agent-tower 0.6.0-beta.11 → 0.6.0-beta.13

package/dist/services/session-manager.js

@@ -1,24 +1,39 @@
 import { prisma } from '../utils/index.js';
 import { SessionStatus, SessionPurpose, TaskStatus, SessionContext } from '../types/index.js';
-import { getProviderById, ExecutionEnv, normalizeExecutorStartError, } from '../executors/index.js';
+import { getProviderById, ExecutionEnv, isPreChildProcessFailure, markPreChildProcessFailure, normalizeExecutorStartError, } from '../executors/index.js';
 import { filterAgentSubprocessExternalEnv } from '../executors/execution-env.js';
 import { sessionMsgStoreManager, createUserMessage, addNormalizedEntry, } from '../output/index.js';
 import { execGit } from '../git/git-cli.js';
 import { getCommitMessageService } from '../core/container.js';
 import { TeamReconcilerService } from './team-reconciler.service.js';
-import { NotFoundError, ValidationError } from '../errors.js';
+import { acquireTeamMemberAdmission } from './team-member-admission-barrier.js';
+import { NotFoundError, ServiceError, ValidationError } from '../errors.js';
+import { AgentRuntimeError } from '../runtime/errors.js';
 import { ensureTaskNotDeleted } from './deleted-task-guard.js';
 import { getWorkspaceWorkingDir, isMainDirectoryWorkspace, } from './workspace-kind.js';
 import { writeErrorLog } from '../utils/error-log.js';
 import { AGENT_API_CREDENTIAL_ENV, clearAgentApiCredentials, createAgentApiCredential, revokeAgentApiCredential, } from '../utils/agent-api-credential.js';
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { RuntimeType, supportsAgentRuntime } from '@agent-tower/shared';
 import { getProviderRuntimeType } from '../executors/providers.js';
 import { appendAgentOutputIntentInstructions } from '../prompts/agent-output-intents.js';
 import { AgentArtifactService } from './agent-artifact.service.js';
 import { CliRuntimeDriver, AcpRuntimeDriver, RuntimeCoordinator, StaticRuntimeRegistry, setRuntimeStateSnapshot, } from '../runtime/index.js';
 import { buildWorkspaceRuntimePrompt } from '../prompts/workspace-background-service-policy.js';
+import { cleanupPersistedAcpProcessTree, } from '../runtime/acp/process-manager.js';
+import { evaluateSessionRuntimeCleanup, RUNTIME_LAUNCH_STATES, } from './session-runtime-cleanup-gate.js';
 const DEBUG_SNAPSHOT = process.env.DEBUG_SNAPSHOT === 'true';
+const PROCESS_CLEANUP_RETRY_DELAYS_MS = [1_000, 5_000, 30_000, 120_000, 300_000];
+const PENDING_RUNTIME_EVENT_TTL_MS = 60_000;
+const PENDING_RUNTIME_EVENTS_PER_KEY = 8;
+const PENDING_RUNTIME_EVENTS_GLOBAL = 128;
+const CONVERSATION_TURN_QUEUED = 'QUEUED';
+const CONVERSATION_TURN_RUNNING = 'RUNNING';
+const CONVERSATION_TURN_COMPLETED = 'COMPLETED';
+const CONVERSATION_TURN_FAILED = 'FAILED';
+function eventKey(sessionId, runtimeInstanceId, launchClaimNumber) {
+    return `${sessionId}:${runtimeInstanceId}:${launchClaimNumber}`;
+}
 function hashForLog(value) {
     return createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
@@ -89,9 +104,22 @@ export class SessionManager {
     heartbeatThrottle = new Map();
     teamReconciler;
     runtimeCoordinator;
+    /** In-memory process owners are generation-scoped, never runtime-id global. */
     runtimeProcessIds = new Map();
+    /** Early exit/tree completion events can arrive before started-row persistence. */
+    pendingRuntimeProcessEvents = new Map();
+    pendingRuntimeEventExpiryTimers = new Map();
     runtimePermissionStates = new Map();
     externalSessionPersistence = new Map();
+    /** Durable conversation turns are consumed one at a time per Session. */
+    conversationQueueWorkers = new Map();
+    conversationQueueStopping = false;
+    /** Admission boundary covering the short initial-start -> process-owning handoff. */
+    pendingInitialStarts = new Map();
+    initialStartResolvers = new Map();
+    /** Same boundary for follow-up/reply turns, which can race a direct stop. */
+    pendingProcessStarts = new Map();
+    processStartResolvers = new Map();
     artifactService = new AgentArtifactService();
     static SNAPSHOT_CHECKPOINT_MS = 15_000;
     static HEARTBEAT_THROTTLE_MS = 30_000;
@@ -111,7 +139,19 @@ export class SessionManager {
             onTurnEvent: (event) => this.handleRuntimeTurnEvent(event),
             onRuntimeState: (state) => this.handleRuntimeState(state),
             onProcessEvent: (event) => this.handleRuntimeProcessEvent(event),
-            onDriverSessionDisposed: (sessionId) => revokeAgentApiCredential(sessionId),
+            onDriverSessionDisposeStarted: (sessionId, runtimeInstanceId, launchClaimNumber) => {
+                return this.markRuntimeProcessCleanupPending(sessionId, runtimeInstanceId, launchClaimNumber);
+            },
+            onDriverSessionDisposed: (sessionId) => {
+                revokeAgentApiCredential(sessionId);
+            },
+            onDriverSessionDisposedInstance: (sessionId, runtimeInstanceId, launchClaimNumber) => {
+                return this.markRuntimeProcessCleanupState(sessionId, runtimeInstanceId, 'CONFIRMED', undefined, launchClaimNumber);
+            },
+            onDriverSessionDisposeFailed: (sessionId, runtimeInstanceId, error, launchClaimNumber) => {
+                this.logSessionError('session.runtimeDispose', error, { sessionId, runtimeInstanceId });
+                return this.markRuntimeProcessCleanupState(sessionId, runtimeInstanceId, 'FAILED', error instanceof Error ? error.message : String(error), launchClaimNumber);
+            },
         });
         // Patches only mark the snapshot dirty. A low-frequency checkpoint keeps the
         // hot stream away from SQLite while terminal paths still force a final flush.
@@ -132,7 +172,10 @@ export class SessionManager {
             // The parser has already written raw stdout, the final assistant entry,
             // usage and all other state from the turn.completed chunk at this point.
             this.terminalSessions.set(sessionId, SessionStatus.COMPLETED);
-            this.startSessionFinalization(sessionId, 0, { logicalCompletion: true });
+            this.startSessionFinalization(sessionId, 0, {
+                logicalCompletion: true,
+                runtimeInstanceId: this.runtimeCoordinator.getRuntimeInstanceId(sessionId),
+            });
         });
         this.eventBus.on('session:turn-failed', ({ sessionId }) => {
             if (this.terminalSessions.has(sessionId))
@@ -141,7 +184,10 @@ export class SessionManager {
             // without an exit code. Use a synthetic non-zero code for the shared
             // finalization path so success-only post-processing cannot run.
             this.terminalSessions.set(sessionId, SessionStatus.FAILED);
-            this.startSessionFinalization(sessionId, 1, { logicalCompletion: true });
+            this.startSessionFinalization(sessionId, 1, {
+                logicalCompletion: true,
+                runtimeInstanceId: this.runtimeCoordinator.getRuntimeInstanceId(sessionId),
+            });
         });
         // NOTE: checkTaskAutoRevert is called directly (awaited) inside start()
         // and sendMessage() to guarantee the task status is updated before the
@@ -158,6 +204,168 @@ export class SessionManager {
     getRuntimeState(sessionId, runtimeType = RuntimeType.CLI) {
         return this.runtimeCoordinator.getState(sessionId, runtimeType);
     }
+    /**
+     * Persist a conversation message and schedule its runtime turn. The caller
+     * only waits for the SQLite insert; ACP startup and prompt delivery happen
+     * in the per-session queue worker.
+     */
+    async enqueueConversationMessage(sessionId, message, providerId) {
+        const enqueueStartedAt = Date.now();
+        const session = await this.findSessionExecutionRecord(sessionId);
+        if (!session) {
+            throw new NotFoundError('Session', sessionId);
+        }
+        this.ensureExecutionRecordIsLive(session);
+        if (!this.isConversationSession(session)) {
+            throw new ValidationError('Only conversation sessions support queued messages');
+        }
+        const effectiveProviderId = providerId ?? session.providerId;
+        if (effectiveProviderId) {
+            const provider = getProviderById(effectiveProviderId);
+            if (!provider) {
+                throw new ValidationError(`Provider not found: ${effectiveProviderId}`);
+            }
+            if (String(provider.agentType) !== session.agentType) {
+                throw new ValidationError(`Cannot switch provider: agentType mismatch. Session uses '${session.agentType}', but provider '${provider.name}' is for '${provider.agentType}'`);
+            }
+            if (getProviderRuntimeType(provider) !== this.normalizeRuntimeType(session.runtimeType)) {
+                throw new ValidationError(`Cannot switch provider: runtimeType mismatch. Session uses '${session.runtimeType}', but provider '${provider.name}' uses '${getProviderRuntimeType(provider)}'`);
+            }
+        }
+        // Generate both identifiers before the insert. The entry id is persisted
+        // with the queue row so a crash between applying the in-memory patch and
+        // updating the row remains replayable without creating a duplicate entry.
+        const turnId = randomUUID();
+        const userEntryId = `user:${turnId}`;
+        const turn = await prisma.conversationTurn.create({
+            data: {
+                id: turnId,
+                sessionId,
+                message,
+                userEntryId,
+                providerId: providerId ?? null,
+                status: CONVERSATION_TURN_QUEUED,
+            },
+            select: { id: true },
+        });
+        // Reflect the user message immediately. This is local, synchronous work;
+        // the expensive ACP startup/prompt remains exclusively in the worker. If
+        // the in-memory snapshot cannot be updated, leave the durable turn queued
+        // so the worker can retry the append instead of losing the message.
+        try {
+            this.appendUserMessageEntry(session, message, userEntryId);
+        }
+        catch (error) {
+            this.logSessionError('conversation.queueUserEntry', error, {
+                sessionId,
+                turnId: turn.id,
+            });
+        }
+        this.kickConversationQueue(sessionId);
+        console.log(`[ConversationQueue] enqueued session=${sessionId} turn=${turn.id} persistMs=${Date.now() - enqueueStartedAt}`);
+        return { turnId: turn.id };
+    }
+    /** Recover turns left in RUNNING state by an interrupted server process. */
+    async startConversationQueue() {
+        this.conversationQueueStopping = false;
+        await prisma.conversationTurn.updateMany({
+            where: { status: CONVERSATION_TURN_RUNNING },
+            data: {
+                status: CONVERSATION_TURN_QUEUED,
+                startedAt: null,
+            },
+        });
+        const pending = await prisma.conversationTurn.findMany({
+            where: { status: CONVERSATION_TURN_QUEUED },
+            select: { sessionId: true },
+            distinct: ['sessionId'],
+        });
+        for (const turn of pending) {
+            this.kickConversationQueue(turn.sessionId);
+        }
+    }
+    /** Stop scheduling new work during the Fastify shutdown phase. */
+    stopConversationQueue() {
+        this.conversationQueueStopping = true;
+    }
+    /** Dispose a TeamRun-owned runtime after its invocation reaches a terminal state. */
+    async disposeRuntimeSession(sessionId, expectedRuntimeInstanceId) {
+        await this.runtimeCoordinator.disposeSession(sessionId, expectedRuntimeInstanceId);
+    }
+    async retryRuntimeProcessCleanup(input) {
+        if (!Number.isInteger(input.launchClaimNumber) || input.launchClaimNumber <= 0) {
+            await this.quarantinePersistedRuntimeProcess(input.sessionId, input.runtimeInstanceId, 'Runtime cleanup evidence is missing launchClaimNumber; automated signalling is disabled', null);
+            throw new AgentRuntimeError('process_identity_mismatch', 'close', 'Runtime cleanup evidence is missing launchClaimNumber', true);
+        }
+        try {
+            if (this.runtimeCoordinator.hasRuntimeInstance(input.sessionId, input.runtimeInstanceId)) {
+                await this.runtimeCoordinator.disposeSession(input.sessionId, input.runtimeInstanceId);
+                return;
+            }
+            await cleanupPersistedAcpProcessTree(input);
+            await this.markRuntimeProcessCleanupState(input.sessionId, input.runtimeInstanceId, 'CONFIRMED', undefined, input.launchClaimNumber);
+        }
+        catch (error) {
+            await this.markRuntimeProcessCleanupState(input.sessionId, input.runtimeInstanceId, 'FAILED', error instanceof Error ? error.message : String(error), input.launchClaimNumber);
+            throw error;
+        }
+    }
+    hasRuntimeProcessOwner(runtimeInstanceId, sessionId, launchClaimNumber) {
+        if (sessionId && Number.isInteger(launchClaimNumber) && launchClaimNumber > 0) {
+            return this.runtimeProcessIds.has(eventKey(sessionId, runtimeInstanceId, launchClaimNumber));
+        }
+        return [...this.runtimeProcessIds.keys()].some((key) => key.split(':')[1] === runtimeInstanceId);
+    }
+    async quarantinePersistedRuntimeProcess(sessionId, runtimeInstanceId, diagnostic, launchClaimNumber) {
+        if (!Number.isInteger(launchClaimNumber) || launchClaimNumber <= 0) {
+            // Without a generation claim there is no safe process-row target. Keep
+            // the session blocked, but never mutate another launch's owner row.
+            await prisma.session.updateMany({
+                where: { id: sessionId },
+                data: {
+                    runtimeLaunchState: RUNTIME_LAUNCH_STATES.QUARANTINED,
+                    runtimeLaunchDiagnostic: diagnostic.slice(0, 2_000),
+                    runtimeLaunchDiagnosticCount: { increment: 1 },
+                    runtimeLaunchNextDiagnosticAt: new Date(Date.now() + 5 * 60_000),
+                },
+            }).catch((error) => {
+                this.logSessionError('session.processCleanupQuarantine', error, { sessionId, runtimeInstanceId });
+            });
+            return;
+        }
+        await prisma.executionProcess.updateMany({
+            where: {
+                sessionId,
+                runtimeInstanceId,
+                launchClaimNumber,
+                cleanupState: { not: 'CONFIRMED' },
+            },
+            data: {
+                cleanupState: 'QUARANTINED',
+                cleanupError: diagnostic.slice(0, 2_000),
+                cleanupAttemptCount: { increment: 1 },
+                nextCleanupRetryAt: new Date(Date.now() + 5 * 60_000),
+            },
+        }).catch((error) => {
+            this.logSessionError('session.processCleanupQuarantine', error, { sessionId, runtimeInstanceId });
+        });
+    }
+    runtimeProcessKeyFor(sessionId, runtimeInstanceId) {
+        const prefix = sessionId + ':' + runtimeInstanceId + ':';
+        return [...this.runtimeProcessIds.keys()].find((key) => key.startsWith(prefix));
+    }
+    launchClaimFromRuntimeProcessKey(key) {
+        if (!key)
+            return undefined;
+        const claim = Number(key.slice(key.lastIndexOf(':') + 1));
+        return Number.isInteger(claim) && claim > 0 ? claim : undefined;
+    }
+    async isRuntimeCleanupConfirmed(sessionId) {
+        return (await evaluateSessionRuntimeCleanup(sessionId, {
+            hasActiveTurn: (candidateId) => this.hasActiveTurn(candidateId),
+            hasRuntimeProcessOwner: (runtimeInstanceId, ownerSessionId, launchClaimNumber) => this.hasRuntimeProcessOwner(runtimeInstanceId, ownerSessionId ?? sessionId, launchClaimNumber),
+        })).confirmed;
+    }
     async resolveRuntimePermission(sessionId, requestId, optionId) {
         await this.runtimeCoordinator.resolvePermission(sessionId, requestId, optionId);
     }
@@ -201,19 +409,25 @@ export class SessionManager {
             console.log('[SessionManager] ❌ Session not found:', id);
             return null;
         }
-        await this.waitForPendingAutoCommit(id);
-        this.beginSessionExecution(id);
-        this.ensureExecutionRecordIsLive(session);
-        const workingDir = this.getExecutionWorkingDir(session);
-        console.log('[SessionManager] Session details:', {
-            id: session.id,
-            agentType: session.agentType,
-            variant: session.variant,
-            prompt: summarizeTextForLog(session.prompt),
-            workingDir,
-        });
-        await this.startRuntimeTurn(session, session.prompt, session.externalSessionId);
-        return session;
+        const initialStart = this.reserveInitialStart(id);
+        try {
+            await this.waitForPendingAutoCommit(id);
+            this.beginSessionExecution(id);
+            this.ensureExecutionRecordIsLive(session);
+            const workingDir = this.getExecutionWorkingDir(session);
+            console.log('[SessionManager] Session details:', {
+                id: session.id,
+                agentType: session.agentType,
+                variant: session.variant,
+                prompt: summarizeTextForLog(session.prompt),
+                workingDir,
+            });
+            await this.startRuntimeTurn(session, session.prompt, session.externalSessionId, session.providerId, 'load', undefined, true);
+            return session;
+        }
+        finally {
+            initialStart.release();
+        }
     }
     async startFollowUp(id, resumeFromSessionId) {
         console.log('[SessionManager] 🚀 Starting follow-up session:', id);
@@ -223,36 +437,43 @@ export class SessionManager {
             console.log('[SessionManager] ❌ Session not found:', id);
             return null;
         }
-        await this.waitForPendingAutoCommit(id);
-        this.beginSessionExecution(id);
-        this.ensureExecutionRecordIsLive(session);
-        const resumeFromSession = await prisma.session.findUnique({
-            where: { id: resumeFromSessionId },
-            select: { logSnapshot: true, externalSessionId: true },
-        });
-        const agentSessionId = resumeFromSession
-            ? resumeFromSession.externalSessionId
-                ?? this.resolveAgentSessionId(resumeFromSessionId, resumeFromSession.logSnapshot)
-            : null;
-        console.log('[SessionManager] Follow-up session details:', {
-            id: session.id,
-            resumeFromSessionId,
-            agentSessionId,
-            agentType: session.agentType,
-            variant: session.variant,
-            prompt: summarizeTextForLog(session.prompt),
-            workingDir: this.getExecutionWorkingDir(session),
-        });
-        await this.startRuntimeTurn(session, session.prompt, agentSessionId, session.providerId, 'resume');
-        return session;
+        const initialStart = this.reserveInitialStart(id);
+        try {
+            await this.waitForPendingAutoCommit(id);
+            this.beginSessionExecution(id);
+            this.ensureExecutionRecordIsLive(session);
+            const resumeFromSession = await prisma.session.findUnique({
+                where: { id: resumeFromSessionId },
+                select: { logSnapshot: true, externalSessionId: true },
+            });
+            const agentSessionId = resumeFromSession
+                ? resumeFromSession.externalSessionId
+                    ?? this.resolveAgentSessionId(resumeFromSessionId, resumeFromSession.logSnapshot)
+                : null;
+            console.log('[SessionManager] Follow-up session details:', {
+                id: session.id,
+                resumeFromSessionId,
+                agentSessionId,
+                agentType: session.agentType,
+                variant: session.variant,
+                prompt: summarizeTextForLog(session.prompt),
+                workingDir: this.getExecutionWorkingDir(session),
+            });
+            await this.startRuntimeTurn(session, session.prompt, agentSessionId, session.providerId, 'resume', undefined, true);
+            return session;
+        }
+        finally {
+            initialStart.release();
+        }
     }
-    async sendMessage(id, message, providerId) {
+    async sendMessage(id, message, providerId, expectedTeamRunInvocationId, options = {}) {
         console.log('[SessionManager] 📨 Sending message to session:', id);
         console.log('[SessionManager] Message summary:', summarizeTextForLog(message));
         if (providerId) {
             console.log('[SessionManager] Switching provider to:', providerId);
         }
         const reservation = this.reserveFollowUp(id);
+        let releaseTeamRunAdmission;
         try {
             // Serialize concurrent follow-ups for the same session while retaining
             // the reservation in the map so the old finalizer cannot reconcile.
@@ -262,6 +483,24 @@ export class SessionManager {
                 console.log('[SessionManager] ❌ Session not found:', id);
                 return null;
             }
+            // TeamRun follow-ups are admission-controlled just like initial starts.
+            // A REST/MCP caller must carry the current invocation identity; browser
+            // or stale/terminal callers must never be able to resurrect a member.
+            const teamRunInvocation = await prisma.agentInvocation.findFirst({
+                where: { sessionId: id },
+                select: { id: true, teamRunId: true, memberId: true },
+                orderBy: [{ createdAt: 'desc' }, { id: 'desc' }],
+            });
+            if (teamRunInvocation) {
+                if (expectedTeamRunInvocationId !== teamRunInvocation.id) {
+                    throw new ServiceError('TeamRun follow-up requires the current invocation identity', 'SESSION_NOT_ADMITTED', 409);
+                }
+                releaseTeamRunAdmission = await acquireTeamMemberAdmission(teamRunInvocation.teamRunId, teamRunInvocation.memberId);
+                await this.assertTeamRunDispatchAdmitted(id, expectedTeamRunInvocationId);
+            }
+            else if (expectedTeamRunInvocationId) {
+                await this.assertTeamRunDispatchAdmitted(id, expectedTeamRunInvocationId);
+            }
             this.ensureExecutionRecordIsLive(session);
             const resumeMode = this.normalizeRuntimeType(session.runtimeType) === RuntimeType.ACP
                 && hasCompletePersistedSnapshot(session)
@@ -311,49 +550,23 @@ export class SessionManager {
                 }
             }
             await this.waitForPendingAutoCommit(id);
-            const isNewStore = !sessionMsgStoreManager.has(id);
-            const msgStore = sessionMsgStoreManager.getOrCreate(id);
-            if (isNewStore && session.logSnapshot) {
-                try {
-                    const snapshot = JSON.parse(session.logSnapshot);
-                    msgStore.restoreFromSnapshot(snapshot);
-                }
-                catch (error) {
-                    console.error(`[SessionManager] Failed to restore snapshot for session ${id}:`, error);
-                }
-            }
-            // Heal index drift caused by previously failed patches (e.g. invalid value).
-            // If entryIndex is ahead of snapshot length, subsequent add/replace paths
-            // become out-of-bounds and all later patches fail.
-            const preflightSnapshot = msgStore.getSnapshot();
-            const expectedIndex = preflightSnapshot.entries.length;
-            const currentIndex = msgStore.entryIndex.current();
-            if (currentIndex !== expectedIndex) {
-                if (DEBUG_SNAPSHOT) {
-                    console.warn(`[SessionManager:snapshot] rebase entryIndex sessionId=${id} currentIndex=${currentIndex} expectedIndex=${expectedIndex}`);
-                }
-                msgStore.entryIndex.startFrom(expectedIndex);
-            }
-            const userEntry = createUserMessage(message);
-            const userIndex = msgStore.entryIndex.next();
-            const userPatch = addNormalizedEntry(userIndex, userEntry);
-            if (DEBUG_SNAPSHOT) {
-                console.log(`[SessionManager:snapshot] sendMessage userPatch sessionId=${id} index=${userIndex} currentIndex=${msgStore.entryIndex.current()}`);
-            }
-            const userPatchSeq = msgStore.pushPatch(userPatch);
-            // Emit directly to EventBus — the old pipeline was already destroyed so
-            // MsgStore's patchListeners are empty at this point. Without this line
-            // the user-message patch would never reach WebSocket subscribers.
-            this.eventBus.emit('session:patch', { sessionId: id, patch: userPatch, seq: userPatchSeq });
+            const userEntryId = options.userEntryId ?? this.appendUserMessageEntry(session, message);
             const agentSessionId = session.externalSessionId
                 ?? this.resolveAgentSessionId(id, session.logSnapshot);
             if (providerId && providerId !== session.providerId) {
                 await this.runtimeCoordinator.disposeSession(id);
             }
-            await this.startRuntimeTurn(session, message, agentSessionId, effectiveProviderId, resumeMode, userEntry.id);
-            return session;
+            const processStart = this.reserveProcessStart(id);
+            try {
+                await this.startRuntimeTurn(session, message, agentSessionId, effectiveProviderId, resumeMode, userEntryId, false, expectedTeamRunInvocationId);
+                return session;
+            }
+            finally {
+                processStart.release();
+            }
         }
         finally {
+            releaseTeamRunAdmission?.();
             reservation.release();
         }
     }
@@ -361,6 +574,18 @@ export class SessionManager {
         const session = await prisma.session.findUnique({ where: { id } });
         if (!session)
             return null;
+        // If initial start has already crossed into its short admission handoff,
+        // let it establish the runtime first; this stop then owns and cleans it.
+        // If stop wins before that handoff, the PENDING -> RUNNING CAS below fails
+        // and no process-owning call can occur after stop returns.
+        await this.pendingInitialStarts.get(id);
+        await this.pendingProcessStarts.get(id);
+        // Revoke TeamRun dispatch before waiting for runtime cleanup. A direct
+        // Session stop does not pass through TeamSchedulerService, so delaying this
+        // until cleanup succeeds would leave heartbeat/follow-up admission open.
+        if (!options.skipTeamRunReconcile && !this.isConversationSession(session)) {
+            await this.teamReconciler.handleSessionStopped(id);
+        }
         const terminalStatus = this.terminalSessions.get(id);
         const hasActiveTurn = this.runtimeCoordinator.hasActiveTurn(id);
         const persistedTerminal = [
@@ -375,10 +600,17 @@ export class SessionManager {
             // backing TeamRun invocation may still be waiting for a room reply, so
             // it must still pass through the cancellation reconciler.
             await this.runtimeCoordinator.disposeSession(id);
+            if (!await this.isRuntimeCleanupConfirmed(id)) {
+                this.terminalSessions.delete(id);
+                return session;
+            }
             this.maybeClearTerminalState(id);
             await pendingFinalization;
-            if (!options.skipTeamRunReconcile && !this.isConversationSession(session)) {
-                await this.teamReconciler.handleSessionStopped(id);
+            if (terminalStatus && !persistedTerminal) {
+                await prisma.session.updateMany({
+                    where: { id, status: { notIn: [SessionStatus.COMPLETED, SessionStatus.FAILED, SessionStatus.CANCELLED] } },
+                    data: { status: terminalStatus },
+                });
             }
             revokeAgentApiCredential(id);
             return session;
@@ -397,9 +629,14 @@ export class SessionManager {
         }
         // Explicit stop revokes the DriverSession-bound workspace-service credential.
         // A later follow-up reopens from the persisted external session id with a new credential.
-        await this.runtimeCoordinator.disposeSession(id).catch((error) => {
-            this.logSessionError('session.runtimeDispose', error, { sessionId: id });
-        });
+        // Do not report a stopped TeamRun member until the owned process tree has
+        // confirmed cleanup. The scheduler will retain the invocation and block
+        // the next admission when this rejects, allowing a later retry/recovery.
+        await this.runtimeCoordinator.disposeSession(id);
+        if (!await this.isRuntimeCleanupConfirmed(id)) {
+            this.terminalSessions.delete(id);
+            return session;
+        }
         const msgStore = sessionMsgStoreManager.get(id);
         if (msgStore) {
             msgStore.pushFinished();
@@ -420,9 +657,6 @@ export class SessionManager {
                 data: { status: SessionStatus.CANCELLED },
             });
         }
-        if (!options.skipTeamRunReconcile && !this.isConversationSession(session)) {
-            await this.teamReconciler.handleSessionStopped(id);
-        }
         this.eventBus.emit('session:stopped', { sessionId: id });
         // Cancellation does not run normal terminal finalization, so release the
         // store after the CANCELLED snapshot has been persisted above.
@@ -467,7 +701,20 @@ export class SessionManager {
     }
     /** Close all runtime driver sessions during graceful server shutdown. */
     async destroyAll() {
+        this.stopConversationQueue();
         await this.runtimeCoordinator.destroyAll();
+        for (const resolve of this.initialStartResolvers.values())
+            resolve();
+        this.initialStartResolvers.clear();
+        this.pendingInitialStarts.clear();
+        for (const resolve of this.processStartResolvers.values())
+            resolve();
+        this.processStartResolvers.clear();
+        this.pendingProcessStarts.clear();
+        this.pendingRuntimeProcessEvents.clear();
+        for (const timer of this.pendingRuntimeEventExpiryTimers.values())
+            clearTimeout(timer);
+        this.pendingRuntimeEventExpiryTimers.clear();
         await Promise.allSettled(this.externalSessionPersistence.values());
         this.externalSessionPersistence.clear();
         this.terminalSessions.clear();
@@ -481,6 +728,127 @@ export class SessionManager {
         this.followUpReservations.clear();
         clearAgentApiCredentials();
     }
+    kickConversationQueue(sessionId) {
+        if (this.conversationQueueStopping || this.conversationQueueWorkers.has(sessionId)) {
+            return;
+        }
+        const worker = new Promise((resolve, reject) => {
+            setImmediate(() => {
+                this.processConversationQueue(sessionId).then(resolve, reject);
+            });
+        });
+        this.conversationQueueWorkers.set(sessionId, worker);
+        void worker
+            .catch((error) => {
+            this.logSessionError('conversation.queue', error, { sessionId });
+        })
+            .finally(() => {
+            if (this.conversationQueueWorkers.get(sessionId) === worker) {
+                this.conversationQueueWorkers.delete(sessionId);
+            }
+            // Cover an enqueue racing with the worker's final empty scan without
+            // creating a worker spin loop when the queue is actually empty.
+            if (!this.conversationQueueStopping) {
+                void prisma.conversationTurn.count({
+                    where: { sessionId, status: CONVERSATION_TURN_QUEUED },
+                }).then((count) => {
+                    if (count > 0)
+                        this.kickConversationQueue(sessionId);
+                }).catch((error) => {
+                    this.logSessionError('conversation.queueScan', error, { sessionId });
+                });
+            }
+        });
+    }
+    async processConversationQueue(sessionId) {
+        while (!this.conversationQueueStopping) {
+            const queued = await prisma.conversationTurn.findFirst({
+                where: { sessionId, status: CONVERSATION_TURN_QUEUED },
+                orderBy: [{ queuedAt: 'asc' }, { createdAt: 'asc' }, { id: 'asc' }],
+            });
+            if (!queued)
+                return;
+            const claimed = await prisma.conversationTurn.updateMany({
+                where: { id: queued.id, status: CONVERSATION_TURN_QUEUED },
+                data: {
+                    status: CONVERSATION_TURN_RUNNING,
+                    attempts: { increment: 1 },
+                    startedAt: new Date(),
+                    lastError: null,
+                },
+            });
+            if (claimed.count !== 1)
+                continue;
+            try {
+                console.log(`[ConversationQueue] claimed session=${sessionId} turn=${queued.id} queueWaitMs=${Math.max(0, Date.now() - queued.queuedAt.getTime())} attempt=${queued.attempts + 1}`);
+                // A conversation accepts one ACP prompt at a time. Waiting here keeps
+                // queued follow-ups from cancelling the previous turn (and hitting
+                // RuntimeCoordinator's ten-second abandon timeout).
+                const previousTurnWaitStartedAt = Date.now();
+                await this.runtimeCoordinator.waitForTurnCompletion(sessionId);
+                console.log(`[ConversationQueue] priorTurnReady session=${sessionId} turn=${queued.id} waitMs=${Date.now() - previousTurnWaitStartedAt}`);
+                if (this.conversationQueueStopping) {
+                    await this.requeueConversationTurn(queued.id);
+                    return;
+                }
+                const session = await this.findSessionExecutionRecord(sessionId);
+                if (!session)
+                    throw new NotFoundError('Session', sessionId);
+                this.ensureExecutionRecordIsLive(session);
+                const userEntryId = queued.userEntryId ?? `user:${queued.id}`;
+                this.appendUserMessageEntry(session, queued.message, userEntryId);
+                if (!queued.userEntryId) {
+                    await prisma.conversationTurn.updateMany({
+                        where: { id: queued.id, status: CONVERSATION_TURN_RUNNING },
+                        data: { userEntryId },
+                    });
+                }
+                const dispatchStartedAt = Date.now();
+                await this.sendMessage(sessionId, queued.message, queued.providerId ?? undefined, undefined, { userEntryId });
+                console.log(`[ConversationQueue] dispatched session=${sessionId} turn=${queued.id} dispatchMs=${Date.now() - dispatchStartedAt}`);
+                const turnWaitStartedAt = Date.now();
+                await this.runtimeCoordinator.waitForTurnCompletion(sessionId);
+                await prisma.conversationTurn.updateMany({
+                    where: { id: queued.id, status: CONVERSATION_TURN_RUNNING },
+                    data: {
+                        status: CONVERSATION_TURN_COMPLETED,
+                        completedAt: new Date(),
+                    },
+                });
+                console.log(`[ConversationQueue] completed session=${sessionId} turn=${queued.id} runtimeWaitMs=${Date.now() - turnWaitStartedAt}`);
+            }
+            catch (error) {
+                if (this.conversationQueueStopping) {
+                    await this.requeueConversationTurn(queued.id);
+                    return;
+                }
+                const lastError = error instanceof Error ? error.message : String(error);
+                await prisma.conversationTurn.updateMany({
+                    where: { id: queued.id, status: CONVERSATION_TURN_RUNNING },
+                    data: {
+                        status: CONVERSATION_TURN_FAILED,
+                        lastError: lastError.slice(0, 2_000),
+                        completedAt: new Date(),
+                    },
+                });
+                const errorSummary = summarizeTextForLog(lastError);
+                console.log(`[ConversationQueue] failed session=${sessionId} turn=${queued.id} errorLength=${errorSummary.length} errorSha256=${errorSummary.sha256}`);
+                this.logSessionError('conversation.queueTurn', error, {
+                    sessionId,
+                    turnId: queued.id,
+                });
+            }
+        }
+    }
+    async requeueConversationTurn(turnId) {
+        await prisma.conversationTurn.updateMany({
+            where: { id: turnId, status: CONVERSATION_TURN_RUNNING },
+            data: {
+                status: CONVERSATION_TURN_QUEUED,
+                startedAt: null,
+            },
+        });
+    }
     resolveAgentSessionId(sessionId, logSnapshot) {
         const msgStore = sessionMsgStoreManager.get(sessionId);
         if (msgStore) {
@@ -500,7 +868,7 @@ export class SessionManager {
         }
         return null;
     }
-    async startRuntimeTurn(session, prompt, resumeExternalSessionId, providerId = session.providerId, resumeMode = 'load', historyBoundaryEntryId) {
+    async startRuntimeTurn(session, prompt, resumeExternalSessionId, providerId = session.providerId, resumeMode = 'load', historyBoundaryEntryId, initialStart = false, expectedTeamRunInvocationId) {
         const workingDir = this.getExecutionWorkingDir(session);
         const env = ExecutionEnv.default(workingDir);
         if (providerId) {
@@ -523,14 +891,19 @@ export class SessionManager {
                 this.logSessionError('session.snapshotRestore', error, { sessionId: session.id });
             }
         }
+        let launchClaimNumber = null;
         try {
-            // Session status follows the logical Runtime turn, not the lifetime of
-            // its backing OS process. ACP reuses one adapter process across turns,
-            // so a follow-up must become RUNNING even when no process starts.
-            await prisma.session.update({
-                where: { id: session.id },
-                data: { status: SessionStatus.RUNNING },
-            });
+            // Every turn claim is durable before RuntimeCoordinator can call a driver.
+            // Initial admission updates PENDING -> RUNNING and the claim counter in
+            // one transaction; follow-ups use the same evidence without pretending
+            // that an existing ACP transport necessarily spawns a new child.
+            launchClaimNumber = await this.claimRuntimeLaunch(session.id, initialStart);
+            try {
+                await this.assertTeamRunDispatchAdmitted(session.id, expectedTeamRunInvocationId);
+            }
+            catch (error) {
+                throw markPreChildProcessFailure(error);
+            }
             const runtimePrompt = buildWorkspaceRuntimePrompt(session, prompt);
             const handle = await this.runtimeCoordinator.startTurn({
                 towerSessionId: session.id,
@@ -548,7 +921,9 @@ export class SessionManager {
                 resumeExternalSessionId,
                 resumeMode,
                 historyBoundaryEntryId,
+                launchClaimNumber,
             });
+            await this.resolveReusedRuntimeLaunch(session.id, launchClaimNumber);
             // Terminal persistence is driven by Runtime turn events. Attach a catch
             // so the public start/message methods do not leave a rejected handle
             // unobserved after they have returned to the HTTP caller.
@@ -559,10 +934,21 @@ export class SessionManager {
         catch (error) {
             await this.runtimeCoordinator.disposeSession(session.id).catch(() => undefined);
             revokeAgentApiCredential(session.id);
-            await prisma.session.update({
-                where: { id: session.id },
-                data: { status: SessionStatus.CANCELLED },
-            }).catch(() => undefined);
+            if (launchClaimNumber != null) {
+                if (isPreChildProcessFailure(error)) {
+                    await this.resolvePreChildRuntimeLaunchFailure(session.id, launchClaimNumber, error);
+                }
+                else {
+                    await this.quarantineRuntimeLaunch(session.id, launchClaimNumber, error);
+                }
+            }
+            const cleanupConfirmed = await this.isRuntimeCleanupConfirmed(session.id).catch(() => false);
+            if (cleanupConfirmed) {
+                await prisma.session.update({
+                    where: { id: session.id },
+                    data: { status: SessionStatus.CANCELLED },
+                }).catch(() => undefined);
+            }
             sessionMsgStoreManager.delete(session.id);
             this.releaseSnapshotPersistenceState(session.id);
             this.logSessionError('session.runtimeStart', error, {
@@ -575,6 +961,153 @@ export class SessionManager {
             throw normalizeExecutorStartError(error);
         }
     }
+    async claimRuntimeLaunch(sessionId, initialStart) {
+        return prisma.$transaction(async (tx) => {
+            const current = await tx.session.findUnique({
+                where: { id: sessionId },
+                select: { status: true, runtimeLaunchClaimCount: true, runtimeLaunchResolvedCount: true },
+            });
+            const admittedStatuses = initialStart
+                ? [SessionStatus.PENDING]
+                : [
+                    SessionStatus.PENDING,
+                    SessionStatus.RUNNING,
+                    SessionStatus.COMPLETED,
+                    SessionStatus.FAILED,
+                    SessionStatus.CANCELLED,
+                ];
+            if (!current
+                || !admittedStatuses.includes(current.status)
+                || current.runtimeLaunchClaimCount !== current.runtimeLaunchResolvedCount) {
+                throw new ServiceError(initialStart
+                    ? 'Session start was revoked before process ownership was acquired'
+                    : 'Session follow-up was revoked before process ownership was acquired', 'SESSION_NOT_ADMITTED', 409);
+            }
+            const claimNumber = current.runtimeLaunchClaimCount + 1;
+            const admitted = await tx.session.updateMany({
+                where: {
+                    id: sessionId,
+                    status: current.status,
+                    runtimeLaunchClaimCount: current.runtimeLaunchClaimCount,
+                    runtimeLaunchResolvedCount: current.runtimeLaunchResolvedCount,
+                },
+                data: {
+                    status: SessionStatus.RUNNING,
+                    runtimeLaunchState: RUNTIME_LAUNCH_STATES.CLAIMED,
+                    runtimeLaunchClaimCount: { increment: 1 },
+                    runtimeLaunchDiagnostic: null,
+                    runtimeLaunchNextDiagnosticAt: null,
+                },
+            });
+            if (admitted.count !== 1) {
+                throw new ServiceError('Session runtime launch admission changed concurrently', 'SESSION_NOT_ADMITTED', 409);
+            }
+            return claimNumber;
+        });
+    }
+    async resolveReusedRuntimeLaunch(sessionId, claimNumber) {
+        await prisma.session.updateMany({
+            where: {
+                id: sessionId,
+                runtimeLaunchClaimCount: claimNumber,
+                runtimeLaunchResolvedCount: claimNumber - 1,
+                runtimeLaunchState: RUNTIME_LAUNCH_STATES.CLAIMED,
+            },
+            data: {
+                runtimeLaunchState: RUNTIME_LAUNCH_STATES.REUSED,
+                runtimeLaunchResolvedCount: { increment: 1 },
+                runtimeLaunchDiagnostic: null,
+                runtimeLaunchNextDiagnosticAt: null,
+            },
+        });
+    }
+    async resolvePreChildRuntimeLaunchFailure(sessionId, claimNumber, error) {
+        await prisma.session.updateMany({
+            where: {
+                id: sessionId,
+                runtimeLaunchClaimCount: claimNumber,
+                runtimeLaunchResolvedCount: claimNumber - 1,
+                runtimeLaunchState: RUNTIME_LAUNCH_STATES.CLAIMED,
+            },
+            data: {
+                runtimeLaunchState: RUNTIME_LAUNCH_STATES.SAFE_PRE_CHILD_FAILURE,
+                runtimeLaunchResolvedCount: { increment: 1 },
+                runtimeLaunchDiagnostic: (error instanceof Error ? error.message : String(error)).slice(0, 2_000),
+                runtimeLaunchNextDiagnosticAt: null,
+            },
+        });
+    }
+    async quarantineRuntimeLaunch(sessionId, claimNumber, error) {
+        const diagnostic = `Runtime launch claim ${claimNumber} failed without proof that no child was created: ${error instanceof Error ? error.message : String(error)}`;
+        await prisma.session.updateMany({
+            where: {
+                id: sessionId,
+                runtimeLaunchClaimCount: claimNumber,
+                runtimeLaunchResolvedCount: { lt: claimNumber },
+            },
+            data: {
+                runtimeLaunchState: RUNTIME_LAUNCH_STATES.QUARANTINED,
+                runtimeLaunchDiagnostic: diagnostic.slice(0, 2_000),
+                runtimeLaunchDiagnosticCount: { increment: 1 },
+                runtimeLaunchNextDiagnosticAt: new Date(Date.now() + 5 * 60_000),
+            },
+        });
+        console.warn(`[SessionManager] Session ${sessionId} runtime launch quarantined: ${diagnostic}`);
+    }
+    reserveInitialStart(sessionId) {
+        let resolve;
+        const promise = new Promise((done) => { resolve = done; });
+        this.pendingInitialStarts.set(sessionId, promise);
+        this.initialStartResolvers.set(sessionId, resolve);
+        return {
+            release: () => {
+                if (this.pendingInitialStarts.get(sessionId) !== promise)
+                    return;
+                this.pendingInitialStarts.delete(sessionId);
+                this.initialStartResolvers.delete(sessionId);
+                resolve();
+            },
+        };
+    }
+    reserveProcessStart(sessionId) {
+        let resolve;
+        const promise = new Promise((done) => { resolve = done; });
+        this.pendingProcessStarts.set(sessionId, promise);
+        this.processStartResolvers.set(sessionId, resolve);
+        return {
+            release: () => {
+                if (this.pendingProcessStarts.get(sessionId) !== promise)
+                    return;
+                this.pendingProcessStarts.delete(sessionId);
+                this.processStartResolvers.delete(sessionId);
+                resolve();
+            },
+        };
+    }
+    async assertTeamRunDispatchAdmitted(sessionId, expectedInvocationId) {
+        const invocation = await prisma.agentInvocation.findFirst({
+            where: {
+                sessionId,
+                ...(expectedInvocationId ? { id: expectedInvocationId } : {}),
+            },
+            select: { id: true, teamRunId: true, memberId: true, status: true, dispatchRevokedAt: true },
+        });
+        const member = invocation
+            ? await prisma.teamMember.findUnique({
+                where: { id: invocation.memberId },
+                select: { teamRunId: true, membershipStatus: true },
+            })
+            : null;
+        if (invocation?.dispatchRevokedAt
+            || (expectedInvocationId && (!invocation
+                || !['QUEUED', 'RUNNING', 'SESSION_ENDED', 'WAITING_ROOM_REPLY'].includes(invocation.status)))
+            || (invocation && (!member
+                || member.teamRunId !== invocation.teamRunId
+                || member.membershipStatus !== 'ACTIVE'
+                || !['QUEUED', 'RUNNING', 'SESSION_ENDED', 'WAITING_ROOM_REPLY'].includes(invocation.status)))) {
+            throw new ServiceError('TeamRun dispatch was revoked before process ownership was acquired', 'SESSION_NOT_ADMITTED', 409);
+        }
+    }
     handleRuntimeTurnEvent(envelope) {
         const sessionId = envelope.towerSessionId;
         const event = envelope.event;
@@ -673,30 +1206,245 @@ export class SessionManager {
         });
     }
     async handleRuntimeProcessEvent(event) {
+        this.prunePendingRuntimeProcessEvents();
+        const launchClaimNumber = Number.isInteger(event.launchClaimNumber) && event.launchClaimNumber > 0
+            ? event.launchClaimNumber
+            : null;
         if (event.type === 'started') {
-            const processRecord = await prisma.$transaction(async (tx) => {
-                const session = await tx.session.findUnique({
-                    where: { id: event.towerSessionId },
-                    include: { workspace: { include: { task: true } }, conversation: true },
+            let processRecord;
+            try {
+                processRecord = await prisma.$transaction(async (tx) => {
+                    const session = await tx.session.findUnique({
+                        where: { id: event.towerSessionId },
+                        include: { workspace: { include: { task: true } }, conversation: true },
+                    });
+                    if (!session)
+                        throw new NotFoundError('Session', event.towerSessionId);
+                    this.ensureExecutionRecordIsLive(session);
+                    const launchClaimNumber = Number.isInteger(event.launchClaimNumber)
+                        && event.launchClaimNumber > 0
+                        ? event.launchClaimNumber
+                        : null;
+                    const runtimeInstanceId = typeof event.runtimeInstanceId === 'string'
+                        && event.runtimeInstanceId.length > 0
+                        ? event.runtimeInstanceId
+                        : null;
+                    const processGroupId = typeof event.processGroupId === 'string'
+                        && event.processGroupId.length > 0
+                        ? event.processGroupId
+                        : null;
+                    const birthMarker = typeof event.birthMarker === 'string'
+                        && event.birthMarker.length > 0
+                        ? event.birthMarker
+                        : null;
+                    const ownershipToken = typeof event.ownershipToken === 'string'
+                        && event.ownershipToken.length > 0
+                        ? event.ownershipToken
+                        : null;
+                    const identityComplete = runtimeInstanceId != null
+                        && Number.isInteger(event.pid)
+                        && event.pid > 0
+                        && processGroupId != null
+                        && birthMarker != null
+                        && ownershipToken != null;
+                    const existing = runtimeInstanceId
+                        ? await tx.executionProcess.findFirst({
+                            where: {
+                                sessionId: event.towerSessionId,
+                                runtimeInstanceId,
+                                launchClaimNumber,
+                            },
+                            select: { id: true, cleanupState: true },
+                        })
+                        : null;
+                    // started is a generation barrier and may be retried after a caller
+                    // timeout. Do not create a second row or advance the launch claim a
+                    // second time when the first transaction already committed.
+                    if (existing)
+                        return existing;
+                    const diagnostic = launchClaimNumber == null
+                        ? 'New runtime generation did not provide a valid launch claim number'
+                        : 'New runtime generation did not provide complete process ownership identity';
+                    const process = await tx.executionProcess.create({
+                        data: {
+                            sessionId: event.towerSessionId,
+                            launchClaimNumber,
+                            runtimeInstanceId,
+                            processGroupId,
+                            birthMarker,
+                            ownershipToken,
+                            cleanupState: identityComplete && launchClaimNumber != null ? 'ACTIVE' : 'QUARANTINED',
+                            cleanupError: identityComplete && launchClaimNumber != null ? null : diagnostic,
+                            cleanupAttemptCount: identityComplete && launchClaimNumber != null ? 0 : 1,
+                            nextCleanupRetryAt: identityComplete && launchClaimNumber != null
+                                ? null
+                                : new Date(Date.now() + 5 * 60_000),
+                            pid: Number.isInteger(event.pid) && event.pid > 0 ? event.pid : null,
+                        },
+                        select: { id: true, cleanupState: true },
+                    });
+                    if (launchClaimNumber == null) {
+                        await tx.session.update({
+                            where: { id: event.towerSessionId },
+                            data: {
+                                runtimeLaunchState: RUNTIME_LAUNCH_STATES.QUARANTINED,
+                                runtimeLaunchProcessCount: { increment: 1 },
+                                runtimeLaunchDiagnostic: diagnostic,
+                                runtimeLaunchDiagnosticCount: { increment: 1 },
+                                runtimeLaunchNextDiagnosticAt: new Date(Date.now() + 5 * 60_000),
+                            },
+                        });
+                        return process;
+                    }
+                    const resolved = await tx.session.updateMany({
+                        where: {
+                            id: event.towerSessionId,
+                            runtimeLaunchClaimCount: launchClaimNumber,
+                            runtimeLaunchResolvedCount: launchClaimNumber - 1,
+                        },
+                        data: {
+                            runtimeLaunchState: identityComplete
+                                ? RUNTIME_LAUNCH_STATES.PROCESS_RECORDED
+                                : RUNTIME_LAUNCH_STATES.QUARANTINED,
+                            runtimeLaunchResolvedCount: { increment: 1 },
+                            runtimeLaunchProcessCount: { increment: 1 },
+                            runtimeLaunchDiagnostic: identityComplete ? null : diagnostic,
+                            runtimeLaunchDiagnosticCount: identityComplete ? undefined : { increment: 1 },
+                            runtimeLaunchNextDiagnosticAt: identityComplete ? null : new Date(Date.now() + 5 * 60_000),
+                        },
+                    });
+                    if (resolved.count !== 1) {
+                        throw new ServiceError(`Runtime process started outside launch claim ${launchClaimNumber}`, 'RUNTIME_LAUNCH_CLAIM_MISMATCH', 409);
+                    }
+                    return process;
                 });
-                if (!session)
-                    throw new NotFoundError('Session', event.towerSessionId);
-                this.ensureExecutionRecordIsLive(session);
-                return tx.executionProcess.create({
-                    data: { sessionId: event.towerSessionId, pid: event.pid },
-                    select: { id: true },
+            }
+            catch (error) {
+                if (launchClaimNumber != null) {
+                    this.clearPendingRuntimeEventExpiryTimer(eventKey(event.towerSessionId, event.runtimeInstanceId, launchClaimNumber));
+                    this.pendingRuntimeProcessEvents.delete(eventKey(event.towerSessionId, event.runtimeInstanceId, launchClaimNumber));
+                }
+                await this.quarantineRuntimeProcessEvent(event, `Runtime started persistence failed permanently: ${error instanceof Error ? error.message : String(error)}`);
+                throw error;
+            }
+            if (typeof event.runtimeInstanceId === 'string'
+                && event.runtimeInstanceId.length > 0
+                && !['CONFIRMED', 'QUARANTINED'].includes(processRecord.cleanupState)) {
+                this.runtimeProcessIds.set(eventKey(event.towerSessionId, event.runtimeInstanceId, launchClaimNumber ?? 0), processRecord.id);
+            }
+            if (launchClaimNumber == null)
+                return;
+            const key = eventKey(event.towerSessionId, event.runtimeInstanceId, launchClaimNumber);
+            const buffered = this.pendingRuntimeProcessEvents.get(key);
+            if (buffered) {
+                this.pendingRuntimeProcessEvents.delete(key);
+                this.clearPendingRuntimeEventExpiryTimer(key);
+                for (const bufferedEvent of buffered) {
+                    await this.handleRuntimeProcessEvent(bufferedEvent.event);
+                }
+            }
+            return;
+        }
+        const processKey = launchClaimNumber != null
+            ? eventKey(event.towerSessionId, event.runtimeInstanceId, launchClaimNumber)
+            : undefined;
+        const processId = processKey ? this.runtimeProcessIds.get(processKey) : undefined;
+        const processRecord = launchClaimNumber != null
+            ? await prisma.executionProcess.findFirst({
+                where: {
+                    ...(processId ? { id: processId } : {}),
+                    sessionId: event.towerSessionId,
+                    runtimeInstanceId: event.runtimeInstanceId,
+                    launchClaimNumber,
+                },
+                select: {
+                    id: true,
+                    launchClaimNumber: true,
+                    processGroupId: true,
+                    birthMarker: true,
+                    ownershipToken: true,
+                    cleanupState: true,
+                },
+            })
+            : null;
+        if (!processRecord) {
+            if (launchClaimNumber == null) {
+                await this.quarantineRuntimeProcessEvent(event, 'Runtime process event arrived before started persistence without a valid launch claim');
+                return;
+            }
+            const key = eventKey(event.towerSessionId, event.runtimeInstanceId, launchClaimNumber);
+            const pending = this.pendingRuntimeProcessEvents.get(key) ?? [];
+            if (pending.length >= PENDING_RUNTIME_EVENTS_PER_KEY
+                || this.pendingRuntimeEventCount() >= PENDING_RUNTIME_EVENTS_GLOBAL) {
+                this.pendingRuntimeProcessEvents.delete(key);
+                this.clearPendingRuntimeEventExpiryTimer(key);
+                await this.quarantineRuntimeProcessEvent(event, 'Runtime process event buffer overflow; event generation quarantined');
+                return;
+            }
+            pending.push({ event, expiresAt: Date.now() + PENDING_RUNTIME_EVENT_TTL_MS });
+            this.pendingRuntimeProcessEvents.set(key, pending);
+            if (!this.pendingRuntimeEventExpiryTimers.has(key)) {
+                const timer = setTimeout(() => {
+                    this.pendingRuntimeProcessEvents.delete(key);
+                    this.pendingRuntimeEventExpiryTimers.delete(key);
+                }, PENDING_RUNTIME_EVENT_TTL_MS);
+                timer.unref?.();
+                this.pendingRuntimeEventExpiryTimers.set(key, timer);
+            }
+            // A process event without its started row is durable evidence that the
+            // launch handoff was interrupted. Keep the session blocked/quarantined
+            // while retaining the in-memory event for a later started retry; never
+            // treat an empty process set as a safe pre-child failure.
+            await prisma.session.updateMany({
+                where: {
+                    id: event.towerSessionId,
+                    // A concurrent started transaction has already established durable
+                    // ownership; it must win over this stale no-row observation.
+                    runtimeLaunchState: {
+                        notIn: [RUNTIME_LAUNCH_STATES.PROCESS_RECORDED, RUNTIME_LAUNCH_STATES.REUSED],
+                    },
+                },
+                data: {
+                    runtimeLaunchState: RUNTIME_LAUNCH_STATES.QUARANTINED,
+                    runtimeLaunchDiagnostic: 'Runtime process event arrived before started persistence',
+                    runtimeLaunchDiagnosticCount: { increment: 1 },
+                    runtimeLaunchNextDiagnosticAt: new Date(Date.now() + 5 * 60_000),
+                },
+            }).catch((error) => {
+                this.logSessionError('session.processEventBeforeStarted', error, {
+                    sessionId: event.towerSessionId,
+                    runtimeInstanceId: event.runtimeInstanceId,
+                    eventType: event.type,
                 });
             });
-            this.runtimeProcessIds.set(event.runtimeInstanceId, processRecord.id);
             return;
         }
-        const processId = this.runtimeProcessIds.get(event.runtimeInstanceId);
-        if (!processId)
+        if (launchClaimNumber == null || processRecord.launchClaimNumber !== launchClaimNumber) {
+            await this.quarantineRuntimeProcessEvent(event, 'Runtime process event launch claim did not match its persisted generation');
+            return;
+        }
+        if (!processId && !['CONFIRMED', 'QUARANTINED'].includes(processRecord.cleanupState)) {
+            this.runtimeProcessIds.set(processKey, processRecord.id);
+        }
+        if (event.type === 'tree_cleanup_completed') {
+            await this.markRuntimeProcessCleanupState(event.towerSessionId, event.runtimeInstanceId, 'CONFIRMED', undefined, launchClaimNumber);
+            if (processKey)
+                this.runtimeProcessIds.delete(processKey);
             return;
-        this.runtimeProcessIds.delete(event.runtimeInstanceId);
-        await prisma.executionProcess.update({
-            where: { id: processId },
-            data: { exitCode: event.exitCode },
+        }
+        const rootExitConfirmsCleanup = processRecord != null
+            && processRecord.processGroupId == null
+            && processRecord.birthMarker == null
+            && processRecord.ownershipToken == null;
+        await prisma.executionProcess.updateMany({
+            where: {
+                sessionId: event.towerSessionId,
+                runtimeInstanceId: event.runtimeInstanceId,
+                ...(launchClaimNumber != null ? { launchClaimNumber } : {}),
+            },
+            data: {
+                exitCode: event.exitCode,
+            },
         }).catch((error) => {
             this.logSessionError('session.processExit', error, {
                 sessionId: event.towerSessionId,
@@ -704,6 +1452,134 @@ export class SessionManager {
                 exitCode: event.exitCode,
             });
         });
+        if (rootExitConfirmsCleanup) {
+            await this.markRuntimeProcessCleanupState(event.towerSessionId, event.runtimeInstanceId, 'CONFIRMED', undefined, launchClaimNumber);
+        }
+        else if (processRecord) {
+            await this.markRuntimeProcessCleanupPending(event.towerSessionId, event.runtimeInstanceId, launchClaimNumber);
+        }
+        if (rootExitConfirmsCleanup) {
+            if (processKey)
+                this.runtimeProcessIds.delete(processKey);
+        }
+    }
+    pendingRuntimeEventCount() {
+        let count = 0;
+        for (const events of this.pendingRuntimeProcessEvents.values())
+            count += events.length;
+        return count;
+    }
+    clearPendingRuntimeProcessEvents(sessionId) {
+        for (const key of this.pendingRuntimeProcessEvents.keys()) {
+            if (key.startsWith(`${sessionId}:`)) {
+                this.pendingRuntimeProcessEvents.delete(key);
+                this.clearPendingRuntimeEventExpiryTimer(key);
+            }
+        }
+    }
+    clearPendingRuntimeEventExpiryTimer(key) {
+        const timer = this.pendingRuntimeEventExpiryTimers.get(key);
+        if (timer)
+            clearTimeout(timer);
+        this.pendingRuntimeEventExpiryTimers.delete(key);
+    }
+    prunePendingRuntimeProcessEvents() {
+        const now = Date.now();
+        for (const [key, events] of this.pendingRuntimeProcessEvents) {
+            const live = events.filter((entry) => entry.expiresAt > now);
+            if (live.length === 0) {
+                this.pendingRuntimeProcessEvents.delete(key);
+                this.clearPendingRuntimeEventExpiryTimer(key);
+            }
+            else if (live.length !== events.length)
+                this.pendingRuntimeProcessEvents.set(key, live);
+        }
+    }
+    async quarantineRuntimeProcessEvent(event, diagnostic) {
+        await prisma.session.updateMany({
+            where: { id: event.towerSessionId },
+            data: {
+                runtimeLaunchState: RUNTIME_LAUNCH_STATES.QUARANTINED,
+                runtimeLaunchDiagnostic: diagnostic,
+                runtimeLaunchDiagnosticCount: { increment: 1 },
+                runtimeLaunchNextDiagnosticAt: new Date(Date.now() + 5 * 60_000),
+            },
+        }).catch((error) => {
+            this.logSessionError('session.processEventQuarantine', error, {
+                sessionId: event.towerSessionId,
+                runtimeInstanceId: event.runtimeInstanceId,
+            });
+        });
+    }
+    async markRuntimeProcessCleanupPending(sessionId, runtimeInstanceId, launchClaimNumber) {
+        if (!Number.isInteger(launchClaimNumber) || launchClaimNumber <= 0) {
+            await this.quarantinePersistedRuntimeProcess(sessionId, runtimeInstanceId, 'Runtime cleanup transition is missing launchClaimNumber; owner remains quarantined', launchClaimNumber);
+            return;
+        }
+        const resolvedClaim = launchClaimNumber;
+        await prisma.executionProcess.updateMany({
+            where: {
+                sessionId,
+                runtimeInstanceId,
+                launchClaimNumber: resolvedClaim,
+                cleanupState: { notIn: ['CONFIRMED', 'QUARANTINED'] },
+            },
+            data: {
+                cleanupState: 'PENDING',
+                cleanupError: null,
+                nextCleanupRetryAt: null,
+            },
+        }).catch((error) => {
+            this.logSessionError('session.processCleanupPending', error, { sessionId, runtimeInstanceId });
+        });
+    }
+    async markRuntimeProcessCleanupState(sessionId, runtimeInstanceId, cleanupState, cleanupError, launchClaimNumber) {
+        if (!Number.isInteger(launchClaimNumber) || launchClaimNumber <= 0) {
+            await this.quarantinePersistedRuntimeProcess(sessionId, runtimeInstanceId, 'Runtime cleanup transition is missing launchClaimNumber; owner remains quarantined', launchClaimNumber);
+            return;
+        }
+        const resolvedClaim = launchClaimNumber;
+        await prisma.$transaction(async (tx) => {
+            const record = await tx.executionProcess.findFirst({
+                where: { sessionId, runtimeInstanceId, launchClaimNumber: resolvedClaim },
+                select: { id: true, cleanupAttemptCount: true, cleanupState: true },
+            });
+            if (!record)
+                return;
+            if (cleanupState === 'CONFIRMED') {
+                if (record.cleanupState === 'QUARANTINED')
+                    return;
+                await tx.executionProcess.updateMany({
+                    where: { id: record.id, sessionId, runtimeInstanceId, launchClaimNumber: resolvedClaim },
+                    data: {
+                        cleanupState,
+                        cleanupError: null,
+                        nextCleanupRetryAt: null,
+                    },
+                });
+                this.runtimeProcessIds.delete(eventKey(sessionId, runtimeInstanceId, resolvedClaim));
+                return;
+            }
+            const attempt = record.cleanupAttemptCount + 1;
+            const delay = PROCESS_CLEANUP_RETRY_DELAYS_MS[Math.min(attempt - 1, PROCESS_CLEANUP_RETRY_DELAYS_MS.length - 1)];
+            await tx.executionProcess.updateMany({
+                where: {
+                    id: record.id,
+                    sessionId,
+                    runtimeInstanceId,
+                    launchClaimNumber: resolvedClaim,
+                    cleanupState: { notIn: ['CONFIRMED', 'QUARANTINED'] },
+                },
+                data: {
+                    cleanupState,
+                    cleanupError: cleanupError?.slice(0, 2_000) ?? 'Process cleanup failed',
+                    cleanupAttemptCount: attempt,
+                    nextCleanupRetryAt: new Date(Date.now() + delay),
+                },
+            });
+        }).catch((error) => {
+            this.logSessionError('session.processCleanupState', error, { sessionId, runtimeInstanceId, cleanupState });
+        });
     }
     normalizeRuntimeType(value) {
         return value === RuntimeType.ACP ? RuntimeType.ACP : RuntimeType.CLI;
@@ -955,6 +1831,48 @@ export class SessionManager {
             },
         });
     }
+    appendUserMessageEntry(session, message, entryId) {
+        const sessionId = session.id;
+        const isNewStore = !sessionMsgStoreManager.has(sessionId);
+        const msgStore = sessionMsgStoreManager.getOrCreate(sessionId);
+        if (isNewStore && session.logSnapshot) {
+            try {
+                msgStore.restoreFromSnapshot(JSON.parse(session.logSnapshot));
+            }
+            catch (error) {
+                console.error(`[SessionManager] Failed to restore snapshot for session ${sessionId}:`, error);
+            }
+        }
+        // Heal index drift caused by previously failed patches (e.g. invalid value).
+        const preflightSnapshot = msgStore.getSnapshot();
+        const expectedIndex = preflightSnapshot.entries.length;
+        const currentIndex = msgStore.entryIndex.current();
+        if (currentIndex !== expectedIndex) {
+            if (DEBUG_SNAPSHOT) {
+                console.warn(`[SessionManager:snapshot] rebase entryIndex sessionId=${sessionId} currentIndex=${currentIndex} expectedIndex=${expectedIndex}`);
+            }
+            msgStore.entryIndex.startFrom(expectedIndex);
+        }
+        // Queue retries may reach this point after the patch was already applied
+        // but before its durable userEntryId update. Reusing the stable id makes
+        // the replay a no-op instead of appending the same message twice.
+        if (entryId) {
+            const existing = preflightSnapshot.entries.find((entry) => entry.id === entryId);
+            if (existing)
+                return entryId;
+        }
+        const userEntry = createUserMessage(message, entryId);
+        const userIndex = msgStore.entryIndex.next();
+        const userPatch = addNormalizedEntry(userIndex, userEntry);
+        if (DEBUG_SNAPSHOT) {
+            console.log(`[SessionManager:snapshot] userPatch sessionId=${sessionId} index=${userIndex} currentIndex=${msgStore.entryIndex.current()}`);
+        }
+        const userPatchSeq = msgStore.pushPatch(userPatch);
+        // Emit directly to EventBus — a previous pipeline may have been destroyed
+        // before the queued turn starts, leaving no MsgStore patch listener.
+        this.eventBus.emit('session:patch', { sessionId, patch: userPatch, seq: userPatchSeq });
+        return userEntry.id;
+    }
     isConversationSession(session) {
         return session.context === SessionContext.CONVERSATION || Boolean(session.conversationId);
     }
@@ -1198,7 +2116,7 @@ export class SessionManager {
             }
             if (!this.isCurrentGeneration(sessionId, generation))
                 return;
-            const handledByTeamRun = await this.teamReconciler.handleSessionExit(sessionId);
+            const handledByTeamRun = await this.teamReconciler.handleSessionExit(sessionId, options.runtimeInstanceId);
             if (!this.isCurrentGeneration(sessionId, generation))
                 return;
             if (!isFailed) {
@@ -1224,6 +2142,7 @@ export class SessionManager {
         if (this.isCurrentGeneration(sessionId, generation)) {
             sessionMsgStoreManager.delete(sessionId);
             this.releaseSnapshotPersistenceState(sessionId);
+            this.clearPendingRuntimeProcessEvents(sessionId);
         }
     }
     beginSessionExecution(sessionId) {