@gajae-code/coding-agent 0.15.5 → 0.16.0

package/src/session/agent-session.ts

@@ -117,6 +117,7 @@ import {
 	modelsAreEqual,
 	streamSimple,
 } from "@gajae-code/ai/core";
+import { normalizeAnthropicBaseUrl } from "@gajae-code/ai/providers/anthropic";
 import {
 	type AuthDisposition,
 	beginAttempt,
@@ -181,8 +182,10 @@ export interface ForkContextSeedOptions {
 }
 
 import type { AuthCredentialSelector } from "@gajae-code/ai/core";
+import { isFoundryEnabled } from "@gajae-code/ai/utils/foundry";
 import type { MacOSPowerAssertion } from "@gajae-code/natives";
 import {
+	$pickCredentialEnv,
 	extractRetryHint,
 	hasFsCode,
 	isEacces,
@@ -312,9 +315,16 @@ import {
 } from "../gjc-runtime/session-layout";
 import {
 	type CoordinatorToolObservation,
+	clearCoordinatorRuntimeStateRescope,
+	hasCoordinatorRuntimeStateRescopeJournal,
+	markCoordinatorRuntimeStateRescopePublishing,
 	ownerTerminalContextFromEnvironment,
 	persistCoordinatorRuntimeStateFromEvent,
+	persistCoordinatorWorkerIntegrationOutcome,
+	prepareCoordinatorRuntimeStateRescope,
+	recoverCoordinatorRuntimeStateRescope,
 	registerCoordinatorRuntimeStateFinalizer,
+	relocateCoordinatorRuntimeStateForRescope,
 	UNPROVEN_TOOL_LABEL,
 } from "../gjc-runtime/session-state-sidecar";
 import {
@@ -443,6 +453,7 @@ import {
 } from "./contribution-prep";
 import { canonicalCoordinatorToolLabel } from "./coordinator-tool-label";
 import { pruneStaleFileMentions } from "./file-mention-pruning";
+import { describeFoldReceipt, FOLD_WAKE_MERGE_WINDOW_MS, type FoldAdapter, FoldCoordinator } from "./fold-coordinator";
 import type { MemoryGuardRestoreResult } from "./memory-guard-checkpoint-participant";
 import {
 	type BashExecutionMessage,
@@ -457,6 +468,7 @@ import {
 	SKILL_PROMPT_MESSAGE_TYPE,
 } from "./messages";
 import { isLegacyProviderSafetyStopMessage } from "./provider-safety-stop";
+import { readSdkRunCapability } from "./sdk-run-capability";
 import { formatSessionDumpText } from "./session-dump-format";
 import type {
 	BranchSummaryEntry,
@@ -471,7 +483,6 @@ import type {
 	SessionManagerCloseOutcome,
 	SessionMemoryStats,
 } from "./session-manager";
-
 import {
 	createReadonlySessionManager,
 	getLatestCompactionEntry,
@@ -488,6 +499,8 @@ import {
 	bindToolLineage,
 	classifyOwnedEnvelope,
 	isOwnedCompletionEnvelope,
+	isOwnedCompletionEnvelopeAllowed,
+	lookupOwnedRegistration,
 	lookupTerminalScope,
 	mintTurnLineageIdHash,
 	type OwnedCompletionEnvelope,
@@ -496,11 +509,35 @@ import {
 	settleToolLineageRegistrationWindow,
 	unregisterOwnedRegistration,
 } from "./terminal-abort";
-
 import { ToolChoiceQueue } from "./tool-choice-queue";
 import { pruneSupersededMaintenanceReminders, pruneSupersededVolatileProjectContext } from "./volatile-context-pruning";
 import { YieldQueue } from "./yield-queue";
 
+const ASYNC_INLINE_RESULT_MAX_CHARS = 12_000;
+const ASYNC_PREVIEW_MAX_CHARS = 4_000;
+
+async function formatParkedAsyncResult(
+	sessionManager: SessionManager,
+	result: string,
+	allowArtifact = true,
+): Promise<string> {
+	if (result.length <= ASYNC_INLINE_RESULT_MAX_CHARS) return result;
+	const preview = `${result.slice(0, ASYNC_PREVIEW_MAX_CHARS)}\n\n[Output truncated. Showing first ${ASYNC_PREVIEW_MAX_CHARS.toLocaleString()} characters.]`;
+	try {
+		if (!allowArtifact) return preview;
+		const { path: artifactPath, id: artifactId } = await sessionManager.allocateArtifactPath("async");
+		if (artifactPath && artifactId) {
+			await Bun.write(artifactPath, result);
+			return `${preview}\nFull output: artifact://${artifactId}`;
+		}
+	} catch (error) {
+		logger.warn("Failed to persist parked async follow-up artifact", {
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+	return preview;
+}
+
 /**
  * #4560: structured workflow recovery projection from canonical durable
  * Ralplan/Ultragoal state, consumed by the compaction summary context and
@@ -1048,10 +1085,23 @@ export interface PromptOptions {
 	onSkillPrepared?: (meta: { name: string; path: string; lineCount?: number; cleanedArgs?: string }) => void;
 	/** Optional invocation-scoped cancellation fence used before an accepted skill starts execution. */
 	preflightSignal?: AbortSignal;
-	/** Internal SDK lifecycle owner token. */
-	sdkRunToken?: string;
+	/** Internal host capability; ordinary package callers cannot construct the branded value. */
+	sdkRunCapability?: unknown;
 }
 
+type InternalPromptOptions = PromptOptions & { sdkRunToken?: string };
+type InternalCustomMessageOptions = Pick<
+	PromptOptions,
+	| "streamingBehavior"
+	| "toolChoice"
+	| "followUpQueuePolicy"
+	| "onPreflightAccepted"
+	| "onPreflightAcceptCommit"
+	| "preflightSignal"
+> & {
+	sdkRunToken?: string;
+};
+
 function promptPreflightCancelledError(): Error {
 	const error = Object.assign(new Error("Prompt preflight was cancelled before execution."), { code: "busy" });
 	error.name = "PromptPreflightCancelledError";
@@ -1626,14 +1676,44 @@ function buildSessionMetadata(
 	provider: string,
 	authStorage: AuthStorage | undefined,
 	credentialSessionId = sessionId,
+	model?: Model,
+	owner?: object,
 ): Record<string, unknown> {
 	const userId: Record<string, string> = { session_id: sessionId };
 	// Only look up account_uuid when the request is going to Anthropic. Injecting
 	// a Anthropic model OAuth account_uuid into requests bound for other providers (including
 	// Anthropic-format-compatible proxies like cloudflare-ai-gateway or gitlab-duo)
 	// would leak the user's Anthropic identity to unrelated third-party APIs.
-	if (provider === "anthropic") {
-		const accountUuid = authStorage?.getOAuthAccountId("anthropic", credentialSessionId);
+	const effectiveBaseUrl =
+		model?.provider === "anthropic"
+			? (normalizeAnthropicBaseUrl(
+					(isFoundryEnabled() ? $pickCredentialEnv("FOUNDRY_BASE_URL") : undefined) ?? model.baseUrl,
+				) ?? "https://api.anthropic.com")
+			: undefined;
+	let officialAnthropicEndpoint = false;
+	if (provider === "anthropic" && model?.api === "anthropic-messages") {
+		try {
+			const candidate = effectiveBaseUrl ?? "https://api.anthropic.com";
+			const url = new URL(candidate);
+			const authority = candidate.match(/^[a-z][a-z\d+.-]*:\/\/([^/?#]*)/iu)?.[1];
+			officialAnthropicEndpoint =
+				url.protocol === "https:" &&
+				url.hostname === "api.anthropic.com" &&
+				authority?.toLowerCase() === "api.anthropic.com" &&
+				!url.username &&
+				!url.password &&
+				!url.search &&
+				!url.hash &&
+				(url.pathname === "/" || url.pathname === "/v1" || url.pathname === "/v1/");
+		} catch {
+			officialAnthropicEndpoint = false;
+		}
+	}
+	// Without the registry owner, do not query shared auth storage: an unscoped
+	// lookup can attribute a registry-scoped API-key request to another OAuth
+	// account. Compatibility facades therefore retain session_id-only metadata.
+	if (officialAnthropicEndpoint && owner) {
+		const accountUuid = authStorage?.getOAuthAccountId("anthropic", credentialSessionId, { owner });
 		if (typeof accountUuid === "string" && accountUuid.length > 0) {
 			userId.account_uuid = accountUuid;
 			// Derive device_id from account_uuid so the payload matches the real CC
@@ -1914,9 +1994,24 @@ export type BeforeAgentStartContributor = (event: {
 }) => Promise<BeforeAgentStartInternalMessage | undefined>;
 
 const AGENT_END_WORKER_INTEGRATION_TIMEOUT_MS = 5_000;
+const POST_PUBLICATION_ERROR_MAX_BYTES = 512;
+
+export type WorkerIntegrationOutcome =
+	| { status: "completed" }
+	| { status: "failed"; error: string }
+	| { status: "timed_out" };
+
+function sanitizePostPublicationError(error: string | undefined): string | undefined {
+	if (error === undefined) return undefined;
+	const normalized = error
+		.replace(/[\u0000-\u001f\u007f]/gu, " ")
+		.replace(/\s+/gu, " ")
+		.trim();
+	return truncateHeadBytes(normalized || "unknown worker integration error", POST_PUBLICATION_ERROR_MAX_BYTES).text;
+}
 
 export class WorkerIntegrationRequestScheduler {
-	#inFlight: Promise<void> | undefined = undefined;
+	#inFlight: Promise<WorkerIntegrationOutcome> | undefined = undefined;
 	#pending = false;
 
 	constructor(
@@ -1933,9 +2028,15 @@ export class WorkerIntegrationRequestScheduler {
 	}
 
 	async flush(): Promise<void> {
+		await this.flushWithOutcome();
+	}
+
+	async flushWithOutcome(): Promise<WorkerIntegrationOutcome> {
+		let outcome: WorkerIntegrationOutcome = { status: "completed" };
 		while (this.#inFlight) {
-			await this.#inFlight;
+			outcome = await this.#inFlight;
 		}
+		return outcome;
 	}
 
 	#start(): void {
@@ -1945,16 +2046,22 @@ export class WorkerIntegrationRequestScheduler {
 		try {
 			request = this.request(controller.signal);
 		} catch {
-			request = Promise.resolve();
+			request = Promise.reject(new Error("Worker integration request failed before dispatch."));
 		}
 		let timeout: ReturnType<typeof setTimeout> | undefined;
-		const deadline = new Promise<void>(resolve => {
+		const deadline = new Promise<WorkerIntegrationOutcome>(resolve => {
 			timeout = setTimeout(() => {
 				controller.abort(new Error("Worker integration request timed out"));
-				resolve();
+				resolve({ status: "timed_out" });
 			}, this.timeoutMs);
 		});
-		this.#inFlight = Promise.race([request.catch(() => {}), deadline]).finally(() => {
+		this.#inFlight = Promise.race([
+			request.then(
+				() => ({ status: "completed" as const }),
+				error => ({ status: "failed" as const, error: String(error) }),
+			),
+			deadline,
+		]).finally(() => {
 			if (timeout) clearTimeout(timeout);
 			controller.abort();
 			this.#inFlight = undefined;
@@ -2285,6 +2392,7 @@ export class AgentSession {
 	#preProfileModel: Model | undefined;
 	#sessionAdmissionQueue: SessionAdmissionEntry[] = [];
 	#activeSessionAdmission: SessionAdmissionEntry | undefined;
+	#startupPromptWaiters = new Set<Promise<void>>();
 	#sessionAdmissionClosing = false;
 	#sessionAdmissionClosed = false;
 	#sessionAdmissionContext = new AsyncLocalStorage<SessionAdmissionEntry>();
@@ -2475,6 +2583,22 @@ export class AgentSession {
 		this.#activeAttemptScope = undefined;
 		this.#activeLogicalRunId = undefined;
 	}
+	#acceptSdkAttemptRun(handle: AttemptRunHandle, sdkRunToken?: string): void {
+		const predecessorScope = this.#activeAttemptScope;
+		const predecessorSdkRunToken =
+			predecessorScope === undefined ? undefined : this.#sdkRunTokensByAttemptScope.get(predecessorScope);
+		const carryRecoverySkip =
+			sdkRunToken !== undefined &&
+			predecessorSdkRunToken === sdkRunToken &&
+			predecessorScope !== undefined &&
+			this.#skipPostPromptRecoveryWaitByAttemptScope.delete(predecessorScope);
+		this.#acceptRunHandle(handle);
+		if (sdkRunToken !== undefined) {
+			this.#activeSdkRunToken = sdkRunToken;
+			this.#sdkRunTokensByAttemptScope.set(handle.scope, sdkRunToken);
+		}
+		if (carryRecoverySkip) this.#skipPostPromptRecoveryWaitByAttemptScope.add(handle.scope);
+	}
 	/** Messages queued to be included with the next user prompt as context ("asides"). */
 	#pendingNextTurnMessages: Array<{ message: CustomMessage; origin: "turn" | "external" }> = [];
 	#scheduledHiddenNextTurnGeneration: number | undefined = undefined;
@@ -2608,7 +2732,88 @@ export class AgentSession {
 		onPersisted?: () => void;
 		appendedToAgent: boolean;
 	}> = [];
-	#foregroundBashBackgroundRequestHandler: (() => void) | undefined;
+	/**
+	 * Set by a fold and consumed once by the pause checkpoint, so a fold ends its
+	 * own turn without pausing any later turn.
+	 */
+	#foldStopRequested = false;
+	/**
+	 * The single linearization point for folding a foreground wait. Arrow deps
+	 * capture `this` but are only invoked after construction.
+	 */
+	readonly #foldCoordinator = new FoldCoordinator({
+		hasActiveTurn: () => this.activePromptHandle !== undefined,
+		armSteeringFence: () => {
+			this.agent.setSteeringAdmissionFence(() => true);
+			return () => this.agent.setSteeringAdmissionFence(undefined);
+		},
+		requestStop: () => {
+			this.#foldStopRequested = true;
+		},
+		captureRemainingIntent: () => this.#captureRemainingIntentForFold(),
+		// A parked completion replayed after the fold must schedule its own wake.
+		// This mirrors exactly what the sdk delivery seam does for a live receipt
+		// delivery, so the parked path cannot rely on an unrelated idle rearm.
+		deliverParked: (job, disposition) => {
+			const endpointId = this.#ownedAsyncJobManager
+				? AsyncJobManager.endpointIdOf(this.#ownedAsyncJobManager)
+				: undefined;
+			const registration = lookupOwnedRegistration(job.id, job.generation, endpointId);
+			if (this.#ownedAsyncJobManager?.isDeliverySuppressed(job.id, job.generation)) {
+				this.#ownedAsyncJobManager.clearParkedDelivery(job.generation);
+				return;
+			}
+			if (this.#foldCoordinator.claimCompletionNotice(job)) {
+				this.emitNotice(
+					"info",
+					`Folded job ${disposition.receipt.jobId} (${disposition.receipt.label}) finished.`,
+					"fold",
+				);
+			}
+			const ownedCompletion = registration
+				? {
+						lineageIdHash: registration.lineageIdHash,
+						promptAttemptEpoch: registration.promptAttemptEpoch,
+						registration,
+					}
+				: undefined;
+			const allowArtifact = ownedCompletion === undefined || isOwnedCompletionEnvelopeAllowed(ownedCompletion);
+			void formatParkedAsyncResult(this.sessionManager, disposition.text, allowArtifact)
+				.then(formattedResult => {
+					const manager = this.#ownedAsyncJobManager;
+					if (manager?.isDeliverySuppressed(job.id, job.generation)) {
+						manager.clearParkedDelivery(job.generation);
+						return;
+					}
+					if (!this.#foldCoordinator.claimCompletionDelivery(job)) {
+						manager?.clearParkedDelivery(job.generation);
+						return;
+					}
+					try {
+						manager?.retainDeliveryClaim(job);
+						if (manager?.isDeliverySuppressed(job.id, job.generation)) {
+							manager.releaseDeliveryClaim(job.generation);
+							manager.clearParkedDelivery(job.generation);
+							return;
+						}
+						this.yieldQueue.enqueue("async-result", {
+							jobId: disposition.receipt.jobId,
+							generation: disposition.receipt.jobGeneration,
+							result: `${formattedResult}\n\n${describeFoldReceipt(disposition.receipt)}`,
+							job,
+							durationMs: undefined,
+							ownedCompletion,
+						});
+					} finally {
+						manager?.clearParkedDelivery(job.generation);
+					}
+				})
+				.catch(error => {
+					this.#ownedAsyncJobManager?.clearParkedDelivery(job.generation);
+					logger.warn("Parked folded delivery formatting failed", { error: String(error) });
+				});
+		},
+	});
 
 	// Python execution state
 	#evalAbortControllers = new Set<AbortController>();
@@ -2616,6 +2821,27 @@ export class AgentSession {
 	/** Idempotent unregister handle for this session's resource-GC registration. */
 	#unregisterResourceGc?: () => void;
 	#unregisterRuntimeStateFinalizer?: () => void;
+	#unregisterBeforeMoveListener?: () => void;
+	#unregisterMoveAbortListener?: () => void;
+	#unregisterMovePublicationListener?: () => void;
+	#unregisterAfterMoveListener?: () => void;
+	/**
+	 * (Re)register the postmortem finalizer bound to the CURRENT cwd/session file. Called at
+	 * construction and after every committed rescope, so an unexpected exit writes terminal
+	 * state to the session's live location rather than the abandoned launch root.
+	 */
+	#registerRuntimeStateFinalizer(): void {
+		this.#unregisterRuntimeStateFinalizer?.();
+		const currentContext = () => ({
+			sessionId: this.sessionId,
+			cwd: this.sessionManager.getCwd(),
+			sessionFile: this.sessionManager.getSessionFile(),
+		});
+		this.#unregisterRuntimeStateFinalizer = registerCoordinatorRuntimeStateFinalizer(
+			currentContext(),
+			currentContext,
+		);
+	}
 	#unregisterSessionMemorySettings?: () => void;
 	/**
 	 * AsyncJobManager owned by this session (top-level only). Subagents leave
@@ -2625,6 +2851,7 @@ export class AgentSession {
 	readonly #disposeAsyncJobManager: boolean;
 	#ownedMcpManager: MCPManager | undefined;
 	#startupTurnBarrier: Promise<void> | undefined;
+	#startupTurnBarrierPending = false;
 	#pendingPythonMessages: Array<{
 		message: PythonExecutionMessage;
 		onPersisted?: () => void;
@@ -2650,6 +2877,9 @@ export class AgentSession {
 	readonly #asyncJobProviderSessionId: string | undefined;
 	#isDisposed = false;
 	#disposePromise: Promise<void> | undefined;
+	readonly #disposeAbortController = new AbortController();
+	#disposeAdmissionClosed: Promise<void> | undefined;
+	#disposePostPromptDrain: Promise<void> | undefined;
 	readonly #toolSessionCleanups = new Set<() => Promise<void> | void>();
 	readonly #toolSessionTransitionCleanups = new Set<() => Promise<void> | void>();
 	readonly #deferredOwnerShutdownFinalizations = new Set<Promise<void>>();
@@ -2658,6 +2888,7 @@ export class AgentSession {
 	#extensionRunner: ExtensionRunner | undefined = undefined;
 	/** SDK follow-up ownership by queued message and the attempt that dequeues it. */
 	#sdkRunTokensByQueuedMessage = new WeakMap<AgentMessage, string>();
+	#skipPostPromptRecoveryWaitByAttemptScope = new WeakSet<AttemptScope>();
 	#sdkRunTokensByAttemptScope = new WeakMap<AttemptScope, string>();
 	#activeSdkRunToken: string | undefined;
 	#activeAttemptScope: AttemptScope | undefined;
@@ -2820,6 +3051,7 @@ export class AgentSession {
 	#cancelAndSubmitAbortOutcomeProviderForTests: (() => Promise<AbortOutcome>) | undefined = undefined;
 	#postPromptTasks = new Set<Promise<void>>();
 	#postPromptTaskSelectionFenceGenerations = new Map<Promise<void>, number>();
+	#postPromptTaskRecoveryExcluded = new Set<Promise<void>>();
 	#postPromptTasksPromise: Promise<void> | undefined = undefined;
 	#postPromptTasksResolve: (() => void) | undefined = undefined;
 	#postPromptTasksAbortController = new AbortController();
@@ -3006,6 +3238,66 @@ export class AgentSession {
 	 * orchestrator does not hold it), so there is no self-deadlock.
 	 */
 	#sessionTransitionKind: string | undefined;
+	#coordinatorPersistGeneration = 0;
+	#coordinatorRescopeBarrier: Promise<void> | undefined;
+	#releaseCoordinatorRescopeBarrier: (() => void) | undefined;
+	#coordinatorRescopeMoveId: string | undefined;
+	#coordinatorEventHandlers = new Set<Promise<void>>();
+	#coordinatorUnbarrieredPersists = new Set<Promise<void>>();
+	#coordinatorReleasedBarrierPersists = new Set<Promise<void>>();
+
+	#beginCoordinatorRescopeBarrier(): {
+		eventHandlers: Promise<void>[];
+		releasedBarrierPersists: Promise<void>[];
+	} {
+		if (this.#coordinatorRescopeBarrier) throw new Error("Coordinator rescope barrier is already active.");
+		const releasedBarrierPersists = [...this.#coordinatorReleasedBarrierPersists];
+		const barrier = Promise.withResolvers<void>();
+		this.#coordinatorRescopeBarrier = barrier.promise;
+		this.#releaseCoordinatorRescopeBarrier = barrier.resolve;
+		this.#bindPendingAgentEndToRescopeBarrier();
+		return { eventHandlers: [...this.#coordinatorEventHandlers], releasedBarrierPersists };
+	}
+
+	#trackReleasedBarrierPersist(persist: Promise<void>): void {
+		this.#coordinatorReleasedBarrierPersists.add(persist);
+		void persist.then(
+			() => this.#coordinatorReleasedBarrierPersists.delete(persist),
+			() => this.#coordinatorReleasedBarrierPersists.delete(persist),
+		);
+	}
+
+	#bindPendingAgentEndToRescopeBarrier(): void {
+		if (!this.#coordinatorRescopeBarrier || !this.#pendingAgentEndEmit) return;
+		const admission = this.#agentEventAdmission.get(this.#pendingAgentEndEmit);
+		if (admission) admission.persistBarrier = this.#coordinatorRescopeBarrier;
+	}
+
+	#appendCoordinatorPersist(run: () => Promise<void>): Promise<void> {
+		const queued = this.#coordinatorPersistQueue.then(run, run);
+		this.#coordinatorPersistQueue = queued.catch(() => {});
+		return queued;
+	}
+
+	#trackUnbarrieredCoordinatorPersist(persist: Promise<void>): void {
+		this.#coordinatorUnbarrieredPersists.add(persist);
+		void persist.then(
+			() => this.#coordinatorUnbarrieredPersists.delete(persist),
+			() => this.#coordinatorUnbarrieredPersists.delete(persist),
+		);
+	}
+
+	async #drainUnbarrieredCoordinatorPersists(): Promise<void> {
+		while (this.#coordinatorUnbarrieredPersists.size > 0) {
+			await Promise.allSettled([...this.#coordinatorUnbarrieredPersists]);
+		}
+	}
+
+	#endCoordinatorRescopeBarrier(): void {
+		this.#releaseCoordinatorRescopeBarrier?.();
+		this.#releaseCoordinatorRescopeBarrier = undefined;
+		this.#coordinatorRescopeBarrier = undefined;
+	}
 
 	#beginSessionTransition(kind: string): void {
 		if (this.#sessionTransitionKind !== undefined) {
@@ -3015,6 +3307,7 @@ export class AgentSession {
 			);
 		}
 		this.#sessionTransitionKind = kind;
+		this.#coordinatorPersistGeneration += 1;
 	}
 
 	#endSessionTransition(): void {
@@ -3041,16 +3334,61 @@ export class AgentSession {
 		return { entry, capability: entry.continuationCapability };
 	}
 
-	async #awaitStartupTurnBarrier(): Promise<void> {
-		const barrier = this.#startupTurnBarrier;
+	#setStartupTurnBarrier(barrier: Promise<void> | undefined): void {
+		this.#startupTurnBarrier = barrier;
+		this.#startupTurnBarrierPending = barrier !== undefined;
 		if (!barrier) return;
-		await barrier;
-		if (this.#startupTurnBarrier === barrier) this.#startupTurnBarrier = undefined;
+		void barrier.then(
+			() => {
+				if (this.#startupTurnBarrier === barrier) this.#startupTurnBarrierPending = false;
+			},
+			() => {
+				if (this.#startupTurnBarrier === barrier) this.#startupTurnBarrierPending = false;
+			},
+		);
+	}
+	async #awaitStartupTurnBarrier(signal?: AbortSignal): Promise<void> {
+		while (true) {
+			const barrier = this.#startupTurnBarrier;
+			if (!barrier) return;
+			await awaitPromptInvocationPreflight(barrier, signal);
+			// Cross one task boundary before clearing readiness. Promise reaction
+			// chains fully drain before timers, so every extension published by the
+			// captured barrier's settlement becomes visible without an arbitrary
+			// microtask-depth cap.
+			const publicationTurn = Promise.withResolvers<void>();
+			const timer = setTimeout(publicationTurn.resolve, 0);
+			try {
+				await awaitPromptInvocationPreflight(publicationTurn.promise, signal);
+			} finally {
+				clearTimeout(timer);
+			}
+			if (this.#startupTurnBarrier !== barrier) continue;
+			this.#setStartupTurnBarrier(undefined);
+			return;
+		}
+	}
+	async #awaitStartupPromptWaiters(signal?: AbortSignal): Promise<void> {
+		while (this.#startupPromptWaiters.size > 0) {
+			await awaitPromptInvocationPreflight(Promise.all([...this.#startupPromptWaiters]), signal);
+			await Promise.resolve();
+		}
+	}
+	#reserveStartupPromptWaiter(): () => void {
+		const waiter = Promise.withResolvers<void>();
+		this.#startupPromptWaiters.add(waiter.promise);
+		let released = false;
+		return () => {
+			if (released) return;
+			released = true;
+			this.#startupPromptWaiters.delete(waiter.promise);
+			waiter.resolve();
+		};
 	}
 	extendStartupTurnBarrier(barrier: Promise<void>): void {
 		const current = this.#startupTurnBarrier;
-		this.#startupTurnBarrier = current ? Promise.all([current, barrier]).then(() => {}) : barrier;
-		void this.#startupTurnBarrier.catch(() => {});
+		this.#setStartupTurnBarrier(current ? Promise.all([current, barrier]).then(() => {}) : barrier);
+		void this.#startupTurnBarrier?.catch(() => {});
 	}
 
 	async #withSessionAdmission<T>(
@@ -3062,6 +3400,8 @@ export class AgentSession {
 			allowDuringClosing?: boolean;
 			bypassSelectionFenceGeneration?: number;
 			allowPromptContinuationReentry?: boolean;
+			idleDelivery?: boolean;
+			startupPromptWaiterRelease?: () => void;
 		},
 	): Promise<T> {
 		const owner = this.#sessionAdmissionContext.getStore();
@@ -3076,7 +3416,21 @@ export class AgentSession {
 			}
 			throw this.#sessionAdmissionBusyError();
 		}
-		if (kind === "prompt") await awaitPromptInvocationPreflight(this.#awaitStartupTurnBarrier(), signal);
+		const releaseStartupPromptWaiter =
+			kind === "prompt" && options?.idleDelivery !== true
+				? (options?.startupPromptWaiterRelease ?? this.#reserveStartupPromptWaiter())
+				: undefined;
+		if (kind === "prompt") {
+			const startupSignal = signal
+				? AbortSignal.any([signal, this.#disposeAbortController.signal])
+				: this.#disposeAbortController.signal;
+			try {
+				await awaitPromptInvocationPreflight(this.#awaitStartupTurnBarrier(startupSignal), startupSignal);
+			} finally {
+				releaseStartupPromptWaiter?.();
+			}
+			if (options?.idleDelivery === true) await this.#awaitStartupPromptWaiters(startupSignal);
+		}
 		const bypassesSelectionFence =
 			options?.bypassSelectionFenceGeneration !== undefined &&
 			options.bypassSelectionFenceGeneration < this.#selectionFenceGeneration;
@@ -3614,7 +3968,7 @@ export class AgentSession {
 		// Deferrals behind still-pending selection fences are excluded here: they
 		// cannot settle before their fence resolves, and the fence owner may be
 		// waiting on this very settlement (#4519).
-		if (!predecessorPromptStillInFlight) {
+		if (promptWait !== "publication" && !predecessorPromptStillInFlight) {
 			await this.#waitForSessionSettlement(this.#turnSettlementDeferralFloor());
 		}
 		if (flushError) throw flushError;
@@ -3656,28 +4010,50 @@ export class AgentSession {
 		this.#pendingAgentEndEmit = undefined;
 		const lease = this.#deferredAgentEndLeases.get(pending);
 		if (lease) this.#deferredAgentEndLeases.delete(pending);
+		this.#startAgentEndPublication(pending, lease);
+	}
+	#startAgentEndPublication(pending: AgentSessionEvent, lease?: RunResourceProducerLease): void {
 		this.#agentEndPublicationInFlight++;
-		this.#agentEndPublicationPromise = this.#publishDeferredAgentEnd(pending, lease);
+		const pendingScope = (pending as AgentSessionEvent & { scope?: AttemptScopeRef }).scope as
+			| AttemptScope
+			| undefined;
+		const sdkTerminal = pendingScope !== undefined && this.#sdkRunTokensByAttemptScope.has(pendingScope);
+		this.#agentEndPublicationPromise = this.#publishDeferredAgentEnd(pending, lease, sdkTerminal);
 		void this.#agentEndPublicationPromise;
 	}
 
 	async #publishDeferredAgentEnd(
 		pending: AgentSessionEvent,
 		lease: RunResourceProducerLease | undefined,
+		workerIntegrationSettled: boolean,
 	): Promise<void> {
+		const publicationContext = {
+			sessionId: this.sessionId,
+			cwd: this.sessionManager.getCwd(),
+			sessionFile: this.sessionManager.getSessionFile(),
+		};
+		const publicationScope = (pending as AgentSessionEvent & { scope?: AttemptScopeRef }).scope as
+			| AttemptScope
+			| undefined;
+		const publicationCorrelationId = publicationScope
+			? this.#sdkRunTokensByAttemptScope.get(publicationScope)
+			: undefined;
 		let extensionDelivery: Promise<void> | undefined;
 		const releaseLease = () => {
 			if (!lease) return;
+			this.#deferredAgentEndLeases.delete(pending);
 			if (this.#postPromptLeases.get(lease.resourceRunId) === lease) {
 				this.#postPromptLeases.delete(lease.resourceRunId);
 			}
 			lease.closeDiscovery();
 		};
 		const publish = async () => {
-			// Worker integration is first-party lifecycle persistence, not an extension
-			// hook. Settle it before publishing the terminal boundary while user extension
-			// delivery and coordinator sidecar persistence remain asynchronous.
-			await this.#flushWorkerIntegrationForAgentEnd();
+			let workerIntegration: Promise<WorkerIntegrationOutcome> | undefined;
+			let workerIntegrationOutcome: WorkerIntegrationOutcome | undefined;
+			if (!workerIntegrationSettled) {
+				workerIntegration = this.#flushWorkerIntegrationForAgentEnd();
+				workerIntegrationOutcome = await workerIntegration;
+			}
 			// Reserve persistence before notifying synchronous subscribers: a subscriber
 			// may start a successor prompt from agent_end, whose running state must
 			// serialize after this terminal boundary rather than be overwritten by it.
@@ -3686,16 +4062,72 @@ export class AgentSession {
 			// behind this terminal transition, but do not make the interactive terminal
 			// wait for the filesystem-backed lock/write to settle. On slow or lock-hostile
 			// mounts such as WSL drvfs, waiting here leaves the foreground activity loader
-			// and busy input state visible after the model has already finished.
-			const terminalPersistence = this.#queueCoordinatorRuntimeStatePersist(pending);
+			// and busy input state visible after the model has already finished. The queue
+			// preserves transaction order; terminal publication is the user-visible
+			// authority and must not be suppressed by a secondary persistence failure.
+			const terminalPersistence = this.#queueCoordinatorRuntimeStatePersist(pending, true);
 			this.#emit(pending);
-			await terminalPersistence;
+			void terminalPersistence.then(
+				() => {
+					if (workerIntegrationOutcome) {
+						this.#recordPostPublicationOutcome(
+							publicationContext,
+							publicationCorrelationId,
+							"worker_integration",
+							workerIntegrationOutcome,
+						);
+					}
+					this.#recordPostPublicationOutcome(
+						publicationContext,
+						publicationCorrelationId,
+						"terminal_persistence",
+						{ status: "completed" },
+					);
+				},
+				error => {
+					if (workerIntegrationOutcome) {
+						this.#recordPostPublicationOutcome(
+							publicationContext,
+							publicationCorrelationId,
+							"worker_integration",
+							workerIntegrationOutcome,
+						);
+					}
+					this.#recordPostPublicationOutcome(
+						publicationContext,
+						publicationCorrelationId,
+						"terminal_persistence",
+						{
+							status: "failed",
+							error: String(error),
+						},
+					);
+					logger.warn("Failed to persist terminal coordinator runtime state", { error: String(error) });
+				},
+			);
 			extensionDelivery = this.#queueExtensionEvent(
 				pending,
 				undefined,
 				true,
 				(pending as AgentSessionEvent & { scope?: AttemptScopeRef }).scope,
 			);
+			if (workerIntegrationSettled) {
+				workerIntegration = this.#flushWorkerIntegrationForAgentEnd();
+				void workerIntegration.then(outcome =>
+					this.#recordPostPublicationOutcome(
+						publicationContext,
+						publicationCorrelationId,
+						"worker_integration",
+						outcome,
+					),
+				);
+				await extensionDelivery;
+				void terminalPersistence.catch(error =>
+					logger.warn("Terminal persistence continued after SDK publication", { error }),
+				);
+			} else {
+				// Non-SDK/public publication has already awaited worker integration above.
+			}
 		};
 		try {
 			if (lease) await this.#runResourceLeaseContext.run(lease, publish);
@@ -3760,10 +4192,96 @@ export class AgentSession {
 				cwd: () => this.sessionManager.getCwd(),
 			});
 		}
-		this.#unregisterRuntimeStateFinalizer = registerCoordinatorRuntimeStateFinalizer({
-			sessionId: this.sessionId,
-			cwd: this.sessionManager.getCwd(),
-			sessionFile: this.sessionManager.getSessionFile(),
+		this.#registerRuntimeStateFinalizer();
+		this.#unregisterBeforeMoveListener = this.sessionManager.registerBeforeMoveListener(async move => {
+			const admittedBeforeBarrier = this.#beginCoordinatorRescopeBarrier();
+			await Promise.allSettled([
+				...admittedBeforeBarrier.eventHandlers,
+				...admittedBeforeBarrier.releasedBarrierPersists,
+			]);
+			this.#bindPendingAgentEndToRescopeBarrier();
+			await this.#drainUnbarrieredCoordinatorPersists();
+			this.#coordinatorPersistGeneration += 1;
+			const moveId = crypto.randomUUID();
+			this.#coordinatorRescopeMoveId = moveId;
+			await prepareCoordinatorRuntimeStateRescope({
+				moveId,
+				sessionId: this.sessionId,
+				previousCwd: move.previousCwd,
+				newCwd: move.newCwd,
+				previousCwdIdentity: move.previousCwdIdentity,
+				newCwdIdentity: move.newCwdIdentity,
+				previousSessionFile: move.previousSessionFile ?? null,
+				newSessionFile: move.newSessionFile ?? null,
+			});
+		});
+		this.#unregisterMoveAbortListener = this.sessionManager.registerMoveAbortListener(async move => {
+			const moveId = this.#coordinatorRescopeMoveId;
+			try {
+				if (moveId && !move.preserveRecoveryJournal) {
+					await clearCoordinatorRuntimeStateRescope(
+						{
+							sessionId: this.sessionId,
+							cwd: move.newCwd,
+							sessionFile: move.newSessionFile ?? null,
+						},
+						moveId,
+						move.previousCwd,
+					);
+				}
+			} finally {
+				this.#coordinatorRescopeMoveId = undefined;
+				this.#endCoordinatorRescopeBarrier();
+			}
+		});
+		this.#unregisterMovePublicationListener = this.sessionManager.registerMovePublicationListener(async move => {
+			const moveId = this.#coordinatorRescopeMoveId;
+			if (!moveId) throw new Error("Coordinator rescope publication has no prepared move identity.");
+			await markCoordinatorRuntimeStateRescopePublishing(
+				{
+					sessionId: this.sessionId,
+					cwd: move.newCwd,
+					sessionFile: move.newSessionFile ?? null,
+				},
+				move.previousCwd,
+				moveId,
+			);
+		});
+		// Every committed rescope (`move_session`, `/move`, SDK/ACP `session.cwd.move`) funnels
+		// through SessionManager.moveTo, so one after-move listener covers all surfaces: it
+		// relocates the coordinator-shared runtime state to the new cwd (otherwise the identity
+		// fence refuses every later persist) and rebinds the postmortem finalizer, which
+		// otherwise keeps writing terminal state to the launch root's cwd/session file.
+		this.#unregisterAfterMoveListener = this.sessionManager.registerAfterMoveListener(async move => {
+			let completed = false;
+			try {
+				const relocated = await relocateCoordinatorRuntimeStateForRescope(
+					{
+						sessionId: this.sessionId,
+						cwd: move.newCwd,
+						sessionFile: this.sessionManager.getSessionFile() ?? null,
+						previousSessionFile: move.previousSessionFile ?? null,
+					},
+					move.previousCwd,
+				);
+				if (!relocated) throw new Error("Coordinator runtime state rescope was refused.");
+				await clearCoordinatorRuntimeStateRescope(
+					{
+						sessionId: this.sessionId,
+						cwd: move.newCwd,
+						sessionFile: this.sessionManager.getSessionFile() ?? null,
+					},
+					this.#coordinatorRescopeMoveId,
+					move.previousCwd,
+				);
+				completed = true;
+			} finally {
+				this.#registerRuntimeStateFinalizer();
+				if (completed) {
+					this.#coordinatorRescopeMoveId = undefined;
+					this.#endCoordinatorRescopeBarrier();
+				}
+			}
 		});
 		// Power assertions are taken per turn (see #beginInFlight); nothing acquired here.
 		this.#evalKernelOwnerId = config.evalKernelOwnerId ?? `agent-session:${Snowflake.next()}`;
@@ -3772,7 +4290,19 @@ export class AgentSession {
 		this.#disposeAsyncJobManager = config.disposeAsyncJobManager ?? true;
 		this.#retainedMemorySampler = config.retainedMemorySampler;
 		this.#ownedMcpManager = config.ownedMcpManager;
-		this.#startupTurnBarrier = config.startupTurnBarrier;
+		this.#setStartupTurnBarrier(config.startupTurnBarrier);
+		// Only arm the recovery barrier when a rescope journal is actually pending. Arming it
+		// unconditionally flips #startupTurnBarrier from absent to a (resolved) promise for
+		// every session, which makes barrier-gated post-turn work (e.g. the hidden-next-turn
+		// drain) take an extra scheduler hop and reorder against terminal-abort requeue.
+		const rescopeRecoveryContext = {
+			sessionId: this.sessionId,
+			cwd: this.sessionManager.getCwd(),
+			sessionFile: this.sessionManager.getSessionFile() ?? null,
+		};
+		if (hasCoordinatorRuntimeStateRescopeJournal(rescopeRecoveryContext)) {
+			this.extendStartupTurnBarrier(recoverCoordinatorRuntimeStateRescope(rescopeRecoveryContext));
+		}
 		this.#scopedModels = config.scopedModels ?? [];
 		this.#thinkingLevel = config.thinkingLevel;
 		this.#promptTemplates = config.promptTemplates ?? [];
@@ -3860,7 +4390,7 @@ export class AgentSession {
 				// agent.prompt directly, allocates right before admission.
 				this.agent.followUp(message);
 			},
-			injectIdle: async messages => {
+			injectIdle: async (messages, signal) => {
 				// Mandated boundary comment (corrected turn semantics): same origin
 				// split as the streaming injector — an allowed owned-completion
 				// delivery starts a fresh turn attempt/lineage and is not a
@@ -3874,27 +4404,43 @@ export class AgentSession {
 				if (dropped.length > 0) this.#settleDeliveredOwnedRegistrations(dropped);
 				const first = survivors[0];
 				if (!first) return;
-				await this.#awaitStartupTurnBarrier();
-				if (this.#isDisposed) return;
-				// A user prompt may have started during the barrier/scheduling
-				// delay: if the session is now streaming, mutating the epoch and
-				// lineage here would corrupt the ACTIVE user turn (and
-				// agent.prompt would then reject as busy, losing the drained
-				// completion). Route the survivors through followUp — the
-				// streaming injector's path — which allocates the fresh resume
-				// lineage at actual admission (review thread P1).
-				if (this.isStreaming) {
-					for (const message of survivors) this.agent.followUp(message);
-					return;
-				}
-				if (survivors.some(message => ownedCompletionResumeAction(message) === "fresh"))
-					this.#resumeFromOwnedCompletion();
+				const settleIfDisposing = (): boolean => {
+					if (!this.#isDisposed && !this.#sessionAdmissionClosing && !this.#disposeAbortController.signal.aborted)
+						return false;
+					this.#settleDeliveredOwnedRegistrations(survivors);
+					return true;
+				};
 				try {
-					if (survivors.length === 1) {
-						await this.agent.prompt(first, this.#managedFallbackPromptOptions());
-					} else {
-						await this.agent.prompt(survivors, this.#managedFallbackPromptOptions());
-					}
+					await this.#withSessionAdmission(
+						"prompt",
+						async () => {
+							if (settleIfDisposing()) return;
+							if (this.isStreaming) {
+								await awaitPromptInvocationPreflight(this.agent.waitForIdle(), signal);
+								if (settleIfDisposing()) return;
+							}
+							if (survivors.some(message => ownedCompletionResumeAction(message) === "fresh"))
+								this.#resumeFromOwnedCompletion();
+							if (survivors.length === 1) {
+								await this.agent.prompt(first, {
+									...this.#managedFallbackPromptOptions(),
+									onRunAccepted: (handle: AttemptRunHandle) => {
+										if (handle) this.#acceptSdkAttemptRun(handle);
+									},
+								});
+							} else {
+								await this.agent.prompt(survivors, {
+									...this.#managedFallbackPromptOptions(),
+									onRunAccepted: (handle: AttemptRunHandle) => {
+										if (handle) this.#acceptSdkAttemptRun(handle);
+									},
+								});
+							}
+						},
+						signal,
+						undefined,
+						{ idleDelivery: true },
+					);
 				} finally {
 					// The owned completions were delivered OR the prompt attempt
 					// failed (e.g. provider rejection): either way the yield
@@ -3906,16 +4452,40 @@ export class AgentSession {
 					this.#settleDeliveredOwnedRegistrations(survivors);
 				}
 			},
-			scheduleIdleFlush: run => {
+			scheduleIdleFlush: (run, onSkip) => {
+				// The startup barrier already gates injectIdle, so begin waiting on a
+				// pending barrier immediately. Once readiness has settled, ordinary
+				// idle wakes retain the fixed merge window.
+				const delayMs = this.#startupTurnBarrierPending ? 0 : FOLD_WAKE_MERGE_WINDOW_MS;
 				this.#schedulePostPromptTask(
-					async () => {
-						await run();
+					async signal => {
+						await run(signal);
 					},
-					{ delayMs: 1 },
+					{ delayMs, onSkip, excludeFromPostPromptRecovery: true },
 				);
 			},
+			getIdleFlushSignal: () => this.#postPromptTasksAbortController.signal,
 		});
 		this.agent.setOnBeforeYield(() => this.yieldQueue.flush("streaming"));
+		// Stop-after-result, never abort: a fold arms this once and the loop ends the
+		// turn at its next checkpoint. Consuming the flag here keeps the pause scoped
+		// to the folded turn instead of pausing everything that follows. The
+		// config-provided checkpoint (subagent requestPause, RLM research) is OR-ed
+		// in, never replaced.
+		// sdk/session.ts threads the config's shouldPause into new Agent, so the
+		// Agent's current checkpoint IS the config-provided one (subagent
+		// requestPause, RLM research). Capture and OR it rather than replace it.
+		const configuredShouldPause = this.agent.shouldPause;
+		this.agent.setShouldPause(() => {
+			if (configuredShouldPause?.() === true) return true;
+			if (!this.#foldStopRequested) return false;
+			this.#foldStopRequested = false;
+			// The folded turn has now actually stopped: steering admission must be
+			// restored so later turns drain their queues normally (the fence stays
+			// armed from the fold until exactly this point).
+			this.agent.setSteeringAdmissionFence(undefined);
+			return true;
+		});
 		this.agent.setMaintainContext((context, lifecycle) =>
 			this.#trackMidRunMaintenance(
 				this.awaitPendingContextTransformations().then(() => this.#runMidRunMaintenance(context, lifecycle)),
@@ -4054,6 +4624,18 @@ export class AgentSession {
 			if (messages.some(message => ownedCompletionResumeAction(message) === "fresh")) {
 				this.#resumeFromOwnedCompletion();
 			}
+			const consumedSdkRunTokenForCurrentRun = messages
+				.map(message => this.#sdkRunTokensByQueuedMessage.get(message))
+				.find((token): token is string => token !== undefined);
+			if (
+				consumedSdkRunTokenForCurrentRun !== undefined &&
+				this.#activeAttemptScope !== undefined &&
+				promotion.startsOwnRun !== true
+			) {
+				this.#sdkRunTokensByAttemptScope.set(this.#activeAttemptScope, consumedSdkRunTokenForCurrentRun);
+				this.#skipPostPromptRecoveryWaitByAttemptScope.add(this.#activeAttemptScope);
+				this.#activeSdkRunToken = consumedSdkRunTokenForCurrentRun;
+			}
 			// Monitor task-notifications now carry the owned-completion envelope
 			// (see tools/monitor.ts), so the general drop + fresh-admission paths
 			// above cover them exactly like async results — no monitor-specific
@@ -4089,6 +4671,18 @@ export class AgentSession {
 		// submitter to the in-flight run instead of parking the correlation for
 		// an unrelated later agent_start (#4668).
 		this.agent.onSteeringConsumed = (messages, promotion = { startsOwnRun: false }) => {
+			const consumedSdkRunToken = messages
+				.map(message => this.#sdkRunTokensByQueuedMessage.get(message))
+				.find((token): token is string => token !== undefined);
+			if (
+				consumedSdkRunToken !== undefined &&
+				this.#activeAttemptScope !== undefined &&
+				promotion.startsOwnRun !== true
+			) {
+				this.#sdkRunTokensByAttemptScope.set(this.#activeAttemptScope, consumedSdkRunToken);
+				this.#skipPostPromptRecoveryWaitByAttemptScope.add(this.#activeAttemptScope);
+				this.#activeSdkRunToken = consumedSdkRunToken;
+			}
 			this.#fireQueuedPromotionHooks(messages, promotion);
 		};
 		this.agent.providerSessionState = this.#providerSessionState;
@@ -5001,6 +5595,10 @@ export class AgentSession {
 	 * seen.
 	 */
 	#coordinatorToolObservations = new WeakMap<object, CoordinatorToolObservation>();
+	#agentEventAdmission = new WeakMap<
+		object,
+		{ scope?: AttemptScope; sdkRunToken?: string; persistGeneration: number; persistBarrier?: Promise<void> }
+	>();
 
 	/**
 	 * Capture what is true at the SYNCHRONOUS agent-event boundary, before any async work.
@@ -5056,6 +5654,12 @@ export class AgentSession {
 	}
 
 	#trackAgentEvent = (event: AgentEvent): Promise<void> => {
+		this.#agentEventAdmission.set(event, {
+			scope: this.#activeAttemptScope,
+			sdkRunToken: this.#activeSdkRunToken,
+			persistGeneration: this.#coordinatorPersistGeneration,
+			persistBarrier: this.#coordinatorRescopeBarrier,
+		});
 		// First statement of the listener: the observation must precede every claim,
 		// reservation, and async hop this handler performs.
 		this.#observeCoordinatorToolEvent(event);
@@ -5125,10 +5729,10 @@ export class AgentSession {
 					this.#postPromptLeases.set(eventLease.resourceRunId, eventLease);
 				if (eventLease) {
 					await this.#runResourceLeaseContext.run(eventLease, () =>
-						this.#handleAgentEvent(event, activePromptHandle, canonicalAdmission),
+						this.#handleAgentEvent(event, activePromptHandle, canonicalAdmission, eventLease),
 					);
 				} else {
-					await this.#handleAgentEvent(event, activePromptHandle, canonicalAdmission);
+					await this.#handleAgentEvent(event, activePromptHandle, canonicalAdmission, undefined);
 				}
 			} catch (error) {
 				logger.warn("Agent event handler failed", { event: event.type, error: String(error) });
@@ -5136,11 +5740,19 @@ export class AgentSession {
 				canonicalAdmission?.release();
 				if (eventLease) {
 					const pendingAgentEnd =
-						event.type === "agent_end" && !maintenanceCheckpoint && this.#pendingAgentEndEmit === event
+						event.type === "agent_end" &&
+						!maintenanceCheckpoint &&
+						(this.#pendingAgentEndEmit === event || this.#deferredAgentEndLeases.has(event))
 							? this.#pendingAgentEndEmit
 							: undefined;
 					if (pendingAgentEnd) {
 						this.#deferredAgentEndLeases.set(pendingAgentEnd, eventLease);
+					} else if (
+						event.type === "agent_end" &&
+						!maintenanceCheckpoint &&
+						this.#deferredAgentEndLeases.has(event)
+					) {
+						// Fast publication took ownership of the lease before the handler unwound.
 					} else {
 						if (event.type === "agent_end" && this.#postPromptLeases.get(eventLease.resourceRunId) === eventLease)
 							this.#postPromptLeases.delete(eventLease.resourceRunId);
@@ -5156,6 +5768,11 @@ export class AgentSession {
 				this.#resolveSessionSettlement();
 			}
 		})();
+		this.#coordinatorEventHandlers.add(handler);
+		void handler.then(
+			() => this.#coordinatorEventHandlers.delete(handler),
+			() => this.#coordinatorEventHandlers.delete(handler),
+		);
 		if (eventLease) eventLease.track("post_prompt", "agent-session-event", handler);
 		return handler;
 	};
@@ -5163,46 +5780,125 @@ export class AgentSession {
 	/** Serializes sidecar writes in publication order, independent of write latency. */
 	#coordinatorPersistQueue: Promise<void> = Promise.resolve();
 
+	#recordPostPublicationOutcome(
+		context: { sessionId: string; cwd: string; sessionFile: string | undefined },
+		correlationId: string | undefined,
+		kind: "worker_integration" | "terminal_persistence",
+		outcome: { status: "completed" | "failed" | "timed_out"; error?: string },
+	): void {
+		if (outcome.status !== "completed") {
+			const correlation = correlationId ?? context.sessionId;
+			const safeError = sanitizePostPublicationError(outcome.error);
+			this.#emit({
+				type: "notice",
+				level: "error",
+				source: kind,
+				message: `${kind} ${outcome.status} for ${correlation}${safeError ? `: ${safeError}` : ""}`,
+			});
+		}
+		const generation = this.#coordinatorPersistGeneration;
+		const barrier = this.#coordinatorRescopeBarrier;
+		const persist = async () => {
+			if (barrier) {
+				await barrier;
+				return await persistCoordinatorWorkerIntegrationOutcome(
+					{
+						sessionId: this.sessionId,
+						cwd: this.sessionManager.getCwd(),
+						sessionFile: this.sessionManager.getSessionFile(),
+					},
+					{
+						...outcome,
+						kind,
+						correlationId,
+						error: sanitizePostPublicationError(outcome.error),
+					},
+				);
+			}
+			return generation === this.#coordinatorPersistGeneration
+				? await persistCoordinatorWorkerIntegrationOutcome(context, {
+						...outcome,
+						kind,
+						correlationId,
+						error: sanitizePostPublicationError(outcome.error),
+					})
+				: undefined;
+		};
+		const queued = barrier
+			? barrier.then(() => this.#appendCoordinatorPersist(persist))
+			: this.#appendCoordinatorPersist(persist);
+		if (barrier) this.#trackReleasedBarrierPersist(queued);
+		else this.#trackUnbarrieredCoordinatorPersist(queued);
+		void queued.catch(error =>
+			logger.warn("Failed to persist terminal reconciliation outcome", { error: String(error) }),
+		);
+	}
+
 	/**
 	 * Reserve this event's place in the sidecar write order.
 	 *
 	 * Called immediately BEFORE local delivery so a synchronous subscriber that re-enters
 	 * the session cannot get its own, later event persisted first. The returned promise is
-	 * only awaited where durability must precede delivery (terminal `agent_end`).
+	 * awaited only by callers that explicitly require a durable handoff; interactive
+	 * terminal delivery remains independent of this secondary sink.
 	 *
 	 * A pairing-only tool event takes no place in that order at all — neither its start nor
 	 * its end. It describes a call that was never dispatched, and this file is read as the
 	 * answer to "what is this session doing right now".
 	 */
-	#queueCoordinatorRuntimeStatePersist(event: AgentSessionEvent): Promise<void> {
+	#queueCoordinatorRuntimeStatePersist(event: AgentSessionEvent, propagateFailure = false): Promise<void> {
 		if (isNonDispatchedToolEvent(event)) return Promise.resolve();
 		const observation = this.#coordinatorToolObservations.get(event);
-		const run = () => this.#persistRuntimeStateInBackground(event, observation);
-		const queued = this.#coordinatorPersistQueue.then(run, run);
-		this.#coordinatorPersistQueue = queued.catch(() => {});
+		const admission = this.#agentEventAdmission.get(event);
+		const barrier = admission?.persistBarrier;
+		if (barrier) {
+			const run = async () => {
+				await barrier;
+				await this.#persistRuntimeStateInBackground(
+					event,
+					{
+						sessionId: this.sessionId,
+						cwd: this.sessionManager.getCwd(),
+						sessionFile: this.sessionManager.getSessionFile(),
+					},
+					observation,
+					propagateFailure,
+				);
+			};
+			const queued = barrier.then(() => this.#appendCoordinatorPersist(run));
+			this.#trackReleasedBarrierPersist(queued);
+			return queued;
+		}
+		const context = {
+			sessionId: this.sessionId,
+			cwd: this.sessionManager.getCwd(),
+			sessionFile: this.sessionManager.getSessionFile(),
+		};
+		const generation = admission?.persistGeneration ?? this.#coordinatorPersistGeneration;
+		const run = () =>
+			generation === this.#coordinatorPersistGeneration
+				? this.#persistRuntimeStateInBackground(event, context, observation, propagateFailure)
+				: Promise.resolve();
+		const queued = this.#appendCoordinatorPersist(run);
+		this.#trackUnbarrieredCoordinatorPersist(queued);
 		return queued;
 	}
 
 	async #persistRuntimeStateInBackground(
 		event: AgentSessionEvent,
+		context: { sessionId: string; cwd: string; sessionFile: string | undefined },
 		observation: CoordinatorToolObservation | undefined,
+		propagateFailure: boolean,
 	): Promise<void> {
 		try {
-			await persistCoordinatorRuntimeStateFromEvent(
-				event,
-				{
-					sessionId: this.sessionId,
-					cwd: this.sessionManager.getCwd(),
-					sessionFile: this.sessionManager.getSessionFile(),
-				},
-				observation,
-			);
-		} catch {
+			await persistCoordinatorRuntimeStateFromEvent(event, context, observation);
+		} catch (error) {
 			logger.warn("Failed to persist coordinator runtime state", { event: event.type });
+			if (propagateFailure) throw error;
 		}
 	}
 
-	async #emitSessionEvent(event: AgentSessionEvent): Promise<void> {
+	async #emitSessionEvent(event: AgentSessionEvent, eventLease?: RunResourceProducerLease): Promise<void> {
 		const attemptScope = (event as AgentSessionEvent & { scope?: AttemptScope }).scope;
 		if (event.type === "turn_start") {
 			this.#extensionTurnGeneration++;
@@ -5236,6 +5932,18 @@ export class AgentSession {
 		// have unwound. Subscribers treat this event as the ready signal; flushing it
 		// from abort while either barrier is active permits a successor to race the
 		// prior prompt's cleanup.
+		const sdkTerminal =
+			event.type === "agent_end" && attemptScope !== undefined && this.#sdkRunTokensByAttemptScope.has(attemptScope);
+		if (
+			event.type === "agent_end" &&
+			sdkTerminal &&
+			this.#pendingAgentEndContinuationHolds.size === 0 &&
+			this.#pendingAgentEndEmit === undefined
+		) {
+			if (eventLease) this.#deferredAgentEndLeases.set(event, eventLease);
+			this.#startAgentEndPublication(event, eventLease);
+			return;
+		}
 		if (event.type === "agent_end" && (this.#livePromptsInFlight() > 0 || this.#agentEventHandlersInFlight > 0)) {
 			this.#pendingAgentEndEmit = event;
 			return;
@@ -5244,8 +5952,12 @@ export class AgentSession {
 		if (event.type === "agent_end") {
 			// Start the durable terminal write before synchronous subscribers can
 			// re-enter prompt(), so a successor's running transition serializes after it.
-			await this.#queueCoordinatorRuntimeStatePersist(event);
+			// Do not let a lock-hostile sidecar suppress the terminal event itself.
+			const terminalPersistence = this.#queueCoordinatorRuntimeStatePersist(event);
 			this.#emit(event);
+			void terminalPersistence.catch(error => {
+				logger.warn("Failed to persist terminal coordinator runtime state", { error: String(error) });
+			});
 			await this.#emitExtensionEvent(event);
 			return;
 		}
@@ -5341,6 +6053,7 @@ export class AgentSession {
 		event: AgentEvent,
 		activePromptHandle?: string,
 		canonicalAdmission?: CanonicalMessageAdmission,
+		eventLease?: RunResourceProducerLease,
 	): Promise<void> => {
 		const attemptScope = (event as AgentEvent & { scope?: AttemptScope }).scope;
 
@@ -5680,7 +6393,7 @@ export class AgentSession {
 			});
 		}
 
-		await this.#emitSessionEvent(displayEvent);
+		await this.#emitSessionEvent(displayEvent, eventLease);
 		if (event.type === "message_end" && event.message.role === "assistant") {
 			this.#assistantAttemptScopes.set(event.message, {
 				scope: attemptScope,
@@ -6030,6 +6743,7 @@ export class AgentSession {
 						skipCompactionCheck: true,
 						resourceRunId: activePromptHandle,
 						maintenanceContinuation: true,
+						sdkRunToken: attemptScope ? this.#sdkRunTokensByAttemptScope.get(attemptScope) : undefined,
 					});
 				}
 				return;
@@ -6126,9 +6840,11 @@ export class AgentSession {
 				});
 			}
 			this.#resolveRetry();
+			if (this.#isDisposed || this.#sessionAdmissionClosing) return;
 
 			const compactionTask = this.#schedulePostPromptTask(
 				async () => {
+					if (this.#isDisposed || this.#sessionAdmissionClosing) return;
 					await this.#checkCompaction(msg, true, undefined, activePromptHandle);
 				},
 				{ resourceRunId: activePromptHandle },
@@ -6201,9 +6917,11 @@ export class AgentSession {
 		selectionFenceGeneration: number,
 		lease?: RunResourceProducerLease,
 		leaseTask: Promise<void> = task,
+		excludeFromRecovery = false,
 	): void {
 		this.#postPromptTasks.add(task);
 		this.#postPromptTaskSelectionFenceGenerations.set(task, selectionFenceGeneration);
+		if (excludeFromRecovery) this.#postPromptTaskRecoveryExcluded.add(task);
 		this.#ensurePostPromptTasksPromise();
 		if (lease) {
 			lease.track("post_prompt", "agent-session", leaseTask);
@@ -6214,6 +6932,7 @@ export class AgentSession {
 			.finally(() => {
 				this.#postPromptTasks.delete(task);
 				this.#postPromptTaskSelectionFenceGenerations.delete(task);
+				this.#postPromptTaskRecoveryExcluded.delete(task);
 				if (this.#postPromptTasks.size === 0) this.#resolvePostPromptTasks();
 			});
 	}
@@ -6227,6 +6946,7 @@ export class AgentSession {
 			resourceRunId?: string;
 			leaseTask?: Promise<void>;
 			selectionFenceGeneration?: number;
+			excludeFromPostPromptRecovery?: boolean;
 		},
 	): Promise<void> {
 		const selectionFenceGeneration =
@@ -6253,7 +6973,11 @@ export class AgentSession {
 			options?.onSkip?.();
 			return Promise.resolve();
 		}
-		const signal = reservation?.ok ? reservation.lease.signal : this.#postPromptTasksAbortController.signal;
+		const taskSignal = reservation?.ok ? reservation.lease.signal : this.#postPromptTasksAbortController.signal;
+		// Disposal is a session-wide terminal fence. Compose it with the selected
+		// logical-resource signal so stale leases from earlier runs cannot keep a
+		// post-prompt task alive after the current run was quarantined.
+		const signal = AbortSignal.any([taskSignal, this.#disposeAbortController.signal]);
 		const runScheduled = async () => {
 			if (delayMs > 0) {
 				try {
@@ -6281,6 +7005,7 @@ export class AgentSession {
 			selectionFenceGeneration,
 			reservation?.ok ? reservation.lease : undefined,
 			options?.leaseTask,
+			options?.excludeFromPostPromptRecovery,
 		);
 		return scheduled;
 	}
@@ -6317,8 +7042,11 @@ export class AgentSession {
 		predecessorAgentEndHold?: symbol;
 		/** Internal predecessor terminal event sequestered while waiting behind selection. */
 		deferredPredecessorAgentEnd?: AgentSessionEvent;
+		/** Internal causal SDK owner captured when this continuation was scheduled. */
+		sdkRunToken?: string;
 	}): Promise<void> {
 		const continuationAdmission = this.#captureScheduledContinuationAdmission();
+		const scheduledSdkRunToken = options?.sdkRunToken;
 		const selectionFenceGeneration =
 			options?.selectionFenceGeneration ??
 			this.#selectionFenceGenerationContext.getStore() ??
@@ -6340,6 +7068,7 @@ export class AgentSession {
 						generation: deferredPromptGeneration,
 						selectionFenceGeneration,
 						deferredPredecessorAgentEnd,
+						sdkRunToken: scheduledSdkRunToken,
 					});
 				} finally {
 					// The recursive call synchronously re-reserved its settlement
@@ -6410,7 +7139,7 @@ export class AgentSession {
 									settleLease();
 									return;
 								}
-								await this.#awaitStartupTurnBarrier();
+								await this.#awaitStartupTurnBarrier(scheduledSignal);
 								if (!canContinue()) {
 									settleLease();
 									return;
@@ -6475,18 +7204,18 @@ export class AgentSession {
 												// agent_start (review P1); their queued messages are in-run
 												// consumptions, not own-run promotions.
 												const startsOwn = options?.maintenanceContinuation !== true;
-												const consumedSdkRunToken = startsOwn
-													? acceptance.consumedQueuedMessages
-															.map(message => this.#sdkRunTokensByQueuedMessage.get(message))
-															.find((token): token is string => token !== undefined)
-													: undefined;
+												const inheritedSdkRunToken = options?.continueQueuedOnly
+													? undefined
+													: (options?.sdkRunToken ?? scheduledSdkRunToken);
+												const consumedSdkRunToken = acceptance.consumedQueuedMessages
+													.map(message => this.#sdkRunTokensByQueuedMessage.get(message))
+													.find((token): token is string => token !== undefined);
+												const sdkRunToken = consumedSdkRunToken ?? inheritedSdkRunToken;
 												this.#fireQueuedPromotionHooks(acceptance.consumedQueuedMessages, {
 													startsOwnRun: startsOwn,
 												});
-												if (consumedSdkRunToken !== undefined)
-													this.#sdkRunTokensByAttemptScope.set(handle.scope, consumedSdkRunToken);
-												if (startsOwn) this.#activeSdkRunToken = consumedSdkRunToken;
-												this.#acceptRunHandle(handle);
+												if (startsOwn) this.#activeSdkRunToken = sdkRunToken;
+												this.#acceptSdkAttemptRun(handle, sdkRunToken);
 												options?.onRunAccepted?.(handle);
 												// Keep the queued token available through the acceptance callback;
 												// SDK follow-up owners bind it to the new attempt scope there.
@@ -6649,8 +7378,12 @@ export class AgentSession {
 		resourceRunId?: string,
 		deferredSelectionFenceGeneration?: number,
 		deferredPredecessorAgentEnd?: AgentSessionEvent,
+		sdkRunToken?: string,
 	): void {
 		const scheduledGeneration = generation;
+		const scheduledSdkRunToken =
+			sdkRunToken ??
+			(this.#activeAttemptScope ? this.#sdkRunTokensByAttemptScope.get(this.#activeAttemptScope) : undefined);
 		const continuationAuthorized = async (
 			signal: AbortSignal,
 			hasPendingNextTurnMessages = false,
@@ -6703,6 +7436,7 @@ export class AgentSession {
 						resourceRunId,
 						selectionFenceGeneration,
 						predecessorAgentEnd,
+						scheduledSdkRunToken,
 					);
 				} finally {
 					this.#endSelectionFenceDeferralTracking(selectionFenceGeneration);
@@ -6750,6 +7484,7 @@ export class AgentSession {
 								promptText,
 								{
 									skipPostPromptRecoveryWait: true,
+									sdkRunToken: scheduledSdkRunToken,
 									skipCompactionCheck: true,
 									predecessorAgentEndHold,
 									onFinalPreflight: ({ hasPendingNextTurnMessages }) =>
@@ -6808,6 +7543,7 @@ export class AgentSession {
 		this.#postPromptTasksAbortController = new AbortController();
 		this.#postPromptTasks.clear();
 		this.#postPromptTaskSelectionFenceGenerations.clear();
+		this.#postPromptTaskRecoveryExcluded.clear();
 		this.#releaseDeferredAgentEndContinuations();
 		this.#resolveTtsrResume();
 		this.#resolvePostPromptTasks();
@@ -6829,8 +7565,11 @@ export class AgentSession {
 				await this.#ttsrResumePromise;
 				continue;
 			}
-			if (this.#postPromptTasksPromise) {
-				await this.#postPromptTasksPromise;
+			const recoveryTasks = [...this.#postPromptTasks].filter(
+				task => !this.#postPromptTaskRecoveryExcluded.has(task),
+			);
+			if (recoveryTasks.length > 0) {
+				await Promise.allSettled(recoveryTasks);
 				continue;
 			}
 			// Tracked post-prompt tasks cover deferred continuations scheduled from
@@ -6852,7 +7591,9 @@ export class AgentSession {
 	 */
 	async #waitForPostPromptTasksBeforeSelectionFence(selectionFenceGeneration: number): Promise<void> {
 		const precedingTasks = [...this.#postPromptTasks].filter(
-			task => (this.#postPromptTaskSelectionFenceGenerations.get(task) ?? 0) < selectionFenceGeneration,
+			task =>
+				!this.#postPromptTaskRecoveryExcluded.has(task) &&
+				(this.#postPromptTaskSelectionFenceGenerations.get(task) ?? 0) < selectionFenceGeneration,
 		);
 		if (precedingTasks.length > 0) await Promise.allSettled(precedingTasks);
 	}
@@ -7527,16 +8268,16 @@ export class AgentSession {
 		this.#workerIntegrationScheduler?.enqueue();
 	}
 
-	async #flushWorkerIntegrationAttempt(): Promise<void> {
-		await this.#workerIntegrationScheduler?.flush();
+	async #flushWorkerIntegrationAttempt(): Promise<WorkerIntegrationOutcome> {
+		return (await this.#workerIntegrationScheduler?.flushWithOutcome()) ?? { status: "completed" };
 	}
 
-	async #flushWorkerIntegrationForAgentEnd(): Promise<void> {
+	async #flushWorkerIntegrationForAgentEnd(): Promise<WorkerIntegrationOutcome> {
 		if (!this.#workerIntegrationRequestedForTurn) {
 			this.#requestWorkerIntegrationAttempt();
 		}
 		try {
-			await this.#flushWorkerIntegrationAttempt();
+			return await this.#flushWorkerIntegrationAttempt();
 		} finally {
 			this.#workerIntegrationRequestedForTurn = false;
 		}
@@ -7549,6 +8290,9 @@ export class AgentSession {
 		workerIntegrationSettled = false,
 		scope?: AttemptScopeRef,
 	): Promise<void> {
+		const admission = this.#agentEventAdmission.get(event);
+		const activeAttemptScopeAtEvent = admission === undefined ? this.#activeAttemptScope : admission.scope;
+		const activeSdkRunTokenAtEvent = admission === undefined ? this.#activeSdkRunToken : admission.sdkRunToken;
 		if (event.type === "agent_end" && !workerIntegrationSettled) {
 			await this.#flushWorkerIntegrationForAgentEnd();
 		}
@@ -7559,20 +8303,36 @@ export class AgentSession {
 				? eventToken
 				: deliveryScope
 					? this.#sdkRunTokensByAttemptScope.get(deliveryScope as AttemptScope)
-					: this.#activeSdkRunToken;
+					: undefined;
 		const isTerminalAgentEnd =
 			event.type === "agent_end" && !(event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted");
 		const finishAttempt = () => {
 			if (!isTerminalAgentEnd) return;
+			// A merged wake batch whose flush fired while still streaming cleared its
+			// pending flag without rescheduling. Returning to idle is exactly when it
+			// becomes deliverable again, so rearm here rather than waiting for an
+			// unrelated enqueue.
+			this.yieldQueue.rearmIdle();
 			const isActiveAttempt =
-				deliveryScope === undefined ||
-				this.#activeAttemptScope === undefined ||
-				deliveryScope === this.#activeAttemptScope;
+				deliveryScope === undefined
+					? this.#activeAttemptScope === activeAttemptScopeAtEvent &&
+						this.#activeSdkRunToken === activeSdkRunTokenAtEvent
+					: deliveryScope === activeAttemptScopeAtEvent &&
+						deliveryScope === this.#activeAttemptScope &&
+						this.#activeSdkRunToken === activeSdkRunTokenAtEvent;
+			if (this.#foldStopRequested) {
+				this.#foldStopRequested = false;
+				this.agent.setSteeringAdmissionFence(undefined);
+			}
 			if (deliveryScope) {
 				this.#attemptRecordStore.retire(deliveryScope as AttemptScope);
-				this.#sdkRunTokensByAttemptScope.delete(deliveryScope as AttemptScope);
+				if (
+					activeSdkRunTokenAtEvent !== undefined &&
+					this.#sdkRunTokensByAttemptScope.get(deliveryScope as AttemptScope) === activeSdkRunTokenAtEvent
+				)
+					this.#sdkRunTokensByAttemptScope.delete(deliveryScope as AttemptScope);
 			}
-			if (isActiveAttempt && sdkRunToken === this.#activeSdkRunToken) this.#activeSdkRunToken = undefined;
+			if (isActiveAttempt) this.#activeSdkRunToken = undefined;
 			if (isActiveAttempt) {
 				this.#activeAttemptScope = undefined;
 				this.#activeLogicalRunId = undefined;
@@ -7840,8 +8600,18 @@ export class AgentSession {
 		const sid = this.#providerSessionId ?? sessionId ?? this.sessionManager.getSessionId();
 		this.agent.sessionId = sid;
 		this.agent.providerSessionId = this.#providerCacheSessionId ?? sid;
-		this.agent.setMetadataResolver((provider: string) =>
-			buildSessionMetadata(sid, provider, this.#modelRegistry.authStorage, this.credentialSessionId),
+		this.agent.setMetadataResolver(context =>
+			buildSessionMetadata(
+				sid,
+				context.provider,
+				this.#modelRegistry.authStorage,
+				this.credentialSessionId,
+				context.model ?? this.model,
+				// Optional call: the metadata resolver runs on every prompt, and `owner` is an
+				// optional `buildSessionMetadata` argument. The auth-credential paths keep the
+				// strict call because they genuinely require a real registry owner.
+				this.#modelRegistry.getAuthStorageOwner?.(),
+			),
 		);
 	}
 
@@ -7945,13 +8715,35 @@ export class AgentSession {
 		if (this.#disposePromise) return this.#disposePromise;
 		const { promise, resolve, reject } = Promise.withResolvers<void>();
 		this.#disposePromise = promise;
+		this.#abortAdmissionEpoch++;
+		this.#isDisposed = true;
+		this.#disposeAbortController.abort();
+		this.#disposeAdmissionClosed = this.#closeSessionAdmission();
+		this.#disposePostPromptDrain = this.#cancelPostPromptTasks();
+		this.#settleDeliveredOwnedRegistrations(this.#pendingNextTurnMessages.map(entry => entry.message));
+		this.#pendingNextTurnMessages = [];
+		this.#scheduledHiddenNextTurnGeneration = undefined;
+		this.#abortActiveMidRunBarriers();
+		this.abortCompaction();
+		this.abortRetry();
+		this.#quarantineAgentRunResources();
+		this.agent.abort();
+		this.agent.setMainAttemptScopeObserver(undefined);
+		this.#disconnectFromAgent();
 		void this.#dispose().then(resolve, reject);
 		return promise;
 	}
 
+	/** Cancel the active logical run domain, including managed continuations detached from Agent's active attempt. */
+	#quarantineAgentRunResources(): void {
+		const resourceRunId = this.agent.currentManagedLogicalRunId ?? this.agent.activeResourceRunId;
+		if (resourceRunId !== undefined) this.agent.resourceLedger.quarantine(String(resourceRunId));
+	}
+
 	async #dispose(): Promise<void> {
-		await this.sessionManager.joinCwdTransition();
-		const admissionClosed = this.#closeSessionAdmission();
+		const admissionClosed = this.#disposeAdmissionClosed ?? this.#closeSessionAdmission();
+		await admissionClosed;
+		await this.sessionManager.closeCwdMoveAdmission();
 		this.#isDisposed = true;
 		// Reject new direct Python starts as soon as disposal begins (synchronously,
 		// before any await) so callers cannot race a start against teardown.
@@ -7989,18 +8781,22 @@ export class AgentSession {
 				this.agent.forceAbort("Session disposed");
 			}
 		}
-		await admissionClosed;
 		await this.#agentEndPublicationPromise;
 		await this.#queuedExtensionEvents;
+		await this.#agentEndHandlingPromise;
 		// Drain the sidecar write order for the same reason the two queues above are
 		// drained: each entry writes under the native identity-bound state-file lock, so a
-		// still-queued write would run after the session that owns it is gone — releasing
+		// a still-queued write would run after the session that owns it is gone — releasing
 		// a lock whose owner no longer exists, and under `bun test --isolate` calling into
 		// the addon after the runtime tore down the context it was scheduled in. The chain
 		// is already failure-absorbing, so this only waits.
 		await this.#coordinatorPersistQueue;
+		// Terminal publication records its reconciliation from a promise reaction, which
+		// can append after the queue snapshot above was awaited. Drain the tracked writes
+		// again so disposal cannot return while that late reconciliation still owns a lock.
+		await this.#drainUnbarrieredCoordinatorPersists();
 		this.#pendingBackgroundExchanges = [];
-		this.yieldQueue.clear();
+		this.#drainTerminalOwnedYieldEntries();
 
 		this.agent.setOnBeforeYield(undefined);
 		try {
@@ -8014,12 +8810,25 @@ export class AgentSession {
 		this.#workflowGateEmitter = undefined;
 		this.#notifyWorkflowGateEmitterChanged(this.sessionId, undefined);
 		await this.#flushWorkerIntegrationAttempt();
-		await this.#cancelPostPromptTasks();
+		// Worker integration completion can enqueue terminal reconciliation while the
+		// flush above is pending; drain that late producer before disposal resolves.
+		await this.#coordinatorPersistQueue;
+		await this.#drainUnbarrieredCoordinatorPersists();
+		await (this.#disposePostPromptDrain ?? this.#cancelPostPromptTasks());
 		// Cancel jobs this agent registered so a subagent's teardown doesn't
 		// leak its background bash/task work into the parent's manager. Only
 		// the session that owns the manager goes on to dispose it (which itself
 		// nukes any leftover jobs and pending deliveries).
 		this.#cancelOwnAsyncJobs();
+		// Final drain (Codex review P2 on #5088): an async-job completion that
+		// enqueued during the awaited session_shutdown window above survived the
+		// first drain with a retained delivery claim, and the already-aborted
+		// disposal signal makes its idle-flush task exit before YieldQueue.flush
+		// can run. Producers are now cancelled, so drain once more to settle any
+		// straggler envelope and release its claim before owned-manager teardown
+		// — a shared manager would otherwise keep the claim past this session's
+		// disposal.
+		this.#drainTerminalOwnedYieldEntries();
 		await Promise.allSettled(this.#deferredOwnerShutdownFinalizations);
 		const ownedAsyncManager = this.#ownedAsyncJobManager;
 		if (ownedAsyncManager && this.#disposeAsyncJobManager) {
@@ -8056,6 +8865,14 @@ export class AgentSession {
 		this.#unregisterSessionMemorySettings = undefined;
 		if (ownerTerminalContextFromEnvironment() === null) this.#unregisterRuntimeStateFinalizer?.();
 		this.#unregisterRuntimeStateFinalizer = undefined;
+		this.#unregisterBeforeMoveListener?.();
+		this.#unregisterBeforeMoveListener = undefined;
+		this.#unregisterMoveAbortListener?.();
+		this.#unregisterMoveAbortListener = undefined;
+		this.#unregisterMovePublicationListener?.();
+		this.#unregisterMovePublicationListener = undefined;
+		this.#unregisterAfterMoveListener?.();
+		this.#unregisterAfterMoveListener = undefined;
 		await releaseTabsForOwner(this.sessionManager.getSessionId()).catch((error: unknown) =>
 			logger.warn("session dispose: releaseTabsForOwner failed", { error }),
 		);
@@ -8220,14 +9037,24 @@ export class AgentSession {
 				await this.#waitForPostPromptTasksBeforeSelectionFence(ignoreSelectionFenceGeneration);
 			}
 			await this.#waitForSessionSettlement(ignoreSelectionFenceGeneration);
+			const hasBlockingPostPromptTasks =
+				ignoreSelectionFenceGeneration === undefined
+					? this.#postPromptTasks.size > 0
+					: [...this.#postPromptTasks].some(
+							task =>
+								!this.#postPromptTaskRecoveryExcluded.has(task) &&
+								(this.#postPromptTaskSelectionFenceGenerations.get(task) ?? 0) < ignoreSelectionFenceGeneration,
+						);
 			if (
 				!this.agent.state.isStreaming &&
 				!this.#retryPromise &&
 				!this.#ttsrResumePromise &&
-				!this.#postPromptTasksPromise &&
+				!hasBlockingPostPromptTasks &&
 				!this.#isSessionSettlementPending(ignoreSelectionFenceGeneration)
 			)
 				return;
+			if (ignoreSelectionFenceGeneration === undefined && hasBlockingPostPromptTasks && this.#postPromptTasksPromise)
+				await this.#postPromptTasksPromise;
 		}
 	}
 
@@ -8252,6 +9079,35 @@ export class AgentSession {
 		await this.sessionManager.flush();
 	}
 
+	queueCoordinatorRuntimeStatePersistForTests(event: AgentSessionEvent, gate: Promise<void>): Promise<void> {
+		this.#agentEventAdmission.set(event, {
+			persistGeneration: this.#coordinatorPersistGeneration,
+			persistBarrier: this.#coordinatorRescopeBarrier,
+		});
+		const task = (async () => {
+			await gate;
+			await this.#queueCoordinatorRuntimeStatePersist(event, true);
+		})();
+		this.#coordinatorEventHandlers.add(task);
+		void task.then(
+			() => this.#coordinatorEventHandlers.delete(task),
+			() => this.#coordinatorEventHandlers.delete(task),
+		);
+		return task;
+	}
+
+	parkAgentEndForCoordinatorPersistForTests(event: Extract<AgentSessionEvent, { type: "agent_end" }>): void {
+		this.#agentEventAdmission.set(event, {
+			persistGeneration: this.#coordinatorPersistGeneration,
+			persistBarrier: this.#coordinatorRescopeBarrier,
+		});
+		this.#pendingAgentEndEmit = event;
+	}
+
+	flushParkedAgentEndForCoordinatorPersistForTests(): void {
+		this.#flushPendingAgentEnd();
+	}
+
 	async drainAsyncJobDeliveriesForAcp(options?: { timeoutMs?: number }): Promise<boolean> {
 		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		if (!manager) return false;
@@ -8454,13 +9310,39 @@ export class AgentSession {
 	 * handler, so Ctrl+B-style folding fails closed instead of aborting or
 	 * shell-suspending arbitrary work.
 	 */
-	registerForegroundBashBackgroundRequestHandler(handler: () => void): () => void {
-		this.#foregroundBashBackgroundRequestHandler = handler;
-		return () => {
-			if (this.#foregroundBashBackgroundRequestHandler === handler) {
-				this.#foregroundBashBackgroundRequestHandler = undefined;
-			}
-		};
+	registerForegroundFoldParticipant(adapter: FoldAdapter): () => void {
+		return this.#foldCoordinator.registerParticipant(adapter);
+	}
+
+	/** The session-owned fold coordinator, for delivery-side receipt lookup. */
+	get foldCoordinator(): FoldCoordinator {
+		return this.#foldCoordinator;
+	}
+
+	/**
+	 * Best-effort capture of what the interrupted turn still intended to do, so
+	 * the wake turn can finish the original task instead of only reporting output.
+	 */
+	#captureRemainingIntentForFold(): string | undefined {
+		const messages = this.agent.state.messages;
+		for (let index = messages.length - 1; index >= 0; index--) {
+			const message = messages[index];
+			if (message?.role !== "user") continue;
+			const content = message.content;
+			const text =
+				typeof content === "string"
+					? content
+					: Array.isArray(content)
+						? content
+								.map(block => (typeof block === "object" && block && "text" in block ? String(block.text) : ""))
+								.filter(Boolean)
+								.join("\n")
+						: "";
+			const trimmed = text.trim();
+			if (trimmed.length === 0) return undefined;
+			return trimmed.length > 2000 ? `${trimmed.slice(0, 2000)}…` : trimmed;
+		}
+		return undefined;
 	}
 
 	/**
@@ -8469,7 +9351,7 @@ export class AgentSession {
 	 * no fold target exists.
 	 */
 	hasForegroundBashBackgroundRequestHandler(): boolean {
-		return this.#foregroundBashBackgroundRequestHandler !== undefined;
+		return this.#foldCoordinator.hasFoldableParticipant();
 	}
 
 	/** Set the SDK permission policy used by guarded ACP tool execution. */
@@ -8505,11 +9387,17 @@ export class AgentSession {
 	 * Ask the active managed foreground bash call to return as a background job.
 	 * Returns false when no supported foreground tool is currently backgroundable.
 	 */
-	requestForegroundBashBackground(): boolean {
-		const handler = this.#foregroundBashBackgroundRequestHandler;
-		if (!handler) return false;
-		handler();
-		return true;
+	async requestForegroundBashBackground(): Promise<boolean> {
+		if (!this.#foldCoordinator.hasFoldableParticipant()) return false;
+		try {
+			const result = await this.#foldCoordinator.requestFold();
+			return result.status === "folded";
+		} catch (error) {
+			logger.warn("Foreground fold request failed", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+			return false;
+		}
 	}
 
 	/**
@@ -9450,6 +10338,7 @@ export class AgentSession {
 		if (this.#sessionAdmissionClosed || this.#isDisposed) throw this.#sessionAdmissionBusyError();
 		const inFlightPrompt = this.#beginInFlight();
 		let hindsightRecall: string | undefined;
+		let continuationSdkRunToken: string | undefined;
 		try {
 			const volatileProjectContextMessage = await this.#buildVolatileProjectContextMessage();
 			this.agent.appendMessage(volatileProjectContextMessage);
@@ -9485,14 +10374,18 @@ export class AgentSession {
 			await this.agent.continue({
 				...this.#managedFallbackPromptOptions(),
 				onRunAccepted: (handle: AttemptRunHandle) => {
-					this.#acceptRunHandle(handle);
+					continuationSdkRunToken = this.#activeSdkRunToken;
+					this.#acceptSdkAttemptRun(handle, continuationSdkRunToken);
 					if (hindsightRecall) hindsightState?.markRecallSnippetInjected(hindsightRecall);
 				},
 			});
-			await this.#waitForPostPromptRecovery();
+			if (continuationSdkRunToken === undefined) await this.#waitForPostPromptRecovery();
 		} finally {
 			this.#removeEphemeralCustomMessages();
-			await this.#settleEndedInFlight(inFlightPrompt);
+			await this.#settleEndedInFlight(
+				inFlightPrompt,
+				continuationSdkRunToken === undefined ? "full" : "publication",
+			);
 		}
 	}
 
@@ -9620,8 +10513,9 @@ export class AgentSession {
 	async setCredentialPin(provider: string, selector: AuthCredentialSelector): Promise<void> {
 		const scopeId = this.credentialSessionId;
 		const authStorage = this.#modelRegistry.authStorage;
-		const target = authStorage.resolveOAuthPinTarget(provider, selector);
-		authStorage.setSessionCredentialSelector(scopeId, provider, target.canonicalSelector);
+		const authStorageOwner = this.#modelRegistry.getAuthStorageOwner();
+		const target = authStorage.resolveOAuthPinTarget(provider, selector, authStorageOwner);
+		authStorage.setSessionCredentialSelector(scopeId, provider, target.canonicalSelector, authStorageOwner);
 		if (target.canonicalSelector.kind === "id" && !this.#credentialStoreIdentity) return;
 		this.sessionManager.appendCustomEntry("auth-credential-pin", {
 			v: 1,
@@ -9701,9 +10595,13 @@ export class AgentSession {
 		args = "",
 		options?: Pick<
 			PromptOptions,
-			"onPreflightAccepted" | "onPreflightAcceptCommit" | "onSkillPrepared" | "preflightSignal" | "sdkRunToken"
+			"onPreflightAccepted" | "onPreflightAcceptCommit" | "onSkillPrepared" | "preflightSignal" | "sdkRunCapability"
 		>,
 	): Promise<{ name: string; path: string; args?: string; lineCount?: number }> {
+		const internalOptions = {
+			...options,
+			sdkRunToken: readSdkRunCapability(options?.sdkRunCapability),
+		};
 		if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
 		const skillName = name.trim();
 		if (!skillName) throw Object.assign(new Error("skill.invoke requires a skill name."), { code: "invalid_input" });
@@ -9749,7 +10647,7 @@ export class AgentSession {
 			lineCount: built.details.lineCount,
 			cleanedArgs: activation.cleanedArgs || undefined,
 		});
-		await this.promptCustomMessage(skillPromptMessage, options);
+		await this.promptCustomMessage(skillPromptMessage, internalOptions as InternalCustomMessageOptions);
 		return {
 			name: skill.name,
 			path: skill.filePath,
@@ -10439,6 +11337,27 @@ export class AgentSession {
 	 * @throws Error if no model selected or no API key available (when not streaming)
 	 */
 	async prompt(text: string, options?: PromptOptions): Promise<void> {
+		const releaseStartupPromptWaiter = this.#reserveStartupPromptWaiter();
+		try {
+			await this.#promptInternal(text, options, releaseStartupPromptWaiter);
+		} finally {
+			releaseStartupPromptWaiter();
+		}
+	}
+
+	async #promptInternal(
+		text: string,
+		options: PromptOptions | undefined,
+		releaseStartupPromptWaiter: () => void,
+	): Promise<void> {
+		const hasUsableImage =
+			options?.images?.some(image => typeof image?.data === "string" && image.data.trim().length > 0) === true;
+		if (typeof text !== "string" || (text.trim().length === 0 && !hasUsableImage))
+			throw Object.assign(new Error("Prompt must not be empty."), { code: "invalid_input" });
+		const sdkRunToken = readSdkRunCapability(options?.sdkRunCapability);
+		const internalOptions: InternalPromptOptions | undefined = options
+			? { ...options, ...(sdkRunToken ? { sdkRunToken } : {}) }
+			: undefined;
 		this.#assertRecoveryHydrationPromoted();
 		const owner = this.#sessionAdmissionContext.getStore();
 		if (owner && !owner.released) throw this.#sessionAdmissionBusyError();
@@ -10453,14 +11372,19 @@ export class AgentSession {
 					await this.invokeSkill(
 						invocation.skill.name,
 						invocation.args,
-						options?.onPreflightAccepted || options?.onPreflightAcceptCommit || options?.preflightSignal
+						options?.onPreflightAccepted ||
+							options?.onPreflightAcceptCommit ||
+							options?.preflightSignal ||
+							internalOptions?.sdkRunToken
 							? {
-									...(options.onPreflightAccepted ? { onPreflightAccepted: options.onPreflightAccepted } : {}),
-									...(options.onPreflightAcceptCommit
+									...(options?.onPreflightAccepted
+										? { onPreflightAccepted: options.onPreflightAccepted }
+										: {}),
+									...(options?.onPreflightAcceptCommit
 										? { onPreflightAcceptCommit: options.onPreflightAcceptCommit }
 										: {}),
-									...(options.preflightSignal ? { preflightSignal: options.preflightSignal } : {}),
-									...(options.sdkRunToken ? { sdkRunToken: options.sdkRunToken } : {}),
+									...(options?.preflightSignal ? { preflightSignal: options.preflightSignal } : {}),
+									...(options?.sdkRunCapability ? { sdkRunCapability: options.sdkRunCapability } : {}),
 								}
 							: undefined,
 					);
@@ -10494,6 +11418,10 @@ export class AgentSession {
 
 		// Expand file-based prompt templates if requested
 		const expandedText = expandPromptTemplates ? expandPromptTemplate(text, [...this.#promptTemplates]) : text;
+		const expandedHasUsableImage =
+			options?.images?.some(image => typeof image?.data === "string" && image.data.trim().length > 0) === true;
+		if (expandedText.trim().length === 0 && !expandedHasUsableImage)
+			throw Object.assign(new Error("Prompt must not be empty."), { code: "invalid_input" });
 		assertImagePlaceholdersHavePayload(expandedText, options?.images);
 		const workflowIntentDiff = options?.synthetic ? null : buildWorkflowIntentDiff(expandedText);
 		const claimsGenuineUserIntent = !options?.synthetic && options?.attribution !== "agent";
@@ -10567,7 +11495,12 @@ export class AgentSession {
 							attribution: promptAttribution,
 							timestamp: Date.now(),
 						}
-					: { role: "user" as const, content: userContent, attribution: promptAttribution, timestamp: Date.now() };
+					: {
+							role: "user" as const,
+							content: userContent,
+							attribution: promptAttribution,
+							timestamp: Date.now(),
+						};
 				if (deepInterviewUserIntentEpoch !== undefined)
 					this.#deepInterviewGenuineUserMessageEpochs.set(message, deepInterviewUserIntentEpoch);
 				await this.refreshGjcSubskillTools();
@@ -10595,6 +11528,8 @@ export class AgentSession {
 				}
 			},
 			options?.preflightSignal,
+			undefined,
+			{ startupPromptWaiterRelease: releaseStartupPromptWaiter },
 		);
 	}
 
@@ -10714,9 +11649,13 @@ export class AgentSession {
 			| "onPreflightAccepted"
 			| "onPreflightAcceptCommit"
 			| "preflightSignal"
-			| "sdkRunToken"
+			| "sdkRunCapability"
 		>,
 	): Promise<void> {
+		const sdkRunToken = readSdkRunCapability(options?.sdkRunCapability);
+		const internalOptions: InternalCustomMessageOptions | undefined = options
+			? { ...options, ...(sdkRunToken ? { sdkRunToken } : {}) }
+			: undefined;
 		if (options?.preflightSignal?.aborted) throw promptPreflightCancelledError();
 		const textContent =
 			typeof message.content === "string"
@@ -10785,7 +11724,7 @@ export class AgentSession {
 				};
 				try {
 					await this.#promptWithMessage(customMessage, textContent, {
-						...options,
+						...internalOptions,
 						onPreflightAccepted: undefined,
 						onPreflightAcceptCommit: commitAcceptance,
 						admissionLease: admission,
@@ -10816,8 +11755,8 @@ export class AgentSession {
 			| "onPreflightAccepted"
 			| "onPreflightAcceptCommit"
 			| "preflightSignal"
-			| "sdkRunToken"
 		> & {
+			sdkRunToken?: string;
 			prependMessages?: AgentMessage[];
 			skipPostPromptRecoveryWait?: boolean;
 			predecessorAgentEndHold?: symbol;
@@ -10884,6 +11823,9 @@ export class AgentSession {
 		const rosterClaim = this.#claimIrcRosterCandidate();
 		let hasPendingNextTurnMessages = false;
 		let pendingNextTurnMessageCount = 0;
+		let skipPostPromptRecoveryWait =
+			options?.skipPostPromptRecoveryWait === true || options?.sdkRunToken !== undefined;
+		let promptAttemptScope: AttemptScope | undefined;
 		let hindsightRecall: string | undefined;
 		try {
 			this.#throwIfPromptPreflightCancelled(generation, preflightSignal);
@@ -11152,9 +12094,10 @@ export class AgentSession {
 				...this.#managedFallbackPromptOptions(),
 				...(options?.sdkRunToken ? { sdkRunToken: options.sdkRunToken } : {}),
 				onRunAccepted: (handle: AttemptRunHandle) => {
-					this.#acceptRunHandle(handle);
-					if (options?.sdkRunToken) {
-						this.#sdkRunTokensByAttemptScope.set(handle.scope, options.sdkRunToken);
+					promptAttemptScope = handle?.scope;
+					if (handle) this.#acceptSdkAttemptRun(handle, options?.sdkRunToken);
+					else this.#acceptRunHandle(handle);
+					if (handle && options?.sdkRunToken) {
 						this.#activeSdkRunToken = options.sdkRunToken;
 					}
 					options?.onRunAccepted?.(handle);
@@ -11189,6 +12132,20 @@ export class AgentSession {
 					options?.onPreflightAccepted?.();
 				},
 			});
+			const activeTerminalScope = this.#activeAttemptScope;
+			const terminalAttemptScope =
+				activeTerminalScope !== undefined &&
+				(this.#skipPostPromptRecoveryWaitByAttemptScope.has(activeTerminalScope) ||
+					(options?.sdkRunToken !== undefined &&
+						this.#sdkRunTokensByAttemptScope.get(activeTerminalScope) === options.sdkRunToken))
+					? activeTerminalScope
+					: promptAttemptScope;
+			if (
+				terminalAttemptScope !== undefined &&
+				this.#skipPostPromptRecoveryWaitByAttemptScope.delete(terminalAttemptScope)
+			) {
+				skipPostPromptRecoveryWait = true;
+			}
 			const terminalAssistant = this.#findLastAssistantMessage();
 			if (
 				rosterClaim &&
@@ -11198,7 +12155,7 @@ export class AgentSession {
 			) {
 				this.#commitIrcRosterClaim(rosterClaim.token, rosterClaim.epoch);
 			}
-			if (!options?.skipPostPromptRecoveryWait) {
+			if (!skipPostPromptRecoveryWait) {
 				await this.#waitForPostPromptRecovery();
 			}
 		} catch (error) {
@@ -11223,7 +12180,7 @@ export class AgentSession {
 				this.#releaseIrcRosterClaim(rosterClaim.token, rosterClaim.epoch);
 			}
 			this.#releaseDeferredAgentEndContinuation(predecessorAgentEndHold);
-			await this.#settleEndedInFlight(inFlightPrompt, options?.skipPostPromptRecoveryWait ? "publication" : "full");
+			await this.#settleEndedInFlight(inFlightPrompt, skipPostPromptRecoveryWait ? "publication" : "full");
 		}
 	}
 
@@ -11427,12 +12384,18 @@ export class AgentSession {
 	 * Queue a steering message to interrupt the agent mid-run.
 	 */
 	async steer(text: string, images?: ImageContent[]): Promise<void> {
+		const hasUsableImage =
+			images?.some(image => typeof image?.data === "string" && image.data.trim().length > 0) === true;
+		if (typeof text !== "string" || (text.trim().length === 0 && !hasUsableImage))
+			throw Object.assign(new Error("Prompt must not be empty."), { code: "invalid_input" });
 		this.#assertRecoveryHydrationPromoted();
 		if (text.startsWith("/")) {
 			this.#throwIfExtensionCommand(text);
 		}
 
 		const expandedText = expandPromptTemplate(text, [...this.#promptTemplates]);
+		if (expandedText.trim().length === 0 && !hasUsableImage)
+			throw Object.assign(new Error("Prompt must not be empty."), { code: "invalid_input" });
 		assertImagePlaceholdersHavePayload(expandedText, images);
 		await this.#queueSteer(expandedText, images, { claimsGenuineUserIntent: true });
 	}
@@ -11445,12 +12408,18 @@ export class AgentSession {
 		images?: ImageContent[],
 		options?: Pick<PromptOptions, "followUpQueuePolicy">,
 	): Promise<void> {
+		const hasUsableImage =
+			images?.some(image => typeof image?.data === "string" && image.data.trim().length > 0) === true;
+		if (typeof text !== "string" || (text.trim().length === 0 && !hasUsableImage))
+			throw Object.assign(new Error("Prompt must not be empty."), { code: "invalid_input" });
 		this.#assertRecoveryHydrationPromoted();
 		if (text.startsWith("/")) {
 			this.#throwIfExtensionCommand(text);
 		}
 
 		const expandedText = expandPromptTemplate(text, [...this.#promptTemplates]);
+		if (expandedText.trim().length === 0 && !hasUsableImage)
+			throw Object.assign(new Error("Prompt must not be empty."), { code: "invalid_input" });
 		assertImagePlaceholdersHavePayload(expandedText, images);
 		await this.#queueFollowUp(expandedText, images, {
 			forceOneAtATime: options?.followUpQueuePolicy === "sequential",
@@ -11468,6 +12437,7 @@ export class AgentSession {
 			claimsGenuineUserIntent?: boolean;
 			onPromoted?: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
 			external?: boolean;
+			sdkRunToken?: string;
 		},
 	): Promise<void> {
 		this.#assertNoHandoffTransition();
@@ -11482,6 +12452,7 @@ export class AgentSession {
 			this.#externalSteerAdmissionSeq.set(message, ++this.#steeringAdmissionSeq);
 			if (options.onPromoted) this.#steerPromotionHooks.set(message, options.onPromoted);
 		}
+		if (options?.sdkRunToken) this.#sdkRunTokensByQueuedMessage.set(message, options.sdkRunToken);
 		if (options?.claimsGenuineUserIntent) {
 			const epoch = this.#claimDeepInterviewUserIntent();
 			this.#deepInterviewGenuineUserMessageEpochs.set(message, epoch);
@@ -11682,7 +12653,16 @@ export class AgentSession {
 		}
 		this.#scheduledHiddenNextTurnGeneration = generation;
 		this.#schedulePostPromptTask(
-			async () => {
+			async signal => {
+				if (signal.aborted || this.#isDisposed || this.#sessionAdmissionClosing) return;
+				if (this.#startupTurnBarrier) {
+					try {
+						await this.#awaitStartupTurnBarrier(signal);
+					} catch {
+						return;
+					}
+				}
+				if (signal.aborted || this.#isDisposed || this.#sessionAdmissionClosing) return;
 				if (this.#scheduledHiddenNextTurnGeneration === generation) {
 					this.#scheduledHiddenNextTurnGeneration = undefined;
 				}
@@ -11711,8 +12691,12 @@ export class AgentSession {
 					return;
 				}
 				try {
-					await this.#promptQueuedHiddenNextTurnMessages();
+					await this.#promptQueuedHiddenNextTurnMessages(signal);
 				} catch {
+					if (this.#isDisposed || this.#sessionAdmissionClosing || this.#disposeAbortController.signal.aborted) {
+						this.#pendingNextTurnMessages = [];
+						return;
+					}
 					// Leave the hidden next-turn messages queued for the next explicit prompt.
 				}
 			},
@@ -11727,7 +12711,7 @@ export class AgentSession {
 		);
 	}
 
-	async #promptQueuedHiddenNextTurnMessages(): Promise<void> {
+	async #promptQueuedHiddenNextTurnMessages(signal?: AbortSignal): Promise<void> {
 		if (this.#pendingNextTurnMessages.length === 0) {
 			return;
 		}
@@ -11757,6 +12741,14 @@ export class AgentSession {
 		if (reclassified.length === 0) {
 			return;
 		}
+		if (this.#isDisposed || this.#sessionAdmissionClosing || this.#disposeAbortController.signal.aborted) {
+			this.#settleDeliveredOwnedRegistrations(reclassified.map(entry => entry.message));
+			return;
+		}
+		if (signal?.aborted) {
+			this.#pendingNextTurnMessages = [...reclassified, ...this.#pendingNextTurnMessages];
+			return;
+		}
 		// Allocate a fresh root-turn lineage when the drained batch contains a
 		// fresh owned envelope OR an EXTERNAL hidden trigger: an external
 		// nextTurn message has no owned envelope, so without this it would
@@ -11778,11 +12770,24 @@ export class AgentSession {
 		const textContent = this.#getCustomMessageTextContent(message);
 		await this.#syncSkillPromptActiveStateSafely(message, true);
 		try {
+			if (this.#isDisposed || this.#sessionAdmissionClosing || this.#disposeAbortController.signal.aborted) {
+				this.#settleDeliveredOwnedRegistrations(reclassified.map(entry => entry.message));
+				return;
+			}
+			if (signal?.aborted) {
+				this.#pendingNextTurnMessages = [...reclassified, ...this.#pendingNextTurnMessages];
+				return;
+			}
 			await this.#promptWithMessage(message, textContent, {
 				prependMessages,
 				skipPostPromptRecoveryWait: true,
+				preflightSignal: signal,
 			});
 		} catch (error) {
+			if (this.#isDisposed || this.#sessionAdmissionClosing || this.#disposeAbortController.signal.aborted) {
+				this.#settleDeliveredOwnedRegistrations(reclassified.map(entry => entry.message));
+				return;
+			}
 			// Requeue only the SURVIVING reclassified entries: a completion
 			// denied by scope:"owned" was settled (dropped) above and must
 			// never reach a later prompt — once its scope and now-unoccupied
@@ -11809,19 +12814,55 @@ export class AgentSession {
 		// another session's manager (which lacks the same local job id) would
 		// see job === undefined and remove a still-live registration (review
 		// thread P1).
-		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
 		for (const message of messages) {
 			const details = (message as { details?: { ownedCompletions?: OwnedCompletionEnvelope[] } }).details;
-			for (const envelope of details?.ownedCompletions ?? []) {
-				const job = manager?.getJob(envelope.registration.jobId);
-				const status = job?.generation === envelope.registration.jobGeneration ? job?.status : undefined;
-				// Evicted jobs have no live record (job === undefined); terminal
-				// statuses settle the registration.
-				if (job === undefined || status === "completed" || status === "cancelled" || status === "failed") {
-					unregisterOwnedRegistration(envelope.registration);
+			for (const envelope of details?.ownedCompletions ?? []) this.#settleOwnedCompletionEnvelope(envelope);
+		}
+	}
+
+	#settleOwnedCompletionEnvelope(envelope: OwnedCompletionEnvelope): void {
+		const manager = this.#ownedAsyncJobManager ?? AsyncJobManager.instance();
+		const job = manager?.getJob(envelope.registration.jobId);
+		const status = job?.generation === envelope.registration.jobGeneration ? job?.status : undefined;
+		// Evicted jobs have no live record (job === undefined); terminal statuses
+		// settle the registration.
+		if (job === undefined || status === "completed" || status === "cancelled" || status === "failed") {
+			unregisterOwnedRegistration(envelope.registration);
+		}
+	}
+
+	/**
+	 * Drop every queued yield entry, releasing its retained delivery claim and
+	 * settling terminal owned-completion envelopes so neither outlives this
+	 * session's disposal. Claims resolve to the manager that actually retained
+	 * them: owned entries via their registration endpoint (subagents inherit a
+	 * parent's manager, and the process-global instance may belong to a
+	 * different concurrent session), ordinary entries only on the session-OWNED
+	 * manager. Disposal runs this twice: before the awaited session_shutdown
+	 * emit, and again after producer cancellation — a completion enqueued
+	 * inside that window would otherwise survive disposal, its claim retained
+	 * on a shared manager and interfering with later delivery teardown (Codex
+	 * review P2 on #5088).
+	 */
+	#drainTerminalOwnedYieldEntries(): void {
+		this.yieldQueue.clear((kind, entries) => {
+			if (kind !== "async-result") return;
+			const ownedManager = this.#ownedAsyncJobManager;
+			for (const entry of entries) {
+				if (typeof entry !== "object" || entry === null) continue;
+				const record = entry as { generation?: unknown; ownedCompletion?: unknown };
+				if (typeof record.generation === "string" && record.generation !== "") {
+					const envelope = isOwnedCompletionEnvelope(record.ownedCompletion) ? record.ownedCompletion : undefined;
+					const endpointId = envelope?.registration.endpointId;
+					const manager =
+						(endpointId !== undefined ? AsyncJobManager.forEndpoint(endpointId) : undefined) ?? ownedManager;
+					manager?.releaseDeliveryClaim(record.generation);
+				}
+				if (isOwnedCompletionEnvelope(record.ownedCompletion)) {
+					this.#settleOwnedCompletionEnvelope(record.ownedCompletion);
 				}
 			}
-		}
+		});
 	}
 
 	#getCustomMessageTextContent(message: Pick<CustomMessage, "content">): string {
@@ -12064,9 +13105,11 @@ export class AgentSession {
 			/** Internal dispatch disposition used before actual queue consumption. */
 			onDispatchDisposition?: (promotion: { startsOwnRun: boolean }) => void;
 			preflightSignal?: AbortSignal;
-			sdkRunToken?: string;
+			sdkRunCapability?: unknown;
 		},
 	): Promise<void> {
+		const sdkRunToken = readSdkRunCapability(options?.sdkRunCapability);
+		const internalOptions = options ? { ...options, ...(sdkRunToken ? { sdkRunToken } : {}) } : undefined;
 		this.#assertRecoveryHydrationPromoted();
 		const owner = this.#sessionAdmissionContext.getStore();
 		if (owner && !owner.released) throw this.#sessionAdmissionBusyError();
@@ -12087,7 +13130,15 @@ export class AgentSession {
 			const textParts: string[] = [];
 			images = [];
 			for (const part of content) {
+				if (!part || typeof part !== "object" || Array.isArray(part))
+					throw Object.assign(new Error("sendUserMessage content blocks must be objects."), {
+						code: "invalid_input",
+					});
 				if (part.type === "text") {
+					if (typeof part.text !== "string")
+						throw Object.assign(new Error("sendUserMessage text blocks must contain string text."), {
+							code: "invalid_input",
+						});
 					textParts.push(part.text);
 				} else {
 					images.push(part);
@@ -12096,6 +13147,10 @@ export class AgentSession {
 			text = textParts.join("\n");
 			if (images.length === 0) images = undefined;
 		}
+		const hasUsableImage =
+			images?.some(image => typeof image?.data === "string" && image.data.trim().length > 0) === true;
+		if (text.trim().length === 0 && !hasUsableImage)
+			throw Object.assign(new Error("Prompt must not be empty."), { code: "invalid_input" });
 
 		let admissionSignal = options?.preflightSignal
 			? AbortSignal.any([this.#promptPreflightAbortController.signal, options.preflightSignal])
@@ -12189,7 +13244,7 @@ export class AgentSession {
 					claimsGenuineUserIntent: true,
 					forceOneAtATime: Boolean(options?.preflightSignal || options?.queuedAtDispatch),
 					onPromoted: options?.onQueuedPromoted,
-					sdkRunToken: options?.sdkRunToken,
+					sdkRunToken: internalOptions?.sdkRunToken,
 				});
 				const cancelQueuedFollowUp = () => queuedFollowUp.cancel();
 				options?.preflightSignal?.addEventListener("abort", cancelQueuedFollowUp, { once: true });
@@ -12204,6 +13259,7 @@ export class AgentSession {
 					claimsGenuineUserIntent: true,
 					onPromoted: options?.onQueuedPromoted,
 					external: true,
+					sdkRunToken: internalOptions?.sdkRunToken,
 				});
 				options?.onPreflightAccepted?.();
 				return;
@@ -12223,6 +13279,7 @@ export class AgentSession {
 					claimsGenuineUserIntent: true,
 					onPromoted: options?.onQueuedPromoted,
 					external: true,
+					sdkRunToken: internalOptions?.sdkRunToken,
 				});
 				// Dispatch-race disposition (#4668 review P1): the SDK snapshot-decided
 				// this submission starts its own turn (idle at dispatch), but the
@@ -12248,7 +13305,7 @@ export class AgentSession {
 			await this.prompt(text, {
 				expandPromptTemplates: false,
 				images,
-				sdkRunToken: options?.sdkRunToken,
+				sdkRunToken: internalOptions?.sdkRunToken,
 				onPreflightAccepted: () => {
 					options?.onPreflightAccepted?.();
 					fireQueuedPromotion();
@@ -12263,7 +13320,7 @@ export class AgentSession {
 							}
 						: undefined,
 				preflightSignal: options?.preflightSignal,
-			});
+			} as InternalPromptOptions);
 		} finally {
 			releaseFollowUpReservation();
 		}
@@ -12772,6 +13829,7 @@ export class AgentSession {
 			| "tool_abort"
 			| "internal";
 		silent?: boolean;
+		sdkRunToken?: string;
 	}): void {
 		const abortGoalState = this.getGoalModeState();
 		this.#suppressNextGoalReminderAfterAbortGoalId =
@@ -12860,12 +13918,14 @@ export class AgentSession {
 			this.#promptPreflightCancellationGeneration++;
 			this.#promptPreflightAbortController.abort();
 			this.#promptPreflightAbortController = new AbortController();
+			this.#drainTerminalOwnedYieldEntries();
+			const overlappingPostPromptDrain = this.#cancelPostPromptTasks();
 			// Abort visibility is per-request: a later real abort must not inherit an
 			// earlier silent abort's suppression and swallow the user-visible notice.
 			if (options?.silent !== true) this.#silentAbortPending = false;
 			// Capture the unwind: the field clears once the first abort settles, and
 			// the awaits below must keep watching THIS unwind, not a successor's.
-			const sharedUnwind = this.#abortUnwind;
+			const sharedUnwind = Promise.all([this.#abortUnwind, overlappingPostPromptDrain]).then(() => {});
 			if (options?.timeoutMs !== undefined) {
 				const timeoutMs = Math.max(0, options.timeoutMs);
 				const deadline = Date.now() + timeoutMs;
@@ -12896,6 +13956,7 @@ export class AgentSession {
 		this.#abortUnwind = unwind.promise;
 		try {
 			this.#abortOptions(options);
+			this.#drainTerminalOwnedYieldEntries();
 			const postPromptDrain = this.#cancelPostPromptTasks();
 			const managedLogicalRunId =
 				this.#defaultFallbackChain().chain.entries.length > 1 ? this.agent.currentManagedLogicalRunId : undefined;
@@ -13473,6 +14534,9 @@ export class AgentSession {
 						attribution: "user" as const,
 						timestamp: Date.now(),
 					};
+					const selectedSdkRunToken = selectedMessage
+						? this.#sdkRunTokensByQueuedMessage.get(selectedMessage)
+						: undefined;
 					const messageText =
 						message.role === "custom"
 							? this.#getCustomMessageTextContent(message)
@@ -13491,6 +14555,7 @@ export class AgentSession {
 						await this.#promptWithMessage(message, messageText, {
 							admissionLease: admission,
 							resetRetryReplaySafety: true,
+							sdkRunToken: selectedSdkRunToken,
 							onRunAccepted: () => {
 								runAccepted = true;
 								if (selected) this.#fireQueuedPromotionHooks([message], { startsOwnRun: true });
@@ -18934,11 +19999,15 @@ export class AgentSession {
 	}
 
 	async #handleManagedAttemptOutcome(outcome: ManagedAttemptOutcome): Promise<ManagedAttemptDecision> {
+		const attemptAbortEpoch = this.#abortAdmissionEpoch;
+		const attemptCancelled = () =>
+			this.#isDisposed || this.#sessionAdmissionClosing || this.#abortAdmissionEpoch !== attemptAbortEpoch;
 		const activePromptHandle = this.activePromptHandle;
 		const cancellationSignal = activePromptHandle
 			? this.#runCancellationDomains.lookup(activePromptHandle)?.signal
 			: undefined;
-		if (cancellationSignal?.aborted) return { type: "terminal", terminal: { stopReason: "cancelled" } };
+		if (attemptCancelled() || cancellationSignal?.aborted)
+			return { type: "terminal", terminal: { stopReason: "cancelled" } };
 		if (outcome.type === "run_terminal") {
 			this.#defaultFallbackChain().resetAttemptBudget();
 			return { type: "terminal", terminal: { stopReason: outcome.reason } };
@@ -18974,7 +20043,6 @@ export class AgentSession {
 				const controllerStateBeforeFailure = controller.snapshotRuntimeState();
 				const advanced = controller.recordEscapedArgumentsFailure(errorMessage, false);
 				this.#escapedNonAsciiManagedRetries = 0;
-				const abortEpoch = this.#abortAdmissionEpoch;
 				if (advanced) {
 					const transitionGeneration = ++this.#fallbackTransitionGeneration;
 					return {
@@ -18995,7 +20063,9 @@ export class AgentSession {
 								!ownership.isCurrent() ||
 								ownership.lease.signal.aborted ||
 								cancellationSignal?.aborted ||
-								this.#abortAdmissionEpoch !== abortEpoch ||
+								this.#isDisposed ||
+								this.#sessionAdmissionClosing ||
+								this.#abortAdmissionEpoch !== attemptAbortEpoch ||
 								this.#fallbackTransitionGeneration !== transitionGeneration;
 							if (continuationCancelled) {
 								await restoreOwnedTransition();
@@ -19020,7 +20090,7 @@ export class AgentSession {
 								"escaped_non_ascii",
 								1,
 								cancellationSignal,
-								abortEpoch,
+								attemptAbortEpoch,
 								controllerStateBeforeFailure,
 								previousModel,
 								previousThinkingLevel,
@@ -19029,7 +20099,9 @@ export class AgentSession {
 							);
 							if (!switched) {
 								if (
-									this.#abortAdmissionEpoch !== abortEpoch ||
+									this.#isDisposed ||
+									this.#sessionAdmissionClosing ||
+									this.#abortAdmissionEpoch !== attemptAbortEpoch ||
 									cancellationSignal?.aborted ||
 									this.#fallbackTransitionGeneration !== transitionGeneration
 								) {
@@ -19049,13 +20121,27 @@ export class AgentSession {
 								});
 								return;
 							}
+							if (
+								attemptCancelled() ||
+								!ownership.isCurrent() ||
+								ownership.lease.signal.aborted ||
+								this.#fallbackTransitionGeneration !== transitionGeneration
+							) {
+								await restoreOwnedTransition();
+								return;
+							}
 							const continuation = this.agent.continue({
 								...this.#managedFallbackPromptOptions(),
 								transientRecoveryMessage: this.#escapedNonAsciiRecoveryMessage(),
+								onRunAccepted: (handle: AttemptRunHandle) => {
+									this.#acceptSdkAttemptRun(handle, this.#activeSdkRunToken);
+								},
 							});
 							if (
 								cancellationSignal?.aborted ||
-								this.#abortAdmissionEpoch !== abortEpoch ||
+								this.#isDisposed ||
+								this.#sessionAdmissionClosing ||
+								this.#abortAdmissionEpoch !== attemptAbortEpoch ||
 								this.#fallbackTransitionGeneration !== transitionGeneration
 							) {
 								await restoreOwnedTransition();
@@ -19074,7 +20160,7 @@ export class AgentSession {
 					};
 				}
 				controller.advance();
-				if (this.#abortAdmissionEpoch !== abortEpoch || cancellationSignal?.aborted)
+				if (attemptCancelled() || cancellationSignal?.aborted)
 					return { type: "terminal", terminal: { stopReason: "cancelled" } };
 				this.#defaultFallbackExhaustedLastTurn = true;
 				return this.#managedFallbackExhaustionDecision(
@@ -19086,10 +20172,13 @@ export class AgentSession {
 			return {
 				type: "retry",
 				continuation: async ownership => {
-					if (!ownership.isCurrent() || ownership.lease.signal.aborted) return;
+					if (attemptCancelled() || !ownership.isCurrent() || ownership.lease.signal.aborted) return;
 					await this.agent.continue({
 						...this.#managedFallbackPromptOptions(),
 						transientRecoveryMessage: this.#escapedNonAsciiRecoveryMessage(),
+						onRunAccepted: (handle: AttemptRunHandle) => {
+							this.#acceptSdkAttemptRun(handle, this.#activeSdkRunToken);
+						},
 					});
 				},
 			};
@@ -19102,7 +20191,7 @@ export class AgentSession {
 			return {
 				type: "maintenance",
 				continuation: async ownership => {
-					if (!ownership.isCurrent() || ownership.lease.signal.aborted) return;
+					if (attemptCancelled() || !ownership.isCurrent() || ownership.lease.signal.aborted) return;
 					const resourceRunId = String(ownership.logicalRunId);
 					const previousLease = this.#postPromptLeases.get(resourceRunId);
 					this.#postPromptLeases.set(resourceRunId, ownership.lease);
@@ -19121,7 +20210,13 @@ export class AgentSession {
 							resourceRunId,
 							ownership.lease.signal,
 						);
-						if (terminalized || successorScheduled || !ownership.isCurrent() || ownership.lease.signal.aborted)
+						if (
+							terminalized ||
+							successorScheduled ||
+							attemptCancelled() ||
+							!ownership.isCurrent() ||
+							ownership.lease.signal.aborted
+						)
 							return;
 						this.agent.requestRunTerminal(ownership.handle.logicalRunId, {
 							stopReason: "error",
@@ -19519,11 +20614,13 @@ export class AgentSession {
 			if (!isAuthenticated(activeApiKey)) return "unchanged";
 			remaining = await authStorage.invalidateCredentialMatching(provider, activeApiKey, {
 				sessionId: credentialSessionId,
+				owner: this.#modelRegistry.getAuthStorageOwner(),
 			});
 			if (!remaining) return "unchanged";
 		} else {
 			remaining = await authStorage.markUsageLimitReached(provider, credentialSessionId, {
 				retryAfterMs: trigger.retryAfterMs,
+				owner: this.#modelRegistry.getAuthStorageOwner(),
 			});
 		}
 
@@ -19562,6 +20659,9 @@ export class AgentSession {
 		scope?: AttemptScope,
 		scopeWasClean = this.#isRetryScopeClean(scope),
 	): Promise<boolean | ManagedAttemptDecision> {
+		const retryAbortEpoch = this.#abortAdmissionEpoch;
+		const retryCancelled = () =>
+			this.#isDisposed || this.#sessionAdmissionClosing || this.#abortAdmissionEpoch !== retryAbortEpoch;
 		const controller = this.#defaultFallbackChain();
 		const managedFallback = controller.chain.entries.length > 1;
 		const retrySettings = this.settings.getGroup("retry");
@@ -19573,6 +20673,9 @@ export class AgentSession {
 		const classification = this.#classifyErrorForRetry(message);
 		const localSnapshot = classification === "local_snapshot";
 		const localBufferOverflow = classification === "local_buffer_overflow";
+		if (retryCancelled()) {
+			return managedOutcome ? { type: "terminal", terminal: { stopReason: "cancelled" } } : false;
+		}
 		// A local machinery failure must never stay charged against the provider
 		// fallback budget, no matter which local exit follows (disabled retry,
 		// visible-content surface, bounded retry, exhaustion, or the immediate
@@ -19835,7 +20938,7 @@ export class AgentSession {
 				ownership?.domain.signal ??
 				(activePromptHandle ? this.#runCancellationDomains.lookup(activePromptHandle)?.signal : undefined);
 			if (ownership && (!ownership.isCurrent() || cancellationSignal?.aborted)) return;
-			const abortEpoch = this.#abortAdmissionEpoch;
+			if (retryCancelled()) return;
 			let quotaPoolExhausted = false;
 			if (managedFallback && !credentialRotated && !providerRetryCeilingReached) {
 				const mark = await this.#markFailedCredential(trigger);
@@ -19869,7 +20972,7 @@ export class AgentSession {
 						trigger.class,
 						attemptsUsed,
 						cancellationSignal,
-						abortEpoch,
+						retryAbortEpoch,
 						controllerStateBeforeAdvance,
 						previousModel,
 						previousThinkingLevel,
@@ -19879,7 +20982,7 @@ export class AgentSession {
 				}
 			}
 			if (ownership && (!ownership.isCurrent() || cancellationSignal?.aborted)) {
-				if (this.#abortAdmissionEpoch === abortEpoch) {
+				if (!retryCancelled()) {
 					await this.#restoreDefaultFallbackTransition(
 						controller,
 						controllerStateBeforeAdvance,
@@ -19889,7 +20992,7 @@ export class AgentSession {
 				}
 				return;
 			}
-			if (this.#abortAdmissionEpoch !== abortEpoch) {
+			if (retryCancelled()) {
 				controller.resetForNewTurn();
 				return;
 			}
@@ -20018,8 +21121,9 @@ export class AgentSession {
 
 			if (managedOutcome) {
 				try {
+					if (retryCancelled() || ownershipCancelled()) return;
 					await this.#checkEstimatedContextBeforePrompt();
-					if (ownershipCancelled()) {
+					if (retryCancelled() || ownershipCancelled()) {
 						const attempt = this.#retryAttempt;
 						this.#retryAttempt = 0;
 						await this.#emitSessionEvent({
@@ -20031,7 +21135,12 @@ export class AgentSession {
 						this.#resolveRetry();
 						return;
 					}
-					await this.agent.continue(this.#managedFallbackPromptOptions());
+					await this.agent.continue({
+						...this.#managedFallbackPromptOptions(),
+						onRunAccepted: (handle: AttemptRunHandle) => {
+							this.#acceptSdkAttemptRun(handle, this.#activeSdkRunToken);
+						},
+					});
 					return;
 				} catch (error) {
 					const attempt = this.#retryAttempt;
@@ -21068,6 +22177,9 @@ export class AgentSession {
 						model.provider,
 						this.#modelRegistry.authStorage,
 						this.credentialSessionId,
+						model,
+						// Optional for the same reason as the main metadata resolver above.
+						this.#modelRegistry.getAuthStorageOwner?.(),
 					),
 					reasoning: toReasoningEffort(this.thinkingLevel),
 					hideThinkingSummary: this.agent.hideThinkingSummary,