@jini-ai/daemon 0.6.8 → 0.6.10

package/dist/run/core/retry.js

@@ -160,6 +160,46 @@ function transientSuppressedReason(category, detail, stage) {
     }
     return 'non_retryable_category';
 }
+/** Side effects that make a same-run retry unsafe (it could duplicate work the user already saw),
+ *  in the order they are reported when several were observed. `cancelRequested` is not listed: it is
+ *  checked earlier, ahead of the failure signal itself. */
+const SIDE_EFFECT_SUPPRESSIONS = [
+    ['userVisibleOutputSeen', 'user_visible_output_seen'],
+    ['toolCallSeen', 'tool_call_seen'],
+    ['artifactWriteSeen', 'artifact_write_seen'],
+    ['liveArtifactSeen', 'live_artifact_seen'],
+];
+function sideEffectSuppressedReason(sideEffects) {
+    const observed = SIDE_EFFECT_SUPPRESSIONS.find(([flag]) => Boolean(sideEffects[flag]));
+    return observed === undefined ? null : observed[1];
+}
+// A non-retryable category is reported ahead of the `retryable` flag, while the other transient
+// reasons (an unknown category, an unsafe stage) are reported only after it.
+function failureSuppressedReason(failure) {
+    if (!failure)
+        return 'missing_failure_signal';
+    if (failure.failure_detail === 'hard_quota')
+        return 'hard_quota';
+    const transientReason = transientSuppressedReason(failure.failure_category, failure.failure_detail, failure.failure_stage);
+    if (transientReason === 'non_retryable_category')
+        return transientReason;
+    if (!failure.retryable)
+        return 'not_retryable';
+    return transientReason;
+}
+/** The first reason (in policy order) that suppresses a retry, or `null` when a retry is safe. */
+function retrySuppressedReason(input) {
+    if (input.result !== 'failed')
+        return 'not_failed';
+    if (input.sideEffects.cancelRequested)
+        return 'cancel_requested';
+    const failureReason = failureSuppressedReason(input.failure);
+    if (failureReason !== null)
+        return failureReason;
+    if (input.attemptCount >= input.retryMaxAttempts)
+        return 'attempt_limit_reached';
+    return sideEffectSuppressedReason(input.sideEffects);
+}
 /**
  * Decides whether a failed run should be automatically retried and, if so, schedules the delay.
  * Suppresses retries when the run was cancelled, emitted user-visible output, or hit a non-transient failure.
@@ -167,52 +207,28 @@ function transientSuppressedReason(category, detail, stage) {
  * @returns A `RunRetryPolicyDecision` with `shouldRetry: true` and a delay, or `shouldRetry: false` with a suppression reason.
  */
 export function decideSafeRunRetry(requiredArgs, optionalArgs = {}) {
-    const input = { ...requiredArgs, ...optionalArgs };
-    const attemptCount = normalizeAttemptCount(input.attemptCount);
-    const retryMaxAttempts = normalizeMaxAttempts(input.maxAttempts);
+    const attemptCount = normalizeAttemptCount(requiredArgs.attemptCount);
+    const retryMaxAttempts = normalizeMaxAttempts(optionalArgs.maxAttempts);
     const retryAttemptIndex = attemptCount + 1;
     const base = {
         retryAttemptIndex,
         retryMaxAttempts,
         retryStrategy: SAFE_RUN_RETRY_STRATEGY,
     };
-    const suppress = (retrySuppressedReason) => ({
-        ...base,
-        shouldRetry: false,
-        retrySuppressedReason,
+    const reason = retrySuppressedReason({
+        result: requiredArgs.result,
+        failure: optionalArgs.failure,
+        sideEffects: optionalArgs.sideEffects ?? {},
+        attemptCount,
+        retryMaxAttempts,
     });
-    if (input.result !== 'failed')
-        return suppress('not_failed');
-    const sideEffects = input.sideEffects ?? {};
-    if (sideEffects.cancelRequested)
-        return suppress('cancel_requested');
-    const failure = input.failure;
-    if (!failure)
-        return suppress('missing_failure_signal');
-    if (failure.failure_detail === 'hard_quota')
-        return suppress('hard_quota');
-    const transientReason = transientSuppressedReason(failure.failure_category, failure.failure_detail, failure.failure_stage);
-    if (transientReason === 'non_retryable_category')
-        return suppress(transientReason);
-    if (!failure.retryable)
-        return suppress('not_retryable');
-    if (transientReason)
-        return suppress(transientReason);
-    if (attemptCount >= retryMaxAttempts)
-        return suppress('attempt_limit_reached');
-    if (sideEffects.userVisibleOutputSeen)
-        return suppress('user_visible_output_seen');
-    if (sideEffects.toolCallSeen)
-        return suppress('tool_call_seen');
-    if (sideEffects.artifactWriteSeen)
-        return suppress('artifact_write_seen');
-    if (sideEffects.liveArtifactSeen)
-        return suppress('live_artifact_seen');
+    if (reason !== null)
+        return { ...base, shouldRetry: false, retrySuppressedReason: reason };
     return {
         ...base,
         shouldRetry: true,
         retryReason: 'transient_failure',
-        retryDelayMs: computeRetryBackoffMs({ attemptIndex: retryAttemptIndex, category: failure.failure_category }, input.random === undefined ? {} : { random: input.random }),
+        retryDelayMs: computeRetryBackoffMs({ attemptIndex: retryAttemptIndex, category: optionalArgs.failure?.failure_category }, optionalArgs.random === undefined ? {} : { random: optionalArgs.random }),
     };
 }
 //# sourceMappingURL=retry.js.map

package/dist/run/diagnostics/diagnostics.js

@@ -2,19 +2,7 @@
 const identityRedactor = ({ text }) => text;
 const STDERR_TAIL_MAX_LINES = 20;
 const STDERR_TAIL_MAX_BYTES = 4 * 1024;
-function readStderrChunk(data) {
-    if (typeof data === 'string')
-        return data;
-    if (!data || typeof data !== 'object' || Array.isArray(data))
-        return null;
-    const obj = data;
-    if (typeof obj.chunk === 'string')
-        return obj.chunk;
-    if (typeof obj.text === 'string')
-        return obj.text;
-    return null;
-}
-function readStdoutChunk(data) {
+function readStreamChunk(data) {
     if (typeof data === 'string')
         return data;
     if (!data || typeof data !== 'object' || Array.isArray(data))
@@ -88,7 +76,7 @@ function collectStreamTailSummary(events, eventName, readChunk, redact) {
  * @returns A `StderrTailSummary` with the last 20 lines (capped at 4 KB) and a truncation flag, or `undefined`.
  */
 export function collectStderrTailSummary(_requiredArgs, { events = [], redact = identityRedactor } = {}) {
-    return collectStreamTailSummary(events, 'stderr', readStderrChunk, redact);
+    return collectStreamTailSummary(events, 'stderr', readStreamChunk, redact);
 }
 /**
  * Collects the tail of the stdout stream from a run's event list, scrubbed by the
@@ -98,7 +86,7 @@ export function collectStderrTailSummary(_requiredArgs, { events = [], redact =
  * @returns A `StdoutTailSummary` with the last 20 lines (capped at 4 KB) and a truncation flag, or `undefined`.
  */
 export function collectStdoutTailSummary(_requiredArgs, { events = [], redact = identityRedactor } = {}) {
-    return collectStreamTailSummary(events, 'stdout', readStdoutChunk, redact);
+    return collectStreamTailSummary(events, 'stdout', readStreamChunk, redact);
 }
 /** The set of `rpc_close_reason` strings a `runtime_close` diagnostic may legitimately carry. */
 const RECOGNIZED_CLOSE_REASONS = new Set([
@@ -136,13 +124,13 @@ function hasVisibleTextDelta(data) {
 /** Accumulates the raw stderr/stdout text carried by this event, if it is a stream chunk. */
 function accumulateStreamChunk(observed, event) {
     if (event.event === 'stderr') {
-        const chunk = readStderrChunk(event.data);
+        const chunk = readStreamChunk(event.data);
         if (chunk)
             observed.stderr += chunk;
         return;
     }
     if (event.event === 'stdout') {
-        const chunk = readStdoutChunk(event.data);
+        const chunk = readStreamChunk(event.data);
         if (chunk) {
             observed.stdout += chunk;
             observed.userVisibleOutputSeen = true;

package/dist/run-credentials.js

@@ -83,31 +83,22 @@ const bearerPattern = /^Bearer[ \t]+(\S+)[ \t]*$/i;
 function notFound(runId, stream) {
     return { allowed: false, status: 404, body: { error: { code: 'NOT_FOUND', message: stream ? 'run was not found' : `run "${runId}" was not found` } } };
 }
-/** Transport-independent bearer gate. Apply principalHeader only after an allowed decision. */
-/** Loopback is not authentication: another local process can reach the daemon. No peer-address
- * exemption is allowed. Missing configuration refuses service (503); bad credentials receive 401.
- * Mount authentication before body parsing and ownership checks. Explicit path exemptions use
- * exact equality and apply only without a credential; presenting one always opts into validation.
- * A run bearer is bound to its run before route allowlisting and overwrites caller identity.
- * Mount the delegated-body gate after parsing so body.runId must also match that credential. */
-export function authorizeDaemonRequest({ request, env, envVarName, principalHeaderName, authorizationHeaderName, crypto, routes }, { exemptPaths = [], runScopedCallers, validateDelegatedRunId = false } = {}) {
-    const authorization = request.headers[authorizationHeaderName];
-    if (exemptPaths.includes(request.path) && authorization === undefined)
-        return { allowed: true };
-    const expected = env[envVarName];
-    if (typeof expected !== 'string' || expected.length === 0)
-        return {
-            allowed: false, status: 503, body: { error: `the agent daemon is not configured: ${envVarName} is unset`, code: 'AGENT_DAEMON_UNCONFIGURED' },
-        };
+/** A presented bearer is the proxy token or a live run credential; anything else, including a
+ * malformed header, is no credential and is never offered to the run resolver. */
+function presentedCredential({ authorization, expected, crypto, runScopedCallers }) {
     const token = bearerPattern.exec(authorization ?? '')?.[1];
-    if (token !== undefined && crypto.tokensMatch({ presented: token, expected }))
-        return { allowed: true };
-    const caller = token === undefined ? undefined : runScopedCallers?.resolveCaller({ token });
-    if (caller === undefined)
-        return { allowed: false, status: 401, body: { error: `Authorization: Bearer <${envVarName}> is required`, code: 'UNAUTHENTICATED' } };
+    if (token === undefined)
+        return undefined;
+    if (crypto.tokensMatch({ presented: token, expected }))
+        return { kind: 'proxy' };
+    const caller = runScopedCallers?.resolveCaller({ token });
+    return caller === undefined ? undefined : { kind: 'run', caller };
+}
+/** Bind a run bearer to its own run before any route allowlisting; undefined means no refusal. */
+function refuseForeignRun({ path, caller, routes }) {
     let target;
     try {
-        target = routes.targetRun({ path: request.path });
+        target = routes.targetRun({ path });
     }
     catch (error) {
         if (!(error instanceof URIError))
@@ -115,16 +106,47 @@ export function authorizeDaemonRequest({ request, env, envVarName, principalHead
         return { allowed: false, status: 400, body: { error: { code: 'BAD_REQUEST', message: 'runId is not valid URL encoding' } } };
     }
     if (target !== undefined && target !== caller.runId)
-        return notFound(target, routes.isEventStream({ path: request.path }));
+        return notFound(target, routes.isEventStream({ path }));
+    return undefined;
+}
+function bodyRunId(body) {
+    return body !== null && typeof body === 'object' ? body['runId'] : undefined;
+}
+function authorizeRunScopedCaller({ request, caller, routes, principalHeaderName, validateDelegatedRunId }) {
+    const foreign = refuseForeignRun({ path: request.path, caller, routes });
+    if (foreign !== undefined)
+        return foreign;
     if (!routes.allowsRunScoped(request))
         return { allowed: false, status: 403, body: { error: `a run-scoped credential cannot call ${request.method} ${request.path}`, code: 'FORBIDDEN' } };
-    if (validateDelegatedRunId && routes.isDelegatedCall(request)) {
-        const bodyRunId = request.body !== null && typeof request.body === 'object' ? request.body['runId'] : undefined;
-        if (bodyRunId !== caller.runId)
-            return { allowed: false, status: 403, body: { error: 'a run-scoped credential requires body.runId to match its own run', code: 'FORBIDDEN' } };
+    if (validateDelegatedRunId && routes.isDelegatedCall(request) && bodyRunId(request.body) !== caller.runId) {
+        return { allowed: false, status: 403, body: { error: 'a run-scoped credential requires body.runId to match its own run', code: 'FORBIDDEN' } };
     }
     return { allowed: true, principalHeader: { name: principalHeaderName, value: caller.principalId } };
 }
+function unconfigured(envVarName) {
+    return { allowed: false, status: 503, body: { error: `the agent daemon is not configured: ${envVarName} is unset`, code: 'AGENT_DAEMON_UNCONFIGURED' } };
+}
+/** Transport-independent bearer gate. Apply principalHeader only after an allowed decision. */
+/** Loopback is not authentication: another local process can reach the daemon. No peer-address
+ * exemption is allowed. Missing configuration refuses service (503); bad credentials receive 401.
+ * Mount authentication before body parsing and ownership checks. Explicit path exemptions use
+ * exact equality and apply only without a credential; presenting one always opts into validation.
+ * A run bearer is bound to its run before route allowlisting and overwrites caller identity.
+ * Mount the delegated-body gate after parsing so body.runId must also match that credential. */
+export function authorizeDaemonRequest({ request, env, envVarName, principalHeaderName, authorizationHeaderName, crypto, routes }, { exemptPaths = [], runScopedCallers, validateDelegatedRunId = false } = {}) {
+    const authorization = request.headers[authorizationHeaderName];
+    if (exemptPaths.includes(request.path) && authorization === undefined)
+        return { allowed: true };
+    const expected = env[envVarName];
+    if (typeof expected !== 'string' || expected.length === 0)
+        return unconfigured(envVarName);
+    const credential = presentedCredential({ authorization, expected, crypto, runScopedCallers });
+    if (credential === undefined)
+        return { allowed: false, status: 401, body: { error: `Authorization: Bearer <${envVarName}> is required`, code: 'UNAUTHENTICATED' } };
+    if (credential.kind === 'proxy')
+        return { allowed: true };
+    return authorizeRunScopedCaller({ request, caller: credential.caller, routes, principalHeaderName, validateDelegatedRunId });
+}
 export function createRunOwnerRegistry(_args, _optional = {}) {
     const owners = new Map();
     return {

package/dist/run-lifecycle.d.ts

@@ -1,3 +1,20 @@
+/**
+ * `RunLifecycle` — start/stream/cancel/resume a run keyed on an opaque
+ * `contextRef` (extraction-plan §2.1: runs key on an opaque `contextRef`,
+ * never a product-record identifier), generalized from OD's `design.runs` service
+ * (`apps/daemon/src/runtimes/runs.ts` + the terminal-decision half of
+ * `apps/daemon/src/runtimes/start-chat-run.ts`, `arch/server-startserver-endgame`
+ * branch — see `archived provenance ledger` for exact line citations).
+ *
+ * Scope boundary: this module owns the run *state machine* and its event
+ * log — create, transition, emit, replay, cancellation-intent propagation,
+ * idempotent start/finish, resume. It does not spawn or signal a subprocess;
+ * that is `@jini-ai/agent-runtime`'s job (extraction-plan task 7). A driver
+ * (today: this package's tests; later: agent-runtime) calls `emit()` for
+ * agent/stdout/stderr/error events, observes cancellation via
+ * `onCancelRequested`, and calls `finish()` once it knows the real outcome.
+ */
+import type { DelegatedResultCorrelation } from './delegated-result-correlation.js';
 import type { RunAgentPayload, RunCancelRequest, RunChunkPayload, RunErrorPayload, RunProtocolEvent, RunStartPayload, RunStatus } from '@jini-ai/protocol';
 import type { EventLog, EventLogEntry, EventLogReplayResult } from './event-log.js';
 import type { InactivityWatchdog, TerminalRunOutcome } from './close-status.js';
@@ -276,6 +293,8 @@ export declare function finishStreamSubscription({ record, subscriber, terminal
     readonly terminal: boolean;
 }): StreamSubscribeResult;
 export interface CreateRunLifecycleInput {
+    /** Share the negotiated bridge/executor digest store so run eviction also releases proofs. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly eventLog: EventLog;
     /** Host-owned sink for asynchronous lifecycle failures that cannot be returned to a caller. Defaults to `console.error`. */
     readonly onInternalError?: (context: RunLifecycleInternalErrorContext) => void;
@@ -283,6 +302,15 @@ export interface CreateRunLifecycleInput {
     readonly terminalRetentionMs?: number;
     /** Hard cap on concurrently-retained terminal run records. See {@link DEFAULT_MAX_TERMINAL_RUNS}. Defaults to that constant. */
     readonly maxTerminalRuns?: number;
+    /**
+     * When `true`, evicting a terminal run record (retention timer or `maxTerminalRuns` cap) also calls
+     * `eventLog.drop()` for it, giving the run's events the same lifetime as its record. Off by default
+     * because a durable adapter's `drop()` deletes stored rows (`@jini-ai/daemon/store/event-log/sqlite`),
+     * which would turn a memory bound into data loss for a host that never asked for it; a host whose
+     * log is in-memory only can opt in. A failed drop is reported through `onInternalError`
+     * (`source: 'event-log-drop'`).
+     */
+    readonly dropEventsOnEviction?: boolean;
     /**
      * How long a run may go with no agent-event `emit()` (excluding the notice itself) before a `'slow_running'` agent event tells the UI the
      * turn is taking longer than usual — never a terminating action; see
@@ -295,7 +323,7 @@ export interface CreateRunLifecycleInput {
     readonly slowRunThresholdMs?: number | null;
 }
 export interface RunLifecycleInternalErrorContext {
-    readonly source: 'inactivity-timeout' | 'slow-run-notice';
+    readonly source: 'inactivity-timeout' | 'slow-run-notice' | 'event-log-drop';
     readonly runId: string;
     readonly error: unknown;
 }
@@ -305,9 +333,10 @@ export interface RunLifecycleInternalErrorContext {
  * @param input.eventLog - The durable `EventLog` port this lifecycle appends to and replays from.
  * @param input.terminalRetentionMs - See {@link CreateRunLifecycleInput.terminalRetentionMs}.
  * @param input.maxTerminalRuns - See {@link CreateRunLifecycleInput.maxTerminalRuns}.
+ * @param input.dropEventsOnEviction - See {@link CreateRunLifecycleInput.dropEventsOnEviction}.
  * @returns A `RunLifecycle` backed by an in-memory run registry plus the injected `EventLog`.
  * @complexity Per-call complexities documented on each method; the registry itself is a `Map` keyed by `runId` (O(1) lookup). Memory is bounded: non-terminal runs are O(n) in concurrently-live runs, and terminal runs are capped at `maxTerminalRuns` (each additionally bounded in retention time by `terminalRetentionMs`) rather than growing for the life of the process.
  * @overallScore 100/100
  */
-export declare function createRunLifecycle(requiredArgs: Pick<CreateRunLifecycleInput, "eventLog">, optionalArgs?: Pick<CreateRunLifecycleInput, "onInternalError" | "terminalRetentionMs" | "maxTerminalRuns" | "slowRunThresholdMs">): RunLifecycle;
+export declare function createRunLifecycle(requiredArgs: Pick<CreateRunLifecycleInput, "eventLog">, optionalArgs?: Pick<CreateRunLifecycleInput, "onInternalError" | "terminalRetentionMs" | "maxTerminalRuns" | "slowRunThresholdMs" | "dropEventsOnEviction" | "delegatedResultCorrelation">): RunLifecycle;
 //# sourceMappingURL=run-lifecycle.d.ts.map

package/dist/run-lifecycle.js

@@ -1,19 +1,3 @@
-/**
- * `RunLifecycle` — start/stream/cancel/resume a run keyed on an opaque
- * `contextRef` (extraction-plan §2.1: runs key on an opaque `contextRef`,
- * never a product-record identifier), generalized from OD's `design.runs` service
- * (`apps/daemon/src/runtimes/runs.ts` + the terminal-decision half of
- * `apps/daemon/src/runtimes/start-chat-run.ts`, `arch/server-startserver-endgame`
- * branch — see `archived provenance ledger` for exact line citations).
- *
- * Scope boundary: this module owns the run *state machine* and its event
- * log — create, transition, emit, replay, cancellation-intent propagation,
- * idempotent start/finish, resume. It does not spawn or signal a subprocess;
- * that is `@jini-ai/agent-runtime`'s job (extraction-plan task 7). A driver
- * (today: this package's tests; later: agent-runtime) calls `emit()` for
- * agent/stdout/stderr/error events, observes cancellation via
- * `onCancelRequested`, and calls `finish()` once it knows the real outcome.
- */
 import { randomUUID } from 'node:crypto';
 import { RUN_PROTOCOL_VERSION, isTerminalRunState } from '@jini-ai/protocol';
 import { createInactivityWatchdog } from './close-status.js';
@@ -108,7 +92,9 @@ function rehydratedRunRecord(runId, entries) {
             retentionTimer: undefined,
         },
         idempotencyKey,
-        isTerminal: terminal !== null,
+        // Terminal exactly when the log holds an 'end' entry (`terminal` is derived from it), so the
+        // end entry's own timestamp is the terminal time — never a "now" substitute.
+        terminalAt: endEntry?.recordedAt,
     };
 }
 function terminalStateFromEndEntry(entry) {
@@ -303,6 +289,7 @@ function buildNewRunRecord(startInput, runId, now) {
  * @param input.eventLog - The durable `EventLog` port this lifecycle appends to and replays from.
  * @param input.terminalRetentionMs - See {@link CreateRunLifecycleInput.terminalRetentionMs}.
  * @param input.maxTerminalRuns - See {@link CreateRunLifecycleInput.maxTerminalRuns}.
+ * @param input.dropEventsOnEviction - See {@link CreateRunLifecycleInput.dropEventsOnEviction}.
  * @returns A `RunLifecycle` backed by an in-memory run registry plus the injected `EventLog`.
  * @complexity Per-call complexities documented on each method; the registry itself is a `Map` keyed by `runId` (O(1) lookup). Memory is bounded: non-terminal runs are O(n) in concurrently-live runs, and terminal runs are capped at `maxTerminalRuns` (each additionally bounded in retention time by `terminalRetentionMs`) rather than growing for the life of the process.
  * @overallScore 100/100
@@ -364,6 +351,7 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
         }
         catch (error) {
             runs.delete(runId);
+            input.delegatedResultCorrelation?.clearRun({ runId });
             clearIdempotencyIndexEntryIfMatching({ idempotencyIndex: idempotencyIndex, idempotencyKey: startInput.idempotencyKey, runId: runId });
             throw error;
         }
@@ -415,7 +403,33 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
             return;
         record.retentionTimer = undefined;
         runs.delete(runId);
+        input.delegatedResultCorrelation?.clearRun({ runId });
         clearIdempotencyIndexEntryIfMatching({ idempotencyIndex: idempotencyIndex, idempotencyKey: record.idempotencyKey, runId: runId });
+        if (input.dropEventsOnEviction === true)
+            void dropEvictedRunEvents(runId);
+    }
+    /** `evictTerminalRun`'s opt-in event drop (see `CreateRunLifecycleInput.dropEventsOnEviction`). Runs from a timer, so a failure is reported, never thrown. */
+    async function dropEvictedRunEvents(runId) {
+        try {
+            await eventLog.drop({ runId });
+        }
+        catch (error) {
+            reportInternalError({ source: 'event-log-drop', runId, error });
+        }
+    }
+    /** Hands `context` to `onInternalError` (or `console.error`), containing a throwing sink. */
+    function reportInternalError(context) {
+        try {
+            if (input.onInternalError)
+                input.onInternalError(context);
+            // eslint-disable-next-line no-console
+            else
+                console.error(`[@jini-ai/daemon] internal error (${context.source}, runId=${context.runId})`, context.error);
+        }
+        catch (sinkError) {
+            // eslint-disable-next-line no-console
+            console.error(`[@jini-ai/daemon] internal error sink failed (${context.source}, runId=${context.runId})`, sinkError);
+        }
     }
     /** Trims the oldest terminal records until `terminalRunOrder` is back at or under `maxTerminalRuns`. */
     function enforceTerminalCap() {
@@ -454,29 +468,25 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
      * it would undo the operator's inactivity policy. Other unexpected process failures still
      * retain their original runtime classification.
      *
-     * The `!record || isTerminalRunState(...)` guard below is defensive only and is currently
-     * unreachable through the public API — deliberately kept, not fake-tested, and the reason is
-     * recorded here so the next reader does not spend time trying to cover it:
+     * There is deliberately no "run missing or already terminal" guard here (an earlier
+     * `!record || isTerminalRunState(...)` guard was removed as unreachable through the public API,
+     * and the handler needs nothing from the record — it acts through `lifecycle.emit`/`finish` by id):
      *
-     * - `isTerminalRunState(...)`: every route to a terminal state runs through `finish()`, which
+     * - terminal: every route to a terminal state runs through `finish()`, which
      *   calls `record.watchdog?.cancel()` and assigns `record.status.state` in the *same synchronous
      *   block* after its durable end append resolves. There is no interleaving point between the two,
      *   so "watchdog still armed" and "record already terminal" cannot both hold when this fires. (If
      *   the end append *throws*, the watchdog stays armed but the run also stays non-terminal.)
-     * - `!record`: the only `runs.delete()` is `start()`'s unwind on a failed durable start append,
-     *   which happens strictly before the watchdog is armed a few lines later. It is also required
-     *   for type-narrowing `record` before `record.status.state` is read, so it cannot simply be
-     *   dropped.
+     * - missing: the only `runs.delete()` calls are `start()`'s unwind on a failed durable start
+     *   append, which happens strictly before the watchdog is armed a few lines later, and terminal
+     *   eviction, which only ever touches runs whose watchdog `finish()` already cancelled. And
+     *   `createInactivityWatchdog` never calls `onTimeout` after `cancel()`.
      *
-     * Note the "start/finish race" test below does *not* exercise this guard despite its name: by the
+     * Note the "start/finish race" test below does *not* exercise this handler despite its name: by the
      * time it advances the timers, `finish()` has already cancelled the watchdog, so the callback
      * never runs at all. It still correctly asserts that no second `finish()` happens.
      */
     async function handleInactivityTimeout(runId) {
-        const record = runs.get(runId);
-        if (!record || isTerminalRunState({ state: record.status.state })) {
-            return;
-        }
         try {
             // A deliberate inactivity kill is permanent for this attempt, not an auto-resume signal.
             await lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'status', label: 'Stopped by inactivity watchdog', detail: 'inactivity-watchdog' } } });
@@ -510,21 +520,17 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
      * one — see that variant's own doc in `@jini-ai/protocol`'s `events.ts` for why: nothing in this
      * codebase renders `'status'` events today, so reusing it here would have shipped an invisible fix.
      *
-     * The `!record || isTerminalRunState(...)` guard mirrors {@link handleInactivityTimeout}'s own
-     * (see that function's doc for why it is unreachable-but-kept there); it is reachable here in one
-     * more case worth naming: `finish()` cancels `record.slowRunWatchdog` synchronously before its
+     * Like {@link handleInactivityTimeout}, it has no "run missing or already terminal" guard (see
+     * that function's doc for why such a guard is unreachable). One more case is worth naming:
+     * `finish()` cancels `record.slowRunWatchdog` synchronously before its
      * `record.status.state` write ever yields, so between this timer firing and `emit()` actually
      * running there is no window where a normal `finish()` could race it — but `emit()` itself can
      * still legitimately throw (e.g. a `finishPromise` in flight from a concurrent `cancel()`-driven
-     * finish that started after this callback's own `runs.get()` read but before its `emit()` call
+     * finish that started after this callback fired but before its `emit()` call
      * completes its internal `await record.startPromise`), which is exactly what the `try`/`catch`
      * below contains rather than letting escape as an unhandled rejection.
      */
     async function handleSlowRunNotice(runId) {
-        const record = runs.get(runId);
-        if (!record || isTerminalRunState({ state: record.status.state })) {
-            return;
-        }
         try {
             await lifecycle.emit({ runId: runId, input: {
                     event: 'agent',
@@ -563,7 +569,7 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
         const replay = await eventLog.replay({ runId: runId, afterCursor: null });
         if (replay.kind !== 'ok' || replay.entries.length === 0)
             return 'skipped';
-        const { record, idempotencyKey, isTerminal } = rehydratedRunRecord(runId, replay.entries);
+        const { record, idempotencyKey, terminalAt } = rehydratedRunRecord(runId, replay.entries);
         runs.set(runId, record);
         if (idempotencyKey !== undefined)
             idempotencyIndex.set(idempotencyKey, runId);
@@ -571,9 +577,10 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
         // its own — without this, a restart would re-populate `runs` with the daemon's entire terminal
         // run history on every boot, reproducing the same unbounded growth this module now guards
         // against at runtime.
-        if (isTerminal)
-            trackTerminalRun(runId, record, record.status.endedAt ?? Date.now());
-        return isTerminal ? 'terminal' : 'non-terminal';
+        if (terminalAt === undefined)
+            return 'non-terminal';
+        trackTerminalRun(runId, record, terminalAt);
+        return 'terminal';
     }
     const lifecycle = {
         async rehydrate(_args) {

package/dist/store/agent-sessions/sqlite.d.ts

@@ -27,6 +27,7 @@ export declare function getAgentSession({ db, conversationId, agentId }: {
  * ability to detect staleness via stablePromptHash and lastMessageId.
  * @param db - Open SQLite database handle.
  * @param input - Session fields to persist; conversationId, agentId, and sessionId are required.
+ * @param nowMs - Clock for `updated_at`; defaults to wall time.
  */
 export declare function upsertAgentSession({ db, input }: {
     readonly db: SqliteDb;
@@ -39,6 +40,8 @@ export declare function upsertAgentSession({ db, input }: {
         cwd?: string | null;
         lastMessageId?: string | null;
     };
+}, { nowMs }?: {
+    readonly nowMs?: () => number;
 }): void;
 /**
  * Fetches the full agent session record for a (conversation, agent) pair, or null if absent.
@@ -83,12 +86,15 @@ export declare function latestCompletedAssistantMessageId({ db, conversationId,
  * @param conversationId - Conversation scope for the session.
  * @param agentId - Agent whose session to update.
  * @param stablePromptHash - The new prompt hash to record.
+ * @param nowMs - Clock for `updated_at`; defaults to wall time.
  */
 export declare function updateAgentSessionStableHash({ db, conversationId, agentId, stablePromptHash }: {
     readonly db: SqliteDb;
     readonly conversationId: string;
     readonly agentId: string;
     readonly stablePromptHash: string;
+}, { nowMs }?: {
+    readonly nowMs?: () => number;
 }): void;
 /**
  * Deletes the agent session record for a (conversation, agent) pair.

package/dist/store/agent-sessions/sqlite.js

@@ -18,8 +18,9 @@ export function getAgentSession({ db, conversationId, agentId }) {
  * ability to detect staleness via stablePromptHash and lastMessageId.
  * @param db - Open SQLite database handle.
  * @param input - Session fields to persist; conversationId, agentId, and sessionId are required.
+ * @param nowMs - Clock for `updated_at`; defaults to wall time.
  */
-export function upsertAgentSession({ db, input }) {
+export function upsertAgentSession({ db, input }, { nowMs = Date.now } = {}) {
     db.prepare(`INSERT INTO agent_sessions
        (conversation_id, agent_id, session_id, stable_prompt_hash, model, cwd, last_message_id, updated_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -29,7 +30,7 @@ export function upsertAgentSession({ db, input }) {
                      model = excluded.model,
                      cwd = excluded.cwd,
                      last_message_id = excluded.last_message_id,
-                     updated_at = excluded.updated_at`).run(input.conversationId, input.agentId, input.sessionId, input.stablePromptHash ?? null, input.model ?? null, input.cwd ?? null, input.lastMessageId ?? null, Date.now());
+                     updated_at = excluded.updated_at`).run(input.conversationId, input.agentId, input.sessionId, input.stablePromptHash ?? null, input.model ?? null, input.cwd ?? null, input.lastMessageId ?? null, nowMs());
 }
 /**
  * Fetches the full agent session record for a (conversation, agent) pair, or null if absent.
@@ -103,10 +104,11 @@ export function latestCompletedAssistantMessageId({ db, conversationId, excludeM
  * @param conversationId - Conversation scope for the session.
  * @param agentId - Agent whose session to update.
  * @param stablePromptHash - The new prompt hash to record.
+ * @param nowMs - Clock for `updated_at`; defaults to wall time.
  */
-export function updateAgentSessionStableHash({ db, conversationId, agentId, stablePromptHash }) {
+export function updateAgentSessionStableHash({ db, conversationId, agentId, stablePromptHash }, { nowMs = Date.now } = {}) {
     db.prepare(`UPDATE agent_sessions SET stable_prompt_hash = ?, updated_at = ?
-      WHERE conversation_id = ? AND agent_id = ?`).run(stablePromptHash, Date.now(), conversationId, agentId);
+      WHERE conversation_id = ? AND agent_id = ?`).run(stablePromptHash, nowMs(), conversationId, agentId);
 }
 /**
  * Deletes the agent session record for a (conversation, agent) pair.

package/dist/surface-exchanges.js

@@ -91,8 +91,9 @@ export function createSurfaceExchangeStore(deps, { idleTtlMs = DEFAULT_SURFACE_I
                 armIdle();
             }
             catch (error) {
+                // Only the lifetime timer can be live here: `armIdle` is the last statement, and it assigns
+                // `cancelIdle` only once its own `schedule` call has returned, so a throw there leaves it unset.
                 cancelLifetime?.();
-                cancelIdle?.();
                 throw error;
             }
             openExchanges.set(id, {

package/dist/terminal-session.d.ts

@@ -147,7 +147,7 @@ export interface CreateTerminalSessionManagerOptions {
  * the kill/write/resize lock, and (via {@link createTerminalToolRegistrations})
  * `ToolExecutor` gating for creation. See module doc for the full design.
  */
-export declare function createTerminalSessionManager(requiredArgs: Record<string, never>, optionalArgs?: Pick<CreateTerminalSessionManagerOptions, "terminalService" | "loadSpawnPty" | "maxEvents" | "maxBufferBytes" | "exitTailBytes" | "flushIntervalMs" | "flushThresholdBytes" | "ttlMs" | "shutdownGraceMs">): TerminalSessionManager;
+export declare function createTerminalSessionManager(_requiredArgs: Record<string, never>, options?: Pick<CreateTerminalSessionManagerOptions, "terminalService" | "loadSpawnPty" | "maxEvents" | "maxBufferBytes" | "exitTailBytes" | "flushIntervalMs" | "flushThresholdBytes" | "ttlMs" | "shutdownGraceMs">): TerminalSessionManager;
 export interface CreateTerminalToolRegistrationsOptions {
     readonly manager: TerminalSessionManager;
     /** @default {@link denyAllTerminalCreatePolicy} — see its doc for why a permissive default was rejected. */