@gajae-code/coding-agent 0.17.2 → 0.17.4

package/src/sdk/bus/index.ts

@@ -50,7 +50,12 @@ type NotificationServer = NativeNotificationServer;
 import { $credentialEnv, logger, postmortem, VERSION } from "@gajae-code/utils";
 
 import { AsyncJobManager } from "../../async";
-import { Settings, validateSettingPatch } from "../../config/settings";
+import {
+	resolveSdkPromptDeadlineMs,
+	resolveSdkPromptMaxRuntimeMs,
+	Settings,
+	validateSettingPatch,
+} from "../../config/settings";
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from "../../extensibility/extensions";
 import { INTERACTIVE_SELECTOR_RESUME_ORIGIN } from "../../extensibility/shared-events";
 import { toAgentWireEventPayload } from "../../modes/shared/agent-wire/event-envelope";
@@ -62,6 +67,11 @@ import {
 } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { AgentSessionEvent } from "../../session/agent-session";
 import type { ClientBridge } from "../../session/client-bridge";
+import {
+	createSessionWorkLease,
+	type SessionWorkLease,
+	type SessionWorkLeaseHandle,
+} from "../../session/session-work-lease";
 import {
 	boundTerminalRetentionState,
 	findOwnedRegistrationsForTurn,
@@ -92,14 +102,14 @@ import { publishSessionHostRuntimeEvidence, type SessionHostRuntimePublication }
 import { processIncarnation } from "../broker/process-incarnation";
 import { resolveSessionLocator, SessionIndex, type SessionIndexEvent } from "../broker/session-index";
 import {
-	CAP_GATED_FRAME_KINDS,
+	canDeliverSdkEvent,
 	createSdkSurfaceFactory,
 	masterAttestationForEffectiveHost,
 	reattestMasterSessionIdentity,
+	SESSION_HOST_OBSERVER_CAPABILITY,
 	type SessionSdkHost,
 	SessionSdkSessionRuntime,
 	shouldHostSdk,
-	TOOL_ACTIVITY_CAPABILITY,
 	verifyMasterCapabilityFrame,
 } from "../host";
 import { type AbortScope, type ControlSurface, dispatchControl, TypedControlError } from "../host/control";
@@ -114,6 +124,7 @@ import {
 	syntheticModelInputError,
 	syntheticNamespaceCollision,
 } from "../model-profile-model";
+import { flushWorktreeOnPromptDeadline } from "../prompt-deadline-flush";
 import {
 	createPromptDeadlineLease,
 	isAttributableProgressEventType,
@@ -121,13 +132,21 @@ import {
 	promptDeadlineAt,
 	recordAttributableProgress,
 } from "../prompt-deadline-lease";
+import { runBoundedDeadlineFlush } from "../prompt-deadline-manager";
 import {
 	assistantFailureCode,
 	failedPromptOutcome,
 	formatPromptFailureForLocalLog,
+	PROMPT_FAILURE_MESSAGE_DEADLINE,
 	sanitizePromptFailure,
 } from "../prompt-failure";
 import { PROMPT_CLIENT_REF_MAX_LENGTH, type SdkPromptTerminalOutcome } from "../prompt-status";
+import {
+	IDLE_TOOL_BOUNDARY_RESULT,
+	TOOL_CALL_BOUNDARY_GRACE_MS,
+	type ToolBoundaryWaitResult,
+	waitForToolCallBoundary,
+} from "../prompt-tool-boundary";
 import { OPERATIONS } from "../protocol/operation-registry";
 import {
 	lifecycleStartupCapabilityForApi,
@@ -274,6 +293,20 @@ type PromptTerminalExtra = {
 	diagnosticAlreadyLogged?: boolean;
 };
 
+/**
+ * Diagnostic reason for a deadline terminal. The pre-#5637 string is preserved
+ * byte-identically whenever the abort landed at a tool boundary (or with no tool
+ * running); only a force-termination with tool calls still executing gets its
+ * own reason, so the "we killed a tool mid-flight" case stops being
+ * indistinguishable from a clean expiry. The failure code, provenance, category
+ * and message are untouched either way — downstream retry classification must
+ * not move.
+ */
+function promptDeadlineDiagnosticReason(boundary: ToolBoundaryWaitResult): string {
+	if (boundary.outcome !== "forced") return PROMPT_FAILURE_MESSAGE_DEADLINE;
+	return `${PROMPT_FAILURE_MESSAGE_DEADLINE} Forced after ${TOOL_CALL_BOUNDARY_GRACE_MS}ms with ${boundary.pendingToolCallIds.length} tool call(s) still executing.`;
+}
+
 function formatPromptTerminalFailureReason(reason: unknown): string {
 	let rawReason: string;
 	if (reason instanceof Error) rawReason = reason.message;
@@ -1266,6 +1299,17 @@ interface SessionRuntime {
 	serverStopped: boolean;
 	/** This runtime's own host-liveness publication; only its teardown may retract it. */
 	evidencePublication?: SessionHostRuntimePublication;
+	/** Authoritative lease held by admitted input, execution, and recovery work. */
+	workLease: SessionWorkLease;
+	/** Lease retained while an uncorrelated agent loop is active. */
+	activeWorkLease?: SessionWorkLeaseHandle;
+	/** Lease retained while an agent loop is paused awaiting resumption. */
+	pausedWorkLease?: SessionWorkLeaseHandle;
+	/**
+	 * Handles of queued submissions promoted to their own run, handed over at
+	 * the promotion boundary and retired by that run's agent_start.
+	 */
+	promotedWorkLeases: SessionWorkLeaseHandle[];
 	brokerRegistrationReleased: boolean;
 	verbosity: "lean" | "verbose";
 	/** Whether the agent loop is currently running (drives the typing indicator). */
@@ -2474,6 +2518,82 @@ function deepStructuralEqual(left: unknown, right: unknown): boolean {
 	);
 }
 
+/**
+ * Holds one session work lease handle for a dispatched submission from dispatch
+ * until the submission's own settlement boundary:
+ *
+ * - a queued message (steer, follow-up, or a prompt diverted into steering)
+ *   releases when it leaves the session queue: consumed inside the running turn
+ *   (`startsOwnRun: false`), removed (`removed: true`), or promoted to its own
+ *   run (`startsOwnRun: true`), where the handle is handed to the runtime and
+ *   released by that run's `agent_start`;
+ * - an inline prompt releases when its dispatch resolves, which is the end of
+ *   its run; the runtime's active-run handle and the accepted submission's
+ *   own handle cover the execution in between;
+ * - a failed or never-admitted dispatch releases immediately.
+ *
+ * Every transfer is bound to THIS message's hooks, never to queue position, so
+ * batched or reordered promotions cannot release a different submission's
+ * handle. A message that stays queued keeps its handle: it is admitted work
+ * the host must outlive, and only the session's own removal hook ends it.
+ */
+interface AdmissionWorkLease {
+	hooks: {
+		onQueuedPromoted: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
+		onDispatchDisposition: (promotion: { startsOwnRun: boolean }) => void;
+	};
+	/** The session admitted the message (a preflight hook fired). */
+	accepted(): void;
+	/** The dispatch resolves at queue time; the message waits for its promotion hook. */
+	queued(): void;
+	/** The dispatch resolved; releases unless the message is still queued. */
+	dispatched(): void;
+	/** The dispatch failed or was never admitted; nothing is queued. */
+	abandon(): void;
+}
+
+function createAdmissionWorkLease(
+	lease: SessionWorkLease | undefined,
+	queuedAtDispatch: boolean,
+	promote: ((handle: SessionWorkLeaseHandle) => void) | undefined,
+): AdmissionWorkLease {
+	let handle = lease?.acquire();
+	let accepted = false;
+	let queued = queuedAtDispatch;
+	const release = (): void => {
+		handle?.release();
+		handle = undefined;
+	};
+	return {
+		hooks: {
+			onQueuedPromoted: promotion => {
+				const current = handle;
+				if (!current) return;
+				handle = undefined;
+				if (promotion.removed || promotion.startsOwnRun !== true || !promote) current.release();
+				else promote(current);
+			},
+			onDispatchDisposition: promotion => {
+				// The dispatch resolved at queue time, not at run end: the message sits
+				// in the steering queue until its promotion hook fires.
+				if (promotion.startsOwnRun === false) queued = true;
+			},
+		},
+		accepted: () => {
+			accepted = true;
+		},
+		queued: () => {
+			queued = true;
+		},
+		dispatched: () => {
+			// The session send contract invokes a preflight hook before resolving;
+			// an adapter that resolves without admitting anything queued no work.
+			if (!accepted || !queued) release();
+		},
+		abandon: release,
+	};
+}
+
 function sdkControlSurface(
 	ctx: ExtensionContext,
 	pendingInteractive: Map<string, PendingInteractiveAsk>,
@@ -2567,6 +2687,10 @@ function sdkControlSurface(
 	// executions and post-response publications) so session teardown can join
 	// them before reporting durable quiescence.
 	trackReconciliationProducer?: (producer: Promise<unknown>) => void,
+	sessionWorkLease?: SessionWorkLease,
+	// Hands a queued submission's lease handle to the runtime when that
+	// submission is promoted to its own run; the run's agent_start adopts it.
+	promoteWorkLease?: (handle: SessionWorkLeaseHandle) => void,
 ): ControlSurface & {
 	cancelPendingPreflights(): Promise<void>;
 	cancelPendingPreflightsForConnection(connectionId: string): Promise<void>;
@@ -2574,6 +2698,7 @@ function sdkControlSurface(
 	const unavailable = (operation: string, reason: string) => () => {
 		throw Object.assign(new Error(`${operation} is unavailable: ${reason}`), { code: "unavailable" });
 	};
+	const hostWorkLease = sessionWorkLease ?? ctx.getSessionWorkLease?.();
 	const bindings = new Set(ctx.sdkBindings?.() ?? []);
 	const surfacePolicy = createSdkSurfaceFactory({
 		ctx,
@@ -2611,23 +2736,58 @@ function sdkControlSurface(
 		return "unknown";
 	};
 	const sendSteer = async (text: string, clientRef?: string) => {
+		// A steer is always queued: its handle is held from dispatch until the
+		// message leaves the session queue (consumed in-run, promoted to its own
+		// run, or removed), which is the only boundary bound to THIS message.
+		const admission = createAdmissionWorkLease(hostWorkLease, true, promoteWorkLease);
+		const sendOptions = {
+			deliverAs: "steer" as const,
+			onPreflightAcceptCommit: admission.accepted,
+			onPreflightAccepted: admission.accepted,
+			...admission.hooks,
+		};
 		if (clientRef === undefined) {
 			const correlation = { commandId: crypto.randomUUID(), turnId: crypto.randomUUID() };
-			await api.sendUserMessage(text, { deliverAs: "steer" });
+			try {
+				await api.sendUserMessage(text, sendOptions);
+				admission.dispatched();
+			} catch (error) {
+				admission.abandon();
+				throw error;
+			}
 			return { ...correlation, accepted: true };
 		}
 		const normalizedClientRef = clientRef.trim();
-		if (!skillRecon?.reserveSteer || !skillRecon.settleSteer)
+		if (!skillRecon?.reserveSteer || !skillRecon.settleSteer) {
+			admission.abandon();
 			throw Object.assign(new Error("Steer reconciliation is unavailable."), { code: "unavailable" });
-		const reservation = await skillRecon.reserveSteer(normalizedClientRef, text);
-		if (reservation.replay) return { sessionId: ctx.sessionManager.getSessionId(), ...reservation.result };
+		}
+		let reservation: Awaited<ReturnType<NonNullable<typeof skillRecon.reserveSteer>>>;
 		try {
-			await api.sendUserMessage(text, { deliverAs: "steer" });
+			reservation = await skillRecon.reserveSteer(normalizedClientRef, text);
+		} catch (error) {
+			admission.abandon();
+			throw error;
+		}
+		if (reservation.replay) {
+			admission.abandon();
+			return { sessionId: ctx.sessionManager.getSessionId(), ...reservation.result };
+		}
+		let dispatched = false;
+		try {
+			await api.sendUserMessage(text, sendOptions);
+			dispatched = true;
+			admission.dispatched();
 			return {
 				sessionId: ctx.sessionManager.getSessionId(),
 				...(await skillRecon.settleSteer(normalizedClientRef, "accepted")),
 			};
 		} catch (error) {
+			// Only a failed dispatch leaves no queued message behind. When the
+			// dispatch resolved and the durable settlement failed afterwards, the
+			// steer is still queued in the session, so its handle stays held until
+			// the promotion or removal hook fires.
+			if (!dispatched) admission.abandon();
 			return {
 				sessionId: ctx.sessionManager.getSessionId(),
 				...(await skillRecon.settleSteer(normalizedClientRef, "rejected", error)),
@@ -2735,17 +2895,28 @@ function sdkControlSurface(
 			throw Object.assign(new Error("clientRef must be a non-empty string of at most 128 characters."), {
 				code: "invalid_input",
 			});
+		// An explicit steer/follow-up is queued and settles at its promotion
+		// boundary; a fresh prompt settles when its run resolves. A plain prompt
+		// that finds the loop busy at dispatch is queued as steering (below), and
+		// one the session itself diverts reports that through onDispatchDisposition.
+		const admission = createAdmissionWorkLease(hostWorkLease, deliverAs !== undefined, promoteWorkLease);
 		if (trackReconciliation) {
 			// Restart recovery must be committed before a tracked prompt reserves capacity,
 			// otherwise it can admit against pre-hydration state or a lost clientRef.
 			try {
 				await awaitReconciliationReady();
 			} catch {
+				admission.abandon();
 				throw Object.assign(new Error("Prompt reconciliation state is unavailable; retry after restart."), {
 					code: "unavailable",
 				});
 			}
-			admitPrompt(trimmedClientRef);
+			try {
+				admitPrompt(trimmedClientRef);
+			} catch (error) {
+				admission.abandon();
+				throw error;
+			}
 		}
 		try {
 			if (forceFresh && isSessionBusy()) {
@@ -2764,6 +2935,7 @@ function sdkControlSurface(
 					},
 				);
 		} catch (error) {
+			admission.abandon();
 			if (trackReconciliation) releasePromptAdmission(trimmedClientRef);
 			throw error;
 		}
@@ -2833,12 +3005,14 @@ function sdkControlSurface(
 				);
 			} catch (error) {
 				accepting = false;
+				admission.abandon();
 				// Durable acceptance failed, so the prompt was never accepted: reject the
 				// control preflight and rethrow so the awaiting session does not execute it.
 				onPromptAcceptFailed(correlation);
 				settlePreflight({ status: "rejected", error });
 				throw error;
 			}
+			admission.accepted();
 			accepting = false;
 			accepted = true;
 			// #4743: an accepted run owns a durable terminal publication when it
@@ -2858,18 +3032,22 @@ function sdkControlSurface(
 		};
 		// Do not acknowledge the prompt until AgentSession's async preflight
 		// succeeds. The terminal result records correlation before agent_start can fire.
+		const effectiveDeliverAs = deliverAs ?? (!forceFresh && isBusy() ? ("steer" as const) : undefined);
+		if (effectiveDeliverAs !== undefined) admission.queued();
 		try {
 			submission = Promise.resolve(
 				api.sendUserMessage(content, {
-					...(deliverAs ? { deliverAs } : !forceFresh && isBusy() ? { deliverAs: "steer" as const } : {}),
+					...(effectiveDeliverAs ? { deliverAs: effectiveDeliverAs } : {}),
 					onPreflightAcceptCommit,
 					onPreflightAccepted,
+					...admission.hooks,
 					preflightSignal: preflightController.signal,
 					...(sdkRunToken ? { sdkRunToken } : {}),
 				}),
 			);
 		} catch (error) {
 			submissionSettled.resolve();
+			admission.abandon();
 			if (accepted && !preflightController.signal.aborted)
 				trackReconciliationProducer?.(Promise.resolve(onPromptFailed(correlation, error)));
 			else settlePreflight({ status: "rejected", error });
@@ -2880,6 +3058,7 @@ function sdkControlSurface(
 			// joined — only its reconciliation publications are tracked below.
 			void submission.then(
 				() => {
+					admission.dispatched();
 					if (!accepted)
 						settlePreflight({
 							status: "rejected",
@@ -2890,6 +3069,7 @@ function sdkControlSurface(
 					submissionSettled.resolve();
 				},
 				error => {
+					admission.abandon();
 					if (accepted && !preflightController.signal.aborted)
 						trackReconciliationProducer?.(Promise.resolve(onPromptFailed(correlation, error)));
 					else settlePreflight({ status: "rejected", error });
@@ -2902,6 +3082,7 @@ function sdkControlSurface(
 			if (result.status === "rejected") throw result.error;
 			return { commandId, turnId, accepted: true, ...(trimmedClientRef ? { clientRef: trimmedClientRef } : {}) };
 		} catch (error) {
+			admission.abandon();
 			if (trackReconciliation) releasePromptAdmission(trimmedClientRef);
 			throw error;
 		} finally {
@@ -3425,7 +3606,15 @@ function sdkControlSurface(
 							...(typeof result === "object" && result ? (result as object) : {}),
 							...(trimmedClientRef ? { clientRef: trimmedClientRef } : {}),
 						});
-					} else if (durableSkillAccepted && skillRecon) {
+					} else if (durableSkillAccepted && skillRecon && !promptOwned) {
+						// A lifecycle-owned skill (requester connection present, submission
+						// registered by onPromptAccepted) is terminalized solely by the
+						// correlated agent_end handler (terminalizePrompt -> claim ->
+						// finalize with the final text). This promise-settlement transition
+						// carries no text and would pre-empt that finalization, dropping the
+						// durable content; it remains only for ownerless acceptance, where
+						// no lifecycle handler will ever fire — and there it is the sole
+						// terminal publication, so it must carry the returned text itself.
 						trackReconciliationProducer?.(
 							skillRecon.noteTransition(correlation, {
 								type: "agent_end",
@@ -4096,6 +4285,13 @@ export function createNotificationsExtension(
 				handle: string,
 				options: { graceMs: number; terminal?: { scope: "turn" | "owned"; expectedEpoch?: number } },
 			) => Promise<RunSettlementProof>;
+			/**
+			 * Live, SYNCHRONOUS view of the dispatched tool calls the run resource
+			 * ledger holds for an execution handle (#5637). Strictly read-only: it
+			 * never claims, seals or otherwise mutates ledger state. Optional so an
+			 * older host that does not thread it degrades to the event-derived set.
+			 */
+			pendingToolExecutions?: (handle: string) => readonly string[];
 		};
 	} = {},
 ): void {
@@ -4323,6 +4519,37 @@ export function createNotificationsExtension(
 		"session.branch",
 	]);
 	const sessionId = (ctx: ExtensionContext): string => ctx.sessionManager.getSessionId();
+	const releaseActiveWorkLease = (rt: SessionRuntime): void => {
+		rt.activeWorkLease?.release();
+		rt.activeWorkLease = undefined;
+	};
+	const releasePausedWorkLease = (rt: SessionRuntime): void => {
+		rt.pausedWorkLease?.release();
+		rt.pausedWorkLease = undefined;
+	};
+	const releasePromotedWorkLeases = (rt: SessionRuntime): void => {
+		for (const handle of rt.promotedWorkLeases.splice(0)) handle.release();
+	};
+	const beginAgentWork = (rt: SessionRuntime): void => {
+		releasePausedWorkLease(rt);
+		// Acquire the run's handle before retiring the promoted ones so the lease
+		// never reads as released between a queued submission and its run.
+		if (!rt.activeWorkLease) rt.activeWorkLease = rt.workLease.acquire();
+		// Every submission promoted into this run handed its handle over at the
+		// promotion boundary; the run's own handle covers them from here.
+		releasePromotedWorkLeases(rt);
+	};
+	const finishAgentWork = (rt: SessionRuntime, paused: boolean): void => {
+		if (paused) {
+			if (!rt.pausedWorkLease) rt.pausedWorkLease = rt.activeWorkLease ?? rt.workLease.acquire();
+			rt.activeWorkLease = undefined;
+			return;
+		}
+		// A run that failed before its agent_start still reaches agent_end; the
+		// handles promoted into it have no later agent_start to retire them.
+		if (!rt.activeWorkLease) releasePromotedWorkLeases(rt);
+		releaseActiveWorkLease(rt);
+	};
 
 	async function stopSession(
 		id: string,
@@ -4466,6 +4693,9 @@ export function createNotificationsExtension(
 				// runs while an identity successor is already serving, and clearing
 				// that live runtime's reader would manufacture "no evidence" for a
 				// host whose clients are still attached.
+				releaseActiveWorkLease(rt);
+				releasePausedWorkLease(rt);
+				releasePromotedWorkLeases(rt);
 				rt.evidencePublication?.retract();
 				rt.evidencePublication = undefined;
 			} catch (e) {
@@ -4603,7 +4833,25 @@ export function createNotificationsExtension(
 		const pendingInteractive = new Map<string, PendingInteractiveAsk>();
 		const pendingPromptCorrelations: Array<{ commandId: string; turnId: string }> = [];
 		const pendingPromptCorrelationsBySdkRunToken = new Map<string, { commandId: string; turnId: string }>();
+		const workLease = ctx.getSessionWorkLease?.() ?? createSessionWorkLease();
 		let runtime: SessionRuntime | undefined;
+		// A promoted submission's handle must either enter the runtime-owned list
+		// before teardown fences it, or be released immediately: stopSession drains
+		// the list after fencing, and a predecessor runtime that already stopped
+		// (mid session_switch) would otherwise hold the handle forever.
+		const promoteWorkLease = (handle: SessionWorkLeaseHandle): void => {
+			const currentRuntime = runtime;
+			if (
+				!currentRuntime ||
+				currentRuntime.stopping ||
+				currentRuntime.serverStopped ||
+				runtimes.get(id) !== currentRuntime
+			) {
+				handle.release();
+				return;
+			}
+			currentRuntime.promotedWorkLeases.push(handle);
+		};
 
 		// The SDK can always answer now (interactive via the answer source, or the
 		// workflow gate), so the endpoint advertises a resolver. Validate the native
@@ -4750,12 +4998,55 @@ export function createNotificationsExtension(
 			}
 		};
 
-		const hostCapCache = new Map<string, ReadonlySet<string>>();
+		type HostConnectionIncarnation = { generation: number; closed: boolean };
+		type HostCapabilityCacheEntry = { generation: number; capabilities: ReadonlySet<string> };
+		const hostCapCache = new Map<string, HostCapabilityCacheEntry>();
+		const hostConnectionIncarnations = new Map<string, HostConnectionIncarnation>();
+		const hostAttachedConnections = new Set<string>();
+		let nextHostConnectionGeneration = 0;
+		const liveHostConnection = (connectionId: string): HostConnectionIncarnation | undefined => {
+			if (!connectionId) return undefined;
+			const current = hostConnectionIncarnations.get(connectionId);
+			if (current?.closed) return undefined;
+			if (current) return current;
+			const incarnation = { generation: ++nextHostConnectionGeneration, closed: false };
+			hostConnectionIncarnations.set(connectionId, incarnation);
+			return incarnation;
+		};
+		const rememberHostCapabilities = (connectionId: string, capabilities: readonly string[]): void => {
+			const incarnation = liveHostConnection(connectionId);
+			if (!incarnation) return;
+			hostCapCache.set(connectionId, {
+				generation: incarnation.generation,
+				capabilities: new Set(capabilities),
+			});
+		};
+		const liveHostCapabilities = (connectionId: string): ReadonlySet<string> | undefined => {
+			const incarnation = hostConnectionIncarnations.get(connectionId);
+			const entry = hostCapCache.get(connectionId);
+			return incarnation && !incarnation.closed && entry?.generation === incarnation.generation
+				? entry.capabilities
+				: undefined;
+		};
+		const closeHostConnection = (connectionId: string): void => {
+			const current = hostConnectionIncarnations.get(connectionId);
+			if (current) current.closed = true;
+			else {
+				hostConnectionIncarnations.set(connectionId, {
+					generation: ++nextHostConnectionGeneration,
+					closed: true,
+				});
+			}
+			hostCapCache.delete(connectionId);
+			hostAttachedConnections.delete(connectionId);
+		};
 
 		const configOverrides = new Map<string, unknown>();
 		const configRevision = { current: 0 };
 		const PROMPT_SUBMISSION_CAPACITY = 128;
 		const PROMPT_SUBMISSION_TTL_MS = 5 * 60_000;
+		/** Bound on remembered `tool_execution_end`s that outran their own start. */
+		const UNMATCHED_TOOL_END_CAPACITY = 64;
 		const PROMPT_TERMINAL_TOMBSTONE_CAPACITY = 256;
 		const PROMPT_TERMINAL_TOMBSTONE_TTL_MS = 15 * 60_000;
 		// SDK-owned terminalization grace; injectable in tests, never a user setting.
@@ -4816,14 +5107,40 @@ export function createNotificationsExtension(
 				 */
 				selfAbortStarted?: true;
 			};
+			/**
+			 * A due deadline expiry is already awaiting the tool-call boundary for
+			 * this submission. Progress that cannot renew past an already-due hard
+			 * cap re-arms a zero-delay timer on every delivery; without this fence
+			 * each one would open ANOTHER grace wait and they would pile up through
+			 * the whole grace (review thread P2).
+			 */
+			deadlineExpiryInFlight?: boolean;
 			phase: "active" | "outcome_claimed" | "terminalizing" | "publication_closed" | "delivered";
 			outcome?: SdkPromptTerminalOutcome;
 			/** Agent-owned resource run captured at acceptance; cleanup targets only this handle. */
 			executionHandle?: string;
 			/** Cancels accepted skill preparation before an execution handle exists. */
 			preflightAbort?: () => void | Promise<void>;
+			/** Keeps the host alive from durable admission through terminal publication. */
+			workLease?: SessionWorkLeaseHandle;
 			reconciliationKind: ReconciliationKind;
 			bufferedFrames: Array<PromptLifecycleFrame | Record<string, unknown>>;
+			/**
+			 * Dispatched tool calls currently executing for this correlation. A SET of
+			 * ids, not a counter: a duplicate or unmatched `tool_execution_end` must
+			 * not drive it negative and falsely report the prompt idle (#5637).
+			 */
+			runningToolCallIds: Set<string>;
+			/**
+			 * Ids whose `tool_execution_end` was delivered with no matching start yet.
+			 * The fanout is asynchronous and unordered across listeners, so the end of
+			 * a finished call can land first; without this the late start would add a
+			 * call that is already over and leave it running forever. Bounded, and
+			 * only ever written on that out-of-order path.
+			 */
+			endedToolCallIds: Set<string>;
+			/** Drained when `runningToolCallIds` becomes empty; one entry per waiting expiry attempt. */
+			toolIdleWaiters: Array<() => void>;
 		};
 		const promptSubmissions = new Map<string, PromptSubmission>();
 		/** Connections fenced by a fatal prompt closure; their later frames are refused. */
@@ -4841,15 +5158,17 @@ export function createNotificationsExtension(
 		 * ordinary direct SDK subscribers retain both public surfaces from #4570.
 		 */
 		const broadcastEventFrame = (event: SdkFrame): string[] => {
-			const gated = CAP_GATED_FRAME_KINDS.has(String(event.kind));
 			const json = JSON.stringify(event);
 			const recipients: string[] = [];
-			for (const [connectionId, capabilities] of hostCapCache) {
+			for (const connectionId of hostAttachedConnections) {
+				const incarnation = hostConnectionIncarnations.get(connectionId);
+				if (!incarnation || incarnation.closed) continue;
+				const capabilities = liveHostCapabilities(connectionId);
 				if (fencedConnections.has(connectionId)) continue;
-				if (gated && !capabilities.has(TOOL_ACTIVITY_CAPABILITY)) continue;
+				if (!canDeliverSdkEvent(String(event.kind), capabilities)) continue;
 				try {
 					server.sendTo(connectionId, json);
-					if (capabilities.has(POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY)) recipients.push(connectionId);
+					if (capabilities?.has(POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY)) recipients.push(connectionId);
 				} catch {
 					// Broadcasts are best effort; directed responses surface send failures.
 				}
@@ -4857,15 +5176,17 @@ export function createNotificationsExtension(
 			return recipients;
 		};
 		const broadcastEventFrameWithReceipts = (event: SdkFrame): string[] => {
-			const gated = CAP_GATED_FRAME_KINDS.has(String(event.kind));
 			const json = JSON.stringify(event);
 			const receipts: string[] = [];
-			for (const [connectionId, capabilities] of hostCapCache) {
+			for (const connectionId of hostAttachedConnections) {
+				const incarnation = hostConnectionIncarnations.get(connectionId);
+				if (!incarnation || incarnation.closed) continue;
+				const capabilities = liveHostCapabilities(connectionId);
 				if (fencedConnections.has(connectionId)) continue;
-				if (gated && !capabilities.has(TOOL_ACTIVITY_CAPABILITY)) continue;
+				if (!canDeliverSdkEvent(String(event.kind), capabilities)) continue;
 				try {
 					const receipt = server.sendToWithReceipt(connectionId, json);
-					if (capabilities.has(POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY)) receipts.push(receipt);
+					if (capabilities?.has(POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY)) receipts.push(receipt);
 				} catch {
 					// Rejected positioned sends remain eligible for the atomic raw fallback.
 				}
@@ -4949,6 +5270,7 @@ export function createNotificationsExtension(
 					pendingPromptCorrelationsBySdkRunToken.delete(sdkRunToken);
 			}
 		};
+
 		const addTerminalTombstone = (key: string, connectionId: string, now = Date.now()) => {
 			promptTerminalTombstones.delete(key);
 			promptTerminalTombstones.set(key, { connectionId, expiresAt: now + PROMPT_TERMINAL_TOMBSTONE_TTL_MS });
@@ -4958,6 +5280,10 @@ export function createNotificationsExtension(
 		const finalizePrompt = (key: string, correlation: { commandId: string; turnId: string }) => {
 			const submission = promptSubmissions.get(key);
 			if (submission?.deadlineTimer) clearTimeout(submission.deadlineTimer);
+			if (submission?.workLease) {
+				submission.workLease.release();
+				submission.workLease = undefined;
+			}
 			promptSubmissions.delete(key);
 			removePendingPromptCorrelation(correlation);
 			if (submission) addTerminalTombstone(key, submission.connectionId);
@@ -4965,6 +5291,10 @@ export function createNotificationsExtension(
 		const expirePromptDelivery = (key: string, submission: PromptSubmission) => {
 			if (!submission.terminal) return;
 			if (submission.deadlineTimer) clearTimeout(submission.deadlineTimer);
+			if (submission.workLease) {
+				submission.workLease.release();
+				submission.workLease = undefined;
+			}
 			promptSubmissions.delete(key);
 			// A fatal closure is transport-level, not a committed semantic terminal: the
 			// durable record stays authoritative, so it must never leave a tombstone.
@@ -5030,10 +5360,6 @@ export function createNotificationsExtension(
 				finalizePrompt(key, correlation);
 			}
 		};
-		const readFiniteSetting = (key: "sdk.promptDeadlineMs" | "sdk.promptMaxRuntimeMs", fallback: number): number => {
-			const value = settings?.get(key);
-			return typeof value === "number" && Number.isFinite(value) ? value : fallback;
-		};
 		/**
 		 * (Re)arm the accepted prompt's terminal deadline from its current lease.
 		 * `terminalizePrompt` stays the single authoritative terminal owner; this
@@ -5046,33 +5372,104 @@ export function createNotificationsExtension(
 			if (submission.deadlineTimer) clearTimeout(submission.deadlineTimer);
 			submission.deadlineTimer = setTimeout(
 				() => {
-					const current = promptSubmissions.get(key);
-					// Identity fencing: a discarded, evicted or re-accepted submission is
-					// never terminalized by a predecessor's timer.
-					if (!current || current.deadlineLease !== lease) return;
-					// Progress delivered while this timer was pending renews the lease, so
-					// re-arm instead of terminalizing a demonstrably live prompt.
-					if (Date.now() < promptDeadlineAt(lease)) {
-						armPromptDeadline(key, correlation);
-						return;
-					}
-					// Register the expiry attempt BEFORE the awaited durable claim:
-					// progress arriving while the claim is in flight must supersede
-					// this attempt (see the post-claim fence in terminalizePrompt).
-					current.deadlineAttempt = { lease, generation: lease.generation };
-					void terminalizePrompt(
-						correlation,
-						{
-							kind: "failed",
-							code: "prompt_deadline_exceeded",
-							message: "Prompt deadline exceeded.",
-							provenance: "deadline",
-							phase: "submission",
-							category: "deadline",
-						},
-						{ fence: true },
-						{ diagnostic: { reason: "Prompt deadline exceeded." } },
-					);
+					void (async () => {
+						const current = promptSubmissions.get(key);
+						// Identity fencing: a discarded, evicted or re-accepted submission is
+						// never terminalized by a predecessor's timer.
+						if (!current || current.deadlineLease !== lease) return;
+						// Progress delivered while this timer was pending renews the lease, so
+						// re-arm instead of terminalizing a demonstrably live prompt.
+						if (Date.now() < promptDeadlineAt(lease)) {
+							armPromptDeadline(key, correlation);
+							return;
+						}
+						// Nothing to terminalize behind the terminal owner — and nothing to
+						// wait for on its behalf either. `terminalizePrompt` refuses this
+						// state anyway; checking it here keeps a superseded timer from
+						// opening a boundary wait it can never use.
+						if (current.terminal || current.phase !== "active") return;
+						// One boundary wait per submission (review thread P2). At an already
+						// due HARD CAP `promptDeadlineAt` is pinned to `acceptedAt + maxMs`,
+						// so every streamed `tool_execution_update` — attributable progress
+						// by design, so a multi-minute compile does not trip the inactivity
+						// lease — re-arms a ZERO-delay timer that walks straight past the
+						// re-arm check above. `deadlineAttempt` cannot serve as the fence: it
+						// is registered only AFTER the wait, precisely so the boundary event
+						// that ends the wait is not read as superseding it.
+						if (current.deadlineExpiryInFlight) return;
+						current.deadlineExpiryInFlight = true;
+						try {
+							// Let an in-flight dispatched tool call reach its boundary first
+							// (#5637): terminal fencing aborts the run before it waits for
+							// settlement, so a tool aborted mid-write leaves a torn artifact.
+							// The wait sits BEFORE the attempt is registered on purpose — inside
+							// `terminalizePrompt` the very `tool_execution_end` that ends the
+							// wait would bump the lease generation and the post-claim fence
+							// would read this attempt as "superseded", so the deadline would
+							// effectively never fire while tools run. Here the existing
+							// renewal/re-arm logic handles that case unchanged. Nothing has been
+							// aborted yet, so this wait is composed with NO abort signal: an
+							// already-aborted one would make the path unreachable.
+							const boundary: ToolBoundaryWaitResult =
+								pendingToolCallIdsFor(current).length === 0
+									? IDLE_TOOL_BOUNDARY_RESULT
+									: await waitForToolCallBoundary({
+											pending: () => pendingToolCallIdsFor(current),
+											whenIdle: () => whenPromptToolsIdle(current),
+											graceMs: TOOL_CALL_BOUNDARY_GRACE_MS,
+										});
+							// Every pre-await fence is re-validated after the await, in order.
+							const after = promptSubmissions.get(key);
+							if (!after || after.deadlineLease !== lease) return;
+							if (after.terminal || after.phase !== "active") return;
+							if (Date.now() < promptDeadlineAt(lease)) {
+								// The boundary event renewed the lease: the prompt is demonstrably
+								// alive, so re-arm instead of terminalizing it.
+								armPromptDeadline(key, correlation);
+								return;
+							}
+							if (boundary.outcome === "forced") {
+								// Ids only: never tool arguments, output, paths or anything
+								// credential-shaped.
+								logger.warn("sdk_prompt_deadline_forced_mid_tool", {
+									commandId: correlation.commandId,
+									turnId: correlation.turnId,
+									graceMs: TOOL_CALL_BOUNDARY_GRACE_MS,
+									pendingToolCallIds: boundary.pendingToolCallIds,
+								});
+							}
+							// Register the expiry attempt BEFORE the awaited durable claim:
+							// progress arriving while the claim is in flight must supersede
+							// this attempt (see the post-claim fence in terminalizePrompt).
+							// The generation is read AFTER the boundary wait because the
+							// boundary event may have bumped it and this attempt is
+							// deliberately the current one.
+							after.deadlineAttempt = { lease, generation: lease.generation };
+							void terminalizePrompt(
+								correlation,
+								{
+									kind: "failed",
+									code: "prompt_deadline_exceeded",
+									message: "Prompt deadline exceeded.",
+									provenance: "deadline",
+									phase: "submission",
+									category: "deadline",
+								},
+								{ fence: true },
+								{ diagnostic: { reason: promptDeadlineDiagnosticReason(boundary) } },
+							);
+						} finally {
+							// `finally` is safe here, and a bare clear before each `return` is
+							// not: a leaked `true` disables the deadline for the rest of the
+							// submission's life, which is strictly worse than the pile-up it
+							// guards. It can only ever clear the flag THIS attempt set on THIS
+							// object — a competing attempt would have returned at the guard
+							// above without setting it — and an attempt that threw is no longer
+							// waiting, so re-admitting the next one is correct. The wait itself
+							// is bounded by the grace, so this always runs.
+							current.deadlineExpiryInFlight = false;
+						}
+					})();
 				},
 				Math.max(0, promptDeadlineAt(lease) - Date.now()),
 			);
@@ -5083,6 +5480,7 @@ export function createNotificationsExtension(
 			const correlation = runtime.activePromptCorrelation;
 			// Renewal is attributed exactly like the correlated delivery below.
 			renewPromptDeadline(correlation, event);
+			noteToolDispatchBoundary(correlation, event);
 			const submission = promptSubmissions.get(promptSubmissionKey(correlation));
 			if (!submission || submission.abandoned) return;
 			const frame = {
@@ -5169,6 +5567,99 @@ export function createNotificationsExtension(
 			if (submission.deadlineLease.generation === generation) return;
 			armPromptDeadline(key, correlation);
 		};
+		/**
+		 * Track which dispatched tool calls are executing for the accepted prompt,
+		 * so an expired deadline can abort at a tool boundary instead of mid-write
+		 * (#5637). Attribution is deliberately identical to `renewPromptDeadline`'s
+		 * — same funnel, same allowlist, same pairing-only exclusion — because a
+		 * call that cannot prove progress cannot prove it is running either.
+		 * `tool_execution_update` proves neither start nor end, so it never changes
+		 * membership.
+		 */
+		const noteToolDispatchBoundary = (
+			correlation: { commandId: string; turnId: string },
+			event: { type: string; toolCallId?: unknown },
+		) => {
+			if (event.type !== "tool_execution_start" && event.type !== "tool_execution_end") return;
+			if (isNonDispatchedToolEvent(event) || typeof event.toolCallId !== "string") return;
+			const submission = promptSubmissions.get(promptSubmissionKey(correlation));
+			if (!submission) return;
+			if (event.type === "tool_execution_start") {
+				// A start whose own end already arrived describes a call that is over:
+				// re-adding it would strand an id that can never be removed again, and
+				// the deadline would then burn the whole grace and report a forced
+				// mid-tool kill for a tool that is not running (review thread P1,
+				// mirror case). The id is consumed, so the pair closes exactly once.
+				if (submission.endedToolCallIds.delete(event.toolCallId)) return;
+				submission.runningToolCallIds.add(event.toolCallId);
+				return;
+			}
+			if (!submission.runningToolCallIds.delete(event.toolCallId)) {
+				// End with no known start: remember it only for this out-of-order case.
+				submission.endedToolCallIds.add(event.toolCallId);
+				// Oldest-first eviction; a Set iterates in insertion order.
+				while (submission.endedToolCallIds.size > UNMATCHED_TOOL_END_CAPACITY) {
+					const oldest = submission.endedToolCallIds.values().next().value;
+					if (oldest === undefined) break;
+					submission.endedToolCallIds.delete(oldest);
+				}
+				return;
+			}
+			if (submission.runningToolCallIds.size > 0) return;
+			for (const resolve of submission.toolIdleWaiters.splice(0)) resolve();
+		};
+		/**
+		 * Authoritative set of tool calls executing for this submission (#5637).
+		 *
+		 * The run resource ledger is the source of truth, not the extension fanout.
+		 * AgentLoop reserves a `kind: "tool"` lease SYNCHRONOUSLY inside its
+		 * dispatch loop, before the tool's `execute` is invoked, and the lease
+		 * settles at the call's real end. `tool_execution_start` instead travels an
+		 * ASYNCHRONOUS path — enqueued on the agent event stream, drained a turn
+		 * later, then handed to listeners whose returned promises are deliberately
+		 * not awaited, behind any user extension registered ahead of this one. So
+		 * `runningToolCallIds` can still be EMPTY while a file-mutating tool is
+		 * already writing, which is exactly the mid-`apply_patch` kill this fix
+		 * exists to prevent.
+		 *
+		 * So whenever the ledger can be read it is the SOLE authority, and a read
+		 * that comes back empty means empty. The fanout is wrong in both
+		 * directions, not one: ledger-running/event-idle must not report idle (the
+		 * mid-`apply_patch` kill above), and ledger-empty/event-running must not
+		 * report pending — the same asynchrony that delays a start also delays an
+		 * end, so a `tool_execution_end` stuck behind another extension would
+		 * otherwise burn the whole grace and record a forced mid-tool kill for a
+		 * call that had already returned.
+		 *
+		 * The fanout stays for observability and still wakes `toolIdleWaiters`, but
+		 * it is the pending authority only when the ledger cannot be consulted: an
+		 * older host without the seam, no execution handle bound yet, or a read
+		 * that threw. That fallback is exactly the pre-ledger behaviour and never
+		 * worse.
+		 */
+		const pendingToolCallIdsFor = (submission: PromptSubmission): string[] => {
+			const handle = submission.executionHandle;
+			const readLedger = terminalAbortSeams?.pendingToolExecutions;
+			if (handle && readLedger)
+				try {
+					// Materialized inside the `try` so only a COMPLETED read wins; a read
+					// that succeeds with no entries still answers "nothing is running",
+					// which is the whole point of preferring it over the stale fanout.
+					return [...readLedger(handle)];
+				} catch (error) {
+					// A seam failure must never disable the deadline or extend it
+					// unboundedly; fall back to the event-derived set for this attempt.
+					logger.warn(`sdk: pending tool execution seam failed: ${String(error)}`);
+				}
+			return [...submission.runningToolCallIds];
+		};
+		/** Resolves once no dispatched tool call is executing for this submission. */
+		const whenPromptToolsIdle = (submission: PromptSubmission): Promise<void> => {
+			if (submission.runningToolCallIds.size === 0) return Promise.resolve();
+			const { promise, resolve } = Promise.withResolvers<void>();
+			submission.toolIdleWaiters.push(resolve);
+			return promise;
+		};
 		const flushPromptLifecycle = (key: string, submission: PromptSubmission) => {
 			for (const frame of submission.bufferedFrames.splice(0)) {
 				try {
@@ -5200,6 +5691,7 @@ export function createNotificationsExtension(
 				if (trackReconciliation) releasePromptAdmission(clientRef);
 				return;
 			}
+			const workLeaseHandle = runtime?.workLease.acquire();
 			// Register delivery ownership synchronously before any await so post-accept
 			// failures that race the durable write still emit correlated terminals.
 			cleanupPromptRecords();
@@ -5211,11 +5703,13 @@ export function createNotificationsExtension(
 					([, submission]) =>
 						submission.terminal && (submission.phase === "delivered" || submission.fatal === true),
 				);
-				if (!oldestTerminal)
+				if (!oldestTerminal) {
+					workLeaseHandle?.release();
 					throw Object.assign(
 						new Error("Too many active prompt submissions; reconcile or await terminal state."),
 						{ code: "reconciliation_capacity" },
 					);
+				}
 				expirePromptDelivery(oldestTerminal[0], oldestTerminal[1]);
 			}
 			if (sdkRunToken) pendingPromptCorrelationsBySdkRunToken.set(sdkRunToken, correlation);
@@ -5230,15 +5724,19 @@ export function createNotificationsExtension(
 				createdAt: Date.now(),
 				deadlineLease: createPromptDeadlineLease({
 					now: Date.now(),
-					leaseMs: readFiniteSetting("sdk.promptDeadlineMs", 1_800_000),
-					maxMs: readFiniteSetting("sdk.promptMaxRuntimeMs", 21_600_000),
+					leaseMs: resolveSdkPromptDeadlineMs(settings?.get("sdk.promptDeadlineMs")),
+					maxMs: resolveSdkPromptMaxRuntimeMs(settings?.get("sdk.promptMaxRuntimeMs")),
 				}),
 				phase: "active",
+				...(workLeaseHandle ? { workLease: workLeaseHandle } : {}),
 				// Bound to the Agent run at `agent_start`; acceptance precedes execution.
 				executionHandle: undefined,
 				...(preflightAbort ? { preflightAbort } : {}),
 				reconciliationKind,
 				bufferedFrames: [],
+				runningToolCallIds: new Set<string>(),
+				endedToolCallIds: new Set<string>(),
+				toolIdleWaiters: [],
 			};
 			const key = promptSubmissionKey(correlation);
 			promptSubmissions.set(key, submission);
@@ -5249,9 +5747,14 @@ export function createNotificationsExtension(
 		};
 		/** Roll back process-local registration when durable acceptance failed. */
 		const discardPromptAcceptance = (correlation: { commandId: string; turnId: string }) => {
-			const submission = promptSubmissions.get(promptSubmissionKey(correlation));
+			const key = promptSubmissionKey(correlation);
+			const submission = promptSubmissions.get(key);
 			if (submission?.deadlineTimer) clearTimeout(submission.deadlineTimer);
-			promptSubmissions.delete(promptSubmissionKey(correlation));
+			if (submission?.workLease) {
+				submission.workLease.release();
+				submission.workLease = undefined;
+			}
+			promptSubmissions.delete(key);
 			removePendingPromptCorrelation(correlation);
 		};
 		const recordPromptTerminal = (correlation: { commandId: string; turnId: string } | undefined) => {
@@ -5275,6 +5778,10 @@ export function createNotificationsExtension(
 		) => {
 			submission.deadlineAttempt = undefined;
 			if (submission.deadlineTimer) clearTimeout(submission.deadlineTimer);
+			if (submission.workLease) {
+				submission.workLease.release();
+				submission.workLease = undefined;
+			}
 			if (!submission.terminal) {
 				submission.terminal = true;
 				submission.fatal = true;
@@ -5466,10 +5973,56 @@ export function createNotificationsExtension(
 				}
 				if (capture) capture.proof = proof;
 			}
-			// Second deadline-attempt fence across the awaited fencing transition:
-			// progress recorded while fencing was in flight supersedes exactly
-			// like progress during the claim. Non-deadline attempts skip this —
-			// their attempt identity was never registered.
+			if (deadlineAttempt) {
+				// Durability BEFORE the durable terminal (#5583, #5623 review round 4).
+				// The bus owns an independent deadline timer and terminalization path,
+				// so the host wiring in `session-runtime` never sees this expiry —
+				// without this call an active notification-bus session loses its dirty
+				// edits on a deadline, which is the exact work-loss this change exists
+				// to stop. It runs between the durable pending claim above and the
+				// finalize below on purpose: a process death anywhere in this window
+				// leaves the durable record PENDING, so restart recovery retries the
+				// prompt instead of treating work that was never autosaved as finished.
+				// Ordering it after the finalize made the autosave the one step a crash
+				// could silently skip. The cost is that the durable terminal is delayed
+				// by at most the flush's 10s bound.
+				//
+				// Deadline path only: reaching here inside `if (deadlineAttempt)` proves
+				// the attempt was registered, and `winner` is the authoritative claimed
+				// outcome, so a cancel, an `agent_failed`, or a normal `agent_end` never
+				// autosaves. Bounded by the shared race and fully swallowed: the
+				// terminal recorded and published below is identical whether the flush
+				// succeeds, fails, or is abandoned.
+				if (
+					winner.kind === "failed" &&
+					winner.code === "prompt_deadline_exceeded" &&
+					settings?.get("sdk.flushWorktreeOnDeadline") !== false
+				) {
+					// `has` is true only for a value the user actually wrote, so this
+					// separates an explicit opt-in from the schema default. The flush only
+					// honours the default inside a linked worktree the session owns.
+					const configured = settings?.get("sdk.flushWorktreeOnDeadline");
+					const hasExplicitSetting =
+						typeof settings?.has === "function"
+							? settings.has("sdk.flushWorktreeOnDeadline")
+							: configured === true;
+					const explicitOptIn = hasExplicitSetting === true && configured === true;
+					await runBoundedDeadlineFlush(signal =>
+						flushWorktreeOnPromptDeadline(ctx.cwd, {
+							explicitOptIn,
+							isCurrent: () =>
+								deadlineAttemptStatus(promptSubmissionKey(correlation), submission, deadlineAttempt) ===
+								"current",
+							signal,
+						}),
+					);
+				}
+			}
+			// Second deadline-attempt fence, across both the awaited fencing
+			// transition and the autosave above: progress recorded while either was in
+			// flight supersedes exactly like progress during the claim, and the
+			// autosave alone can hold this path for ten seconds. Non-deadline attempts
+			// skip this — their attempt identity was never registered.
 			if (deadlineAttempt) {
 				const key = promptSubmissionKey(correlation);
 				const status = deadlineAttemptStatus(key, submission, deadlineAttempt);
@@ -6720,6 +7273,8 @@ export function createNotificationsExtension(
 			terminalAbortSeams,
 			// #4743: join fire-and-forget reconciliation producers at teardown.
 			trackReconciliationProducer,
+			workLease,
+			promoteWorkLease,
 		);
 		cancelPreflightsForConnection = controlSurface.cancelPendingPreflightsForConnection;
 		const abandonPromptResponse = (connectionId: string, frame: Record<string, unknown>) => {
@@ -6859,7 +7414,7 @@ export function createNotificationsExtension(
 					expectedEpoch: options.masterAttestationEpoch,
 					replay: consumedMasterNonces,
 				}),
-			connectionCapabilities: connectionId => hostCapCache.get(connectionId),
+			connectionCapabilities: liveHostCapabilities,
 			installProviderDefinitions,
 			onProviderDefinitionsRemoved: removeProviderDefinitions,
 			onRequest: options.onSdkRequest,
@@ -7242,6 +7797,8 @@ export function createNotificationsExtension(
 			policyGeneration: 0,
 			workflowGatePublicationEpoch: 0,
 			busy: false,
+			workLease,
+			promotedWorkLeases: [],
 			pendingPromptCorrelations,
 			pendingPromptCorrelationsBySdkRunToken,
 			activePromptCorrelation: undefined,
@@ -7385,14 +7942,10 @@ export function createNotificationsExtension(
 						sendEndpointStale(inbound.connectionId, typedFrame);
 						return;
 					}
-					if (typedFrame.type === "ephemeral_turn" || typedFrame.type === "ephemeral_turn_cancel") return;
 					if (typedFrame.type === "event_replay") {
-						const capabilities = Array.isArray(typedFrame.capabilities) ? typedFrame.capabilities : [];
-						hostCapCache.set(
-							inbound.connectionId,
-							new Set(capabilities.filter((capability): capability is string => typeof capability === "string")),
-						);
+						if (liveHostConnection(inbound.connectionId)) hostAttachedConnections.add(inbound.connectionId);
 					}
+					if (typedFrame.type === "ephemeral_turn" || typedFrame.type === "ephemeral_turn_cancel") return;
 					inboundSdkFrame?.(inbound.connectionId, typedFrame);
 				} catch (error) {
 					sendMalformed(
@@ -7425,15 +7978,26 @@ export function createNotificationsExtension(
 				);
 			}
 			server.onNegotiatedCapabilities((_err, connectionId, capabilities) => {
-				if (connectionId) hostCapCache.set(connectionId, new Set(capabilities));
+				// ThreadsafeFunction currently delivers its tuple payload as the second
+				// callback argument at runtime, while older generated declarations expose
+				// the tuple members as separate parameters. Accept both shapes without
+				// allowing an unvalidated payload to become authority.
+				const tuple = Array.isArray(connectionId) ? (connectionId as unknown[]) : undefined;
+				const id = tuple?.[0] ?? connectionId;
+				const negotiated = tuple?.[1] ?? capabilities;
+				if (typeof id === "string" && Array.isArray(negotiated))
+					rememberHostCapabilities(
+						id,
+						negotiated.filter((capability): capability is string => typeof capability === "string"),
+					);
 			});
 			server.onConnectionClose((_err, connectionId) => {
 				if (!connectionId) return;
+				closeHostConnection(connectionId);
 				void controlSurface
 					.cancelPendingPreflightsForConnection(connectionId)
 					.catch(error => logger.warn(`sdk: failed to cancel disconnected preflight: ${String(error)}`));
 				host.handleDisconnect(connectionId);
-				hostCapCache.delete(connectionId);
 				// The socket is gone, so its fence has nothing left to refuse. Dropping the
 				// entry keeps the set bounded by live connections instead of growing forever.
 				fencedConnections.delete(connectionId);
@@ -7699,7 +8263,7 @@ export function createNotificationsExtension(
 			// thread (forwarded by the daemon over the WS, fail-closed at the daemon).
 			server.onInbound(async (err, inbound) => {
 				if (err || !inbound) return;
-				const notificationOrigin = hostCapCache.get(inbound.connectionId)?.has(ASK_SELECTED_ACK_CAPABILITY);
+				const notificationOrigin = liveHostCapabilities(inbound.connectionId)?.has(ASK_SELECTED_ACK_CAPABILITY);
 				const admission = notificationInboundAdmission({
 					inboundFenced: initializedRuntime.inboundFenced,
 					policySuspended: runtime?.policySuspended ?? false,
@@ -7804,6 +8368,8 @@ export function createNotificationsExtension(
 								]
 							: text;
 					let acceptedSent = false;
+					const deliverAsSteer = runtime?.busy === true;
+					const admission = createAdmissionWorkLease(workLease, deliverAsSteer, promoteWorkLease);
 					const acceptAdmission = (): void => {
 						// Fired by AgentSession's preflight acceptance: after admission has
 						// committed but before the turn starts. Registering the update id and
@@ -7811,6 +8377,7 @@ export function createNotificationsExtension(
 						// pendingInbound registration it consumes.
 						if (acceptedSent) return;
 						acceptedSent = true;
+						admission.accepted();
 						if (runtime && typeof inbound.updateId === "number") runtime.pendingInbound.add(inbound.updateId);
 						sendInboundAck(authenticatedInbound.connectionId, authenticatedInbound, "accepted");
 					};
@@ -7820,12 +8387,15 @@ export function createNotificationsExtension(
 						// of after the await; a rejection (preflight, admission, or later)
 						// still reaches the catch and maps to a rejected ack.
 						await api.sendUserMessage(content, {
-							...(runtime?.busy ? { deliverAs: "steer" as const } : {}),
+							...(deliverAsSteer ? { deliverAs: "steer" as const } : {}),
 							onPreflightAcceptCommit: acceptAdmission,
 							onPreflightAccepted: acceptAdmission,
+							...admission.hooks,
 						});
 						acceptAdmission();
+						admission.dispatched();
 					} catch (e) {
+						admission.abandon();
 						sendInboundAck(
 							authenticatedInbound.connectionId,
 							authenticatedInbound,
@@ -7950,15 +8520,21 @@ export function createNotificationsExtension(
 			}
 
 			// The native server owns the only authoritative view of this host's live
-			// SDK client sockets; publish it so a detached session host can bound its
-			// own lifetime without probing the OS (#4010). The handle is this
-			// runtime's alone, so only this runtime's teardown can retract it.
+			// SDK client sockets; publish it with observer-only sockets separated so a
+			// detached session host can bound its own lifetime without probing the OS
+			// (#4010). Work is represented by the session's single lease, not by
+			// reconstructed busy/correlation fields. The handle is this runtime's alone,
+			// so only this runtime's teardown can retract it.
 			initializedRuntime.evidencePublication = publishSessionHostRuntimeEvidence({
 				attachedClients: () => server.clientCount(),
-				workInFlight: () =>
-					initializedRuntime.busy ||
-					initializedRuntime.pendingPromptCorrelations.length > 0 ||
-					initializedRuntime.pendingPromptCorrelationsBySdkRunToken.size > 0,
+				observerClients: () => {
+					if (workLease.isHeld()) return 0;
+					const observers = [...hostCapCache.keys()].filter(connectionId =>
+						liveHostCapabilities(connectionId)?.has(SESSION_HOST_OBSERVER_CAPABILITY),
+					).length;
+					return Math.min(server.clientCount(), observers);
+				},
+				workLease,
 			});
 			ephemeralTurns.configureAuthority({
 				sessionId: id,
@@ -8060,6 +8636,32 @@ export function createNotificationsExtension(
 								...(lifecycleRequestId ? { lifecycleRequestId } : {}),
 							});
 						},
+						heartbeat: async input => {
+							const expected = registration;
+							if (
+								!expected ||
+								expected.sessionId !== input.sessionId ||
+								expected.endpointGeneration !== input.endpointGeneration ||
+								path.resolve(expected.locator.stateRoot) !== path.resolve(input.stateRoot)
+							)
+								return;
+							await index.append({
+								type: "host_heartbeat",
+								sessionId: expected.sessionId,
+								locator: expected.locator,
+								endpointGeneration: expected.endpointGeneration,
+								pid: expected.pid,
+								...(expected.processIncarnation === undefined
+									? {}
+									: { processIncarnation: expected.processIncarnation }),
+								...(expected.hostIncarnation === undefined
+									? {}
+									: { hostIncarnation: expected.hostIncarnation }),
+								...(expected.masterRole === undefined ? {} : { masterRole: expected.masterRole }),
+								activity: input.activity,
+								ts: input.activity.at,
+							});
+						},
 						unregister: async input => {
 							const expected = registration;
 							if (
@@ -8075,8 +8677,8 @@ export function createNotificationsExtension(
 					});
 					throwIfLifecycleStopped();
 					initializedRuntime.brokerRegistrationActive = true;
-					// Host liveness is derived from alive(pid) when the index is read; heartbeats
-					// are deliberately not appended to the durable session index.
+					// Host liveness is derived from alive(pid) and the coalesced heartbeats;
+					// activity transitions are appended by the host through this registration.
 				} catch (brokerError) {
 					if (lifecycleRequired) throw brokerError;
 					logger.warn(`sdk broker registration skipped: ${String(brokerError)}`);
@@ -8896,6 +9498,9 @@ export function createNotificationsExtension(
 		const id = sessionId(ctx);
 		const rt = runtimes.get(id);
 		if (!rt) return;
+		void rt.host
+			.reportActivity("active")
+			.catch(error => logger.warn(`notifications: active activity checkpoint failed: ${String(error)}`));
 		// Streaming state is SDK-visible session truth (context.get isStreaming);
 		// it is tracked regardless of whether notifications are active.
 		rt.busy = true;
@@ -8918,6 +9523,7 @@ export function createNotificationsExtension(
 		if (sdkRunToken && correlation) rt.pendingPromptCorrelationsBySdkRunToken.delete(sdkRunToken);
 		const continuation = rt.activePromptCorrelation !== undefined;
 		rt.activePromptCorrelation = correlation;
+		beginAgentWork(rt);
 		if (correlation && !continuation) rt.bindPromptExecutionHandle(correlation, ctx.getActivePromptHandle());
 		if (continuation) return;
 		await rt.notePromptReconciliation(correlation, { type: "agent_start" });
@@ -8983,6 +9589,9 @@ export function createNotificationsExtension(
 		const id = sessionId(ctx);
 		const rt = runtimes.get(id);
 		if (!rt) return;
+		void rt.host
+			.reportActivity("idle")
+			.catch(error => logger.warn(`notifications: idle activity checkpoint failed: ${String(error)}`));
 		// Clear the streaming flag for SDK consumers even when notifications are off.
 		rt.busy = false;
 		const correlation = rt.activePromptCorrelation;
@@ -9070,6 +9679,7 @@ export function createNotificationsExtension(
 		} else {
 			rt.emitPromptLifecycle(undefined, { type: "agent_end", sessionId: id });
 		}
+		finishAgentWork(rt, event.stopReason === "paused");
 		rt.activePromptCorrelation = undefined;
 		terminalizeInFlightTools(rt, id, event.stopReason === "cancelled" ? "cancelled" : "failed");
 		try {