@gajae-code/coding-agent 0.18.6 → 0.18.8

package/src/sdk/host/session-runtime.ts

@@ -5,6 +5,7 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { promisify } from "node:util";
 import { isContinuingMidRunMaintenanceOutcome, isNonDispatchedToolEvent, ThinkingLevel } from "@gajae-code/agent-core";
+import type { AttemptScope } from "@gajae-code/agent-core/attempt-scope";
 import type { Api, ImageContent, Model, ProviderDiagnostic } from "@gajae-code/ai/core";
 
 import { logger } from "@gajae-code/utils";
@@ -229,6 +230,8 @@ class SdkOnlyIdempotencyConflictError extends Error {
  *  the outcome synchronously on its capture slot, while this runtime observes
  *  the publication from the separate `agent_end` handler. */
 const SDK_ONLY_TERMINAL_PUBLICATION_WAIT_MS = 1_000;
+/** Queue-owner cancellation is synchronous in AgentSession; this bound fails closed if its disposition is lost. */
+const SDK_ONLY_QUEUE_CANCELLATION_WAIT_MS = 1_000;
 /** Bounded wait for in-flight workflow gate resolutions to settle during SDK
  *  runtime shutdown before proceeding with cleanup. Unresolved resolutions
  *  after this bound are abandoned — their durable broker state is the recovery
@@ -746,6 +749,49 @@ export interface InvocationCorrelation {
 	turnId: string;
 }
 
+type AcceptedQueueDisposition = "preflight" | "queued" | "consumed" | "promoted" | "removed" | "teardown";
+
+interface AcceptedQueueCancellationResult {
+	removed: boolean;
+	consumed: boolean;
+	unconfirmed: boolean;
+}
+
+interface AcceptedQueueCancellation {
+	correlation: InvocationCorrelation;
+	connectionId: string | undefined;
+	controller: AbortController;
+	accepted: boolean;
+	queueCandidate: boolean;
+	disposition: AcceptedQueueDisposition;
+	dispositionPromise: Promise<AcceptedQueueDisposition>;
+	resolveDisposition: (disposition: AcceptedQueueDisposition) => void;
+	removalTerminalization?: Promise<boolean>;
+	removalFailure?: unknown;
+}
+
+function retireAcceptedQueueCancellation(
+	cancellations: Map<string, AcceptedQueueCancellation>,
+	correlation: InvocationCorrelation,
+	durableTerminalConfirmed = false,
+): void {
+	const key = `${correlation.commandId}:${correlation.turnId}`;
+	const cancellation = cancellations.get(key);
+	if (!cancellation) return;
+	if (!cancellation.controller.signal.aborted) cancellation.controller.abort();
+	if (!durableTerminalConfirmed && cancellation.disposition === "removed" && cancellation.removalTerminalization) {
+		void cancellation.removalTerminalization.then(published => {
+			if (published && cancellations.get(key) === cancellation) cancellations.delete(key);
+		});
+		return;
+	}
+	if (cancellations.get(key) === cancellation) cancellations.delete(key);
+	if (cancellation.disposition === "queued") {
+		cancellation.disposition = "teardown";
+		cancellation.resolveDisposition("teardown");
+	}
+}
+
 export type InvocationKind = "prompt" | "skill" | "steer";
 type InvocationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed" | "uncertain";
 type InvocationOutcome = SdkPromptTerminalOutcome;
@@ -2063,12 +2109,7 @@ function createQuerySurface(
 	};
 	const getProfileCredentialSessionId = () => ctx.credentialSessionId ?? id;
 	const profileSettings = (options.settings ?? ctx.settings) as Pick<Settings, "get"> | undefined;
-	const getProfileAvailableModels = (): Model<Api>[] => {
-		const getAvailableForProfileActivation = ctx.modelRegistry.getAvailableForProfileActivation;
-		return typeof getAvailableForProfileActivation === "function"
-			? getAvailableForProfileActivation.call(ctx.modelRegistry)
-			: ctx.modelRegistry.getAvailable();
-	};
+	const getProfileAvailableModels = (): Model<Api>[] => ctx.modelRegistry.getAvailable();
 	const resolveProfileAvailability = async (
 		profile: ModelProfileDefinition,
 		authenticatedProviders: ReadonlySet<string>,
@@ -2422,6 +2463,9 @@ function createQuerySurface(
 		getExtensions: () => ctx.getExtensions(),
 		getArtifactRange: (artifactId, offset, length) => ctx.getArtifactRange?.(artifactId, offset, length),
 		getJobs: () => ctx.getJobs(),
+		...(typeof (ctx as Partial<ExtensionContext>).getProjectProgress === "function"
+			? { getProjectProgress: () => ctx.getProjectProgress!() }
+			: {}),
 		getPromptStatus: (selector: { commandId?: string; turnId?: string; clientRef?: string }) =>
 			reconciliation.lookup("prompt", selector),
 		getSkillInvokeStatus: (selector: { commandId?: string; turnId?: string; clientRef?: string }) =>
@@ -2694,6 +2738,11 @@ export function providerFailureFromAgentEnd(
 			return undefined;
 		}
 		if (errorKind === "local_snapshot_failure" || errorKind === "local_buffer_overflow") return undefined;
+		if (errorKind === "local_empty_response")
+			return {
+				code: "empty_response",
+				message: PROMPT_FAILURE_MESSAGE_SUBMISSION,
+			};
 		let errorMessage: unknown;
 		try {
 			errorMessage = assistant.errorMessage;
@@ -2874,7 +2923,7 @@ function createControlSurface(
 		connectionId: string | undefined,
 		sdkRunToken: string,
 		promotion?: { startsOwnRun?: boolean; removed?: boolean },
-	) => void,
+	) => undefined | Promise<boolean>,
 	policy?: SdkSurfacePolicy,
 	settings?: Settings,
 	configOverrides?: Map<string, unknown>,
@@ -2895,6 +2944,7 @@ function createControlSurface(
 	trackGateResolution: <T>(resolution: Promise<T>) => Promise<T> = async resolution => await resolution,
 	onInvocationCompletionReconciledForTests?: (kind: InvocationKind, correlation: InvocationCorrelation) => void,
 	publishLifecycleFrame?: (frame: SdkFrame) => void,
+	acceptedQueueCancellations: Map<string, AcceptedQueueCancellation> = new Map(),
 ): ControlSurface {
 	const normalizePromptImages = (value: unknown): ImageContent[] => {
 		if (!Array.isArray(value)) return [];
@@ -2998,6 +3048,49 @@ function createControlSurface(
 		}
 		return pending;
 	};
+	const cancelAcceptedQueueSubmissions = async (
+		connectionId: string | undefined,
+		admittedRequests: readonly AcceptedQueueCancellation[] = [...acceptedQueueCancellations.values()],
+	): Promise<AcceptedQueueCancellationResult> => {
+		const result: AcceptedQueueCancellationResult = { removed: false, consumed: false, unconfirmed: false };
+		if (connectionId === undefined) return result;
+		const owned = admittedRequests.filter(
+			request => request.connectionId === connectionId && request.accepted && request.queueCandidate,
+		);
+		for (const request of owned) {
+			let disposition = request.disposition;
+			if (disposition === "queued") {
+				request.controller.abort();
+				disposition = request.disposition;
+				if (disposition === "queued") {
+					const timedOut = Promise.withResolvers<AcceptedQueueDisposition>();
+					const timer = setTimeout(() => timedOut.resolve("teardown"), SDK_ONLY_QUEUE_CANCELLATION_WAIT_MS);
+					timer.unref();
+					try {
+						disposition = await Promise.race([request.dispositionPromise, timedOut.promise]);
+					} finally {
+						clearTimeout(timer);
+					}
+				}
+			}
+			if (disposition === "removed") {
+				if (await request.removalTerminalization) result.removed = true;
+				else result.unconfirmed = true;
+			} else if (disposition === "consumed" || disposition === "promoted") {
+				result.consumed = true;
+			} else if (disposition === "teardown") {
+				result.unconfirmed = true;
+			}
+		}
+		return result;
+	};
+	const requesterOwnsActiveRun = (connectionId: string | undefined): boolean => {
+		if (connectionId === undefined) return false;
+		const seamOwner = terminalAbortSeams?.getActivePromptOwnerConnectionId?.();
+		return seamOwner === undefined
+			? (activePromptOwner.connectionIds?.has(connectionId) ?? false)
+			: seamOwner === connectionId;
+	};
 	const normalizeClientRef = (clientRef: string | undefined): string | undefined => {
 		if (clientRef === undefined) return undefined;
 		const trimmed = clientRef.trim();
@@ -3012,6 +3105,7 @@ function createControlSurface(
 		clientRef: string | undefined,
 		run: (options: {
 			sdkRunCapability: SdkRunCapability;
+			preflightSignal: AbortSignal;
 			onPreflightAccepted: () => void;
 			onPreflightAcceptCommit: () => Promise<void>;
 			/** Internal disposition before a queued submission is actually consumed. */
@@ -3034,6 +3128,7 @@ function createControlSurface(
 		const sdkRunToken = `${correlation.commandId}:${correlation.turnId}`;
 		const sdkRunCapability = createSdkRunCapability(sdkRunToken);
 		const publishTerminal = (outcome: InvocationOutcome): void => {
+			retireAcceptedQueueCancellation(acceptedQueueCancellations, correlation);
 			publishLifecycleFrame?.({
 				type: "agent_end",
 				sessionId: ctx.sessionManager.getSessionId(),
@@ -3052,9 +3147,22 @@ function createControlSurface(
 			publishTerminal(canonicalFailedOutcome(failure));
 		};
 		const preflight = Promise.withResolvers<void>();
+		const preflightController = new AbortController();
+		const queueDisposition = Promise.withResolvers<AcceptedQueueDisposition>();
+		const queueCancellation: AcceptedQueueCancellation = {
+			correlation,
+			connectionId: requesterConnectionId,
+			controller: preflightController,
+			accepted: false,
+			queueCandidate: false,
+			disposition: "preflight",
+			dispositionPromise: queueDisposition.promise,
+			resolveDisposition: queueDisposition.resolve,
+		};
 		let accepted = false;
 		let settled = false;
 		const cancelPreflight = () => {
+			preflightController.abort();
 			if (settled) return;
 			settled = true;
 			preflight.reject(
@@ -3073,6 +3181,8 @@ function createControlSurface(
 			try {
 				await reconciliation.noteAccepted(kind, correlation, retainedClientRef);
 				accepted = true;
+				queueCancellation.accepted = true;
+				if (queueCancellation.queueCandidate) queueCancellation.disposition = "queued";
 				settled = true;
 				if (kind === "prompt" && startsOwnTurn) armPromptDeadline(correlation);
 				// The accepted submission does NOT own the active turn until its run
@@ -3105,16 +3215,23 @@ function createControlSurface(
 		// Skills always start their own invocation; a plain prompt starts one
 		// only when idle at dispatch time.
 		const startsOwnTurn = kind === "skill" || (kind === "prompt" && !alwaysQueued && !queuedAtDispatch);
+		queueCancellation.queueCandidate = queuedAtDispatch;
+		if (queuedAtDispatch && queueCancellation.accepted) queueCancellation.disposition = "queued";
+		if (kind === "prompt")
+			acceptedQueueCancellations.set(`${correlation.commandId}:${correlation.turnId}`, queueCancellation);
 		let promotionStartsOwnRun: boolean | undefined;
 		try {
 			const submission = Promise.resolve(
 				run({
 					onPreflightAccepted: () => void accept().catch(() => undefined),
+					preflightSignal: preflightController.signal,
 					sdkRunCapability,
 					onPreflightAcceptCommit: accept,
 					onDispatchDisposition: promotion => {
 						promotionStartsOwnRun = promotion.startsOwnRun;
 						if (promotion.startsOwnRun === false) {
+							queueCancellation.queueCandidate = true;
+							if (queueCancellation.accepted) queueCancellation.disposition = "queued";
 							// Dispatch-race diversion (#4668 review P1): the idle snapshot leased
 							// this prompt at acceptance, but it was actually diverted into the
 							// in-flight run's steering queue. While it sits queued — legitimately
@@ -3131,7 +3248,37 @@ function createControlSurface(
 					// terminal-abort that turn (review threads P1/P2).
 					onQueuedPromoted: (promotion?: { startsOwnRun?: boolean; removed?: boolean }) => {
 						promotionStartsOwnRun = promotion?.startsOwnRun;
-						onPromotedTurn?.(kind, correlation, requesterConnectionId, sdkRunToken, promotion);
+						if (promotion?.removed) {
+							queueCancellation.disposition = "removed";
+							queueCancellation.removalTerminalization = (async () => {
+								try {
+									return (
+										(await onPromotedTurn?.(
+											kind,
+											correlation,
+											requesterConnectionId,
+											sdkRunToken,
+											promotion,
+										)) === true
+									);
+								} catch (error) {
+									queueCancellation.removalFailure = error;
+									logger.error("SDK queued prompt terminal publication failed", {
+										commandId: correlation.commandId,
+										turnId: correlation.turnId,
+										error: String(error),
+									});
+									return false;
+								}
+							})();
+							queueCancellation.resolveDisposition("removed");
+							return;
+						}
+						if (queueCancellation.queueCandidate) {
+							queueCancellation.disposition = promotion?.startsOwnRun === false ? "consumed" : "promoted";
+							queueCancellation.resolveDisposition(queueCancellation.disposition);
+						}
+						void onPromotedTurn?.(kind, correlation, requesterConnectionId, sdkRunToken, promotion);
 					},
 					queuedAtDispatch,
 				}),
@@ -3218,6 +3365,7 @@ function createControlSurface(
 				},
 				error => {
 					if (settled) {
+						retireAcceptedQueueCancellation(acceptedQueueCancellations, correlation);
 						// The submission promise rejects after preflight acceptance only when the
 						// work itself is over (provider stream interrupt, abort, queue failure).
 						// The accepted run never started (agent_start never fired), so its pending
@@ -3338,6 +3486,7 @@ function createControlSurface(
 				...(acceptedFields?.() ?? {}),
 			};
 		} catch (error) {
+			retireAcceptedQueueCancellation(acceptedQueueCancellations, correlation);
 			if (!accepted) reconciliation.release(kind, retainedClientRef);
 			throw error;
 		} finally {
@@ -3705,6 +3854,36 @@ function createControlSurface(
 					return boundTerminalRetentionState(state.keys, mutate(state.scopes), terminalReservationLimit);
 				});
 			};
+			const unconfirmedQueueTerminal = async (): Promise<unknown> => {
+				const result = {
+					ok: true,
+					selection: scope,
+					turn: "uncertain",
+					ownedWork: scope === "turn" ? "left_running" : "uncertain",
+					automaticDelivery: scope === "turn" ? "enabled" : "none",
+					resumeOnOwnedCompletion: scope === "turn",
+					reason: "queue_terminal_unconfirmed",
+				};
+				const payloadHash = hashResult(result);
+				await transactBoundedTerminalScopes(scopes =>
+					scopes.map(record =>
+						(keyHash
+							? record.idempotencyKeyHash === keyHash
+							: record.turnContinuationFence.abortedAttemptEpoch === epoch) &&
+						record.turnDisposition === "no_effect_reserved"
+							? {
+									...record,
+									turnDisposition: "uncertain",
+									responsePayloadHash: payloadHash,
+									replayPayloadHash: replayShapedHash(record, result, payloadHash),
+									terminalAt: Date.now(),
+								}
+							: record,
+					),
+				);
+				return result;
+			};
+			const abortingConnectionId = sdkControlRequesterContext.getStore();
 			let handle = terminalAbortSeams.getActivePromptHandle();
 			let epoch = terminalAbortSeams.getTerminalTurnEpoch();
 			// Set when the no-effect reservation found an existing SAME-input row or
@@ -3796,9 +3975,12 @@ function createControlSurface(
 				const recheckedHandle = terminalAbortSeams.getActivePromptHandle();
 				const recheckedEpoch = terminalAbortSeams.getTerminalTurnEpoch();
 				if (!recheckedHandle || recheckedEpoch === undefined) {
-					// No prompt won the race: finalize the reserved row so a later
-					// same-key retry replays this deterministic no_active_turn result
-					// (review thread P2).
+					// An accepted SDK queue owner is independent of the root prompt. Remove
+					// only this requester's exact queued submissions, and do not claim the
+					// root stopped; terminal success waits for each correlated removal
+					// failure+terminal transaction to become durable.
+					const queueCancellation = await cancelAcceptedQueueSubmissions(abortingConnectionId);
+					if (queueCancellation.unconfirmed) return await unconfirmedQueueTerminal();
 					return await returnNoActiveTurn();
 				}
 				handle = recheckedHandle;
@@ -3816,7 +3998,6 @@ function createControlSurface(
 			// per-connection selection of the full bus path. The owner is re-read
 			// through the seam when provided (deterministic tests) and otherwise
 			// from the runtime-tracked accepting connection.
-			const abortingConnectionId = sdkControlRequesterContext.getStore();
 			const currentOwnerConnectionIds = (): ReadonlySet<string> => {
 				const seam = terminalAbortSeams.getActivePromptOwnerConnectionId?.();
 				// The seam reports a single deterministic owner (test harnesses); the
@@ -3864,9 +4045,10 @@ function createControlSurface(
 					abortingConnectionId === undefined ||
 					!recheckedOwners.has(abortingConnectionId)
 				) {
-					// The turn is still not the aborting connection's: finalize the
-					// reserved row so a later same-key retry replays no_active_turn
-					// deterministically (review thread P2).
+					// Request-owned steering cannot borrow the unrelated root's abort
+					// authority. It may still be removed by its exact queue capability.
+					const queueCancellation = await cancelAcceptedQueueSubmissions(abortingConnectionId);
+					if (queueCancellation.unconfirmed) return await unconfirmedQueueTerminal();
 					const noActiveTurnResult = {
 						ok: true,
 						selection: scope,
@@ -4289,6 +4471,26 @@ function createControlSurface(
 			);
 		},
 		abort: async () => {
+			const connectionId = sdkControlRequesterContext.getStore();
+			const ownedAdmissions = [...acceptedQueueCancellations.values()].filter(
+				request => connectionId !== undefined && request.connectionId === connectionId,
+			);
+			const ownedPreflights = connectionId === undefined ? [] : [...(pendingPreflights.get(connectionId) ?? [])];
+			// Capture both phases before cancellation or any awaited terminal work:
+			// acceptance can settle its callback before agent_start owns the run.
+			for (const cancel of ownedPreflights) cancel();
+			let cancelledAdmission = ownedPreflights.length > 0;
+			for (const request of ownedAdmissions) {
+				if (request.disposition !== "preflight" || request.controller.signal.aborted) continue;
+				request.controller.abort();
+				cancelledAdmission = true;
+			}
+			if (connectionId !== undefined && !requesterOwnsActiveRun(connectionId)) {
+				const queueCancellation = await cancelAcceptedQueueSubmissions(connectionId, ownedAdmissions);
+				if (queueCancellation.unconfirmed) return { aborted: false, reason: "queue_terminal_unconfirmed" };
+				if (queueCancellation.removed || cancelledAdmission) return { aborted: true };
+				return { aborted: false, turn: "no_active_turn" };
+			}
 			await Promise.resolve(ctx.abort()).catch(() => undefined);
 			return { aborted: true };
 		},
@@ -4372,8 +4574,8 @@ function createControlSurface(
 		},
 		setModelProfile: id => (ctx.setModelProfile ? ctx.setModelProfile(id) : unavailable("model.profile.set")()),
 		cycleModel: () => (ctx.cycleModel ? ctx.cycleModel() : unavailable("model.cycle")()),
-		setThinking: level => {
-			api.setThinkingLevel(level as never);
+		setThinking: async level => {
+			await api.setThinkingLevelForControl(level as ThinkingLevel, false);
 			return { changed: true };
 		},
 		cycleThinking: () =>
@@ -4628,6 +4830,61 @@ function quiescingFrame(frame: Record<string, unknown>): Record<string, unknown>
 
 /** Install a complete SDK host for a session when notifications are inactive. */
 export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: CreateSdkSessionRuntimeOptions): void {
+	const acceptedQueueCancellations = new Map<string, AcceptedQueueCancellation>();
+	const disposeAcceptedQueueCancellations = async (): Promise<void> => {
+		const cancellations = [...acceptedQueueCancellations.values()];
+		const queuedRemovals = cancellations.filter(
+			cancellation =>
+				cancellation.accepted &&
+				cancellation.queueCandidate &&
+				(cancellation.disposition === "queued" || cancellation.disposition === "removed"),
+		);
+		for (const cancellation of cancellations)
+			if (!cancellation.controller.signal.aborted) cancellation.controller.abort();
+
+		const failures: unknown[] = [];
+		const timedOut = Promise.withResolvers<void>();
+		const timer = setTimeout(timedOut.resolve, SDK_ONLY_QUEUE_CANCELLATION_WAIT_MS);
+		timer.unref();
+		try {
+			await Promise.all(
+				queuedRemovals.map(async cancellation => {
+					const publication = (async (): Promise<boolean> => {
+						const disposition =
+							cancellation.disposition === "queued"
+								? await cancellation.dispositionPromise
+								: cancellation.disposition;
+						if (disposition === "promoted" || disposition === "consumed") return true;
+						return disposition === "removed" && (await cancellation.removalTerminalization) === true;
+					})();
+					const published = await Promise.race([publication, timedOut.promise.then(() => false)]);
+					const key = `${cancellation.correlation.commandId}:${cancellation.correlation.turnId}`;
+					if (published || acceptedQueueCancellations.get(key) !== cancellation) {
+						if (acceptedQueueCancellations.get(key) === cancellation) acceptedQueueCancellations.delete(key);
+					} else {
+						failures.push(
+							cancellation.removalFailure ??
+								new Error(
+									`Queued prompt ${cancellation.correlation.commandId}:${cancellation.correlation.turnId} terminal publication was not confirmed during shutdown.`,
+								),
+						);
+					}
+				}),
+			);
+		} finally {
+			clearTimeout(timer);
+		}
+		for (const cancellation of cancellations) {
+			if (queuedRemovals.includes(cancellation)) continue;
+			const key = `${cancellation.correlation.commandId}:${cancellation.correlation.turnId}`;
+			if (acceptedQueueCancellations.get(key) === cancellation) acceptedQueueCancellations.delete(key);
+		}
+		if (failures.length > 0)
+			throw Object.assign(
+				new AggregateError(failures, "SDK runtime could not durably publish queued prompt cancellations."),
+				{ code: "sdk_reconciliation_teardown_failed" },
+			);
+	};
 	let active:
 		| {
 				sessionId: string;
@@ -4658,6 +4915,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				}>;
 				openLifecycleBatches: Array<{
 					epoch: number;
+					/** Session-initiated starts still reserve their own unmatched end. */
+					unownedStart: boolean;
 					invocations: Array<{
 						kind: InvocationKind;
 						correlation: InvocationCorrelation;
@@ -4713,6 +4972,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		string,
 		{ state: RuntimeState; batch?: LifecycleBatch; correlationKey?: string }
 	>();
+	const lifecycleScopeOwners = new WeakMap<AttemptScope, { state: RuntimeState; batch: LifecycleBatch }>();
 	const lifecycleCorrelationKey = (correlation: InvocationCorrelation): string =>
 		`${correlation.commandId}:${correlation.turnId}`;
 	const sessionIdentityForContext = (ctx: ExtensionContext): string | undefined => {
@@ -4782,13 +5042,18 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		owner.unrecordedFailureReasons?.clear();
 		for (const [token, binding] of lifecycleRunOwners) if (binding.state === owner) lifecycleRunOwners.delete(token);
 	};
+	const hasQueuedTerminalRecovery = (owner: RuntimeState): boolean =>
+		[...acceptedQueueCancellations.values()].some(
+			cancellation => cancellation.disposition === "removed" && owner.deadlineManager.has(cancellation.correlation),
+		);
 	const maybeRetireLifecycleOwner = (owner: RuntimeState): void => {
 		if (
 			owner.pending.length > 0 ||
 			owner.openLifecycleBatches.length > 0 ||
 			(owner.attachedInvocations?.length ?? 0) > 0 ||
 			(owner.drainedInvocations?.length ?? 0) > 0 ||
-			owner.lifecycleTasks.size > 0
+			owner.lifecycleTasks.size > 0 ||
+			hasQueuedTerminalRecovery(owner)
 		)
 			return;
 		removeRetiredLifecycleOwner(owner);
@@ -4809,8 +5074,10 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				entry => lifecycleCorrelationKey(entry.correlation) !== target,
 			);
 		}
+		// Retiring an SDK correlation must not discard an unrelated session-
+		// initiated start. Its delayed end still belongs to that empty batch.
 		owner.openLifecycleBatches = owner.openLifecycleBatches.filter(
-			batch => batch.invocations.length > 0 || batch.attachedInvocations.length > 0,
+			batch => batch.unownedStart || batch.invocations.length > 0 || batch.attachedInvocations.length > 0,
 		);
 		owner.drainedInvocations = owner.drainedInvocations?.filter(
 			entry => lifecycleCorrelationKey(entry.correlation) !== target,
@@ -5089,32 +5356,24 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		stopReason?: AgentEndEvent["stopReason"],
 		startToken?: string,
 		startTokens?: string[],
+		startLifecycleScope?: AttemptScope,
 	): Promise<void> => {
 		const current = lifecycleOwner?.state ?? active;
 		if (!current) return;
 		const failureBatch = lifecycleOwner?.batch;
-		const adoptLifecycleBatch = (
-			batch:
-				| Array<{
-						kind: InvocationKind;
-						correlation: InvocationCorrelation;
-						connectionId: string | undefined;
-				  }>
-				| undefined,
-		): void => {
-			if (!batch || batch.length === 0) {
-				current.activeInvocation = undefined;
-				current.drainedInvocations = undefined;
-				current.attachedInvocations = undefined;
-				if (current === active) activePromptOwnerHolder.connectionIds = undefined;
-				return;
-			}
-			current.activeInvocation = batch[0];
-			current.drainedInvocations = batch.map(({ kind, correlation }) => ({ kind, correlation }));
-			current.attachedInvocations = undefined;
+		const adoptLifecycleBatch = (batch: LifecycleBatch | undefined): void => {
+			current.activeInvocation = batch?.invocations[0];
+			current.drainedInvocations = batch
+				? [...batch.invocations, ...batch.attachedInvocations].map(({ kind, correlation }) => ({
+						kind,
+						correlation,
+					}))
+				: undefined;
+			current.attachedInvocations = batch?.attachedInvocations.slice();
 			const owners = new Set<string>();
-			for (const entry of batch) if (entry.connectionId !== undefined) owners.add(entry.connectionId);
-			if (current === active) activePromptOwnerHolder.connectionIds = owners;
+			for (const entry of batch?.invocations ?? [])
+				if (entry.connectionId !== undefined) owners.add(entry.connectionId);
+			if (current === active) activePromptOwnerHolder.connectionIds = owners.size > 0 ? owners : undefined;
 		};
 		let transitions: Array<{ kind: InvocationKind; correlation: InvocationCorrelation }> = [];
 		if (type === "agent_failed") {
@@ -5148,13 +5407,18 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			);
 			transitions = [...fallback, ...attached].map(({ kind, correlation }) => ({ kind, correlation }));
 		} else if (type === "agent_start") {
-			current.lifecycleEpoch = ++nextLifecycleEpoch;
+			const scopeOwner = startLifecycleScope ? lifecycleScopeOwners.get(startLifecycleScope) : undefined;
+			const scopeBatch =
+				scopeOwner?.state === current && current.openLifecycleBatches.includes(scopeOwner.batch)
+					? scopeOwner.batch
+					: undefined;
+			current.lifecycleEpoch = scopeBatch?.epoch ?? ++nextLifecycleEpoch;
 			if (current === active) activePromptOwnerHolder.lifecycleEpoch = current.lifecycleEpoch;
 			// Mark lifecycle active even when the drain is empty: a monitor/cron
 			// run started by the session has no SDK pending entry but is still a
 			// real active run that later in-run promotions must attach to instead
-			// of falling back to pending (review P1). Empty drains leave the
-			// previous SDK owner untouched.
+			// of falling back to pending (review P1). Only an explicitly bound
+			// continuation retains a previous public lifecycle boundary.
 			current.lifecycleActive = true;
 			// Drain EVERY entry admitted for this run: a continuation may promote
 			// several follow-ups (each with its own requester correlation) into one
@@ -5175,40 +5439,47 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				typeof startToken === "string" && startToken.length > 0
 					? lifecycleRunOwners.get(startToken)?.batch
 					: undefined;
-			if (drained.length > 0) {
-				const batch: LifecycleBatch = {
+			const continuationBatch =
+				scopeBatch ??
+				(drained.length === 0 && existingTokenBatch && current.openLifecycleBatches.includes(existingTokenBatch)
+					? existingTokenBatch
+					: undefined);
+			let batch: LifecycleBatch;
+			if (!continuationBatch) {
+				// Every new run owns an end, including interactive/monitor runs
+				// without SDK invocations. Their delayed ends must never consume
+				// the next SDK run's terminal receipt.
+				batch = {
 					epoch: current.lifecycleEpoch,
+					unownedStart: drained.length === 0,
 					invocations: drained,
 					attachedInvocations: [],
-					startPublished: false,
+					startPublished: drained.length === 0,
 					heldContentDropped: false,
 					heldContent: [],
 				};
 				current.openLifecycleBatches.push(batch);
-				for (const entry of drained) {
-					lifecycleRunOwners.set(entry.sdkRunToken, {
-						state: current,
-						batch,
-						correlationKey: lifecycleCorrelationKey(entry.correlation),
-					});
-				}
-				adoptLifecycleBatch(drained);
-				for (const entry of drained) {
-					if (entry.kind !== "prompt") continue;
-					if (current.deadlineManager.isExpiring(entry.correlation))
-						current.deadlineManager.captureExpiringRun(entry.correlation);
-					else current.deadlineManager.onRunStarted(entry.correlation);
-				}
-			} else if (existingTokenBatch && current.openLifecycleBatches.includes(existingTokenBatch)) {
-				// A continuation within the same SDK-owned run carries the same token
-				// but has no newly pending invocation. Preserve the established owner so
-				// later chunks and the final terminal remain directed to its submitters.
-				adoptLifecycleBatch(existingTokenBatch.invocations);
 			} else {
-				// An empty drain is an agent-initiated successor run. Clear the
-				// predecessor's SDK owner and active invocation so abort ownership and
-				// tool-progress renewal cannot leak into the successor.
-				adoptLifecycleBatch(undefined);
+				// The producer consumed the predecessor end, or this is the same
+				// token-owned run. Preserve its attached owners and single final end.
+				batch = continuationBatch;
+				batch.invocations.push(...drained);
+				if (drained.length > 0) batch.startPublished = false;
+			}
+			if (startLifecycleScope) lifecycleScopeOwners.set(startLifecycleScope, { state: current, batch });
+			for (const entry of drained) {
+				lifecycleRunOwners.set(entry.sdkRunToken, {
+					state: current,
+					batch,
+					correlationKey: lifecycleCorrelationKey(entry.correlation),
+				});
+			}
+			adoptLifecycleBatch(batch);
+			for (const entry of drained) {
+				if (entry.kind !== "prompt") continue;
+				if (current.deadlineManager.isExpiring(entry.correlation))
+					current.deadlineManager.captureExpiringRun(entry.correlation);
+				else current.deadlineManager.onRunStarted(entry.correlation);
 			}
 			transitions = drained.map(({ kind, correlation }) => ({ kind, correlation }));
 		} else {
@@ -5284,7 +5555,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				transitions.map(({ correlation }) => `${correlation.commandId}:${correlation.turnId}`),
 			);
 			if (
-				!ended.invocations.some(({ correlation }) =>
+				(ended.invocations.length > 0 || ended.attachedInvocations.length > 0) &&
+				![...ended.invocations, ...ended.attachedInvocations].some(({ correlation }) =>
 					transitionKeys.has(`${correlation.commandId}:${correlation.turnId}`),
 				)
 			)
@@ -5331,7 +5603,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 						);
 					}
 					current.openLifecycleBatches = current.openLifecycleBatches.filter(
-						batch => batch.invocations.length > 0,
+						batch => batch.unownedStart || batch.invocations.length > 0 || batch.attachedInvocations.length > 0,
 					);
 					current.drainedInvocations = current.drainedInvocations?.filter(
 						entry =>
@@ -5342,7 +5614,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 						current.activeInvocation?.correlation.commandId === invocation.correlation.commandId &&
 						current.activeInvocation.correlation.turnId === invocation.correlation.turnId
 					)
-						adoptLifecycleBatch(current.openLifecycleBatches[0]?.invocations);
+						adoptLifecycleBatch(current.openLifecycleBatches[0]);
 					if (current.openLifecycleBatches.length === 0) current.lifecycleActive = false;
 				} catch (error) {
 					if (controller.signal.aborted) {
@@ -5714,6 +5986,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		}
 		if (type === "agent_end" && isContinuingMidRunMaintenanceOutcome(maintenanceOutcome)) return;
 		if (type === "agent_end") {
+			for (const invocation of transitions)
+				retireAcceptedQueueCancellation(acceptedQueueCancellations, invocation.correlation);
 			if (current.lifecycleEpoch !== eventLifecycleEpoch) {
 				// A successor agent_start won the lifecycle race while this event's
 				// durable transitions were awaiting persistence. Retire the ended
@@ -5763,7 +6037,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 					!current.deadlineManager.shouldDeferTerminalTransition(invocation.correlation)
 				)
 					current.deadlineManager.clear(invocation.correlation);
-			adoptLifecycleBatch(current.openLifecycleBatches[0]?.invocations);
+			adoptLifecycleBatch(current.openLifecycleBatches[0]);
 			if (current.openLifecycleBatches.length === 0) current.lifecycleActive = false;
 			// Resolve EVERY concurrent waiter for the aborted turn: the turn emits
 			// exactly one agent_end, and each admitted abort of it must observe the
@@ -5797,6 +6071,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 					undefined,
 					typeof event.sdkRunToken === "string" ? event.sdkRunToken : undefined,
 					event.sdkRunTokens,
+					event.lifecycleScope,
 				),
 			owner,
 		).catch(error => {
@@ -5965,7 +6240,10 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 	api.on("turn_start", async (_event, ctx) => {
 		const current = lifecycleStateForContext(ctx, "agent_start");
 		if (!current) return;
-		await current.registerBroker();
+		// Optional broker discovery must not hold an interactive extension event open.
+		// registerBroker owns single-flight recovery and optional-failure diagnostics.
+		const registration = current.registerBroker();
+		if (options.brokerRegistrationRequired) await registration;
 		current.runtime.emitEvent({ type: "turn_start", sessionId: ctx.sessionManager.getSessionId() });
 	});
 	const consumedMasterNonces = new Map<string, number>();
@@ -6124,6 +6402,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		return code !== undefined && /^[A-Za-z0-9_.-]{1,64}$/u.test(code) ? code : "unavailable";
 	};
 	const startRuntime = async (ctx: ExtensionContext): Promise<void> => {
+		if (active) return;
+		if (acceptedQueueCancellations.size > 0) await disposeAcceptedQueueCancellations();
 		if (active) return;
 		const sessionId = ctx.sessionManager.getSessionId();
 		const stateRoot = path.join(ctx.cwd, ".gjc", "state");
@@ -6364,6 +6644,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				});
 			},
 			onExpired: correlation => {
+				retireAcceptedQueueCancellation(acceptedQueueCancellations, correlation, true);
 				const owner = lifecycleOwnerHolder.state;
 				if (!owner) return;
 				removeLifecycleReferences(owner, correlation);
@@ -6400,26 +6681,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 					true,
 				);
 		}
-		const openLifecycleBatches: Array<{
-			epoch: number;
-			invocations: Array<{
-				kind: InvocationKind;
-				correlation: InvocationCorrelation;
-				connectionId: string | undefined;
-				sdkRunToken: string;
-			}>;
-			attachedInvocations: Array<{
-				kind: InvocationKind;
-				correlation: InvocationCorrelation;
-				connectionId: string | undefined;
-			}>;
-			startPublished: boolean;
-			heldContentDropped: boolean;
-			heldContent: Array<{
-				event: AgentSessionEvent;
-				recipients: Array<{ correlation: InvocationCorrelation; connectionId: string | undefined }>;
-			}>;
-		}> = [];
+		const openLifecycleBatches: LifecycleBatch[] = [];
 		const configRevision = { current: 0 };
 		let acceptingGateResolutions = true;
 		const inFlightGateResolutions = new Set<Promise<unknown>>();
@@ -6521,9 +6783,9 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			kind: InvocationKind,
 			correlation: InvocationCorrelation,
 			error: { code: string; message: string },
-		): void => {
+		): Promise<boolean> => {
 			if (lifecycleOwnerHolder.state) removeLifecycleTokenAliases(lifecycleOwnerHolder.state, correlation);
-			const attempt = async (remaining: number): Promise<void> => {
+			const attempt = async (remaining: number): Promise<boolean> => {
 				try {
 					// 1. Record the failure reason durably FIRST. If this write fails,
 					// never fall through to agent_end: the record still has no error,
@@ -6546,7 +6808,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 							turnId: correlation.turnId,
 							error: sanitizePromptFailure(reasonError),
 						});
-						return;
+						return false;
 					}
 					await Bun.sleep(1_000);
 					return attempt(remaining - 1);
@@ -6570,6 +6832,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 					});
 					// 3. Release recovery ownership ONLY after durable terminalization.
 					deadlineManager.clear(correlation);
+					if (kind === "prompt") retireAcceptedQueueCancellation(acceptedQueueCancellations, correlation);
+					return true;
 				} catch (transitionError) {
 					// Keep prompt recovery leased; skill recovery has no prompt lease.
 					if (kind === "skill") scheduleSkillRecovery(correlation);
@@ -6580,9 +6844,10 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 						turnId: correlation.turnId,
 						error: sanitizePromptFailure(transitionError),
 					});
+					return false;
 				}
 			};
-			void attempt(3);
+			return attempt(3);
 		};
 
 		const controlSurface = createControlSurface(
@@ -6632,11 +6897,10 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 						});
 				};
 				if (lifecycleOwnerHolder.quiescing) {
-					terminalizeAbandonedSubmission(kind, correlation, {
+					return terminalizeAbandonedSubmission(kind, correlation, {
 						code: "session_quiescing",
 						message: "Session endpoint was replaced before the invocation started.",
 					});
-					return;
 				}
 				// Lease at the ACTUAL promotion boundary (#4668 review): a promoted
 				// submission that wedges before its run's agent_start must still
@@ -6656,11 +6920,10 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 							entry.correlation.turnId === correlation.turnId,
 					);
 					if (pendingIdx >= 0) pending.splice(pendingIdx, 1);
-					terminalizeAbandonedSubmission(kind, correlation, {
+					return terminalizeAbandonedSubmission(kind, correlation, {
 						code: "cancelled",
 						message: "Queued prompt was removed before consumption.",
 					});
-					return;
 				}
 				if (promotion?.startsOwnRun !== false) {
 					// A submission PROMOTED to its own run (finished prompt unwinding)
@@ -6706,7 +6969,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 										entry.correlation.turnId === current.activeInvocation?.correlation.turnId,
 								),
 							)
-						: undefined;
+						: current.openLifecycleBatches.at(-1);
 					const alreadyAttached = current.drainedInvocations.some(
 						entry =>
 							entry.correlation.commandId === correlation.commandId &&
@@ -6813,6 +7076,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			trackGateResolution,
 			options.onInvocationCompletionReconciledForTests,
 			frame => runtime.emitEvent(frame),
+			acceptedQueueCancellations,
 		);
 		const installProviderDefinitions = (capability: string, definitions: unknown): void => {
 			if (capability === "permission") {
@@ -7074,7 +7338,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		};
 		const startupImageCapture = captureStartupRuntimeImage();
 		const registerBroker = async (): Promise<void> => {
-			if (brokerRegistered) return;
+			if (brokerRecoveryStopped || brokerRegistered) return;
 			if (brokerRegistrationInFlight !== undefined) {
 				await brokerRegistrationInFlight;
 				return;
@@ -7107,6 +7371,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 								throw new Error("SDK transport endpoint was not published before broker registration.");
 							const endpointPath = path.join(input.stateRoot, "sdk", `${input.sessionId}.json`);
 							const file = await readEndpointFile(endpointPath);
+							if (brokerRecoveryStopped) return;
 							if (!file) throw new Error("SDK endpoint could not be read as a stable regular file.");
 							const endpoint = JSON.parse(file.source) as Record<string, unknown>;
 							if (
@@ -7310,13 +7575,32 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		active = runtimeOwner;
 		try {
 			publishedEndpointUrl = (await runtime.start()).url;
-			await registerBroker();
+			// Required lifecycle hosts remain fail-closed; optional hosts publish locally
+			// and recover broker availability outside the extension watchdog.
+			const registration = registerBroker();
+			if (options.brokerRegistrationRequired) await registration;
 			// Await the startup runtime image capture before arming recovery.
 			// This ensures replacement detection works correctly on the first recovery check.
 			await startupImageCapture;
-			if (!brokerRecoveryStopped) startBrokerRecovery();
+			// Recovery arms only after the startup attempt settles, so no tick overlaps it, and
+			// a failed startup attempt holds the backoff like a failed recovery registration.
+			const armBrokerRecovery = (): void => {
+				if (brokerRecoveryStopped) return;
+				if (!brokerRegistered) brokerRecoveryBackoff.recordFailure(options.agentDir);
+				startBrokerRecovery();
+			};
+			if (options.brokerRegistrationRequired) armBrokerRecovery();
+			else void registration.then(armBrokerRecovery);
 		} catch (error) {
+			runtimeOwner.quiesceInput();
+			runtimeOwner.fenceGateResolutions();
 			active = undefined;
+			let queueCancellationFailure: unknown;
+			try {
+				await disposeAcceptedQueueCancellations();
+			} catch (cleanupError) {
+				queueCancellationFailure = cleanupError;
+			}
 			stopBrokerRecovery();
 			disposeGate?.();
 			try {
@@ -7356,16 +7640,40 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				};
 				lifecycleOwnerHolder.state = failedRuntimeOwner;
 				active = failedRuntimeOwner;
-				throw new AggregateError([error, cleanupError], "SDK runtime startup failed and cleanup failed.");
+				const failures = [
+					error,
+					...(queueCancellationFailure === undefined ? [] : [queueCancellationFailure]),
+					cleanupError,
+				];
+				const startupFailure = new AggregateError(failures, "SDK runtime startup failed and cleanup failed.");
+				if (queueCancellationFailure !== undefined)
+					Object.assign(startupFailure, { code: "sdk_reconciliation_teardown_failed" });
+				throw startupFailure;
 			}
 			cursors.close();
 			await revisions.close().catch(() => undefined);
+			if (queueCancellationFailure !== undefined)
+				throw Object.assign(
+					new AggregateError(
+						[error, queueCancellationFailure],
+						"SDK runtime startup failed with queued cancellation publication errors.",
+					),
+					{ code: "sdk_reconciliation_teardown_failed" },
+				);
 			throw error;
 		}
 	};
 	const stopActive = async (cancelSkillRecovery = false, unregisterReason?: "detached_idle"): Promise<void> => {
 		const current = active;
 		if (!current) return;
+		current.quiesceInput();
+		current.fenceGateResolutions();
+		let queueCancellationFailure: unknown;
+		try {
+			await disposeAcceptedQueueCancellations();
+		} catch (cleanupError) {
+			queueCancellationFailure = cleanupError;
+		}
 		if (cancelSkillRecovery) {
 			for (const controller of skillRecoveryControllers.values()) controller.abort();
 			for (const controller of skillTerminalRecoveryControllers.values()) controller.abort();
@@ -7373,8 +7681,6 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		activePromptOwnerHolder.connectionIds = undefined;
 		activePromptOwnerHolder.lifecycleEpoch = undefined;
 		current.stopBrokerRecovery();
-		current.quiesceInput();
-		current.fenceGateResolutions();
 		try {
 			await current.waitForGateResolutionQuiescence();
 			if (current.lifecycleTasks.size > 0) {
@@ -7395,7 +7701,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				current.openLifecycleBatches.length > 0 ||
 				(current.attachedInvocations?.length ?? 0) > 0 ||
 				(current.drainedInvocations?.length ?? 0) > 0 ||
-				current.lifecycleTasks.size > 0;
+				current.lifecycleTasks.size > 0 ||
+				hasQueuedTerminalRecovery(current);
 			if (retainsLifecycleWork) {
 				const owners = retiredLifecycleOwners.get(current.sessionId) ?? [];
 				if (!owners.includes(current)) owners.push(current);
@@ -7407,7 +7714,8 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 						current.openLifecycleBatches.length > 0 ||
 						(current.attachedInvocations?.length ?? 0) > 0 ||
 						(current.drainedInvocations?.length ?? 0) > 0 ||
-						current.lifecycleTasks.size > 0
+						current.lifecycleTasks.size > 0 ||
+						hasQueuedTerminalRecovery(current)
 					) {
 						const retry = setTimeout(retryCleanup, LIFECYCLE_QUIESCENCE_MS);
 						retry.unref();
@@ -7431,10 +7739,19 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			// shutdown from retrying the failed endpoint removal.
 			if (active === undefined) active = current;
 			logger.error("sdk runtime stop failed", { code: errorCode(error), error: String(error) });
+			if (queueCancellationFailure !== undefined)
+				throw Object.assign(
+					new AggregateError(
+						[queueCancellationFailure, error],
+						"SDK runtime stop and queued cancellation publication both failed.",
+					),
+					{ code: "sdk_reconciliation_teardown_failed" },
+				);
 			throw error;
 		}
 		current.cursors.close();
 		await current.revisions.close();
+		if (queueCancellationFailure !== undefined) throw queueCancellationFailure;
 	};
 	api.on("session_start", async (_event, ctx) => {
 		await startRuntime(ctx);