@gajae-code/coding-agent 0.18.0 → 0.18.5

package/src/sdk/broker/lifecycle.ts

@@ -97,6 +97,7 @@ import {
 } from "./session-index";
 import {
 	cancellableSleep,
+	DEFAULT_BROKER_PRESPAWN_PREPARATION_TIMEOUT_MS,
 	DEFAULT_READINESS_TIMEOUT_MS,
 	deriveLifecycleOuterDeadlines,
 	isValidReadinessTimeoutMs,
@@ -517,6 +518,7 @@ type LifecycleCommandResolver = () => LifecycleCommand;
 const lifecycleCommandResolversForTest = new WeakMap<Broker, LifecycleCommandResolver>();
 const lifecycleCleanupHooksForTest = new WeakMap<Broker, () => void>();
 const startupAdmittedInputs = new WeakSet<Input>();
+const startupBrokerDerivedAdmissions = new WeakMap<Input, { admittedAt: number; preSpawnDeadlineAt: number }>();
 const startupLaunchInputs = new WeakMap<Input, SessionLaunch>();
 type EnsureLaunchWorktreeForTest = (
 	plan: GjcLaunchWorktreePlan,
@@ -627,7 +629,10 @@ export function hasValidLifecycleDeadlines(value: LifecycleDeadlines, now = Date
 type Input = Record<string, unknown>;
 // The admitted launch deadline must survive the response phase: executeLifecycle
 // receives the caller's original input after startup admission has expanded it.
-type LifecycleEffectIntentWithDeadline = LifecycleEffectIntent & { lifecycleCleanupDeadlineAt?: number };
+type LifecycleEffectIntentWithDeadline = LifecycleEffectIntent & {
+	lifecycleCleanupDeadlineAt?: number;
+	admissionCleanupDeadlineAt?: number;
+};
 export const isCanonicalSessionId = (value: string): boolean => /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value);
 const defaultStateRoot = (cwd: string) => path.join(path.resolve(cwd), ".gjc", "state");
 const hasDefaultStateRoot = (cwd: string, root: string) => path.resolve(root) === defaultStateRoot(cwd);
@@ -4828,6 +4833,7 @@ async function terminateSpawnedChild(
 	terminationStartDeadlineAt: number,
 	expected: EffectMarker | undefined,
 	timing: LifecycleTiming,
+	reapUnregisteredCutoff = false,
 ): Promise<boolean> {
 	const pid = child.pid;
 	if (!pid || (expected && pid !== expected.pid)) return false;
@@ -4841,100 +4847,226 @@ async function terminateSpawnedChild(
 	await broker.index.refresh();
 	if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
 	const registered = expected ? broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker) : false;
-	// Keep one poll interval inside the lifecycle deadline for the final exact
-	// cleanup proof. Registered sessions retain the original deadline partition;
-	// only an unregistered child needs this extra bounded margin.
-	const processExitDeadlineAt = expected && !registered ? deadline - POLL_MS : deadline;
+	// Reserve a quarter of the termination phase for the exact post-exit proof
+	// and ledger-backed artifact cleanup. Registered hosts retain their deadline.
+	const postExitProofReserveMs = Math.max(POLL_MS, Math.floor((deadline - terminationStartDeadlineAt) / 4));
+	const processExitDeadlineAt = expected && !registered ? deadline - postExitProofReserveMs : deadline;
 	const unregisteredTerminationDeadlineAt =
 		processExitDeadlineAt - Math.max(POLL_MS, Math.floor((processExitDeadlineAt - terminationStartDeadlineAt) / 2));
 	const observe = (): ProcessObservation =>
-		child.exitCode !== null
+		child.exitCode !== null || child.signalCode !== null
 			? "exited"
 			: observeProcess(pid, incarnation, value => processIncarnationForBroker(broker, value));
-	const waitForExit = async (until: number): Promise<ProcessObservation> => {
-		let observation = observe();
-		while (observation !== "exited" && timing.now() < until) {
-			await timing.sleep(Math.max(0, Math.min(POLL_MS, until - timing.now())));
-			observation = observe();
-		}
-
-		return observation;
+	let ownedExitObserved = child.exitCode !== null || child.signalCode !== null;
+	const ownedExit = Promise.withResolvers<void>();
+	const observeOwnedExit = (): void => {
+		ownedExitObserved = true;
+		ownedExit.resolve();
 	};
-
-	let observation = observe();
-	const recheckOwnedExitObservation = async (): Promise<void> => {
-		if (observation !== "uncertain") return;
-		// This direct ChildProcess is owned by this broker invocation. A process-incarnation
-		// read can briefly lag its exit event, so recheck only this owned child before failing.
-		observation = await waitForExit(processExitDeadlineAt);
+	child.once("exit", observeOwnedExit);
+	const cleanupOwnedExitListeners = (): void => {
+		child.removeListener("exit", observeOwnedExit);
 	};
-	if (observation === "alive") {
-		if (expected && !registered) {
-			// A child that has not registered yet owns the cutoff receipt. Give it
-			// the bounded pre-registration window to publish that proof, but reserve
-			// the final proof interval for post-signal observation inside the request
-			// deadline. A valid receipt does not interrupt the child's own rollback.
-			while (timing.now() < unregisteredTerminationDeadlineAt) {
-				if (await readLifecycleFailureArtifact(lifecycleFailurePath(root, id, expected.effectMarker), expected))
-					await waitUntil(timing, unregisteredTerminationDeadlineAt);
-				else await timing.sleep(Math.max(0, Math.min(POLL_MS, unregisteredTerminationDeadlineAt - timing.now())));
+	try {
+		const waitForExit = async (until: number): Promise<ProcessObservation> => {
+			let observation = observe();
+			while (observation !== "exited" && timing.now() < until) {
+				await Promise.race([ownedExit.promise, timing.sleep(Math.max(0, Math.min(POLL_MS, until - timing.now())))]);
+				if (ownedExitObserved) observation = "exited";
+				else observation = observe();
+			}
+
+			return observation;
+		};
+
+		let observation = observe();
+		const recheckOwnedExitObservation = async (): Promise<void> => {
+			if (observation !== "uncertain") return;
+			// This direct ChildProcess is owned by this broker invocation. A process-incarnation
+			// read can briefly lag its exit event, so recheck only this owned child before failing.
+			observation = await waitForExit(processExitDeadlineAt);
+		};
+		if (observation === "alive") {
+			if (expected && !registered) {
+				await waitUntil(timing, terminationStartDeadlineAt);
+				// A child with a published cutoff receipt owns its rollback. Without one,
+				// waiting for a blocked module to publish is wasted signal/exit time.
+				const failure = await readLifecycleFailureArtifact(
+					lifecycleFailurePath(root, id, expected.effectMarker),
+					expected,
+				);
+				if (failure) await waitUntil(timing, unregisteredTerminationDeadlineAt);
+			} else {
+				await waitUntil(timing, terminationStartDeadlineAt);
 			}
-		} else {
-			await waitUntil(timing, terminationStartDeadlineAt);
-		}
-		observation = observe();
-	}
-	if (observation === "alive") {
-		if (!(await signalVerifiedSession({ locator: { stateRoot: root }, pid }, id, "SIGTERM", expected))) {
 			observation = observe();
-			await recheckOwnedExitObservation();
-			if (observation !== "exited") {
-				await recordTerminalUncertain(broker, id, root, pid);
-				return false;
+		}
+		if (observation === "alive") {
+			const signalResult =
+				expected && !registered
+					? child.kill("SIGTERM")
+					: await signalVerifiedSession({ locator: { stateRoot: root }, pid }, id, "SIGTERM", expected);
+			if (!signalResult) {
+				observation = observe();
+				await recheckOwnedExitObservation();
+				if (observation !== "exited") {
+					await recordTerminalUncertain(broker, id, root, pid);
+					return false;
+				}
+			} else {
+				const remaining = Math.max(0, processExitDeadlineAt - timing.now());
+				const gracefulDeadline =
+					timing.now() +
+					Math.min(CLOSE_TIMEOUT_MS, Math.floor(remaining * (expected && !registered ? 0.15 : 0.5)));
+				observation = await waitForExit(gracefulDeadline);
 			}
-		} else {
-			const remaining = Math.max(0, processExitDeadlineAt - timing.now());
-			const gracefulDeadline = timing.now() + Math.min(CLOSE_TIMEOUT_MS, Math.floor(remaining / 2));
-			observation = await waitForExit(gracefulDeadline);
 		}
-	}
-	if (observation === "alive") {
-		if (!(await signalVerifiedSession({ locator: { stateRoot: root }, pid }, id, "SIGKILL", expected))) {
-			observation = observe();
-			await recheckOwnedExitObservation();
-			if (observation !== "exited") {
-				await recordTerminalUncertain(broker, id, root, pid);
-				return false;
+		if (observation === "alive") {
+			const signalResult =
+				expected && !registered
+					? child.kill("SIGKILL")
+					: await signalVerifiedSession({ locator: { stateRoot: root }, pid }, id, "SIGKILL", expected);
+			if (!signalResult) {
+				observation = observe();
+				await recheckOwnedExitObservation();
+				if (observation !== "exited") {
+					await recordTerminalUncertain(broker, id, root, pid);
+					return false;
+				}
+			} else {
+				observation = await waitForExit(processExitDeadlineAt);
 			}
-		} else {
-			observation = await waitForExit(processExitDeadlineAt);
 		}
-	}
-	await recheckOwnedExitObservation();
-	if (observation !== "exited" || !lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-	let rollbackGeneration: number | null | undefined;
-	if (expected) {
-		const failure = await readLifecycleFailureArtifact(
-			lifecycleFailurePath(root, id, expected.effectMarker),
-			expected,
-		);
-		if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-		const rollbackComplete =
-			failure?.artifact.rollback.fenced === true &&
-			failure.artifact.rollback.runtimeRemoved &&
-			failure.artifact.rollback.hostStopped &&
-			failure.artifact.rollback.brokerRegistrationReleased;
-		if (!rollbackComplete) {
-			if (!readyThenExitToleranceEnabled()) {
-				// A child that exited with a non-zero status before publishing any
-				// lifecycle receipt has no durable rollback to wait for. Prove the
-				// owned artifacts are gone and release its registration, but retain
-				// terminal uncertainty for timeouts, clean exits, and child-authored
-				// startup receipts whose rollback is incomplete.
-				if (failure || child.exitCode === null || child.exitCode === 0) return failClosed();
+		await recheckOwnedExitObservation();
+		if (observation !== "exited" || !lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+		let rollbackGeneration: number | null | undefined;
+		if (expected) {
+			const failure = await readLifecycleFailureArtifact(
+				lifecycleFailurePath(root, id, expected.effectMarker),
+				expected,
+			);
+			if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+			const rollbackComplete =
+				failure?.artifact.rollback.fenced === true &&
+				failure.artifact.rollback.runtimeRemoved &&
+				failure.artifact.rollback.hostStopped &&
+				failure.artifact.rollback.brokerRegistrationReleased;
+			if (failure && expected && !rollbackComplete) {
+				await broker.index.refresh();
+				const hasRegistration = broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker);
+				if (!hasRegistration) {
+					const artifactsRemoved = await removeOwnedLifecycleArtifacts(
+						root,
+						id,
+						expected,
+						undefined,
+						undefined,
+						proofBudget,
+					);
+					const endpointGone = await endpointRemoved(root, id);
+					// A signal-delivery error can be emitted while the child still runs. Recheck
+					// exact process absence after cleanup before reporting a proven reap.
+					if (
+						artifactsRemoved &&
+						endpointGone &&
+						(observe() === "exited" || ownedExitObserved) &&
+						lifecycleProofWithinDeadline(proofBudget)
+					)
+						return true;
+					return failClosed();
+				}
+			}
+			if (!rollbackComplete) {
+				if (!readyThenExitToleranceEnabled()) {
+					// A child that exited with a non-zero status before publishing any
+					// lifecycle receipt has no durable rollback to wait for. Prove the
+					// owned artifacts are gone and release its registration, but retain
+					// terminal uncertainty for timeouts, clean exits, and child-authored
+					// startup receipts whose rollback is incomplete.
+					await broker.index.refresh();
+					const uncertainRegistration = broker.index
+						.listSessions()
+						.sessions.some(
+							session => session.sessionId === id && session.pid === pid && session.terminalUncertain === true,
+						);
+					if (
+						failure ||
+						uncertainRegistration ||
+						(child.exitCode === null && child.signalCode === null) ||
+						child.exitCode === 0
+					)
+						return failClosed();
+					if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+					const publishedReady = (await probePublishedReadyAuthority(root, id, expected)).kind === "matched";
+					if (publishedReady) return failClosed();
+					if (reapUnregisteredCutoff && !(await endpointRemoved(root, id))) return failClosed();
+					const artifactsRemoved = await removeOwnedLifecycleArtifacts(
+						root,
+						id,
+						expected,
+						undefined,
+						undefined,
+						proofBudget,
+					);
+					if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+					await broker.index.refresh();
+					if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+					const registered = broker.index
+						.listSessions()
+						.sessions.find(session => session.sessionId === id && session.pid === pid);
+					let registrationReleased =
+						!broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker) ||
+						registered?.terminal === true ||
+						registered?.terminalUncertain === true;
+					if (registered && !registrationReleased) {
+						registrationReleased = await broker.index.unregisterIfCurrent(registered);
+						if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+						await broker.index.refresh();
+						registrationReleased =
+							registrationReleased ||
+							!broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker);
+					}
+					const stillExited =
+						observeProcess(pid, expected.incarnation, value => processIncarnationForBroker(broker, value)) ===
+						"exited";
+					const endpointGone = await endpointRemoved(root, id);
+					if (
+						stillExited &&
+						artifactsRemoved &&
+						endpointGone &&
+						registrationReleased &&
+						registered?.terminalUncertain !== true &&
+						lifecycleProofWithinDeadline(proofBudget)
+					) {
+						if (!reapUnregisteredCutoff) return true;
+						try {
+							await writeSessionLifecycleFailure(
+								root,
+								id,
+								expected.effectMarker,
+								{ phase: "startup", reason: "failed", message: `Session ${id} exited at readiness cutoff.` },
+								{
+									endpointGeneration: null,
+									fenced: true,
+									runtimeRemoved: true,
+									hostStopped: true,
+									brokerRegistrationReleased: true,
+								},
+								undefined,
+								expected.incarnation,
+								expected.pid,
+							);
+						} catch {
+							return failClosed();
+						}
+						if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+						return true;
+					}
+					return failClosed();
+				}
 				if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
 				const publishedReady = (await probePublishedReadyAuthority(root, id, expected)).kind === "matched";
-				if (publishedReady) return failClosed();
+				if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
 				const artifactsRemoved = await removeOwnedLifecycleArtifacts(
 					root,
 					id,
@@ -4949,21 +5081,50 @@ async function terminateSpawnedChild(
 				const registered = broker.index
 					.listSessions()
 					.sessions.find(session => session.sessionId === id && session.pid === pid);
+				const registeredRowTerminal = registered?.terminal === true || registered?.terminalUncertain === true;
 				let registrationReleased =
-					!broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker) ||
-					registered?.terminal === true ||
-					registered?.terminalUncertain === true;
+					!broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker) || registeredRowTerminal;
 				if (registered && !registrationReleased) {
+					if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
 					registrationReleased = await broker.index.unregisterIfCurrent(registered);
 					if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
 					await broker.index.refresh();
+					if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
 					registrationReleased =
 						registrationReleased || !broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker);
 				}
 				const stillExited =
 					observeProcess(pid, expected.incarnation, value => processIncarnationForBroker(broker, value)) ===
 					"exited";
+				if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
 				const endpointGone = await endpointRemoved(root, id);
+				if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+				try {
+					if (publishedReady && !failure) {
+						await writeSessionLifecycleFailure(
+							root,
+							id,
+							expected.effectMarker,
+							{
+								phase: "startup",
+								reason: "failed",
+								message: `Session ${id} ${READY_THEN_EXIT_MESSAGE}.`,
+							},
+							{
+								endpointGeneration: registered?.endpointGeneration ?? null,
+								fenced: stillExited && registrationReleased,
+								runtimeRemoved: artifactsRemoved && endpointGone,
+								hostStopped: stillExited,
+								brokerRegistrationReleased: registrationReleased,
+							},
+							undefined,
+							expected.incarnation,
+							expected.pid,
+						);
+					}
+				} catch {
+					// A missing broker-authored receipt must not hide a proven dead child.
+				}
 				if (
 					stillExited &&
 					artifactsRemoved &&
@@ -4974,102 +5135,35 @@ async function terminateSpawnedChild(
 					return true;
 				return failClosed();
 			}
-			if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-			const publishedReady = (await probePublishedReadyAuthority(root, id, expected)).kind === "matched";
-			if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-			const artifactsRemoved = await removeOwnedLifecycleArtifacts(
-				root,
-				id,
-				expected,
-				undefined,
-				undefined,
-				proofBudget,
-			);
-			if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-			await broker.index.refresh();
-			if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-			const registered = broker.index
-				.listSessions()
-				.sessions.find(session => session.sessionId === id && session.pid === pid);
-			const registeredRowTerminal = registered?.terminal === true || registered?.terminalUncertain === true;
-			let registrationReleased =
-				!broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker) || registeredRowTerminal;
-			if (registered && !registrationReleased) {
-				if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-				registrationReleased = await broker.index.unregisterIfCurrent(registered);
-				if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-				await broker.index.refresh();
-				if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-				registrationReleased =
-					registrationReleased || !broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker);
-			}
-			const stillExited =
-				observeProcess(pid, expected.incarnation, value => processIncarnationForBroker(broker, value)) === "exited";
-			if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-			const endpointGone = await endpointRemoved(root, id);
-			if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-			try {
-				if (publishedReady && !failure) {
-					await writeSessionLifecycleFailure(
-						root,
-						id,
-						expected.effectMarker,
-						{
-							phase: "startup",
-							reason: "failed",
-							message: `Session ${id} ${READY_THEN_EXIT_MESSAGE}.`,
-						},
-						{
-							endpointGeneration: registered?.endpointGeneration ?? null,
-							fenced: stillExited && registrationReleased,
-							runtimeRemoved: artifactsRemoved && endpointGone,
-							hostStopped: stillExited,
-							brokerRegistrationReleased: registrationReleased,
-						},
-						undefined,
-						expected.incarnation,
-						expected.pid,
-					);
-				}
-			} catch {
-				// A missing broker-authored receipt must not hide a proven dead child.
-			}
-			if (
-				stillExited &&
-				artifactsRemoved &&
-				endpointGone &&
-				registrationReleased &&
-				lifecycleProofWithinDeadline(proofBudget)
-			)
-				return true;
+			rollbackGeneration = failure.artifact.rollback.endpointGeneration;
+		}
+		if (expected && !(await removeOwnedLifecycleArtifacts(root, id, expected, undefined, undefined, proofBudget)))
+			return failClosed();
+		if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+		await broker.index.refresh();
+		if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+		if (
+			rollbackGeneration === null &&
+			expected &&
+			!broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker)
+		)
+			return lifecycleProofWithinDeadline(proofBudget) ? true : failClosed();
+		const registeredBeforeTermination =
+			rollbackGeneration === undefined || rollbackGeneration === null
+				? undefined
+				: broker.index.findHostRegistration(id, rollbackGeneration, pid, expected?.effectMarker);
+		const unregistered = registeredBeforeTermination
+			? broker.index.hostUnregisteredAfter(registeredBeforeTermination)
+			: undefined;
+		if (!registeredBeforeTermination || !unregistered) {
 			return failClosed();
 		}
-		rollbackGeneration = failure.artifact.rollback.endpointGeneration;
-	}
-	if (expected && !(await removeOwnedLifecycleArtifacts(root, id, expected, undefined, undefined, proofBudget)))
-		return failClosed();
-	if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-	await broker.index.refresh();
-	if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-	if (
-		rollbackGeneration === null &&
-		expected &&
-		!broker.index.hasHostRegistrationForLifecycle(id, pid, expected.effectMarker)
-	)
-		return lifecycleProofWithinDeadline(proofBudget) ? true : failClosed();
-	const registeredBeforeTermination =
-		rollbackGeneration === undefined || rollbackGeneration === null
-			? undefined
-			: broker.index.findHostRegistration(id, rollbackGeneration, pid, expected?.effectMarker);
-	const unregistered = registeredBeforeTermination
-		? broker.index.hostUnregisteredAfter(registeredBeforeTermination)
-		: undefined;
-	if (!registeredBeforeTermination || !unregistered) {
-		return failClosed();
+		if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
+		const endpointGone = await endpointRemoved(root, id);
+		return endpointGone && lifecycleProofWithinDeadline(proofBudget) ? true : failClosed();
+	} finally {
+		cleanupOwnedExitListeners();
 	}
-	if (!lifecycleProofWithinDeadline(proofBudget)) return failClosed();
-	const endpointGone = await endpointRemoved(root, id);
-	return endpointGone && lifecycleProofWithinDeadline(proofBudget) ? true : failClosed();
 }
 
 async function signalVerifiedSession(
@@ -6414,6 +6508,7 @@ async function executeLifecycleResponse(
 		const timing = lifecycleTiming(broker);
 		const admissionGranted = startupAdmittedInputs.has(input);
 		if (!admissionGranted) {
+			const startupReceivedAt = timing.now();
 			const suppliedDeadlineFields = [
 				input.receivedAt,
 				input.requestedReadinessTimeoutMs,
@@ -6441,15 +6536,26 @@ async function executeLifecycleResponse(
 				);
 			}
 			const admitted = await broker.runStartup(queueWaitMs, timing, async admittedAt => {
-				const admittedInput = launch.worktreePlan
-					? { ...input, admittedAt, requestedReadinessTimeoutMs }
-					: { ...input, ...deriveLifecycleDeadlines(admittedAt, requestedReadinessTimeoutMs) };
+				const callerSuppliedDeadlines = suppliedDeadlineFields.some(value => value !== undefined);
+				let admittedInput: Input;
+				if (launch.worktreePlan) admittedInput = { ...input, admittedAt, requestedReadinessTimeoutMs };
+				else if (callerSuppliedDeadlines) admittedInput = { ...input };
+				else admittedInput = { ...input, ...deriveLifecycleDeadlines(admittedAt, requestedReadinessTimeoutMs) };
 				startupAdmittedInputs.add(admittedInput);
+				if (!launch.worktreePlan && !callerSuppliedDeadlines)
+					startupBrokerDerivedAdmissions.set(admittedInput, {
+						admittedAt,
+						preSpawnDeadlineAt: Math.min(
+							admittedAt + DEFAULT_BROKER_PRESPAWN_PREPARATION_TIMEOUT_MS,
+							startupReceivedAt + queueWaitMs,
+						),
+					});
 				startupLaunchInputs.set(admittedInput, launch);
 				try {
 					return await executeLifecycleResponse(broker, operation, admittedInput, identity, cleanup);
 				} finally {
 					startupLaunchInputs.delete(admittedInput);
+					startupBrokerDerivedAdmissions.delete(admittedInput);
 					startupAdmittedInputs.delete(admittedInput);
 				}
 			});
@@ -6477,6 +6583,8 @@ async function executeLifecycleResponse(
 		let readinessDeadline: number;
 		let terminationStartDeadline: number;
 		let outerCleanupDeadlineAt: number | undefined;
+		const brokerAdmission = startupBrokerDerivedAdmissions.get(input);
+		const preSpawnDeadlineAt = brokerAdmission?.preSpawnDeadlineAt;
 		if (launch.worktreePlan) {
 			const prepTimeouts = readPreparationTimeouts(input);
 			if (!prepTimeouts.ok) return fail("invalid_input", PREPARATION_TIMEOUT_INVALID_MESSAGE);
@@ -6507,6 +6615,10 @@ async function executeLifecycleResponse(
 			lifecycleDeadline = deadlines.lifecycleCleanupDeadlineAt;
 			readinessDeadline = deadlines.semanticReadyDeadlineAt;
 			terminationStartDeadline = deadlines.terminationStartDeadlineAt;
+			if (preSpawnDeadlineAt !== undefined) {
+				outerCleanupDeadlineAt = preSpawnDeadlineAt + deadlines.requestedReadinessTimeoutMs;
+				lifecycleDeadline = outerCleanupDeadlineAt;
+			}
 		}
 
 		if (!hasProcessIncarnationAuthority())
@@ -6530,6 +6642,9 @@ async function executeLifecycleResponse(
 			childOwnershipEstablished: false,
 			lifecycleCleanupDeadlineAt:
 				outerCleanupDeadlineAt ?? (childDeadlines as LifecycleDeadlines).lifecycleCleanupDeadlineAt,
+			...(brokerAdmission
+				? { admissionCleanupDeadlineAt: (childDeadlines as LifecycleDeadlines).lifecycleCleanupDeadlineAt }
+				: {}),
 			...(plannedWorktreeIntent ? { worktree: plannedWorktreeIntent } : {}),
 		};
 
@@ -6631,7 +6746,22 @@ async function executeLifecycleResponse(
 			}
 			return mapPreparationFailure(error);
 		}
-		if (!launch.worktreePlan && timing.now() >= readinessDeadline)
+		if (preSpawnDeadlineAt !== undefined && brokerAdmission !== undefined) {
+			const prepFinishedAt = timing.now();
+			if (prepFinishedAt >= preSpawnDeadlineAt)
+				return fail(
+					"readiness_timeout",
+					`Broker pre-spawn preparation exceeded its ${Math.max(0, preSpawnDeadlineAt - brokerAdmission.admittedAt)} ms allowance after ${Math.max(0, prepFinishedAt - brokerAdmission.admittedAt)} ms.`,
+				);
+			// Only broker-derived tuples restart here; exact caller deadlines remain unchanged.
+			childDeadlines = deriveLifecycleDeadlines(
+				prepFinishedAt,
+				(childDeadlines as LifecycleDeadlines).requestedReadinessTimeoutMs,
+			);
+			readinessDeadline = childDeadlines.semanticReadyDeadlineAt;
+			terminationStartDeadline = childDeadlines.terminationStartDeadlineAt;
+			lifecycleDeadline = childDeadlines.lifecycleCleanupDeadlineAt;
+		} else if (!launch.worktreePlan && timing.now() >= readinessDeadline)
 			return fail(
 				"readiness_timeout",
 				"Lifecycle preparation exhausted the semantic readiness deadline before spawning.",
@@ -6863,6 +6993,7 @@ async function executeLifecycleResponse(
 											knownSecrets,
 										)
 									: undefined;
+				const ledgerUncertain = broker.ledger.get(identity)?.state === "terminal_uncertain";
 				const terminated = await terminateSpawnedChild(
 					child,
 					broker,
@@ -6872,8 +7003,8 @@ async function executeLifecycleResponse(
 					terminationStartDeadline,
 					spawnedAuthority,
 					timing,
+					readiness.kind === "timeout",
 				);
-
 				if (!terminated)
 					return readiness.kind === "ready_probe_failed"
 						? fail(
@@ -6884,6 +7015,11 @@ async function executeLifecycleResponse(
 								"terminal_uncertain",
 								`Session ${launch.id} did not become ready and its spawned process could not be verified dead. ${diagnostic ?? "stage=readiness waiting_for=session_ready child=uncertain exit=not_observed signal=not_observed stderr=none"}`,
 							);
+				if (ledgerUncertain)
+					return fail(
+						"terminal_uncertain",
+						`Lifecycle startup cleanup could not be proven; retained artifacts require reconciliation. Original launch failure: Session ${launch.id} did not become ready and its spawned process could not be verified dead.`,
+					);
 				return readiness.kind === "startup_failed"
 					? fail(
 							readiness.failure.code ?? "spawn_failed",
@@ -7880,6 +8016,7 @@ async function exactCleanupProof(
 	evidence: { artifact: LifecycleFailureArtifact } | undefined,
 	proofBudget?: LifecycleProofBudget,
 	allowObservedWindowsReadyExit = false,
+	allowObservedUnregisteredCutoff = false,
 ): Promise<LifecycleCleanupProof | undefined> {
 	const rollback = evidence?.artifact.rollback;
 	const durableRollbackComplete =
@@ -7887,6 +8024,16 @@ async function exactCleanupProof(
 		rollback.runtimeRemoved &&
 		rollback.hostStopped &&
 		rollback.brokerRegistrationReleased;
+	// An owned child reaped before registration cannot finish its cutoff receipt.
+	// The broker may retire that receipt only after independently proving process,
+	// endpoint, and registration absence through this exact cleanup transaction.
+	const observedUnregisteredCutoff =
+		allowObservedUnregisteredCutoff &&
+		rollback?.endpointGeneration === null &&
+		rollback.fenced === false &&
+		rollback.runtimeRemoved === false &&
+		rollback.hostStopped === false &&
+		rollback.brokerRegistrationReleased === false;
 	// Windows deliberately keeps the failure receipt incomplete because its
 	// directory-entry publication cannot be flushed. A broker-observed
 	// ready-then-exit can still authorize the separate ledger-backed exact
@@ -7904,7 +8051,7 @@ async function exactCleanupProof(
 		!root ||
 		!id ||
 		!expected ||
-		(!durableRollbackComplete && !observedWindowsReadyExit) ||
+		(!durableRollbackComplete && !observedWindowsReadyExit && !observedUnregisteredCutoff) ||
 		observeProcess(expected.pid, expected.incarnation, value => processIncarnationForBroker(broker, value)) !==
 			"exited"
 	)
@@ -7991,6 +8138,26 @@ export interface LifecycleExecutionOutcome {
 	deferredArtifactCleanup?: () => Promise<void>;
 }
 
+export function classifyLateAdmissionSpawnFailure(
+	response: BrokerResponse,
+	effectIntent: LifecycleEffectIntentWithDeadline | undefined,
+	now: number,
+	messageSource: BrokerResponse,
+): BrokerResponse {
+	if (
+		response.ok ||
+		response.error.code !== "spawn_failed" ||
+		effectIntent?.childOwnershipEstablished !== true ||
+		effectIntent.admissionCleanupDeadlineAt === undefined ||
+		now < effectIntent.admissionCleanupDeadlineAt
+	)
+		return response;
+	return {
+		...response,
+		error: { code: "terminal_uncertain", message: terminalUncertainStartupMessage(messageSource) },
+	};
+}
+
 /** Returns the response together with every durable lifecycle fact needed for truthful replay. */
 export async function executeLifecycle(
 	broker: Broker,
@@ -7999,6 +8166,7 @@ export async function executeLifecycle(
 	identity: string,
 	cleanup?: CleanupEvidence,
 ): Promise<LifecycleExecutionOutcome> {
+	const timing = lifecycleTiming(broker);
 	let proofBudget = lifecycleProofBudgetFromInput(broker, input);
 	if (!proofBudget)
 		proofBudget = lifecycleProofBudgetFromEffectIntent(broker, broker.ledger.get(identity)?.effectIntent);
@@ -8052,16 +8220,25 @@ export async function executeLifecycle(
 			const binding = validateLifecycleDeleteMetadataBinding(broker, operation, input, identity, cleanup);
 			if (binding) return { response: binding };
 		}
+		const reconciled = await reconcileLifecycleCleanup(
+			broker,
+			identity,
+			cleanup,
+			operation === "session.delete"
+				? { ok: true, result: { sessionId: cleanup.sessionId } }
+				: fail("spawn_failed", "No ready SDK endpoint remains available."),
+			proofBudget,
+		);
 		return {
-			response: await reconcileLifecycleCleanup(
-				broker,
-				identity,
-				cleanup,
+			response:
 				operation === "session.delete"
-					? { ok: true, result: { sessionId: cleanup.sessionId } }
-					: fail("spawn_failed", "No ready SDK endpoint remains available."),
-				proofBudget,
-			),
+					? reconciled
+					: classifyLateAdmissionSpawnFailure(
+							reconciled,
+							broker.ledger.get(identity)?.effectIntent,
+							timing.now(),
+							reconciled,
+						),
 		};
 	}
 	const response = await executeLifecycleResponse(broker, operation, input, identity, cleanup);
@@ -8090,6 +8267,7 @@ export async function executeLifecycle(
 		evidence,
 		proofBudget,
 		!response.ok && response.error.code === "ready_then_exited",
+		!response.ok && response.error.code === "readiness_timeout",
 	);
 	const startupFailure: LifecycleStartupFailureReceipt | undefined = evidence
 		? {
@@ -8189,47 +8367,59 @@ export async function executeLifecycle(
 				? response
 				: response.error.code === "endpoint_unreadable"
 					? response
-					: // An unreadable/corrupt endpoint is already the fail-closed honest
-						// terminal classification (it names the artifact, not the
-						// child); the reconciliation wrapper must not erase it.
-						response.error.code === "ready_then_exited" && (cleanupProof || provenDeadCleanup)
+					: response.error.code === "readiness_timeout" &&
+							cleanupProof &&
+							lifecycleCleanupResponse &&
+							!lifecycleCleanupResponse.ok &&
+							lifecycleCleanupResponse.error.code === "spawn_failed"
 						? {
 								...response,
 								...(durableEffects ? { durableEffects } : {}),
 								...(startupFailure ? { startupFailure } : {}),
 							}
-						: startupFailure && cleanupProof
+						: // An unreadable/corrupt endpoint is already the fail-closed honest
+							// terminal classification (it names the artifact, not the
+							// child); the reconciliation wrapper must not erase it.
+							response.error.code === "ready_then_exited" && (cleanupProof || provenDeadCleanup)
 							? {
-									ok: false,
-									error: startupFailure.code
-										? {
-												code: startupFailure.code,
-												message: startupFailure.message,
-												details: startupFailure.details!,
-												endpoint: "unavailable" as const,
-											}
-										: {
-												code: "spawn_failed",
-												message: startupFailure.message,
-												endpoint: "unavailable" as const,
-											},
+									...response,
 									...(durableEffects ? { durableEffects } : {}),
-									startupFailure,
+									...(startupFailure ? { startupFailure } : {}),
 								}
-							: provenDeadCleanup && response.error.code !== "terminal_uncertain"
-								? response
-								: {
+							: startupFailure && cleanupProof
+								? {
 										ok: false,
-										error: {
-											code: "terminal_uncertain",
-											message: terminalUncertainStartupMessage(response),
-										},
+										error: startupFailure.code
+											? {
+													code: startupFailure.code,
+													message: startupFailure.message,
+													details: startupFailure.details!,
+													endpoint: "unavailable" as const,
+												}
+											: {
+													code: "spawn_failed",
+													message: startupFailure.message,
+													endpoint: "unavailable" as const,
+												},
 										...(durableEffects ? { durableEffects } : {}),
-										...(startupFailure ? { startupFailure } : {}),
+										startupFailure,
 									}
+								: provenDeadCleanup && response.error.code !== "terminal_uncertain"
+									? response
+									: {
+											ok: false,
+											error: {
+												code: "terminal_uncertain",
+												message: terminalUncertainStartupMessage(response),
+											},
+											...(durableEffects ? { durableEffects } : {}),
+											...(startupFailure ? { startupFailure } : {}),
+										}
 			: response;
+	// The extended proof window may reconcile artifacts after the original
+	// admission deadline, but cannot retroactively prove a timely spawn failure.
 	return {
-		response: terminalResponse,
+		response: classifyLateAdmissionSpawnFailure(terminalResponse, entry?.effectIntent, timing.now(), response),
 		...(durableEffects ? { durableEffects } : {}),
 		...(startupFailure ? { startupFailure } : {}),
 	};