@gajae-code/coding-agent 0.14.2 → 0.15.0

package/src/session/agent-session.ts

@@ -48,7 +48,7 @@ import {
 	type StablePrefixSnapshot,
 	ThinkingLevel,
 } from "@gajae-code/agent-core";
-import { normalizeMessagesForProvider } from "@gajae-code/agent-core/agent-loop";
+import { ESCAPED_NONASCII_RECOVERY_PROMPT, normalizeMessagesForProvider } from "@gajae-code/agent-core/agent-loop";
 import type { AttemptRunHandle, AttemptScope, AttemptScopeAuthority } from "@gajae-code/agent-core/attempt-scope";
 import {
 	AUTO_HANDOFF_THRESHOLD_FOCUS,
@@ -104,6 +104,7 @@ import type {
 	TransportFailureFacts,
 	Usage,
 	UsageReport,
+	UserMessage,
 } from "@gajae-code/ai/core";
 import {
 	classifyContextOverflow,
@@ -309,8 +310,14 @@ import {
 	registerCoordinatorRuntimeStateFinalizer,
 	UNPROVEN_TOOL_LABEL,
 } from "../gjc-runtime/session-state-sidecar";
-import { requestGjcWorkerIntegrationAttempt } from "../gjc-runtime/team-runtime";
-import { GjcTeamWorkerHeartbeatReporter } from "../gjc-runtime/team-worker-heartbeat";
+import {
+	isWorkflowRecoveryStalled,
+	projectLatestRalplanRun,
+	projectUltragoalRun,
+	trackWorkflowRecoveryZeroProgress,
+	type WorkflowRecoveryProjection,
+	type WorkflowRecoveryZeroProgressMemory,
+} from "../gjc-runtime/workflow-recovery-projection";
 import { GoalRuntime } from "../goals/runtime";
 import type { Goal, GoalModeState } from "../goals/state";
 import type { HindsightSessionState } from "../hindsight/state";
@@ -486,12 +493,169 @@ import { ToolChoiceQueue } from "./tool-choice-queue";
 import { pruneSupersededMaintenanceReminders, pruneSupersededVolatileProjectContext } from "./volatile-context-pruning";
 import { YieldQueue } from "./yield-queue";
 
+/**
+ * #4560: structured workflow recovery projection from canonical durable
+ * Ralplan/Ultragoal state, consumed by the compaction summary context and
+ * the post-compaction continuation prompt.
+ */
 interface CompactionStateSnapshot {
+	workflowRecovery?: WorkflowRecoveryProjection;
 	goal: { objective: string; status: Goal["status"]; enabled: boolean } | undefined;
 	openTodos: string[];
 	activeSkills: Array<{ skill: string; phase: string }>;
 	queuedMessages: boolean;
 	lastAssistantStopReason: StopReason | undefined;
+	recentFileMutations: string[];
+}
+
+const FILE_MUTATION_TOOLS = new Set(["write", "edit", "apply_patch", "ast_edit"]);
+const MAX_RECENT_FILE_MUTATIONS = 12;
+
+function collectFileMutationPaths(toolName: string, args: unknown): string[] {
+	if (!FILE_MUTATION_TOOLS.has(toolName) || !args || typeof args !== "object" || Array.isArray(args)) return [];
+	const record = args as Record<string, unknown>;
+	const paths: string[] = [];
+	const addPath = (value: unknown) => {
+		if (typeof value === "string" && value.length > 0 && !paths.includes(value)) paths.push(value);
+	};
+	const directPath = getStringProperty(record, "path") ?? getStringProperty(record, "file_path");
+	addPath(directPath);
+
+	for (const path of collectStringPaths(record.paths)) addPath(path);
+	const edits = Array.isArray(record.edits) ? record.edits : [];
+	for (const edit of edits) {
+		if (!edit || typeof edit !== "object" || Array.isArray(edit)) continue;
+		addPath(getStringProperty(edit as Record<string, unknown>, "rename"));
+	}
+
+	const input = getStringProperty(record, "input");
+	if (input) {
+		try {
+			for (const entry of expandApplyPatchToEntries({ input })) {
+				addPath(entry.path);
+				addPath(entry.rename);
+			}
+		} catch {
+			// If the edit input is not an apply_patch envelope, retain direct paths.
+		}
+	}
+	return paths;
+}
+
+function collectRecentFileMutations(messages: readonly AgentMessage[]): string[] {
+	const callsById = new Map<string, string[]>();
+	for (const message of messages) {
+		if (message.role !== "assistant") continue;
+		const content = (message as AssistantMessage).content;
+		if (!Array.isArray(content)) continue;
+		for (const block of content) {
+			if (block.type !== "toolCall" || !FILE_MUTATION_TOOLS.has(block.name)) continue;
+			const paths = collectFileMutationPaths(block.name, block.arguments).filter(path => path.length > 0);
+			if (paths.length > 0) callsById.set(block.id, paths);
+		}
+	}
+	const seen = new Set<string>();
+	const paths: string[] = [];
+	for (let index = messages.length - 1; index >= 0; index--) {
+		const message = messages[index];
+		if (message.role !== "toolResult") continue;
+		const result = message as { toolName?: string; toolCallId?: string; isError?: boolean };
+		if (result.isError || !result.toolName || !FILE_MUTATION_TOOLS.has(result.toolName)) continue;
+		const filePaths = result.toolCallId ? callsById.get(result.toolCallId) : undefined;
+		if (!filePaths) continue;
+		for (let pathIndex = filePaths.length - 1; pathIndex >= 0; pathIndex--) {
+			const filePath = filePaths[pathIndex];
+			if (!filePath || seen.has(filePath)) continue;
+			seen.add(filePath);
+			paths.push(filePath);
+			if (paths.length >= MAX_RECENT_FILE_MUTATIONS) break;
+		}
+		if (paths.length >= MAX_RECENT_FILE_MUTATIONS) break;
+	}
+	return paths;
+}
+
+/**
+ * #4560: render the structured workflow recovery projection as bounded
+ * compaction-context lines. Scope lines mark accepted scope and non-goals so
+ * post-compaction continuation reloads the accepted contract instead of
+ * re-deriving (and potentially expanding) it from summary prose.
+ */
+function renderWorkflowRecoveryContext(recovery: WorkflowRecoveryProjection): string[] {
+	const lines: string[] = [];
+	const objective = sanitizeCompactionStateText(recovery.objective, 200);
+	lines.push(`Workflow contract (${recovery.skill}): ${objective}`);
+	const accepted = recovery.scope.filter(item => item.kind === "accepted").slice(0, 8);
+	if (accepted.length > 0) {
+		lines.push(`Accepted scope: ${accepted.map(item => sanitizeCompactionStateText(item.text, 120)).join("; ")}`);
+	}
+	const nonGoals = recovery.scope.filter(item => item.kind === "non_goal").slice(0, 6);
+	if (nonGoals.length > 0) {
+		lines.push(`Non-goals: ${nonGoals.map(item => sanitizeCompactionStateText(item.text, 120)).join("; ")}`);
+	}
+	if (recovery.acceptanceCriteria.length > 0) {
+		lines.push(
+			`Acceptance criteria: ${recovery.acceptanceCriteria.map(item => sanitizeCompactionStateText(item, 120)).join("; ")}`,
+		);
+	}
+	if (recovery.currentGoal) {
+		const goal = recovery.currentGoal;
+		lines.push(
+			`Current goal: ${sanitizeCompactionStateText(goal.goalId, 40)} status=${sanitizeCompactionStateText(goal.status, 40)} ${sanitizeCompactionStateText(goal.objective, 120)}`,
+		);
+	}
+	const progress = recovery.progress;
+	const progressParts: string[] = [];
+	if (progress.totalGoals !== undefined) {
+		progressParts.push(`goals ${progress.completedGoals ?? 0}/${progress.totalGoals}`);
+	}
+	if (progress.outstandingGoals !== undefined) progressParts.push(`outstanding ${progress.outstandingGoals}`);
+	if (progress.latestCohortSourceHash) progressParts.push(`sourceHash ${progress.latestCohortSourceHash}`);
+	if (progressParts.length > 0) lines.push(`Progress: ${progressParts.join(", ")}`);
+	lines.push(
+		`Next action: ${recovery.nextAction.actionClass}${recovery.nextAction.goalId ? ` (${recovery.nextAction.goalId})` : ""}`,
+	);
+	if (recovery.provenance.sha256) lines.push(`Contract digest: ${recovery.provenance.sha256}`);
+	return lines;
+}
+
+/**
+ * #4560: post-compaction continuation for recognized active workflows.
+ * Returns undefined when no structured projection exists (generic
+ * auto-continue is preserved) or when every active workflow skill is
+ * continuation-inert (paused/terminal/unknown stay inert). The prompt keeps
+ * latest-user-intent supremacy and forbids silent scope expansion: any work
+ * beyond the accepted contract must be classified and recorded, never assumed.
+ */
+function buildWorkflowRecoveryContinuationPrompt(
+	recovery: WorkflowRecoveryProjection | undefined,
+	activeSkills: ReadonlyArray<{ skill: string; phase: string }>,
+): string | undefined {
+	if (!recovery) return undefined;
+	const recognized = activeSkills.some(
+		entry => entry.skill === recovery.skill && !isWorkflowContinuationInert(entry.skill, entry.phase),
+	);
+	if (!recognized) return undefined;
+	const lines = [
+		"Compaction removed earlier conversation history. Resume the active workflow from its durable contract below — do not re-derive or expand scope from the summary.",
+		"",
+		"<workflow-recovery>",
+		...renderWorkflowRecoveryContext(recovery),
+		"</workflow-recovery>",
+		"",
+		"Rules:",
+		"- Reload this contract before acting; the durable workflow state (.gjc session state, plans, goals, ledger receipts) is authoritative over any summary prose.",
+		"- Resume the stated next action class unless the user's latest message supersedes it; user intent always wins.",
+		"- Do not expand accepted scope. Work beyond the accepted scope/non-goals must be classified as new scope and explicitly recorded (durable blocker or steering), never silently accepted.",
+		"- Do not repeat already-verified review generations when the recorded source hash and evidence basis are unchanged; continue from recorded progress instead.",
+		"- If the same next action has already been attempted with no measurable progress (same source hash, no completed obligations, same blocker state), record a durable blocker/escalation note instead of looping.",
+	];
+	if (recovery.zeroProgress?.stalled) {
+		lines.push(
+			`STALLED: durable progress has not changed across ${recovery.zeroProgress.unchangedObservations + 1} compaction recoveries. Do not repeat the same next action again. Record a durable blocker or escalate to the operator now.`,
+		);
+	}
+	return lines.join("\n");
 }
 
 /** Escape XML-ish metacharacters and flatten newlines so state text cannot break compaction prompt framing. */
@@ -657,12 +821,6 @@ export interface AgentSessionConfig {
 	workerIntegrationRequest?: (signal: AbortSignal) => Promise<void>;
 	/** Bound terminal worker-integration settlement for embedded hosts and deterministic lifecycle tests. */
 	workerIntegrationTimeoutMs?: number;
-	/**
-	 * Override the runtime-owned `gjc team` worker heartbeat reporter. Defaults to a
-	 * reporter derived from the team worker environment, or none outside a worker pane.
-	 */
-	teamWorkerHeartbeatReporter?: GjcTeamWorkerHeartbeatReporter;
-
 	/** Loaded skills (already discovered by SDK) */
 	skills?: Skill[];
 	/** Skill loading warnings (already captured by SDK) */
@@ -1050,6 +1208,8 @@ const PROVIDER_FIRST_EVENT_TIMEOUT_ERROR = "Provider stream timed out while wait
 const WRAPPED_PROVIDER_FIRST_EVENT_TIMEOUT_ERROR = `Error: ${PROVIDER_FIRST_EVENT_TIMEOUT_ERROR}`;
 const PROVIDER_FIRST_EVENT_TIMEOUT_WITHOUT_ARTICLE_ERROR = "Provider stream timed out while waiting for first event";
 const BARE_DEFAULT_CODEX_OVERLOAD_ERROR = /^Codex error event(?:: .*)? \(code=server_is_overloaded(?:, [^)]+)*\)$/;
+/** Anthropic's typed capacity-overload `error.type`, the only overload code admitted below. */
+const ANTHROPIC_OVERLOADED_ERROR_TYPE = "overloaded_error";
 const KIMI_CODE_FIRST_EVENT_TIMEOUT_MESSAGES = {
 	"anthropic-messages": new Set([
 		PROVIDER_FIRST_EVENT_TIMEOUT_ERROR,
@@ -1123,6 +1283,40 @@ function isBareDefaultCodexOverload(message: AssistantMessage): boolean {
 	);
 }
 
+/**
+ * True when the whole error message is Anthropic's own typed capacity-overload
+ * envelope. The provider's `overloaded_error` can arrive as a statusless SSE
+ * error event, so the envelope is the only structured evidence available: it is
+ * parsed as JSON and both the outer `type` and the nested `error.type` must
+ * match exactly. Prose is never inspected, so a message that merely mentions
+ * being overloaded cannot authorize a replay.
+ */
+function isAnthropicOverloadedEnvelope(errorMessage: string | undefined): boolean {
+	if (!errorMessage) return false;
+	const trimmed = errorMessage.trim();
+	if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return false;
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return false;
+	}
+	if (typeof parsed !== "object" || parsed === null) return false;
+	if ((parsed as { type?: unknown }).type !== "error") return false;
+	const error = (parsed as { error?: unknown }).error;
+	if (typeof error !== "object" || error === null) return false;
+	return (error as { type?: unknown }).type === ANTHROPIC_OVERLOADED_ERROR_TYPE;
+}
+
+function isBareDefaultAnthropicOverload(message: AssistantMessage): boolean {
+	return (
+		message.api === "anthropic-messages" &&
+		isAnthropicOverloadedEnvelope(message.errorMessage) &&
+		!hasBareDefaultRetryDisqualifyingFacts(message) &&
+		!assistantMessageHasVisibleOrToolContent(message)
+	);
+}
+
 function assistantMessageHasVisibleOrToolContent(message: AssistantMessage): boolean {
 	return message.content.some(content => {
 		if (content.type === "text") return content.text.length > 0;
@@ -1922,6 +2116,15 @@ export interface DefaultFallbackRuntimeState {
 const AGENT_CONTINUE_BUSY_RESCHEDULE_BASE_DELAY_MS = 100;
 const AGENT_CONTINUE_BUSY_RESCHEDULE_MAX_DELAY_MS = 5_000;
 const AGENT_CONTINUE_BUSY_MAX_RESCHEDULES = 50;
+/**
+ * Maximum un-charged managed-fallback retries for escaped-non-ASCII tool-call
+ * turns within one logical run. Each retry is a fresh loop with its own
+ * in-loop resample budget, so without this cap a deterministic escaper loops
+ * forever: the fallback chain never sees a charge to exhaust on. Matching the
+ * agent loop's own per-loop budget (MAX_ESCAPED_NONASCII_RESAMPLES + 1 wire
+ * attempts) keeps one steering retry plus one blind retry before the run ends.
+ */
+const MAX_ESCAPED_NONASCII_MANAGED_RETRIES = 2;
 
 function agentContinueBusyRescheduleDelayMs(attempt: number): number {
 	const exponential = AGENT_CONTINUE_BUSY_RESCHEDULE_BASE_DELAY_MS * 2 ** Math.max(0, attempt - 1);
@@ -2229,6 +2432,8 @@ export class AgentSession {
 	#retryPromise: Promise<void> | undefined = undefined;
 	#retryResolve: (() => void) | undefined = undefined;
 	#defaultFallbackController: FallbackChainController | undefined;
+	/** Managed escaped-non-ASCII retries issued for the current logical run. Bounded so a deterministic escaper cannot loop forever through un-charged fallback retries. */
+	#escapedNonAsciiManagedRetries = 0;
 	#overflowMaintenanceAttempts = 0;
 	#defaultFallbackExhaustedLastTurn = false;
 	#fallbackInvocationId = 0;
@@ -2269,7 +2474,7 @@ export class AgentSession {
 	 */
 	readonly #ownedAsyncJobManager: AsyncJobManager | undefined;
 	readonly #disposeAsyncJobManager: boolean;
-	readonly #ownedMcpManager: MCPManager | undefined;
+	#ownedMcpManager: MCPManager | undefined;
 	#startupTurnBarrier: Promise<void> | undefined;
 	#pendingPythonMessages: Array<{
 		message: PythonExecutionMessage;
@@ -2316,12 +2521,8 @@ export class AgentSession {
 	}
 
 	#turnIndex = 0;
-	#workerIntegrationScheduler: WorkerIntegrationRequestScheduler;
+	#workerIntegrationScheduler: WorkerIntegrationRequestScheduler | undefined;
 	#workerIntegrationRequestedForTurn = false;
-	/** Runtime-owned team worker heartbeat; `undefined` outside a `gjc team` worker pane. */
-	#teamWorkerHeartbeat: GjcTeamWorkerHeartbeatReporter | undefined;
-	#teamWorkerTurnsInFlight = 0;
-	#unregisterTeamWorkerAsyncJobChange: (() => void) | undefined;
 	// First-party internal before-agent-start contributors (not user hooks).
 	#beforeAgentStartContributors: BeforeAgentStartContributor[] = [];
 
@@ -2378,6 +2579,8 @@ export class AgentSession {
 	#workspaceTreeService: LazyService<WorkspaceTreeRuntime> | undefined;
 	#onWorkspaceTreeReady: ((tree: WorkspaceTree) => void | Promise<void>) | undefined;
 	#networkPrewarmService: LazyService<NetworkPrewarmRuntime> | undefined;
+	/** Set by `applyRescopedCwdState`: forces the next turn to re-scan at the new cwd. */
+	#pendingWorkspaceTreeRescope = false;
 	/** Throttle cache for the per-turn volatile workspace-tree scan (see #buildVolatileProjectContextMessage). */
 	#cachedWorkspaceTree: WorkspaceTree | undefined;
 	#cachedWorkspaceTreeAt = 0;
@@ -2437,6 +2640,18 @@ export class AgentSession {
 	 *  surface a red "Operation aborted" line; cleared by a later non-silent abort
 	 *  or by `abort`'s safety net when no aborted message_end is produced. */
 	#silentAbortPending = false;
+	/** In-flight `abort()` unwind. Fresh prompts wait so they cannot steer into the dying turn. */
+	#abortUnwind: Promise<void> | undefined;
+	#abortEpoch = 0;
+	/**
+	 * Monotonic count of ADMITTED abort requests, advanced synchronously on every
+	 * `#abortWithOutcome` entry — including an abort that shares an already
+	 * in-flight unwind rather than starting its own. A prompt that waits for an
+	 * unwind captures this value and refuses to resume if it advanced while it
+	 * waited: abort is terminal, so work admitted before the user's latest abort
+	 * must never start just because the physical unwind was shared.
+	 */
+	#abortAdmissionEpoch = 0;
 	/** Monotonic counter for `enqueueCustomMessageDisplay` tag generation;
 	 *  combined with `Date.now()` so tags stay unique even across rapid
 	 *  same-tick enqueues. */
@@ -2488,6 +2703,7 @@ export class AgentSession {
 		nonEditDeterminations: 0,
 	};
 	#promptInFlightCount = 0;
+	#inFlightGenerations: number[] = [];
 	#agentEventHandlersInFlight = 0;
 	#queuedExtensionEventCount = 0;
 	#extensionTurnGeneration = 0;
@@ -2798,12 +3014,18 @@ export class AgentSession {
 
 	#beginInFlight(): void {
 		this.#promptInFlightCount++;
+		this.#inFlightGenerations.push(this.#abortEpoch);
 		if (this.#promptInFlightCount === 1) {
 			this.#acquirePowerAssertion();
-			// Runtime-owned worker liveness follows Agent turns and background jobs
-			// in #refreshTeamWorkerHeartbeat(), including internally dispatched turns.
 		}
 	}
+
+	/** True while a live agent loop or a non-aborted in-flight prompt owns the session. */
+	#isLiveTurnBusy(): boolean {
+		if (this.agent.state.isStreaming) return true;
+		if (!this.isStreaming) return false;
+		return this.#inFlightGenerations.every(generation => generation === this.#abortEpoch);
+	}
 	/**
 	 * Allocate a FRESH prompt attempt/lineage for an allowed owned-completion
 	 * delivery (corrected turn semantics). The new turn gets a new attempt epoch
@@ -2853,6 +3075,27 @@ export class AgentSession {
 		return signal.aborted || this.#promptGeneration !== generation;
 	}
 
+	/**
+	 * Wait for the in-flight abort unwind, then prove no LATER abort was admitted
+	 * while waiting. Overlapping aborts share one physical unwind, so awaiting
+	 * `#abortUnwind` alone cannot distinguish "the abort I raced" from "a second
+	 * abort the user issued after me". Returns false when the caller must not
+	 * resume; the caller then rejects as a cancelled preflight rather than
+	 * starting a successor the user already aborted.
+	 *
+	 * Loops because an abort admitted during the wait can install its own unwind:
+	 * the fence only opens once no unwind is in flight and the admission epoch has
+	 * stopped advancing.
+	 */
+	async #awaitAbortUnwindFence(): Promise<boolean> {
+		const admissionEpoch = this.#abortAdmissionEpoch;
+		while (this.#abortUnwind !== undefined) {
+			await this.#abortUnwind;
+			if (this.#abortAdmissionEpoch !== admissionEpoch) return false;
+		}
+		return this.#abortAdmissionEpoch === admissionEpoch;
+	}
+
 	#throwIfPromptPreflightCancelled(generation: number, signal: AbortSignal): void {
 		if (this.#isPromptPreflightCancelled(generation, signal)) {
 			throw promptPreflightCancelledError();
@@ -3068,6 +3311,44 @@ export class AgentSession {
 	#wakeScopedSettlementWaiters(): void {
 		for (const check of [...this.#scopedSettlementWaiters]) check();
 	}
+	#abortedTurnTerminalPending(): boolean {
+		return (
+			this.#promptInFlightCount > 0 ||
+			this.#agentEventHandlersInFlight > 0 ||
+			this.#pendingAgentEndEmit !== undefined ||
+			this.#agentEndPublicationInFlight > 0
+		);
+	}
+
+	/** Wait for the aborted turn's agent_end handler and publication, not just agent idle. */
+	async #awaitAbortedTurnTerminal(): Promise<void> {
+		await Promise.resolve();
+		await this.#agentEndHandlingPromise;
+		this.#flushPendingAgentEnd();
+		await this.#agentEndPublicationPromise;
+		while (this.#abortedTurnTerminalPending()) {
+			const wake = Promise.withResolvers<void>();
+			const check = () => {
+				if (!this.#abortedTurnTerminalPending()) wake.resolve();
+			};
+			this.#scopedSettlementWaiters.add(check);
+			check();
+			try {
+				// Wait ONLY on the state-change wake. Racing the agent_end handling or
+				// publication promise here spins: an in-flight event handler that is not
+				// an agent_end (a `message_end` extension handler, say) leaves both of
+				// those already settled, so the race resolves immediately and the loop
+				// re-runs as a microtask, starving timers until the handler finishes.
+				// Every counter this loop reads wakes the scoped waiters when it drops.
+				await wake.promise;
+			} finally {
+				this.#scopedSettlementWaiters.delete(check);
+			}
+			this.#flushPendingAgentEnd();
+			await this.#agentEndHandlingPromise;
+			await this.#agentEndPublicationPromise;
+		}
+	}
 
 	/**
 	 * Wait for session settlement. `ignoreSelectionFenceGeneration` carries the
@@ -3107,10 +3388,10 @@ export class AgentSession {
 
 	#endInFlight(): unknown {
 		this.#promptInFlightCount = Math.max(0, this.#promptInFlightCount - 1);
+		if (this.#inFlightGenerations.length > 0) this.#inFlightGenerations.shift();
 		if (this.#promptInFlightCount !== 0) return undefined;
 
 		this.#releasePowerAssertion();
-		this.#refreshTeamWorkerHeartbeat();
 		let flushError: unknown;
 		try {
 			// The turn is over, so nothing can split a tool_use/tool_result pair any
@@ -3168,17 +3449,6 @@ export class AgentSession {
 		if (errors.length > 1) throw new AggregateError(errors, "Multiple deferred prompt messages failed to flush");
 	}
 
-	#refreshTeamWorkerHeartbeat(): void {
-		const hasOwnedBackgroundJob =
-			this.#agentId !== undefined &&
-			(this.#ownedAsyncJobManager?.getRunningJobs({ ownerId: this.#agentId }).length ?? 0) > 0;
-		if (this.#teamWorkerTurnsInFlight > 0 || hasOwnedBackgroundJob) {
-			this.#teamWorkerHeartbeat?.start();
-		} else {
-			this.#teamWorkerHeartbeat?.stop();
-		}
-	}
-
 	#flushPendingAgentEnd(): void {
 		if (
 			this.#promptInFlightCount > 0 ||
@@ -3280,25 +3550,11 @@ export class AgentSession {
 			}
 		});
 		this.memoryBackend = config.memoryBackend ?? createMemoryBackendService(this.settings);
-		this.#workerIntegrationScheduler = new WorkerIntegrationRequestScheduler(
-			config.workerIntegrationRequest ??
-				(async signal => {
-					await requestGjcWorkerIntegrationAttempt(this.sessionManager.getCwd(), process.env, { signal }).catch(
-						error => {
-							logger.warn("GJC team worker integration request failed", { error: String(error) });
-						},
-					);
-				}),
-			config.workerIntegrationTimeoutMs,
-		);
-		// One publisher per worker process: subagent sessions share this process and its
-		// team env, so letting each create a reporter would run N timers writing the same
-		// record. The top-level session owns the pane's liveness.
-		this.#teamWorkerHeartbeat =
-			config.teamWorkerHeartbeatReporter ??
-			((config.taskDepth ?? 0) === 0
-				? GjcTeamWorkerHeartbeatReporter.forProcess(() => this.sessionManager.getCwd())
-				: undefined);
+		// Worker integration is an injected seam only: hosts that need turn-end
+		// integration supply the request, and no scheduler exists otherwise.
+		this.#workerIntegrationScheduler = config.workerIntegrationRequest
+			? new WorkerIntegrationRequestScheduler(config.workerIntegrationRequest, config.workerIntegrationTimeoutMs)
+			: undefined;
 		this.notificationSessionController = config.notificationSessionController;
 		this.taskDepth = config.taskDepth ?? 0;
 		this.#workflowGatePublication = config.workflowGatePublication ?? "endpoint";
@@ -3542,9 +3798,6 @@ export class AgentSession {
 		this.#ttsrManager = config.ttsrManager;
 		this.#obfuscator = config.obfuscator;
 		this.#agentId = config.agentId;
-		this.#unregisterTeamWorkerAsyncJobChange = this.#ownedAsyncJobManager?.onChange(() => {
-			this.#refreshTeamWorkerHeartbeat();
-		});
 		this.#agentRegistry = config.agentRegistry;
 		this.#providerSessionId = config.providerSessionId;
 		this.#credentialSessionId = config.credentialSessionId;
@@ -3768,6 +4021,61 @@ export class AgentSession {
 			...(this.#activeSkillState.sessionId ? { session_id: this.#activeSkillState.sessionId } : {}),
 		};
 	}
+	/**
+	 * Live prompt marker or restored durable workflow — the effective state the
+	 * cwd-local mutation guard must honor after resume.
+	 */
+	getEffectiveActiveWorkflowSkillState(): { skill: string; sessionId: string } | undefined {
+		const currentSessionId = this.sessionManager.getSessionId();
+		const inMemory = this.#activeSkillState;
+		if (
+			inMemory &&
+			(!inMemory.sessionId || inMemory.sessionId === currentSessionId) &&
+			isCanonicalGjcWorkflowSkill(inMemory.skill)
+		) {
+			return { skill: inMemory.skill, sessionId: inMemory.sessionId ?? currentSessionId };
+		}
+		if (
+			this.#restoredWorkflowSkillState?.sessionId === currentSessionId &&
+			isCanonicalGjcWorkflowSkill(this.#restoredWorkflowSkillState.skill)
+		) {
+			return this.#restoredWorkflowSkillState;
+		}
+		return undefined;
+	}
+
+	/** Replace the session-owned MCP manager after a cwd rescope. */
+	async replaceOwnedMcpManager(next: MCPManager | undefined): Promise<void> {
+		const previous = this.#ownedMcpManager;
+		if (previous && previous !== next) {
+			await previous.disconnectAll().catch(() => {});
+			if (MCPManager.instance() === previous) MCPManager.setInstance(undefined);
+		}
+		this.#ownedMcpManager = next;
+		if (next && MCPManager.instance() === undefined) MCPManager.setInstance(next);
+	}
+
+	/** Swap named custom/project tools after a cwd rescope. */
+	async replaceNamedCustomTools(previousNames: readonly string[], nextTools: CustomTool[]): Promise<void> {
+		const previous = new Set(previousNames);
+		const previousActive = this.getActiveToolNames();
+		for (const name of previous) this.#toolRegistry.delete(name);
+		const getCustomToolContext = () => this.#getCustomToolContext();
+		const added: string[] = [];
+		for (const customTool of nextTools) {
+			const wrapped = CustomToolAdapter.wrap(customTool, getCustomToolContext) as AgentTool;
+			const finalTool = (
+				this.#extensionRunner ? new ExtensionToolWrapper(wrapped, this.#extensionRunner) : wrapped
+			) as AgentTool;
+			this.#toolRegistry.set(finalTool.name, finalTool);
+			added.push(finalTool.name);
+		}
+		this.#invalidateDiscoveryCaches();
+		await this.#applyActiveToolsByName([
+			...previousActive.filter(name => !previous.has(name)),
+			...added.filter(name => !previous.has(name) || previousActive.includes(name)),
+		]);
+	}
 
 	/** Best-effort accessor for the active skill's `current_phase` field from
 	 *  its persisted mode-state file. Used by the `skill` tool to enforce the
@@ -3798,13 +4106,7 @@ export class AgentSession {
 	/** Provider-facing ask metadata must expose only the active deep-interview phase. */
 	getDeepInterviewAskStage(): "topology" | "post-topology" | undefined {
 		const currentSessionId = this.sessionManager.getSessionId();
-		const inMemory = this.#activeSkillState;
-		const active =
-			inMemory && (!inMemory.sessionId || inMemory.sessionId === currentSessionId)
-				? inMemory
-				: this.#restoredWorkflowSkillState?.sessionId === currentSessionId
-					? this.#restoredWorkflowSkillState
-					: undefined;
+		const active = this.getEffectiveActiveWorkflowSkillState();
 		if (active?.skill !== "deep-interview") return undefined;
 		try {
 			assertNonEmptyGjcSessionId(currentSessionId, "AgentSession.getDeepInterviewAskStage");
@@ -4589,10 +4891,19 @@ export class AgentSession {
 				if (event.type === "agent_end" && !maintenanceCheckpoint) {
 					if (terminalOwner ? !terminalClaim?.ok : this.activePromptHandle !== undefined) return;
 				}
-				// A prompt-owned event with a captured handle must have obtained an exact
-				// producer lease before its handler was created. Failed ownership never
-				// schedules prompt work or falls back to a successor's handle.
-				if (activePromptHandle && !eventLease) return;
+				// Terminal publication is ownership-sensitive and is handled above. A
+				// message/turn lifecycle event is different: its canonical transcript
+				// append is the evidence needed to recover the run. Do not drop that
+				// evidence merely because the best-effort post-prompt lease could not be
+				// acquired. The current-handle check still fences a genuinely late event
+				// from a replaced run without allowing a successor handle to be borrowed.
+				if (
+					activePromptHandle &&
+					!eventLease &&
+					event.type !== "agent_end" &&
+					this.activePromptHandle !== activePromptHandle
+				)
+					return;
 				if (eventLease && event.type === "agent_end")
 					this.#postPromptLeases.set(eventLease.resourceRunId, eventLease);
 				if (eventLease) {
@@ -4622,6 +4933,10 @@ export class AgentSession {
 				this.#agentEventHandlersInFlight = Math.max(0, this.#agentEventHandlersInFlight - 1);
 				this.#flushPendingAgentEnd();
 				agentEndHandled?.resolve();
+				// Every other in-flight counter republishes settlement when it drops; this
+				// one is read by the abort drain and the session settlement waiters too,
+				// so a handler finishing has to wake them or they wait on nothing.
+				this.#resolveSessionSettlement();
 			}
 		})();
 		if (eventLease) eventLease.track("post_prompt", "agent-session-event", handler);
@@ -4678,18 +4993,6 @@ export class AgentSession {
 		} else if (event.type === "turn_end") {
 			this.#closedExtensionTurnGeneration = this.#extensionTurnGeneration;
 		}
-		if (event.type === "turn_start") {
-			this.#teamWorkerTurnsInFlight++;
-			this.#refreshTeamWorkerHeartbeat();
-		} else if (event.type === "turn_end") {
-			this.#teamWorkerTurnsInFlight = Math.max(0, this.#teamWorkerTurnsInFlight - 1);
-			this.#refreshTeamWorkerHeartbeat();
-		} else if (event.type === "agent_end") {
-			// Failed Agent runs can emit agent_end without turn_end. Reset rather than
-			// leaking a positive count that would report an idle/failed worker forever.
-			this.#teamWorkerTurnsInFlight = 0;
-			this.#refreshTeamWorkerHeartbeat();
-		}
 		if (event.type === "message_update") {
 			// Fast path: message_update maps to no sidecar state, so we must not
 			// build the persistRuntimeState closure here (per-token hot path).
@@ -6197,14 +6500,24 @@ export class AgentSession {
 								return;
 							}
 							if (!(await continuationAuthorized(signal))) return;
+							// #4560: recognized active workflows resume from their
+							// durable structured contract instead of the generic
+							// prompt; unknown/paused/terminal workflows keep the
+							// generic continuation and latest-user-intent supremacy.
+							const recoverySnapshot = await this.#compactionStateSnapshot();
+							const recoveryPrompt = buildWorkflowRecoveryContinuationPrompt(
+								recoverySnapshot.workflowRecovery,
+								recoverySnapshot.activeSkills,
+							);
+							const promptText = recoveryPrompt ?? autoContinuePrompt;
 							await this.#promptWithMessage(
 								{
 									role: "developer",
-									content: [{ type: "text", text: autoContinuePrompt }],
+									content: [{ type: "text", text: promptText }],
 									attribution: "agent",
 									timestamp: Date.now(),
 								},
-								autoContinuePrompt,
+								promptText,
 								{
 									skipPostPromptRecoveryWait: true,
 									skipCompactionCheck: true,
@@ -6981,11 +7294,11 @@ export class AgentSession {
 	}
 
 	#requestWorkerIntegrationAttempt(): void {
-		this.#workerIntegrationScheduler.enqueue();
+		this.#workerIntegrationScheduler?.enqueue();
 	}
 
 	async #flushWorkerIntegrationAttempt(): Promise<void> {
-		await this.#workerIntegrationScheduler.flush();
+		await this.#workerIntegrationScheduler?.flush();
 	}
 
 	async #flushWorkerIntegrationForAgentEnd(): Promise<void> {
@@ -7377,6 +7690,7 @@ export class AgentSession {
 	}
 
 	async #dispose(): Promise<void> {
+		await this.sessionManager.joinCwdTransition();
 		const admissionClosed = this.#closeSessionAdmission();
 		this.#isDisposed = true;
 		// Reject new direct Python starts as soon as disposal begins (synchronously,
@@ -7494,9 +7808,6 @@ export class AgentSession {
 		await disposeKernelSessionsByOwner(this.#evalKernelOwnerId);
 		await disposeVmContextsByOwner(this.#evalKernelOwnerId);
 		this.#releasePowerAssertion();
-		this.#unregisterTeamWorkerAsyncJobChange?.();
-		this.#unregisterTeamWorkerAsyncJobChange = undefined;
-		this.#teamWorkerHeartbeat?.dispose();
 		// Disconnect the agent event listener BEFORE closing session resources so a late
 		// provider/tool message_end cannot append to the closing SessionManager.
 		this.#disconnectFromAgent();
@@ -7547,9 +7858,6 @@ export class AgentSession {
 		this.#unregisterResourceGc = undefined;
 		this.#unregisterSessionMemorySettings?.();
 		this.#unregisterSessionMemorySettings = undefined;
-		this.#unregisterTeamWorkerAsyncJobChange?.();
-		this.#unregisterTeamWorkerAsyncJobChange = undefined;
-		this.#teamWorkerHeartbeat?.dispose();
 		const work = Promise.allSettled([
 			// kill:true so a forced exit also reaps spawned-app Chrome we own (headless
 			// always closes; connected/attached browsers only disconnect — never killed).
@@ -7562,15 +7870,22 @@ export class AgentSession {
 			disposeVmContextsByOwner(kernelOwnerId).catch((error: unknown) =>
 				logger.warn("signal teardown: disposeVmContextsByOwner failed", { error }),
 			),
-			// Tool-owned resources (e.g. an autoresearch mission's persistent Python
-			// kernel) register their own disposer and are keyed by an owner id that is
-			// NOT #evalKernelOwnerId, so the two disposals above never reach them. Drain
-			// them here inside the same budget: without this a signal exit orphans the
-			// subprocess. #runToolSessionCleanups already clears the set, so the graceful
-			// dispose path running first makes this a no-op rather than a double free.
+			// Tool-owned resources (e.g. the python tool's persistent per-session
+			// kernel) register their own disposer keyed by an owner id that is NOT
+			// #evalKernelOwnerId, so the two disposals above never reach them. Drain
+			// BOTH cleanup sets here inside the same budget: the SDK binds a tool's
+			// `registerSessionCleanup` to registerToolSessionTransitionCleanup, so a
+			// python REPL kernel lands in the transition set while a directly-registered
+			// cleanup lands in the other. Graceful dispose drains both; draining only
+			// one here left signal exit orphaning the subprocess. Each runner clears
+			// its set, so a graceful dispose running first makes this a no-op rather
+			// than a double free.
 			this.#runToolSessionCleanups().catch((error: unknown) =>
 				logger.warn("signal teardown: tool session cleanups failed", { error }),
 			),
+			this.#runToolSessionTransitionCleanups().catch((error: unknown) =>
+				logger.warn("signal teardown: tool session transition cleanups failed", { error }),
+			),
 		]);
 		await Promise.race([work, Bun.sleep(timeoutMs)]);
 	}
@@ -8204,6 +8519,35 @@ export class AgentSession {
 			},
 		}) as T;
 	}
+	#wrapToolForCwdTransitionFence<T extends AgentTool>(tool: T): T {
+		if (tool.name === "move_session") return tool;
+		return new Proxy(tool, {
+			get: (target, prop) => {
+				if (prop !== "execute") return Reflect.get(target, prop, target);
+				return async (
+					toolCallId: string,
+					args: unknown,
+					signal: AbortSignal | undefined,
+					onUpdate: never,
+					ctx: never,
+				) => {
+					return await this.sessionManager.runWithCwdReadLease(async () => {
+						const admittedGeneration = this.sessionManager.getCwdGeneration();
+						const result = await target.execute(toolCallId, args as never, signal, onUpdate, ctx);
+						// The lease keeps writers out for the whole execution, so this can
+						// only trip if a caller bypassed the lease; surface it rather than
+						// returning a result computed against a retired cwd.
+						if (this.sessionManager.getCwdGeneration() !== admittedGeneration) {
+							throw new Error(
+								"Session working directory changed while this tool executed; retry against the new cwd.",
+							);
+						}
+						return result;
+					});
+				};
+			},
+		}) as T;
+	}
 
 	/**
 	/** Wrap a tool with the workflow mutation guard before permissions or execution. */
@@ -8251,16 +8595,18 @@ export class AgentSession {
 		let wrappersByVersion = this.#guardedToolWrapperCache.get(tool);
 		const cached = wrappersByVersion?.get(cacheKey);
 		if (cached) return cached as T;
-		const wrapped = this.#wrapToolForWorkflowMutationGuard(
-			this.#wrapToolForAcpPermission(
-				guardToolForUltragoalAsk(
-					tool,
-					() => this.sessionManager.getCwd(),
-					() => ({
-						activeSkillState: this.getActiveSkillState(),
-						sessionId: this.sessionManager.getSessionId(),
-					}),
-					() => this.getSessionAgentDir(),
+		const wrapped = this.#wrapToolForCwdTransitionFence(
+			this.#wrapToolForWorkflowMutationGuard(
+				this.#wrapToolForAcpPermission(
+					guardToolForUltragoalAsk(
+						tool,
+						() => this.sessionManager.getCwd(),
+						() => ({
+							activeSkillState: this.getActiveSkillState(),
+							sessionId: this.sessionManager.getSessionId(),
+						}),
+						() => this.getSessionAgentDir(),
+					),
 				),
 			),
 		);
@@ -9771,18 +10117,26 @@ export class AgentSession {
 			this.#cachedWorkspaceTreeAt = Date.now();
 			this.#initialWorkspaceTree = undefined;
 			includeTree = this.#cachedWorkspaceTree;
-		} else if (Date.now() - this.#cachedWorkspaceTreeAt >= VOLATILE_TREE_TTL_MS) {
+		} else if (
+			this.#pendingWorkspaceTreeRescope ||
+			Date.now() - this.#cachedWorkspaceTreeAt >= VOLATILE_TREE_TTL_MS
+		) {
+			// A rescope retires the cached tree regardless of TTL, and must re-scan
+			// rather than reuse the launch-root snapshot the service already holds.
+			const rescoped = this.#pendingWorkspaceTreeRescope;
+			this.#pendingWorkspaceTreeRescope = false;
 			if (this.#workspaceTreeService) {
-				const firstWorkspaceTree = this.#cachedWorkspaceTreeAt === 0;
+				const firstWorkspaceTree = this.#cachedWorkspaceTreeAt === 0 && !rescoped;
 				const runtime = await this.#workspaceTreeService.get("first-turn-barrier");
 				this.#cachedWorkspaceTree = firstWorkspaceTree ? runtime.snapshot : await runtime.refresh();
-				publishStableWorkspaceTree = firstWorkspaceTree;
+				publishStableWorkspaceTree = firstWorkspaceTree || rescoped;
 			} else {
 				try {
 					this.#cachedWorkspaceTree = await buildWorkspaceTree(cwd, { timeoutMs: 5000 });
 				} catch {
 					this.#cachedWorkspaceTree = undefined;
 				}
+				publishStableWorkspaceTree = rescoped;
 			}
 			this.#cachedWorkspaceTreeAt = Date.now();
 			includeTree = this.#cachedWorkspaceTree;
@@ -9867,18 +10221,31 @@ export class AgentSession {
 		assertImagePlaceholdersHavePayload(expandedText, options?.images);
 		const workflowIntentDiff = options?.synthetic ? null : buildWorkflowIntentDiff(expandedText);
 		const claimsGenuineUserIntent = !options?.synthetic && options?.attribution !== "agent";
-		const admissionGeneration = this.#promptGeneration;
-		const admissionSignal = options?.preflightSignal
+		let admissionGeneration = this.#promptGeneration;
+		let admissionSignal = options?.preflightSignal
 			? AbortSignal.any([this.#promptPreflightAbortController.signal, options.preflightSignal])
 			: this.#promptPreflightAbortController.signal;
 		if (this.#pendingSelectionFences > 0) {
 			await awaitPromptInvocationPreflight(this.#selectionFenceTail, admissionSignal);
 		}
+		let waitedForAbortUnwind = false;
+		if (this.#abortUnwind) {
+			// A LATER abort admitted while this prompt waited keeps abort terminal:
+			// the successor is refused instead of refreshing its generation and
+			// starting work the user already aborted twice.
+			if (!(await this.#awaitAbortUnwindFence())) throw promptPreflightCancelledError();
+			admissionGeneration = this.#promptGeneration;
+			admissionSignal = options?.preflightSignal
+				? AbortSignal.any([this.#promptPreflightAbortController.signal, options.preflightSignal])
+				: this.#promptPreflightAbortController.signal;
+			waitedForAbortUnwind = true;
+		}
 		const deepInterviewUserIntentEpoch =
 			claimsGenuineUserIntent && !this.isStreaming ? this.#claimDeepInterviewUserIntent() : undefined;
 
-		// If streaming, queue via steer() or followUp() based on option
-		if (this.isStreaming) {
+		// If streaming, queue via steer() or followUp() based on option.
+		// Abort unwind is awaited above so a successor is not busy against leftover in-flight.
+		if (this.#isLiveTurnBusy() && !waitedForAbortUnwind) {
 			if (!options?.streamingBehavior) {
 				throw new AgentBusyError();
 			}
@@ -9972,7 +10339,7 @@ export class AgentSession {
 		// workflow skills can always call it.
 		if (active && isCanonicalGjcWorkflowSkill(skill)) this.#attachAskTool();
 		const sessionId = this.sessionManager.getSessionId();
-		// Canonical GJC workflow skills (deep-interview, ralplan, ultragoal, team)
+		// Canonical GJC workflow skills (deep-interview, ralplan, ultragoal, autoresearch)
 		// own their `.gjc/state/skill-active-state.json` row through the
 		// `gjc state handoff` and `gjc state clear` runtime verbs. The prompt
 		// observer must not overwrite an existing row (that clobbered handoff
@@ -10989,7 +11356,7 @@ export class AgentSession {
 		if (this.isRetrying) return false;
 		const messages = this.agent.state.messages;
 		const last = messages[messages.length - 1];
-		return last?.role === "assistant";
+		return last?.role === "assistant" || last?.role === "bashExecution" || last?.role === "pythonExecution";
 	}
 
 	queueDeferredMessage(message: CustomMessage): void {
@@ -11440,10 +11807,21 @@ export class AgentSession {
 			if (images.length === 0) images = undefined;
 		}
 
-		const admissionSignal = options?.preflightSignal
+		let admissionSignal = options?.preflightSignal
 			? AbortSignal.any([this.#promptPreflightAbortController.signal, options.preflightSignal])
 			: this.#promptPreflightAbortController.signal;
-		const preflightCancellationGeneration = this.#promptPreflightCancellationGeneration;
+		let preflightCancellationGeneration = this.#promptPreflightCancellationGeneration;
+		let waitedForAbortUnwind = false;
+		if (this.#abortUnwind && options?.deliverAs === undefined) {
+			// Same terminal-abort fence as `prompt()`: an overlapping second abort
+			// refuses this retained submission instead of letting it start late.
+			if (!(await this.#awaitAbortUnwindFence())) throw promptPreflightCancelledError();
+			preflightCancellationGeneration = this.#promptPreflightCancellationGeneration;
+			admissionSignal = options?.preflightSignal
+				? AbortSignal.any([this.#promptPreflightAbortController.signal, options.preflightSignal])
+				: this.#promptPreflightAbortController.signal;
+			waitedForAbortUnwind = true;
+		}
 		// Classify and reserve follow-up order synchronously, before any await
 		// (selection fence or durable acceptance): a follow-up dispatch that is
 		// not yet durably enqueued must already count as ahead, or a later plain
@@ -11451,7 +11829,14 @@ export class AgentSession {
 		// delivery/steering and overtake it. The reservation is released once
 		// the durable enqueue settles either way, so a rejected or cancelled
 		// acceptance leaves no phantom ordering behind.
-		const queuedPlainPrompt = options?.queuedAtDispatch === true && options.deliverAs === undefined;
+		// A busy SDK dispatch is only queued while the agent loop is live.
+		// Abort unwind is not a live loop: queuedAtDispatch from that window
+		// must not divert a fresh prompt into the dying turn's steer queue.
+		// Keep the original busy-dispatch bit for promotion/ownership: after
+		// unwind the successor starts its own turn and must fire onQueuedPromoted
+		// so SDK pending correlation is not dropped.
+		const dispatchedWhileBusy = options?.queuedAtDispatch === true && options.deliverAs === undefined;
+		const queuedPlainPrompt = dispatchedWhileBusy;
 		const hasFollowUpAhead = (): boolean =>
 			this.#activeFollowUpReservationEpochs.size > 0 ||
 			this.agent.snapshotFollowUp().length > 0 ||
@@ -11462,6 +11847,7 @@ export class AgentSession {
 			!followUpAheadAtReservation &&
 			!this.agent.state.isStreaming &&
 			!this.#canAutoContinueForSteer();
+		const promoteAfterAbortUnwind = waitedForAbortUnwind && dispatchedWhileBusy && !followUpAheadAtReservation;
 		const deliverAs =
 			options?.deliverAs ??
 			(queuedPlainPrompt
@@ -11539,7 +11925,9 @@ export class AgentSession {
 			// Compaction is intentionally NOT diverted here: prompt() handles an
 			// in-flight compaction internally, and #queueSteer would otherwise park
 			// the message in the steering queue with no turn to consume it.
-			if (this.isStreaming) {
+			// Abort unwind is awaited before classification so a successor is not
+			// parked in the dying turn's steer queue.
+			if (this.#isLiveTurnBusy() && !waitedForAbortUnwind) {
 				if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
 				assertPreflightStillOpen();
 				await this.#queueSteer(text, images, {
@@ -11554,7 +11942,7 @@ export class AgentSession {
 			// Use prompt() with expandPromptTemplates: false to skip command handling and template expansion
 			let queuedPromotionFired = false;
 			const fireQueuedPromotion = () => {
-				if (!freshAtReservation || queuedPromotionFired) return;
+				if ((!freshAtReservation && !promoteAfterAbortUnwind) || queuedPromotionFired) return;
 				queuedPromotionFired = true;
 				options?.onQueuedPromoted?.();
 			};
@@ -11566,7 +11954,7 @@ export class AgentSession {
 					fireQueuedPromotion();
 				},
 				onPreflightAcceptCommit:
-					options?.onPreflightAcceptCommit || freshAtReservation
+					options?.onPreflightAcceptCommit || freshAtReservation || promoteAfterAbortUnwind
 						? async () => {
 								if (options?.onPreflightAcceptCommit) await options.onPreflightAcceptCommit();
 								else options?.onPreflightAccepted?.();
@@ -11599,6 +11987,21 @@ export class AgentSession {
 	get queuedMessageCount(): number {
 		return this.#steeringMessages.length + this.#followUpMessages.length + this.#pendingNextTurnMessages.length;
 	}
+	/**
+	 * Number of pending messages a user-facing drain can actually deliver back:
+	 * exactly the steering and follow-up queues that `clearQueue()`,
+	 * `popLastQueuedMessage()`, and `getQueuedMessageEntries()` operate on.
+	 *
+	 * Hidden next-turn context is deliberately excluded. Those entries are
+	 * authored by the agent (e.g. a `todo_write` failure reminder queued with
+	 * `deliverAs: "nextTurn"` and no `triggerTurn`), are never returned by the
+	 * drain handlers, and deliberately survive turn completion — so a UI gate
+	 * that counted them would report permanently pending work that no key press
+	 * can clear, locking the user out of their own input (#4741).
+	 */
+	get drainableQueuedMessageCount(): number {
+		return this.#steeringMessages.length + this.#followUpMessages.length;
+	}
 	/** Typed pending-message counts per queue (steering, follow-up, next-turn). */
 	get pendingMessageCounts(): { steering: number; followUp: number; nextTurn: number } {
 		return {
@@ -11728,6 +12131,27 @@ export class AgentSession {
 		return this.#skills;
 	}
 
+	/**
+	 * Install the skill set discovered at a newly rescoped cwd (`move_session`).
+	 * Project-scoped skills belong to the directory they were discovered in, so
+	 * they must not survive a move out of it.
+	 */
+	async replaceSkills(skills: Skill[]): Promise<void> {
+		this.#skills = skills;
+		await this.refreshBaseSystemPrompt();
+	}
+
+	/**
+	 * Retire the cached workspace tree after a rescope so the next turn re-scans
+	 * at the new cwd instead of re-presenting the abandoned launcher root.
+	 */
+	retireWorkspaceTreeForRescope(): void {
+		this.#initialWorkspaceTree = undefined;
+		this.#cachedWorkspaceTree = undefined;
+		this.#cachedWorkspaceTreeAt = 0;
+		this.#pendingWorkspaceTreeRescope = true;
+	}
+
 	/** Skill loading warnings captured by SDK */
 	get skillWarnings(): readonly SkillWarning[] {
 		return this.#skillWarnings;
@@ -11751,13 +12175,16 @@ export class AgentSession {
 		this.setTodoPhases(phases.filter(p => p.tasks.length > 0));
 	}
 
-	async #compactionStateSnapshot(): Promise<CompactionStateSnapshot> {
+	async #compactionStateSnapshot(
+		options: { trackWorkflowRecoveryProgress?: boolean } = {},
+	): Promise<CompactionStateSnapshot> {
 		const snapshot: CompactionStateSnapshot = {
 			goal: undefined,
 			openTodos: [],
 			activeSkills: [],
 			queuedMessages: false,
 			lastAssistantStopReason: undefined,
+			recentFileMutations: [],
 		};
 		try {
 			const goalState = this.getGoalModeState();
@@ -11780,6 +12207,9 @@ export class AgentSession {
 				error: error instanceof Error ? error.message : String(error),
 			});
 		}
+		// #4560: clear before the read so a failed refresh can never leave a
+		// previous run's workflow owner in place for the recovery projector.
+		this.#lastCompactionActiveSkills = [];
 		try {
 			const state = await readVisibleSkillActiveState(this.sessionManager.getCwd(), this.sessionId, {
 				bypassCache: true,
@@ -11788,11 +12218,40 @@ export class AgentSession {
 				.filter(entry => entry.active !== false)
 				.slice(0, 5)
 				.map(entry => ({ skill: entry.skill, phase: entry.phase ?? "unknown" }));
+			this.#lastCompactionActiveSkills = snapshot.activeSkills;
 		} catch (error) {
 			logger.warn("Failed to read workflow state for compaction snapshot", {
 				error: error instanceof Error ? error.message : String(error),
 			});
 		}
+		try {
+			// #4560: reload the durable workflow contract for recognized
+			// Ralplan/Ultragoal runs so compaction carries a structured
+			// recovery projection instead of summary prose alone. Degrades
+			// safely: malformed/stale/tampered durable state leaves the
+			snapshot.workflowRecovery =
+				snapshot.goal?.status === "paused" ? undefined : await this.#projectWorkflowRecovery();
+			if (snapshot.workflowRecovery && options.trackWorkflowRecoveryProgress) {
+				this.#workflowRecoveryMemory = trackWorkflowRecoveryZeroProgress(
+					this.#workflowRecoveryMemory,
+					snapshot.workflowRecovery,
+				);
+			}
+			if (snapshot.workflowRecovery && this.#workflowRecoveryMemory) {
+				snapshot.workflowRecovery = {
+					...snapshot.workflowRecovery,
+					zeroProgress: {
+						...snapshot.workflowRecovery.zeroProgress,
+						unchangedObservations: this.#workflowRecoveryMemory.unchangedObservations,
+						stalled: isWorkflowRecoveryStalled(this.#workflowRecoveryMemory),
+					},
+				};
+			}
+		} catch (error) {
+			logger.warn("Failed to project workflow recovery state for compaction snapshot", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+		}
 		try {
 			snapshot.queuedMessages = this.agent.hasQueuedMessages() || this.#pendingNextTurnMessages.length > 0;
 		} catch (error) {
@@ -11812,9 +12271,43 @@ export class AgentSession {
 				error: error instanceof Error ? error.message : String(error),
 			});
 		}
+		try {
+			snapshot.recentFileMutations = collectRecentFileMutations(this.messages);
+		} catch (error) {
+			logger.warn("Failed to read recent file mutations for compaction snapshot", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+		}
 		return snapshot;
 	}
 
+	/**
+	 * #4560: derive the structured workflow recovery projection for an
+	 * active recognized workflow from its canonical durable state. Returns
+	 * undefined for inactive/unrecognized workflows (generic behavior is
+	 * preserved) and for malformed durable state (safe degradation).
+	 */
+	async #projectWorkflowRecovery(): Promise<WorkflowRecoveryProjection | undefined> {
+		const entries = (this.#lastCompactionActiveSkills ?? []).filter(
+			entry => !isWorkflowContinuationInert(entry.skill, entry.phase),
+		);
+		const cwd = this.sessionManager.getCwd();
+		// Ultragoal runs own the live execution contract; prefer their plan.
+		if (entries.some(entry => entry.skill === "ultragoal")) {
+			const projection = await projectUltragoalRun({ cwd, sessionId: this.sessionId }).catch(() => undefined);
+			if (projection) return projection;
+		}
+		if (entries.some(entry => entry.skill === "ralplan")) {
+			const projection = await projectLatestRalplanRun({ cwd, sessionId: this.sessionId }).catch(() => undefined);
+			if (projection) return projection;
+		}
+		return undefined;
+	}
+	/** #4560: zero-progress memory across compaction observations. */
+	#workflowRecoveryMemory: WorkflowRecoveryZeroProgressMemory | undefined;
+	/** #4560: active skills observed by the latest compaction snapshot. */
+	#lastCompactionActiveSkills: Array<{ skill: string; phase: string }> = [];
+
 	#compactionStateContext(snapshot: CompactionStateSnapshot): string[] {
 		const context: string[] = [];
 		const goal = snapshot.goal;
@@ -11834,6 +12327,12 @@ export class AgentSession {
 			const todos = snapshot.openTodos.map(todo => sanitizeCompactionStateText(todo, 120));
 			context.push(`Open todos: ${todos.join("; ")}`);
 		}
+		if (snapshot.recentFileMutations.length > 0) {
+			const files = snapshot.recentFileMutations.map(filePath => sanitizeCompactionStateText(filePath, 120));
+			context.push(`Recent file mutations: ${files.join("; ")}`);
+		}
+		const recovery = snapshot.workflowRecovery;
+		if (recovery) context.push(...renderWorkflowRecoveryContext(recovery));
 		return context;
 	}
 
@@ -11957,6 +12456,7 @@ export class AgentSession {
 		this.#markRetryReplayUnsafe();
 		this.abortRetry();
 		this.#promptGeneration++;
+		this.#abortEpoch++;
 		this.#promptPreflightCancellationGeneration++;
 		this.#promptPreflightAbortController.abort();
 		this.#promptPreflightAbortController = new AbortController();
@@ -11980,66 +12480,94 @@ export class AgentSession {
 			| "internal";
 		silent?: boolean;
 	}): Promise<AbortOutcome> {
-		this.#abortOptions(options);
-		const postPromptDrain = this.#cancelPostPromptTasks();
-		const managedLogicalRunId =
-			this.#defaultFallbackChain().chain.entries.length > 1 ? this.agent.currentManagedLogicalRunId : undefined;
-		this.agent.abort();
-		const cleanup = Promise.all([postPromptDrain, this.agent.waitForIdle()]).then(
-			() => ({ kind: "settled" as const }),
-			(cause: unknown) => ({ kind: "error" as const, cause }),
-		);
-		cleanup.catch(() => {});
-		let outcome: AbortOutcome;
-		if (options?.timeoutMs !== undefined && options.timeoutMs > 0) {
-			outcome = await Promise.race([
-				cleanup,
-				Bun.sleep(options.timeoutMs).then(() => ({ kind: "timeout" as const })),
-			]);
-			if (outcome.kind === "timeout") {
-				this.#abandonPostPromptTasks();
-				const forceAbortLogicalRunId = this.agent.currentManagedLogicalRunId ?? this.#activeLogicalRunId;
-				try {
-					if (forceAbortLogicalRunId !== undefined)
-						this.agent.forceAbort("Abort cleanup timed out", forceAbortLogicalRunId);
-					else this.agent.forceAbort("Abort cleanup timed out");
-				} catch {
-					this.agent.forceAbort("Abort cleanup timed out");
+		// Advance the admission epoch SYNCHRONOUSLY, before any await and before the
+		// shared-unwind branch. A second abort that piggybacks on the first unwind
+		// still creates a cancellation fence, so a prompt admitted between the two
+		// aborts is refused rather than started after the shared unwind resolves.
+		this.#abortAdmissionEpoch++;
+		if (this.#abortUnwind) {
+			// The shared unwind already ran `#abortOptions` for the FIRST abort, so this
+			// abort must still apply the effects that are specific to its own request.
+			//
+			// Cancellation fence: a prompt admitted before this abort keeps a live
+			// generation and preflight signal otherwise, and would start after the
+			// shared unwind resolves — work the user has already aborted twice.
+			this.#promptPreflightCancellationGeneration++;
+			this.#promptPreflightAbortController.abort();
+			this.#promptPreflightAbortController = new AbortController();
+			// Abort visibility is per-request: a later real abort must not inherit an
+			// earlier silent abort's suppression and swallow the user-visible notice.
+			if (options?.silent !== true) this.#silentAbortPending = false;
+			await this.#abortUnwind;
+			return { kind: "settled" };
+		}
+		const unwind = Promise.withResolvers<void>();
+		this.#abortUnwind = unwind.promise;
+		try {
+			this.#abortOptions(options);
+			const postPromptDrain = this.#cancelPostPromptTasks();
+			const managedLogicalRunId =
+				this.#defaultFallbackChain().chain.entries.length > 1 ? this.agent.currentManagedLogicalRunId : undefined;
+			this.agent.abort();
+			const cleanup = Promise.all([postPromptDrain, this.agent.waitForIdle()]).then(
+				() => ({ kind: "settled" as const }),
+				(cause: unknown) => ({ kind: "error" as const, cause }),
+			);
+			cleanup.catch(() => {});
+			let outcome: AbortOutcome;
+			if (options?.timeoutMs !== undefined && options.timeoutMs > 0) {
+				outcome = await Promise.race([
+					cleanup,
+					Bun.sleep(options.timeoutMs).then(() => ({ kind: "timeout" as const })),
+				]);
+				if (outcome.kind === "timeout") {
+					this.#abandonPostPromptTasks();
+					const forceAbortLogicalRunId = this.agent.currentManagedLogicalRunId ?? this.#activeLogicalRunId;
+					try {
+						if (forceAbortLogicalRunId !== undefined)
+							this.agent.forceAbort("Abort cleanup timed out", forceAbortLogicalRunId);
+						else this.agent.forceAbort("Abort cleanup timed out");
+					} catch {
+						this.agent.forceAbort("Abort cleanup timed out");
+					}
+					this.emitNotice(
+						"warning",
+						"Abort cleanup timed out; forced session recovery. The previous provider stream or tool may still be unwinding in the background.",
+						"abort",
+					);
 				}
-				this.emitNotice(
-					"warning",
-					"Abort cleanup timed out; forced session recovery. The previous provider stream or tool may still be unwinding in the background.",
-					"abort",
-				);
+			} else {
+				outcome = await cleanup;
 			}
-		} else {
-			outcome = await cleanup;
-		}
-		try {
-			await this.#goalRuntime.onTaskAborted({ reason: options?.goalReason ?? "interrupted" });
-			if (managedLogicalRunId !== undefined)
-				this.agent.requestRunTerminal(managedLogicalRunId, { stopReason: "cancelled" });
-			this.#flushPendingBackgroundExchanges();
-			this.#flushPendingAgentEnd();
-			if (
-				!this.#cancelAndSubmitInProgress &&
-				(options?.cause ?? "internal") === "user_interrupt" &&
-				this.agent.hasQueuedSteering()
-			) {
-				this.#scheduleAgentContinue({
-					delayMs: 1,
-					generation: this.#promptGeneration,
-					shouldContinue: () => this.agent.hasQueuedSteering(),
-					rescheduleOnBusy: true,
-					continueQueuedOnly: true,
-				});
+			try {
+				await this.#goalRuntime.onTaskAborted({ reason: options?.goalReason ?? "interrupted" });
+				if (managedLogicalRunId !== undefined)
+					this.agent.requestRunTerminal(managedLogicalRunId, { stopReason: "cancelled" });
+				this.#flushPendingBackgroundExchanges();
+				await this.#awaitAbortedTurnTerminal();
+				if (
+					!this.#cancelAndSubmitInProgress &&
+					(options?.cause ?? "internal") === "user_interrupt" &&
+					this.agent.hasQueuedSteering()
+				) {
+					this.#scheduleAgentContinue({
+						delayMs: 1,
+						generation: this.#promptGeneration,
+						shouldContinue: () => this.agent.hasQueuedSteering(),
+						rescheduleOnBusy: true,
+						continueQueuedOnly: true,
+					});
+				}
+				return outcome;
+			} catch (cause) {
+				return { kind: "error", cause };
+			} finally {
+				this.#silentAbortPending = false;
+				if (this.#toolChoiceQueue.hasInFlight) this.#toolChoiceQueue.reject("aborted");
 			}
-			return outcome;
-		} catch (cause) {
-			return { kind: "error", cause };
 		} finally {
-			this.#silentAbortPending = false;
-			if (this.#toolChoiceQueue.hasInFlight) this.#toolChoiceQueue.reject("aborted");
+			this.#abortUnwind = undefined;
+			unwind.resolve();
 		}
 	}
 
@@ -14952,7 +15480,7 @@ export class AgentSession {
 			const compactionAbortController = new AbortController();
 			this.#compactionAbortController = compactionAbortController;
 			// Take this invocation's state snapshot for the summarizer context.
-			const compactionStateSnapshot = await this.#compactionStateSnapshot();
+			const compactionStateSnapshot = await this.#compactionStateSnapshot({ trackWorkflowRecoveryProgress: true });
 
 			try {
 				if (!this.model) {
@@ -15061,7 +15589,6 @@ export class AgentSession {
 				if (compactionAbortController.signal.aborted) {
 					throw new CompactionCancelledError();
 				}
-
 				const compactionEntryId = this.sessionManager.appendCompaction(
 					summary,
 					shortSummary,
@@ -17007,7 +17534,7 @@ export class AgentSession {
 			if (autoCompactionSignal.aborted) return { kind: "aborted", source: "signal" };
 			await this.#emitSessionEvent({ type: "auto_compaction_start", reason, action });
 			if (autoCompactionSignal.aborted) return await emitAborted();
-			const compactionStateSnapshot = await this.#compactionStateSnapshot();
+			const compactionStateSnapshot = await this.#compactionStateSnapshot({ trackWorkflowRecoveryProgress: true });
 			if (autoCompactionSignal.aborted || this.#isDisposed || this.#promptGeneration !== generation) {
 				return await emitAborted();
 			}
@@ -17555,6 +18082,10 @@ export class AgentSession {
 		if (this.#isTerminalProviderFirstEventTimeout(message)) return false;
 		if (message.errorMessage?.startsWith("Model fallback chain exhausted;")) return false;
 		const transportFailure = message.transportFailure;
+		// Transport facts normally bypass typed classification in managed fallback.
+		// A provider safety stop must still remain terminal on that path.
+		if (message.stopReason === "error" && message.errorKind === "provider_safety_stop" && transportFailure)
+			return false;
 		const contextWindow = this.model?.contextWindow ?? 0;
 		if (classifyContextOverflow(message, transportFailure, contextWindow)) return false;
 		const managedFallback = this.#defaultFallbackChain().chain.entries.length > 1;
@@ -17796,6 +18327,15 @@ export class AgentSession {
 		return undefined;
 	}
 
+	#escapedNonAsciiRecoveryMessage(): UserMessage {
+		return {
+			role: "user",
+			content: ESCAPED_NONASCII_RECOVERY_PROMPT,
+			synthetic: true,
+			timestamp: Date.now(),
+		};
+	}
+
 	#managedFallbackPromptOptions(): {
 		fallbackManaged?: boolean;
 		nextFallbackAttempt?: (model: Model) => FallbackAttemptToken;
@@ -17821,6 +18361,9 @@ export class AgentSession {
 	}
 
 	async #resetDefaultFallbackForNewTurn(): Promise<void> {
+		// A fresh user turn gets a fresh escaped-non-ASCII retry budget: the
+		// defect is per-turn wire luck, not a sticky model property.
+		this.#escapedNonAsciiManagedRetries = 0;
 		const controller = this.#defaultFallbackChain();
 		if (this.#defaultFallbackExhaustedLastTurn) {
 			this.#defaultFallbackExhaustedLastTurn = false;
@@ -17924,15 +18467,35 @@ export class AgentSession {
 			// evidence: never charge the attempt, advance the chain, or suppress the
 			// selector. The loop already removed the defective turn from history and
 			// bounded its own resample budget, so this decision just re-issues the
-			// same request on the same model. Once the loop declines (budget spent),
-			// it falls through to the terminal per-call rejection, so the retry here
-			// is a continuation of the same logical run rather than a new prompt.
+			// same request on the same model. The re-issue carries the transient
+			// steering instruction exactly once (when the discarded attempt did not
+			// already have one), so a deterministic escaper has a reason to change
+			// its spelling; the instruction never lands in durable history.
+			//
+			// The retries are un-charged by design, so a deterministic escaper
+			// would otherwise loop forever: each continuation is a fresh loop with
+			// a fresh in-loop resample budget, and the fallback chain never sees a
+			// charge to exhaust on. Bound them per logical run and fail closed to
+			// the terminal exhaustion message once the budget is spent — the same
+			// fail-closed answer the unmanaged path gives via the per-call
+			// rejection. New user turns reset the budget in #resetDefaultFallbackForNewTurn.
+			this.#escapedNonAsciiManagedRetries += 1;
+			if (this.#escapedNonAsciiManagedRetries > MAX_ESCAPED_NONASCII_MANAGED_RETRIES) {
+				return this.#managedFallbackExhaustionDecision(
+					outcome.message,
+					`Managed fallback retried the escaped non-ASCII tool-call turn ${MAX_ESCAPED_NONASCII_MANAGED_RETRIES} times without a literal-UTF-8 re-issue; giving up so the run fails closed instead of looping.`,
+				);
+			}
 			this.#defaultFallbackChain().discardStartedAttempt();
+			const steering = outcome.steeringPending === true;
 			return {
 				type: "retry",
 				continuation: async ownership => {
 					if (!ownership.isCurrent() || ownership.lease.signal.aborted) return;
-					await this.agent.continue(this.#managedFallbackPromptOptions());
+					await this.agent.continue({
+						...this.#managedFallbackPromptOptions(),
+						...(steering ? { transientRecoveryMessage: this.#escapedNonAsciiRecoveryMessage() } : {}),
+					});
 				},
 			};
 		}
@@ -18027,6 +18590,7 @@ export class AgentSession {
 		// result is returned verbatim below. Narrowing it away here would silently
 		// disable the terminal-403 guard in `#markFailedCredential`.
 	): { class: FallbackTriggerClass; retryAfterMs?: number; authDisposition?: AuthDisposition } | undefined {
+		if (message.stopReason === "error" && message.errorKind === "provider_safety_stop") return undefined;
 		if (classifyContextOverflow(message, transportFailure, this.model?.contextWindow ?? 0)) return undefined;
 		const transport = classifyFallbackTrigger(transportFailure ?? { status: message.errorStatus });
 		if (transport.class !== "other") return transport;
@@ -18247,6 +18811,18 @@ export class AgentSession {
 					}
 				: false;
 		}
+		// A typed provider safety stop is terminal even when managed fallback is
+		// enabled. Preserve the original refusal instead of treating the absent
+		// fallback trigger as chain exhaustion; do not broaden this to every
+		// untyped terminal classification.
+		if (message.stopReason === "error" && message.errorKind === "provider_safety_stop") {
+			return managedOutcome
+				? {
+						type: "terminal",
+						terminal: { stopReason: "error", messages: [message] },
+					}
+				: false;
+		}
 		// retry.enabled=false always surfaces immediately, matching the explicit
 		// user opt-out. The managed provider-fallback chain keeps its own
 		// availability policy.
@@ -18260,6 +18836,7 @@ export class AgentSession {
 		}
 		const firstEventTimeout = classification === "first_event_timeout";
 		const emptyResponse = classification === "empty_response";
+		const canReplayProviderOverload = isBareDefaultCodexOverload(message) || isBareDefaultAnthropicOverload(message);
 		const reportedRetryMaxAttempts = transportFailure?.retryMaxAttempts;
 		if (reportedRetryMaxAttempts !== undefined) {
 			this.#providerRetryMaxAttempts = Math.min(
@@ -18338,24 +18915,22 @@ export class AgentSession {
 		if (!managedFallback && assistantMessageHasVisibleOrToolContent(message)) {
 			return false;
 		}
-		// Bare defaults retain their narrow watchdog and Codex admissions. A
-		// first-event timeout adds the typed, content-free, current-clean-scope
-		// requirement above; other transient watchdogs preserve legacy behavior.
+		// Bare defaults retain their narrow watchdog and provider capacity-overload
+		// admissions. A first-event timeout adds the typed, content-free,
+		// current-clean-scope requirement above; other transient watchdogs preserve
+		// legacy behavior. A provider overload is admitted only from that provider's
+		// own typed overload code on a content-free attempt carrying no conflicting
+		// transport facts, so replaying it cannot duplicate observable work.
 		const canReplayEmptyResponse = emptyResponse && (this.#retryAttempt === 0 || this.#hasCleanRetryReplaySafety);
 		if (!managedFallback && !legacyRetryConfigured && !canReplayRotatedCredential && !canReplayEmptyResponse) {
-			const bareDefaultCodexOverload = isBareDefaultCodexOverload(message);
-			const canReplayCodexOverload = bareDefaultCodexOverload;
 			if (
-				(!canReplayCodexOverload &&
+				(!canReplayProviderOverload &&
 					!this.#isTypedFirstEventTimeout(message) &&
 					!messageOnlyWatchdogTimeout &&
 					(hasBareDefaultRetryDisqualifyingFacts(message) ||
 						(classification !== "transient" && classification !== "first_event_timeout") ||
 						!BARE_DEFAULT_WATCHDOG_ERROR.test(message.errorMessage ?? ""))) ||
-				(!canReplayCodexOverload &&
-					!firstEventTimeout &&
-					!messageOnlyWatchdogTimeout &&
-					!this.#hasCleanRetryReplaySafety)
+				(!firstEventTimeout && !messageOnlyWatchdogTimeout && !this.#hasCleanRetryReplaySafety)
 			) {
 				return false;
 			}
@@ -18363,6 +18938,7 @@ export class AgentSession {
 		const legacyUnbounded =
 			!managedFallback &&
 			classification === "transient" &&
+			!canReplayProviderOverload &&
 			!this.#isIdleStreamStallErrorMessage(message.errorMessage ?? "");
 
 		const failedSelector = managedFallback ? controller.currentSelector() : undefined;