@gajae-code/coding-agent 0.18.0 → 0.18.5

package/src/sdk/broker/recovery-backoff.ts

@@ -0,0 +1,135 @@
+/**
+ * Bounded exponential backoff tracker for broker recovery failures per agent dir.
+ * Tracks repeated recovery failures and implements exponential backoff with a cap
+ * to prevent repeated spawns from destabilizing the system.
+ */
+
+/** Configuration for recovery backoff behavior. */
+export interface RecoveryBackoffConfig {
+	/** Initial backoff delay in milliseconds (default: 1000ms). */
+	initialDelayMs: number;
+	/** Maximum backoff delay in milliseconds (default: 30000ms = 30s). */
+	maxDelayMs: number;
+	/** Backoff multiplier applied each retry (default: 2). */
+	multiplier: number;
+	/** Maximum number of recovery attempts per session (default: 5). */
+	maxAttempts: number;
+}
+
+/** State for a single agent dir's recovery backoff. */
+export interface RecoveryBackoffState {
+	/** Timestamp of the last recovery failure. */
+	lastFailureAt: number;
+	/** Current backoff delay in milliseconds. */
+	currentDelayMs: number;
+	/** Number of consecutive failures. */
+	failureCount: number;
+	/** Whether recovery has been permanently stopped due to max attempts. */
+	stopped: boolean;
+}
+
+/**
+ * Session broker recovery ticks every 30 s (`SESSION_BROKER_RECOVERY_INTERVAL_MS`), so the
+ * first retry waits two ticks and the delay doubles up to 30 minutes: a broker that keeps
+ * failing costs about two spawn attempts per hour at steady state instead of one per tick.
+ * Recovery never stops for good on failures alone -- a broker outage must still heal once
+ * the broker comes back. Only a replaced runtime image ends recovery (session-runtime.ts).
+ */
+const DEFAULTS: RecoveryBackoffConfig = {
+	initialDelayMs: 60_000,
+	maxDelayMs: 30 * 60_000,
+	multiplier: 2,
+	maxAttempts: Number.POSITIVE_INFINITY,
+};
+
+/** Manages per-agent-dir recovery backoff state. */
+export class RecoveryBackoffTracker {
+	#state = new Map<string, RecoveryBackoffState>();
+	#config: RecoveryBackoffConfig;
+	#clock: { now(): number } = { now: Date.now };
+
+	constructor(config: Partial<RecoveryBackoffConfig> = {}) {
+		this.#config = { ...DEFAULTS, ...config };
+	}
+
+	/** Test hook: inject a custom clock. */
+	setClockForTest(clock: { now(): number }): void {
+		this.#clock = clock;
+	}
+
+	/**
+	 * Check if recovery should proceed now, considering backoff.
+	 * Returns true if sufficient time has elapsed since the last failure.
+	 */
+	canAttemptRecovery(agentDir: string): boolean {
+		const state = this.#state.get(agentDir);
+		if (!state) return true;
+		if (state.stopped) return false;
+
+		const now = this.#clock.now();
+		return now >= state.lastFailureAt + state.currentDelayMs;
+	}
+
+	/**
+	 * Record a recovery failure and update backoff state.
+	 * Returns true if recovery should continue to be attempted, false if max attempts reached.
+	 */
+	recordFailure(agentDir: string): boolean {
+		let state = this.#state.get(agentDir);
+		if (!state) {
+			state = {
+				lastFailureAt: this.#clock.now(),
+				currentDelayMs: this.#config.initialDelayMs,
+				failureCount: 1,
+				stopped: false,
+			};
+			this.#state.set(agentDir, state);
+		} else {
+			state.lastFailureAt = this.#clock.now();
+			state.failureCount += 1;
+
+			// Apply exponential backoff
+			state.currentDelayMs = Math.min(state.currentDelayMs * this.#config.multiplier, this.#config.maxDelayMs);
+
+			// Stop if we've hit max attempts
+			if (state.failureCount >= this.#config.maxAttempts) {
+				state.stopped = true;
+			}
+		}
+
+		return !state.stopped;
+	}
+
+	/**
+	 * Record a successful recovery and reset backoff state.
+	 */
+	recordSuccess(agentDir: string): void {
+		this.#state.delete(agentDir);
+	}
+
+	/**
+	 * Get the current backoff state for an agent dir (for testing/diagnostics).
+	 */
+	getState(agentDir: string): RecoveryBackoffState | undefined {
+		return this.#state.get(agentDir);
+	}
+
+	/**
+	 * Get milliseconds until the next recovery attempt can proceed.
+	 */
+	getBackoffWaitMs(agentDir: string): number {
+		const state = this.#state.get(agentDir);
+		if (!state) return 0;
+
+		const now = this.#clock.now();
+		const nextAttemptAt = state.lastFailureAt + state.currentDelayMs;
+		return Math.max(0, nextAttemptAt - now);
+	}
+
+	/**
+	 * Reset all backoff state (for testing).
+	 */
+	resetForTest(): void {
+		this.#state.clear();
+	}
+}

package/src/sdk/broker/runtime.ts

@@ -271,6 +271,15 @@ export function sdkInternalRuntimeImage(): string | undefined {
 	return publishedRuntimeImage({});
 }
 
+/** Identity of a runtime image: enough to detect replacement at the same path. */
+export interface SdkInternalRuntimeImageIdentity {
+	path: string;
+	dev: number;
+	ino: number;
+	mtimeMs: number;
+	size: number;
+}
+
 /** A stat that has not answered by here is inconclusive, never proof of absence. */
 const RUNTIME_IMAGE_PROBE_TIMEOUT_MS = 1_000;
 
@@ -308,6 +317,80 @@ export async function isSdkInternalRuntimeImagePresent(file: string): Promise<bo
 	}
 }
 
+const RUNTIME_IMAGE_PROBE_TIMED_OUT = Symbol("runtime-image-probe-timed-out");
+
+/**
+ * `fsp.stat` bounded by the runtime-image probe timeout. A metadata request on a
+ * stalled mount can never settle; the timeout sentinel lets callers treat that as
+ * inconclusive instead of pending forever.
+ */
+async function statRuntimeImageBounded(file: string): Promise<fs.Stats | typeof RUNTIME_IMAGE_PROBE_TIMED_OUT> {
+	const timedOut = Promise.withResolvers<typeof RUNTIME_IMAGE_PROBE_TIMED_OUT>();
+	const timer: NodeJS.Timeout = setTimeout(
+		() => timedOut.resolve(RUNTIME_IMAGE_PROBE_TIMED_OUT),
+		RUNTIME_IMAGE_PROBE_TIMEOUT_MS,
+	);
+	try {
+		return await Promise.race([fsp.stat(file), timedOut.promise]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+/**
+ * Capture the runtime image identity (dev, ino, mtimeMs, size) at startup.
+ * Used to detect if the binary at the same path has been replaced.
+ */
+export async function captureRuntimeImageIdentity(file: string): Promise<SdkInternalRuntimeImageIdentity | undefined> {
+	try {
+		const resolved = path.resolve(file);
+		const stats = await statRuntimeImageBounded(resolved);
+		// A timed-out probe leaves the identity unknown, like any other failure.
+		if (stats === RUNTIME_IMAGE_PROBE_TIMED_OUT || !stats.isFile()) return undefined;
+		return {
+			path: resolved,
+			dev: stats.dev,
+			ino: stats.ino,
+			mtimeMs: stats.mtimeMs,
+			size: stats.size,
+		};
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Check if the runtime image has been replaced since startup.
+ * Returns `true` if the path is gone, its dev/ino differ from the startup identity,
+ * or its size or modification time changed (an in-place rewrite keeps the inode).
+ * Returns `false` (inconclusive) if the file exists and matches, or on any error.
+ */
+export async function isSdkInternalRuntimeImageReplaced(
+	startupIdentity: SdkInternalRuntimeImageIdentity | undefined,
+): Promise<boolean> {
+	if (startupIdentity === undefined) return false;
+
+	try {
+		const stats = await statRuntimeImageBounded(startupIdentity.path);
+		// A timed-out probe is inconclusive, not proof of replacement.
+		if (stats === RUNTIME_IMAGE_PROBE_TIMED_OUT) return false;
+		if (!stats.isFile()) return false; // Not a file, but not proven gone
+		// dev/ino catch a replacement at the same path; size and mtime catch an
+		// in-place rewrite that keeps the inode (mtime also covers same-size bytes).
+		return (
+			stats.dev !== startupIdentity.dev ||
+			stats.ino !== startupIdentity.ino ||
+			stats.size !== startupIdentity.size ||
+			stats.mtimeMs !== startupIdentity.mtimeMs
+		);
+	} catch (error) {
+		// Only ENOENT/ENOTDIR prove absence
+		if (isProvenRuntimeImageAbsence(error)) return true;
+		// Inconclusive on other errors
+		return false;
+	}
+}
+
 /** Resolve the production descriptor from the statically imported marker and current Bun runtime evidence. */
 export function resolveSdkInternalSpawnCommand(action: SdkInternalAction): SdkInternalSpawnCommand {
 	return resolveSdkInternalSpawnCommandWithEvidence(action, {});

package/src/sdk/broker/startup-budget.ts

@@ -11,6 +11,9 @@ export const MAX_PREPARATION_TIMEOUT_MS = 120_000;
 /** Bounded workspace install window; independent of child semantic readiness. */
 export const DEFAULT_DEPENDENCY_PREPARATION_TIMEOUT_MS = 30_000;
 
+/** Non-worktree broker pre-spawn cap, also limited by the admission window remaining since receipt. */
+export const DEFAULT_BROKER_PRESPAWN_PREPARATION_TIMEOUT_MS = 30_000;
+
 export function isValidReadinessTimeoutMs(value: unknown): value is number {
 	return (
 		typeof value === "number" &&
@@ -98,7 +101,9 @@ export function lifecycleStartupBudgetMs(requestedReadinessTimeoutMs: number): n
  *
  * Worktree launches add independent preparation budgets so git add / install cannot
  * cut the caller while the broker still owns the request. One-arg
- * {@link lifecycleStartupBudgetMs} stays queue+readiness for no-worktree callers.
+ * {@link lifecycleStartupBudgetMs} stays queue+readiness for no-worktree callers:
+ * broker-derived pre-spawn work uses only the unspent admission window from receipt,
+ * and the fresh readiness window ends within that unchanged caller budget.
  */
 export function lifecycleRequestTimeoutMs(operation: string, input: Record<string, unknown>): number | undefined {
 	const deadlineFields = [

package/src/sdk/bus/chat-daemon-control.ts

@@ -141,8 +141,8 @@ export type ChatDaemonAction = "stop" | "reload";
  * crashes, recovery, and attachment retirement cannot replay ambiguous work.
  */
 export const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>> = {
-	discord: 81,
-	slack: 88,
+	discord: 82,
+	slack: 89,
 };
 
 export function chatDaemonGeneration(kind: ChatDaemonKind): number {

package/src/sdk/bus/index.ts

@@ -116,6 +116,7 @@ import { type AbortScope, type ControlSurface, dispatchControl, TypedControlErro
 import { BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD } from "../host/control/runtime-gate";
 import { isAutoroutingInactive, markAutoroutingInactive } from "../host/internal-autorouting-state";
 import { CursorRegistry, QueryHandlers, RevisionStore, type SessionSurface } from "../host/query";
+import { RESPONSE_CEILING_BYTES } from "../host/query/handlers";
 import type { SdkFrame } from "../host/types";
 import {
 	parseSyntheticModelId,
@@ -137,6 +138,7 @@ import {
 	assistantFailureCode,
 	failedPromptOutcome,
 	formatPromptFailureForLocalLog,
+	isSafePromptFailureCode,
 	PROMPT_FAILURE_MESSAGE_DEADLINE,
 	providerDiagnosticField,
 	publishedPromptFailure,
@@ -4246,6 +4248,16 @@ export function shouldAwaitNotificationStartup(event: {
 	return event.type !== "session_switch" || event.transition?.origin !== INTERACTIVE_SELECTOR_RESUME_ORIGIN;
 }
 
+export function boundedCorrelatedAgentEndFrame(frame: Record<string, unknown>): Record<string, unknown> {
+	const finalText = typeof frame.finalText === "string" ? frame.finalText : "";
+	if (finalText.length <= RESPONSE_CEILING_BYTES / 8) return frame;
+	return {
+		...frame,
+		finalText: `${finalText.slice(0, RESPONSE_CEILING_BYTES / 8)}[truncated]`,
+		finalTextTruncated: true,
+	};
+}
+
 export function createNotificationsExtension(
 	api: ExtensionAPI,
 	options: {
@@ -5080,6 +5092,8 @@ export function createNotificationsExtension(
 			acknowledged: boolean;
 			connectionId: string;
 			abandoned: boolean;
+			terminalRetry?: Promise<void>;
+			backlogDropLogged?: boolean;
 			failed: boolean;
 			terminal: boolean;
 			retainCorrelation: boolean;
@@ -5331,6 +5345,289 @@ export function createNotificationsExtension(
 			submission.abandoned = true;
 			submission.bufferedFrames.length = 0;
 		};
+		const isCorrelatedDeltaFrame = (frame: Record<string, unknown>): boolean => {
+			if (frame.type !== "event" || frame.kind !== "message_update") return false;
+			const payload = frame.payload as {
+				event?: { assistantMessageEvent?: { type?: string } };
+			};
+			const type = payload.event?.assistantMessageEvent?.type;
+			return type === "text_delta" || type === "thinking_delta";
+		};
+		const boundedCorrelatedFrames = (frame: Record<string, unknown>): Record<string, unknown>[] | undefined => {
+			if (frame.type === "event" && frame.kind === "message_update") {
+				const payload = frame.payload as {
+					event?: {
+						message?: { role?: string };
+						assistantMessageEvent?: { type?: string; delta?: string };
+					};
+				};
+				const update = payload.event?.assistantMessageEvent;
+				if (update?.type !== "text_delta" && update?.type !== "thinking_delta") return undefined;
+				// ACP consumes deltas, so retain the delta while discarding the replaceable
+				// accumulated message snapshot. Split giant deltas without changing content.
+				const delta = update.delta ?? "";
+				const makeFrame = (chunk: string): Record<string, unknown> => ({
+					...frame,
+					payload: {
+						event_type: "message_update",
+						event: {
+							type: "message_update",
+							message: { role: payload.event?.message?.role ?? "assistant", content: [] },
+							assistantMessageEvent: { type: update.type, delta: chunk },
+						},
+					},
+				});
+				const frames: Record<string, unknown>[] = [];
+				let offset = 0;
+				while (offset < delta.length || (offset === 0 && delta.length === 0)) {
+					let low = 1;
+					let high = delta.length - offset + 1;
+					let bestEnd = 0;
+					while (low < high) {
+						const candidateLength = Math.floor((low + high) / 2);
+						let candidateEnd = offset + candidateLength;
+						if (
+							candidateEnd < delta.length &&
+							delta.charCodeAt(candidateEnd) >= 0xdc00 &&
+							delta.charCodeAt(candidateEnd) <= 0xdfff
+						)
+							candidateEnd += 1;
+						const candidate = JSON.stringify(makeFrame(delta.slice(offset, candidateEnd)));
+						if (Buffer.byteLength(candidate) <= RESPONSE_CEILING_BYTES) {
+							bestEnd = candidateEnd;
+							low = candidateLength + 1;
+						} else {
+							high = candidateLength;
+						}
+					}
+					if (bestEnd === 0) return undefined;
+					frames.push(makeFrame(delta.slice(offset, bestEnd)));
+					offset = bestEnd;
+					if (delta.length === 0) break;
+				}
+				return frames;
+			}
+			if (frame.type === "event" && frame.kind === "message_end") {
+				const payload = frame.payload as {
+					event?: { message?: { role?: string; content?: Array<{ type?: string; text?: string }> } };
+				};
+				const message = payload.event?.message;
+				const textBlocks =
+					message?.content
+						?.filter(
+							(block): block is { type: "text"; text: string } =>
+								block.type === "text" && typeof block.text === "string",
+						)
+						.map(block => block.text) ?? [];
+				const makeMessageEndFrame = (
+					content: Array<{ type: "text"; text: string }>,
+					textTruncated?: true,
+					omittedTextBlocks?: number,
+				): Record<string, unknown> => ({
+					...frame,
+					payload: {
+						event_type: "message_end",
+						event: {
+							type: "message_end",
+							message: {
+								role: message?.role ?? "assistant",
+								content,
+								...(textTruncated ? { textTruncated } : {}),
+								...(omittedTextBlocks ? { omittedTextBlocks } : {}),
+							},
+						},
+					},
+				});
+				const fits = (candidate: Record<string, unknown>): boolean =>
+					Buffer.byteLength(JSON.stringify(candidate)) <= RESPONSE_CEILING_BYTES;
+				const content: Array<{ type: "text"; text: string }> = [];
+				let textTruncated = false;
+				let omittedTextBlocks = 0;
+				for (const [index, textBlock] of textBlocks.entries()) {
+					const wholeBlock = [...content, { type: "text" as const, text: textBlock }];
+					if (fits(makeMessageEndFrame(wholeBlock))) {
+						content.push({ type: "text", text: textBlock });
+						continue;
+					}
+					textTruncated = true;
+					const remainingTextBlocks = textBlocks.length - index;
+					let low = 1;
+					let high = textBlock.length + 1;
+					let bestEnd = 0;
+					while (low < high) {
+						const candidateLength = Math.floor((low + high) / 2);
+						let candidateEnd = candidateLength;
+						if (
+							candidateEnd < textBlock.length &&
+							textBlock.charCodeAt(candidateEnd) >= 0xdc00 &&
+							textBlock.charCodeAt(candidateEnd) <= 0xdfff
+						)
+							candidateEnd += 1;
+						const candidateContent = [
+							...content,
+							...(candidateEnd > 0 ? [{ type: "text" as const, text: textBlock.slice(0, candidateEnd) }] : []),
+						];
+						const candidateOmittedTextBlocks = remainingTextBlocks - (candidateEnd > 0 ? 1 : 0);
+						if (
+							fits(
+								makeMessageEndFrame(
+									candidateContent,
+									true,
+									candidateOmittedTextBlocks > 0 ? candidateOmittedTextBlocks : undefined,
+								),
+							)
+						) {
+							bestEnd = candidateEnd;
+							low = candidateLength + 1;
+						} else high = candidateLength;
+					}
+					if (bestEnd > 0) content.push({ type: "text", text: textBlock.slice(0, bestEnd) });
+					omittedTextBlocks = remainingTextBlocks - (bestEnd > 0 ? 1 : 0);
+					break;
+				}
+				return [
+					makeMessageEndFrame(
+						content,
+						textTruncated ? true : undefined,
+						omittedTextBlocks > 0 ? omittedTextBlocks : undefined,
+					),
+				];
+			}
+			if (frame.type === "agent_end") {
+				return [boundedCorrelatedAgentEndFrame(frame)];
+			}
+			if (frame.type === "agent_failed") {
+				const outcome = frame.outcome as Extract<SdkPromptTerminalOutcome, { kind: "failed" }> | undefined;
+				return [
+					{
+						...frame,
+						error: { code: outcome?.code ?? "prompt_failed", message: "Prompt failure details were truncated." },
+						...(outcome ? { outcome: { ...outcome, message: "Prompt failure details were truncated." } } : {}),
+					},
+				];
+			}
+			return undefined;
+		};
+		const deliverCorrelatedFrame = (submission: PromptSubmission, frame: Record<string, unknown>) => {
+			if (submission.abandoned) return;
+			const activeRuntime = runtime;
+			if (!activeRuntime) return;
+			const fail = (cause: string, frameBytes: number, failedJson = JSON.stringify(frame)) => {
+				// A non-terminal frame only reports progress from a still-running
+				// prompt. Abandon its delivery on failure instead of publishing a
+				// synthetic terminal that could race the real run and make ACP
+				// settle the prompt while provider/tool execution continues.
+				if (frame.type !== "agent_end" && frame.type !== "agent_failed") {
+					if (cause === "writer_backlog_full") {
+						if (!submission.backlogDropLogged) {
+							submission.backlogDropLogged = true;
+							logger.warn(
+								`sdk: correlated non-terminal delivery dropped: cause=${cause} frameBytes=${frameBytes}`,
+							);
+						}
+						return;
+					}
+					logger.warn(`sdk: correlated non-terminal delivery abandoned: cause=${cause} frameBytes=${frameBytes}`);
+					abandonPrompt(submission);
+					return;
+				}
+				if (cause === "writer_backlog_full") {
+					const correlation = { commandId: String(frame.commandId), turnId: String(frame.turnId) };
+					const key = promptSubmissionKey(correlation);
+					submission.terminalRetry = (async () => {
+						const deadline = Date.now() + 3_000;
+						while (Date.now() < deadline) {
+							await Bun.sleep(50);
+							try {
+								activeRuntime.server.sendTo(submission.connectionId, failedJson);
+								return;
+							} catch (retryError) {
+								if (!String(retryError).includes("cause=writer_backlog_full")) break;
+							}
+						}
+						terminalDeliveryFailure(cause, frameBytes);
+					})().finally(() => {
+						submission.terminalRetry = undefined;
+						if (submission.terminal && promptSubmissions.get(key) === submission) {
+							if (!submission.abandoned) submission.phase = "delivered";
+							finalizePrompt(key, correlation);
+						}
+					});
+					return;
+				}
+				terminalDeliveryFailure(cause, frameBytes);
+			};
+			const terminalDeliveryFailure = (cause: string, frameBytes: number) => {
+				const safeCause = isSafePromptFailureCode(cause) ? cause : "unknown";
+				const correlation = { commandId: String(frame.commandId), turnId: String(frame.turnId) };
+				const outcome = failedPromptOutcome({
+					code: "prompt_failed",
+					provenance: "agent_failed",
+					providerCode: safeCause,
+					evidence: {},
+				});
+				try {
+					activeRuntime.server.sendTo(
+						submission.connectionId,
+						JSON.stringify({
+							type: "agent_failed",
+							sessionId: activeRuntime.id,
+							...correlation,
+							error: {
+								code: "delivery_failed",
+								message: "Prompt frame delivery failed.",
+								cause: safeCause,
+								frameBytes,
+							},
+							outcome,
+						}),
+					);
+				} catch (error) {
+					logger.warn(`sdk: correlated delivery failure terminal failed: ${String(error)}`);
+				}
+				abandonPrompt(submission);
+			};
+			const original = JSON.stringify(frame);
+			const originalBytes = Buffer.byteLength(original);
+			let framesToSend = [frame];
+			if (originalBytes > RESPONSE_CEILING_BYTES) {
+				const bounded = boundedCorrelatedFrames(frame);
+				if (!bounded) {
+					if (frame.type === "event" && frame.kind === "message_update" && !isCorrelatedDeltaFrame(frame)) return;
+					fail("oversized_frame", originalBytes);
+					return;
+				}
+				framesToSend = bounded;
+			}
+			for (const frameToSend of framesToSend) {
+				const json = JSON.stringify(frameToSend);
+				if (Buffer.byteLength(json) > RESPONSE_CEILING_BYTES) {
+					fail("oversized_frame", originalBytes);
+					return;
+				}
+				try {
+					activeRuntime.server.sendTo(submission.connectionId, json);
+				} catch (error) {
+					const detail = String(error);
+					if (detail.includes("cause=oversized_frame") && json === original) {
+						const bounded = boundedCorrelatedFrames(frame);
+						if (bounded) {
+							try {
+								for (const retryFrame of bounded)
+									activeRuntime.server.sendTo(submission.connectionId, JSON.stringify(retryFrame));
+								return;
+							} catch (retryError) {
+								logger.warn(`sdk: bounded correlated delivery failed: ${String(retryError)}`);
+							}
+						}
+					}
+					logger.warn(`sdk: correlated delivery failed: ${detail}`);
+					const cause = /cause=([a-z_]+)/.exec(detail)?.[1] ?? "unknown";
+					fail(cause, originalBytes, json);
+					return;
+				}
+			}
+		};
 		const emitPromptLifecycle = (
 			correlation: { commandId: string; turnId: string } | undefined,
 			frame: PromptLifecycleFrame,
@@ -5353,13 +5650,9 @@ export function createNotificationsExtension(
 				submission.bufferedFrames.push(frame);
 				return;
 			}
-			try {
-				runtime.server.sendTo(submission.connectionId, JSON.stringify(frame));
-			} catch (error) {
-				logger.warn(`sdk: correlated lifecycle delivery failed: ${String(error)}`);
-				abandonPrompt(submission);
-			}
+			deliverCorrelatedFrame(submission, frame);
 			if (submission.terminal) {
+				if (submission.terminalRetry) return;
 				submission.phase = "delivered";
 				finalizePrompt(key, correlation);
 			}
@@ -5497,12 +5790,7 @@ export function createNotificationsExtension(
 				submission.bufferedFrames.push(frame);
 				return;
 			}
-			try {
-				runtime.server.sendTo(submission.connectionId, JSON.stringify(frame));
-			} catch (error) {
-				logger.warn(`sdk: correlated agent event delivery failed: ${String(error)}`);
-				abandonPrompt(submission);
-			}
+			deliverCorrelatedFrame(submission, frame);
 		};
 		/**
 		 * Status of a registered deadline expiry attempt after an awaited
@@ -5666,15 +5954,13 @@ export function createNotificationsExtension(
 		};
 		const flushPromptLifecycle = (key: string, submission: PromptSubmission) => {
 			for (const frame of submission.bufferedFrames.splice(0)) {
-				try {
-					server.sendTo(submission.connectionId, JSON.stringify(frame));
-				} catch (error) {
-					logger.warn(`sdk: buffered correlated lifecycle delivery failed: ${String(error)}`);
-					abandonPrompt(submission);
-					break;
-				}
+				deliverCorrelatedFrame(submission, frame);
+				if (submission.abandoned) break;
 			}
 			if (submission.terminal) {
+				if (submission.terminalRetry) {
+					return;
+				}
 				submission.phase = "delivered";
 				const [commandId, turnId] = key.split(":", 2);
 				if (commandId && turnId) finalizePrompt(key, { commandId, turnId });
@@ -9636,10 +9922,10 @@ export function createNotificationsExtension(
 			else if (finalAssistant?.errorKind === "provider_safety_stop")
 				outcome = { kind: "stopped", reason: "refusal", provenance: "agent" };
 			// A missing/normal final assistant with a non-failing loop stop reason is a
-			// normal turn end; only explicit error/aborted assistants or non-completed
-			// loop stop reasons are failures. Text is never parsed.
+			// normal turn end; only explicit error/aborted assistants or other
+			// non-completed loop stop reasons are failures. Text is never parsed.
 			else if (
-				(event.stopReason === undefined || event.stopReason === "completed") &&
+				(event.stopReason === undefined || event.stopReason === "completed" || event.stopReason === "paused") &&
 				finalAssistant?.stopReason !== "error" &&
 				finalAssistant?.stopReason !== "aborted"
 			)

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -297,7 +297,7 @@ export const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 193 gates streamed content on negotiated observer capabilities,
  * so existing owners are replaced before exposing the new observer path.
  */
-export const DAEMON_GENERATION = 196;
+export const DAEMON_GENERATION = 199;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7