agent-relay-runner 0.127.3 → 0.127.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-runner",
-  "version": "0.127.3",
+  "version": "0.127.5",
   "description": "Unified provider lifecycle runner for Agent Relay",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.4",
-    "agent-relay-sdk": "0.2.118",
+    "agent-relay-sdk": "0.2.120",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-relay-runner",
   "description": "Thin Agent Relay runner bridge for Claude Code",
-  "version": "0.127.3",
+  "version": "0.127.5",
   "agentRelayContracts": {
     "providerPluginProtocol": 1
   }

package/src/adapter.ts

@@ -146,11 +146,17 @@ export interface ProviderPermissionDecisionInput {
   approvalId: string;
   decision: ProviderPermissionDecision;
   reason?: string;
+  decisionReason?: ProviderPermissionDecisionReason;
   // For "answer" decisions (Claude AskUserQuestion): maps each question's text
   // to the chosen option label(s). Multi-select labels are comma-joined.
   answers?: Record<string, string>;
 }
 
+export interface ProviderPermissionDecisionReason {
+  kind: "timeout" | "dismissed" | "answered";
+  message?: string;
+}
+
 export interface ProviderAdapter {
   provider: string;
   spawn(config: RunnerSpawnConfig): Promise<ManagedProcess>;

package/src/adapters/claude-transcript.ts

@@ -25,6 +25,7 @@ export interface TurnStep {
   type: "narration" | "reasoning" | "tool";
   text: string;
   label?: string;
+  occurredAt?: number;
 }
 
 interface TranscriptMessage {
@@ -35,6 +36,7 @@ interface TranscriptMessage {
 
 interface TranscriptEntry {
   type?: string;
+  timestamp?: string;
   message?: TranscriptMessage;
   // Claude Code stamps every transcript entry with `isSidechain`: true for
   // entries belonging to a Task (subagent) run, false for the root session.
@@ -225,6 +227,46 @@ export function countTranscriptEntries(jsonl: string): number {
   return count;
 }
 
+/** Key-order-independent structural equality, cheap enough for a small tool_input object. */
+function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const keys = Object.keys(value as Record<string, unknown>).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson((value as Record<string, unknown>)[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+/**
+ * True when the transcript already contains the exact assistant tool_use block that
+ * triggered a PreToolUse hook — the settle-poll anchor (#1116). The hook payload's own
+ * `tool_name`/`tool_input` are the precise call that fired it, so matching them against
+ * the transcript's tool_use blocks (name + structural input equality) is exact, unlike
+ * guessing from transcript shape alone. Claude's JSONL flush is async/bursty and can
+ * lag well behind the hook firing, so the entry backing the hook's own call may still be
+ * missing from disk the instant the hook runs — this is what the settle-poll waits for.
+ * #1086 should adopt this same anchor for its own turn-final settle marker rather than
+ * inventing a second one.
+ */
+export function transcriptHasToolUseAnchor(jsonl: string, toolName: string, toolInput: unknown): boolean {
+  const wantInput = canonicalJson(toolInput ?? {});
+  for (const line of jsonl.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry: TranscriptEntry;
+    try {
+      entry = JSON.parse(trimmed) as TranscriptEntry;
+    } catch {
+      continue;
+    }
+    if (entry.type !== "assistant" || isSidechainEntry(entry)) continue;
+    for (const block of blocks(entry.message)) {
+      if (block.type === "tool_use" && block.name === toolName && canonicalJson(block.input ?? {}) === wantInput) return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Extract the ordered narration, reasoning, and tool steps for the most recent
  * turn (since the last real user prompt). Used by the reasoning tailer to stream
@@ -283,18 +325,25 @@ export class LatestTurnStepAccumulator {
       return;
     }
     if (entry.type !== "assistant") return;
+    const occurredAt = transcriptEntryOccurredAt(entry);
     for (const b of blocks(entry.message)) {
       if (b.type === "text" && typeof b.text === "string" && b.text.trim()) {
-        this.latestSteps.push({ type: "narration", text: b.text.trim() });
+        this.latestSteps.push({ type: "narration", text: b.text.trim(), ...(occurredAt ? { occurredAt } : {}) });
       } else if (b.type === "thinking" && typeof b.thinking === "string" && b.thinking.trim()) {
-        this.latestSteps.push({ type: "reasoning", text: b.thinking.trim() });
+        this.latestSteps.push({ type: "reasoning", text: b.thinking.trim(), ...(occurredAt ? { occurredAt } : {}) });
       } else if (b.type === "tool_use" && typeof b.name === "string" && b.name) {
-        this.latestSteps.push({ type: "tool", label: b.name, text: summarizeToolUse(b.name, b.input) });
+        this.latestSteps.push({ type: "tool", label: b.name, text: summarizeToolUse(b.name, b.input), ...(occurredAt ? { occurredAt } : {}) });
       }
     }
   }
 }
 
+function transcriptEntryOccurredAt(entry: TranscriptEntry): number | undefined {
+  if (typeof entry.timestamp !== "string" || !entry.timestamp) return undefined;
+  const parsed = Date.parse(entry.timestamp);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+
 /**
  * Stable dedup keys for a turn's steps, in order. Each key is salted with how many
  * identical (type,label,text) steps preceded it in the same window — so running the

package/src/control-server.ts

@@ -1,11 +1,12 @@
 import type { Server, ServerWebSocket } from "bun";
 import type { InteractivePrompt, Message, ReplyObligation } from "agent-relay-sdk";
 import { errMessage, isRecord } from "agent-relay-sdk";
-import type { ProviderPermissionDecisionInput, ProviderStatusEvent, SemanticStatus, TerminalAttachSpec } from "./adapter";
+import type { ProviderPermissionDecisionInput, ProviderPermissionDecisionReason, ProviderStatusEvent, SemanticStatus, TerminalAttachSpec } from "./adapter";
 import { obligationRequiresExplicitReply } from "./reply-obligation-cache";
 import { relayReplyActionText } from "./relay-instructions";
 import { logger, parseLogLevel, LOG_LEVELS } from "./logger";
 import { buildRateLimitProviderState } from "./rate-limit";
+import { bestEffortDeletePendingPermissionRequest, bestEffortListPendingPermissionRequests, bestEffortUpsertPendingPermissionRequest, type PendingPermissionRequestRecord, type PendingPermissionStore } from "./pending-permission-store";
 
 // The AskUserQuestion / PermissionRequest hook (runner/plugins/claude/hooks/hooks.json)
 // has a 900s Claude-side timeout. Resolve the server-side wait with a margin UNDER that
@@ -16,6 +17,8 @@ const PERMISSION_WAIT_MS = 880_000;
 // agent can tell "nobody answered in time" (retriable) from "the human said no" (#693).
 const PERMISSION_TIMEOUT_REASON =
   "No response received within ~15 minutes (timeout, not a dismissal). Re-ask if you still need a decision.";
+const PERMISSION_STOP_REASON = "The runner restarted while this permission request was pending; the original hook is no longer connected.";
+const RESOLVED_APPROVAL_LIMIT = 1024;
 
 // A hook that failed in a way it could not handle itself reports here so the
 // failure is never silent (#198 item 5). Phase 1 logs it FATAL to the per-agent
@@ -49,10 +52,15 @@ interface ControlServerOptions {
   // dashboard chat without the agent re-emitting it via /reply.
   // isPreFlush: true signals a mid-turn call from a PreToolUse hook — flush any
   // un-mirrored narrative before the interactive form appears in chat (#435).
+  // toolName/toolInput (#1116): the hook payload's own tool call — the exact anchor the
+  // runner settle-polls the transcript for before draining and returning. The resolved
+  // `reasoningSettled` reflects whether that anchor was actually found (vs a bounded
+  // timeout), so the interactive form can stamp an honest value instead of an assumed one.
   // promptId (#1086): Claude's native `prompt_id` from the Stop hook payload — the
   // stable, provider-native turn identifier used instead of a minted random UUID.
-  onSessionTurn?(input: { transcriptPath: string; lastAssistantMessage?: unknown; promptId?: string; isPreFlush?: boolean }): Promise<void>;
+  onSessionTurn?(input: { transcriptPath: string; lastAssistantMessage?: unknown; promptId?: string; isPreFlush?: boolean; toolName?: string; toolInput?: unknown }): Promise<{ reasoningSettled: boolean } | void>;
   onPermissionResolved?(input: ResolvedPermissionPrompt): Promise<void> | void;
+  onPermissionAbandoned?(input: PendingPermissionRequestRecord & { reason: string; decisionReason: ProviderPermissionDecisionReason }): Promise<void> | void;
   // A provider UserPromptSubmit hook hands over the prompt the human typed
   // directly into the session (web terminal / TUI) so the runner can mirror it
   // into the dashboard chat and start tailing the turn transcript for reasoning.
@@ -71,6 +79,8 @@ interface ControlServerOptions {
   // Test seam: how long the permission hook waits for a dashboard decision before
   // resolving as a timeout. Defaults to PERMISSION_WAIT_MS (margin under the 900s hook).
   permissionWaitMs?: number;
+  instanceId?: string;
+  pendingPermissionStore?: PendingPermissionStore;
 }
 
 export interface ResolvedPermissionPrompt {
@@ -84,6 +94,9 @@ export interface ResolvedPermissionPrompt {
   approvalId: string;
   decision: ProviderPermissionDecisionInput["decision"];
   decisionLabel: string;
+  occurredAt: number;
+  resolvedAt: number;
+  decisionReason: ProviderPermissionDecisionReason;
   questions?: unknown[];
   answers?: Record<string, string>;
 }
@@ -97,6 +110,7 @@ export function startControlServer(options: ControlServerOptions): ControlServer
   // is an idempotent no-op instead of a silent command failure (#693).
   const resolvedApprovals = new Set<string>();
   let server!: Server<MonitorSocketData>;
+  recoverStoredPermissionRequests(options);
 
   server = Bun.serve<MonitorSocketData>({
     hostname: "127.0.0.1",
@@ -188,6 +202,15 @@ export function startControlServer(options: ControlServerOptions): ControlServer
       for (const pending of pendingDeliveries.values()) clearTimeout(pending.timer);
       pendingDeliveries.clear();
       for (const pending of pendingPermissionRequests.values()) clearTimeout(pending.timer);
+      for (const [approvalId, pending] of pendingPermissionRequests.entries()) {
+        const decision = withDecisionReason({
+          approvalId,
+          decision: "deny",
+          reason: PERMISSION_STOP_REASON,
+        }, "dismissed");
+        bestEffortDeletePendingPermissionRequest(options.pendingPermissionStore, approvalId);
+        pending.resolve(decision);
+      }
       pendingPermissionRequests.clear();
       server.stop(true);
     },
@@ -213,9 +236,9 @@ export function startControlServer(options: ControlServerOptions): ControlServer
       }
       clearTimeout(pending.timer);
       pendingPermissionRequests.delete(input.approvalId);
-      resolvedApprovals.add(input.approvalId);
-      if (resolvedApprovals.size > 1024) resolvedApprovals.clear();
-      pending.resolve(input);
+      bestEffortDeletePendingPermissionRequest(options.pendingPermissionStore, input.approvalId);
+      recordResolvedApproval(resolvedApprovals, input.approvalId);
+      pending.resolve(withDecisionReason(input, input.decision === "deny" || input.decision === "abort" ? "dismissed" : "answered"));
       options.onStatus({
         status: "busy",
         reason: "provider-turn",
@@ -232,6 +255,16 @@ export function startControlServer(options: ControlServerOptions): ControlServer
   };
 }
 
+export function recordResolvedApproval(resolvedApprovals: Set<string>, approvalId: string, limit = RESOLVED_APPROVAL_LIMIT): void {
+  resolvedApprovals.delete(approvalId);
+  resolvedApprovals.add(approvalId);
+  while (resolvedApprovals.size > limit) {
+    const oldest = resolvedApprovals.values().next().value;
+    if (!oldest) break;
+    resolvedApprovals.delete(oldest);
+  }
+}
+
 function replyObligationSummary(obligations: ReplyObligation[]): Record<string, unknown> {
   const obligation = obligations[0];
   if (!obligation) return { pending: false, count: 0 };
@@ -259,23 +292,69 @@ function replyObligationStopDecision(obligations: ReplyObligation[]): Record<str
   };
 }
 
+function recoverStoredPermissionRequests(options: ControlServerOptions): void {
+  const store = options.pendingPermissionStore;
+  if (!store) return;
+  for (const record of bestEffortListPendingPermissionRequests(store)) {
+    bestEffortDeletePendingPermissionRequest(store, record.approvalId);
+    const decisionReason: ProviderPermissionDecisionReason = {
+      kind: Date.now() >= record.hookDeadlineAt ? "timeout" : "dismissed",
+      message: Date.now() >= record.hookDeadlineAt ? PERMISSION_TIMEOUT_REASON : PERMISSION_STOP_REASON,
+    };
+    options.onPermissionAbandoned?.({ ...record, reason: decisionReason.message ?? PERMISSION_STOP_REASON, decisionReason });
+  }
+}
+
+function withDecisionReason(input: ProviderPermissionDecisionInput, kind: ProviderPermissionDecisionReason["kind"]): ProviderPermissionDecisionInput {
+  if (input.decisionReason) return input;
+  return {
+    ...input,
+    decisionReason: {
+      kind,
+      ...(input.reason ? { message: input.reason } : {}),
+    },
+  };
+}
+
+function decisionReasonMessage(decision: ProviderPermissionDecisionInput, fallback: string): string {
+  return decision.reason || decision.decisionReason?.message || fallback;
+}
+
 async function handlePermissionRequest(
   req: Request,
-  options: ControlServerOptions,
-  pendingPermissionRequests: Map<string, { resolve(input: ProviderPermissionDecisionInput): void; timer: Timer }>,
+	  options: ControlServerOptions,
+	  pendingPermissionRequests: Map<string, { resolve(input: ProviderPermissionDecisionInput): void; timer: Timer }>,
 ): Promise<Response> {
+  const occurredAt = Date.now();
   const body = await req.json().catch(() => null);
   if (!isRecord(body)) return Response.json({});
-  // #435: flush any un-mirrored narrative from the transcript before the form
-  // appears in chat — the transcript already has the assistant text block at
-  // PreToolUse time, but the Stop hook (which normally captures it) won't fire
-  // until after the user answers, so the form would otherwise arrive first.
+  // #435/#1116: flush any un-mirrored narrative from the transcript before the form
+  // appears in chat. The old comment here asserted the transcript already had the
+  // assistant text block at PreToolUse time — empirically false: Claude's JSONL flush is
+  // async/bursty and can lag the hook firing by a long margin. onSessionTurn now
+  // settle-polls for the exact tool_use entry that triggered this hook (toolName/
+  // toolInput below are that anchor) before draining, and honestly reports back whether
+  // it found the anchor or hit its bounded timeout — reasoningSettled reflects that,
+  // rather than an assumption nothing here confirmed.
   const transcriptPath = typeof body.transcript_path === "string" ? body.transcript_path : "";
+  const toolName = typeof body.tool_name === "string" ? body.tool_name : undefined;
+  const toolInput = isRecord(body.tool_input) ? body.tool_input : undefined;
+  let reasoningSettled = true;
   if (transcriptPath && options.onSessionTurn) {
-    await options.onSessionTurn({ transcriptPath, isPreFlush: true }).catch(() => {});
+    const result = await options.onSessionTurn({ transcriptPath, isPreFlush: true, toolName, toolInput }).catch(() => undefined);
+    if (result && typeof result.reasoningSettled === "boolean") reasoningSettled = result.reasoningSettled;
   }
   const approvalId = crypto.randomUUID();
-  const view = claudePermissionApprovalView(approvalId, body);
+  const view = claudePermissionApprovalView(approvalId, body, reasoningSettled);
+  const waitMs = options.permissionWaitMs ?? PERMISSION_WAIT_MS;
+  const hookDeadlineAt = occurredAt + waitMs;
+  bestEffortUpsertPendingPermissionRequest(options.pendingPermissionStore, {
+    approvalId,
+    view,
+    hookDeadlineAt,
+    ownerInstanceId: options.instanceId ?? "",
+    occurredAt,
+  });
   options.onStatus({
     status: "busy",
     reason: "provider-turn",
@@ -293,24 +372,25 @@ async function handlePermissionRequest(
   const decision = await new Promise<ProviderPermissionDecisionInput>((resolve) => {
     const timer = setTimeout(() => {
       pendingPermissionRequests.delete(approvalId);
-      resolve({ approvalId, decision: "deny", reason: PERMISSION_TIMEOUT_REASON });
-    }, options.permissionWaitMs ?? PERMISSION_WAIT_MS);
+      bestEffortDeletePendingPermissionRequest(options.pendingPermissionStore, approvalId);
+      resolve(withDecisionReason({ approvalId, decision: "deny", reason: PERMISSION_TIMEOUT_REASON }, "timeout"));
+    }, waitMs);
     pendingPermissionRequests.set(approvalId, { resolve, timer });
   });
 
-  if (decision.reason !== PERMISSION_TIMEOUT_REASON && options.onPermissionResolved) {
-    await Promise.resolve(options.onPermissionResolved(claudeResolvedPermissionPrompt(view, decision, body))).catch(() => {});
+  if (decision.decisionReason?.kind !== "timeout" && options.onPermissionResolved) {
+    await Promise.resolve(options.onPermissionResolved(claudeResolvedPermissionPrompt(view, decision, body, occurredAt))).catch(() => {});
   }
 
   return Response.json(claudePermissionHookResponse(decision, body));
 }
 
 // Build the normalized InteractivePrompt for a Claude PreToolUse permission/question hook.
-// reasoningSettled is stamped `true` because handlePermissionRequest pre-flushes the
-// transcript narrative (onSessionTurn isPreFlush) BEFORE this view is built and emitted, so
-// the turn's reasoning is already mirrored ahead of the form (#435/#723). No `provider` tag —
-// the server reads the typed contract, not provider identity.
-function claudePermissionApprovalView(id: string, body: Record<string, unknown>): InteractivePrompt {
+// reasoningSettled is the caller's settle-poll result (#435/#723/#1116): true when
+// handlePermissionRequest's pre-flush confirmed the turn's reasoning was drained before
+// this view was built, false when it hit its bounded timeout without confirming. No
+// `provider` tag — the server reads the typed contract, not provider identity.
+function claudePermissionApprovalView(id: string, body: Record<string, unknown>, reasoningSettled: boolean): InteractivePrompt {
   const toolName = typeof body.tool_name === "string" ? body.tool_name : "Tool";
   const toolInput = isRecord(body.tool_input) ? body.tool_input : {};
   // AskUserQuestion is not a yes/no gate — it asks the user to pick answers.
@@ -326,7 +406,7 @@ function claudePermissionApprovalView(id: string, body: Record<string, unknown>)
       body: "",
       questions: toolInput.questions as InteractivePrompt["questions"],
       choices: [],
-      reasoningSettled: true,
+      reasoningSettled,
     };
   }
   // ExitPlanMode arrives through the generic PermissionRequest hook (it doesn't
@@ -347,7 +427,7 @@ function claudePermissionApprovalView(id: string, body: Record<string, unknown>)
         { id: "approve", label: "Approve plan" },
         { id: "deny", label: "Keep planning" },
       ],
-      reasoningSettled: true,
+      reasoningSettled,
     };
   }
   const command = typeof toolInput.command === "string" ? toolInput.command : "";
@@ -368,7 +448,7 @@ function claudePermissionApprovalView(id: string, body: Record<string, unknown>)
       { id: "deny", label: "Deny" },
       { id: "abort", label: "Abort" },
     ],
-    reasoningSettled: true,
+    reasoningSettled,
   };
 }
 
@@ -389,12 +469,12 @@ function claudePermissionHookResponse(decision: ProviderPermissionDecisionInput,
       };
     }
     return {
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: decision.reason || "Dismissed from Agent Relay dashboard",
-      },
-    };
+	    hookSpecificOutput: {
+	        hookEventName: "PreToolUse",
+	        permissionDecision: "deny",
+	        permissionDecisionReason: decisionReasonMessage(decision, "Dismissed from Agent Relay dashboard"),
+	      },
+	    };
   }
   const hookEventName = "PermissionRequest";
   // AskUserQuestion can be gated by the PermissionRequest hook instead of PreToolUse
@@ -428,16 +508,16 @@ function claudePermissionHookResponse(decision: ProviderPermissionDecisionInput,
   return {
     hookSpecificOutput: {
       hookEventName,
-      decision: {
-        behavior: "deny",
-        message: decision.reason || "Denied from Agent Relay dashboard",
-        interrupt: decision.decision === "abort",
-      },
-    },
+	    decision: {
+	        behavior: "deny",
+	        message: decisionReasonMessage(decision, "Denied from Agent Relay dashboard"),
+	        interrupt: decision.decision === "abort",
+	      },
+	    },
   };
 }
 
-function claudeResolvedPermissionPrompt(view: InteractivePrompt, decision: ProviderPermissionDecisionInput, body: Record<string, unknown>): ResolvedPermissionPrompt {
+function claudeResolvedPermissionPrompt(view: InteractivePrompt, decision: ProviderPermissionDecisionInput, body: Record<string, unknown>, occurredAt: number): ResolvedPermissionPrompt {
   const toolName = typeof body.tool_name === "string" ? body.tool_name : "Tool";
   const toolInput = isRecord(body.tool_input) ? body.tool_input : {};
   const kind = view.kind === "questions" || view.kind === "plan" || view.kind === "command" || view.kind === "tool"
@@ -459,6 +539,9 @@ function claudeResolvedPermissionPrompt(view: InteractivePrompt, decision: Provi
     approvalId: decision.approvalId,
     decision: decision.decision,
     decisionLabel,
+    decisionReason: decision.decisionReason ?? { kind: decision.decision === "deny" || decision.decision === "abort" ? "dismissed" : "answered", ...(decision.reason ? { message: decision.reason } : {}) },
+    occurredAt,
+    resolvedAt: Date.now(),
     ...(questions ? { questions } : {}),
     ...(decision.answers ? { answers: decision.answers } : {}),
   };

package/src/mcp-outbox.ts

@@ -68,8 +68,15 @@ export async function deliverRunnerOutboxEvent(input: RunnerOutboxDelivery): Pro
     logger.warn("outbox", `dropping event with unknown kind: ${record.kind}`);
   } catch (error) {
     if (isHttpStatusError(error, 409)) {
+      const reason = errMessage(error);
       if (record.kind === "session-message-batch") {
-        logger.error("outbox", `relay reported duplicate session batch; acking row seq=${record.seq} batchKey=${record.idempotencyKey} itemKeys=${sessionBatchItemKeys(record).join(",")} error=${errMessage(error)}`);
+        const messages = sessionBatchMessages(record);
+        logger.error("outbox", `relay reported duplicate session batch; acking row seq=${record.seq} batchKey=${record.idempotencyKey} itemKeys=${sessionBatchItemKeys(record).join(",")} error=${reason}`);
+        await emitMirrorDropNotice(input, messages, messages.length, `duplicate idempotency key: ${reason}`, "duplicate-batch");
+      } else if (record.kind === "session-message") {
+        const message = record.payload as SendMessageInput;
+        logger.error("outbox", `relay reported duplicate session message; acking row seq=${record.seq} key=${record.idempotencyKey} error=${reason}`);
+        await emitMirrorDropNotice(input, [message], 1, `duplicate idempotency key: ${reason}`, "duplicate-message");
       }
       return;
     }
@@ -79,14 +86,20 @@ export async function deliverRunnerOutboxEvent(input: RunnerOutboxDelivery): Pro
 }
 
 async function deliverSessionBatchItems(input: RunnerOutboxDelivery, messages: SendMessageInput[]): Promise<void> {
+  const dropped: Array<{ message: SendMessageInput; reason: string }> = [];
   for (const message of messages) {
     try {
       await input.http.sendMessage(message);
     } catch (error) {
       if (!isDeterministicValidationError(error)) throw error;
-      logger.warn("outbox", `dropping invalid session batch item: ${errMessage(error)}`);
+      const reason = errMessage(error);
+      logger.error("outbox", `dropping invalid session batch item key=${message.idempotencyKey ?? "(none)"} error=${reason}`);
+      dropped.push({ message, reason });
     }
   }
+  for (const item of dropped) {
+    await emitMirrorDropNotice(input, [item.message], 1, item.reason, "invalid-item");
+  }
 }
 
 function isDeterministicValidationError(error: unknown): boolean {
@@ -95,10 +108,47 @@ function isDeterministicValidationError(error: unknown): boolean {
 }
 
 function sessionBatchItemKeys(record: OutboxRecord): string[] {
-  const messages = Array.isArray((record.payload as { messages?: unknown }).messages)
+  const messages = sessionBatchMessages(record);
+  return messages.map((message, index) => message.idempotencyKey ?? `${record.idempotencyKey}:${index}`);
+}
+
+function sessionBatchMessages(record: OutboxRecord): SendMessageInput[] {
+  return Array.isArray((record.payload as { messages?: unknown }).messages)
     ? (record.payload as { messages: SendMessageInput[] }).messages
     : [];
-  return messages.map((message, index) => message.idempotencyKey ?? `${record.idempotencyKey}:${index}`);
+}
+
+async function emitMirrorDropNotice(input: RunnerOutboxDelivery, messages: SendMessageInput[], count: number, reason: string, suffix: string): Promise<void> {
+  if (count <= 0) return;
+  const anchor = messages[0];
+  const from = typeof anchor?.from === "string" && anchor.from ? anchor.from : "system";
+  const to = typeof anchor?.to === "string" && anchor.to ? anchor.to : "user";
+  const occurredAt = typeof anchor?.occurredAt === "number" ? anchor.occurredAt : input.record.occurredAt;
+  const body = `${count} steps could not be mirrored: ${reason}`;
+  const idempotencyKey = `session-mirror-drop:${input.record.idempotencyKey}:${suffix}:${shortHash(body)}`;
+  logger.error("outbox", `session mirror drop notice seq=${input.record.seq} count=${count} reason=${reason} noticeKey=${idempotencyKey}`);
+  try {
+    await input.http.sendMessage({
+      from,
+      to,
+      kind: "session",
+      body,
+      idempotencyKey,
+      occurredAt,
+      payload: { session: { type: "notice", origin: "provider", label: "mirror-drop", stepId: idempotencyKey } },
+    });
+  } catch (error) {
+    logger.error("outbox", `failed to emit session mirror drop notice seq=${input.record.seq}; acking original row anyway: ${errMessage(error)}`);
+  }
+}
+
+function shortHash(value: string): string {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < value.length; i++) {
+    h ^= value.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return (h >>> 0).toString(36);
 }
 
 export async function deliverBufferedMcpCall(input: {

package/src/pending-permission-store.ts

@@ -0,0 +1,148 @@
+import { Database } from "bun:sqlite";
+import type { InteractivePrompt } from "agent-relay-sdk";
+import { mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { sanitizeFsName } from "agent-relay-sdk/fs-name";
+import { runnerOutboxDirFromEnv } from "./config";
+import { logger } from "./logger";
+import { errMessage } from "agent-relay-sdk";
+
+export interface PendingPermissionRequestRecord {
+  approvalId: string;
+  view: InteractivePrompt;
+  hookDeadlineAt: number;
+  ownerInstanceId: string;
+  occurredAt: number;
+}
+
+interface PendingPermissionRow {
+  approval_id: string;
+  view: string;
+  hook_deadline_at: number;
+  owner_instance_id: string;
+  occurred_at: number;
+}
+
+export class PendingPermissionStore {
+  private db?: Database;
+  readonly path: string;
+
+  constructor(options: { agentId: string; dir?: string }) {
+    const dir = options.dir ?? runnerOutboxDirFromEnv() ?? join(tmpdir(), "agent-relay-outbox");
+    this.path = options.dir === ":memory:" ? ":memory:" : join(dir, `pending-permissions-${safeName(options.agentId)}.sqlite`);
+    try {
+      if (this.path !== ":memory:") mkdirSync(dirname(this.path), { recursive: true });
+      const db = new Database(this.path, { create: true });
+      db.exec("PRAGMA journal_mode = WAL");
+      db.exec("PRAGMA busy_timeout = 2000");
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS pending_permission_requests (
+          approval_id TEXT PRIMARY KEY,
+          view TEXT NOT NULL,
+          hook_deadline_at INTEGER NOT NULL,
+          owner_instance_id TEXT NOT NULL,
+          occurred_at INTEGER NOT NULL,
+          created_at INTEGER NOT NULL
+        )
+      `);
+      this.db = db;
+    } catch (error) {
+      logger.error("pending-permission-store", `disabled after open failed path=${this.path}: ${errMessage(error)}`);
+      this.db = undefined;
+    }
+  }
+
+  upsert(record: PendingPermissionRequestRecord): void {
+    if (!this.db) return;
+    try {
+      this.db.query(`
+        INSERT INTO pending_permission_requests (approval_id, view, hook_deadline_at, owner_instance_id, occurred_at, created_at)
+        VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(approval_id) DO UPDATE SET
+          view = excluded.view,
+          hook_deadline_at = excluded.hook_deadline_at,
+          owner_instance_id = excluded.owner_instance_id,
+          occurred_at = excluded.occurred_at
+      `).run(record.approvalId, JSON.stringify(record.view), record.hookDeadlineAt, record.ownerInstanceId, record.occurredAt, Date.now());
+    } catch (error) {
+      logger.error("pending-permission-store", `upsert failed approvalId=${record.approvalId}; continuing in-memory only: ${errMessage(error)}`);
+    }
+  }
+
+  delete(approvalId: string): void {
+    if (!this.db) return;
+    try {
+      this.db.query("DELETE FROM pending_permission_requests WHERE approval_id = ?").run(approvalId);
+    } catch (error) {
+      logger.error("pending-permission-store", `delete failed approvalId=${approvalId}; continuing in-memory only: ${errMessage(error)}`);
+    }
+  }
+
+  list(): PendingPermissionRequestRecord[] {
+    if (!this.db) return [];
+    try {
+      const rows = this.db.query("SELECT * FROM pending_permission_requests ORDER BY occurred_at ASC").all() as PendingPermissionRow[];
+      return rows.map((row) => ({
+        approvalId: row.approval_id,
+        view: safeParseView(row.view),
+        hookDeadlineAt: row.hook_deadline_at,
+        ownerInstanceId: row.owner_instance_id,
+        occurredAt: row.occurred_at,
+      }));
+    } catch (error) {
+      logger.error("pending-permission-store", `list failed; continuing without persisted approvals: ${errMessage(error)}`);
+      return [];
+    }
+  }
+
+  close(): void {
+    try { this.db?.close(); } catch { /* already closed */ }
+  }
+}
+
+export function bestEffortListPendingPermissionRequests(store: PendingPermissionStore | undefined): PendingPermissionRequestRecord[] {
+  try {
+    return store?.list() ?? [];
+  } catch (error) {
+    logger.error("pending-permission-store", `list failed; continuing without persisted approvals: ${errMessage(error)}`);
+    return [];
+  }
+}
+
+export function bestEffortUpsertPendingPermissionRequest(store: PendingPermissionStore | undefined, record: PendingPermissionRequestRecord): void {
+  try {
+    store?.upsert(record);
+  } catch (error) {
+    logger.error("pending-permission-store", `upsert failed approvalId=${record.approvalId}; continuing in-memory only: ${errMessage(error)}`);
+  }
+}
+
+export function bestEffortDeletePendingPermissionRequest(store: PendingPermissionStore | undefined, approvalId: string): void {
+  try {
+    store?.delete(approvalId);
+  } catch (error) {
+    logger.error("pending-permission-store", `delete failed approvalId=${approvalId}; continuing in-memory only: ${errMessage(error)}`);
+  }
+}
+
+function safeName(value: string): string {
+  return sanitizeFsName(value, { replacement: "_", maxLen: 180, fallback: "agent" });
+}
+
+function safeParseView(json: string): InteractivePrompt {
+  try {
+    const parsed = JSON.parse(json);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed as InteractivePrompt;
+  } catch {
+    // Fall through to a valid placeholder so recovery can still emit a notice and clear the row.
+  }
+  return {
+    id: "unknown",
+    kind: "tool",
+    title: "Recovered permission request",
+    body: "The original permission request could not be decoded.",
+    choices: [],
+    reasoningSettled: false,
+  };
+}

package/src/runner-core.ts

@@ -16,7 +16,7 @@ import { readRunnerContextProbeState } from "./context-probe-state";
 import { startControlServer, type ControlServer, type ResolvedPermissionPrompt } from "./control-server";
 import { ReplyObligationCache, obligationRequiresExplicitReply, responseCaptureReplyRoute } from "./reply-obligation-cache";
 import { Outbox, type OutboxRecord } from "./outbox";
-import { extractLastAssistantTurn, extractLastAssistantTurnAfterEntry, extractAssistantTurnForPrompt, countTranscriptEntries, extractHookAssistantMessage, extractLatestTurnSteps, stepDedupKeys, transcriptLooksComplete } from "./adapters/claude-transcript";
+import { extractLastAssistantTurn, extractLastAssistantTurnAfterEntry, extractAssistantTurnForPrompt, countTranscriptEntries, extractHookAssistantMessage, extractLatestTurnSteps, stepDedupKeys, transcriptHasToolUseAnchor, transcriptLooksComplete } from "./adapters/claude-transcript";
 import { IncrementalClaudeTranscriptTail } from "./adapters/claude-transcript-tail";
 import { getManifest } from "agent-relay-providers";
 import { profileUsesProviderHostGlobals } from "./profile-home";
@@ -29,6 +29,7 @@ import { deliverBufferedMcpCall as deliverBufferedMcpOutboxCall, deliverRunnerOu
 import { RunnerInsights } from "./runner-insights";
 import { BusyReconciler } from "./busy-reconciler";
 import { publishCapturedResponse } from "./response-capture-report";
+import { PendingPermissionStore, type PendingPermissionRequestRecord } from "./pending-permission-store";
 import { runnerLaunchInjectionSessionEvents, type RunnerRelayInjectionEvent } from "./relay-injection-events";
 import { providerTerminalSession, providerTerminalSocket } from "./process-meta";
 import { capsFromEnv, logLevelFromEnv, mcpProxyEnabledFromEnv, orchestratorBaseDirFromEnv, orchestratorUrlFromEnv, registrationTimeoutMsFromEnv, runnerInfoFileFromEnv, runnerLogFileFromEnv, runnerOutboxDirWithInfoFallback, sessionDebugEnabled, tagsFromEnv, workspaceModeFromEnv } from "./config";
@@ -153,6 +154,13 @@ const MAX_INITIAL_PROMPT_ATTEMPTS = 6;
 // transcript bytes.
 const REASONING_POLL_MS = 1_200;
 const SESSION_MIRROR_BATCH_MAX = 100;
+// #1116: bounded settle-poll for the PreToolUse pre-flush anchor. Claude's JSONL flush is
+// async/bursty and can lag the hook firing by a long margin, so a one-shot read (the old
+// #435/#499 behavior) often finds nothing. Poll at this cadence until the exact triggering
+// tool_use entry lands on disk, but never past the timeout — the question must never block
+// the user more than a few seconds waiting on a transcript write that might not be coming.
+const SETTLE_POLL_INTERVAL_MS = 250;
+const SETTLE_POLL_TIMEOUT_MS = 4_000;
 interface RunnerTimelineEvent {
   status: string;
   id?: string;
@@ -184,6 +192,7 @@ export class AgentRunner {
   // their own FIFO queue stops one transient trace failure from head-of-line blocking real-message
   // delivery (and vice versa); its backoff is capped low since a stale live-mirror frame is cheap.
   private readonly sessionOutbox: Outbox;
+  private readonly pendingPermissionStore: PendingPermissionStore;
   private sessionBatchSeq = 0;
   private readonly insights: RunnerInsights;
   private readonly busyReconciler: BusyReconciler;
@@ -285,6 +294,10 @@ export class AgentRunner {
   // Reasoning tailer (item 5): streams the in-flight turn's reasoning/tool steps
   // from the Claude transcript into chat as discreet session events.
   private reasoningTail?: ReasoningTailState;
+  // Settle-poll cadence for the pre-flush anchor (#1116) — instance fields (not just the
+  // module constants) so tests can shrink them without waiting out the real bound.
+  private settlePollIntervalMs = SETTLE_POLL_INTERVAL_MS;
+  private settlePollTimeoutMs = SETTLE_POLL_TIMEOUT_MS;
   private scratch?: SessionScratchLayout;
   // #417: for non-claude providers, tracks how many times each spawner obligation has
   // been re-injected so a non-responsive agent can't spin in a re-injection loop.
@@ -322,6 +335,7 @@ export class AgentRunner {
       maxBackoffMs: 5_000,
       maxAttempts: 6,
     });
+    this.pendingPermissionStore = new PendingPermissionStore({ agentId: this.agentId, dir: outboxDir });
     this.insights = new RunnerInsights({
       agentId: this.agentId,
       cwd: options.cwd,
@@ -424,10 +438,13 @@ export class AgentRunner {
       // Hot-path-safe: answered instantly from the local snapshot, never a server
       // round-trip. The snapshot is kept warm by the background refresh below (#196).
       onReplyObligations: () => Promise.resolve(this.obligationCache.get()),
-      onSessionTurn: (input) => this.publishSessionTurn(input), onPermissionResolved: (input) => this.publishSessionEvent({ from: this.agentId, to: "user", body: input.body, session: { type: "prompt-resolution", origin: "provider", label: input.decisionLabel, ...(this.currentTurnId ? { turnId: this.currentTurnId } : {}), stepId: `prompt-resolution:${input.approvalId}`, promptResolution: input } }),
+      onSessionTurn: (input) => this.publishSessionTurn(input), onPermissionResolved: (input) => this.publishSessionEvent({ from: this.agentId, to: "user", body: input.body, occurredAt: input.occurredAt, session: { type: "prompt-resolution", origin: "provider", label: input.decisionLabel, ...(this.currentTurnId ? { turnId: this.currentTurnId } : {}), stepId: `prompt-resolution:${input.approvalId}`, promptResolution: input } }),
+      onPermissionAbandoned: (input) => this.publishPermissionAbandonedNotice(input),
       onUserPrompt: (input) => this.handleUserPrompt(input),
       onSessionBoundary: (input) => this.handleSessionBoundary(input),
       onHookFatal: (report) => this.reportHookFatal(report),
+      instanceId: this.options.instanceId,
+      pendingPermissionStore: this.pendingPermissionStore,
     });
     this.startMcpProxy();
     this.writeRunnerInfoFile();
@@ -496,7 +513,7 @@ export class AgentRunner {
     this.busyReconciler.disarm();
     this.stopReasoningTail();
     this.obligationCache.stop();
-    this.outbox.close(); this.sessionOutbox.close();
+    this.outbox.close(); this.sessionOutbox.close(); this.pendingPermissionStore.close();
     this.proxy?.stop();
     this.control?.stop();
     await this.bus.close();
@@ -1435,17 +1452,21 @@ export class AgentRunner {
   // no relay message) are mirrored too. A reply obligation, when present, is still
   // used as replyTo so the Stop hook stops nagging the agent to /reply.
   //
-  // isPreFlush: true (#435/#499) — mid-turn PreToolUse boundary. Drain the live
-  // tail and force-flush session messages before showing the blocking control;
-  // the entry cursor lets Stop capture skip already-emitted text.
-  private async publishSessionTurn(input: { transcriptPath: string; lastAssistantMessage?: unknown; promptId?: string; isPreFlush?: boolean }): Promise<void> {
+  // isPreFlush: true (#435/#499/#1116) — mid-turn PreToolUse boundary. Settle-polls the
+  // transcript for the exact tool_use entry that triggered the hook (toolName/toolInput,
+  // the hook payload's own anchor), then drains the live tail and force-flushes session
+  // messages before showing the blocking control; the entry cursor lets Stop capture skip
+  // already-emitted text. Returns whether the settle-poll actually found the anchor
+  // (reasoningSettled) — an honest `false` on timeout rather than a stamped `true` on a
+  // premise nothing here confirmed (#1116; see InteractivePrompt.reasoningSettled).
+  private async publishSessionTurn(input: { transcriptPath: string; lastAssistantMessage?: unknown; promptId?: string; isPreFlush?: boolean; toolName?: string; toolInput?: unknown }): Promise<{ reasoningSettled: boolean } | void> {
     if (input.transcriptPath) this.lastTranscriptPath = input.transcriptPath;
 
     if (input.isPreFlush) {
-      if (!input.transcriptPath) return;
-      let jsonl: string | undefined;
-      try { jsonl = await readFile(input.transcriptPath, "utf8"); } catch { return; }
-      if (!jsonl) return;
+      if (!input.transcriptPath) return { reasoningSettled: true };
+      const settled = await this.settlePollForToolUse(input.transcriptPath, input.toolName, input.toolInput);
+      const jsonl = settled.jsonl;
+      if (jsonl === undefined) return { reasoningSettled: false };
       const body = extractLastAssistantTurnAfterEntry(jsonl, this.narrativeFlushEntryCount);
       await this.drainReasoningTail();
       this.narrativeFlushEntryCount = countTranscriptEntries(jsonl);
@@ -1455,7 +1476,7 @@ export class AgentRunner {
         await this.publishSessionEvent({ from: this.agentId, to: "user", body, session: { type: "response", origin: "provider", ...(turnId ? { turnId } : {}) } });
       }
       await this.sessionOutbox.flush(2_000).then((ok) => { if (!ok) this.sessionLog(`pre-flush session outbox incomplete before blocking control (${this.sessionOutbox.pendingCount()} pending)`); }, (error) => this.sessionLog(`pre-flush session outbox failed before blocking control: ${errMessage(error)}`));
-      return;
+      return { reasoningSettled: settled.settled };
     }
 
     // Claude's Stop hook reports its own native `prompt_id` — the same UUID the
@@ -1465,6 +1486,11 @@ export class AgentRunner {
     // prompt_id at turn start — see setProviderStatus / handleUserPrompt), but this
     // prefers the freshest source so finalization is correct even if the two drift.
     const turnId = input.promptId ?? this.currentTurnId;
+    // #1116: drain whatever the tail hasn't polled yet BEFORE stopping it — stopping first
+    // (the old order) clears the poll/timer state, so any steps Claude flushed in the last
+    // window between the tail's previous tick and this Stop hook were silently dropped from
+    // the step lane instead of reaching chat.
+    await this.drainReasoningTail();
     this.stopReasoningTail();
     // Optional correlation for threading + obligation clearing — never a capture gate.
     let replyToMessageId: number | undefined, replyTarget = "user";
@@ -1550,22 +1576,18 @@ export class AgentRunner {
   // tool step) as a `kind: "session"` relay message tagged with payload.session so
   // the dashboard can render the live provider session faithfully. Display-only:
   // session messages are never delivered back into a provider.
-  private publishSessionEvent(input: {
-    from: string;
-    to: string;
-    body: string;
-    session: MessageSessionMeta;
-    replyTo?: number;
-  }): void {
-    // Durable, ordered, timestamped (#196): the actual POST happens in deliverOutboxEvent,
-    // retried until it lands. occurredAt is stamped now so a queued event reports when it
-    // truly happened, not when the server finally accepted it. Routed through the fast-lane
-    // sessionOutbox (#332) so a transient trace failure can't head-of-line block real messages.
+  private publishSessionEvent(input: { from: string; to: string; body: string; session: MessageSessionMeta; replyTo?: number; occurredAt?: number }): void {
+    // Durable, ordered, timestamped (#196/#1115): the actual POST happens in
+    // deliverOutboxEvent, retried until it lands. An explicit occurredAt preserves the
+    // provider-native event time; otherwise the outbox stamps enqueue time. Routed through
+    // the fast-lane sessionOutbox (#332) so a transient trace failure can't head-of-line
+    // block real messages.
     // A stepId-bearing step (Codex tool running→completed, streamed reasoning/response) uses a
     // STABLE idempotency key so the server upserts the row in place instead of appending a dup.
     const stepId = input.session.stepId;
     this.sessionOutbox.enqueue({
       kind: "session-message",
+      ...(input.occurredAt ? { occurredAt: input.occurredAt } : {}),
       ...(stepId ? { idempotencyKey: `session-step:${input.from}:${input.session.turnId ?? ""}:${stepId}` } : {}),
       payload: {
         from: input.from,
@@ -1578,13 +1600,7 @@ export class AgentRunner {
     });
   }
 
-  private publishSessionEventsBatch(inputs: Array<{
-    from: string;
-    to: string;
-    body: string;
-    session: MessageSessionMeta;
-    replyTo?: number;
-  }>): void {
+  private publishSessionEventsBatch(inputs: Array<{ from: string; to: string; body: string; session: MessageSessionMeta; replyTo?: number; occurredAt?: number }>): void {
     for (let i = 0; i < inputs.length; i += SESSION_MIRROR_BATCH_MAX) {
       const chunk = inputs.slice(i, i + SESSION_MIRROR_BATCH_MAX);
       if (chunk.length === 1) {
@@ -1599,6 +1615,7 @@ export class AgentRunner {
           ...(input.replyTo ? { replyTo: input.replyTo } : {}),
           kind: "session",
           body: input.body,
+          ...(input.occurredAt ? { occurredAt: input.occurredAt } : {}),
           ...(stepId ? { idempotencyKey: `session-step:${input.from}:${input.session.turnId ?? ""}:${stepId}` } : {}),
           payload: { session: { provider: this.options.provider, ...input.session } },
         } satisfies SendMessageInput;
@@ -1940,7 +1957,7 @@ export class AgentRunner {
       }
       const turnId = this.currentTurnId ?? turnIdAtStart;
       let emitted = 0;
-      const batch: Array<{ from: string; to: string; body: string; session: MessageSessionMeta }> = [];
+      const batch: Array<{ from: string; to: string; body: string; session: MessageSessionMeta; occurredAt?: number }> = [];
       for (const { sig, step } of keyed) {
         if (seen.has(sig)) continue;
         seen.add(sig);
@@ -1949,6 +1966,7 @@ export class AgentRunner {
           from: this.agentId,
           to: "user",
           body: step.text,
+          ...(step.occurredAt ? { occurredAt: step.occurredAt } : {}),
           session: { type: step.type, origin: "provider", ...(turnId ? { turnId } : {}), ...(step.label ? { label: step.label } : {}) },
         });
         if (step.type === "narration") emittedNarrationKeys.add(sig);
@@ -1971,6 +1989,28 @@ export class AgentRunner {
     await this.reasoningTail?.poll();
   }
 
+  // #1116: bounded settle-poll for the PreToolUse pre-flush anchor. The old pre-flush read
+  // the transcript exactly once and, on the false premise that Claude's JSONL write is
+  // synchronous with the hook firing, treated whatever it found (often nothing) as complete.
+  // Claude's flush is actually async/bursty — sometimes gated on the hook's own resolution —
+  // so this polls at settlePollIntervalMs until the transcript contains the EXACT tool_use
+  // entry that triggered the hook (toolName/toolInput from the hook payload is the precise
+  // anchor), then returns the freshest read. Never polls past settlePollTimeoutMs — the
+  // question must ship regardless, just honestly flagged as `settled: false` when it does.
+  // No toolName (a caller that can't identify an anchor) skips straight to a single read,
+  // matching the old one-shot behavior.
+  private async settlePollForToolUse(transcriptPath: string, toolName?: string, toolInput?: unknown): Promise<{ settled: boolean; jsonl?: string }> {
+    const deadline = Date.now() + this.settlePollTimeoutMs;
+    for (;;) {
+      let jsonl: string | undefined;
+      try { jsonl = await readFile(transcriptPath, "utf8"); } catch { jsonl = undefined; }
+      if (!toolName) return { settled: Boolean(jsonl), jsonl };
+      if (jsonl !== undefined && transcriptHasToolUseAnchor(jsonl, toolName, toolInput)) return { settled: true, jsonl };
+      if (Date.now() >= deadline) return { settled: false, jsonl };
+      await Bun.sleep(this.settlePollIntervalMs);
+    }
+  }
+
   private preFlushBodyAlreadyMirroredByReasoningTail(jsonl: string, body: string): boolean {
     const tail = this.reasoningTail;
     if (!tail || !tail.emittedNarrationKeys.size) return false;
@@ -2003,6 +2043,23 @@ export class AgentRunner {
     });
   }
 
+  private publishPermissionAbandonedNotice(input: PendingPermissionRequestRecord & { reason: string }): void {
+    const title = input.view.title || "permission request";
+    this.publishSessionEvent({
+      from: this.agentId,
+      to: "user",
+      body: `Permission request denied after runner restart: ${title}. ${input.reason}`,
+      occurredAt: Date.now(),
+      session: {
+        type: "notice",
+        origin: "provider",
+        label: "permission-denied",
+        stepId: `permission-abandoned:${input.approvalId}`,
+        ...(this.currentTurnId ? { turnId: this.currentTurnId } : {}),
+      },
+    });
+  }
+
   // #286: a discreet, durable chat marker when a usage/rate-limit hold begins, via
   // the same session-mirror lane as the compaction notice. Outbound session event
   // (NOT an inbound message) so it shows in the dashboard chat WITHOUT waking a turn