@jskit-ai/assistant-core 0.2.15 → 0.2.17

package/src/server/conversation/openCodeSessionTurns.js

@@ -333,7 +333,7 @@ export function createOpenCodeSessionTurns({ processes, monitors, turns, process
   }
 
   async function reconcileSessionTurn(key, target, activeRun, options, application) {
-    if (activeRun?.observationError) {
+    if (endedOnPreviousServer(activeRun)) {
       await processOwner.stopUnobservedSession(target, activeRun.threadId);
       await application.writeRun({ ...activeRun, id: activeRun.turnId }, "interrupted", activeRun.observationError);
     } else if (activeRun) {
@@ -344,7 +344,7 @@ export function createOpenCodeSessionTurns({ processes, monitors, turns, process
         startedAt: normalizeNullableText(activeRun.startedAt)
       }, options, application.monitor);
     }
-    return Boolean(activeRun && !activeRun.observationError);
+    return Boolean(activeRun && !endedOnPreviousServer(activeRun));
   }
 
   async function ensurePreparedSessionReadiness(prepared) {
@@ -443,8 +443,15 @@ export function createOpenCodeSessionTurns({ processes, monitors, turns, process
     return prepare();
   }
 
+  // A saved active run whose observation already ended: lost, or stopped by the
+  // previous server's shutdown. Recovery records it interrupted once native
+  // work is idle; neither is the turn's own failure.
+  function endedOnPreviousServer(run) {
+    return Boolean(run?.observationError || run?.stoppedByShutdown === true);
+  }
+
   function needsObservationRecovery(key, run) {
-    return Boolean(run?.active && run.observationError && !monitors.has(key));
+    return Boolean(run?.active && endedOnPreviousServer(run) && !monitors.has(key));
   }
 
   async function recordStoppedObservation(key, run, threadId, writeRun) {

package/src/server/conversation/openCodeTemporaryConversations.js

@@ -172,18 +172,25 @@ export function createOpenCodeTemporaryConversations({ processes, temporaryConve
     const rows = openCodeMessageRows(await target.server.client.messages(conversationId));
     const result = openCodeLastAssistantResult(rows, { readError });
     const messages = openCodePersistentConversationMessages(rows, projection.messageId);
+    const runId = tracked?.inputMessageId || [...rows].reverse().find((row) => row.type === "user")?.id || "";
+    // The application marks the run a previous server's shutdown stopped: that
+    // run's native abort is the shutdown's interruption, not its failure, and
+    // recording it lets the application make the checkpoint it still owes.
+    const shutdownStop = projection.stoppedByShutdown;
+    const stoppedByShutdown = !tracked && Boolean(runId) && shutdownStop?.runId === runId;
     let conversationStatus = "completed";
     if (status.type !== "idle" || tracked?.active) conversationStatus = "inProgress";
-    else if (tracked?.interrupted) conversationStatus = "interrupted";
+    else if (tracked?.interrupted || stoppedByShutdown) conversationStatus = "interrupted";
     else if (tracked?.error || result.error) conversationStatus = "failed";
+    if (stoppedByShutdown) await shutdownStop.ended();
     return {
       conversationId,
       ok: true,
       messages,
       text: result.text,
       admitted: Boolean(projection.inputMessageId && rows.some((row) => row.id === projection.inputMessageId)),
-      error: normalizeNullableText(tracked?.error?.message) || result.error,
-      runId: tracked?.inputMessageId || [...rows].reverse().find((row) => row.type === "user")?.id || "",
+      error: stoppedByShutdown ? "" : normalizeNullableText(tracked?.error?.message) || result.error,
+      runId,
       status: conversationStatus
     };
   }

package/src/server/conversation/openCodeTurn.js

@@ -478,6 +478,10 @@ export async function waitForOpenCodeFinalResponse(client, conversationId, turn,
 /**
  * Production detached-turn lifetime. Applications project the completed native
  * result before observation is closed, then publish/checkpoint their own state.
+ * A turn the server's shutdown stopped (`turn.stoppedByShutdown`), or that
+ * ends on its own once shutdown has begun, ends interrupted however its wait
+ * ended, and `afterClose` is told so: the application leaves its checkpoint to
+ * the next server.
  * @param {import("./openCodeProcessOwner.js").OpenCodeProcessOwner} processOwner
  */
 export async function observeOpenCodeTurnCompletion(processOwner, target, conversationId, turn, {
@@ -486,6 +490,10 @@ export async function observeOpenCodeTurnCompletion(processOwner, target, conver
   const turnAbort = turn.abortController;
   let stopped = true;
   let outcome = "completed";
+  const leftToNextServer = () => {
+    if (processOwner.closed) turn.stoppedByShutdown = true;
+    return turn.stoppedByShutdown === true;
+  };
   try {
     const options = { ...waitOptions, signal: AbortSignal.any([
       signal, ...(timeoutMs ? [AbortSignal.timeout(timeoutMs)] : [])
@@ -493,11 +501,15 @@ export async function observeOpenCodeTurnCompletion(processOwner, target, conver
     const completion = finalResponse
       ? await waitForOpenCodeFinalResponse(target.server.client, conversationId, turn, { ...finalResponse, ...options })
       : await waitForOpenCodeMessages(target.server.client, conversationId, () => turn.inputMessageId, options);
+    if (leftToNextServer()) {
+      outcome = "interrupted";
+      return { interrupted: true };
+    }
     return await projectResult(completion);
   } catch (error) {
     const failure = signal.aborted ? signal.reason : error;
-    outcome = turn.interrupted ? "interrupted" : "failed";
-    if (turn.interrupted) return { interrupted: true };
+    outcome = leftToNextServer() || turn.interrupted ? "interrupted" : "failed";
+    if (outcome === "interrupted") return { interrupted: true };
     if (!target.abortController.signal.aborted) {
       try {
         await processOwner.stopUnobservedSession(target, conversationId);
@@ -513,7 +525,7 @@ export async function observeOpenCodeTurnCompletion(processOwner, target, conver
       turn.active = !stopped;
       turn.mayBeRunning = !stopped;
     }
-    await afterClose({ stopped, outcome });
+    await afterClose({ stopped, outcome, stoppedByShutdown: turn.stoppedByShutdown === true });
   }
 }
 

package/src/server/conversation/openCodeTurnMonitor.js

@@ -351,11 +351,20 @@ export function createOpenCodeTurnMonitor({ processes, monitors, turns, processO
           }
         }
       } finally {
+        // The end of a turn the server's shutdown stopped belongs to the next
+        // server: its saved run stays active and carries the shutdown's mark,
+        // so that server's recovery records the turn interrupted and runs the
+        // host's checkpoint. Run here, that checkpoint (a Git snapshot, say)
+        // could be refused or hold the host's bounded shutdown for as long as
+        // it takes. A turn that ends on its own once shutdown has begun is left
+        // the same way. A user's Stop outside shutdown ends its turn here.
+        if (processOwner.closed && finalState !== "active") turn.stoppedByShutdown = true;
+        const nextServerEnds = turn.stoppedByShutdown === true && finalState !== "active";
         // Claim retirement before awaited cleanup/checkpointing. A new Send
         // joins this monitor's cleanup instead of steering an unobserved turn.
         turn.active = finalState === "active";
         await events.close();
-        if (credentialFailure || finalState === "failed") {
+        if (!nextServerEnds && (credentialFailure || finalState === "failed")) {
           failure = await completeResult(turn, { credentialFailure, providerApiFailure, finalState, failure });
         }
         turn.error = failure;
@@ -364,7 +373,7 @@ export function createOpenCodeTurnMonitor({ processes, monitors, turns, processO
         turn.finalAssistantResultTarget = turn.finalAssistantResult ? finalAssistantResultTarget : null;
         turn.finalAssistantResultProcess = turn.finalAssistantResult ? finalAssistantResultProcess : null;
         turn.updatedAt = new Date().toISOString();
-        await writeRun(turn, finalState, failure).catch(() => null);
+        await (nextServerEnds ? writeRun(turn, "active", "") : writeRun(turn, finalState, failure)).catch(() => null);
       }
       return openCodeTurnSnapshot(turn, target.upstreamSessionId);
     }).finally(() => {

package/src/server/conversation/providers/claudeDriver.js

@@ -346,6 +346,10 @@ export function createClaudeConversationDriver({
     return native.owner.closeProject(input, native.application);
   }
 
+  function beginShutdown({ native }) {
+    return native.owner.beginShutdown();
+  }
+
   function invalidateRuntimes({ native, input }) {
     return native.owner.invalidateRuntimes(input, native.application, native.account);
   }
@@ -568,6 +572,7 @@ export function createClaudeConversationDriver({
     listConversationStorage,
     retireConversationHistory,
     closeProject,
+    beginShutdown,
     invalidateRuntimes,
     reconcileSessions,
     createConversation,

package/src/server/conversation/providers/codexDriver.js

@@ -63,6 +63,10 @@ function nativeGoalChanged() {
   });
 }
 
+function beginShutdown({ native }) {
+  return native.runOwner.beginShutdown();
+}
+
 /**
  * Conversations own threads and observers on the account's shared native runtime.
  * @param {object} dependencies
@@ -653,6 +657,7 @@ export function createCodexConversationDriver({ connections, host = {}, limits =
     deleteDetachedConversation,
     listConversationStorage,
     retireConversationHistory,
+    beginShutdown,
     invalidateRuntimes,
     reconcileSessions,
     unsubscribeSessions,

package/src/server/conversation/providers/opencodeDriver.js

@@ -126,6 +126,10 @@ export function createOpenCodeConversationDriver({
     return native.owner.closeProject(input, native.preparation.projectCleanup());
   }
 
+  function beginShutdown({ native }) {
+    return native.owner.beginShutdown();
+  }
+
   function invalidateRuntimes({ native, input }) {
     return native.owner.invalidateRuntimes(input, native.preparation);
   }
@@ -375,6 +379,7 @@ export function createOpenCodeConversationDriver({
     listConversationStorage,
     retireConversationHistory,
     closeProject,
+    beginShutdown,
     invalidateRuntimes,
     reconcileSessions,
     createConversation,

package/src/server/conversation/runtime.js

@@ -227,6 +227,7 @@ export function createConversationRuntime({ engine: defaultEngine = "api", defau
     runNativeDetachedConversation: lifecycle.runNativeDetachedConversation,
     open: handles.open,
     closeNativeProject: lifecycle.closeNativeProject,
+    beginNativeShutdown: lifecycle.beginNativeShutdown,
     invalidateNativeRuntimes: lifecycle.invalidateNativeRuntimes,
     reconcileNativeSessions: lifecycle.reconcileNativeSessions,
     unsubscribeNativeSessions: lifecycle.unsubscribeNativeSessions,

package/test/claudeLifecycle.test.js

@@ -242,6 +242,34 @@ test("Claude shutdown leaves a running turn's end and its checkpoint to the next
   assert.deepEqual(custody(JSON.parse(f.session("a").records.get(MAIN_IDS.a))), { executionId: "", state: "interrupted" });
 });
 
+test("once Claude's shutdown has begun, a turn that ends on its own is left to the next server, which runs its one checkpoint", { timeout: 5_000 }, async t => {
+  const f = await lifecycleFixture(t);
+  const a = await f.running("a");
+  const saved = f.session("a").records.get(MAIN_IDS.a);
+  f.owner.beginShutdown();
+  assert.deepEqual(f.calls.stops, [], "beginning the shutdown stopped nothing");
+  // The turn ends on its own.
+  await f.processes[0].options.onEvent({ type: "result", subtype: "success", result: "Done." });
+  assert.deepEqual(f.calls.checkpoints, [], "the turn's end ran no checkpoint");
+  assert.equal(f.session("a").records.get(MAIN_IDS.a), saved, "the saved record keeps the active turn");
+  assert.equal((await f.owner.invalidateRuntimes({ reason: "server-shutdown" }, f.application, f.account)).ok, true);
+  assert.equal(a.process, null, "the full stop still stopped the process");
+  assert.deepEqual(f.calls.checkpoints, []);
+  // The next server's close proves that exit, then interrupts the turn through its checkpoint, once.
+  f.restart();
+  assert.equal((await f.owner.closeSession({ sessionId: "a" }, f.application)).ok, true);
+  assert.equal((await f.owner.closeSession({ sessionId: "a" }, f.application)).ok, true);
+  assert.deepEqual(f.calls.checkpoints, ["a:interrupted"]);
+});
+
+test("outside shutdown a Claude turn that ends on its own still runs its checkpoint at once", { timeout: 5_000 }, async t => {
+  const f = await lifecycleFixture(t);
+  await f.running("a");
+  await f.processes[0].options.onEvent({ type: "result", subtype: "success", result: "Done." });
+  assert.deepEqual(f.calls.checkpoints, ["a:completed"]);
+  assert.equal(JSON.parse(f.session("a").records.get(MAIN_IDS.a)).state, "completed");
+});
+
 test("Claude project close releases its sessions from memory without reopening saved conversations", async t => {
   const f = await lifecycleFixture(t);
   await f.idle("a");

package/test/codexConversationsCheckpoint.test.js

@@ -20,6 +20,8 @@ function persistentConversationFixture() {
   };
   const commands = createCodexConversationCommands({
     async checkpoint(_sessionId, input) { checkpoints.push(input); },
+    // Outside shutdown, with no request contexts.
+    isClosing: () => false, captureContext: () => null, runInContext: (_context, operation) => operation(),
     conversationPreparation: { async context() { return { result: { provider } }; } },
     namespace: (sessionId) => sessionId,
     // The provider owner still holds the provider observing the conversation;

package/test/codexLifecycleIsolation.test.js

@@ -231,6 +231,8 @@ function conversationCommands({ context = async () => ({ result: { ok: false, co
   providerSessions = {} } = {}) {
   return createCodexConversationCommands({
     checkpoint: async () => {},
+    // Outside shutdown, with no request contexts.
+    isClosing: () => false, captureContext: () => null, runInContext: (_context, operation) => operation(),
     conversationPreparation: {
       context,
       scope,

package/test/codexShutdownStop.test.js

@@ -0,0 +1,168 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createCodexConversationCommands } from "../src/server/conversation/codexConversations.js";
+import { createCodexRuntimeLifecycle } from "../src/server/conversation/codexRuntimeLifecycle.js";
+
+// A Temporary chat's Codex turn that the server's shutdown stops, or that ends
+// while the server is stopping, leaves its checkpoint to the next server: the
+// application records it as owed, and that server's next read makes it once.
+
+const turnOutcomes = { USER_CANCELLED: "user_cancelled", SERVICE_RESTART: "service_restart" };
+
+// One server's observed conversation. `latest` is the turn Codex's history
+// reports to a read; turn notifications reach the conversation's observer.
+function server({ closing = false, latest = { id: "turn-1", status: "inProgress", items: [] }, threadError = null } = {}) {
+  const checkpoints = [];
+  const deferred = [];
+  const listeners = new Set();
+  const emit = notification => listeners.forEach(listener => listener(notification));
+  const provider = {
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    async readThreadStatus(threadId) {
+      return { raw: { id: threadId, historyMode: "paginated", status: "idle", ...(threadError ? { error: threadError } : {}) } };
+    },
+    async listThreadTurns() { return { data: [latest] }; },
+    async readGoal() { return { goal: null }; },
+    async stopThreadForObservationLoss() {}
+  };
+  const lifecycle = { closing };
+  const commands = createCodexConversationCommands({
+    async checkpoint(sessionId, input) { checkpoints.push({ sessionId, ...input }); },
+    async deferCheckpoint(sessionId, input) { deferred.push({ sessionId, ...input }); },
+    isClosing: () => lifecycle.closing,
+    captureContext: () => null,
+    runInContext: (_context, operation) => operation(),
+    codexAppServerConversationMessageId: (...parts) => parts.join(":"),
+    conversationPreparation: { async context() { return { result: { provider } }; } },
+    namespace: sessionId => sessionId,
+    providerSessions: { owner: { providers: new Map([["provider", provider]]), holdProvider: () => () => {} } },
+    turnOutcomes
+  });
+  const startTurn = () => {
+    commands.observeCodexConversation("session", "thread", provider);
+    emit({ method: "turn/started", params: { threadId: "thread", turn: { id: "turn-1", status: "inProgress" } } });
+  };
+  const complete = status => emit({ method: "turn/completed", params: { threadId: "thread", turn: { id: "turn-1", status } } });
+  const read = stoppedByShutdown => commands.readPersistentCodexConversation("session", { conversationId: "thread", stoppedByShutdown },
+    { provider }).then(({ status, error, runId }) => ({ status, error, runId }));
+  return { checkpoints, deferred, commands, lifecycle, startTurn, complete, read };
+}
+
+const OWED = { sessionId: "session", outerTurnId: "codex:thread:turn-1", threadId: "thread", turnId: "turn-1" };
+
+test("shutdown leaves a running Temporary turn's interrupted checkpoint to the next server, which makes it once on its read", async () => {
+  const first = server();
+  first.startTurn();
+  first.lifecycle.closing = true;
+  await first.commands.leaveRunningTurnsToNextServer();
+  assert.deepEqual(first.checkpoints, [], "shutdown made no checkpoint");
+  assert.deepEqual(first.deferred, [{ ...OWED, status: "interrupted", turnOutcome: "service_restart" }]);
+
+  // The stopped process ends the turn natively as interrupted.
+  const next = server({ latest: { id: "turn-1", status: "interrupted", items: [] }, threadError: { message: "Turn aborted." } });
+  const ended = [];
+  const mark = runId => ({ runId, async ended() { ended.push(runId); } });
+  assert.deepEqual(await next.read(mark("turn-1")), { status: "interrupted", error: "", runId: "turn-1" });
+  assert.deepEqual(ended, ["turn-1"], "recording the stopped run lets the application make its checkpoint");
+  assert.deepEqual(await next.read(undefined), { status: "interrupted", error: "Turn aborted.", runId: "turn-1" },
+    "an unmarked interruption keeps Codex's own report");
+  await next.read(mark("turn-0"));
+  assert.deepEqual(ended, ["turn-1"], "only the marked run is recorded as ended");
+  assert.deepEqual(next.checkpoints, []);
+});
+
+test("a Temporary turn that ends on its own while the server stops leaves its checkpoint, with its own outcome, to the next server", async () => {
+  const f = server();
+  f.startTurn();
+  f.lifecycle.closing = true;
+  f.complete("completed");
+  await Promise.all(f.commands.deferredCheckpoints);
+  assert.deepEqual(f.checkpoints, []);
+  assert.deepEqual(f.deferred, [{ ...OWED, status: "completed", turnOutcome: "" }]);
+  assert.equal(f.commands.deferredCheckpoints.size, 0, "shutdown awaits each deferred record");
+
+  // The next server reads the completed turn as completed, and makes its checkpoint.
+  const next = server({ latest: { id: "turn-1", status: "completed", items: [] } });
+  const ended = [];
+  assert.equal((await next.read({ runId: "turn-1", async ended() { ended.push("turn-1"); } })).status, "completed");
+  assert.deepEqual(ended, ["turn-1"]);
+});
+
+test("outside shutdown a Temporary turn's end still makes its checkpoint at once", async () => {
+  const f = server();
+  f.startTurn();
+  f.complete("interrupted");
+  assert.deepEqual(f.checkpoints, [{ ...OWED, status: "interrupted", turnOutcome: "" }]);
+  assert.deepEqual(f.deferred, []);
+  await f.commands.leaveRunningTurnsToNextServer();
+  assert.deepEqual(f.deferred, [], "a finished turn owes nothing at shutdown");
+});
+
+// The run owner's runtime lifecycle, with the owner calls it makes recorded.
+function runtimeLifecycle(calls, leaveTurnsToNextServer) {
+  return createCodexRuntimeLifecycle({
+    pendingWork: { conversationTurnStarts: new Map(), messageDeliveries: new Map(), reasoningPersistQueues: new Map(),
+      resultFinalizations: new Map(), threadReconciliations: new Map(), notificationTasks: new Map(), deferredCheckpoints: new Set() },
+    observer: { eventSubscriptions: new Map() },
+    checkManagedConnection: async () => {},
+    providerSessions: { managed: new Map(), assertOpen() {}, owner: {
+      lifecycleTasks: new Set(), runtimeAcquisitions: new Set(),
+      beginShutdown() { calls.push("owner-shutdown"); },
+      async invalidateRuntimes() { calls.push("stop-runtimes"); return { failed: [], providerCount: 0, results: [], stopped: 0 }; }
+    } },
+    helperLifecycle: { projectOperations: new Map(), cleanups: new Map(), mutations: new Map(), restores: new Map(), turnStarts: new Map() },
+    captureContext: () => null,
+    runInContext: (_context, operation) => operation(),
+    debugLog() {},
+    debugError: error => error?.message,
+    leaveTurnsToNextServer
+  });
+}
+
+test("a Codex shutdown leaves the running turns to the next server before any runtime stops, and waits for their records", async () => {
+  const calls = [];
+  const recorded = Promise.withResolvers();
+  const lifecycle = runtimeLifecycle(calls, async () => {
+    calls.push("leave-turns");
+    await recorded.promise;
+    calls.push("turns-recorded");
+  });
+  const shutdown = lifecycle.invalidateRuntimes({ reason: "server-shutdown" }, { enabled: true });
+  assert.equal(lifecycle.closing, true);
+  await Promise.resolve();
+  recorded.resolve();
+  await shutdown;
+  assert.equal(calls[0], "leave-turns");
+  assert.ok(calls.indexOf("turns-recorded") < calls.lastIndexOf("stop-runtimes"), "shutdown waited for the records");
+});
+
+test("a begun Codex shutdown stops nothing, and a Temporary turn that then ends on its own leaves its checkpoint to the next server", async () => {
+  const f = server();
+  f.startTurn();
+  const calls = [];
+  const lifecycle = runtimeLifecycle(calls, () => f.commands.leaveRunningTurnsToNextServer());
+  Object.defineProperty(f.lifecycle, "closing", { get: () => lifecycle.closing });
+  lifecycle.beginShutdown();
+  assert.equal(lifecycle.closing, true, "the closing fence is set before the call returns");
+  assert.deepEqual(calls, ["owner-shutdown"], "beginning the shutdown stopped nothing");
+  f.complete("completed");
+  await Promise.all(f.commands.deferredCheckpoints);
+  assert.deepEqual(f.checkpoints, [], "the turn's end made no checkpoint");
+  assert.deepEqual(f.deferred.at(-1), { ...OWED, status: "completed", turnOutcome: "" }, "its own outcome is owed");
+
+  // The full stop that follows still stops the runtimes, and leaves the turns only once.
+  const deferred = f.deferred.length;
+  await lifecycle.invalidateRuntimes({ reason: "server-shutdown" }, { enabled: true });
+  assert.ok(calls.includes("stop-runtimes"));
+  assert.equal(f.deferred.length, deferred);
+  assert.deepEqual(f.checkpoints, []);
+
+  // The next server's read makes the owed checkpoint once.
+  const next = server({ latest: { id: "turn-1", status: "completed", items: [] } });
+  const ended = [];
+  assert.equal((await next.read({ runId: "turn-1", async ended() { ended.push("turn-1"); } })).status, "completed");
+  assert.deepEqual(ended, ["turn-1"]);
+});

package/test/codexTemporaryProviderRelease.test.js

@@ -53,6 +53,8 @@ function codexFixture(t, { idleMs = 20 } = {}) {
   });
   const commands = createCodexConversationCommands({
     async checkpoint() {},
+    // Outside shutdown, with no request contexts.
+    isClosing: () => false, captureContext: () => null, runInContext: (_context, operation) => operation(),
     codexAppServerConversationMessageId: (...parts) => parts.join(":"),
     codexAppServerStreamMessage: () => ({}),
     conversationPreparation: {

package/test/codexTurn.test.js

@@ -3856,3 +3856,60 @@ test("native history budget rejects unavailable dynamic limits before pending de
     assert.equal(sends, 0);
   }
 });
+
+test("a Main turn the previous server's shutdown stopped reads as interrupted by a restart, with one interrupted checkpoint", async () => {
+  const notices = [];
+  const checkpoints = [];
+  const f = await receiptFixture({
+    outcomeNotice(_runtime, _sessionId, _threadId, _turnId, outcome) { notices.push(outcome); },
+    checkpoint(_sessionId, input) { checkpoints.push(input); }
+  });
+  f.provider.interruptionOutcome = () => "";
+  // The shutdown marks the running turn and leaves the rest of its saved run as it was.
+  assert.deepEqual(await f.owner.markTurnStoppedByShutdown(f.sessionId, f.threadId), { marked: true });
+  assert.deepEqual({ state: f.run.state, stoppedByShutdownTurnId: f.run.stoppedByShutdownTurnId },
+    { state: "active", stoppedByShutdownTurnId: f.turnId });
+  assert.deepEqual(await f.owner.markTurnStoppedByShutdown(f.sessionId, "another-thread"), { marked: false });
+  // The next server reads the native turn as interrupted.
+  const result = await f.owner.stopTurnWithProviderFailure(f.sessionId, f.threadId, f.turnId, {
+    status: "interrupted", provider: f.provider, verifyInactive: false
+  });
+  assert.equal(result.status, "interrupted");
+  assert.match(result.error, /interrupted by a restart/u);
+  assert.deepEqual(notices, ["service_restart"]);
+  assert.deepEqual(checkpoints.map(({ status, turnOutcome }) => ({ status, turnOutcome })),
+    [{ status: "interrupted", turnOutcome: "service_restart" }]);
+  assert.equal(f.run.state, "interrupted");
+});
+
+test("an interrupted Main turn without the shutdown's mark keeps the plain interrupted outcome", async () => {
+  const notices = [];
+  const checkpoints = [];
+  const f = await receiptFixture({
+    outcomeNotice(_runtime, _sessionId, _threadId, _turnId, outcome) { notices.push(outcome); },
+    checkpoint(_sessionId, input) { checkpoints.push(input); }
+  });
+  f.provider.interruptionOutcome = () => "";
+  // A mark left by an earlier turn does not apply to this one.
+  f.run = { ...f.run, stoppedByShutdownTurnId: "an-earlier-turn" };
+  await f.owner.stopTurnWithProviderFailure(f.sessionId, f.threadId, f.turnId, {
+    status: "interrupted", provider: f.provider, verifyInactive: false
+  });
+  assert.deepEqual(notices, ["interrupted"]);
+  assert.deepEqual(checkpoints.map(({ turnOutcome }) => turnOutcome), ["interrupted"]);
+});
+
+test("a Main turn that ends once shutdown has begun is left to the next server, with no checkpoint now", async () => {
+  const f = await settlementFixture();
+  f.owner.runtimeLifecycle = { closing: true };
+  const before = structuredClone(f.run);
+  assert.deepEqual(await f.owner.markTurnIdle(f.sessionId, { status: "completed", threadId: f.threadId, turnId: f.turnId }),
+    { ok: true, processed: false, reason: "left_to_next_server" });
+  assert.deepEqual(f.run, before, "the saved run is unchanged");
+  assert.deepEqual(f.checkpoints, []);
+  // Outside shutdown the same end is recorded and checkpointed at once.
+  f.owner.runtimeLifecycle = { closing: false };
+  await f.owner.markTurnIdle(f.sessionId, { status: "completed", threadId: f.threadId, turnId: f.turnId });
+  assert.equal(f.run.state, "completed");
+  assert.deepEqual(f.checkpoints.map(({ status }) => status), ["completed"]);
+});

package/test/conversationSession.test.js

@@ -706,6 +706,35 @@ test("native invalidation preserves synchronous fences and failures without open
   await result;
 });
 
+test("beginning native shutdown reaches the configured owner synchronously and opens no conversation", async t => {
+  const input = { reason: "server-shutdown" };
+  const calls = [];
+  let asynchronousHost = true;
+  const native = { runOwner: {
+    beginShutdown() { calls.push("begin"); return "begun"; },
+    invalidateRuntimes() { assert.fail("Beginning shutdown stops nothing."); }
+  } };
+  const runtime = createConversationRuntime({
+    authorize() { assert.fail("Trusted shutdown must not acquire session authority."); },
+    storage: {
+      read() { assert.fail("Shutdown must not read a conversation."); },
+      write() { assert.fail("Shutdown must not allocate a conversation."); }
+    },
+    host: { conversation(request) {
+      calls.push("host");
+      assert.deepEqual(request, { context, input, operation: "beginShutdown" });
+      const prepared = { engine: "codex", native, context, input };
+      return asynchronousHost ? Promise.resolve(prepared) : prepared;
+    } }
+  });
+  t.after(() => runtime.close());
+  assert.throws(() => runtime.beginNativeShutdown({ context, input }), /synchronous configured host/);
+  assert.deepEqual(calls, ["host"]);
+  asynchronousHost = false;
+  assert.equal(runtime.beginNativeShutdown({ context, input }), "begun");
+  assert.deepEqual(calls, ["host", "host", "begin"], "the owner's fence is set before the call returns");
+});
+
 test("renewal proof cleanup preserves OpenCode failure, consumption and retry through the configured owner", async t => {
   const owner = createOpenCodeSharedRuntime({});
   const calls = [];