceGeneration)
 			)
 				return;
 		}
 	}
 
+	/**
+	 * Deterministically await every in-flight agent-event handler (including the
+	 * synchronous canonical persistence each one performs) plus the durable
+	 * transcript flush, without waiting for a prompt/turn lifecycle.
+	 *
+	 * This is the explicit signal replacement for real-time settle sleeps after
+	 * externally emitted events (`agent.emitExternalEvent`): the dispatcher
+	 * increments `#agentEventHandlersInFlight` synchronously before this call can
+	 * observe it, and each handler decrements it in its `finally`, so the
+	 * settlement promise below resolves exactly when the last handler — and
+	 * therefore its `sessionManager.appendMessage`/`_persist` work — has finished.
+	 * `flush()` then queues deterministically behind the SessionManager persist
+	 * queue, so every seeded entry is canonical AND on disk before the caller
+	 * proceeds.
+	 */
+	async awaitSessionSettlement(): Promise<void> {
+		await this.awaitPendingContextTransformations();
+		await this.#waitForSessionSettlement();
+		await this.sessionManager.flush();
+	}
+
 	async drainAsyncJobDeliveriesForAcp(options?: { timeoutMs?: number }): Promise<boolean> {
-		const manager = AsyncJobManager.instance();
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		if (!manager) return false;
 		const ownerFilter = this.#agentId ? { ownerId: this.#agentId } : undefined;
 		const before = manager.getDeliveryState(ownerFilter);
@@ -6555,7 +7693,7 @@ export class AgentSession {
 	 * any remaining queued/delivering work is observable and can block mutation.
 	 */
 	getAsyncDeliveryStateForAcp(): { queued: number; delivering: boolean } {
-		const manager = AsyncJobManager.instance();
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		if (!manager) return { queued: 0, delivering: false };
 		const ownerFilter = this.#agentId ? { ownerId: this.#agentId } : undefined;
 		return manager.getDeliveryState(ownerFilter);
@@ -7113,9 +8251,15 @@ export class AgentSession {
 						activeSkillState: this.getActiveSkillState(),
 						sessionId: this.sessionManager.getSessionId(),
 					}),
+					() => this.getSessionAgentDir(),
 				),
 			),
 		);
+		// The object published into `agent.state.tools` — and therefore the object the
+		// agent loop actually dispatches to — is this guard wrapper, not the registry
+		// entry. A wrapper built from a proven built-in inherits that proof; one built
+		// from a custom, MCP, or extension tool inherits nothing.
+		if (this.#builtinToolIdentities.has(tool)) this.#builtinToolIdentities.add(wrapped);
 		if (!wrappersByVersion) {
 			wrappersByVersion = new Map();
 			this.#guardedToolWrapperCache.set(tool, wrappersByVersion);
@@ -7241,6 +8385,9 @@ export class AgentSession {
 		const refreshedTool = await this.#reloadSshTool();
 		if (refreshedTool) {
 			this.#toolRegistry.set(refreshedTool.name, refreshedTool);
+			// A reloaded built-in is a NEW object. Without this it would replace the proven
+			// one and every subsequent `ssh` call would be reported as `custom`.
+			this.#builtinToolIdentities.add(refreshedTool);
 		} else {
 			this.#toolRegistry.delete("ssh");
 			this.#selectedDiscoveredToolNames.delete("ssh");
@@ -7842,6 +8989,36 @@ export class AgentSession {
 		return this.#credentialSessionId ?? this.sessionId;
 	}
 
+	/** Pin one OAuth credential for this session scope and persist the minimal intent. */
+	async setCredentialPin(provider: string, selector: AuthCredentialSelector): Promise<void> {
+		const scopeId = this.credentialSessionId;
+		const authStorage = this.#modelRegistry.authStorage;
+		const target = authStorage.resolveOAuthPinTarget(provider, selector);
+		authStorage.setSessionCredentialSelector(scopeId, provider, target.canonicalSelector);
+		if (target.canonicalSelector.kind === "id" && !this.#credentialStoreIdentity) return;
+		this.sessionManager.appendCustomEntry("auth-credential-pin", {
+			v: 1,
+			scopeId,
+			provider,
+			pin: target.canonicalSelector,
+			...(target.canonicalSelector.kind === "id" && this.#credentialStoreIdentity
+				? { credentialStoreIdentity: this.#credentialStoreIdentity }
+				: {}),
+		});
+	}
+
+	/** Mask persistent/global selection for this session and restore AUTO ranking. */
+	async setCredentialAuto(provider: string): Promise<void> {
+		const scopeId = this.credentialSessionId;
+		this.#modelRegistry.authStorage.setSessionCredentialAuto(provider, scopeId);
+		this.sessionManager.appendCustomEntry("auth-credential-pin", {
+			v: 1,
+			scopeId,
+			provider,
+			pin: { auto: true },
+		});
+	}
+
 	/** Current session display name, if set */
 	get sessionName(): string | undefined {
 		return this.sessionManager.getSessionName();
@@ -7895,8 +9072,12 @@ export class AgentSession {
 	async invokeSkill(
 		name: string,
 		args = "",
-		options?: Pick<PromptOptions, "onPreflightAccepted" | "onPreflightAcceptCommit" | "onSkillPrepared">,
+		options?: Pick<
+			PromptOptions,
+			"onPreflightAccepted" | "onPreflightAcceptCommit" | "onSkillPrepared" | "preflightSignal"
+		>,
 	): Promise<{ name: string; path: string; args?: string; lineCount?: number }> {
+		if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
 		const skillName = name.trim();
 		if (!skillName) throw Object.assign(new Error("skill.invoke requires a skill name."), { code: "invalid_input" });
 		if (typeof args !== "string")
@@ -7908,18 +9089,24 @@ export class AgentSession {
 			throw Object.assign(new Error(`Skill ${skillName} was not found.${availableHint}`), { code: "invalid_input" });
 		}
 		const deepInterviewUserIntentEpoch = this.#claimDeepInterviewUserIntent();
-		const activation = await resolveSubskillActivationForSkillInvocation({
-			cwd: this.sessionManager.getCwd(),
-			sessionId: this.sessionId,
-			skillName: skill.name,
-			args,
-		});
-		const built = await buildSkillPromptMessage(skill, activation.cleanedArgs, {
-			subskillActivation: activation.activation,
-			subskillActivationSet: activation.activeSubskillsToPersist,
-			cwd: this.sessionManager.getCwd(),
-			sessionId: this.sessionId,
-		});
+		const activation = await awaitPromptInvocationPreflight(
+			resolveSubskillActivationForSkillInvocation({
+				cwd: this.sessionManager.getCwd(),
+				sessionId: this.sessionId,
+				skillName: skill.name,
+				args,
+			}),
+			options?.preflightSignal,
+		);
+		const built = await awaitPromptInvocationPreflight(
+			buildSkillPromptMessage(skill, activation.cleanedArgs, {
+				subskillActivation: activation.activation,
+				subskillActivationSet: activation.activeSubskillsToPersist,
+				cwd: this.sessionManager.getCwd(),
+				sessionId: this.sessionId,
+			}),
+			options?.preflightSignal,
+		);
 		const skillPromptMessage = {
 			customType: SKILL_PROMPT_MESSAGE_TYPE,
 			content: built.message,
@@ -7928,6 +9115,7 @@ export class AgentSession {
 			attribution: "user" as const,
 		};
 		this.#deepInterviewPreclaimedCustomInputEpochs.set(skillPromptMessage, deepInterviewUserIntentEpoch);
+		if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
 		options?.onSkillPrepared?.({
 			name: skill.name,
 			path: skill.filePath,
@@ -8161,6 +9349,11 @@ export class AgentSession {
 			const wrappedTool = wrapToolWithMetaNotice(createdAskTool as unknown as AgentTool);
 			askTool = this.#extensionRunner ? new ExtensionToolWrapper(wrappedTool, this.#extensionRunner) : wrappedTool;
 			this.#toolRegistry.set(askTool.name, askTool);
+			// Built here from the built-in `ask` descriptor rather than by the session
+			// builder, so its provenance has to be recorded here too. Only this
+			// construction path qualifies: an `ask` already in the registry is left alone,
+			// because whatever put it there owns its provenance.
+			this.#builtinToolIdentities.add(askTool);
 		}
 
 		try {
@@ -8609,6 +9802,8 @@ export class AgentSession {
 	 */
 	async prompt(text: string, options?: PromptOptions): Promise<void> {
 		this.#assertRecoveryHydrationPromoted();
+		const owner = this.#sessionAdmissionContext.getStore();
+		if (owner && !owner.released) throw this.#sessionAdmissionBusyError();
 		const expandPromptTemplates = options?.expandPromptTemplates ?? true;
 
 		if (expandPromptTemplates && text.startsWith("/skill:") && !options?.images?.length) {
@@ -8620,12 +9815,13 @@ export class AgentSession {
 					await this.invokeSkill(
 						invocation.skill.name,
 						invocation.args,
-						options?.onPreflightAccepted || options?.onPreflightAcceptCommit
+						options?.onPreflightAccepted || options?.onPreflightAcceptCommit || options?.preflightSignal
 							? {
 									...(options.onPreflightAccepted ? { onPreflightAccepted: options.onPreflightAccepted } : {}),
 									...(options.onPreflightAcceptCommit
 										? { onPreflightAcceptCommit: options.onPreflightAcceptCommit }
 										: {}),
+									...(options.preflightSignal ? { preflightSignal: options.preflightSignal } : {}),
 								}
 							: undefined,
 					);
@@ -8662,6 +9858,13 @@ export class AgentSession {
 		assertImagePlaceholdersHavePayload(expandedText, options?.images);
 		const workflowIntentDiff = options?.synthetic ? null : buildWorkflowIntentDiff(expandedText);
 		const claimsGenuineUserIntent = !options?.synthetic && options?.attribution !== "agent";
+		const admissionGeneration = this.#promptGeneration;
+		const admissionSignal = options?.preflightSignal
+			? AbortSignal.any([this.#promptPreflightAbortController.signal, options.preflightSignal])
+			: this.#promptPreflightAbortController.signal;
+		if (this.#pendingSelectionFences > 0) {
+			await awaitPromptInvocationPreflight(this.#selectionFenceTail, admissionSignal);
+		}
 		const deepInterviewUserIntentEpoch =
 			claimsGenuineUserIntent && !this.isStreaming ? this.#claimDeepInterviewUserIntent() : undefined;
 
@@ -8686,64 +9889,67 @@ export class AgentSession {
 			return;
 		}
 
-		const admissionGeneration = this.#promptGeneration;
-		const admissionSignal = this.#promptPreflightAbortController.signal;
-		await this.#withSessionAdmission("prompt", async admission => {
-			this.#throwIfPromptPreflightCancelled(admissionGeneration, admissionSignal);
-			if (workflowIntentDiff) {
-				this.sessionManager.appendCustomEntry(WORKFLOW_INTENT_DIFF_CUSTOM_TYPE, workflowIntentDiff);
-			}
+		await this.#withSessionAdmission(
+			"prompt",
+			async admission => {
+				this.#throwIfPromptPreflightCancelled(admissionGeneration, admissionSignal);
+				if (workflowIntentDiff) {
+					this.sessionManager.appendCustomEntry(WORKFLOW_INTENT_DIFF_CUSTOM_TYPE, workflowIntentDiff);
+				}
 
-			// Skip eager todo prelude when the user has already queued a directive
-			const hasPendingUserDirective = this.#toolChoiceQueue.inspect().includes("user-force");
-			const eagerTodoPrelude =
-				!options?.synthetic && !hasPendingUserDirective ? this.#createEagerTodoPrelude(expandedText) : undefined;
+				// Skip eager todo prelude when the user has already queued a directive
+				const hasPendingUserDirective = this.#toolChoiceQueue.inspect().includes("user-force");
+				const eagerTodoPrelude =
+					!options?.synthetic && !hasPendingUserDirective ? this.#createEagerTodoPrelude(expandedText) : undefined;
 
-			const userContent: (TextContent | ImageContent)[] = [{ type: "text", text: expandedText }];
-			if (options?.images) {
-				userContent.push(...options.images);
-			}
-
-			const promptAttribution = options?.attribution ?? (options?.synthetic ? "agent" : "user");
-			const message = options?.synthetic
-				? {
-						role: "developer" as const,
-						content: userContent,
-						attribution: promptAttribution,
-						timestamp: Date.now(),
-					}
-				: { role: "user" as const, content: userContent, attribution: promptAttribution, timestamp: Date.now() };
-			if (deepInterviewUserIntentEpoch !== undefined)
-				this.#deepInterviewGenuineUserMessageEpochs.set(message, deepInterviewUserIntentEpoch);
-			await this.refreshGjcSubskillTools();
+				const userContent: (TextContent | ImageContent)[] = [{ type: "text", text: expandedText }];
+				if (options?.images) {
+					userContent.push(...options.images);
+				}
 
-			if (eagerTodoPrelude?.toolChoice) {
-				this.#toolChoiceQueue.pushOnce(eagerTodoPrelude.toolChoice, {
-					label: "eager-todo",
-				});
-			}
+				const promptAttribution = options?.attribution ?? (options?.synthetic ? "agent" : "user");
+				const message = options?.synthetic
+					? {
+							role: "developer" as const,
+							content: userContent,
+							attribution: promptAttribution,
+							timestamp: Date.now(),
+						}
+					: { role: "user" as const, content: userContent, attribution: promptAttribution, timestamp: Date.now() };
+				if (deepInterviewUserIntentEpoch !== undefined)
+					this.#deepInterviewGenuineUserMessageEpochs.set(message, deepInterviewUserIntentEpoch);
+				await this.refreshGjcSubskillTools();
+
+				if (eagerTodoPrelude?.toolChoice) {
+					this.#toolChoiceQueue.pushOnce(eagerTodoPrelude.toolChoice, {
+						label: "eager-todo",
+					});
+				}
 
-			try {
-				await this.#promptWithMessage(message, expandedText, {
-					...options,
-					prependMessages: eagerTodoPrelude ? [eagerTodoPrelude.message] : undefined,
-					admissionLease: admission,
-					resetRetryReplaySafety: true,
-				});
-			} finally {
-				// Clean up residual eager-todo directive if the prompt never consumed it
-				// (e.g., compaction aborted, validation failed).
-				this.#toolChoiceQueue.removeByLabel("eager-todo");
-			}
-			if (!options?.synthetic) {
-				await this.#enforcePlanModeToolDecision();
-			}
-		});
+				try {
+					await this.#promptWithMessage(message, expandedText, {
+						...options,
+						prependMessages: eagerTodoPrelude ? [eagerTodoPrelude.message] : undefined,
+						admissionLease: admission,
+						resetRetryReplaySafety: true,
+					});
+				} finally {
+					// Clean up residual eager-todo directive if the prompt never consumed it
+					// (e.g., compaction aborted, validation failed).
+					this.#toolChoiceQueue.removeByLabel("eager-todo");
+				}
+				if (!options?.synthetic) {
+					await this.#enforcePlanModeToolDecision();
+				}
+			},
+			options?.preflightSignal,
+		);
 	}
 
 	async #syncSkillPromptActiveState(
 		message: Pick<CustomMessage<unknown>, "customType" | "details">,
 		active: boolean,
+		persistActiveState = true,
 	): Promise<void> {
 		if (message.customType !== SKILL_PROMPT_MESSAGE_TYPE) return;
 		const details = message.details;
@@ -8767,8 +9973,12 @@ export class AgentSession {
 		// initial mode-state + active row only when the skill is not already
 		// active, so the mutation guard and Stop hook engage immediately instead
 		// of relying on the skill prompt to run its own state-init steps.
-		if (active) {
-			await ensureWorkflowSkillActivationState({ cwd: this.sessionManager.getCwd(), skill, sessionId });
+		if (active && persistActiveState) {
+			await ensureWorkflowSkillActivationState({
+				cwd: this.sessionManager.getCwd(),
+				skill,
+				sessionId,
+			});
 			const subskillDetails = details as {
 				subskillActivation?: LoadedSubskillActivation;
 				subskillActivationSet?: LoadedSubskillActivation[];
@@ -8802,9 +10012,10 @@ export class AgentSession {
 	async #syncSkillPromptActiveStateSafely(
 		message: Pick<CustomMessage<unknown>, "customType" | "details">,
 		active: boolean,
+		persistActiveState = true,
 	): Promise<void> {
 		try {
-			await this.#syncSkillPromptActiveState(message, active);
+			await this.#syncSkillPromptActiveState(message, active, persistActiveState);
 		} catch {
 			// Skill HUD state is observational; a filesystem write failure must not
 			// interrupt the prompt turn it is visualizing. The native Stop hook still
@@ -8812,13 +10023,48 @@ export class AgentSession {
 		}
 	}
 
+	async #seedSkillPromptActiveStateSafely(
+		message: Pick<CustomMessage<unknown>, "customType" | "details">,
+	): Promise<WorkflowSkillActivationSeed | undefined> {
+		if (message.customType !== SKILL_PROMPT_MESSAGE_TYPE) return undefined;
+		const details = message.details;
+		if (!details || typeof details !== "object") return undefined;
+		const name = (details as { name?: unknown }).name;
+		if (typeof name !== "string" || !name.trim()) return undefined;
+		try {
+			const subskillDetails = details as {
+				subskillActivation?: LoadedSubskillActivation;
+				subskillActivationSet?: LoadedSubskillActivation[];
+			};
+			const activations = subskillDetails.subskillActivationSet?.length
+				? subskillDetails.subskillActivationSet
+				: subskillDetails.subskillActivation
+					? [subskillDetails.subskillActivation]
+					: [];
+			return await ensureWorkflowSkillActivationSeed({
+				cwd: this.sessionManager.getCwd(),
+				skill: name.trim(),
+				sessionId: this.sessionManager.getSessionId(),
+				activeSubskills: activations.length ? activations.map(toActiveSubskillEntry) : undefined,
+			});
+		} catch {
+			return undefined;
+		}
+	}
+
 	async promptCustomMessage<T = unknown>(
 		message: Pick<CustomMessage<T>, "customType" | "content" | "display" | "details" | "attribution">,
 		options?: Pick<
 			PromptOptions,
-			"streamingBehavior" | "toolChoice" | "followUpQueuePolicy" | "onPreflightAccepted" | "onPreflightAcceptCommit"
+			| "streamingBehavior"
+			| "toolChoice"
+			| "followUpQueuePolicy"
+			| "onPreflightAccepted"
+			| "onPreflightAcceptCommit"
+			| "preflightSignal"
 		>,
 	): Promise<void> {
+		if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
 		const textContent =
 			typeof message.content === "string"
 				? message.content
@@ -8849,31 +10095,61 @@ export class AgentSession {
 
 		const admissionGeneration = this.#promptGeneration;
 		const admissionSignal = this.#promptPreflightAbortController.signal;
-		await this.#withSessionAdmission("prompt", async admission => {
-			this.#throwIfPromptPreflightCancelled(admissionGeneration, admissionSignal);
-			const customMessage: CustomMessage<T> = {
-				role: "custom",
-				customType: message.customType,
-				content: message.content,
-				display: message.display,
-				details: message.details,
-				attribution: message.attribution ?? "agent",
-				timestamp: Date.now(),
-			};
-			if (deepInterviewUserIntentEpoch !== undefined)
-				this.#deepInterviewGenuineUserMessageEpochs.set(customMessage, deepInterviewUserIntentEpoch);
-
-			await this.#syncSkillPromptActiveStateSafely(customMessage, true);
-			try {
-				await this.#promptWithMessage(customMessage, textContent, {
-					...options,
-					admissionLease: admission,
-					resetRetryReplaySafety: true,
-				});
-			} finally {
-				await this.#syncSkillPromptActiveStateSafely(customMessage, false);
-			}
-		});
+		await this.#withSessionAdmission(
+			"prompt",
+			async admission => {
+				this.#throwIfPromptPreflightCancelled(admissionGeneration, admissionSignal);
+				if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
+				const customMessage: CustomMessage<T> = {
+					role: "custom",
+					customType: message.customType,
+					content: message.content,
+					display: message.display,
+					details: message.details,
+					attribution: message.attribution ?? "agent",
+					timestamp: Date.now(),
+				};
+				if (deepInterviewUserIntentEpoch !== undefined)
+					this.#deepInterviewGenuineUserMessageEpochs.set(customMessage, deepInterviewUserIntentEpoch);
+
+				let activationSeed: WorkflowSkillActivationSeed | undefined;
+				let preflightCancelled = false;
+				let durableAcceptanceCompleted = false;
+				const commitAcceptance = async () => {
+					activationSeed = await this.#seedSkillPromptActiveStateSafely(customMessage);
+					await this.#syncSkillPromptActiveStateSafely(customMessage, true, activationSeed?.seeded !== true);
+					if (options?.preflightSignal?.aborted) {
+						await activationSeed?.rollback();
+						throw promptPreflightCancelledError();
+					}
+					if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
+					else options?.onPreflightAccepted?.();
+					durableAcceptanceCompleted = true;
+					if (options?.preflightSignal?.aborted) {
+						await activationSeed?.rollback();
+						throw promptPreflightCancelledError();
+					}
+				};
+				try {
+					await this.#promptWithMessage(customMessage, textContent, {
+						...options,
+						onPreflightAccepted: undefined,
+						onPreflightAcceptCommit: commitAcceptance,
+						admissionLease: admission,
+						resetRetryReplaySafety: true,
+					});
+				} catch (error) {
+					if (isPromptPreflightCancelledError(error) || !durableAcceptanceCompleted) {
+						preflightCancelled = true;
+						await activationSeed?.rollback();
+					}
+					throw error;
+				} finally {
+					if (!preflightCancelled) await this.#syncSkillPromptActiveStateSafely(customMessage, false);
+				}
+			},
+			options?.preflightSignal,
+		);
 	}
 
 	async #promptWithMessage(
@@ -8881,7 +10157,12 @@ export class AgentSession {
 		expandedText: string,
 		options?: Pick<
 			PromptOptions,
-			"toolChoice" | "images" | "skipCompactionCheck" | "onPreflightAccepted" | "onPreflightAcceptCommit"
+			| "toolChoice"
+			| "images"
+			| "skipCompactionCheck"
+			| "onPreflightAccepted"
+			| "onPreflightAcceptCommit"
+			| "preflightSignal"
 		> & {
 			prependMessages?: AgentMessage[];
 			skipPostPromptRecoveryWait?: boolean;
@@ -8893,16 +10174,59 @@ export class AgentSession {
 		},
 	): Promise<void> {
 		this.#assertNoHandoffTransition();
-		await this.#agentEndPublicationPromise;
+		if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
+		await awaitPromptInvocationPreflight(this.#agentEndPublicationPromise, options?.preflightSignal);
 		// Re-check after the publication await: a handoff can engage during that
 		// window, and #beginInFlight below would otherwise start a turn against the
 		// session being handed off.
 		this.#assertNoHandoffTransition();
 		this.#beginInFlight();
+		// Discard hidden next-turn successors queued by a PREVIOUS turn that a
+		// terminal abort closed. This must run BEFORE the admission bump below:
+		// once the new root turn advances the epoch, the fence lookup can no
+		// longer find the aborted turn's scope, and the pending messages would
+		// otherwise be injected into this new prompt (review thread P2).
+		if (this.#pendingNextTurnMessages.length > 0 && this.#isTurnContinuationBlocked()) {
+			// Discard only TURN-origin hidden successors of the fenced attempt;
+			// external/background next-turn context (extension triggers,
+			// autoresearch) must survive (review thread P2). AUTHORIZED
+			// owned-completion envelopes are preserved too: a monitor
+			// notification queued via the deferred path (default origin "turn")
+			// is an authorized completion from work left running by a PRIOR
+			// scope:"turn" abort and must still reach followUp/prompt (review
+			// thread P1).
+			this.#pendingNextTurnMessages = this.#pendingNextTurnMessages.filter(
+				entry => entry.origin !== "turn" || ownedCompletionResumeAction(entry.message as never) !== "ordinary",
+			);
+		}
+		// NEW ROOT TURN: advance the attempt epoch before minting the lineage so
+		// consecutive non-aborted turns never share (lineageIdHash, epoch). A
+		// terminal abort of turn B must never capture turn A's left-running
+		// owned work, and turn A's completion must never classify as a resume of
+		// B. Same-turn continuations (auto-continue/retry, resetRetryReplaySafety
+		// unset) keep the turn's epoch and lineage.
+		if (options?.resetRetryReplaySafety) {
+			this.#promptGeneration++;
+			this.#promptPreflightAbortController.abort();
+			this.#promptPreflightAbortController = new AbortController();
+		}
 		const predecessorAgentEndHold =
 			options?.predecessorAgentEndHold ?? this.#reserveDeferredAgentEndForContinuation();
 		const generation = this.#promptGeneration;
-		const preflightSignal = this.#promptPreflightAbortController.signal;
+		// Mint the immutable lineage identity for this prompt turn before the
+		// model runs; beforeToolCall attaches this lineage + attempt epoch to
+		// each tool call id so background registrations can be classified by
+		// source later (terminal-abort owned-completion vs turn-continuation).
+		this.#turnLineageIdHash = mintTurnLineageIdHash(
+			this.sessionManager.getSessionId?.() ?? "local",
+			generation,
+			this.#terminalLineageSecret,
+		);
+
+		const sessionPreflightSignal = this.#promptPreflightAbortController.signal;
+		const preflightSignal = options?.preflightSignal
+			? AbortSignal.any([sessionPreflightSignal, options.preflightSignal])
+			: sessionPreflightSignal;
 		const rosterClaim = this.#claimIrcRosterCandidate();
 		let hasPendingNextTurnMessages = false;
 		let pendingNextTurnMessageCount = 0;
@@ -8949,7 +10273,7 @@ export class AgentSession {
 				await this.#checkEstimatedContextBeforePrompt([
 					...(options?.prependMessages ?? []),
 					message,
-					...this.#pendingNextTurnMessages,
+					...this.#pendingNextTurnMessages.map(entry => entry.message),
 				]);
 			}
 
@@ -9108,8 +10432,14 @@ export class AgentSession {
 				messages.push(message);
 
 				// Re-present captured pending next-turn messages (never drained here).
-				for (const msg of this.#pendingNextTurnMessages.slice(0, pendingNextTurnMessageCount)) {
-					messages.push(msg);
+				// Reclassify deferred envelopes before injecting them into the new
+				// root turn: a monitor notification queued during/after a scope:"owned"
+				// abort must be dropped (and fresh ones allocate a fresh lineage)
+				// even though the deferred queueing path never ran the classifier
+				// (review thread P1).
+				for (const entry of this.#pendingNextTurnMessages.slice(0, pendingNextTurnMessageCount)) {
+					if (ownedCompletionResumeAction(entry.message as never) === "drop") continue;
+					messages.push(entry.message);
 				}
 				messages.push(...fileMentionMessages);
 				if (hindsightRecall) {
@@ -9153,6 +10483,15 @@ export class AgentSession {
 					attemptMessages = undefined;
 				},
 			};
+			// Abort can race asynchronous preflight work. The injection signatures were
+			// consumed while building context, but no prompt was accepted, so reset them.
+			if (this.#isPromptPreflightCancelled(generation, preflightSignal) || options?.preflightSignal?.aborted) {
+				this.#resetInjectedContextSignatures();
+				// Ack-waiting callers are told the preflight never ran; direct callers
+				// (aborted after setup) resolve gracefully as before f24f46ff5.
+				if (options?.onPreflightAccepted || options?.onPreflightAcceptCommit) throw promptPreflightCancelledError();
+				return;
+			}
 
 			const agentPromptOptions = {
 				...(options?.toolChoice ? { toolChoice: options.toolChoice } : undefined),
@@ -9168,11 +10507,20 @@ export class AgentSession {
 						this.getHindsightSessionState()?.markRecallSnippetInjected(hindsightRecall);
 					}
 					if (pendingNextTurnMessageCount > 0) {
+						// The captured prefix is consumed here whether its entries were
+						// injected or dropped. Settle every owned envelope at this
+						// consumption boundary; the helper retains registrations whose
+						// jobs are still running, while non-persistent monitor jobs
+						// already cancelled after delivery cannot produce another
+						// settlement (review thread P2).
+						const consumedPrefix = this.#pendingNextTurnMessages.slice(0, pendingNextTurnMessageCount);
+						this.#settleDeliveredOwnedRegistrations(consumedPrefix.map(entry => entry.message));
 						this.#pendingNextTurnMessages.splice(0, pendingNextTurnMessageCount);
 					}
 					if (this.#cancelAndSubmitInProgress) this.#cancelAndSubmitPendingNextTurnDrained = true;
 				},
 			};
+
 			await this.#promptAgentWithIdleRetry(preSubmit, agentPromptOptions, predecessorAgentEndHold, {
 				signal: preflightSignal,
 				resourceRunId: this.#runResourceLeaseContext.getStore()?.resourceRunId,
@@ -9457,15 +10805,21 @@ export class AgentSession {
 	async #queueSteer(
 		text: string,
 		images?: ImageContent[],
-		options?: { claimsGenuineUserIntent?: boolean },
+		options?: { claimsGenuineUserIntent?: boolean; onPromoted?: () => void; external?: boolean },
 	): Promise<void> {
 		this.#assertNoHandoffTransition();
 		assertImagePlaceholdersHavePayload(text, images);
 		const displayText = text || (images && images.length > 0 ? "[Image]" : "");
-		this.#steeringMessages.push(this.#createQueuedDisplayEntry(displayText));
+		const displayEntry = this.#createQueuedDisplayEntry(displayText);
+		this.#steeringMessages.push(displayEntry);
 		const content: (TextContent | ImageContent)[] = [{ type: "text", text }];
 		if (images && images.length > 0) content.push(...images);
 		const message = { role: "user" as const, content, attribution: "user" as const, timestamp: Date.now() };
+		if (options?.external) {
+			this.#externalSteerMessages.add(message);
+			this.#externalSteerAdmissionSeq.set(message, ++this.#steeringAdmissionSeq);
+			if (options.onPromoted) this.#steerPromotionHooks.set(message, options.onPromoted);
+		}
 		if (options?.claimsGenuineUserIntent) {
 			const epoch = this.#claimDeepInterviewUserIntent();
 			this.#deepInterviewGenuineUserMessageEpochs.set(message, epoch);
@@ -9482,6 +10836,7 @@ export class AgentSession {
 		if (!this.#cancelAndSubmitInProgress && this.#canAutoContinueForSteer()) {
 			this.#scheduleAgentContinue({
 				shouldContinue: () => this.#canAutoContinueForSteer() && this.agent.hasQueuedSteering(),
+				rescheduleOnBusy: true,
 				continueQueuedOnly: true,
 			});
 		}
@@ -9493,29 +10848,95 @@ export class AgentSession {
 	async #queueFollowUp(
 		text: string,
 		images?: ImageContent[],
-		options?: { forceOneAtATime?: boolean; claimsGenuineUserIntent?: boolean },
-	): Promise<void> {
+		options?: {
+			forceOneAtATime?: boolean;
+			claimsGenuineUserIntent?: boolean;
+			onPromoted?: () => void;
+			sdkRunToken?: string;
+		},
+	): Promise<QueuedFollowUpOwner> {
 		this.#assertNoHandoffTransition();
 		assertImagePlaceholdersHavePayload(text, images);
 		const displayText = text || (images && images.length > 0 ? "[Image]" : "");
-		this.#followUpMessages.push(this.#createQueuedDisplayEntry(displayText));
+		const queueWasEmpty = !this.agent.hasQueuedMessages();
+		const displayEntry = this.#createQueuedDisplayEntry(displayText);
+		this.#followUpMessages.push(displayEntry);
 		const content: (TextContent | ImageContent)[] = [{ type: "text", text }];
 		if (images && images.length > 0) content.push(...images);
 		const message = { role: "user" as const, content, attribution: "user" as const, timestamp: Date.now() };
+		this.#externalFollowUps.add(message);
+		if (options?.onPromoted) this.#followUpPromotionHooks.set(message, options.onPromoted);
 		if (options?.claimsGenuineUserIntent) {
 			const epoch = this.#claimDeepInterviewUserIntent();
 			this.#deepInterviewGenuineUserMessageEpochs.set(message, epoch);
 		}
-		this.agent.followUp(message, options?.forceOneAtATime ? { forceOneAtATime: true } : undefined);
-		// When fully idle AND the session is in a resumable assistant-ended state,
-		// schedule an immediate continue so the queued follow-up is delivered
-		// without waiting for the next user turn. We gate on isStreaming (model
-		// actively producing), isRetrying (auto-retry backoff is sleeping between
-		// attempts, #retryPromise set), and the last message being assistant —
-		// agent.continue() only dequeues follow-ups from an assistant-ended state;
-		// resuming from user/toolResult state runs an extra model call on the
-		// stale prompt before draining the queue.
-		this.#scheduleQueuedFollowUpContinuation();
+		if (options?.sdkRunToken) this.#sdkRunTokensByQueuedMessage.set(message, options.sdkRunToken);
+		if (options?.sdkRunToken && (this.agent.state.isStreaming || this.agent.hasQueuedMessages())) {
+			this.#deferredSdkFollowUps.push(message);
+		} else {
+			this.agent.followUp(message, options?.forceOneAtATime ? { forceOneAtATime: true } : undefined);
+		}
+		// When this is the first queued message and the session is in a resumable
+		// assistant-ended state, schedule an immediate continue so it is delivered
+		// without waiting for the next user turn. A later accepted follow-up must
+		// not start unrelated queued work ahead of it, because that work has a
+		// different cancellation and terminal owner.
+		if (queueWasEmpty)
+			this.#scheduleQueuedFollowUpContinuation(() =>
+				this.agent.snapshotFollowUp().some(candidate => candidate === message),
+			);
+		return {
+			cancel: () => {
+				const deferredIndex = this.#deferredSdkFollowUps.indexOf(message);
+				let removed = false;
+				if (deferredIndex !== -1) {
+					this.#deferredSdkFollowUps.splice(deferredIndex, 1);
+					removed = true;
+				} else {
+					removed = this.agent.removeQueuedMessages(candidate => candidate === message).followUp > 0;
+					// This message was already released from the deferred queue; its
+					// scheduled continuation was cancelled before it started. No further
+					// agent_end may arrive to release the next deferred follow-up, so
+					// advance the queue here to keep the next accepted SDK request moving.
+					if (removed) this.#releaseDeferredSdkFollowUps();
+				}
+				if (removed) {
+					this.#followUpMessages = this.#followUpMessages.filter(entry => entry !== displayEntry);
+					this.#deepInterviewGenuineUserMessageEpochs.delete(message);
+					this.#sdkRunTokensByQueuedMessage.delete(message);
+					// A canceled follow-up is never promoted: release its
+					// promotion hook so the callback is not retained for the
+					// session lifetime (review thread P2).
+					this.#followUpPromotionHooks.delete(message);
+				}
+				return removed;
+			},
+		};
+	}
+	#releaseDeferredSdkFollowUps(): void {
+		// A deferred SDK follow-up must become the sole first message at the next
+		// acceptance so its run token is bound to the agent_start. Releasing it
+		// behind still-queued work reproduces the token-less mid-run consumption
+		// hazard, so wait for the queue to drain; the next agent_end retries.
+		if (this.agent.hasQueuedMessages()) return;
+		const message = this.#deferredSdkFollowUps.shift();
+		if (!message) return;
+		this.agent.followUp(message, { forceOneAtATime: true });
+		this.#scheduleAgentContinue({
+			shouldContinue: () => this.#canStartDeferredSdkFollowUp() && this.agent.hasQueuedMessages(),
+			rescheduleOnBusy: true,
+			continueQueuedOnly: true,
+		});
+	}
+	#canStartDeferredSdkFollowUp(): boolean {
+		if (this.agent.state.isStreaming) return false;
+		if (this.isCompacting) return false;
+		if (this.isBashRunning) return false;
+		if (this.isEvalRunning) return false;
+		if (this.isRetrying) return false;
+		const messages = this.agent.state.messages;
+		const last = messages[messages.length - 1];
+		return last?.role === "assistant" || last?.role === "bashExecution" || last?.role === "pythonExecution";
 	}
 
 	/**
@@ -9531,10 +10952,17 @@ export class AgentSession {
 		const last = messages[messages.length - 1];
 		return last?.role === "assistant" || last?.role === "bashExecution" || last?.role === "pythonExecution";
 	}
-	#scheduleQueuedFollowUpContinuation(): void {
-		if (!this.#cancelAndSubmitInProgress && this.#canAutoContinueForFollowUp() && this.agent.hasQueuedMessages()) {
+	#scheduleQueuedFollowUpContinuation(ownsQueuedMessage: (() => boolean) | undefined = undefined): void {
+		if (
+			!this.#cancelAndSubmitInProgress &&
+			this.#canAutoContinueForFollowUp() &&
+			this.agent.hasQueuedMessages() &&
+			(ownsQueuedMessage?.() ?? true)
+		) {
 			this.#scheduleAgentContinue({
-				shouldContinue: () => this.#canAutoContinueForFollowUp() && this.agent.hasQueuedMessages(),
+				shouldContinue: () =>
+					this.#canAutoContinueForFollowUp() && this.agent.hasQueuedMessages() && (ownsQueuedMessage?.() ?? true),
+				rescheduleOnBusy: true,
 				continueQueuedOnly: true,
 			});
 		}
@@ -9556,16 +10984,16 @@ export class AgentSession {
 	}
 
 	queueDeferredMessage(message: CustomMessage): void {
-		this.#queueHiddenNextTurnMessage(message, true);
+		this.#queueHiddenNextTurnMessage(message, true, "turn");
 	}
 
 	queueDeferredMessageForTests(message: CustomMessage, triggerTurn = true): void {
-		this.#queueHiddenNextTurnMessage(message, triggerTurn);
+		this.#queueHiddenNextTurnMessage(message, triggerTurn, "turn");
 	}
 
 	/** Read-only test seam for the hidden next-turn context queue. */
 	getPendingNextTurnMessagesForTests(): readonly CustomMessage[] {
-		return this.#pendingNextTurnMessages.slice();
+		return this.#pendingNextTurnMessages.map(entry => entry.message);
 	}
 
 	/** Test-only abort outcome override; undefined retains the production abort race. */
@@ -9573,12 +11001,16 @@ export class AgentSession {
 		this.#cancelAndSubmitAbortOutcomeProviderForTests = provider;
 	}
 
-	#queueHiddenNextTurnMessage(message: CustomMessage, triggerTurn: boolean): void {
+	#queueHiddenNextTurnMessage(
+		message: CustomMessage,
+		triggerTurn: boolean,
+		origin: "turn" | "external" = "external",
+	): void {
 		// A hidden next-turn message queued during a handoff transition would be
 		// dropped when the successor clears predecessor queues; reject it as busy so
 		// the caller can retry against the settled session.
 		this.#assertNoHandoffTransition();
-		this.#pendingNextTurnMessages.push(message);
+		this.#pendingNextTurnMessages.push({ message, origin });
 		if (!triggerTurn) return;
 		const generation = this.#promptGeneration;
 		if (this.#scheduledHiddenNextTurnGeneration === generation) {
@@ -9593,6 +11025,27 @@ export class AgentSession {
 				if (this.#pendingNextTurnMessages.length === 0) {
 					return;
 				}
+				// Terminal abort closed this turn's continuation fence: a hidden
+				// next-turn successor queued by the aborted turn must NOT start,
+				// even though the scheduler's generation check still passes
+				// (the abort preserves the epoch so the gate can find the scope).
+				if (this.#isTurnContinuationBlocked()) {
+					// Terminal abort closed this turn's continuation fence:
+					// DISCARD only the turn-origin hidden successors queued by the
+					// aborted turn so they cannot be drained into a later explicit
+					// prompt; external/background next-turn context survives
+					// (review thread P2). AUTHORIZED owned-completion envelopes
+					// survive too: a left-running owned job's completion queued
+					// via sendCustomMessage (default origin "turn") is a promised
+					// resume of the root worker, not a continuation of the aborted
+					// attempt, and #promptQueuedHiddenNextTurnMessages classifies
+					// it fresh (review thread P1).
+					this.#pendingNextTurnMessages = this.#pendingNextTurnMessages.filter(
+						entry =>
+							entry.origin !== "turn" || ownedCompletionResumeAction(entry.message as never) !== "ordinary",
+					);
+					return;
+				}
 				try {
 					await this.#promptQueuedHiddenNextTurnMessages();
 				} catch {
@@ -9617,12 +11070,47 @@ export class AgentSession {
 
 		const queuedMessages = [...this.#pendingNextTurnMessages];
 		this.#pendingNextTurnMessages = [];
-		const message = queuedMessages[queuedMessages.length - 1];
+		// Reclassify deferred envelopes at the drain boundary: a monitor
+		// notification queued via the deferAgentInitiatedTurns branch never ran
+		// ownedCompletionResumeAction at queue time, so a scope:"owned" abort
+		// that landed since may now classify the envelope as drop — drop it and
+		// allocate a fresh lineage for fresh envelopes (review thread P1).
+		const dropped: Array<{ message: CustomMessage }> = [];
+		const reclassified = queuedMessages.filter(entry => {
+			if (ownedCompletionResumeAction(entry.message as never) === "drop") {
+				dropped.push(entry);
+				return false;
+			}
+			return true;
+		});
+		// A reclassified drop (owned scope, terminal job) never reaches a
+		// follow-up/prompt boundary: settle its registrations here so the
+		// terminal tuple does not occupy the global registration and
+		// retained-policy capacities indefinitely (review thread P2).
+		if (dropped.length > 0) {
+			this.#settleDeliveredOwnedRegistrations(dropped.map(entry => entry.message));
+		}
+		if (reclassified.length === 0) {
+			return;
+		}
+		// Allocate a fresh root-turn lineage when the drained batch contains a
+		// fresh owned envelope OR an EXTERNAL hidden trigger: an external
+		// nextTurn message has no owned envelope, so without this it would
+		// reuse the previous turn's identical lineage+epoch and a later
+		// scope:"owned" abort of the external turn could capture the previous
+		// turn's jobs (review thread P1).
+		if (
+			reclassified.some(entry => ownedCompletionResumeAction(entry.message as never) === "fresh") ||
+			reclassified.some(entry => entry.origin === "external")
+		) {
+			this.#resumeFromOwnedCompletion();
+		}
+		const message = reclassified[reclassified.length - 1]?.message;
 		if (!message) {
 			return;
 		}
 
-		const prependMessages = queuedMessages.slice(0, -1);
+		const prependMessages = reclassified.slice(0, -1).map(entry => entry.message);
 		const textContent = this.#getCustomMessageTextContent(message);
 		await this.#syncSkillPromptActiveStateSafely(message, true);
 		try {
@@ -9631,13 +11119,47 @@ export class AgentSession {
 				skipPostPromptRecoveryWait: true,
 			});
 		} catch (error) {
-			this.#pendingNextTurnMessages = [...queuedMessages, ...this.#pendingNextTurnMessages];
+			// Requeue only the SURVIVING reclassified entries: a completion
+			// denied by scope:"owned" was settled (dropped) above and must
+			// never reach a later prompt — once its scope and now-unoccupied
+			// policy tombstone are evicted by the bounded registries, the
+			// restored external monitor message would classify as ordinary and
+			// breach the owned abort's zero-delivery guarantee (review thread
+			// P2).
+			this.#pendingNextTurnMessages = [...reclassified, ...this.#pendingNextTurnMessages];
 			throw error;
 		} finally {
 			await this.#syncSkillPromptActiveStateSafely(message, false);
 		}
 	}
 
+	/** Unregister owned-completion registrations once their delivery is settled
+	 *  (delivered as a fresh/ordinary turn or dropped by an owned scope) AND the
+	 *  underlying job is TERMINAL. A monitor notification reuses the still-running
+	 *  monitor's registration, so removing it after an intermediate notification
+	 *  would let a later scope:"owned" abort miss the monitor and make subsequent
+	 *  notifications lose their envelope (review thread P1). */
+	#settleDeliveredOwnedRegistrations(messages: AgentMessage[]): void {
+		// Use the SESSION-OWNED manager first: the process-global instance is
+		// the last-created session, so checking this session's delivery against
+		// another session's manager (which lacks the same local job id) would
+		// see job === undefined and remove a still-live registration (review
+		// thread P1).
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
+		for (const message of messages) {
+			const details = (message as { details?: { ownedCompletions?: OwnedCompletionEnvelope[] } }).details;
+			for (const envelope of details?.ownedCompletions ?? []) {
+				const job = manager?.getJob(envelope.registration.jobId);
+				const status = job?.generation === envelope.registration.jobGeneration ? job?.status : undefined;
+				// Evicted jobs have no live record (job === undefined); terminal
+				// statuses settle the registration.
+				if (job === undefined || status === "completed" || status === "cancelled" || status === "failed") {
+					unregisterOwnedRegistration(envelope.registration);
+				}
+			}
+		}
+	}
+
 	#getCustomMessageTextContent(message: Pick<CustomMessage, "content">): string {
 		if (typeof message.content === "string") {
 			return message.content;
@@ -9679,6 +11201,13 @@ export class AgentSession {
 			triggerTurn?: boolean;
 			deliverAs?: "steer" | "followUp" | "nextTurn";
 			followUpQueuePolicy?: "respect-mode" | "sequential";
+			/** INTERNAL trusted option: origin of a hidden next-turn message —
+			 *  "turn" (produced by the current turn's continuation machinery,
+			 *  purged by a terminal abort) or "external" (background producers,
+			 *  preserved). Extension sendMessage callers are classified
+			 *  "external" at the trusted bridge and never supply this bit
+			 *  (review thread P2). */
+			origin?: "turn" | "external";
 		},
 	): Promise<void> {
 		this.#assertRecoveryHydrationPromoted();
@@ -9703,7 +11232,7 @@ export class AgentSession {
 			// while an (auto-)handoff is unwinding it.
 			this.#assertNoHandoffTransition();
 			if (options?.deliverAs === "nextTurn") {
-				this.#queueHiddenNextTurnMessage(appMessage, options?.triggerTurn ?? false);
+				this.#queueHiddenNextTurnMessage(appMessage, options?.triggerTurn ?? false, options?.origin ?? "turn");
 				return;
 			}
 
@@ -9721,9 +11250,13 @@ export class AgentSession {
 		if (options?.deliverAs === "nextTurn") {
 			if (options?.triggerTurn) {
 				if (this.#clientBridge?.deferAgentInitiatedTurns && !this.#allowAcpAgentInitiatedTurns) {
-					this.#queueHiddenNextTurnMessage(appMessage, false);
+					this.#queueHiddenNextTurnMessage(appMessage, false, options?.origin ?? "turn");
 					return;
 				}
+				// Every direct idle admission is a NEW ROOT TURN: allocate a fresh
+				// lineage so the turn never remints the previous turn's identical
+				// lineage+epoch (review thread P1).
+				this.#resumeFromOwnedCompletion();
 				await this.#syncSkillPromptActiveStateSafely(appMessage, true);
 				try {
 					await this.#promptWithMessage(appMessage, this.#getCustomMessageTextContent(appMessage), {
@@ -9731,6 +11264,11 @@ export class AgentSession {
 					});
 				} finally {
 					await this.#syncSkillPromptActiveStateSafely(appMessage, false);
+					// The direct idle admission bypasses onFollowUpConsumed:
+					// settle any delivered owned-completion envelope so a
+					// terminal registration does not occupy the registry until
+					// saturation (review thread P2).
+					this.#settleDeliveredOwnedRegistrations([appMessage]);
 				}
 				return;
 			}
@@ -9752,6 +11290,27 @@ export class AgentSession {
 				this.#queueHiddenNextTurnMessage(appMessage, false);
 				return;
 			}
+			// Gate owned-completion deliveries at this IDLE boundary too: the
+			// monitor notification envelope must DROP for scope:"owned" (racing
+			// settlement) and allocate a FRESH lineage for scope:"turn" — the
+			// direct prompt path below bypasses the follow-up consumption
+			// classification (review thread P1).
+			const idleResumeAction = ownedCompletionResumeAction(appMessage as never);
+			if (idleResumeAction === "drop") {
+				// The notification is denied (owned scope) but its job may be
+				// terminal: settle the envelope's registrations before
+				// discarding it, otherwise the tuple occupies the global
+				// registration and retained-policy bounds indefinitely
+				// (review thread P2).
+				this.#settleDeliveredOwnedRegistrations([appMessage]);
+				return;
+			}
+			// Every direct idle admission is a NEW ROOT TURN: allocate a fresh
+			// lineage even for ordinary triggers (cron/extension). Without this,
+			// the turn would remint the previous turn's identical lineage+epoch
+			// and a later scope:"owned" abort could capture the earlier turn's
+			// unrelated jobs (review thread P1).
+			this.#resumeFromOwnedCompletion();
 			await this.#syncSkillPromptActiveStateSafely(appMessage, true);
 			try {
 				await this.#promptWithMessage(appMessage, this.#getCustomMessageTextContent(appMessage), {
@@ -9759,6 +11318,13 @@ export class AgentSession {
 				});
 			} finally {
 				await this.#syncSkillPromptActiveStateSafely(appMessage, false);
+				// The direct idle admission bypasses onFollowUpConsumed:
+				// settle any delivered owned-completion envelope so a terminal
+				// registration does not occupy the registry until saturation —
+				// a non-persistent monitor cancels right after its first line
+				// and enqueues no delivery that would settle it otherwise
+				// (review thread P2).
+				this.#settleDeliveredOwnedRegistrations([appMessage]);
 			}
 			return;
 		}
@@ -9786,13 +11352,13 @@ export class AgentSession {
 		}
 		const agentRemoved = this.agent.removeQueuedMessages(isMatch);
 		const beforeNext = this.#pendingNextTurnMessages.length;
-		for (const m of this.#pendingNextTurnMessages) {
-			if (predicate(m)) {
-				const tag = readPendingDisplayTag(m.details);
+		for (const entry of this.#pendingNextTurnMessages) {
+			if (predicate(entry.message)) {
+				const tag = readPendingDisplayTag(entry.message.details);
 				if (tag) removedTags.add(tag);
 			}
 		}
-		this.#pendingNextTurnMessages = this.#pendingNextTurnMessages.filter(m => !predicate(m));
+		this.#pendingNextTurnMessages = this.#pendingNextTurnMessages.filter(entry => !predicate(entry.message));
 		const pendingNextTurn = beforeNext - this.#pendingNextTurnMessages.length;
 		let displaySteering = 0;
 		let displayFollowUp = 0;
@@ -9825,11 +11391,26 @@ export class AgentSession {
 		content: string | (TextContent | ImageContent)[],
 		options?: {
 			deliverAs?: "steer" | "followUp";
+			/** Preserve a busy SDK dispatch as queued work across an admission fence. */
+			queuedAtDispatch?: boolean;
 			onPreflightAccepted?: () => void;
 			onPreflightAcceptCommit?: () => void | Promise<void>;
+			/** Fired when a queued submission (steering or follow-up) is promoted to its own run (SDK ownership correlation). */
+			onQueuedPromoted?: () => void;
+			preflightSignal?: AbortSignal;
+			sdkRunToken?: string;
 		},
 	): Promise<void> {
 		this.#assertRecoveryHydrationPromoted();
+		const owner = this.#sessionAdmissionContext.getStore();
+		if (owner && !owner.released) throw this.#sessionAdmissionBusyError();
+		this.#assertSessionAdmissionOpen();
+		if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
+		if (typeof content !== "string" && !Array.isArray(content)) {
+			throw Object.assign(new Error("sendUserMessage requires string or content-array content."), {
+				code: "invalid_input",
+			});
+		}
 		// Normalize content to text string + optional images
 		let text: string;
 		let images: ImageContent[] | undefined;
@@ -9850,38 +11431,145 @@ export class AgentSession {
 			if (images.length === 0) images = undefined;
 		}
 
-		if (options?.deliverAs === "followUp") {
-			if (options.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
-			await this.#queueFollowUp(text, images, { claimsGenuineUserIntent: true });
-			options.onPreflightAccepted?.();
-			return;
-		}
-		if (options?.deliverAs === "steer") {
-			if (options.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
-			await this.#queueSteer(text, images, { claimsGenuineUserIntent: true });
-			options.onPreflightAccepted?.();
-			return;
-		}
+		const admissionSignal = options?.preflightSignal
+			? AbortSignal.any([this.#promptPreflightAbortController.signal, options.preflightSignal])
+			: this.#promptPreflightAbortController.signal;
+		const preflightCancellationGeneration = this.#promptPreflightCancellationGeneration;
+		// Classify and reserve follow-up order synchronously, before any await
+		// (selection fence or durable acceptance): a follow-up dispatch that is
+		// not yet durably enqueued must already count as ahead, or a later plain
+		// prompt admitted through the same window would classify itself as fresh
+		// delivery/steering and overtake it. The reservation is released once
+		// the durable enqueue settles either way, so a rejected or cancelled
+		// acceptance leaves no phantom ordering behind.
+		const queuedPlainPrompt = options?.queuedAtDispatch === true && options.deliverAs === undefined;
+		const hasFollowUpAhead = (): boolean =>
+			this.#activeFollowUpReservationEpochs.size > 0 ||
+			this.agent.snapshotFollowUp().length > 0 ||
+			this.#deferredSdkFollowUps.length > 0;
+		const followUpAheadAtReservation = queuedPlainPrompt && hasFollowUpAhead();
+		const freshAtReservation =
+			queuedPlainPrompt &&
+			!followUpAheadAtReservation &&
+			!this.agent.state.isStreaming &&
+			!this.#canAutoContinueForSteer();
+		const deliverAs =
+			options?.deliverAs ??
+			(queuedPlainPrompt
+				? followUpAheadAtReservation
+					? "followUp"
+					: freshAtReservation
+						? undefined
+						: "steer"
+				: undefined);
+		const followUpReservationEpoch = deliverAs === "followUp" ? ++this.#followUpReservationEpoch : undefined;
+		if (followUpReservationEpoch !== undefined) {
+			this.#activeFollowUpReservationEpochs.add(followUpReservationEpoch);
+		}
+		const releaseFollowUpReservation = () => {
+			if (followUpReservationEpoch === undefined) return;
+			this.#activeFollowUpReservationEpochs.delete(followUpReservationEpoch);
+			const waiters = [...this.#followUpReservationDrainWaiters];
+			this.#followUpReservationDrainWaiters.clear();
+			for (const waiter of waiters) waiter();
+		};
+		try {
+			if (this.#pendingSelectionFences > 0) {
+				await awaitPromptInvocationPreflight(this.#selectionFenceTail, admissionSignal);
+			}
+			const assertPreflightStillOpen = () => {
+				this.#assertSessionAdmissionOpen();
+				if (
+					options?.preflightSignal?.aborted ||
+					this.#promptPreflightCancellationGeneration !== preflightCancellationGeneration
+				) {
+					throw promptPreflightCancelledError();
+				}
+			};
+			assertPreflightStillOpen();
+			if (deliverAs === "followUp") {
+				// Durable enqueue preserves reservation order: while an earlier
+				// follow-up dispatch is still between its reservation and its own
+				// durable enqueue, wait for those earlier reservations so this
+				// dispatch can never enqueue ahead of them.
+				if (followUpReservationEpoch !== undefined) {
+					await this.#waitForEarlierFollowUpReservations(
+						followUpReservationEpoch,
+						options?.preflightSignal,
+						admissionSignal,
+					);
+				}
+				if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
+				assertPreflightStillOpen();
+				const queuedFollowUp = await this.#queueFollowUp(text, images, {
+					claimsGenuineUserIntent: true,
+					forceOneAtATime: Boolean(options?.preflightSignal || options?.queuedAtDispatch),
+					onPromoted: options?.onQueuedPromoted,
+					sdkRunToken: options?.sdkRunToken,
+				});
+				const cancelQueuedFollowUp = () => queuedFollowUp.cancel();
+				options?.preflightSignal?.addEventListener("abort", cancelQueuedFollowUp, { once: true });
+				if (options?.preflightSignal?.aborted) cancelQueuedFollowUp();
+				options?.onPreflightAccepted?.();
+				return;
+			}
+			if (deliverAs === "steer") {
+				if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
+				assertPreflightStillOpen();
+				await this.#queueSteer(text, images, {
+					claimsGenuineUserIntent: true,
+					onPromoted: options?.onQueuedPromoted,
+					external: true,
+				});
+				options?.onPreflightAccepted?.();
+				return;
+			}
 
-		// No explicit delivery mode: only a live stream makes prompt() throw
-		// AgentBusyError, so queue the message as steering while streaming.
-		// Compaction is intentionally NOT diverted here: prompt() handles an
-		// in-flight compaction internally, and #queueSteer would otherwise park
-		// the message in the steering queue with no turn to consume it.
-		if (this.isStreaming) {
-			if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
-			await this.#queueSteer(text, images, { claimsGenuineUserIntent: true });
-			options?.onPreflightAccepted?.();
-			return;
-		}
+			// No explicit delivery mode: only a live stream makes prompt() throw
+			// AgentBusyError, so queue the message as steering while streaming.
+			// Compaction is intentionally NOT diverted here: prompt() handles an
+			// in-flight compaction internally, and #queueSteer would otherwise park
+			// the message in the steering queue with no turn to consume it.
+			if (this.isStreaming) {
+				if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
+				assertPreflightStillOpen();
+				await this.#queueSteer(text, images, {
+					claimsGenuineUserIntent: true,
+					onPromoted: options?.onQueuedPromoted,
+					external: true,
+				});
+				options?.onPreflightAccepted?.();
+				return;
+			}
 
-		// Use prompt() with expandPromptTemplates: false to skip command handling and template expansion
-		await this.prompt(text, {
-			expandPromptTemplates: false,
-			images,
-			onPreflightAccepted: options?.onPreflightAccepted,
-			onPreflightAcceptCommit: options?.onPreflightAcceptCommit,
-		});
+			// Use prompt() with expandPromptTemplates: false to skip command handling and template expansion
+			let queuedPromotionFired = false;
+			const fireQueuedPromotion = () => {
+				if (!freshAtReservation || queuedPromotionFired) return;
+				queuedPromotionFired = true;
+				options?.onQueuedPromoted?.();
+			};
+			await this.prompt(text, {
+				expandPromptTemplates: false,
+				images,
+				onPreflightAccepted: () => {
+					options?.onPreflightAccepted?.();
+					fireQueuedPromotion();
+				},
+				onPreflightAcceptCommit:
+					options?.onPreflightAcceptCommit || freshAtReservation
+						? async () => {
+								if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
+								else options?.onPreflightAccepted?.();
+								assertPreflightStillOpen();
+								fireQueuedPromotion();
+							}
+						: undefined,
+				preflightSignal: options?.preflightSignal,
+			});
+		} finally {
+			releaseFollowUpReservation();
+		}
 	}
 
 	/**
@@ -9893,6 +11581,7 @@ export class AgentSession {
 		const followUp = this.#followUpMessages.map(e => e.text);
 		this.#steeringMessages = [];
 		this.#followUpMessages = [];
+		this.#deferredSdkFollowUps = [];
 		this.agent.clearAllQueues();
 		return { steering, followUp };
 	}
@@ -10259,6 +11948,7 @@ export class AgentSession {
 		this.#markRetryReplayUnsafe();
 		this.abortRetry();
 		this.#promptGeneration++;
+		this.#promptPreflightCancellationGeneration++;
 		this.#promptPreflightAbortController.abort();
 		this.#promptPreflightAbortController = new AbortController();
 		this.#scheduledHiddenNextTurnGeneration = undefined;
@@ -10331,6 +12021,7 @@ export class AgentSession {
 					delayMs: 1,
 					generation: this.#promptGeneration,
 					shouldContinue: () => this.agent.hasQueuedSteering(),
+					rescheduleOnBusy: true,
 					continueQueuedOnly: true,
 				});
 			}
@@ -10361,20 +12052,370 @@ export class AgentSession {
 		if (outcome.kind === "error") throw outcome.cause;
 	}
 	/**
-	 * Abort a specific active prompt and prove whether its tracked resources settled.
+	 * Private terminal-abort seam: read the CURRENT turn's attempt epoch WITHOUT
+	 * interrupting it. Used to write the durable initial terminal marker BEFORE
+	 * any fence/stop effect (plan ordered step 4). Only the epoch is exposed —
+	 * never the opaque lineage handle — so no private origin metadata leaves the
+	 * session. Fails closed (undefined) when no active turn lineage exists.
+	 */
+	/**
+	 * Private terminal-abort seam: cancel a PENDING (not-yet-started) prompt
+	 * preflight. Aborting the preflight controller fires the captured admission
+	 * signal so #throwIfPromptPreflightCancelled throws and the pending prompt
+	 * never starts even if its SDK waiter was already settled; the controller is
+	 * reset for the next admission. No run handle exists for a preflight prompt.
+	 */
+	cancelPendingPreflightForTerminalAbort(): void {
+		this.#promptPreflightCancellationGeneration++;
+		this.#promptPreflightAbortController.abort();
+		this.#promptPreflightAbortController = new AbortController();
+	}
+	/**
+	 * Capture the steering admission snapshot at abort ADMISSION: the host
+	 * invokes this before its durable marker transaction, so client steering
+	 * admitted while the abort is in flight classifies as post-snapshot and is
+	 * preserved instead of being purged at the later abortPromptAndWait
+	 * (review thread P1). Snapshots are stored PER-ADMISSION in a per-turn
+	 * FIFO: the settlement of each admission consumes its own captured
+	 * sequence, so a later overlapping abort of the same turn can never
+	 * overwrite an earlier admission's snapshot and purge an already-accepted
+	 * steer (review thread P1).
+	 */
+	captureTerminalAbortSteeringSnapshot(): number | undefined {
+		if (this.#turnLineageIdHash === undefined) return undefined;
+		const key = `${this.#turnLineageIdHash}:${this.#promptGeneration}`;
+		const queue = this.#terminalAbortSteeringSnapshots.get(key) ?? [];
+		const token = ++this.#terminalAbortAdmissionSeq;
+		queue.push({ seq: this.#steeringAdmissionSeq, token });
+		this.#terminalAbortSteeringSnapshots.set(key, queue);
+		this.#terminalAbortSteeringSnapshotKeys.set(token, key);
+		return token;
+	}
+	/**
+	 * Discard a captured snapshot whose admission never settles (a durable
+	 * same-key replay, no-effect, conflict, or marker failure): the entry is
+	 * keyed to the CURRENT turn, which is where its admission captured it.
+	 * Removing by token keeps overlapping admissions' entries independent.
+	 */
+	/**
+	 * Rebind a captured snapshot to the CURRENT turn: the owner-mismatch
+	 * fall-through may terminalize the aborting requester's own turn that won
+	 * the race, while the token was captured under the other connection's
+	 * turn. The entry moves to the current turn's FIFO (retaining the original
+	 * admission sequence) so the settlement's purge classifies steering
+	 * admitted since admission as post-snapshot (review thread P1).
+	 */
+	rebindTerminalAbortSteeringSnapshot(token: number): void {
+		const capturedKey = this.#terminalAbortSteeringSnapshotKeys.get(token);
+		if (capturedKey === undefined) return;
+		if (this.#turnLineageIdHash === undefined) return;
+		const currentKey = `${this.#turnLineageIdHash}:${this.#promptGeneration}`;
+		if (capturedKey === currentKey) return;
+		const capturedQueue = this.#terminalAbortSteeringSnapshots.get(capturedKey);
+		const index = capturedQueue?.findIndex(entry => entry.token === token) ?? -1;
+		if (index < 0) return;
+		const [entry] = capturedQueue!.splice(index, 1);
+		if (capturedQueue!.length === 0) this.#terminalAbortSteeringSnapshots.delete(capturedKey);
+		const currentQueue = this.#terminalAbortSteeringSnapshots.get(currentKey) ?? [];
+		currentQueue.push(entry);
+		this.#terminalAbortSteeringSnapshots.set(currentKey, currentQueue);
+		this.#terminalAbortSteeringSnapshotKeys.set(token, currentKey);
+	}
+	discardTerminalAbortSteeringSnapshot(token: number): void {
+		const key = this.#terminalAbortSteeringSnapshotKeys.get(token);
+		if (!key) return;
+		this.#terminalAbortSteeringSnapshotKeys.delete(token);
+		const queue = this.#terminalAbortSteeringSnapshots.get(key);
+		if (!queue) return;
+		const index = queue.findIndex(entry => entry.token === token);
+		if (index >= 0) {
+			queue.splice(index, 1);
+			if (queue.length === 0) this.#terminalAbortSteeringSnapshots.delete(key);
+		}
+	}
+
+	getTerminalTurnEpoch(): number | undefined {
+		const lineageIdHash = this.#turnLineageIdHash;
+		if (!lineageIdHash) return undefined;
+		return this.#promptGeneration;
+	}
+	/**
+	 * Logical endpoint used to key owned-registration lineage bindings.
+	 * Subagents inherit the parent's AsyncJobManager, whose completion callback
+	 * resolves registrations via AsyncJobManager.endpointIdOf(manager); the
+	 * child's own sessionManager id is never registered under the manager, so
+	 * binding/registering under it would make the parent's lookup miss and
+	 * demote the completion to an ordinary follow-up — purgeable by a parent
+	 * terminal turn abort and outside owned-scope delivery denial (review
+	 * thread P1). The manager's registered endpoint (owned for a top-level
+	 * session, inherited for a child) is authoritative for both binding and
+	 * lookup.
 	 */
-	async abortPromptAndWait(handle: string, options: { graceMs: number }): Promise<RunSettlementProof> {
+	#ownedRegistrationEndpoint(): string {
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
+		return AsyncJobManager.endpointIdOf(manager) ?? this.sessionManager.getSessionId() ?? "local";
+	}
+	async abortPromptAndWait(
+		handle: string,
+		options: {
+			graceMs: number;
+			terminal?: { scope: "turn" | "owned"; expectedEpoch?: number; steeringSnapshotToken?: number };
+		},
+	): Promise<
+		RunSettlementProof & {
+			terminalScope?: { scopeId: string; abortedAttemptEpoch: number; lineageIdHash: string };
+		}
+	> {
+		let registeredScope: { scopeId: string; abortedAttemptEpoch: number; lineageIdHash: string } | undefined;
+		// The purge snapshot is consumed per-admission inside the terminal
+		// block; the rearm below (reachable only when a scope was registered,
+		// i.e. only after the purge ran) reads the same value.
+		let abortSteeringSnapshot: number | undefined;
+		if (options.terminal) {
+			// The terminal scope must be registered for the ABORTED turn's
+			// lineage, never a successor's. A new root turn advances the attempt
+			// epoch at admission, so when the caller captured the epoch before a
+			// durable claim and a successor won that window, the current epoch no
+			// longer matches — fail closed and never fence or purge the
+			// unrelated successor's queues (review thread P1). Callers that do
+			// not pass an expected epoch (direct seam users) retain the prior
+			// register-regardless behavior.
+			if (
+				options.terminal.expectedEpoch !== undefined &&
+				options.terminal.expectedEpoch !== this.#promptGeneration
+			) {
+				return { status: "unfenced", reason: "unknown_run", pending: [] };
+			}
+			const requestedSnapshotToken = options.terminal.steeringSnapshotToken;
+			const currentSnapshotKey =
+				this.#turnLineageIdHash === undefined ? undefined : `${this.#turnLineageIdHash}:${this.#promptGeneration}`;
+			if (requestedSnapshotToken !== undefined) {
+				const capturedKey = this.#terminalAbortSteeringSnapshotKeys.get(requestedSnapshotToken);
+				const capturedQueue = capturedKey ? this.#terminalAbortSteeringSnapshots.get(capturedKey) : undefined;
+				if (
+					capturedKey !== currentSnapshotKey ||
+					!capturedQueue?.some(entry => entry.token === requestedSnapshotToken)
+				) {
+					this.discardTerminalAbortSteeringSnapshot(requestedSnapshotToken);
+					return { status: "unfenced", reason: "unknown_run", pending: [] };
+				}
+			}
+			// Terminal abort (C04 mode:"terminal"): register and synchronously
+			// close the continuation fence for the current turn BEFORE the run is
+			// interrupted, so a later left-running owned completion classifies as
+			// owned-completion by exact source (lineage + attempt epoch). The
+			// owned-completion policy stays enabled for scope:"turn" — delivery
+			// intentionally resumes the agent — and disabled for scope:"owned".
+			// A missing lineage (no active turn) fails closed: no scope is
+			// registered, so nothing is attributed.
+			const lineageIdHash = this.#turnLineageIdHash;
+			if (lineageIdHash) {
+				const scope = registerTerminalTurnScope({
+					lineageIdHash,
+					promptAttemptEpoch: this.#promptGeneration,
+					ownedCompletionPolicy: options.terminal.scope === "owned" ? "disabled" : "enabled",
+				});
+				// Admission can fail closed (registry saturation): the abort
+				// proceeds without a scope, so nothing is attributed.
+				if (scope) {
+					registeredScope = {
+						scopeId: scope.scopeId,
+						abortedAttemptEpoch: scope.promptAttemptEpoch,
+						lineageIdHash: scope.lineageIdHash,
+					};
+				}
+				// Terminal abort blocks STEERING continuations of the aborted turn:
+				// purge steering queued just before the abort won (the loop can
+				// exit on the abort signal without polling it) so it cannot alter
+				// the next user turn (review thread P2). The follow-up queue is
+				// preserved — owned-completion resumes must still deliver.
+				const turnSnapshotKey = `${lineageIdHash}:${this.#promptGeneration}`;
+				const queuedTurnSnapshots = this.#terminalAbortSteeringSnapshots.get(turnSnapshotKey);
+				const snapshotIndex =
+					requestedSnapshotToken === undefined
+						? 0
+						: (queuedTurnSnapshots?.findIndex(entry => entry.token === requestedSnapshotToken) ?? -1);
+				const consumedSnapshot =
+					queuedTurnSnapshots && snapshotIndex >= 0 ? queuedTurnSnapshots.splice(snapshotIndex, 1)[0] : undefined;
+				if (consumedSnapshot) this.#terminalAbortSteeringSnapshotKeys.delete(consumedSnapshot.token);
+				abortSteeringSnapshot = consumedSnapshot?.seq ?? this.#steeringAdmissionSeq;
+				if (queuedTurnSnapshots?.length === 0) {
+					this.#terminalAbortSteeringSnapshots.delete(turnSnapshotKey);
+				}
+				const admittedAfterSnapshot = (message: AgentMessage): boolean =>
+					(this.#externalSteerAdmissionSeq.get(message) ?? 0) > (abortSteeringSnapshot ?? -1);
+				// Steering purge, STEERING queue only: the agent-wide removal
+				// would also wipe the follow-up queue, which owned-completion
+				// resumes must still deliver (review thread P1).
+				const steeringBeforePurge = this.agent.snapshotSteering();
+				this.agent.removeQueuedMessages(
+					message => !(this.#externalSteerMessages.has(message) && admittedAfterSnapshot(message)),
+					"steering",
+				);
+				// Keep the display list aligned with the ACTUAL purge decisions:
+				// preserved post-snapshot external steers stay visible and
+				// purged internal steers disappear — a stale entry would let the
+				// positional editing APIs remove a different preserved steer
+				// (review thread P2).
+				const steeringAfterPurge = new Set(this.agent.snapshotSteering());
+				const keptSteeringDisplays: QueuedDisplayEntry[] = [];
+				for (let displayIndex = 0; displayIndex < steeringBeforePurge.length; displayIndex++) {
+					if (steeringAfterPurge.has(steeringBeforePurge[displayIndex]!)) {
+						keptSteeringDisplays.push(this.#steeringMessages[displayIndex]!);
+					}
+				}
+				this.#steeringMessages = keptSteeringDisplays;
+
+				// Remove ORDINARY follow-ups queued for the aborted turn: the
+				// aborted loop exits without polling them, so a later unrelated
+				// prompt could drain and execute the supposedly-terminated turn's
+				// command. Only authorized owned-completion envelopes survive
+				// (review thread P1).
+				const followUpBeforePurge = this.agent.snapshotFollowUp();
+				this.agent.removeQueuedMessages(message => {
+					// An SDK/client follow-up independently requested the next
+					// root turn; it is not a continuation caused by the
+					// aborted turn.
+					if (this.#externalFollowUps.has(message)) return false;
+					// Preserve only envelopes that are CURRENTLY AUTHORIZED as
+					// owned completions (fresh or drop). The public
+					// sendMessage() accepts arbitrary details, so the mere
+					// presence of the ownedCompletions field is not authority —
+					// an envelope with no matching terminal scope classifies
+					// ordinary and must NOT survive the abort (review thread P2).
+					return ownedCompletionResumeAction(message as never) === "ordinary";
+				}, "followUp");
+				// Mirror the follow-up purge in the display list so stale entries
+				// cannot misalign the positional editing APIs (review thread P2).
+				const followUpAfterPurge = new Set(this.agent.snapshotFollowUp());
+				const keptFollowUpDisplays: QueuedDisplayEntry[] = [];
+				for (let displayIndex = 0; displayIndex < followUpBeforePurge.length; displayIndex++) {
+					if (followUpAfterPurge.has(followUpBeforePurge[displayIndex]!)) {
+						keptFollowUpDisplays.push(this.#followUpMessages[displayIndex]!);
+					}
+				}
+				this.#followUpMessages = keptFollowUpDisplays;
+			}
+			// Do NOT advance the attempt epoch here: the terminal scope must stay
+			// keyed to the aborted epoch so #isTurnContinuationBlocked (which
+			// looks up by the CURRENT #promptGeneration) still finds the closed
+			// fence for hidden-next-turn and other non-generation-guarded
+			// continuation paths. Fresh-turn allocation is the per-admission
+			// responsibility: every NEW ROOT TURN (#promptWithMessage with
+			// resetRetryReplaySafety) advances the epoch before minting, so the
+			// next turn after the abort gets a distinct (lineage, epoch) and is
+			// never captured by this scope (review thread P2).
+			this.#promptPreflightCancellationGeneration++;
+			this.#promptPreflightAbortController.abort();
+			this.#promptPreflightAbortController = new AbortController();
+		}
 		const aborted = this.#runCancellationDomains.abort(handle);
 		if (!aborted.ok) {
 			if (aborted.reason === "quarantined") {
-				return await this.agent.resourceLedger.waitForSettlement(handle, { graceMs: 0 });
+				return {
+					...(await this.agent.resourceLedger.waitForSettlement(handle, { graceMs: 0 })),
+					...(registeredScope ? { terminalScope: registeredScope } : {}),
+				};
 			}
-			return { status: "unfenced", reason: "unknown_run", pending: [] };
+			return {
+				status: "unfenced",
+				reason: "unknown_run",
+				pending: [],
+				...(registeredScope ? { terminalScope: registeredScope } : {}),
+			};
 		}
 		if (handle === this.agent.activeResourceRunId) this.agent.abort();
 		const proof = await this.agent.resourceLedger.waitForSettlement(handle, { graceMs: options.graceMs });
 		if (proof.status === "unfenced") this.agent.resourceLedger.quarantine(handle);
-		return proof;
+		// Rearm surviving owned-completion follow-ups once the abort has
+		// settled: the aborted loop exits before polling the follow-up queue,
+		// so preserving the envelopes alone leaves them stranded until an
+		// unrelated prompt. Schedule a continue so they are consumed as a
+		// fresh turn (review thread P1).
+		if (options.terminal && registeredScope) {
+			// Rearm ONLY envelopes the classifier marks fresh. A drop-classified
+			// envelope (a denied owned completion under scope:"owned") must never
+			// reach the model: purge it from the follow-up queue BEFORE the
+			// rearm's continue is scheduled, because the agent loop dequeues
+			// follow-ups DIRECTLY and consumes the whole queue at once — a
+			// denied envelope left queued alongside the fresh completion would
+			// otherwise be passed to #runLoop with it (review thread P1). The
+			// onFollowUpConsumed filter at agent.ts continue() is the second
+			// line of defense for any envelope queued in the window after this
+			// purge and before the dequeue.
+			const followUpSnapshot = this.agent.snapshotQueues();
+			const droppedFollowUps: AgentMessage[] = [];
+			const purgedFollowUps = followUpSnapshot.followUp.filter(message => {
+				if (ownedCompletionResumeAction(message as never) === "drop") {
+					droppedFollowUps.push(message);
+					return false;
+				}
+				return true;
+			});
+			if (droppedFollowUps.length > 0) {
+				this.agent.restoreQueues({ ...followUpSnapshot, followUp: purgedFollowUps });
+				// The denied completion is terminal; settle its registration so
+				// the tuple does not occupy global capacity while the fresh
+				// completion resumes (review thread P2).
+				this.#settleDeliveredOwnedRegistrations(droppedFollowUps);
+			}
+			const hasPreservedFollowUp = () =>
+				this.agent
+					.snapshotQueues()
+					.followUp.some(
+						message =>
+							ownedCompletionResumeAction(message as never) === "fresh" || this.#externalFollowUps.has(message),
+					);
+			// A preserved post-snapshot client steer is also an independent
+			// root-turn request: the abort exits the loop and never polls the
+			// steering queue, so without a rearm the accepted steer stays
+			// stranded until unrelated activity (review thread P1).
+			const hasPreservedSteering = (): boolean =>
+				this.agent
+					.snapshotQueues()
+					.steering.some(
+						message =>
+							this.#externalSteerMessages.has(message) &&
+							(this.#externalSteerAdmissionSeq.get(message) ?? 0) > (abortSteeringSnapshot ?? -1),
+					);
+			if (hasPreservedFollowUp() || hasPreservedSteering()) {
+				// ANY preserved follow-up or steer — an owned-completion resume,
+				// an independently requested external follow-up, or a
+				// post-snapshot client steer — needs a fresh lineage before its
+				// continue: without it the scheduled continuation runs under the
+				// aborted lineage+epoch and the terminal fence skips it as
+				// terminal_turn, stranding the preserved user request until
+				// unrelated activity. Minting the fresh lineage does not
+				// reclassify the external message as agent-initiated owned work;
+				// it only unbinds the new turn from the aborted attempt (review
+				// thread P1).
+				this.#resumeFromOwnedCompletion();
+				this.#scheduleAgentContinue({
+					delayMs: 1,
+					generation: this.#promptGeneration,
+					shouldContinue: () => hasPreservedFollowUp() || hasPreservedSteering(),
+					// The rearmed continuation must consume the queued steer inside
+					// the run acceptance (continueQueuedMessages) rather than
+					// dequeue it later via getSteeringMessages: a terminal abort
+					// leaves a non-assistant history tail (tool result), which
+					// would otherwise select Agent.continue() and accept the run
+					// with an empty consumedQueuedMessages payload, so
+					// #fireQueuedPromotionHooks never fires and the submitting
+					// connection is not recorded as an owner — its later terminal
+					// abort is rejected as an owner mismatch (review thread P1).
+					// The preserved messages are still re-verified by
+					// shouldContinue at continuation time, so a steer removed
+					// during the delay never fires a stale hook and a post-snapshot
+					// steer admitted during the delay is not missed.
+					continueQueuedOnly: true,
+					rescheduleOnBusy: true,
+				});
+			}
+		}
+		return {
+			...proof,
+			...(registeredScope ? { terminalScope: registeredScope } : {}),
+		};
 	}
 
 	/** Atomically interrupt the active run and make text the next prompt. */
@@ -10522,6 +12563,7 @@ export class AgentSession {
 							resetRetryReplaySafety: true,
 							onRunAccepted: () => {
 								runAccepted = true;
+								if (selected) this.#fireQueuedPromotionHooks([message]);
 								if (selected) {
 									this.#steeringMessages = this.#steeringMessages.filter(entry => entry !== selected.display);
 									this.#followUpMessages = this.#followUpMessages.filter(entry => entry !== selected.display);
@@ -10604,7 +12646,7 @@ export class AgentSession {
 			}
 		}
 
-		const manager = AsyncJobManager.instance();
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		const ownerId = this.#agentId;
 		const lease = manager && ownerId ? manager.beginOwnerSubagentShutdown(ownerId) : undefined;
 		if (manager && ownerId && !lease) {
@@ -10630,11 +12672,18 @@ export class AgentSession {
 			this.#rebindProviderSessionState(new Map());
 			this.agent.reset();
 			if (!options?.drop) await this.sessionManager.flush();
+			const noLeasePreviousSessionIdentity = this.sessionManager.getSessionId();
+			const noLeasePreviousSessionFile = this.sessionManager.getSessionFile();
 			const prepared = await this.sessionManager.prepareNewSession(options);
 			try {
 				// Last fallible gate while public getters still show the predecessor (#3138).
 				await initializeLocalRoot(this.#localProtocolOptions(prepared));
+				this.#assertJobManagerEndpointAdmission(prepared.sessionId, prepared.sessionFile);
 				this.sessionManager.commitPreparedNewSession(prepared);
+				// Endpoint identity committed to the successor: re-register the
+				// manager so post-transition lineage bindings resolve and owned
+				// aborts classify in the successor session (review thread P1).
+				this.#rekeyJobManagerForSessionIdentity(noLeasePreviousSessionIdentity, noLeasePreviousSessionFile);
 				await this.#runToolSessionTransitionCleanups();
 			} catch (error) {
 				throw await discardPreparedNewSessionAfterFailure(this.sessionManager, prepared, error);
@@ -10662,6 +12711,7 @@ export class AgentSession {
 		if (!manager) throw new Error("Owner subagent shutdown manager became unavailable.");
 		if (!ownerId) throw new Error("Owner subagent shutdown owner became unavailable.");
 		const previousSessionIdentity = this.sessionManager.getSessionId();
+		const previousSessionIdentityFile = this.sessionManager.getSessionFile();
 		try {
 			try {
 				manager.runOwnerProducerCleanupsStrict({ ownerId });
@@ -10704,7 +12754,12 @@ export class AgentSession {
 			try {
 				// Last fallible gate while public getters still show the predecessor (#3138).
 				await initializeLocalRoot(this.#localProtocolOptions(prepared));
+				this.#assertJobManagerEndpointAdmission(prepared.sessionId, prepared.sessionFile);
 				this.sessionManager.commitPreparedNewSession(prepared);
+				// Endpoint identity committed to the successor: re-register the
+				// manager so post-transition lineage bindings resolve and owned
+				// aborts classify in the successor session (review thread P1).
+				this.#rekeyJobManagerForSessionIdentity(previousSessionIdentity, previousSessionIdentityFile);
 				await this.#runToolSessionTransitionCleanups();
 			} catch (error) {
 				throw await discardPreparedNewSessionAfterFailure(this.sessionManager, prepared, error);
@@ -10879,6 +12934,7 @@ export class AgentSession {
 		try {
 			const previousSessionFile = this.sessionFile;
 			const previousWorkflowGateSessionId = this.sessionId;
+			const previousSessionIdentity = this.sessionManager.getSessionId();
 
 			// Emit session_before_switch event with reason "fork" (can be cancelled)
 			if (this.#extensionRunner?.hasHandlers("session_before_switch")) {
@@ -10915,6 +12971,7 @@ export class AgentSession {
 						getSessionId: () => forkedManager.getSessionId(),
 					});
 					await this.#settleOwnAsyncJobsBeforeArtifactRetirement();
+					this.#assertJobManagerEndpointAdmission(forkedManager.getSessionId(), forkedManager.getSessionFile());
 				} catch (error) {
 					const forkedFile = forkedManager.getSessionFile();
 					const cleanupErrors: unknown[] = [];
@@ -10945,6 +13002,7 @@ export class AgentSession {
 					throw error;
 				}
 				this.sessionManager = forkedManager;
+				this.#rekeyJobManagerForSessionIdentity(previousSessionIdentity, previousSessionFile);
 				try {
 					await previousManager.close();
 				} catch (error) {
@@ -10961,7 +13019,11 @@ export class AgentSession {
 				try {
 					await initializeLocalRoot(this.#localProtocolOptions(prepared));
 					await this.#settleOwnAsyncJobsBeforeArtifactRetirement();
+					this.#assertJobManagerEndpointAdmission(prepared.sessionId, prepared.sessionFile);
 					this.sessionManager.commitPreparedNewSession(prepared);
+					// Fork commits a successor endpoint identity; re-register the
+					// manager under it (review thread P1).
+					this.#rekeyJobManagerForSessionIdentity(previousSessionIdentity, previousSessionFile);
 					await this.#runToolSessionTransitionCleanups();
 				} catch (error) {
 					throw await discardPreparedNewSessionAfterFailure(this.sessionManager, prepared, error);
@@ -11062,6 +13124,27 @@ export class AgentSession {
 		return this.#activeModelProfile;
 	}
 
+	/**
+	 * Re-apply vendor-separated delegation after a profile activation changed the
+	 * role layer. `eagerTasks` is resolved at prompt build time, but under
+	 * `tools.discoveryMode: all` the `task` tool is hidden until something
+	 * activates it, and the delegation directive stays behind its
+	 * `has tools "task"` guard. Activating a vendor-separated profile mid-session
+	 * must therefore reach the live tool set, not just the next session.
+	 */
+	async syncEagerDelegation(): Promise<void> {
+		const { eagerTasks } = resolveEagerTaskDelegation({
+			settings: this.settings,
+			profile: this.#activeModelProfile
+				? this.#modelRegistry.getModelProfile?.(this.#activeModelProfile)
+				: undefined,
+		});
+		if (eagerTasks && this.#toolRegistry.has("task") && !this.getActiveToolNames().includes("task")) {
+			await this.activateDiscoveredTools(["task"]);
+		}
+		await this.refreshBaseSystemPrompt();
+	}
+
 	/** Resolver intent only for assignments owned by the active profile. */
 	#persistedModelProfileAliasIntent(role: string): { aliasIntent: "preset-equivalent" } | undefined {
 		if (!this.#activeModelProfile) return undefined;
@@ -11209,11 +13292,10 @@ export class AgentSession {
 			onAfterActivation?: () => void;
 		},
 	): Promise<{ changed: boolean; id: string }> {
+		// Do not hold selection admission while waiting for a scheduled continuation:
+		// the continuation may need prompt admission to settle the current turn.
+		await this.waitForIdle();
 		const canonicalName = await this.#withSessionAdmission("selection", async () => {
-			// A model-picker action must not alter an in-flight generation: wait
-			// for the current run to settle inside the admission before applying
-			// the profile, matching `setDefaultModelSelection`.
-			await this.waitForIdle();
 			const profiles = this.#modelRegistry.getModelProfiles();
 			let canonical: string;
 			try {
@@ -11300,10 +13382,10 @@ export class AgentSession {
 	 * profile activation and default-model selection.
 	 */
 	async withSdkControlMutation<T>(body: () => Promise<T>): Promise<T> {
+		// Waiting while selection owns admission deadlocks with a scheduled
+		// continuation queued behind it. Wait before acquiring the mutation lease.
+		await this.waitForIdle();
 		return this.#withSessionAdmission("selection", async () => {
-			// A config mutation can change the active model-role assignment. Do not
-			// alter an in-flight turn after its prompt admission lease has released.
-			await this.waitForIdle();
 			return await body();
 		});
 	}
@@ -11655,95 +13737,148 @@ export class AgentSession {
 			onAfterMutation?: () => void;
 		},
 	): Promise<DefaultModelSelectionResult> {
-		return this.#withSessionAdmission("selection", async () => {
-			options?.onBeforeMutation?.();
-			const expectedSessionId = this.sessionId;
-
-			if (thinkingLevel === ThinkingLevel.Inherit) {
-				throw new Error("Default model selection cannot inherit a thinking level");
-			}
-			const apiKey = await this.#modelRegistry.getApiKey(model, this.credentialSessionId);
-			if (!apiKey) {
-				throw new Error(`No API key for ${model.provider}/${model.id}`);
-			}
-			const resolvedLevel = resolveThinkingLevelForModel(model, thinkingLevel);
-			const effectiveLevel =
-				resolvedLevel ??
-				resolveThinkingLevelForModel(model, model.thinking?.defaultLevel ?? this.thinkingLevel) ??
-				ThinkingLevel.Off;
-			await this.waitForIdle();
-			await this.sessionManager.flush();
-			await this.#waitForAdmittedBaseSystemPromptRebuilds();
-			if (this.sessionId !== expectedSessionId) {
-				throw new Error("Session changed while selecting model");
-			}
-			const expectedMutationRevision = this.#defaultModelSelectionMutationRevision;
-			const preparedSystemPrompt = await this.#prepareDefaultModelSelectionPrompt(model);
-			if (this.sessionId !== expectedSessionId) {
-				throw new Error("Session changed while selecting model");
-			}
-			const stage = await this.sessionManager.stageDefaultModelSelection(
-				`${model.provider}/${model.id}`,
-				effectiveLevel,
-				{ appendThinkingLevel: true },
+		// Reserve the causal selection fence synchronously, before credential
+		// probing can yield. Later external prompts wait behind this operation,
+		// while an inherited post-prompt continuation may bypass the fence so
+		// waitForIdle never deadlocks waiting for prompt admission.
+		const owner = this.#sessionAdmissionContext.getStore();
+		if (owner && !owner.released) throw this.#sessionAdmissionBusyError();
+		if (this.#sessionAdmissionClosing || this.#sessionAdmissionClosed || this.#isDisposed) {
+			throw this.#sessionAdmissionBusyError();
+		}
+		if (thinkingLevel === ThinkingLevel.Inherit) {
+			throw new Error("Default model selection cannot inherit a thinking level");
+		}
+		const expectedSessionId = this.sessionId;
+		const priorSelectionFence = this.#selectionFenceTail;
+		const selectionFence = Promise.withResolvers<void>();
+		this.#selectionFenceGeneration += 1;
+		this.#pendingSelectionFences += 1;
+		const selectionFenceGeneration = this.#selectionFenceGeneration;
+		if (this.#oldestPendingSelectionFenceGeneration === 0) {
+			this.#oldestPendingSelectionFenceGeneration = selectionFenceGeneration;
+		}
+		this.#selectionFenceTail = priorSelectionFence.then(() => selectionFence.promise);
+		void this.#selectionFenceTail.catch(() => {});
+		try {
+			await priorSelectionFence;
+			const { effectiveLevel } = await this.#withSessionAdmission(
+				"selection",
+				async () => {
+					if (this.sessionId !== expectedSessionId) {
+						throw new Error("Session changed while selecting model");
+					}
+					const apiKey = await this.#modelRegistry.getApiKey(model, this.credentialSessionId);
+					if (this.sessionId !== expectedSessionId) {
+						throw new Error("Session changed while selecting model");
+					}
+					if (!apiKey) {
+						throw new Error(`No API key for ${model.provider}/${model.id}`);
+					}
+					const resolvedLevel = resolveThinkingLevelForModel(model, thinkingLevel);
+					return {
+						effectiveLevel:
+							resolvedLevel ??
+							resolveThinkingLevelForModel(model, model.thinking?.defaultLevel ?? this.thinkingLevel) ??
+							ThinkingLevel.Off,
+					};
+				},
+				undefined,
+				undefined,
+				{ allowDuringClosing: true },
 			);
-			let durableCommit: CasReceipt;
-			try {
-				const selector = formatModelSelectorValue(`${model.provider}/${model.id}`, effectiveLevel);
-				durableCommit = await this.settings.commitAtomicBatchWithCurrent(() => [
-					{ path: "modelRoles.default" as SettingPath, op: "set", value: selector },
-				]);
-			} catch (error) {
-				try {
-					await this.sessionManager.discardDefaultModelSelectionStage(stage);
-				} catch (cleanupError) {
-					throw new AggregateError(
-						[error, cleanupError],
-						"Default model selection persistence and staged session cleanup both failed.",
-					);
-				}
-				throw error;
-			}
-			if (this.#defaultModelSelectionMutationRevision !== expectedMutationRevision) {
-				await this.#throwDefaultModelSelectionRecovery(
-					new Error("Default model selection was superseded before session promotion"),
-					stage,
-					durableCommit,
-				);
-			}
-			const promotion = this.sessionManager.promoteDefaultModelSelection(stage);
-			switch (promotion.kind) {
-				case "promoted": {
-					this.#publishDefaultModelSelection(model, effectiveLevel, preparedSystemPrompt);
-					break;
-				}
-				case "not_promoted": {
-					return this.#throwDefaultModelSelectionRecovery(
-						promotion.error ?? new Error("Default model selection was superseded before session promotion"),
-						stage,
-						durableCommit,
+			await this.waitForIdle(selectionFenceGeneration);
+			return await this.#withSessionAdmission(
+				"selection",
+				async () => {
+					options?.onBeforeMutation?.();
+					if (this.sessionId !== expectedSessionId) {
+						throw new Error("Session changed while selecting model");
+					}
+					await this.sessionManager.flush();
+					await this.#waitForAdmittedBaseSystemPromptRebuilds();
+					if (this.sessionId !== expectedSessionId) {
+						throw new Error("Session changed while selecting model");
+					}
+					const expectedMutationRevision = this.#defaultModelSelectionMutationRevision;
+					const preparedSystemPrompt = await this.#prepareDefaultModelSelectionPrompt(model);
+					if (this.sessionId !== expectedSessionId) {
+						throw new Error("Session changed while selecting model");
+					}
+					const stage = await this.sessionManager.stageDefaultModelSelection(
+						`${model.provider}/${model.id}`,
+						effectiveLevel,
+						{ appendThinkingLevel: true },
 					);
-				}
-				case "unknown": {
-					const message = "Session replacement outcome could not be determined.";
-					throw new DefaultModelSelectionRecoveryError(message, {
-						message,
-						rollback: {
-							disposition: "unknown",
-							failures: [
-								{
-									stage: "session",
-									message: "Session replacement outcome could not be determined.",
+					let durableCommit: CasReceipt;
+					try {
+						const selector = formatModelSelectorValue(`${model.provider}/${model.id}`, effectiveLevel);
+						durableCommit = await this.settings.commitAtomicBatchWithCurrent(() => [
+							{ path: "modelRoles.default" as SettingPath, op: "set", value: selector },
+						]);
+					} catch (error) {
+						try {
+							await this.sessionManager.discardDefaultModelSelectionStage(stage);
+						} catch (cleanupError) {
+							throw new AggregateError(
+								[error, cleanupError],
+								"Default model selection persistence and staged session cleanup both failed.",
+							);
+						}
+						throw error;
+					}
+					if (this.#defaultModelSelectionMutationRevision !== expectedMutationRevision) {
+						await this.#throwDefaultModelSelectionRecovery(
+							new Error("Default model selection was superseded before session promotion"),
+							stage,
+							durableCommit,
+						);
+					}
+					const promotion = this.sessionManager.promoteDefaultModelSelection(stage);
+					switch (promotion.kind) {
+						case "promoted": {
+							this.#publishDefaultModelSelection(model, effectiveLevel, preparedSystemPrompt);
+							break;
+						}
+						case "not_promoted": {
+							return this.#throwDefaultModelSelectionRecovery(
+								promotion.error ?? new Error("Default model selection was superseded before session promotion"),
+								stage,
+								durableCommit,
+							);
+						}
+						case "unknown": {
+							const message = "Session replacement outcome could not be determined.";
+							throw new DefaultModelSelectionRecoveryError(message, {
+								message,
+								rollback: {
+									disposition: "unknown",
+									failures: [
+										{
+											stage: "session",
+											message: "Session replacement outcome could not be determined.",
+										},
+									],
 								},
-							],
-						},
-					});
-				}
+							});
+						}
+					}
+					this.#clearActiveModelProfileForConcreteDefault("user-selection");
+					options?.onAfterMutation?.();
+					return { provider: model.provider, modelId: model.id, thinkingLevel: effectiveLevel };
+				},
+				undefined,
+				undefined,
+				{ allowDuringClosing: true },
+			);
+		} finally {
+			selectionFence.resolve();
+			this.#pendingSelectionFences -= 1;
+			if (this.#oldestPendingSelectionFenceGeneration === selectionFenceGeneration) {
+				this.#oldestPendingSelectionFenceGeneration = 0;
 			}
-			this.#clearActiveModelProfileForConcreteDefault("user-selection");
-			options?.onAfterMutation?.();
-			return { provider: model.provider, modelId: model.id, thinkingLevel: effectiveLevel };
-		});
+			this.#resolveSessionSettlement();
+		}
 	}
 	/**
 	 * Cycle to next/previous model.
@@ -13185,9 +15320,13 @@ export class AgentSession {
 				// Last fallible action: verified local:// readiness from immutable staged options.
 				await initializeLocalRoot(this.#localProtocolOptions(prepared));
 				await this.#settleOwnAsyncJobsBeforeArtifactRetirement();
+				this.#assertJobManagerEndpointAdmission(prepared.sessionId, prepared.sessionFile);
 
 				// --- Commit boundary: synchronous adoption is the sole identity publication.
 				this.sessionManager.commitPreparedNewSession(prepared);
+				// Handoff commits a successor endpoint identity; re-register the
+				// manager under it (review thread P1).
+				this.#rekeyJobManagerForSessionIdentity(rollbackSessionState.sessionId, rollbackSessionState.sessionFile);
 				committed = true;
 				await this.#runToolSessionTransitionCleanups();
 				this.agent.reset();
@@ -15402,7 +17541,9 @@ export class AgentSession {
 				classification === "transient" ||
 				classification === "unknown" ||
 				classification === "first_event_timeout" ||
-				classification === "empty_response"
+				classification === "empty_response" ||
+				classification === "local_snapshot" ||
+				classification === "local_buffer_overflow"
 			);
 		}
 		const trigger = classifyFallbackTrigger(transportFailure ?? { status: message.errorStatus });
@@ -15422,7 +17563,13 @@ export class AgentSession {
 			return true;
 		}
 		const classification = this.#classifyErrorForRetry(message);
-		return classification === "transient" || classification === "unknown" || classification === "first_event_timeout";
+		return (
+			classification === "transient" ||
+			classification === "unknown" ||
+			classification === "first_event_timeout" ||
+			classification === "local_snapshot" ||
+			classification === "local_buffer_overflow"
+		);
 	}
 
 	#isTransientErrorMessage(errorMessage: string): boolean {
@@ -15512,10 +17659,20 @@ export class AgentSession {
 	#classifyErrorForRetry(message: AssistantMessage): RetryErrorClassification {
 		if (message.stopReason !== "error") return "none";
 		if (message.errorKind === "provider_safety_stop") return "terminal";
+		if (message.errorKind === "local_snapshot_failure") return "local_snapshot";
+		if (message.errorKind === "local_buffer_overflow") return "local_buffer_overflow";
 		if (this.#isTypedFirstEventTimeout(message)) return "first_event_timeout";
 		if (this.#isTypedEmptyResponse(message)) return "empty_response";
 		if (!message.errorMessage) return "none";
 		const err = message.errorMessage;
+		// Managed-attempt local failures from restored sessions may lack the
+		// typed error kind; match the stable message prefixes as a fallback.
+		if (err.startsWith("Managed fallback attempt could not produce a serializable event snapshot")) {
+			return "local_snapshot";
+		}
+		if (err.startsWith("Managed fallback attempt exceeded the provisional event buffer limit")) {
+			return "local_buffer_overflow";
+		}
 		// Provider safety refusals (e.g. Anthropic stop_reason "refusal" /
 		// "sensitive") are deterministic for the submitted context: replaying
 		// the identical conversation re-triggers the identical refusal, so an
@@ -15719,7 +17876,6 @@ export class AgentSession {
 	}
 
 	async #handleManagedAttemptOutcome(outcome: ManagedAttemptOutcome): Promise<ManagedAttemptDecision> {
-		if (outcome.type !== "escaped_arguments_discarded") this.#consecutiveEscapedArgumentRetries = 0;
 		if (outcome.type === "run_terminal") {
 			this.#defaultFallbackChain().resetAttemptBudget();
 			return { type: "terminal", terminal: { stopReason: outcome.reason } };
@@ -15727,24 +17883,12 @@ export class AgentSession {
 		if (outcome.type === "escaped_arguments_discarded") {
 			// An escaped-non-ASCII wire defect is a sampling accident, not provider
 			// evidence: never charge the attempt, advance the chain, or suppress the
-			// selector. The loop already removed the defective turn from history, so
-			// this decision just re-issues the same request on the same model.
-			//
-			// The retry bound lives HERE, not in the loop: a managed retry re-enters
-			// the loop as a fresh run, so no loop-local budget survives it. After
-			// MAX_ESCAPED_ARGUMENT_RETRIES consecutive escaped-argument discards the
-			// run terminates with an error instead of ping-ponging forever against a
-			// model that deterministically emits escaped arguments. The counter
-			// resets on any other outcome.
+			// selector. The loop already removed the defective turn from history and
+			// bounded its own resample budget, so this decision just re-issues the
+			// same request on the same model. Once the loop declines (budget spent),
+			// it falls through to the terminal per-call rejection, so the retry here
+			// is a continuation of the same logical run rather than a new prompt.
 			this.#defaultFallbackChain().discardStartedAttempt();
-			this.#consecutiveEscapedArgumentRetries++;
-			if (this.#consecutiveEscapedArgumentRetries > MAX_ESCAPED_ARGUMENT_RETRIES) {
-				this.#consecutiveEscapedArgumentRetries = 0;
-				return {
-					type: "terminal",
-					terminal: { stopReason: "error", messages: [outcome.message] },
-				};
-			}
 			return {
 				type: "retry",
 				continuation: async ownership => {
@@ -16039,12 +18183,50 @@ export class AgentSession {
 			this.settings.has("retry.maxRetries") ||
 			this.settings.has("retry.baseDelayMs") ||
 			this.settings.has("retry.maxDelayMs");
-		// retry.enabled=false always surfaces immediately, matching the explicit
-		// user opt-out.
-		if (!managedFallback && !retrySettings.enabled) return false;
 		const classification = this.#classifyErrorForRetry(message);
+		const localSnapshot = classification === "local_snapshot";
+		const localBufferOverflow = classification === "local_buffer_overflow";
+		// A local machinery failure must never stay charged against the provider
+		// fallback budget, no matter which local exit follows (disabled retry,
+		// visible-content surface, bounded retry, exhaustion, or the immediate
+		// buffer-overflow surface). Discard the started attempt's provisional
+		// charge up front; the discard is a no-op when no attempt is currently
+		// charged.
+		if ((localSnapshot || localBufferOverflow) && managedFallback) controller.discardStartedAttempt();
+		// Local snapshot/staging failures are deterministic for the retained
+		// producer shape. Re-streaming the same request only duplicates the same
+		// local defect (and, before #4578, amplified it three times). Surface the
+		// one producer-boundary diagnostic immediately without provider-fallback
+		// attribution or credential mutation.
+		if (localSnapshot || localBufferOverflow) {
+			return managedOutcome
+				? {
+						type: "terminal",
+						terminal: { stopReason: "error", messages: [message] },
+					}
+				: false;
+		}
+		// retry.enabled=false always surfaces immediately, matching the explicit
+		// user opt-out. The managed provider-fallback chain keeps its own
+		// availability policy.
+		if (!retrySettings.enabled && !managedFallback) {
+			return managedOutcome
+				? {
+						type: "terminal",
+						terminal: { stopReason: "error", messages: [message] },
+					}
+				: false;
+		}
 		const firstEventTimeout = classification === "first_event_timeout";
 		const emptyResponse = classification === "empty_response";
+		const reportedRetryMaxAttempts = transportFailure?.retryMaxAttempts;
+		if (reportedRetryMaxAttempts !== undefined) {
+			this.#providerRetryMaxAttempts = Math.min(
+				this.#providerRetryMaxAttempts ?? Number.POSITIVE_INFINITY,
+				reportedRetryMaxAttempts,
+			);
+		}
+		const providerRetryMaxAttempts = this.#providerRetryMaxAttempts;
 		// Content-free message-only watchdog prose (wrapped canonical or bare
 		// per-provider variants) is admitted like the typed path: it is
 		// replay-safe, so a bare-default retry may re-issue the request even
@@ -16076,18 +18258,24 @@ export class AgentSession {
 					}
 				: false;
 		}
-		const trigger = this.#fallbackTriggerFor(message, !managedFallback, transportFailure);
+		const trigger:
+			| { class: FallbackTriggerClass; retryAfterMs?: number; authDisposition?: AuthDisposition }
+			| undefined = this.#fallbackTriggerFor(message, !managedFallback, transportFailure);
 		if (!trigger) {
 			return managedOutcome
 				? this.#managedFallbackExhaustionDecision(message, message.errorMessage || "Model fallback attempt failed")
 				: false;
 		}
+		const attemptsUsed = managedFallback ? controller.attemptsUsed || 1 : this.#retryAttempt + 1;
+		const providerRetryCeilingReached =
+			providerRetryMaxAttempts !== undefined && attemptsUsed >= providerRetryMaxAttempts;
 		// Credential rotation: a content-free quota/rate-limit failure has no
 		// observable state to corrupt, so it is replay-safe regardless of
 		// extension lifecycle participation. Mark the failed credential and
 		// retry with the next stored credential of the same provider.
 		let credentialRotated =
 			!managedFallback &&
+			!providerRetryCeilingReached &&
 			!assistantMessageHasVisibleOrToolContent(message) &&
 			(trigger.class === "quota" || trigger.class === "rate_limit") &&
 			(await this.#markFailedCredential(trigger));
@@ -16095,7 +18283,9 @@ export class AgentSession {
 		// output, no tool calls, no extension-observable streaming state was produced
 		// before the failure. This bypasses #hasCleanRetryReplaySafety because the
 		// content-free check is the replay-safety guarantee for credential rotation.
-		const canReplayRotatedCredential = credentialRotated;
+		// A reached provider ceiling also continues through this gate only so the
+		// bounded exhaustion path can surface its exact diagnostic; it never replays.
+		const canReplayRotatedCredential = credentialRotated || providerRetryCeilingReached;
 		// Universal automatic replay-safety gate (#3791): once the failed attempt
 		// carries observable assistant text, thinking, or tool-call content,
 		// automatic session retry must not re-issue the request. This covers
@@ -16133,17 +18323,30 @@ export class AgentSession {
 			!managedFallback &&
 			classification === "transient" &&
 			!this.#isIdleStreamStallErrorMessage(message.errorMessage ?? "");
-		const attemptsUsed = managedFallback ? controller.attemptsUsed || 1 : this.#retryAttempt + 1;
+
 		const failedSelector = managedFallback ? controller.currentSelector() : undefined;
-		let outcome = managedFallback
-			? controller.onAttemptFailure(trigger.class, message.errorMessage || "Unknown error")
-			: legacyUnbounded || attemptsUsed <= retrySettings.maxRetries
-				? "retry"
-				: "exhausted";
+		let outcome: "retry" | "advance" | "exhausted";
+		if (managedFallback) {
+			outcome = controller.onAttemptFailure(trigger.class, message.errorMessage || "Unknown error");
+			if (providerRetryCeilingReached && outcome === "retry") {
+				outcome = controller.advance() ? "advance" : "exhausted";
+			}
+		} else {
+			outcome = providerRetryCeilingReached
+				? "exhausted"
+				: legacyUnbounded || attemptsUsed <= retrySettings.maxRetries
+					? "retry"
+					: "exhausted";
+		}
 		// Credential rotation is unbounded: a fresh credential is a different
 		// retry dimension from transient-error backoff, so it overrides maxRetries
 		// exhaustion and forces an immediate same-model retry.
-		if (managedFallback && outcome === "advance" && (trigger.class === "quota" || trigger.class === "rate_limit")) {
+		if (
+			managedFallback &&
+			!providerRetryCeilingReached &&
+			outcome === "advance" &&
+			(trigger.class === "quota" || trigger.class === "rate_limit")
+		) {
 			credentialRotated = await this.#markFailedCredential(trigger);
 		}
 		if (credentialRotated) {
@@ -16157,6 +18360,9 @@ export class AgentSession {
 				outcome = "retry";
 			}
 		}
+		if (outcome === "advance") {
+			this.#providerRetryMaxAttempts = undefined;
+		}
 		if (outcome === "exhausted") {
 			if (managedFallback) {
 				const errorMessage = this.#fallbackExhaustionError(controller);
@@ -16165,9 +18371,13 @@ export class AgentSession {
 				controller.resetSticky();
 				return managedOutcome ? this.#managedFallbackExhaustionDecision(message, errorMessage) : false;
 			}
-			if (classification === "first_event_timeout") {
+			if (classification === "first_event_timeout" || providerRetryMaxAttempts !== undefined) {
 				const elapsedMs = Date.now() - (this.#firstEventTimeoutRetryStartedAt ?? Date.now());
-				message.errorMessage = `First-event stream timeout exhausted after ${attemptsUsed} attempts; waited ${elapsedMs}ms total: ${message.errorMessage ?? "Unknown error"}`;
+				const prefix =
+					classification === "first_event_timeout"
+						? "First-event stream timeout exhausted"
+						: "First-event/grace retry ceiling exhausted";
+				message.errorMessage = `${prefix} after ${attemptsUsed} attempts; waited ${elapsedMs}ms total: ${message.errorMessage ?? "Unknown error"}`;
 			}
 			return false;
 		}
@@ -16190,7 +18400,9 @@ export class AgentSession {
 		}
 
 		const retry = async (ownership?: ManagedAttemptContinuationOwnership): Promise<void> => {
-			if (managedFallback && !credentialRotated) await this.#markFailedCredential(trigger);
+			if (managedFallback && !credentialRotated && !providerRetryCeilingReached) {
+				await this.#markFailedCredential(trigger);
+			}
 			let advanced = outcome !== "advance";
 			let resolutionError: unknown;
 			if (outcome === "advance") {
@@ -16233,11 +18445,17 @@ export class AgentSession {
 				await this.#emitSessionEvent({
 					type: "auto_retry_start",
 					attempt: this.#retryAttempt,
-					maxAttempts: managedFallback
-						? controller.maxAttempts
-						: firstEventTimeout
-							? retrySettings.maxRetries + 1
-							: retrySettings.maxRetries,
+					maxAttempts:
+						managedFallback && !localSnapshot
+							? firstEventTimeout || this.#providerRetryMaxAttempts !== undefined
+								? Math.min(controller.maxAttempts, this.#providerRetryMaxAttempts ?? Number.POSITIVE_INFINITY)
+								: controller.maxAttempts
+							: firstEventTimeout || this.#providerRetryMaxAttempts !== undefined
+								? Math.min(
+										retrySettings.maxRetries + 1,
+										this.#providerRetryMaxAttempts ?? Number.POSITIVE_INFINITY,
+									)
+								: retrySettings.maxRetries,
 					delayMs,
 					errorMessage,
 					unbounded: managedFallback ? false : legacyUnbounded,
@@ -16440,6 +18658,7 @@ export class AgentSession {
 					}
 					if (!preflightAccepted) {
 						await seam?.onPreflightAccepted?.();
+						if (seam?.signal?.aborted) throw promptPreflightCancelledError();
 						preflightAccepted = true;
 					}
 					await this.agent.prompt(messages, options);
@@ -16545,6 +18764,7 @@ export class AgentSession {
 		if (lastMsg.role !== "assistant") {
 			if (!this.#isInterruptedRetryTail(lastMsg)) return false;
 			this.#retryAttempt = 0;
+			this.#providerRetryMaxAttempts = undefined;
 			this.#scheduleAgentContinue({ delayMs: 1 });
 			return true;
 		}
@@ -16563,6 +18783,7 @@ export class AgentSession {
 
 		// Reset retry budget for a fresh attempt
 		this.#retryAttempt = 0;
+		this.#providerRetryMaxAttempts = undefined;
 
 		// Re-attempt the turn
 		this.#scheduleAgentContinue({ delayMs: 1 });
@@ -17657,7 +19878,7 @@ export class AgentSession {
 			}
 			options?.onTransitionMutationStarted?.();
 
-			const asyncManager = AsyncJobManager.instance();
+			const asyncManager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 			const ownerId = this.#agentId;
 			const lease =
 				switchingToDifferentSession && asyncManager && ownerId
@@ -17719,6 +19940,13 @@ export class AgentSession {
 				await this.sessionManager.setSessionFile(sessionPath, {
 					deferEphemeralArtifactRetirement: switchingToDifferentSession,
 				});
+				// setSessionFile rotated the endpoint identity to the successor;
+				// re-register the manager under it so post-transition lineage
+				// bindings resolve and owned aborts classify in the successor
+				// session (review thread P1).
+				this.#rekeyJobManagerForSessionIdentity(previousSessionState.sessionId, previousSessionState.sessionFile, {
+					retirePredecessorRegistrations: false,
+				});
 				if (switchingToDifferentSession) this.sessionManager.stageAdoptedArtifactManagerForTransition();
 				// The successor identity is already rotated in the manager but not yet
 				// published; gate its local:// root before publication so the agent,
@@ -17865,6 +20093,10 @@ export class AgentSession {
 				}
 
 				if (switchingToDifferentSession) {
+					const predecessorEndpointId = this.#asyncJobEndpointId(
+						previousSessionState.sessionId,
+						previousSessionState.sessionFile,
+					);
 					let ownerShutdownSettled = true;
 					if (ownerShutdownManager && ownerShutdownLease && ownerId) {
 						try {
@@ -17879,7 +20111,12 @@ export class AgentSession {
 						} catch (error) {
 							ownerShutdownSettled = false;
 							ownerShutdownFinalizationDeferred = true;
-							this.#scheduleDeferredOwnerShutdownFinalization(ownerShutdownManager, ownerShutdownLease, ownerId);
+							this.#scheduleDeferredOwnerShutdownFinalization(
+								ownerShutdownManager,
+								ownerShutdownLease,
+								ownerId,
+								predecessorEndpointId,
+							);
 							this.#suppressOwnAsyncJobDeliveries();
 							this.emitNotice(
 								"error",
@@ -17892,6 +20129,10 @@ export class AgentSession {
 					// Different files may intentionally carry the same copied session id; pathname transition is the commit signal.
 					ownerShutdownTransitionCommitted = true;
 					if (ownerShutdownSettled) {
+						// Every predecessor job/delivery has settled. Only now can its
+						// tuple evidence be retired; doing this immediately after rekey
+						// made rollback restore live jobs without their owned tuples.
+						retireOwnedRegistrationsForEndpoint(predecessorEndpointId);
 						this.sessionManager.retireEphemeralArtifactsAfterTransition();
 						await this.#runToolSessionTransitionCleanups();
 					}
@@ -17917,6 +20158,35 @@ export class AgentSession {
 				return true;
 			} catch (error) {
 				if (transitionCleanupCommitted) throw error;
+				// The switch never committed: rotate the manager's endpoint
+				// registration back to the predecessor before restoring it
+				// (review thread P1 — the map key must track the session id).
+				const successorEndpointId = this.#asyncJobEndpointId(
+					this.sessionManager.getSessionId(),
+					this.sessionManager.getSessionFile(),
+				);
+				const predecessorEndpointId = this.#asyncJobEndpointId(
+					previousSessionState.sessionId,
+					previousSessionState.sessionFile,
+				);
+				const rekeyed = AsyncJobManager.rekeyForEndpoint(
+					successorEndpointId,
+					predecessorEndpointId,
+					AsyncJobManager.forEndpoint(successorEndpointId),
+				);
+				if (!rekeyed) {
+					// Another top-level session claimed the freed predecessor endpoint
+					// while the switch's cleanup was in flight: restoring the old
+					// identity would leave this manager registered under the successor
+					// while tool lookups for the restored identity resolve the foreign
+					// manager, so same-ID jobs could be queried or cancelled across
+					// sessions and owned aborts lose their causal set (review thread
+					// P1). Fail the rollback instead of restoring into misattributed
+					// ownership; the caller surfaces the switch failure.
+					throw new Error(
+						`Session switch rollback aborted: predecessor endpoint "${previousSessionState.sessionId}" is no longer owned by this session.`,
+					);
+				}
 				await this.sessionManager.restoreRollbackState(previousSessionState);
 				this.#defaultFallbackController = undefined;
 				this.#syncAgentSessionId(previousSessionState.sessionId);
@@ -18008,6 +20278,7 @@ export class AgentSession {
 		try {
 			const previousSessionFile = this.sessionFile;
 			const previousWorkflowGateSessionId = this.sessionId;
+			const previousSessionIdentity = this.sessionManager.getSessionId();
 			const selectedEntry = this.sessionManager.getEntryForFidelity(entryId);
 
 			if (selectedEntry?.type !== "message" || selectedEntry.message.role !== "user") {
@@ -18039,7 +20310,11 @@ export class AgentSession {
 			try {
 				await initializeLocalRoot(this.#localProtocolOptions(prepared));
 				await this.#settleOwnAsyncJobsBeforeArtifactRetirement();
+				this.#assertJobManagerEndpointAdmission(prepared.sessionId, prepared.sessionFile);
 				this.sessionManager.commitPreparedNewSession(prepared);
+				// Branch commits a successor endpoint identity; re-register the
+				// manager under it (review thread P1).
+				this.#rekeyJobManagerForSessionIdentity(previousSessionIdentity, previousSessionFile);
 				await this.#runToolSessionTransitionCleanups();
 			} catch (error) {
 				throw await discardPreparedNewSessionAfterFailure(this.sessionManager, prepared, error);