@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/async/job-manager.ts

@@ -1,6 +1,7 @@
 import { logger } from "@gajae-code/utils";
 import {
 	lookupOwnedRegistration,
+	migrateOwnedAttemptSaturationsForEndpoint,
 	registerOwnedRegistration,
 	resolveToolLineage,
 	retireOwnedRegistrationForDeadLetter,
@@ -192,7 +193,15 @@ export interface SubagentRecord {
 	 * file, followed by a separately available runner (`no_runner` otherwise).
 	 */
 	resumable: boolean;
-	queued?: { ownerId?: string; seq: number; message?: string; resumeToolCallId?: string; createdAt: number };
+	queued?: {
+		ownerId?: string;
+		seq: number;
+		message?: string;
+		resumeToolCallId?: string;
+		admissionEndpointId?: string;
+		ownedRegistrationEndpointId?: string;
+		createdAt: number;
+	};
 	/** Last queued-resume seq for a CANCELLED queued resume (rec.queued is
 	 *  cleared on cancel): retained on the record so owned settlement's second
 	 *  proof can still see the generation as provably cancelled, without a
@@ -227,6 +236,7 @@ interface OwnerSubagentShutdownRecordCapture {
 	readonly record: SubagentRecord;
 	readonly currentJobId: string | null;
 	readonly currentJobGeneration?: string;
+	readonly queuedSeq?: number;
 }
 
 /** Lightweight, manager-owned resume payload. The async layer treats `data` as opaque. */
@@ -245,6 +255,8 @@ export type ResumeRunner = (
 	message?: string,
 	descriptor?: ResumeDescriptor,
 	resumeToolCallId?: string,
+	admissionEndpointId?: string,
+	ownedRegistrationEndpointId?: string,
 ) => string | undefined;
 
 function sessionFileFromResumeDescriptorData(data: unknown): string | null {
@@ -275,6 +287,9 @@ interface ResumeQueueEntry {
 	ownerId?: string;
 	seq: number;
 	message?: string;
+	resumeToolCallId?: string;
+	admissionEndpointId?: string;
+	ownedRegistrationEndpointId?: string;
 	createdAt: number;
 }
 
@@ -633,7 +648,7 @@ export class AsyncJobManager {
 	 *  resume can neither resolve its lineage nor register its owned tuple
 	 *  (review thread P1). Returns TRUE when the mapping was moved (or no move
 	 *  was needed); returns FALSE when the successor endpoint is owned by a
-	 *  FOREIGN live manager — the transition must then abort or roll back
+	/**
 	 *  BEFORE retiring predecessor state, because leaving this manager under
 	 *  the predecessor while tools resolve the successor to the foreign
 	 *  manager sends jobs to the wrong session and owned aborts lose their
@@ -653,6 +668,11 @@ export class AsyncJobManager {
 		}
 		AsyncJobManager.#byEndpoint.delete(predecessorEndpointId);
 		AsyncJobManager.#byEndpoint.set(successorEndpointId, manager);
+		migrateOwnedAttemptSaturationsForEndpoint(predecessorEndpointId, successorEndpointId);
+		// Migrate queued ownership registrations from the predecessor endpoint to
+		// the successor. The admission endpoint remains unchanged for exact lineage
+		// lookup; each queue entry tracks the separate endpoint used for ownership.
+		manager.#migrateQueuedResumeRegistrations(predecessorEndpointId, successorEndpointId);
 		return true;
 	}
 
@@ -1225,6 +1245,7 @@ export class AsyncJobManager {
 				this.#externallySettled.delete(job.generation);
 				if (this.#jobs.get(id) === job) this.#settledJobs.add(job);
 				this.#settleExecution(execution);
+				if (!this.#disposed && !this.#registrationClosed) this.#drainResumeQueue();
 			})
 			.then(completion.resolve, completion.reject);
 
@@ -1261,13 +1282,19 @@ export class AsyncJobManager {
 	cancel(id: string, filter?: AsyncJobFilter): boolean {
 		if (id.startsWith("queued:")) {
 			// A queued resume (no real job yet): owned settlement cancels it by
-			// removing the queued subagent record and publishing the terminal
-			// (review thread P1).
+			// removing the queued subagent record and publishing the terminal.
+			// Preserve generation identity by checking that the requested sequence
+			// matches the current record's queued sequence (review thread P2).
 			const colon = id.lastIndexOf(":");
 			const subagentId = colon > "queued:".length ? id.slice("queued:".length, colon) : undefined;
 			if (!subagentId) return false;
+			const seqStr = id.slice(colon + 1);
+			// Validate that seqStr is exactly a positive integer without leading zeros (e.g., 1, 123, not 01, 1junk, 1.5)
+			if (!/^[1-9][0-9]*$/.test(seqStr)) return false;
+			const seq = parseInt(seqStr, 10);
+			if (Number.isNaN(seq)) return false;
 			const rec = this.getSubagentRecord(subagentId);
-			if (rec?.status !== "queued") return false;
+			if (rec?.status !== "queued" || rec.queued?.seq !== seq) return false;
 			return this.cancelSubagent(subagentId, filter);
 		}
 		const job = this.#jobs.get(id);
@@ -1383,6 +1410,10 @@ export class AsyncJobManager {
 		if (currentJob && record.currentJobGeneration === undefined) record.currentJobGeneration = currentJob.generation;
 		this.#subagentRecords.set(record.subagentId, record);
 		this.#notifyChange();
+		// Drain stale entries in case this replacement invalidated queued resumes
+		// for the previous owner/generation. Stale-entry retirement is independent
+		// of capacity, so it happens immediately, not waiting for a free slot.
+		this.#drainResumeQueue();
 	}
 
 	/**
@@ -1564,6 +1595,7 @@ export class AsyncJobManager {
 				record,
 				currentJobId: record.currentJobId,
 				currentJobGeneration: record.currentJobGeneration,
+				queuedSeq: record.status === "queued" ? record.queued?.seq : undefined,
 			});
 			if (this.#isTerminalSubagentStatus(record.status) && backingExecution?.physicallySettled !== false) continue;
 			targets.set(record.subagentId, {
@@ -1675,20 +1707,23 @@ export class AsyncJobManager {
 		for (const target of lease.targets) {
 			const executions = state.backingExecutions.get(target.subagentId) ?? [];
 			const capture = state.records.get(target.subagentId);
-			if (
+			const record = capture?.record;
+			const preserveQueuedRecord =
 				target.source === "record" &&
-				capture &&
-				this.#subagentRecords.get(target.subagentId) === capture.record &&
-				capture.record.status === "queued"
-			) {
-				this.cancelSubagent(target.subagentId, { ownerId: lease.ownerId });
-			}
+				target.jobId === null &&
+				capture !== undefined &&
+				record !== undefined &&
+				this.#subagentRecords.get(target.subagentId) === record &&
+				record.ownerId === lease.ownerId &&
+				record.currentJobId === capture.currentJobId &&
+				record.currentJobGeneration === capture.currentJobGeneration &&
+				record.status === "queued" &&
+				record.queued?.seq === capture.queuedSeq;
 			for (const execution of executions) {
-				this.#cancelExactExecution(execution);
+				if (!preserveQueuedRecord) this.#cancelExactExecution(execution);
 				promises.add(execution.physicalCompletion);
 			}
 			if (target.source !== "record" || executions.length > 0) continue;
-			const record = capture?.record;
 			if (!capture || !record || this.#subagentRecords.get(target.subagentId) !== record) continue;
 			if (record.status === "paused") {
 				const row = record.currentJobId ? this.#jobs.get(record.currentJobId) : undefined;
@@ -1737,19 +1772,50 @@ export class AsyncJobManager {
 	): boolean {
 		const capture = state.records.get(target.subagentId);
 		const record = capture?.record;
+		const physicallySettled = (state.backingExecutions.get(target.subagentId) ?? []).every(
+			execution => execution.job.ownerId === ownerId && execution.physicallySettled,
+		);
+		if (!capture || !record) return false;
+
+		// A queued record is terminal only for the captured owner record and generation:
+		// the lease fence keeps it queued until release or commit, and it must not be
+		// cancelled merely to collect shutdown evidence.
+		if (
+			target.source === "record" &&
+			target.jobId === null &&
+			this.#subagentRecords.get(target.subagentId) === record &&
+			record.ownerId === ownerId &&
+			record.currentJobId === capture.currentJobId &&
+			record.currentJobGeneration === capture.currentJobGeneration &&
+			record.status === "queued" &&
+			record.queued?.seq === capture.queuedSeq
+		) {
+			return physicallySettled;
+		}
+
 		if (
-			!record ||
 			this.#subagentRecords.get(target.subagentId) !== record ||
 			record.ownerId !== ownerId ||
-			record.currentJobId !== capture.currentJobId ||
-			record.currentJobGeneration !== capture.currentJobGeneration ||
 			!this.#isTerminalSubagentStatus(record.status)
 		) {
 			return false;
 		}
-		return (state.backingExecutions.get(target.subagentId) ?? []).every(
-			execution => execution.job.ownerId === ownerId && execution.physicallySettled,
-		);
+		if (capture.queuedSeq !== undefined) {
+			const queuedGeneration = `queued:${target.subagentId}:${capture.queuedSeq}`;
+			if (
+				record.status !== "cancelled" ||
+				record.terminalQueuedSeq !== capture.queuedSeq ||
+				record.terminalGeneration !== queuedGeneration
+			) {
+				return false;
+			}
+		} else if (
+			record.currentJobId !== capture.currentJobId ||
+			record.currentJobGeneration !== capture.currentJobGeneration
+		) {
+			return false;
+		}
+		return physicallySettled;
 	}
 
 	#ownerSubagentShutdownProof(
@@ -1771,7 +1837,11 @@ export class AsyncJobManager {
 		};
 	}
 
-	finishOwnerSubagentShutdown(lease: OwnerSubagentShutdownLease, outcome: "commit" | "release"): void {
+	finishOwnerSubagentShutdown(
+		lease: OwnerSubagentShutdownLease,
+		outcome: "commit" | "release",
+		options?: { drainResumeQueue?: boolean },
+	): void {
 		const state = this.#ownerSubagentShutdownLeases.get(lease.ownerId);
 		if (!state || state.lease.id !== lease.id) return;
 		if (outcome === "commit" && state.proof?.confirmed) {
@@ -1780,7 +1850,10 @@ export class AsyncJobManager {
 			this.#purgeOwnerSubagentState(lease.ownerId);
 		}
 		this.#ownerSubagentShutdownLeases.delete(lease.ownerId);
-		if (outcome === "release") this.#ensureDeliveryLoop();
+		if (outcome === "release") {
+			if (options?.drainResumeQueue && !this.#disposed && !this.#registrationClosed) this.#drainResumeQueue();
+			this.#ensureDeliveryLoop();
+		}
 	}
 
 	#recordByJobId(jobId: string, expectedGeneration?: string): SubagentRecord | undefined {
@@ -1851,7 +1924,10 @@ export class AsyncJobManager {
 		if (rec.status === "queued") {
 			if (message !== undefined && rec.queued) {
 				rec.queued.message = message;
-				const queued = this.#resumeQueue.find(entry => entry.subagentId === rec.subagentId);
+				const queued = this.#resumeQueue.find(
+					entry =>
+						entry.subagentId === rec.subagentId && entry.ownerId === rec.ownerId && entry.seq === rec.queued?.seq,
+				);
 				if (queued) queued.message = message;
 				return { ok: true, queued: true, status: "queued" };
 			}
@@ -1864,12 +1940,28 @@ export class AsyncJobManager {
 		if (!this.#resolveResumeRunner(rec, descriptor)) return { ok: false, reason: "no_runner" };
 		if (this.getRunningJobs().length >= this.#maxRunningJobs) {
 			const seq = ++this.#resumeSeq;
+			rec.terminalQueuedSeq = undefined;
 			rec.status = "queued";
+			// Resolve the admission endpoint before queueing: when the manager is
+			// rekeyed before the queue is drained or the subagent is cancelled, we
+			// need the original endpoint to unregister the queued registration.
+			let admissionEndpointId: string | undefined;
+			let ownedRegistrationEndpointId: string | undefined;
+			if (resumeToolCallId) {
+				const managerEndpointId = AsyncJobManager.endpointIdOf(this);
+				const lineage = resolveToolLineage(resumeToolCallId, managerEndpointId);
+				if (lineage) {
+					admissionEndpointId = lineage.endpointId ?? managerEndpointId;
+					ownedRegistrationEndpointId = managerEndpointId ?? lineage.endpointId;
+				}
+			}
 			rec.queued = {
 				ownerId: rec.ownerId,
 				seq,
 				message,
 				...(resumeToolCallId ? { resumeToolCallId } : {}),
+				...(admissionEndpointId ? { admissionEndpointId } : {}),
+				...(ownedRegistrationEndpointId ? { ownedRegistrationEndpointId } : {}),
 				createdAt: Date.now(),
 			};
 			this.#resumeQueue.push({
@@ -1878,6 +1970,8 @@ export class AsyncJobManager {
 				seq,
 				message,
 				...(resumeToolCallId ? { resumeToolCallId } : {}),
+				...(admissionEndpointId ? { admissionEndpointId } : {}),
+				...(ownedRegistrationEndpointId ? { ownedRegistrationEndpointId } : {}),
 				createdAt: rec.queued.createdAt,
 			});
 			// Register the QUEUED generation as owned work of the resume request's
@@ -1890,7 +1984,7 @@ export class AsyncJobManager {
 				if (lineage) {
 					const queuedGeneration = `queued:${rec.subagentId}:${seq}`;
 					registerOwnedRegistration({
-						...(lineage.endpointId ? { endpointId: lineage.endpointId } : {}),
+						...(ownedRegistrationEndpointId ? { endpointId: ownedRegistrationEndpointId } : {}),
 						lineageIdHash: lineage.lineageIdHash,
 						promptAttemptEpoch: lineage.promptAttemptEpoch,
 						endpointGeneration: lineage.endpointGeneration,
@@ -1916,21 +2010,82 @@ export class AsyncJobManager {
 		if (registration) unregisterOwnedRegistration(registration);
 	}
 
+	#migrateQueuedResumeRegistrations(predecessorEndpointId: string, successorEndpointId: string): void {
+		// Keep the admission endpoint for exact lineage lookup, but migrate each
+		// queued ownership tuple with the manager so cleanup and resumed-job
+		// ownership use the successor endpoint.
+
+		// Iterate through both the resume queue and subagent records to migrate all
+		// entries whose owned registration is still at the predecessor endpoint.
+		const processedSeqs = new Set<number>();
+
+		// First pass: migrate queue entries
+		for (const queueEntry of this.#resumeQueue) {
+			const queuedEndpointId =
+				queueEntry.ownedRegistrationEndpointId ?? queueEntry.admissionEndpointId ?? predecessorEndpointId;
+			if (queuedEndpointId === predecessorEndpointId) {
+				processedSeqs.add(queueEntry.seq);
+
+				// Migrate the owned registration from E1 to E2
+				const queuedGeneration = `queued:${queueEntry.subagentId}:${queueEntry.seq}`;
+				const oldReg = lookupOwnedRegistration(queuedGeneration, queuedGeneration, queuedEndpointId);
+				if (oldReg) {
+					unregisterOwnedRegistration(oldReg);
+					registerOwnedRegistration({
+						endpointId: successorEndpointId,
+						lineageIdHash: oldReg.lineageIdHash,
+						promptAttemptEpoch: oldReg.promptAttemptEpoch,
+						endpointGeneration: oldReg.endpointGeneration,
+						jobId: queuedGeneration,
+						jobGeneration: queuedGeneration,
+					});
+				}
+				queueEntry.ownedRegistrationEndpointId = successorEndpointId;
+				const rec = this.#subagentRecords.get(queueEntry.subagentId);
+				if (rec?.queued?.seq === queueEntry.seq) rec.queued.ownedRegistrationEndpointId = successorEndpointId;
+			}
+		}
+
+		// Second pass: check subagent records for queued entries not in the queue
+		// (e.g., entries that were queued before this rekey)
+		for (const [, rec] of this.#subagentRecords) {
+			if (rec.queued && !processedSeqs.has(rec.queued.seq)) {
+				const queuedEndpointId =
+					rec.queued.ownedRegistrationEndpointId ?? rec.queued.admissionEndpointId ?? predecessorEndpointId;
+				if (queuedEndpointId === predecessorEndpointId) {
+					// Migrate the owned registration
+					const queuedGeneration = `queued:${rec.subagentId}:${rec.queued.seq}`;
+					const oldReg = lookupOwnedRegistration(queuedGeneration, queuedGeneration, queuedEndpointId);
+					if (oldReg) {
+						unregisterOwnedRegistration(oldReg);
+						registerOwnedRegistration({
+							endpointId: successorEndpointId,
+							lineageIdHash: oldReg.lineageIdHash,
+							promptAttemptEpoch: oldReg.promptAttemptEpoch,
+							endpointGeneration: oldReg.endpointGeneration,
+							jobId: queuedGeneration,
+							jobGeneration: queuedGeneration,
+						});
+					}
+					rec.queued.ownedRegistrationEndpointId = successorEndpointId;
+				}
+			}
+		}
+	}
+
 	#retireQueuedOwned(rec: SubagentRecord): void {
 		const seq = rec.queued?.seq ?? rec.terminalQueuedSeq;
 		if (seq === undefined) return;
 		const queuedGeneration = `queued:${rec.subagentId}:${seq}`;
-		// Resolve the registration with the resume lineage's ENDPOINT identity:
-		// task ids are session-scoped and each manager's resume sequence starts
-		// locally, so concurrent sessions can both register an identical
-		// queued:<subagent>:<seq> generation — an endpoint-less lookup could
-		// retrieve and unregister the OTHER session's tuple (review thread P1).
-		const endpointId = rec.queued?.resumeToolCallId
-			? (resolveToolLineage(rec.queued.resumeToolCallId, AsyncJobManager.endpointIdOf(this))?.endpointId ??
-				// Fall back to the manager's own registered endpoint when the
-				// binding itself predates endpoint keying or is not found.
-				AsyncJobManager.endpointIdOf(this))
-			: AsyncJobManager.endpointIdOf(this);
+		// The ownership endpoint follows the manager during rekey, while the
+		// admission endpoint remains tied to the original tool lineage.
+		const endpointId =
+			rec.queued?.ownedRegistrationEndpointId ??
+			rec.queued?.admissionEndpointId ??
+			(rec.queued?.resumeToolCallId
+				? resolveToolLineage(rec.queued.resumeToolCallId, AsyncJobManager.endpointIdOf(this))?.endpointId
+				: undefined) ??
+			AsyncJobManager.endpointIdOf(this);
 		const registration = lookupOwnedRegistration(queuedGeneration, queuedGeneration, endpointId);
 		if (registration) unregisterOwnedRegistration(registration);
 	}
@@ -1940,17 +2095,31 @@ export class AsyncJobManager {
 		message: string | undefined,
 		descriptor: ResumeDescriptor | undefined,
 		resumeToolCallId?: string,
+		admissionEndpointId?: string,
+		ownedRegistrationEndpointId?: string,
 	): { ok: boolean; status?: SubagentLifecycle; jobId?: string; reason?: string } {
 		if (this.#isOwnerSubagentShutdownFenced(rec.ownerId)) {
 			return { ok: false, status: rec.status, reason: "owner_shutdown_in_progress" };
 		}
 		const prevJobId = rec.currentJobId;
 		const queuedGeneration = rec.queued?.seq !== undefined ? `queued:${rec.subagentId}:${rec.queued.seq}` : undefined;
+		const queuedEndpointId =
+			ownedRegistrationEndpointId ??
+			rec.queued?.ownedRegistrationEndpointId ??
+			rec.queued?.admissionEndpointId ??
+			AsyncJobManager.endpointIdOf(this);
 		// Clear any retained progress from the previous run so a resumed subagent
 		// never renders the prior run's tool/output as live before it emits again.
 		this.#subagentProgress.delete(rec.subagentId);
 		const runner = this.#resolveResumeRunner(rec, descriptor);
-		const newJobId = runner?.(rec.subagentId, message, descriptor, resumeToolCallId);
+		const newJobId = runner?.(
+			rec.subagentId,
+			message,
+			descriptor,
+			resumeToolCallId,
+			admissionEndpointId ?? rec.queued?.admissionEndpointId,
+			ownedRegistrationEndpointId ?? queuedEndpointId,
+		);
 		if (!newJobId) {
 			// The queued resume FAILED to start: retire its owned registration
 			// so the tuple does not accumulate indefinitely (review thread P2).
@@ -1970,17 +2139,10 @@ export class AsyncJobManager {
 			// causal set has exactly one tuple per job. The EXACT stored tuple
 			// is looked up first — unregisterOwnedRegistration now verifies the
 			// full five-tuple before deleting (review thread P1). The lookup is
-			// ENDPOINT-qualified via the resume lineage: concurrent sessions
-			// mint the same queued:<subagent>:<seq> generation, and the
-			// remaining endpoint-less fallback scan could retrieve and
-			// unregister the OTHER session's tuple (review thread P1).
-			const resumeEndpoint = resumeToolCallId
-				? (resolveToolLineage(resumeToolCallId, AsyncJobManager.endpointIdOf(this))?.endpointId ??
-					// The binding may have been evicted (8192-cap FIFO): fall back
-					// to the manager's own endpoint so the lookup never degrades
-					// into the cross-endpoint scan (review thread P2).
-					AsyncJobManager.endpointIdOf(this))
-				: undefined;
+			// ENDPOINT-qualified by the saved ownership endpoint. The tool lineage
+			// is looked up at admissionEndpointId, but the queued registration may
+			// have moved with the manager during rekey.
+			const resumeEndpoint = queuedEndpointId;
 			const queuedReg = lookupOwnedRegistration(queuedGeneration, queuedGeneration, resumeEndpoint);
 			if (queuedReg) unregisterOwnedRegistration(queuedReg);
 		}
@@ -1992,24 +2154,101 @@ export class AsyncJobManager {
 	#drainResumeQueue(): void {
 		if (this.#resumeQueue.length === 0) return;
 		this.#resumeQueue.sort((a, b) => a.seq - b.seq);
+
+		// First pass: retire stale entries independently of capacity. This ensures
+		// stale registrations are cleaned up even when the pool is saturated.
 		let index = 0;
-		while (index < this.#resumeQueue.length && this.getRunningJobs().length < this.#maxRunningJobs) {
+		while (index < this.#resumeQueue.length) {
 			const entry = this.#resumeQueue[index];
 			const rec = this.#subagentRecords.get(entry.subagentId);
-			if (rec?.status !== "queued") {
+			if (
+				rec?.status !== "queued" ||
+				rec.ownerId !== entry.ownerId ||
+				rec.queued?.ownerId !== entry.ownerId ||
+				rec.queued?.seq !== entry.seq
+			) {
+				// Retire the stale queued registration: the entry no longer matches
+				// the current record state (owner changed, seq mismatch, or record
+				// transitioned away from queued). Unregister its owned tuple so a
+				// later owned abort does not see orphaned work.
+				const staleQueuedGeneration = `queued:${entry.subagentId}:${entry.seq}`;
+				// The tuple follows the manager's ownership endpoint during rekey;
+				// the original admission endpoint remains solely for lineage lookup.
+				const endpointId =
+					entry.ownedRegistrationEndpointId ?? entry.admissionEndpointId ?? AsyncJobManager.endpointIdOf(this);
+				const registration = lookupOwnedRegistration(staleQueuedGeneration, staleQueuedGeneration, endpointId);
+				if (registration) unregisterOwnedRegistration(registration);
+				// Mark the stale generation as terminal so waiters for that exact
+				// generation do not block forever; do NOT update the current record
+				// because it may belong to a different owner/generation.
+				if (!this.#publishedTerminalGenerations.has(staleQueuedGeneration)) {
+					this.#publishedTerminalGenerations.add(staleQueuedGeneration);
+					this.#terminalEvents.set(staleQueuedGeneration, {
+						generation: staleQueuedGeneration,
+						jobId: null,
+						subagentId: entry.subagentId,
+						ownerId: entry.ownerId,
+						status: "cancelled",
+						createdAt: Date.now(),
+					});
+					// Notify any waiters for this exact generation.
+					for (const state of this.#terminalWaits.values()) {
+						if (
+							state.targets.some(
+								target =>
+									target.generation === staleQueuedGeneration ||
+									this.#waitGenerationAliases.get(target.generation) === staleQueuedGeneration,
+							)
+						)
+							this.#maybeResolveWait(state);
+					}
+				}
 				this.#resumeQueue.splice(index, 1);
 				continue;
 			}
+			index += 1;
+		}
+
+		// Second pass: resume valid entries while capacity allows. By this point,
+		// all stale entries have been retired, so we only process entries that
+		// currently match their record state.
+		index = 0;
+		while (index < this.#resumeQueue.length && this.getRunningJobs().length < this.#maxRunningJobs) {
+			const entry = this.#resumeQueue[index];
+			const rec = this.#subagentRecords.get(entry.subagentId);
+			if (rec?.status !== "queued" || rec.ownerId !== entry.ownerId || rec.queued?.seq !== entry.seq) {
+				// This should not happen because we cleaned up all stale entries
+				// in the first pass, but skip if we encounter an unexpected state.
+				index += 1;
+				continue;
+			}
 			if (this.#isOwnerSubagentShutdownFenced(entry.ownerId)) {
 				index += 1;
 				continue;
 			}
+			let priorExecutionActive = false;
+			for (const execution of this.#activeExecutions) {
+				if (
+					execution.job.ownerId === entry.ownerId &&
+					execution.job.metadata?.subagent?.id === entry.subagentId &&
+					!execution.physicallySettled
+				) {
+					priorExecutionActive = true;
+					break;
+				}
+			}
+			if (priorExecutionActive) {
+				index += 1;
+				continue;
+			}
 			try {
 				const result = this.#startResume(
 					rec,
 					entry.message,
 					this.#descriptorForRecord(rec),
 					rec.queued?.resumeToolCallId,
+					entry.admissionEndpointId,
+					entry.ownedRegistrationEndpointId,
 				);
 				if (!result.ok) {
 					if (result.reason === "owner_shutdown_in_progress") {
@@ -2065,8 +2304,10 @@ export class AsyncJobManager {
 			return true;
 		}
 		if (rec.status === "queued") {
-			const idx = this.#resumeQueue.findIndex(e => e.subagentId === rec.subagentId);
 			const queuedSeq = rec.queued?.seq;
+			const idx = this.#resumeQueue.findIndex(
+				e => e.subagentId === rec.subagentId && e.ownerId === rec.ownerId && e.seq === queuedSeq,
+			);
 			if (idx !== -1) this.#resumeQueue.splice(idx, 1);
 			rec.status = "cancelled";
 			if (queuedSeq !== undefined) {
@@ -2089,16 +2330,57 @@ export class AsyncJobManager {
 
 	#purgeOwnerSubagentState(ownerId?: string): void {
 		for (let i = this.#resumeQueue.length - 1; i >= 0; i--) {
-			if (!ownerId || this.#resumeQueue[i].ownerId === ownerId) this.#resumeQueue.splice(i, 1);
+			const entry = this.#resumeQueue[i];
+			if (!ownerId || entry.ownerId === ownerId) {
+				// Retire stale queued registrations BEFORE removing the queue entry:
+				// the purge removes the entry with no start, cancellation, or delivery
+				// boundary, so the registration would otherwise leak into the global
+				// ownership registries and eventually make later owned aborts fail
+				// closed (review thread P2). Use the saved ownership endpoint after
+				// rekey, not the immutable lineage/admission endpoint.
+				const staleQueuedGeneration = `queued:${entry.subagentId}:${entry.seq}`;
+				const endpointId =
+					entry.ownedRegistrationEndpointId ?? entry.admissionEndpointId ?? AsyncJobManager.endpointIdOf(this);
+				const registration = lookupOwnedRegistration(staleQueuedGeneration, staleQueuedGeneration, endpointId);
+				if (registration) unregisterOwnedRegistration(registration);
+				// Also publish a terminal event for this generation so any waiters know it won't resume.
+				if (!this.#publishedTerminalGenerations.has(staleQueuedGeneration)) {
+					this.#publishedTerminalGenerations.add(staleQueuedGeneration);
+					this.#terminalEvents.set(staleQueuedGeneration, {
+						generation: staleQueuedGeneration,
+						jobId: null,
+						subagentId: entry.subagentId,
+						ownerId: entry.ownerId,
+						status: "cancelled",
+						createdAt: Date.now(),
+					});
+					// Notify any waiters for this exact generation.
+					for (const state of this.#terminalWaits.values()) {
+						if (
+							state.targets.some(
+								target =>
+									target.generation === staleQueuedGeneration ||
+									this.#waitGenerationAliases.get(target.generation) === staleQueuedGeneration,
+							)
+						)
+							this.#maybeResolveWait(state);
+					}
+				}
+				this.#resumeQueue.splice(i, 1);
+			}
 		}
 		for (const [sid, rec] of this.#subagentRecords) {
 			if (!ownerId || rec.ownerId === ownerId) {
+				const queuedSeq = rec.status === "queued" ? rec.queued?.seq : undefined;
+				if (queuedSeq !== undefined) {
+					rec.terminalQueuedSeq = queuedSeq;
+					this.#publishQueuedTerminal(sid, `queued:${sid}:${queuedSeq}`, "cancelled");
+				}
 				// Retire the queued resume's owned registration BEFORE deleting the
-				// record: the purge removes the resume-queue entry and record with
-				// no start, cancellation, or delivery boundary, so the registration
-				// would otherwise leak into the global ownership registries and
-				// eventually make later owned aborts fail closed (review thread
-				// P2). #retireQueuedOwned is a no-op for non-queued records.
+				// record: #publishQueuedTerminal above is the wait-notification
+				// boundary for queued work; this removes the corresponding ownership
+				// tuple so it cannot leak into later owned aborts. The helper is a
+				// no-op for non-queued records.
 				this.#retireQueuedOwned(rec);
 				this.#liveHandles.delete(sid);
 				this.#resumeDescriptors.delete(sid);
@@ -2114,6 +2396,24 @@ export class AsyncJobManager {
 			const colon = id.lastIndexOf(":");
 			const subagentId = colon > "queued:".length ? id.slice("queued:".length, colon) : undefined;
 			if (!subagentId) return undefined;
+
+			// Check for stale queued tombstone in terminal events first.
+			// If a queued generation was retired as stale, it's recorded here
+			// for owned settlement to find even if the subagent record is gone.
+			const tombstoneEvent = this.#terminalEvents.get(id);
+			if (tombstoneEvent && id.startsWith(`queued:${subagentId}:`)) {
+				return {
+					id,
+					generation: id,
+					type: "task",
+					status: tombstoneEvent.status as "cancelled" | "failed",
+					startTime: tombstoneEvent.createdAt,
+					label: `stale queued resume ${subagentId}`,
+					abortController: new AbortController(),
+					promise: Promise.resolve(),
+				};
+			}
+
 			const rec = this.getSubagentRecord(subagentId);
 			if (!rec) return undefined;
 			const liveSeq = rec.queued?.seq;