@gajae-code/coding-agent 0.18.10 → 0.18.12

package/dist/types/sdk/broker/ensure.d.ts

@@ -1,9 +1,101 @@
 import { type ChildProcess } from "node:child_process";
 import type { FileHandle } from "node:fs/promises";
 import { type FileLockOptions } from "../../config/file-lock";
+import { type BrokerStartupExitRecord } from "./broker-exit";
 import { type BrokerDiscovery } from "./discovery";
+import { type ProcessIncarnationObservation } from "./process-incarnation";
 import { type SdkInternalSpawnCommand } from "./runtime";
 import { type BrokerStartupFailureMarker } from "./startup-failure";
+/** Result of launching a broker through a hop/trampoline or as an exact fixture child. */
+export interface BrokerSpawnResult {
+    /** The launcher process, or the exact broker process for fixture leases. */
+    process: ChildProcess;
+    /** The real broker's pid (from the launcher reply or exact child). */
+    realBrokerPid: number | undefined;
+    /** Kernel identity returned by the POSIX trampoline when available. */
+    realBrokerIncarnation?: string;
+    handoff?: BrokerLaunchHandoff;
+}
+export interface BrokerLaunchHandoff {
+    release(): Promise<void>;
+    terminate(): Promise<void>;
+}
+/**
+ * Typed error returned when a Windows broker hop fails.
+ * The hop is mandatory on Windows for broker detachment; failure is unrecoverable.
+ */
+export declare class BrokerHopError extends Error {
+    readonly code = "broker_hop_failed";
+    readonly hopExitCode: number | null;
+    readonly hopStdout: string;
+    readonly hopStderr: string;
+    readonly reason: string;
+    constructor(fields: {
+        exitCode: number | null;
+        stdout: string;
+        stderr: string;
+        reason: string;
+    });
+}
+export declare function resolveBrokerLaunchMode(platform: NodeJS.Platform, initiator: "discovery" | "fixture-lease"): "windows-hop" | "posix-trampoline" | "darwin-trampoline" | "direct";
+/** What the parent sends the Windows hop. The broker environment is never serialized here. */
+export interface BrokerHopMessage {
+    command: {
+        file: string;
+        args: string[];
+    };
+    cwd?: string;
+    /** Path (never an inherited fd number) the hop opens for the broker's stderr. */
+    stderrLogPath?: string;
+}
+export interface BrokerLaunchResult {
+    process: ChildProcess;
+    realBrokerPid: number | undefined;
+    realBrokerIncarnation?: string;
+    error: Error | undefined;
+    handoff?: BrokerLaunchHandoff;
+}
+/** Test hook: proves a stuck launcher is terminated at its deadline. */
+export declare function awaitBrokerLauncherForTest(child: ChildProcess, timeoutMs: number, onTimeout?: () => void): Promise<{
+    kind: "closed";
+} | {
+    kind: "timeout";
+    terminated: boolean;
+}>;
+/**
+ * Windows only: launch the broker through the internal hop and await its reply.
+ *
+ * `taskkill /T /F` walks ParentProcessId, so a broker spawned directly by the client
+ * dies with it even when detached. The hop spawns the broker and exits after
+ * the parent acknowledges the complete reply, leaving the broker without a
+ * live parent in the client's tree. The broker inherits the environment set on
+ * the hop, never passed on the command line; stderr is passed as a path because
+ * a parent fd number does not exist inside the hop.
+ */
+export declare function launchBrokerViaHop(message: BrokerHopMessage, options: {
+    env: NodeJS.ProcessEnv;
+    cwd?: string;
+    timeoutMs?: number;
+}): Promise<BrokerLaunchResult>;
+/** Parses the hop's single-line pid/incarnation reply into broker identity or a typed error. */
+export declare function parseBrokerHopReply(code: number | null, stdout: string, spawnError?: Error, stderr?: string): {
+    realBrokerPid: number | undefined;
+    realBrokerIncarnation?: string;
+    error: Error | undefined;
+};
+/** POSIX only: the trampoline holds its exact broker child until the publication decision. */
+export declare function launchBrokerViaPosixTrampoline(agentDir: string, options: {
+    env: NodeJS.ProcessEnv;
+    cwd?: string;
+    stderrFd?: number;
+    timeoutMs?: number;
+    retainChildUntilPublication?: boolean;
+}): Promise<BrokerLaunchResult>;
+export declare function parseBrokerTrampolineReply(code: number | null, stdout: string, spawnError?: Error): {
+    realBrokerPid: number | undefined;
+    realBrokerIncarnation?: string;
+    error: Error | undefined;
+};
 export declare function isBrokerGenerationCompatible(discovery: BrokerDiscovery | null): boolean;
 /**
  * A live incumbent stops being reusable once the runtime image it launches
@@ -29,7 +121,9 @@ export interface EnsureBrokerSettings {
      */
     env?: NodeJS.ProcessEnv;
 }
-export interface BrokerStartupLockTestHooks {
+export interface BrokerStartupLockOptions {
+    /** Stop waiting for the startup lock at this absolute wall-clock deadline. */
+    deadlineAt?: number;
     onAcquired?: () => void;
     onContended?: () => void;
 }
@@ -48,7 +142,7 @@ export declare function emitBrokerStartupTestSignal(signal: string): Promise<voi
  */
 export declare const BROKER_DISCOVERY_BUDGET: {
     readonly staleRetirementMs: 5000;
-    readonly startupLockWaitMs: 9000;
+    readonly startupLockWaitMs: number;
     readonly publicationMs: 15000;
     /** What the startup fence grants its holder: retirement plus one publication attempt. */
     readonly fenceOperationMs: number;
@@ -94,7 +188,7 @@ declare function acquireSpawnLock(agentDir: string, options?: SpawnLockOptions):
  * The parent-held spawn lock prevents ordinary stampedes; this second fence keeps
  * startup single-flight if that detached child's launcher dies and its lock is reclaimed.
  */
-export declare function withBrokerStartupLock<T>(agentDir: string, operation: (deadline: number) => Promise<T>, testHooks?: BrokerStartupLockTestHooks): Promise<T>;
+export declare function withBrokerStartupLock<T>(agentDir: string, operation: (deadline: number) => Promise<T>, options?: BrokerStartupLockOptions): Promise<T>;
 /**
  * Tail of the detached broker's stderr folded into a discovery failure.
  *
@@ -138,13 +232,27 @@ export interface StartedFixtureBroker {
 interface BrokerOwner {
     stop(): Promise<void>;
     canReuse(discovery: BrokerDiscovery | null): boolean;
-    markReady(discovery: BrokerDiscovery): boolean;
-    setTarget(pid: number, incarnation: string): void;
+    markReady(discovery: BrokerDiscovery): Promise<boolean>;
 }
 interface ReapTiming {
     gracefulMs: number;
     killVerifyMs: number;
 }
+type DetachedBrokerSignal = (pid: number, brokerIncarnation: string, signal: NodeJS.Signals) => boolean;
+/**
+ * Reap a broker launched by a short-lived hop or trampoline. The launcher has
+ * already exited, so its ChildProcess carries no signal to await: the real broker
+ * is targeted by the reported pid, and every poll is fenced by incarnation.
+ * Signals use a pinned OS process handle; unsupported platforms fail closed.
+ */
+interface PinnedBrokerProcess {
+    readonly incarnation: string;
+    signalRoot(signal: number): boolean;
+}
+/** Reap a failed launch through its pending trampoline lease or retained broker handle. */
+export declare function reapFailedBrokerLaunch(launch: Pick<BrokerLaunchResult, "process" | "realBrokerPid" | "realBrokerIncarnation" | "handoff">): Promise<void>;
+/** Reap the direct broker child held by the startup trampoline before publication. */
+export declare function reapBrokerTrampolineChild(child: ChildProcess, brokerPid: number | undefined, brokerIncarnation?: string): Promise<void>;
 type BrokerOwnerIdentity = Pick<BrokerDiscovery, "ownerId" | "pid" | "incarnation">;
 /** Start client teardown, but never await it past the retirement operation's absolute deadline. */
 export declare function closeBrokerClientBeforeDeadline(client: {
@@ -173,6 +281,10 @@ export declare function startFixtureBrokerWithLeaseForTest(settings: EnsureBroke
  * Test-only launch surface for topology fixtures. It accepts an already-resolved
  * command and retains the exact spawned child; no production selection path
  * reaches this function.
+ *
+ * Note: This function does NOT use the Windows broker hop. Fixtures are test-only
+ * and do not require Windows process-tree detachment; the fixture needs to retain
+ * exact ownership of the actual broker process to control its stdio[3] control pipe.
  */
 export declare function startFixtureBrokerCommandWithLeaseForTest(command: FixtureBrokerCommand): StartedFixtureBrokerCommand;
 /** Test hook: returns a stop handle for the detached broker this process spawned. */
@@ -183,11 +295,28 @@ export declare function brokerOwnerForTest(agentDir: string): BrokerOwner | unde
 /** Test hook: verifies the complete broker owner identity used during stale retirement. */
 export declare function brokerOwnerIdentityMatchesForTest(left: BrokerOwnerIdentity | null, right: BrokerOwnerIdentity): boolean;
 /** Test hook: drives the detached-broker reap on a controllable child surface. */
-export declare function reapSpawnedBrokerForTest(child: ChildProcess, timing?: ReapTiming): Promise<void>;
+export declare function reapSpawnedBrokerForTest(child: ChildProcess, realBrokerPid?: number, brokerIncarnation?: string, timing?: ReapTiming): Promise<void>;
+/** Test hook: verifies detached PID reaping fences every signal and poll by incarnation. */
+export declare function reapDetachedBrokerPidForTest(pid: number, brokerIncarnation: string | undefined, timing?: ReapTiming, observe?: (pid: number) => ProcessIncarnationObservation, signalProcess?: DetachedBrokerSignal): Promise<void>;
+/** Test hook: verifies a pinned process handle matches before sending a signal. */
+export declare function signalPinnedBrokerProcessForTest(reference: PinnedBrokerProcess | null, expectedIncarnation: string, signal: NodeJS.Signals): boolean;
+/** Test hook: verifies platforms without identity-bound signaling fail closed. */
+export declare function signalDetachedBrokerProcessForTest(pid: number, brokerIncarnation: string, signal: NodeJS.Signals, platform: NodeJS.Platform): boolean;
 /** Test hook: resolves the complete broker environment without spawning. */
 export declare function brokerSpawnEnvironmentForTest(command: SdkInternalSpawnCommand, override?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /** Test hook: installs an exact controllable owner to exercise replacement fencing. */
-export declare function registerBrokerOwnerForTest(agentDir: string, child: ChildProcess, timing?: ReapTiming): BrokerOwner;
+export declare function registerBrokerOwnerForTest(agentDir: string, child: ChildProcess, realBrokerPid?: number, brokerIncarnation?: string, timing?: ReapTiming): BrokerOwner;
 /** Test hook: exercises the same trusted-marker reason reconstruction used by ensureBroker. */
 export declare function brokerStartupFailureReasonForTest(marker: BrokerStartupFailureMarker | undefined): string;
+/** Test hook: verifies typed hop errors survive ensureBroker's spawn-failure mapping. */
+export declare function brokerSpawnFailureErrorForTest(spawnError: Error): Error;
+/** Test hook: preserves and reaps a verified broker reply captured at the hop deadline. */
+export declare function brokerHopTimeoutResultForTest(hop: ChildProcess, stdout: string, stderr: string, timeoutMs: number, launcherTerminated: boolean): Promise<BrokerLaunchResult>;
+/** Test hook: preserves and reaps a verified POSIX trampoline reply at its deadline. */
+export declare function brokerTrampolineTimeoutResultForTest(trampoline: ChildProcess, stdout: string, timeoutMs: number, trampolineTerminated: boolean): Promise<BrokerLaunchResult>;
+/** Test hook: verifies broker exit evidence takes precedence over the launcher's status. */
+export declare function brokerStartupExitStatusForTest(childExitCode: number | null, childSignal: NodeJS.Signals | null, startupExitRecord: Pick<BrokerStartupExitRecord, "exitCode" | "signal"> | undefined, startupFailureMarker: Pick<BrokerStartupFailureMarker, "exitCode" | "signal"> | undefined): {
+    exitCode: number | null;
+    signal: string | null;
+};
 export {};

package/dist/types/sdk/broker/hop.d.ts

@@ -0,0 +1,36 @@
+import * as childProcess from "node:child_process";
+import type * as stream from "node:stream";
+import type { Process } from "@gajae-code/natives";
+export declare const BROKER_HANDOFF_ACKNOWLEDGEMENT = "GJC_BROKER_HANDOFF_ACK\n";
+export declare const BROKER_HANDOFF_COMMIT = "GJC_BROKER_HANDOFF_COMMIT\n";
+export declare const BROKER_HANDOFF_ABORT = "GJC_BROKER_HANDOFF_ABORT\n";
+/**
+ * Windows broker hop: spawns the real broker with detached:true and reports its pid.
+ *
+ * The hop is needed because a broker spawned with detached:true IS still killed when the
+ * parent process tree is terminated (e.g., by taskkill /T /F on Windows). Using an
+ * intermediate hop process that exits after spawning the real broker allows the broker
+ * to survive, because the hop's parent (the initiating client) can be killed without
+ * affecting the broker (the hop's pid is no longer valid).
+ *
+ * Invoked by gjc internals only. Usage:
+ *   gjc internal broker-hop <json-encoded-args>
+ *
+ * Exits with code 0 after writing the broker pid/incarnation to stdout and
+ * receiving the parent's acknowledgement. If stdin closes first, it terminates
+ * the pinned broker and exits with code 1.
+ */
+export declare function runBrokerHopFromArgv(argv: string[]): Promise<void>;
+type BrokerHopWriteCallback = (error?: Error | null) => void;
+type BrokerHopWriter = (chunk: string, callback: BrokerHopWriteCallback) => void;
+type BrokerHopAcknowledger = () => Promise<boolean>;
+export declare function writeBrokerHopReplyForTest(child: childProcess.ChildProcess, reference: Process, pid: number, write: BrokerHopWriter, waitForAcknowledgement?: BrokerHopAcknowledger): Promise<{
+    kind: "written";
+} | {
+    kind: "failed";
+    reason: string;
+}>;
+export declare function waitForBrokerHandoffAcknowledgement(input: stream.Readable): Promise<boolean>;
+/** Wait for a validated identity ACK followed by the parent's publication decision. */
+export declare function waitForBrokerHandoffDecision(input: stream.Readable, timeoutMs?: number): Promise<"commit" | "abort">;
+export {};

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -144,19 +144,27 @@ export declare class LifecycleLedger {
     findByOperationKey(operationKey: string, fingerprint?: string): LifecycleLedgerEntry | undefined;
     findAnyByOperationKey(operationKey: string): LifecycleLedgerEntry | undefined;
     /**
-     * Live or uncertain legacy rows predate the operation/key index. Their opaque
-     * identities cannot establish that a different target is safe, so callers
-     * must reject rather than create a second admission. A fresh session.create
-     * may ignore completed terminal legacy rows so old successful operations do
-     * not block coordinator startup. Other operations retain the legacy fence
-     * because target-bound legacy identities cannot prove key uniqueness. For
-     * target-bound terminal creates, the opaque legacy identity also cannot reveal
-     * the original caller key, so this exception retires that legacy key history;
-     * exact key-only legacy creates are still rejected by the earlier lookup.
+     * Live legacy rows predate the operation/key index. Their opaque identities
+     * cannot establish that a different target is safe, so callers must reject
+     * rather than create a second admission. A fresh session.create may ignore
+     * final legacy rows: exact legacy identities are still resolved before this
+     * check, and uncertain rows retain their session-scoped fences.
+     *
+     * A session-targeted request passes `sessionTarget` to ignore terminal legacy
+     * rows that record only other sessions, unless the row is the caller's key
+     * reused across targets (`keyReuseIdentities`). Terminal rows recording the
+     * target or no session, uncertain rows, and live rows keep the fence because
+     * they cannot prove the requested target is unrelated.
      */
     hasLegacyIdentity(excludedIdentities?: ReadonlySet<string>, options?: {
-        ignoreTerminalRows?: boolean;
+        ignoreFinalRows?: boolean;
+        sessionTarget?: {
+            sessionId: string;
+            keyReuseIdentities: ReadonlySet<string>;
+        };
     }): boolean;
+    /** Sessions recorded by terminal legacy rows, for deriving key-reuse identities. */
+    terminalLegacySessionIds(): Set<string>;
     migrateIdentity(from: string, to: string, metadata: {
         operationKey: string;
         fingerprint: string;

package/dist/types/sdk/broker/lock-host-identity.d.ts

@@ -0,0 +1,5 @@
+export interface BrokerLockHostIdentity {
+    ownerHostId: string;
+    previousOwnerHostIds: readonly string[];
+}
+export declare function brokerLockHostIdentity(agentDir: string): Promise<BrokerLockHostIdentity>;

package/dist/types/sdk/broker/session-index.d.ts

@@ -1,3 +1,4 @@
+import { type FileLockOptions } from "../../config/file-lock";
 import { SDK_STATE_VERSION, SESSION_INDEX_EVENT_VERSION } from "./state-version";
 export type SessionIndexEventType = "host_registered" | "host_heartbeat" | "host_unregistered" | "lifecycle_started" | "lifecycle_terminal" | "session_closed" | "session_deleted" | "record_reconciled";
 export type SessionActivityState = "active" | "idle";
@@ -182,10 +183,12 @@ export declare const SESSION_HEARTBEAT_INTERVAL_MS = 60000;
 export declare const DEAD_HOST_HEARTBEAT_SILENCE_MS: number;
 export declare const DEFAULT_SESSION_RETENTION_MAX_AGE_MS: number;
 export declare const DEFAULT_SESSION_RETENTION_MAX_ROWS = 25000;
+/** Bound ordinary bootstrap waits; authorized doctor successors may use the full prepared window. */
+export declare function sessionIndexStartupLockOptions(deadline: number, signal?: AbortSignal, policy?: "ordinary" | "authorized-successor"): FileLockOptions;
 export declare class SessionIndex {
     #private;
     constructor(agentDir: string, policy?: RetentionPolicy, observationDeps?: SessionIndexObservationDeps);
-    open(): Promise<this>;
+    open(options?: FileLockOptions): Promise<this>;
     replay(): Promise<void>;
     /**
      * Polling-path refresh (#4689): when both index files carry the exact change

package/dist/types/sdk/bus/chat-command-policy.d.ts

@@ -1,8 +1,9 @@
+import { type AdapterValidationError } from "../protocol/adapter-validation";
 import { type Adapter, type OperationKind } from "../protocol/operation-registry";
 export type ChatTransport = Extract<Adapter, "telegram" | "discord" | "slack">;
 export type ChatOperationDisposition = "allowed" | "unsupported_on_chat";
 export interface ChatCommandError {
-    code: "unsupported_on_chat" | "secret_input_forbidden";
+    code: "unsupported_on_chat" | "secret_input_forbidden" | "ultrafast_tier_forbidden" | AdapterValidationError["code"];
     message: string;
 }
 export type ChatCommandDecision = {

package/dist/types/sdk/bus/index.d.ts

@@ -612,6 +612,29 @@ export declare function shouldAwaitNotificationStartup(event: {
     };
 }): boolean;
 export declare function boundedCorrelatedAgentEndFrame(frame: Record<string, unknown>): Record<string, unknown>;
+/** Connection-scoped identity of a queued prompt submission an abort may address. */
+export interface TerminalAbortSubmissionScope {
+    connectionId?: string;
+    terminal: boolean;
+}
+/**
+ * Whether a terminal abort addresses this prompt submission.
+ *
+ * An ordinary abort is scoped to the requesting connection's own prompt: `connectionId`
+ * identifies the connection that submitted it, and a submission that already reached a
+ * terminal state is never addressed. Broker-authorized operator authority
+ * (`TerminalAbortInput.operator`, granted only through the broker control route) is the
+ * documented exception — "operator authority changes only connection ownership, never
+ * those settlement proofs" — so it addresses the session's submission even when another
+ * connection submitted it. Without that override every operator abort issued over a
+ * second connection (the SDK client case, where each request is its own connection)
+ * reported no_active_turn while the turn was still running.
+ */
+export declare function terminalAbortAddressesSubmission(input: {
+    connectionId: string | undefined;
+    operatorAuthorized: boolean;
+    submission: TerminalAbortSubmissionScope;
+}): boolean;
 export declare function createNotificationsExtension(api: ExtensionAPI, options?: {
     settings?: Settings;
     ensureTelegramDaemon?: (input: {

package/dist/types/sdk/bus/reconciliation-store.d.ts

@@ -182,9 +182,19 @@ export interface ReconciliationStore {
     snapshotTerminalScopes(): DurableTerminalScopeRecord[];
     delete(): Promise<void>;
 }
+export interface ReconciliationStoreInstrumentationEvent {
+    at: number;
+    phase: "enqueued" | "started" | "completed" | "failed";
+    operation?: string;
+    substep?: string;
+    error?: string;
+    /** Detailed information about lock acquisition, promise identity, db state, etc. */
+    detail?: string;
+}
 export declare function createReconciliationStore(options: {
     sessionFile: string | null | undefined;
     sessionId: string;
     fs?: ReconciliationStoreFs;
     now?: () => number;
+    onInstrumentationForTests?: (event: ReconciliationStoreInstrumentationEvent) => void;
 }): ReconciliationStore;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -296,8 +296,10 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 202 joins queued-removal terminal publication before ordinary
  * abort acknowledgement, replacing owners that still acknowledge cancellation
  * before its terminal record is durable.
+ * Generation 203 replaces owners that still treat a project `.gjc` file as an
+ * explicit deadline-autosave opt-in for a primary checkout.
  */
-export declare const DAEMON_GENERATION = 202;
+export declare const DAEMON_GENERATION = 204;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/cli/session-cli.d.ts

@@ -45,7 +45,6 @@ export interface RetainedTranscriptTailReader {
 export declare const SDK_JSON_INPUT_FILE_MAX_BYTES: number;
 /** Translate only SDK-owned codes and explicitly allowlisted reconciliation fields. */
 export declare function sdkPublicFailure(code: string, details?: unknown, proof?: PublicEffectProof): PublicCommandFailure;
-/** Lifecycle terminality/retryability is not, by itself, proof of an effect outcome. */
 export declare function lifecyclePublicFailure(outcome: Extract<SessionLifecycleResult, {
     ok: false;
 }>): PublicCommandFailure;

package/dist/types/sdk/host/session-runtime.d.ts

@@ -157,6 +157,8 @@ export interface SdkOnlyTerminalAbortSeams {
     getReconciliationStore?: () => SdkOnlyReconciliationStore | undefined;
     getTerminalTurnEpoch: () => number | undefined;
     getActivePromptHandle: () => string | undefined;
+    onDeadlineRecoveryCheckpointForTests?: (checkpoint: SdkOnlyDeadlineRecoveryCheckpoint) => void;
+    onPersistenceInstrumentationForTests?: (event: PersistenceInstrumentationEvent) => void;
     /** Re-read the active prompt's owning SDK connection for the owner-mismatch
      *  recheck; falls back to the runtime-tracked owner when absent (review
      *  thread P1). */
@@ -196,6 +198,23 @@ export interface SdkOnlyTerminalAbortSeams {
     /** Test override for the maximum durable terminal reservation rows. */
     maxDurableTerminalReservationsForTests?: number;
 }
+export interface SdkOnlyDeadlineRecoveryCheckpoint {
+    at: number;
+    stage: "terminalization-start" | "terminalization-result" | "publication-start" | "publication-result" | "note-transition-start" | "note-transition-awaiting-finalization" | "note-transition-finalization-ready" | "note-transition-before-persist" | "note-transition-persisted" | "note-transition-persist-failed" | "deadline-recovery-retired";
+    correlation: InvocationCorrelation;
+    result?: "settled" | "uncertain" | "published" | "not-published" | "rejected";
+    reason?: string;
+    recordStatus?: string;
+    recordRevision?: number;
+    recordTerminalAt?: number;
+    pendingFinalization?: boolean;
+    eventCaptured?: boolean;
+    eventPrepared?: boolean;
+    terminalCommitted?: boolean;
+    leaseCurrent?: boolean;
+    pendingToolCount?: number;
+    errorCode?: string;
+}
 /**
  * The transport-neutral SDK session runtime.
  *
@@ -354,10 +373,23 @@ export interface InvocationReconciliation {
     }): Promise<void>;
     markUncertain(kind: InvocationKind, correlation: InvocationCorrelation, isCurrent?: () => boolean, deadlineMaxAt?: number): Promise<void>;
 }
+export interface PersistenceInstrumentationEvent {
+    at: number;
+    phase: "enqueued" | "started" | "completed" | "failed";
+    operation?: string;
+    substep?: string;
+    error?: string;
+    /** Detailed information about lock acquisition, promise identity, db state, etc. */
+    detail?: string;
+    /** Time spent waiting (ms) before the operation started. */
+    waitMs?: number;
+}
 export declare function createInvocationReconciliation(options?: {
     stateRoot?: string;
     sessionId?: string;
     store?: SdkOnlyReconciliationStore;
+    onDeadlineRecoveryCheckpointForTests?: (checkpoint: SdkOnlyDeadlineRecoveryCheckpoint) => void;
+    onPersistenceInstrumentationForTests?: (event: PersistenceInstrumentationEvent) => void;
 }): InvocationReconciliation;
 export interface SdkSurfaceFactoryOptions {
     ctx: ExtensionContext;

package/dist/types/sdk/prompt-deadline-flush.d.ts

@@ -44,7 +44,8 @@
  * WHERE it runs. `sdk.flushWorktreeOnDeadline` still defaults to on, but the
  * implicit default applies only in a LINKED worktree (`gitDir !== commonDir`) —
  * what agent/paseo sessions run in, and the #5583 field report. In the user's
- * primary checkout an autosave needs an explicit opt-in.
+ * primary checkout an autosave needs an explicit opt-in from the user/global
+ * config or a runtime override. A project `.gjc` file is not that opt-in.
  */
 export interface PromptDeadlineFlushResult {
     /** Branch the WIP commit landed on, or `undefined` on a detached HEAD. */
@@ -58,9 +59,10 @@ export interface PromptDeadlineFlushOptions {
     /** Active session's agent directory, used to keep volatile broker state out of the WIP commit. */
     readonly agentDir?: string;
     /**
-     * Whether the caller resolved `sdk.flushWorktreeOnDeadline` to `true` from a
-     * value the user actually wrote, rather than from the schema default. Only an
-     * explicit opt-in may autosave outside a linked worktree.
+     * Whether the caller resolved `sdk.flushWorktreeOnDeadline` to `true` from the
+     * user/global config or a runtime override, rather than from the schema
+     * default or a project `.gjc` file. Only that opt-in may autosave outside a
+     * linked worktree.
      */
     readonly explicitOptIn?: boolean;
     /**
@@ -71,6 +73,41 @@ export interface PromptDeadlineFlushOptions {
     readonly isCurrent?: () => boolean;
     readonly signal?: AbortSignal;
 }
+declare const DEADLINE_FLUSH_SETTING = "sdk.flushWorktreeOnDeadline";
+/**
+ * The settings view both deadline hosts already hold. `get` is the merged value
+ * (global, then project, then runtime override, otherwise the schema default).
+ * `getGlobal` and `getOverride` are the layers a project file cannot write.
+ */
+export interface DeadlineFlushSettings {
+    get(path: typeof DEADLINE_FLUSH_SETTING): unknown;
+    getAgentDir?(): string | undefined;
+    getGlobal?(path: typeof DEADLINE_FLUSH_SETTING): unknown;
+    getOverride?(path: typeof DEADLINE_FLUSH_SETTING): unknown;
+}
+/**
+ * True only when the user wrote `sdk.flushWorktreeOnDeadline: true` in a runtime
+ * override or the global config. The schema default and a project `.gjc` file
+ * do not count: `Settings.has()` sees the merged view, so a repo-shipped `true`
+ * would otherwise open the primary-checkout gate.
+ */
+export declare function explicitDeadlineFlushOptIn(settings: DeadlineFlushSettings | undefined): boolean;
+/**
+ * Whether this deadline must not autosave.
+ *
+ * A runtime override wins, then the user/global value. A project file cannot
+ * cancel either one. A project `false` still opts out when the user has not
+ * written the key.
+ */
+export declare function deadlineFlushSuppressed(settings: DeadlineFlushSettings | undefined): boolean;
+/**
+ * Deadline-host entry for the worktree autosave. Both the session runtime and
+ * the notification bus call this so the opt-in decision cannot drift.
+ */
+export declare function autosaveWorktreeOnPromptDeadline(cwd: string, settings: DeadlineFlushSettings | undefined, options?: {
+    readonly isCurrent?: () => boolean;
+    readonly signal?: AbortSignal;
+}): Promise<PromptDeadlineFlushResult | undefined>;
 /**
  * Commit any uncommitted work in the worktree owning `cwd`.
  *
@@ -83,3 +120,4 @@ export interface PromptDeadlineFlushOptions {
  * bound, so a caller that passes nothing still cannot hang here.
  */
 export declare function flushWorktreeOnPromptDeadline(cwd: string, options?: AbortSignal | PromptDeadlineFlushOptions): Promise<PromptDeadlineFlushResult | undefined>;
+export {};

package/dist/types/sdk/prompt-deadline-manager.d.ts

@@ -70,6 +70,8 @@ export declare class PromptDeadlineManager {
          */
         deadlineFlushTimeoutMs?: number;
     });
+    /** Notify about termination check results to adjust retry strategy. */
+    notifyTerminationResult(correlation: InvocationCorrelation, _result: PromptDeadlineTerminalization, reason: string): void;
     onAccepted(correlation: InvocationCorrelation): void;
     /** A new exact agent_start retires an uncertainty-only fence, never captured terminal intent. */
     onRunStarted(correlation: InvocationCorrelation): void;

package/dist/types/sdk/protocol/adapter-validation.d.ts

@@ -3,14 +3,20 @@ type SecretInputError = {
     code: "secret_field_forbidden";
     message: string;
 };
-/** Rejects secret-bearing config patches from model-facing adapter inputs. */
-export declare function validateAdapterSecretFields(operation: string, input: Input): SecretInputError | undefined;
+type UltrafastRestrictionError = {
+    code: "ultrafast_tier_forbidden";
+    message: string;
+};
+/** Rejects secret-bearing and ultrafast-tier config patches from model-facing adapter inputs. */
+export declare function validateAdapterSecretFields(operation: string, input: Input): SecretInputError | UltrafastRestrictionError | undefined;
 export type AdapterValidationError = {
     code: "invalid_reload_component" | "invalid_input";
     message: string;
 };
 /** Rejects instruction-bearing controls before correlation or provider work. */
 export declare function validateRequiredPromptText(operation: string, input: Input): AdapterValidationError | undefined;
-/** Validates controls that adapters must reject before forwarding them to a host. */
-export declare function validateAdapterControl(operation: string, input: Input): AdapterValidationError | undefined;
+/** Validates controls before forwarding them; adapters reject ultrafast unless explicitly trusted. */
+export declare function validateAdapterControl(operation: string, input: Input, options?: {
+    allowUltrafastTier?: boolean;
+}): AdapterValidationError | undefined;
 export {};

package/dist/types/sdk/reconciliation-extensions.d.ts

@@ -1,2 +1,2 @@
 export { createKindAwareReconciliation, type KindAwareReconciliation, type ReconciliationKind, type SteerReconciliationResult, } from "./bus/kind-aware-reconciliation";
-export { createReconciliationStore, type DurableExecutionReconciliationRecord, type DurableReconciliationRecord, type DurableSteerReconciliationRecord, type ReconciliationStore, resolveReconciliationSessionFile, } from "./bus/reconciliation-store";
+export { createReconciliationStore, type DurableExecutionReconciliationRecord, type DurableReconciliationRecord, type DurableSteerReconciliationRecord, type ReconciliationStore, type ReconciliationStoreInstrumentationEvent, resolveReconciliationSessionFile, } from "./bus/reconciliation-store";

package/dist/types/sdk/session-list.d.ts

@@ -1,6 +1,6 @@
 export type SessionListPageRecord = Record<string, unknown>;
 export type SessionListSavedSessionOmissionReason = "scope_unavailable" | "candidate_scan_failed" | "candidate_not_found" | "candidate_ambiguous" | "candidate_invalid" | "identity_incomplete";
-export declare const SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES: readonly ["cwd_missing", "cwd_not_directory", "identity_unavailable", "network_unsupported", "sessions_root_unavailable", "binding_conflict", "binding_invalid", "migration_busy", "managed_gc_journal_capacity_exceeded", "atomic_unavailable", "invalid_request", "durability_failed", "durability_not_provable", "capacity_exceeded", "scan_failed", "unsafe_root", "invalid_candidate", "invalid_header", "unreadable_candidate", "source_changed", "cwd_not_found", "cwd_not_utf8", "cwd_network_unsupported", "cwd_identity_unavailable", "cwd_io_error"];
+export declare const SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES: readonly ["cwd_missing", "cwd_not_directory", "identity_unavailable", "network_unsupported", "sessions_root_unavailable", "binding_conflict", "binding_invalid", "migration_busy", "managed_gc_journal_capacity_exceeded", "atomic_unavailable", "invalid_request", "permission_denied", "durability_failed", "durability_not_provable", "capacity_exceeded", "scan_failed", "unsafe_root", "invalid_candidate", "invalid_header", "unreadable_candidate", "source_changed", "cwd_not_found", "cwd_not_utf8", "cwd_network_unsupported", "cwd_identity_unavailable", "cwd_io_error"];
 export type SessionListSavedSessionOmissionDetailCode = (typeof SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES)[number];
 /** Path-free diagnostic for a requested managed transcript that could not be selected safely. */
 export interface SessionListSavedSessionOmission {