baxian 1.2.56 → 1.2.58

package/dist/agent/manager.js

@@ -1,4 +1,5 @@
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
 import { join, normalize } from 'node:path';
 import { tmpdir } from 'node:os';
 import { createSignalToken } from './phase-signal.js';
@@ -13,7 +14,7 @@ import { findForeignTaskTip } from './lineage.js';
 import { imageFilename, agentHostPath, writeImageToHost } from './image-input.js';
 import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, hasOscTitleWorking, hasOscTitleIdle, screenAllowsTitleIdle, } from './tmux.js';
 import { BranchManager, DirtyWorkdirError, ReviewHeadMismatchError } from './branch.js';
-import { RepoStore, createRepoStoreCache } from './repo-store.js';
+import { RepoStore, createRepoStoreCache, moveFileIntoPlace, stageFileGuarded } from './repo-store.js';
 import { PhaseSignalWatcher } from './phase-signal-watcher.js';
 import { ReviewTransport, resolveServerPayloads } from './review-transport.js';
 import { buildPromptInline, buildGreetingPrompt, PromptSizeError, RequiredSkillsMissingError, MAX_PROMPT_BYTES_ROUTE_LIMIT, } from './prompt.js';
@@ -85,6 +86,10 @@ export function buildLaunchCommand(agent) {
     }
     return segments.join(' ');
 }
+// cd re-resolves by pathname: a reused pane shell may sit on a deleted-and-recreated cwd inode.
+export function launchCommandIn(dir, agent) {
+    return `cd ${shellQuote(dir)} && ${buildLaunchCommand(agent)}`;
+}
 function agentRuntimeKindFor(agent) {
     return agent.runtime;
 }
@@ -142,6 +147,16 @@ const RUNTIME_LIVENESS_SAMPLES = 3;
 export function canDispatchWithBinding(binding) {
     return !binding?.taskId && !binding?.creationToken && binding?.status !== 'awaiting_human';
 }
+// 派发期 hold：prompt 从未注入、pane 无在途回合，重派安全；ack_unknown 一类不在此列
+export const RECOVERABLE_QA_DISPATCH_HOLD_PHASES = new Set([
+    'checkout-preparation-failed',
+    'dirty-workdir',
+]);
+export function isRecoverableQaDispatchHold(binding) {
+    return binding?.status === 'awaiting_human'
+        && binding.awaitingPhase != null
+        && RECOVERABLE_QA_DISPATCH_HOLD_PHASES.has(binding.awaitingPhase);
+}
 const TURN_COMPLETED_AWAITING_PHASES = new Set();
 const CANCEL_CLEANUP_HOLD_PHASES = new Set(['cancel-clearing', 'cancel-interrupt-failed']);
 function isCancelCleanupHold(binding) {
@@ -158,12 +173,24 @@ function cancelPhaseDowngrades(prev, next) {
     return cancelPhaseRank(next) < cancelPhaseRank(prev);
 }
 const REGREET_REQUIRED_HOLD_PHASES = new Set(['greeting_failed']);
+const CHECKOUT_HOLD_PHASES = new Set([
+    'dirty-workdir',
+    'checkout-preparation-failed',
+    'branch-cleanup-pending',
+]);
 function shouldReleaseHeldBinding(state, boundTask) {
     if (state.awaitingPhase != null && REGREET_REQUIRED_HOLD_PHASES.has(state.awaitingPhase))
         return false;
     const taskIsTerminal = !!boundTask && TERMINAL_STATUSES.includes(boundTask.status);
     const turnCompleted = state.awaitingPhase != null && TURN_COMPLETED_AWAITING_PHASES.has(state.awaitingPhase);
-    return !boundTask || taskIsTerminal || turnCompleted;
+    // 任务已退回 verdict 门禁且当前持有者不是本 agent：这次绑定是转码失败的残留
+    // （fresh-acquire 释放被脏树挡下），Resume 时补完释放，否则 dev 被永久占住
+    const staleCodeHandoff = state.awaitingPhase != null
+        && CHECKOUT_HOLD_PHASES.has(state.awaitingPhase)
+        && !!boundTask
+        && (boundTask.status === 'spec-ready' || boundTask.status === 'max_rounds')
+        && boundTask.agentId !== state.id;
+    return !boundTask || taskIsTerminal || turnCompleted || staleCodeHandoff;
 }
 export class AgentManager {
     config;
@@ -449,8 +476,11 @@ export class AgentManager {
                 `if tmux is missing, ${tmuxInstallHint(agent.projectId)}`);
         }
         if (mode === 'create' && alive) {
-            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
-                `it creates itself — kill it manually or pick a different agent id`);
+            const reclaimed = await this.runUnderSessionLifecycle(agentId, () => this.reclaimHalfCreatedSession(tmux, agentId));
+            if (!reclaimed) {
+                throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
+                    `it creates itself — kill it manually or pick a different agent id`);
+            }
         }
         if (alive && (mode === 'runtime' || mode === 'recover')) {
             return this.adoptOrRestartSession(tmux, runner, agent, agentId, workdir, workdir);
@@ -470,8 +500,77 @@ export class AgentManager {
         // before the skill runs. Message-body payloads are not expanded, so this path is injection-safe.
         await this.runUnderSkillDirLock(this.skillDirLockKey(agent, workdir), async () => {
             await this.ensureSkillDirSafe(runner, workdir, subdir);
-            await this.skillRegistry.materialize((path, content) => this.atomicWriteFile(runner, path, content), destRoot);
+            await this.skillRegistry.materialize((path, content) => this.atomicWriteFile(runner, workdir, path, content), destRoot);
+        });
+    }
+    // A rollback only kills if no adoption bumped the generation since its create.
+    sessionLifecycleChain = new Map();
+    adoptGeneration = new Map();
+    runUnderSessionLifecycle(agentId, fn) {
+        const prev = this.sessionLifecycleChain.get(agentId) ?? Promise.resolve();
+        const cur = prev.then(fn, fn);
+        const settled = cur.then(() => undefined, () => undefined);
+        this.sessionLifecycleChain.set(agentId, settled);
+        void settled.finally(() => {
+            if (this.sessionLifecycleChain.get(agentId) === settled)
+                this.sessionLifecycleChain.delete(agentId);
         });
+        return cur;
+    }
+    // Inside the lifecycle lock, a generation bump since create means handoff — stand down.
+    async rollbackCreatedSession(agentId, partial, reason, opts = {}) {
+        await this.runUnderSessionLifecycle(agentId, async () => {
+            try {
+                const ref = partial.sessionRef;
+                if (!ref) {
+                    console.warn(`[AgentManager] ${agentId} rollback (${reason}) skipped: no session ref recorded`);
+                    return;
+                }
+                if ((this.adoptGeneration.get(agentId) ?? 0) !== (partial.genAtCreate ?? 0)) {
+                    console.warn(`[AgentManager] ${agentId} rollback (${reason}) skipped: session adopted since create — leaving it to its successor`);
+                    return;
+                }
+                if (opts.expectCreationToken !== undefined) {
+                    let fresh;
+                    try {
+                        fresh = await this.agentStore.get(agentId);
+                    }
+                    catch (storeErr) {
+                        console.warn(`[AgentManager] ${agentId} rollback (${reason}) skipped: agent store read failed — session left in place:`, storeErr);
+                        return;
+                    }
+                    if (!fresh) {
+                        console.warn(`[AgentManager] ${agentId} rollback (${reason}) skipped: agent record gone`);
+                        return;
+                    }
+                    if (fresh.creationToken !== opts.expectCreationToken) {
+                        console.warn(`[AgentManager] ${agentId} rollback (${reason}) skipped: creationToken rotated — leaving the session to its successor`);
+                        return;
+                    }
+                }
+                const cfg = this.getAgentConfig(agentId);
+                if (!cfg) {
+                    console.warn(`[AgentManager] ${agentId} rollback (${reason}) skipped: agent no longer in config`);
+                    return;
+                }
+                const runner = this.createRunnerFor(cfg);
+                const outcome = await new TmuxManager(runner).killSessionRef(ref);
+                if (outcome === 'stale-server') {
+                    console.warn(`[AgentManager] ${agentId} rollback (${reason}): tmux server generation changed — leaving session ${ref.sessionId} untouched`);
+                }
+                else if (outcome === 'killed') {
+                    console.warn(`[AgentManager] ${agentId} rollback (${reason}): killed created session ${ref.sessionId}`);
+                }
+            }
+            catch (cleanupErr) {
+                console.warn(`[AgentManager] created-session rollback (${reason}) failed for ${agentId}:`, cleanupErr);
+            }
+        });
+    }
+    async rollbackEnsureSessionFailure(agentId, err, reason) {
+        if (!(err instanceof EnsureSessionError) || !err.partial.createdSession)
+            return;
+        await this.rollbackCreatedSession(agentId, err.partial, reason);
     }
     skillDirChain = new Map();
     skillDirLockKey(agent, workdir) {
@@ -491,19 +590,21 @@ export class AgentManager {
         });
         return run;
     }
-    async atomicWriteFile(runner, finalPath, content) {
-        const tmp = `${finalPath}.baxian-tmp`;
-        await runner.writeFile(tmp, content);
-        const mv = `mv -f ${shellQuote(tmp)} ${shellQuote(finalPath)}`;
-        const res = await runner.exec(`sh -c ${shellQuote(mv)}`);
-        if (res.exitCode !== 0) {
-            throw new Error(`atomic skill write failed (${finalPath}): ${res.stderr || 'unknown error'}`);
+    async atomicWriteFile(runner, workdir, finalPath, content) {
+        const tmp = `${finalPath}.baxian-tmp-${randomBytes(6).toString('hex')}`;
+        try {
+            await stageFileGuarded(runner, workdir, tmp, content);
+            await moveFileIntoPlace(runner, tmp, finalPath, { guardRoot: workdir });
+        }
+        catch (err) {
+            throw new Error(`atomic skill write failed (${finalPath}): ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     async ensureSkillDirSafe(runner, workdir, subdir) {
         const top = subdir.split('/')[0];
         const keep = this.skillRegistry.names().map((n) => `! -name ${shellQuote(n)}`).join(' ');
-        const inner = `cd ${shellQuote(workdir)} && ` +
+        const inner = `[ ! -L ${shellQuote(workdir)} ] && [ -d ${shellQuote(workdir)} ] && ` +
+            `cd ${shellQuote(workdir)} && ` +
             `for d in ${top} ${subdir}; do if [ -L "$d" ]; then ` +
             `printf 'baxian: %s is a symlink -> %s; replace it with a real directory\\n' "$d" "$(readlink "$d")" >&2; ` +
             `exit 3; fi; done && ` +
@@ -516,10 +617,12 @@ export class AgentManager {
             throw new Error(`failed to prepare a symlink-safe ${subdir} in ${workdir}: ${res.stderr || 'unknown error'}`);
         }
     }
-    async tagSessionSkillsVersion(tmux, agentId) {
+    async tagSessionSkillsVersion(tmux, agentId, ref) {
         if (this.skillRegistry.names().length === 0)
             return;
-        await tmux.setOption(agentId, '@baxian-skills-version', this.skillRegistry.contentHash());
+        await this.setSessionOptions(tmux, agentId, ref, [
+            ['@baxian-skills-version', this.skillRegistry.contentHash()],
+        ]);
     }
     async replSkillsStale(tmux, agentId) {
         if (this.skillRegistry.names().length === 0)
@@ -528,7 +631,8 @@ export class AgentManager {
         return tagged !== this.skillRegistry.contentHash();
     }
     async excludeInjectedSkills(runner, workdir, subdir) {
-        const inner = `cd ${shellQuote(workdir)} && ` +
+        const inner = `[ ! -L ${shellQuote(workdir)} ] && [ -d ${shellQuote(workdir)} ] && ` +
+            `cd ${shellQuote(workdir)} && ` +
             `if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then echo BX_SKILLS_NON_GIT; exit 0; fi; ` +
             `tracked="$(git ls-files -- ${shellQuote(`${subdir}/baxian-*`)} 2>/dev/null | head -5)"; ` +
             `if [ -n "$tracked" ]; then printf 'BX_SKILLS_TRACKED %s\\n' "$tracked" | head -1; exit 0; fi; ` +
@@ -551,35 +655,46 @@ export class AgentManager {
         }
         throw new Error(`cannot make injected skills invisible to Git in ${workdir}: ${verdict || 'no probe output'}`);
     }
-    async pinRuntimeSessionOptions(tmux, agentId) {
-        await tmux.setOption(agentId, 'prefix', 'C-b');
-        await tmux.setOption(agentId, 'prefix2', 'None');
-        await tmux.setOption(agentId, 'mouse', 'on');
+    runtimePinEntries() {
+        return [
+            ['prefix', 'C-b'],
+            ['prefix2', 'None'],
+            ['mouse', 'on'],
+        ];
     }
-    async pinFreshSessionOptions(tmux, agentId) {
-        await tmux.setOption(agentId, 'window-size', 'latest');
-        await this.pinRuntimeSessionOptions(tmux, agentId);
+    // A name (or even a bare $id) can rebind to a same-name successor mid-flight;
+    // every option write goes through the identity-checked by-ref batch.
+    async setSessionOptions(tmux, agentId, ref, entries) {
+        const outcome = await tmux.setSessionOptionsIfAlive(ref, entries);
+        if (outcome === 'gone') {
+            throw new Error(`tmux session ${ref.sessionId} (${agentId}) vanished before its options could be applied`);
+        }
     }
     async buildFreshSession(tmux, agent, agentId, workdir, sessionDir = workdir) {
         return this.runUnderSkillDirLock(this.skillDirLockKey(agent, sessionDir), () => this.buildFreshSessionLocked(tmux, agent, agentId, workdir, sessionDir));
     }
     async buildFreshSessionLocked(tmux, agent, agentId, workdir, sessionDir) {
         let createdSession = false;
+        let createdRef;
+        const genAtCreate = this.adoptGeneration.get(agentId) ?? 0;
         const runtime = agentRuntimeKindFor(agent);
         try {
-            await tmux.createSession(agentId, sessionDir);
+            createdRef = await tmux.createSession(agentId, sessionDir);
             createdSession = true;
-            await tmux.setOption(agentId, '@baxian-agent-id', agentId);
-            await tmux.setOption(agentId, '@baxian-runtime', agent.runtime);
-            await tmux.setOption(agentId, WORKDIR_SESSION_OPTION, sessionDir);
-            await tmux.setOption(agentId, 'allow-passthrough', 'on');
-            await tmux.setOption(agentId, 'set-titles', 'on');
-            await this.pinFreshSessionOptions(tmux, agentId);
-            await tmux.setOption(agentId, 'status-right', '');
+            await this.setSessionOptions(tmux, agentId, createdRef, [
+                ['@baxian-agent-id', agentId],
+                ['@baxian-runtime', agent.runtime],
+                [WORKDIR_SESSION_OPTION, sessionDir],
+                ['allow-passthrough', 'on'],
+                ['set-titles', 'on'],
+                ['window-size', 'latest'],
+                ...this.runtimePinEntries(),
+                ['status-right', ''],
+            ]);
             await tmux.setServerOption('extended-keys', 'on');
             await tmux.appendServerOptionIfMissing('terminal-features', 'xterm*:extkeys');
-            const paneId = await tmux.getSinglePaneId(agentId);
-            await tmux.sendKeysToPane(paneId, `${buildLaunchCommand(agent)}\n`);
+            const paneId = await tmux.getSinglePaneIdByRef(createdRef);
+            await tmux.sendKeysToPane(paneId, `${launchCommandIn(sessionDir, agent)}\n`);
             await tmux.handleTrustDialog(paneId, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
@@ -587,11 +702,13 @@ export class AgentManager {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
-            await this.tagSessionSkillsVersion(tmux, agentId);
-            return { ok: true, createdSession: true, freshRuntime: true, paneId, workdir };
+            await this.tagSessionSkillsVersion(tmux, agentId, createdRef);
+            return { ok: true, createdSession: true, freshRuntime: true, paneId, workdir, sessionRef: createdRef };
         }
         catch (err) {
-            const partial = { createdSession, agentId };
+            const partial = { createdSession, agentId, genAtCreate };
+            if (createdRef)
+                partial.sessionRef = createdRef;
             if (err instanceof ReplNotReadyError) {
                 partial.lastScreen = err.lastScreen;
                 if (createdSession && detectStartupDialog(err.lastScreen, runtime)) {
@@ -607,22 +724,12 @@ export class AgentManager {
             console.warn(`[bootstrap] ${agentId} not in config at bootstrap start — aborting`);
             return;
         }
-        const tryKillOrphanSession = async (reason) => {
-            try {
-                const runner = this.createRunnerFor(cfgAtStart);
-                await new TmuxManager(runner).killSession(agentId);
-            }
-            catch (cleanupErr) {
-                console.warn(`[bootstrap] orphan killSession (${reason}) failed for ${agentId}:`, cleanupErr);
-            }
-        };
         try {
             const result = await this.ensureSession(agentId, 'create');
             if (!(await this.runGreetingHandshake(agentId, cfgAtStart, result.paneId))) {
                 const current = await this.agentStore.get(agentId);
                 if (current && current.creationToken !== creationToken) {
-                    console.warn(`[bootstrap] ${agentId} creationToken changed during greeting — killing orphan session`);
-                    await tryKillOrphanSession('greeting-failure token mismatch');
+                    console.warn(`[bootstrap] ${agentId} creationToken changed during greeting — leaving the session to its successor`);
                     return;
                 }
                 await this.markGreetingFailed(agentId, creationToken);
@@ -643,8 +750,7 @@ export class AgentManager {
                 };
             });
             if (!resolvedExisting) {
-                console.warn(`[bootstrap] ${agentId} creationToken mismatch on success — killing orphan session`);
-                await tryKillOrphanSession('post-success token mismatch');
+                console.warn(`[bootstrap] ${agentId} creationToken mismatch on success — leaving the session to its successor`);
                 return;
             }
             await this.safeEmit({
@@ -662,8 +768,7 @@ export class AgentManager {
                 if (err.partial.createdSession) {
                     const fresh = await this.agentStore.get(agentId);
                     if (!fresh || fresh.creationToken !== creationToken) {
-                        console.warn(`[bootstrap] ${agentId} dialog-path token mismatch — killing orphan session`);
-                        await tryKillOrphanSession('dialog-path token mismatch');
+                        console.warn(`[bootstrap] ${agentId} dialog-path token mismatch — leaving the session to its successor`);
                         return;
                     }
                 }
@@ -674,7 +779,9 @@ export class AgentManager {
                 return;
             }
             if (err instanceof EnsureSessionError && err.partial.createdSession) {
-                await tryKillOrphanSession('hard-failure rollback');
+                await this.rollbackCreatedSession(agentId, err.partial, 'hard-failure rollback', {
+                    expectCreationToken: creationToken,
+                });
             }
             const message = err instanceof Error ? err.message : String(err);
             await this.markBootstrapFailed(agentId, creationToken, message);
@@ -1143,27 +1250,39 @@ export class AgentManager {
             signal.addEventListener('abort', onAbort, { once: true });
         });
     }
+    // Claim snapshot and adoption declaration share one critical section with rollbacks.
     async adoptOrRestartSession(tmux, runner, agent, agentId, workdir, sessionDir) {
-        let claim;
+        return this.runUnderSessionLifecycle(agentId, () => this.adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir));
+    }
+    async adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir) {
+        let snapshot;
         try {
-            claim = await tmux.getOption(agentId, '@baxian-agent-id');
+            snapshot = await tmux.getSessionSnapshot(agentId);
         }
         catch (err) {
-            throw new EnsureSessionError({ createdSession: false, agentId }, `getOption(@baxian-agent-id) failed: ${err instanceof Error ? err.message : String(err)}`);
+            throw new EnsureSessionError({ createdSession: false, agentId }, `session snapshot failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        if (claim !== agentId) {
+        if (!snapshot) {
+            return this.buildFreshSession(tmux, agent, agentId, workdir, sessionDir);
+        }
+        const sessionRef = snapshot.ref;
+        if (snapshot.claim !== agentId) {
+            if (snapshot.claim === null && await this.reclaimHalfCreatedSession(tmux, agentId, snapshot)) {
+                return this.buildFreshSession(tmux, agent, agentId, workdir, sessionDir);
+            }
             throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" exists but @baxian-agent-id session claim mismatch ` +
-                `(got "${claim ?? 'null'}"); baxian will not adopt foreign session — operator must intervene`);
+                `(got "${snapshot.claim ?? 'null'}"); baxian will not adopt foreign session — operator must intervene`);
         }
+        this.adoptGeneration.set(agentId, (this.adoptGeneration.get(agentId) ?? 0) + 1);
         try {
-            await this.pinRuntimeSessionOptions(tmux, agentId);
+            await this.setSessionOptions(tmux, agentId, sessionRef, this.runtimePinEntries());
         }
         catch (err) {
-            throw new EnsureSessionError({ createdSession: false, agentId }, `pinRuntimeSessionOptions failed: ${err instanceof Error ? err.message : String(err)}`);
+            throw new EnsureSessionError({ createdSession: false, agentId }, `pinning runtime session options failed: ${err instanceof Error ? err.message : String(err)}`);
         }
         let paneId;
         try {
-            paneId = await tmux.getSinglePaneId(agentId);
+            paneId = await tmux.getSinglePaneIdByRef(sessionRef);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `getSinglePaneId failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1202,10 +1321,10 @@ export class AgentManager {
             else if (state.kind !== 'shell') {
                 throw new EnsureSessionError({ createdSession: false, agentId }, `tmux pane path ${currentPath} differs from Workdir ${sessionDir}, but runtime is not safely idle`);
             }
-            await tmux.killSession(agentId);
+            await this.killAdoptTarget(tmux, agentId, sessionRef, 'workdir change');
             return this.buildFreshSession(tmux, agent, agentId, workdir, sessionDir);
         }
-        await tmux.setOption(agentId, WORKDIR_SESSION_OPTION, sessionDir);
+        await this.setSessionOptions(tmux, agentId, sessionRef, [[WORKDIR_SESSION_OPTION, sessionDir]]);
         switch (state.kind) {
             case 'live-runtime': {
                 let stale;
@@ -1223,9 +1342,10 @@ export class AgentManager {
                         skillsStale: true,
                         paneId,
                         workdir,
+                        sessionRef,
                     };
                 }
-                return { ok: true, createdSession: false, freshRuntime: false, paneId, workdir };
+                return { ok: true, createdSession: false, freshRuntime: false, paneId, workdir, sessionRef };
             }
             case 'startup-dialog':
                 throw new EnsureSessionError({
@@ -1247,8 +1367,8 @@ export class AgentManager {
                         timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                         scrollback: 0,
                     });
-                    await this.tagSessionSkillsVersion(tmux, agentId);
-                    return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir };
+                    await this.tagSessionSkillsVersion(tmux, agentId, sessionRef);
+                    return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir, sessionRef };
                 }
                 catch (trustErr) {
                     if (trustErr instanceof ReplNotReadyError && detectStartupDialog(trustErr.lastScreen, runtime)) {
@@ -1266,7 +1386,7 @@ export class AgentManager {
                 break;
         }
         try {
-            await tmux.sendKeysToPane(paneId, `${buildLaunchCommand(agent)}\n`);
+            await tmux.sendKeysToPane(paneId, `${launchCommandIn(sessionDir, agent)}\n`);
             await tmux.handleTrustDialog(paneId, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
@@ -1274,8 +1394,8 @@ export class AgentManager {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
-            await this.tagSessionSkillsVersion(tmux, agentId);
-            return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir };
+            await this.tagSessionSkillsVersion(tmux, agentId, sessionRef);
+            return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir, sessionRef };
         }
         catch (relErr) {
             if (relErr instanceof ReplNotReadyError && detectStartupDialog(relErr.lastScreen, runtime)) {
@@ -1289,6 +1409,66 @@ export class AgentManager {
             throw new EnsureSessionError({ createdSession: false, agentId }, `REPL relaunch failed: ${relErr instanceof Error ? relErr.message : String(relErr)}`);
         }
     }
+    // Frees a bootstrap blocked on its predecessor's half-created session (nonce
+    // env present but claim never written); anything else is left alone.
+    async reclaimHalfCreatedSession(tmux, agentId, knownSnapshot) {
+        let snapshot;
+        try {
+            snapshot = knownSnapshot ?? await tmux.getSessionSnapshot(agentId);
+        }
+        catch (err) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `session snapshot failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!snapshot)
+            return true;
+        if (snapshot.claim !== null)
+            return false;
+        let halfCreated;
+        try {
+            halfCreated = await tmux.hasCreationNonce(agentId);
+        }
+        catch (err) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `creation-nonce probe failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!halfCreated)
+            return false;
+        let outcome;
+        try {
+            // claim-still-empty rides the kill itself — a claim racing the probes makes the server refuse.
+            outcome = await tmux.killSessionRef(snapshot.ref, { onlyIfUnclaimed: true });
+        }
+        catch (err) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `killSessionRef (half-created leftover) failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (outcome === 'refused' || outcome === 'stale-server') {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `session ${snapshot.ref.sessionId} was claimed (or its server changed) while reclaiming the half-created leftover — retry to observe the new state`);
+        }
+        if (outcome === 'killed') {
+            console.warn(`[AgentManager] ${agentId}: killed half-created leftover session ${snapshot.ref.sessionId} (creation nonce present, claim never written)`);
+        }
+        else {
+            console.warn(`[AgentManager] ${agentId}: half-created leftover session ${snapshot.ref.sessionId} already gone`);
+        }
+        return true;
+    }
+    async killAdoptTarget(tmux, agentId, sessionRef, reason) {
+        let outcome;
+        try {
+            outcome = await tmux.killSessionRef(sessionRef);
+        }
+        catch (err) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `killSessionRef (${reason}) failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (outcome === 'stale-server') {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux server generation changed while replacing session (${reason}); retry to observe the new state`);
+        }
+        if (outcome === 'killed') {
+            console.warn(`[AgentManager] ${agentId}: killed session ${sessionRef.sessionId} (${reason})`);
+        }
+        else {
+            console.warn(`[AgentManager] ${agentId}: session ${sessionRef.sessionId} already gone (${reason})`);
+        }
+    }
     async acquireAgentForTask(agentId, taskId, phase) {
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
@@ -1335,17 +1515,43 @@ export class AgentManager {
                     `(expected ${expectedTaskId}, got ${state.taskId}); skipping`);
                 return false;
             }
+            if (opts.expectedLockToken !== undefined && state.lockToken !== opts.expectedLockToken) {
+                console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} lock generation changed ` +
+                    `(binding re-acquired by a successor); skipping release`);
+                return false;
+            }
             if (isCancelCleanupHold(state) && !opts.fromCancelCleanup) {
                 console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} ${state.awaitingPhase} (cancel-cleanup hold); refusing auto-release`);
                 return false;
             }
             const boundTask = await this.taskStore.get(expectedTaskId);
+            if (opts.expectedTask
+                && boundTask
+                && (boundTask.status !== opts.expectedTask.status
+                    || boundTask.phase !== opts.expectedTask.phase
+                    || boundTask.signalToken !== opts.expectedTask.signalToken)) {
+                console.warn(`[AgentManager] releaseAgentForTask: task ${expectedTaskId} moved past the captured pass; skipping ${mode} transition`);
+                return false;
+            }
             if (state.status === 'awaiting_human' && !opts.allowAwaitingHuman) {
                 if (!shouldReleaseHeldBinding(state, boundTask)) {
                     console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} is awaiting_human (${state.awaitingPhase}); refusing to release`);
                     return false;
                 }
             }
+            // expectedHold 是 hold 世代快照的严格 CAS（全 undefined 表示“期望无 hold”）：
+            // hold 消失（被并发 Resume 清掉）或换代同样意味着接管，不得继续释放
+            const matchesExpectedHold = (binding) => {
+                const held = binding.status === 'awaiting_human';
+                return (held ? binding.awaitingPhase : undefined) === opts.expectedHold.phase
+                    && (held ? binding.awaitingSince : undefined) === opts.expectedHold.since
+                    && (held ? binding.awaitingNonce : undefined) === opts.expectedHold.nonce;
+            };
+            // 世代门前置：hold 换代时任何 pane/workdir 副作用都不得发生（末尾 CAS 只兜最后窗口）
+            if (opts.expectedHold && !matchesExpectedHold(state)) {
+                console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed or cleared before release; refusing`);
+                return false;
+            }
             if (mode === 'waiting' && (!boundTask || !ACTIVE_TASK_STATUSES.has(boundTask.status))) {
                 console.warn(`[AgentManager] releaseAgentForTask: task ${expectedTaskId} is not active; skipping waiting transition`);
                 return false;
@@ -1360,10 +1566,19 @@ export class AgentManager {
             }
             const now = new Date().toISOString();
             if (mode === 'waiting') {
+                let preservedNewerHold = false;
                 await this.agentStore.update(agentId, (latest) => {
                     if (!latest)
                         return AGENT_STORE_NOOP;
                     if (opts.clearAwaitingHuman && latest.status === 'awaiting_human') {
+                        // The hold-generation CAS lives inside the atomic update: a hold written after any pre-read survives.
+                        if (opts.expectedHold
+                            && (latest.awaitingPhase !== opts.expectedHold.phase
+                                || latest.awaitingSince !== opts.expectedHold.since
+                                || latest.awaitingNonce !== opts.expectedHold.nonce)) {
+                            preservedNewerHold = true;
+                            return AGENT_STORE_NOOP;
+                        }
                         const cleared = {
                             id: latest.id,
                             projectId: latest.projectId,
@@ -1382,6 +1597,10 @@ export class AgentManager {
                         updatedAt: now,
                     };
                 });
+                if (preservedNewerHold) {
+                    console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} holds a newer generation than the captured one; keeping the hold`);
+                    return false;
+                }
                 return true;
             }
             let sessionConfirmedAbsent = false;
@@ -1389,6 +1608,7 @@ export class AgentManager {
                 const releaseWorkdir = state.workdir;
                 const runner = this.createRunnerFor(cfg);
                 const tmux = new TmuxManager(runner);
+                const holdMatchesExpected = (binding) => !opts.expectedHold || matchesExpectedHold(binding);
                 const hold = async (reason) => {
                     const latest = await this.agentStore.get(agentId);
                     if (!latest
@@ -1397,18 +1617,27 @@ export class AgentManager {
                         || !await this.lockManager.isOwner(agentId, expectedTaskId, lockToken)) {
                         return false;
                     }
+                    // 释放中被写入的新 hold（如 ack_unknown）比 cleanup 失败信息更关键，不得覆盖
+                    if (!holdMatchesExpected(latest)) {
+                        console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed during release; not overwriting with branch-cleanup-pending`);
+                        return false;
+                    }
                     const pendingAt = new Date().toISOString();
                     if (boundTask && cfg.role === 'dev') {
                         boundTask.branchCleanupPending = { agentId, reason, updatedAt: pendingAt };
                         boundTask.updatedAt = pendingAt;
                         await this.taskStore.set(boundTask);
                     }
-                    await this.agentStore.update(agentId, (latest) => {
-                        if (!latest || latest.taskId !== expectedTaskId || latest.lockToken !== lockToken) {
+                    let wrote = false;
+                    await this.agentStore.update(agentId, (latest2) => {
+                        if (!latest2 || latest2.taskId !== expectedTaskId || latest2.lockToken !== lockToken) {
                             return AGENT_STORE_NOOP;
                         }
+                        if (!holdMatchesExpected(latest2))
+                            return AGENT_STORE_NOOP;
+                        wrote = true;
                         return {
-                            ...latest,
+                            ...latest2,
                             status: 'awaiting_human',
                             awaitingPhase: 'branch-cleanup-pending',
                             awaitingReason: reason,
@@ -1416,6 +1645,10 @@ export class AgentManager {
                             updatedAt: pendingAt,
                         };
                     });
+                    if (!wrote) {
+                        console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} branch-cleanup-pending hold not written (binding or hold changed)`);
+                        return false;
+                    }
                     await this.emitIntervention(state.projectId, agentId, expectedTaskId, {
                         phase: 'branch-cleanup-pending',
                         reason,
@@ -1450,6 +1683,14 @@ export class AgentManager {
                         sessionConfirmedAbsent = true;
                     }
                     await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
+                    // 探测/等待期间 markAwaitingHuman 不受本锁串行；进入 checkout 变更前按当前盘面重验世代
+                    if (opts.expectedHold) {
+                        const beforeBranchOps = await this.agentStore.get(agentId);
+                        if (!beforeBranchOps || !matchesExpectedHold(beforeBranchOps)) {
+                            console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed before checkout cleanup; aborting release`);
+                            return false;
+                        }
+                    }
                     if (cfg.role === 'dev' && boundTask) {
                         const branches = new BranchManager(runner);
                         const cleanup = await branches.cleanupTaskBranch(releaseWorkdir, {
@@ -1493,6 +1734,13 @@ export class AgentManager {
                                 delete boundTask.branchCleanupSkipped;
                                 cleanupStateChanged = true;
                             }
+                            if (cleanup.remoteTipSha) {
+                                boundTask.branchLocalCleaned = {
+                                    remoteTipSha: cleanup.remoteTipSha,
+                                    updatedAt: new Date().toISOString(),
+                                };
+                                cleanupStateChanged = true;
+                            }
                         }
                         if (cleanupStateChanged) {
                             boundTask.updatedAt = new Date().toISOString();
@@ -1519,6 +1767,7 @@ export class AgentManager {
             else {
                 await this.assertTaskLockOwner(agentId, expectedTaskId, lockToken);
             }
+            let holdGenerationChanged = false;
             await this.agentStore.update(agentId, (existing) => {
                 if (!existing)
                     return AGENT_STORE_NOOP;
@@ -1527,6 +1776,11 @@ export class AgentManager {
                     || (state.workdir !== undefined && existing.workdir !== state.workdir)) {
                     return AGENT_STORE_NOOP;
                 }
+                // 世代 CAS 在原子写入内判定：预读后被重写或清除的 hold 都不得被这次释放清掉
+                if (opts.expectedHold && !matchesExpectedHold(existing)) {
+                    holdGenerationChanged = true;
+                    return AGENT_STORE_NOOP;
+                }
                 return {
                     id: existing.id,
                     projectId: existing.projectId,
@@ -1536,9 +1790,25 @@ export class AgentManager {
                     updatedAt: now,
                 };
             });
+            if (holdGenerationChanged) {
+                console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed during release; keeping the hold`);
+                return false;
+            }
             return this.lockManager.releaseIfOwner(agentId, expectedTaskId, lockToken);
         });
     }
+    async clearBranchLocalCleaned(taskId) {
+        await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh?.branchLocalCleaned)
+                return;
+            delete fresh.branchLocalCleaned;
+            fresh.updatedAt = new Date().toISOString();
+            await this.taskStore.set(fresh);
+        }).catch(err => {
+            console.warn(`[AgentManager] clearing branchLocalCleaned(${taskId}) failed:`, err);
+        });
+    }
     async releaseAgentIfBound(agentId, expectedTaskId, opts) {
         const state = await this.agentStore.get(agentId);
         if (state?.taskId !== expectedTaskId)
@@ -1750,14 +2020,20 @@ export class AgentManager {
         this.phaseSignalWatcher?.rearmNeedInput(agentId);
         await this.setAgentNeedInput(agentId, false);
     }
-    async clearAwaitingHuman(agentId) {
+    async clearAwaitingHuman(agentId, opts = {}) {
         const now = new Date().toISOString();
         let cleared = false;
         await this.agentStore.update(agentId, (latest) => {
             if (!latest || latest.status !== 'awaiting_human')
                 return AGENT_STORE_NOOP;
+            if (opts.expectedHold
+                && (latest.awaitingPhase !== opts.expectedHold.phase
+                    || latest.awaitingSince !== opts.expectedHold.since
+                    || latest.awaitingNonce !== opts.expectedHold.nonce)) {
+                return AGENT_STORE_NOOP;
+            }
             cleared = true;
-            const { status: _status, awaitingPhase: _awaitingPhase, awaitingReason: _awaitingReason, awaitingSince: _awaitingSince, ...readyState } = latest;
+            const { status: _status, awaitingPhase: _awaitingPhase, awaitingReason: _awaitingReason, awaitingSince: _awaitingSince, awaitingNonce: _awaitingNonce, ...readyState } = latest;
             return {
                 ...readyState,
                 updatedAt: now,
@@ -1773,6 +2049,16 @@ export class AgentManager {
         await this.agentStore.update(agentId, (existing) => {
             if (!existing)
                 return AGENT_STORE_NOOP;
+            if (opts.expectedHold) {
+                const heldPhase = existing.status === 'awaiting_human' ? existing.awaitingPhase : undefined;
+                const heldSince = existing.status === 'awaiting_human' ? existing.awaitingSince : undefined;
+                const heldNonce = existing.status === 'awaiting_human' ? existing.awaitingNonce : undefined;
+                if (heldPhase !== opts.expectedHold.phase
+                    || heldSince !== opts.expectedHold.since
+                    || heldNonce !== opts.expectedHold.nonce) {
+                    return AGENT_STORE_NOOP;
+                }
+            }
             if (opts.expectedCreationToken !== undefined) {
                 const expected = opts.expectedCreationToken;
                 const actual = existing.creationToken ?? null;
@@ -1785,6 +2071,10 @@ export class AgentManager {
                 if (actualTask !== expectedTask)
                     return AGENT_STORE_NOOP;
             }
+            // 锁代 CAS：绑定被 successor re-acquire 后不得把工作中的 agent 挂回旧 hold
+            if (opts.expectedLockToken !== undefined && existing.lockToken !== opts.expectedLockToken) {
+                return AGENT_STORE_NOOP;
+            }
             if (isCancelCleanupHold(existing)) {
                 if (!CANCEL_CLEANUP_HOLD_PHASES.has(phase))
                     return AGENT_STORE_NOOP;
@@ -1801,15 +2091,17 @@ export class AgentManager {
                 awaitingPhase: phase,
                 awaitingReason: reason,
                 awaitingSince: now,
+                awaitingNonce: randomBytes(8).toString('hex'),
                 updatedAt: now,
             };
         });
         if (!wrote)
-            return;
+            return false;
         await this.emitIntervention(projectId, agentId, taskId, {
             phase,
             reason,
         });
+        return true;
     }
     async markAwaitingIfAckUnknown(agentId, err, expectedTaskId) {
         if (err instanceof DispatchTerminalError && err.reason === 'ack_unknown') {
@@ -1860,7 +2152,69 @@ export class AgentManager {
                 return { resumed: false, releasedBinding: false, reason };
             }
             if ((state.awaitingPhase === 'dirty-workdir' || state.awaitingPhase === 'checkout-preparation-failed')
-                && boundTask && ACTIVE_TASK_STATUSES.has(boundTask.status)) {
+                && boundTask && ACTIVE_TASK_STATUSES.has(boundTask.status)
+                // verdict 门禁状态没有在途派发：清掉 hold 后由 spec verdict 重新走完整转码，Resume 放行
+                && boundTask.status !== 'spec-ready' && boundTask.status !== 'max_rounds') {
+                if (state.taskId && boundTask.qaAgentId === agentId) {
+                    // 停驻的 review pass 已死（任务离开 review）：重派会伪造新 pass，只清 hold 并释放绑定；
+                    // 快照 hold/task 世代供释放路径 CAS，且不得借用 cancel-cleanup 的绕行凭据
+                    if (boundTask.status !== 'review') {
+                        return {
+                            resumed: true,
+                            releasedBinding: false,
+                            releaseHeldQa: {
+                                taskId: state.taskId,
+                                expectedHold: {
+                                    phase: state.awaitingPhase,
+                                    since: state.awaitingSince,
+                                    nonce: state.awaitingNonce,
+                                },
+                                expectedTask: {
+                                    status: boundTask.status,
+                                    phase: boundTask.phase,
+                                    signalToken: boundTask.signalToken,
+                                },
+                            },
+                            projectId: state.projectId,
+                            previousPhase: state.awaitingPhase,
+                        };
+                    }
+                    const nowQa = new Date().toISOString();
+                    let clearedHold = false;
+                    await this.agentStore.update(agentId, (existing) => {
+                        if (!existing || existing.taskId !== state.taskId)
+                            return AGENT_STORE_NOOP;
+                        if (existing.awaitingPhase !== state.awaitingPhase
+                            || existing.awaitingSince !== state.awaitingSince
+                            || existing.awaitingNonce !== state.awaitingNonce) {
+                            return AGENT_STORE_NOOP;
+                        }
+                        clearedHold = true;
+                        return {
+                            ...existing,
+                            status: 'ok',
+                            awaitingPhase: undefined,
+                            awaitingReason: undefined,
+                            awaitingSince: undefined,
+                            awaitingNonce: undefined,
+                            updatedAt: nowQa,
+                        };
+                    });
+                    if (!clearedHold) {
+                        const reason = `Agent ${agentId} hold changed while resuming; re-check the agent state and Resume again.`;
+                        console.warn(`[AgentManager] resumeAgent: ${reason}`);
+                        return { resumed: false, releasedBinding: false, reason };
+                    }
+                    return {
+                        resumed: true,
+                        releasedBinding: false,
+                        redispatchReviewTaskId: state.taskId,
+                        reviewPassToken: boundTask.signalToken,
+                        heldLockToken: state.lockToken,
+                        projectId: state.projectId,
+                        previousPhase: state.awaitingPhase,
+                    };
+                }
                 const reason = `Task ${state.taskId} was not dispatched because its checkout could not be prepared. ` +
                     'Fix the Workdir, then cancel and redispatch the task; Resume cannot reconstruct the original dispatch safely.';
                 console.warn(`[AgentManager] resumeAgent: agent ${agentId} ${state.awaitingPhase} — ${reason}`);
@@ -1959,7 +2313,7 @@ export class AgentManager {
         if (result.redispatchCodeTaskId) {
             try {
                 const task = await this.taskStore.get(result.redispatchCodeTaskId);
-                const round = task?.specReviewRound;
+                const round = task ? (task.specReviewRound ?? 1) : undefined;
                 const stored = round === undefined
                     ? null
                     : await this.reviewStore?.getRound(result.redispatchCodeTaskId, 'spec', round);
@@ -1973,6 +2327,12 @@ export class AgentManager {
                     await this.markAwaitingHuman(agentId, 'code-dispatch-failed', reason, { expectedTaskId: result.redispatchCodeTaskId }).catch(() => undefined);
                     return { resumed: false, releasedBinding: false, reason };
                 }
+                // 重派与首派同样不经 startSession 的 post-ack finalize：残留的 bootstrap 标记
+                // 会让下一次 recover 把已送达的 code prompt 再判成未送达
+                if (!this.isResearchHandoff(task, agentId)) {
+                    const lockToken = (await this.agentStore.get(agentId))?.lockToken;
+                    await this.finalizeReplayedBootstrap(agentId, result.redispatchCodeTaskId, 'code', lockToken);
+                }
             }
             catch (err) {
                 console.error(`[AgentManager] resumeAgent code redispatch failed for ${agentId}:`, err);
@@ -1981,6 +2341,126 @@ export class AgentManager {
                 return { resumed: false, releasedBinding: false, reason };
             }
         }
+        if (result.releaseHeldQa) {
+            const { taskId: heldTaskId, expectedHold, expectedTask } = result.releaseHeldQa;
+            const released = await this.releaseAgentForTask(agentId, heldTaskId, 'idle', {
+                allowAwaitingHuman: true,
+                expectedHold,
+                expectedTask,
+            });
+            if (!released) {
+                const refreshed = await this.agentStore.get(agentId).catch((readErr) => {
+                    console.warn(`[AgentManager] resumeAgent post-release read failed for ${agentId}:`, readErr);
+                    return null;
+                });
+                return {
+                    resumed: false,
+                    releasedBinding: false,
+                    reason: refreshed?.awaitingReason
+                        ?? `Agent ${agentId} could not safely release task ${heldTaskId}; its pass or hold moved on — re-check the agent state and Resume again.`,
+                };
+            }
+            await this.emitIntervention(result.projectId, agentId, heldTaskId, {
+                phase: 'resumed',
+                previousPhase: result.previousPhase,
+                releasedBinding: true,
+            });
+            return { resumed: true, releasedBinding: true };
+        }
+        if (result.redispatchReviewTaskId) {
+            try {
+                await this.dispatchReviewToQa(result.redispatchReviewTaskId, {
+                    bumpRound: false,
+                    fromStatus: ['review'],
+                    ...(result.reviewPassToken !== undefined ? { expectSignalToken: result.reviewPassToken } : {}),
+                });
+            }
+            catch (err) {
+                console.error(`[AgentManager] resumeAgent review redispatch failed for ${agentId}:`, err);
+                const reason = `QA review redispatch on Resume failed: ${err instanceof Error ? err.message : String(err)}`;
+                const reviewTaskId = result.redispatchReviewTaskId;
+                // 锁代未变（未被 successor re-acquire）才允许补挂；markAwaitingHuman 内的 CAS 原子复核同一条件
+                const restoreHoldIfStillOurs = async (phase, holdReason) => {
+                    const after = await this.agentStore.get(agentId);
+                    if (after?.taskId === reviewTaskId
+                        && after.status !== 'awaiting_human'
+                        && after.lockToken === result.heldLockToken) {
+                        await this.markAwaitingHuman(agentId, phase, holdReason, {
+                            expectedTaskId: reviewTaskId,
+                            ...(result.heldLockToken !== undefined ? { expectedLockToken: result.heldLockToken } : {}),
+                        });
+                    }
+                };
+                // handled 只代表 startSession 已尝试落 hold；落库可能已失败，必须核实并按需补挂
+                if (err instanceof EnsureSessionError && err.partial.handled) {
+                    try {
+                        await restoreHoldIfStillOurs(result.previousPhase ?? 'checkout-preparation-failed', reason);
+                        return { resumed: false, releasedBinding: false, reason };
+                    }
+                    catch (holdErr) {
+                        const holdMsg = holdErr instanceof Error ? holdErr.message : String(holdErr);
+                        console.error(`[AgentManager] resumeAgent could not verify/restore the handled hold for ${agentId}:`, holdErr);
+                        return {
+                            resumed: false,
+                            releasedBinding: false,
+                            reason: `${reason}; verifying/restoring the hold also failed: ${holdMsg} — the agent may be missing its awaiting_human flag, inspect it manually`,
+                        };
+                    }
+                }
+                // ack_unknown：prompt 可能已在跑，必须恢复 ack hold 的可见性，而非按普通失败补挂 checkout hold
+                if (err instanceof DispatchTerminalError && err.reason === 'ack_unknown') {
+                    try {
+                        await restoreHoldIfStillOurs('dispatch-failed:ack_unknown', `${err.message}. Prompt may still be running in the pane; verify before resuming.`);
+                        return { resumed: false, releasedBinding: false, reason };
+                    }
+                    catch (holdErr) {
+                        const holdMsg = holdErr instanceof Error ? holdErr.message : String(holdErr);
+                        console.error(`[AgentManager] resumeAgent could not restore the ack_unknown hold for ${agentId}:`, holdErr);
+                        return {
+                            resumed: false,
+                            releasedBinding: false,
+                            reason: `${reason}; restoring the dispatch-failed:ack_unknown hold also failed: ${holdMsg} — prompt state is unknown and the agent is NOT flagged awaiting_human, inspect it manually`,
+                        };
+                    }
+                }
+                // pass 被接管（token 轮换或任务离开 review）说明该 pass 已死，补挂会把新 pass 的 QA 打成 hold
+                let passSuperseded = false;
+                let recoveryReadFailed = false;
+                try {
+                    const taskNow = await this.taskStore.get(reviewTaskId);
+                    passSuperseded = taskNow?.status !== 'review'
+                        || (result.reviewPassToken !== undefined && taskNow.signalToken !== result.reviewPassToken);
+                }
+                catch (readErr) {
+                    recoveryReadFailed = true;
+                    console.error(`[AgentManager] resumeAgent recovery task read failed for ${agentId}:`, readErr);
+                }
+                if (passSuperseded)
+                    return { resumed: false, releasedBinding: false, reason };
+                try {
+                    if (recoveryReadFailed) {
+                        // 读失败时无法证明接管，优先恢复可见性：锁代/绑定 CAS 全部由 markAwaitingHuman 原子判定
+                        await this.markAwaitingHuman(agentId, result.previousPhase ?? 'checkout-preparation-failed', reason, {
+                            expectedTaskId: reviewTaskId,
+                            ...(result.heldLockToken !== undefined ? { expectedLockToken: result.heldLockToken } : {}),
+                        });
+                    }
+                    else {
+                        await restoreHoldIfStillOurs(result.previousPhase ?? 'checkout-preparation-failed', reason);
+                    }
+                    return { resumed: false, releasedBinding: false, reason };
+                }
+                catch (holdErr) {
+                    const holdMsg = holdErr instanceof Error ? holdErr.message : String(holdErr);
+                    console.error(`[AgentManager] resumeAgent could not restore the QA hold for ${agentId}:`, holdErr);
+                    return {
+                        resumed: false,
+                        releasedBinding: false,
+                        reason: `${reason}; restoring the hold also failed: ${holdMsg} — the agent is NOT flagged awaiting_human, inspect it manually`,
+                    };
+                }
+            }
+        }
         return {
             resumed: result.resumed,
             releasedBinding: result.releasedBinding,
@@ -2284,15 +2764,14 @@ export class AgentManager {
             throw new Error(`Unknown agent: ${agentId}`);
         const runner = this.createRunnerFor(cfg);
         const tmux = new TmuxManager(runner);
-        const alive = await tmux.hasSession(agentId);
-        if (!alive) {
+        const snapshot = await tmux.getSessionSnapshot(agentId);
+        if (!snapshot) {
             throw new Error(`restart-repl: tmux session ${agentId} does not exist; use retry to rebuild`);
         }
-        const claim = await tmux.getOption(agentId, '@baxian-agent-id');
-        if (claim !== agentId) {
-            throw new Error(`restart-repl: session claim mismatch (got "${claim ?? 'null'}"); refusing to touch foreign session`);
+        if (snapshot.claim !== agentId) {
+            throw new Error(`restart-repl: session claim mismatch (got "${snapshot.claim ?? 'null'}"); refusing to touch foreign session`);
         }
-        const paneId = await tmux.getSinglePaneId(agentId);
+        const paneId = await tmux.getSinglePaneIdByRef(snapshot.ref);
         await tmux.sendKeysToPane(paneId, 'C-c');
         const cmd = await this.pollPaneCommandStable(tmux, paneId, { timeoutMs: 2_000 });
         const RUNTIME = /^(?:claude|codex|node|opencode|qodercli(?:-[\d.]+)?|\d+\.\d+\.\d+)$/;
@@ -2314,10 +2793,10 @@ export class AgentManager {
                 'use retry to rebuild the session safely');
         }
         await this.provisionRepoSkills(runner, cfg, workdir);
-        await tmux.setOption(agentId, WORKDIR_SESSION_OPTION, workdir);
+        await this.setSessionOptions(tmux, agentId, snapshot.ref, [[WORKDIR_SESSION_OPTION, workdir]]);
         const runtime = agentRuntimeKindFor(cfg);
         const relaunch = async () => {
-            await tmux.sendKeysToPane(paneId, `${buildLaunchCommand(cfg)}\n`);
+            await tmux.sendKeysToPane(paneId, `${launchCommandIn(workdir, cfg)}\n`);
             await tmux.handleTrustDialog(paneId, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
@@ -2325,7 +2804,7 @@ export class AgentManager {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
-            await this.tagSessionSkillsVersion(tmux, agentId);
+            await this.tagSessionSkillsVersion(tmux, agentId, snapshot.ref);
         };
         await this.runUnderSkillDirLock(this.skillDirLockKey(cfg, workdir), relaunch);
         await this.agentStore.update(agentId, (state) => {
@@ -2338,41 +2817,339 @@ export class AgentManager {
             };
         });
     }
-    async redispatchResearchAfterReplRestart(agentId, taskId) {
+    // Holds only the pass captured in the task tuple: a successor pass (rotated token/phase/status) is never overwritten.
+    async holdReplayFailureIfCurrent(agentId, taskAtEntry, holdPhase, reason, entryHold) {
+        return this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskAtEntry.id);
+            if (fresh?.agentId !== agentId
+                || fresh.status !== taskAtEntry.status
+                || fresh.phase !== taskAtEntry.phase
+                || fresh.signalToken !== taskAtEntry.signalToken)
+                return false;
+            if (await this.markAwaitingHuman(agentId, holdPhase, reason, {
+                expectedTaskId: taskAtEntry.id,
+                expectedHold: entryHold,
+            }))
+                return true;
+            // Entry hold gone (Resume raced): write over the empty generation, never over a foreign hold.
+            if (await this.markAwaitingHuman(agentId, holdPhase, reason, {
+                expectedTaskId: taskAtEntry.id,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+            }))
+                return true;
+            const now = await this.agentStore.get(agentId);
+            return now?.status === 'awaiting_human';
+        });
+    }
+    async redispatchTaskPromptAfterReplRestart(agentId, taskId) {
         const agent = this.getAgentConfig(agentId);
         const task = await this.taskStore.get(taskId);
-        if (!agent || agent.role !== 'research' || !task)
+        if (!agent || !task || !TASK_OWNER_ROLES.has(agent.role))
+            return false;
+        if (task.agentId !== agentId)
             return false;
-        if (task.researchAgentId !== agentId || task.agentId !== agentId || !task.signalToken)
+        const participantId = agent.role === 'research' ? task.researchAgentId : task.devAgentId;
+        if (participantId !== agentId)
             return false;
-        let phase;
-        let expectedKind;
-        let findings;
-        if (task.phase === 'research' && task.status === 'in_progress') {
-            phase = 'research';
-            expectedKind = 'spec-done';
-        }
-        else if (task.phase === 'spec' && task.status === 'fixing') {
-            const round = task.specReviewRound ?? 1;
-            const stored = await this.reviewStore?.getRound(taskId, 'spec', round);
-            if (!stored?.findings)
+        const bindingAtEntry = await this.agentStore.get(agentId);
+        const entryHold = {
+            phase: bindingAtEntry?.status === 'awaiting_human' ? bindingAtEntry.awaitingPhase : undefined,
+            since: bindingAtEntry?.status === 'awaiting_human' ? bindingAtEntry.awaitingSince : undefined,
+            nonce: bindingAtEntry?.status === 'awaiting_human' ? bindingAtEntry.awaitingNonce : undefined,
+        };
+        // Concurrent passes can advance the task mid-replay; every replay gate re-checks this snapshot.
+        const taskStillCurrent = async () => {
+            const fresh = await this.taskStore.get(taskId);
+            return fresh?.agentId === agentId
+                && fresh.status === task.status
+                && fresh.phase === task.phase
+                && fresh.signalToken === task.signalToken;
+        };
+        // Hold ops share one task-mutation slot with a tuple re-check, and CAS on the entry hold generation.
+        const clearEntryHold = async () => this.withTaskLock(async () => {
+            if (!(await taskStillCurrent()))
                 return false;
-            phase = 'server-feedback';
-            expectedKind = 'spec-fixed';
-            findings = JSON.stringify(stored.findings);
+            if (entryHold.phase === undefined) {
+                const now = await this.agentStore.get(agentId);
+                return now?.status !== 'awaiting_human';
+            }
+            return this.clearAwaitingHuman(agentId, { expectedHold: entryHold });
+        });
+        const holdReplayFailure = (phase, reason) => this.holdReplayFailureIfCurrent(agentId, task, phase, reason, entryHold);
+        // skipSnapshot: stale scrollback literals belong to the aborted runtime; onlyReplaceOwnToken keeps a successor's watcher out of reach.
+        const fencedReplay = (expectedKinds, token, stillCurrent) => {
+            const abortStaleReplay = async () => {
+                if (await stillCurrent())
+                    return true;
+                this.phaseSignalWatcher?.stopIfToken(taskId, token);
+                return false;
+            };
+            return {
+                armBeforeInject: async () => {
+                    if (!(await stillCurrent()))
+                        return false;
+                    const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, {
+                        skipSnapshot: true,
+                        onlyReplaceOwnToken: true,
+                    });
+                    if (!armed) {
+                        if (!(await stillCurrent()))
+                            return false;
+                        // Own-generation arm failure: throwing routes the caller into the resumable hold.
+                        throw new Error(`replay signal watcher failed to arm for task ${taskId}; Restart REPL again or cancel the task`);
+                    }
+                    return abortStaleReplay();
+                },
+                guardBeforeInject: abortStaleReplay,
+            };
+        };
+        try {
+            if (task.status === 'approved' && agent.role === 'dev') {
+                return await this.replayApprovedHolderAfterReplRestart(agentId, task, taskStillCurrent, fencedReplay, { clearEntryHold, holdReplayFailure });
+            }
+            const mapped = this.mapTaskStateToExpectedWatcher(task);
+            if (!mapped || mapped.agentId !== agentId)
+                return false;
+            if (!task.signalToken) {
+                return await holdReplayFailure('restart-redispatch-failed', 'REPL restarted mid-pass but the task has no signal token to replay the prompt with; cancel the task or re-dispatch it.');
+            }
+            const signalToken = task.signalToken;
+            const replayOpts = {
+                signalToken,
+                preserveDispatchOutputs: true,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+                ...fencedReplay(mapped.expectedKinds, signalToken, taskStillCurrent),
+            };
+            const replayInitialBootstrap = async (phase, opts) => {
+                // This hold means the prompt WAS delivered and only the marker clear failed; replaying would run it twice.
+                if (entryHold.phase === 'bootstrap-marker-clear-failed') {
+                    return holdReplayFailure('restart-redispatch-failed', 'REPL restarted while the initial prompt was already delivered (its bootstrap marker clear had failed); replaying would dispatch the task twice. Resume and verify the Workdir, or cancel the task.');
+                }
+                const bindingBefore = await this.agentStore.get(agentId);
+                if (!(await clearEntryHold()))
+                    return false;
+                const resumed = await this.continueSession(taskId, agentId, phase, opts);
+                if (resumed && bindingBefore?.bootstrappingTaskId === taskId) {
+                    await this.finalizeReplayedBootstrap(agentId, taskId, phase, bindingBefore.lockToken);
+                }
+                return resumed;
+            };
+            if (task.status === 'in_progress' && task.phase === 'research' && agent.role === 'research') {
+                return await replayInitialBootstrap('research', replayOpts);
+            }
+            if (task.status === 'in_progress' && task.phase === undefined && agent.role === 'dev') {
+                // An undelivered bootstrap never started work, so the fresh-dispatch clean gate still applies.
+                const delivered = (await this.agentStore.get(agentId))?.bootstrappingTaskId !== taskId;
+                return await replayInitialBootstrap('develop', {
+                    ...replayOpts,
+                    ...(delivered ? { allowDirtyWorkdir: true } : {}),
+                });
+            }
+            if (task.status === 'in_progress' && task.phase === 'code' && agent.role === 'dev') {
+                const state = await this.agentStore.get(agentId);
+                // A no-QA auto-approved spec never writes specReviewRound back; the code dispatch defaults to round 1.
+                const round = task.specReviewRound ?? 1;
+                const stored = await this.reviewStore?.getRound(taskId, 'spec', round);
+                if (state?.bootstrappingTaskId === taskId || !stored || stored.phase !== 'spec') {
+                    return await holdReplayFailure('code-dispatch-failed', 'REPL restarted but the code-phase prompt cannot be resumed in place. Resume to replay the persisted Spec documents, or cancel the task.');
+                }
+                if (!(await clearEntryHold()))
+                    return false;
+                return await this.continueSession(taskId, agentId, 'code', {
+                    ...replayOpts,
+                    allowDirtyWorkdir: true,
+                    specDocuments: stored.documents,
+                    ...(task.specReviewRound !== undefined ? { currentSpecRound: task.specReviewRound } : {}),
+                });
+            }
+            if (task.status === 'fixing' && task.phase === 'spec') {
+                const round = task.specReviewRound ?? 1;
+                const stored = await this.reviewStore?.getRound(taskId, 'spec', round);
+                if (!stored?.findings) {
+                    return await holdReplayFailure('restart-redispatch-failed', `REPL restarted during the spec fixing round but round ${round} findings are not persisted; the feedback prompt cannot be replayed. Cancel the task or re-run the spec review.`);
+                }
+                if (!(await clearEntryHold()))
+                    return false;
+                return await this.continueSession(taskId, agentId, 'server-feedback', {
+                    ...replayOpts,
+                    ...(agent.role === 'dev' ? { allowDirtyWorkdir: true } : {}),
+                    serverPriorFindings: JSON.stringify(stored.findings),
+                    ...(task.specReviewRound !== undefined ? { currentSpecRound: task.specReviewRound } : {}),
+                });
+            }
+            // A direct (no-SDD) pass never persists a phase, so fixing + undefined is the plain code-feedback round.
+            if (task.status === 'fixing'
+                && (task.phase === 'code' || task.phase === undefined)
+                && agent.role === 'dev') {
+                if (task.reviewMode === 'server') {
+                    const round = Math.max(task.reviewRound, 1);
+                    const stored = await this.reviewStore?.getRound(taskId, 'code', round);
+                    if (!stored?.findings) {
+                        return await holdReplayFailure('restart-redispatch-failed', `REPL restarted during the code fixing round but round ${round} findings are not persisted; the feedback prompt cannot be replayed. Cancel the task or re-run the code review.`);
+                    }
+                    if (!(await clearEntryHold()))
+                        return false;
+                    return await this.continueSession(taskId, agentId, 'server-feedback', {
+                        ...replayOpts,
+                        allowDirtyWorkdir: true,
+                        serverPriorFindings: JSON.stringify(stored.findings),
+                    });
+                }
+                if (!(await clearEntryHold()))
+                    return false;
+                return await this.continueSession(taskId, agentId, 'fix', {
+                    ...replayOpts,
+                    allowDirtyWorkdir: true,
+                });
+            }
+            return false;
+        }
+        catch (err) {
+            // A post-entry throw may land after clearEntryHold; only a tuple-checked hold on the live generation is safe.
+            const message = err instanceof Error ? err.message : String(err);
+            if (await holdReplayFailure('restart-redispatch-failed', `REPL restarted but replaying the task prompt failed: ${message}. Resume to retry, or cancel the task.`)) {
+                return true;
+            }
+            throw err;
+        }
+    }
+    // approved hosts two live holder passes — GitHub post-approve (PostApproveStore) and server after-done (task fields); a parked pre-publish holder stays on the waiting path.
+    async replayApprovedHolderAfterReplRestart(agentId, task, taskStillCurrent, fencedReplay, holdGen) {
+        const taskId = task.id;
+        const { clearEntryHold, holdReplayFailure } = holdGen;
+        if (task.reviewMode === 'server') {
+            if (!task.publishDispatchedAt)
+                return false;
+            if (!task.signalToken) {
+                return holdReplayFailure('restart-redispatch-failed', 'REPL restarted mid-publish but the rotated publish token is missing; the publish prompt cannot be replayed. Cancel the task or mark-complete to re-dispatch the publish.');
+            }
+            const token = task.signalToken;
+            const afterDone = this.resolveAfterDone(task);
+            if (!afterDone) {
+                return holdReplayFailure('restart-redispatch-failed', 'REPL restarted mid-publish but the after-done target cannot be resolved anymore. Resume then mark-complete to retry the publish, or cancel the task.');
+            }
+            let violation;
+            try {
+                violation = await this.findLineageViolation(taskId);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                return holdReplayFailure('restart-redispatch-failed', `REPL restarted mid-publish but the branch lineage re-check failed: ${message}. Resume then Restart REPL to retry, or cancel the task.`);
+            }
+            if (violation) {
+                return holdReplayFailure('restart-redispatch-failed', `The task branch embeds another active task's commits (${violation.branch}); rebase onto origin/HEAD, then mark-complete to retry the publish.`);
+            }
+            if (!(await clearEntryHold()))
+                return false;
+            return this.continueSession(taskId, agentId, 'server-after-done', {
+                signalToken: token,
+                preserveDispatchOutputs: true,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+                allowDirtyWorkdir: true,
+                serverAfterDone: { kind: afterDone, branch: task.branch ?? BRANCH_PREFIX + taskId },
+                ...fencedReplay(['code-ready'], token, taskStillCurrent),
+            });
+        }
+        if (task.postApproveRevoked) {
+            return holdReplayFailure('restart-redispatch-failed', `The post-approve completion was deliberately revoked (${task.postApproveRevoked.reason}); ` +
+                'the block stays effective, so the pass is not replayed. Re-request changes to restart the review round, or cancel the task.');
+        }
+        const stored = await this.getPostApproveCompletion(taskId);
+        let completion;
+        if (stored) {
+            if (!task.postApproveHeadSha) {
+                return holdReplayFailure('restart-redispatch-failed', 'REPL restarted during the post-approve pass but the stored completion cannot be tied to a persisted approved head; re-request the review verdict or cancel the task.');
+            }
+            if (stored.approvedHeadSha !== task.postApproveHeadSha) {
+                // Provably a dead episode's residue: retire it by token, then rebuild for the current head.
+                await this.clearPostApproveCompletionIfMatches(taskId, stored.token);
+                completion = await this.rebuildPostApproveCompletion(agentId, task, holdReplayFailure);
+            }
+            else {
+                completion = { token: stored.token, rebuilt: false };
+            }
         }
         else {
+            completion = await this.rebuildPostApproveCompletion(agentId, task, holdReplayFailure);
+        }
+        if (completion === 'held')
+            return true;
+        if (completion === 'stale')
+            return false;
+        const resolvedCompletion = completion;
+        const completionStillCurrent = async () => {
+            const fresh = await this.taskStore.get(taskId);
+            return fresh?.agentId === agentId
+                && fresh.status === task.status
+                && fresh.phase === task.phase
+                && fresh.signalToken === task.signalToken
+                && fresh.postApproveRevoked === undefined
+                && fresh.postApproveHeadSha === task.postApproveHeadSha
+                && (await this.getPostApproveCompletion(taskId))?.token === resolvedCompletion.token;
+        };
+        if (!(await completionStillCurrent()))
+            return false;
+        if (!(await clearEntryHold()))
             return false;
+        let resumed = false;
+        try {
+            resumed = await this.continueSession(taskId, agentId, 'post-approve', {
+                signalToken: completion.token,
+                preserveDispatchOutputs: true,
+                expectedHold: { phase: undefined, since: undefined, nonce: undefined },
+                allowDirtyWorkdir: true,
+                ...fencedReplay(['pr-merge-ready'], completion.token, completionStillCurrent),
+            });
         }
-        await this.clearAwaitingHuman(agentId);
-        return this.continueSession(taskId, agentId, phase, {
-            bypassTaskStatusGate: true,
-            signalToken: task.signalToken,
-            preserveDispatchOutputs: true,
-            ...(findings ? { serverPriorFindings: findings } : {}),
-            ...(task.specReviewRound !== undefined ? { currentSpecRound: task.specReviewRound } : {}),
-            armBeforeInject: () => this.setupPhaseSignalWatcher(taskId, agentId, expectedKind, task.signalToken),
+        catch (err) {
+            if (completion.rebuilt)
+                await this.clearPostApproveCompletionIfMatches(taskId, completion.token);
+            throw err;
+        }
+        if (!resumed && completion.rebuilt) {
+            await this.clearPostApproveCompletionIfMatches(taskId, completion.token);
+            const fresh = await this.taskStore.get(taskId);
+            const episodeIntact = fresh?.agentId === agentId
+                && fresh.status === task.status
+                && fresh.phase === task.phase
+                && fresh.signalToken === task.signalToken
+                && fresh.postApproveRevoked === undefined
+                && fresh.postApproveHeadSha === task.postApproveHeadSha;
+            if (!episodeIntact)
+                return false;
+            return holdReplayFailure('restart-redispatch-failed', 'REPL restarted during the post-approve pass and the rebuilt prompt could not be delivered; Resume then Restart REPL to retry, or cancel the task.');
+        }
+        return resumed;
+    }
+    // A bare hold would loop (Resume clears it, the next restart misses the record again), so rebuild from the persisted approved head.
+    async rebuildPostApproveCompletion(agentId, task, holdReplayFailure) {
+        // latestHeadSha drifts with pushes/mismatch probes; only the head persisted at dispatch is provably approved.
+        const approvedHeadSha = task.postApproveHeadSha;
+        if (!approvedHeadSha) {
+            const held = await holdReplayFailure('restart-redispatch-failed', 'REPL restarted during the post-approve pass but neither its completion context nor a provably approved head are persisted; cancel the task or re-request the review verdict.');
+            return held ? 'held' : 'stale';
+        }
+        const token = createSignalToken();
+        // Conditional create: the in-lock re-read rejects any revoke/dispatch landed since the snapshot.
+        const created = await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(task.id);
+            if (!fresh
+                || fresh.agentId !== agentId
+                || fresh.status !== 'approved'
+                || fresh.phase !== task.phase
+                || fresh.signalToken !== task.signalToken
+                || fresh.postApproveRevoked !== undefined
+                || fresh.postApproveHeadSha !== approvedHeadSha) {
+                return false;
+            }
+            if (await this.postApproveStore.get(task.id))
+                return false;
+            await this.postApproveStore.set(task.id, { token, approvedHeadSha });
+            return true;
         });
+        if (!created)
+            return 'stale';
+        return { token, rebuilt: true };
     }
     prepareRemoveTargets(agentId) {
         const cfg = this.getAgentConfig(agentId);
@@ -2419,17 +3196,23 @@ export class AgentManager {
                 }
             }
             try {
-                const alive = await tmux.hasSession(id);
-                if (alive) {
-                    const claim = await tmux.getOption(id, '@baxian-agent-id');
-                    if (claim === id) {
-                        await tmux.killSession(id);
-                    }
-                    else {
+                await this.runUnderSessionLifecycle(id, async () => {
+                    const snapshot = await tmux.getSessionSnapshot(id);
+                    if (!snapshot)
+                        return;
+                    if (snapshot.claim !== id) {
                         console.warn(`[AgentManager] cleanupRemovedAgentRuntime: skipping kill for ${id} ` +
-                            `(claim=${claim ?? 'null'}; not baxian-managed)`);
+                            `(claim=${snapshot.claim ?? 'null'}; not baxian-managed)`);
+                        return;
                     }
-                }
+                    const outcome = await tmux.killSessionRef(snapshot.ref);
+                    if (outcome === 'stale-server') {
+                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: tmux server generation changed for ${id} — leaving session untouched`);
+                    }
+                    else if (outcome === 'killed') {
+                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: killed session ${snapshot.ref.sessionId} for removed agent ${id}`);
+                    }
+                });
             }
             catch (err) {
                 failures.push({ agentId: id, step: 'tmux', error: err });
@@ -2546,14 +3329,27 @@ export class AgentManager {
     async getPostApproveCompletion(taskId) {
         return this.postApproveStore.get(taskId);
     }
-    async setPostApproveCompletion(taskId, value) {
-        await this.withTaskLock(async () => {
-            await this.postApproveStore.set(taskId, value);
-            if (!this.phaseSignalWatcher)
-                return;
+    // Install CASes on the current approved episode; only a fresh human verdict (clearRevocation) unlocks a standing marker.
+    async setPostApproveCompletion(taskId, value, opts = {}) {
+        return this.withTaskLock(async () => {
             const task = await this.taskStore.get(taskId);
+            if (task) {
+                if (task.status !== 'approved')
+                    return false;
+                if (task.postApproveRevoked && !opts.clearRevocation)
+                    return false;
+                if (task.postApproveHeadSha !== undefined && task.postApproveHeadSha !== value.approvedHeadSha)
+                    return false;
+            }
+            await this.postApproveStore.set(taskId, value);
             if (!task)
-                return;
+                return true;
+            if (task.postApproveRevoked) {
+                const { postApproveRevoked: _revoked, ...rest } = task;
+                await this.taskStore.set({ ...rest, updatedAt: new Date().toISOString() });
+            }
+            if (!this.phaseSignalWatcher)
+                return true;
             await this.startPhaseSignalWatch({
                 taskId,
                 projectId: task.projectId,
@@ -2561,6 +3357,7 @@ export class AgentManager {
                 expectedKinds: 'pr-merge-ready',
                 token: value.token,
             });
+            return true;
         });
     }
     async clearPostApproveCompletion(taskId) {
@@ -2569,6 +3366,46 @@ export class AgentManager {
             this.phaseSignalWatcher?.stop(taskId);
         });
     }
+    // CAS for an existing pass: never creates a record nor touches the marker, so it cannot resurrect a revoked completion.
+    async updatePostApproveCompletionIfToken(taskId, expectedToken, patch) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (task?.postApproveRevoked)
+                return false;
+            const current = await this.postApproveStore.get(taskId);
+            if (!current || current.token !== expectedToken)
+                return false;
+            await this.postApproveStore.set(taskId, { ...current, ...patch });
+            return true;
+        });
+    }
+    // Deliberate clear: the persisted marker keeps a restart replay from rebuilding the completion and bypassing the block.
+    async revokePostApproveCompletion(taskId, reason, opts = {}) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.status !== 'approved')
+                return false;
+            // Head binds the revoke to one approved episode; an unpersisted head cannot disprove it, so blocking stays fail closed.
+            if (opts.expectedHeadSha !== undefined
+                && task.postApproveHeadSha !== undefined
+                && task.postApproveHeadSha !== opts.expectedHeadSha)
+                return false;
+            if (opts.expectedToken !== undefined) {
+                const current = await this.postApproveStore.get(taskId);
+                if (current?.token !== opts.expectedToken)
+                    return false;
+            }
+            // Marker lands first: a crash before the clear leaves marker+completion, which every consumer fences on.
+            await this.taskStore.set({
+                ...task,
+                postApproveRevoked: { reason, at: new Date().toISOString() },
+                updatedAt: new Date().toISOString(),
+            });
+            await this.postApproveStore.clear(taskId);
+            this.phaseSignalWatcher?.stop(taskId);
+            return true;
+        });
+    }
     async clearPostApproveCompletionIfMatches(taskId, token) {
         return this.withTaskLock(async () => {
             const cleared = await this.postApproveStore.clearIfMatches(taskId, token);
@@ -2577,14 +3414,67 @@ export class AgentManager {
             return cleared;
         });
     }
+    // Marker/token/head/pending are re-checked inside the committing critical section, so a concurrent revoke never loses.
+    async completeApprovedPassToMergeReady(taskId, expectedToken) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.status !== 'approved' || task.postApproveRevoked) {
+                return { refused: 'stale' };
+            }
+            const completion = await this.postApproveStore.get(taskId);
+            if (!completion
+                || completion.token !== expectedToken
+                || task.postApproveHeadSha === undefined
+                || completion.approvedHeadSha !== task.postApproveHeadSha) {
+                return { refused: 'stale' };
+            }
+            if (completion.pendingRedispatch)
+                return { refused: 'pending' };
+            delete task.postApproveHeadSha;
+            Object.assign(task, {
+                status: 'merge-ready',
+                latestHeadSha: completion.approvedHeadSha,
+                updatedAt: new Date().toISOString(),
+            });
+            await this.taskStore.set(task);
+            await this.postApproveStore.clear(taskId);
+            this.phaseSignalWatcher?.stop(taskId);
+            return { task };
+        });
+    }
     async setupRecoveredPostApproveSignals() {
-        if (!this.phaseSignalWatcher)
-            return;
         const tasks = await this.taskStore.list({ status: 'approved' });
         for (const task of tasks) {
+            if (task.postApproveRevoked) {
+                // Finish an interrupted revoke: the marker is authoritative, the leftover record must not re-arm.
+                try {
+                    await this.postApproveStore.clear(task.id);
+                }
+                catch (err) {
+                    console.warn(`[AgentManager] setupRecoveredPostApproveSignals: revoked completion cleanup failed for task=${task.id}:`, err);
+                }
+                continue;
+            }
             const completion = await this.postApproveStore.get(task.id);
             if (!completion)
                 continue;
+            if (task.postApproveHeadSha === undefined) {
+                // A completion the task head cannot vouch for is another episode's residue until proven otherwise.
+                console.warn(`[AgentManager] setupRecoveredPostApproveSignals: task=${task.id} has a stored completion but no persisted approved head; not re-arming`);
+                continue;
+            }
+            if (completion.approvedHeadSha !== task.postApproveHeadSha) {
+                try {
+                    await this.postApproveStore.clear(task.id);
+                    console.warn(`[AgentManager] setupRecoveredPostApproveSignals: task=${task.id} retired a completion bound to head ${completion.approvedHeadSha} (persisted approved head ${task.postApproveHeadSha})`);
+                }
+                catch (err) {
+                    console.warn(`[AgentManager] setupRecoveredPostApproveSignals: stale completion cleanup failed for task=${task.id}:`, err);
+                }
+                continue;
+            }
+            if (!this.phaseSignalWatcher)
+                continue;
             try {
                 await this.startPhaseSignalWatch({
                     taskId: task.id,
@@ -2761,6 +3651,20 @@ export class AgentManager {
         task.updatedAt = new Date().toISOString();
         await this.taskStore.set(task);
     }
+    async updateTaskIfStatus(taskId, expectedStatus, updates, alsoExpect = {}) {
+        return this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || task.status !== expectedStatus)
+                return false;
+            if ('signalToken' in alsoExpect && task.signalToken !== alsoExpect.signalToken)
+                return false;
+            if ('reviewRound' in alsoExpect && task.reviewRound !== alsoExpect.reviewRound)
+                return false;
+            Object.assign(task, updates, { updatedAt: new Date().toISOString() });
+            await this.taskStore.set(task);
+            return true;
+        });
+    }
     async updateTask(taskId, updates) {
         await this.withTaskLock(async () => {
             const task = await this.taskStore.get(taskId);
@@ -2780,11 +3684,18 @@ export class AgentManager {
                 return null;
             if (!guard.fromStatus.includes(previousStatus))
                 return null;
+            if (guard.expectSignalToken !== undefined && task.signalToken !== guard.expectSignalToken)
+                return null;
             if (patch?.branch && patch.branch !== task.branch) {
                 const existing = await this.findTaskByBranch(patch.branch, task.projectId);
                 if (existing && existing.id !== taskId)
                     return null;
             }
+            // The revocation marker and approved head scope to the approved episode they were created in.
+            if (previousStatus === 'approved' && toStatus !== 'approved') {
+                delete task.postApproveRevoked;
+                delete task.postApproveHeadSha;
+            }
             Object.assign(task, patch ?? {}, {
                 status: toStatus,
                 updatedAt: new Date().toISOString(),
@@ -3543,18 +4454,12 @@ export class AgentManager {
                 const stillOwner = stateNow?.taskId === taskId
                     && stateNow.lockToken === lockToken
                     && await this.lockManager.isOwner(agentId, taskId, lockToken);
-                try {
-                    if (stillOwner) {
-                        const runner = this.createRunnerFor(agent);
-                        await new TmuxManager(runner).killSession(agentId);
-                    }
-                    else {
-                        console.warn(`[AgentManager] startSession ensureSession rollback skipped killSession for stale owner ` +
-                            `${agentId}/${taskId}`);
-                    }
+                if (stillOwner) {
+                    await this.rollbackCreatedSession(agentId, err.partial, 'startSession ensure rollback');
                 }
-                catch (cleanupErr) {
-                    console.warn(`[AgentManager] startSession ensureSession rollback killSession failed:`, cleanupErr);
+                else {
+                    console.warn(`[AgentManager] startSession ensureSession rollback skipped for stale owner ` +
+                        `${agentId}/${taskId}`);
                 }
             }
             throw err;
@@ -3595,13 +4500,17 @@ export class AgentManager {
             else {
                 if (!task.branch)
                     throw new Error(`Task ${taskId} has no task branch`);
-                await branchManager.switchToTaskBranch(workdir, taskId, task.branch, task.branchCreatedByBaxian === true);
+                await branchManager.switchToTaskBranch(workdir, taskId, task.branch, task.branchCreatedByBaxian === true, task.branchLocalCleaned
+                    ? { restorableRemoteTip: task.branchLocalCleaned.remoteTipSha }
+                    : {});
+                if (task.branchLocalCleaned)
+                    await this.clearBranchLocalCleaned(taskId);
             }
             await assertOwner();
             if (!ensure.freshRuntime) {
                 await this.clearRuntimeForTaskBoundary(tmux, paneId, agentId, agent.runtime, assertOwner);
                 if (ensure.skillsStale)
-                    await this.tagSessionSkillsVersion(tmux, agentId);
+                    await this.tagSessionSkillsVersion(tmux, agentId, ensure.sessionRef);
             }
         }
         catch (err) {
@@ -3840,7 +4749,7 @@ export class AgentManager {
             throw err;
         }
     }
-    async injectAndAwaitAck(tmux, paneId, prompt, agentId, runtime) {
+    async injectAndAwaitAck(tmux, paneId, prompt, agentId, runtime, guardBeforePaste) {
         const before = await this.agentStore.get(agentId);
         const beforeLockToken = before?.taskId
             ? await this.resolveTaskLockToken(before, before.taskId)
@@ -3889,13 +4798,16 @@ export class AgentManager {
                 }
                 : undefined;
             await revalidate?.();
-            return await this.injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate);
+            if (guardBeforePaste && !(await guardBeforePaste())) {
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
+            return await this.injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste);
         }
         finally {
             this.compactInFlight.delete(agentId);
         }
     }
-    async injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate) {
+    async injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste) {
         // 静态忙信号（文本忙样式/working title）可能是残稿或 stale title 冒充，一律由帧活性仲裁；ready 视图覆盖 stale title。
         const preTitle = await tmux.readPaneTitle(paneId);
         const preFrame = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
@@ -3905,15 +4817,87 @@ export class AgentManager {
         if (staticBusy && await this.paneHasLiveTurn(tmux, paneId, runtime)) {
             throw new Error(`pre-inject busy check: pane ${paneId} is still running a turn; dispatch aborted`);
         }
-        await tmux.clearComposerDraft(paneId);
         await revalidate?.();
-        await tmux.injectPrompt(paneId, prompt, agentId);
+        if (guardBeforePaste) {
+            // A stale replay must not touch the pane at all: the guard runs before the first composer scrub.
+            if (!(await guardBeforePaste())) {
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
+            const staged = await tmux.stagePromptBuffer(paneId, prompt, agentId);
+            // Fence + scrub + paste share one task-mutation-queue slot, so a rotation lands before or after, never between.
+            let pasted = false;
+            try {
+                pasted = await this.withTaskLock(async () => {
+                    if (!(await guardBeforePaste()))
+                        return false;
+                    await tmux.clearComposerDraft(paneId);
+                    await tmux.pasteStagedBuffer(paneId, staged.buf);
+                    return true;
+                });
+            }
+            catch (pasteErr) {
+                // Buffer still present proves the paste never landed; missing/unprobeable fails closed to a composer scrub.
+                let bufferConsumed = true;
+                try {
+                    await tmux.dropStagedBuffer(staged.buf);
+                    bufferConsumed = false;
+                }
+                catch (dropErr) {
+                    console.warn(`[AgentManager] staged buffer ${staged.buf} not confirmed dropped after failed paste (missing or unprobeable); failing closed to a composer scrub:`, dropErr);
+                }
+                if (bufferConsumed) {
+                    try {
+                        await tmux.clearComposerDraft(paneId);
+                    }
+                    catch (clearErr) {
+                        console.warn(`[AgentManager] composer scrub after unknown paste outcome failed for pane ${paneId}:`, clearErr);
+                    }
+                }
+                throw pasteErr;
+            }
+            if (!pasted) {
+                try {
+                    await tmux.dropStagedBuffer(staged.buf);
+                }
+                catch (err) {
+                    console.warn(`[AgentManager] staged buffer ${staged.buf} cleanup failed:`, err);
+                }
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
+        }
+        else {
+            await tmux.clearComposerDraft(paneId);
+            await revalidate?.();
+            await tmux.injectPrompt(paneId, prompt, agentId);
+        }
         let baseline;
         let baselineTitle = '';
         try {
             baseline = await tmux.captureSettledSnapshot(paneId, { timeoutMs: this.dispatchSettleTimeoutMs });
             baselineTitle = await tmux.readPaneTitle(paneId);
-            await tmux.sendEnter(paneId);
+            if (guardBeforePaste) {
+                // The Enter is the actual submission; it takes the same fenced queue slot.
+                const submitted = await this.withTaskLock(async () => {
+                    if (!(await guardBeforePaste()))
+                        return false;
+                    await tmux.sendEnter(paneId);
+                    return true;
+                });
+                if (!submitted) {
+                    try {
+                        await tmux.clearComposerDraft(paneId);
+                    }
+                    catch (err) {
+                        // Fail closed: a submit-ready stale prompt could not be confirmed gone.
+                        const message = err instanceof Error ? err.message : String(err);
+                        throw new Error(`fence-rejected prompt could not be scrubbed from the composer of pane ${paneId}; verify the pane before reuse: ${message}`);
+                    }
+                    return { acked: false, composerDelivered: false, aborted: true };
+                }
+            }
+            else {
+                await tmux.sendEnter(paneId);
+            }
         }
         catch (preAckErr) {
             if (await this.clearComposerForReuse(tmux, paneId, agentId))
@@ -3921,11 +4905,24 @@ export class AgentManager {
             const message = preAckErr instanceof Error ? preAckErr.message : String(preAckErr);
             throw new DispatchTerminalError('ack_unknown', `pre-ack failure left an unconfirmed composer on live pane ${paneId}: ${message}`);
         }
+        let staleDuringResend = false;
         try {
             await tmux.waitSubmitAck(paneId, baseline, runtime, {
                 timeoutMs: this.dispatchAckTimeoutMs,
                 baselineTitle,
-                resend: () => tmux.sendEnter(paneId),
+                resend: guardBeforePaste
+                    ? async () => {
+                        // A resend is a fresh submission of whatever sits in the composer; it takes the same fence.
+                        const resent = await this.withTaskLock(async () => {
+                            if (!(await guardBeforePaste()))
+                                return false;
+                            await tmux.sendEnter(paneId);
+                            return true;
+                        });
+                        if (!resent)
+                            staleDuringResend = true;
+                    }
+                    : () => tmux.sendEnter(paneId),
                 resendIntervalMs: this.dispatchAckResendIntervalMs,
             });
             return { acked: true, composerDelivered: true };
@@ -3935,6 +4932,16 @@ export class AgentManager {
             if (!(err instanceof Error && /runtime ack timeout/.test(err.message))) {
                 throw new DispatchTerminalError('ack_unknown', `ack_unknown for pane ${paneId}: ${message}`);
             }
+            if (staleDuringResend) {
+                try {
+                    await tmux.clearComposerDraft(paneId);
+                }
+                catch (scrubErr) {
+                    const scrubMessage = scrubErr instanceof Error ? scrubErr.message : String(scrubErr);
+                    throw new Error(`fence-rejected resend left an unverified composer on pane ${paneId}; verify the pane before reuse: ${scrubMessage}`);
+                }
+                return { acked: false, composerDelivered: false, aborted: true };
+            }
             console.warn(`[AgentManager] dispatch ack timeout for pane ${paneId} agent ${agentId}: ${message}`);
             const state = await this.agentStore.get(agentId).catch(() => null);
             await this.emitIntervention(state?.projectId ?? '', agentId, state?.taskId, {
@@ -4018,18 +5025,12 @@ export class AgentManager {
                 const stillOwner = stateNow?.taskId === taskId
                     && stateNow.lockToken === lockToken
                     && await this.lockManager.isOwner(agentId, taskId, lockToken);
-                try {
-                    if (stillOwner) {
-                        const runner = this.createRunnerFor(agent);
-                        await new TmuxManager(runner).killSession(agentId);
-                    }
-                    else {
-                        console.warn(`[AgentManager] continueSession ensureSession rollback skipped killSession for stale owner ` +
-                            `${agentId}/${taskId}`);
-                    }
+                if (stillOwner) {
+                    await this.rollbackCreatedSession(agentId, err.partial, 'continueSession ensure rollback');
                 }
-                catch (cleanupErr) {
-                    console.warn(`[AgentManager] continueSession ensureSession rollback killSession failed:`, cleanupErr);
+                else {
+                    console.warn(`[AgentManager] continueSession ensureSession rollback skipped for stale owner ` +
+                        `${agentId}/${taskId}`);
                 }
             }
             throw err;
@@ -4050,7 +5051,7 @@ export class AgentManager {
             const reason = `Workdir changed during continueSession: ` +
                 `before=${taskWorkdir}, ensure=${ensure.workdir}, state=${verifiedWorkdir ?? 'missing'}`;
             console.warn(`[AgentManager] continueSession[${phase}]: ${reason}; holding`);
-            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId });
+            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId, ...(opts.expectedHold ? { expectedHold: opts.expectedHold } : {}) });
             return false;
         }
         const expectedStatuses = PHASE_EXPECTED_STATUS[phase] ?? [];
@@ -4066,11 +5067,22 @@ export class AgentManager {
         }
         if (agent.role === 'dev' && task.branch) {
             const branches = new BranchManager(runner);
-            await branches.assertClean(verifiedWorkdir);
+            if (!opts.allowDirtyWorkdir)
+                await branches.assertClean(verifiedWorkdir);
             const actualRef = await branches.currentRef(verifiedWorkdir);
             if (actualRef !== `refs/heads/${task.branch}`) {
-                throw new Error(`Agent ${agentId} checkout mismatch for task ${taskId}: ` +
-                    `expected refs/heads/${task.branch}, got ${actualRef ?? 'detached HEAD'}`);
+                // dev 可能已被释放过（如 spec max_rounds 停驻默认分支）；switchToTaskBranch 自带
+                // assertClean，脏树时抛 DirtyWorkdirError fail-closed，不会覆盖未提交的改动
+                await this.assertTaskGeneration(agentId, taskId, lockToken, verifiedWorkdir);
+                await branches.switchToTaskBranch(verifiedWorkdir, taskId, task.branch, task.branchCreatedByBaxian === true, {
+                    requireExistingWork: true,
+                    ...(task.branchLocalCleaned
+                        ? { restorableRemoteTip: task.branchLocalCleaned.remoteTipSha }
+                        : {}),
+                });
+                await this.assertTaskGeneration(agentId, taskId, lockToken, verifiedWorkdir);
+                if (task.branchLocalCleaned)
+                    await this.clearBranchLocalCleaned(taskId);
             }
         }
         else if (agent.role === 'research') {
@@ -4113,6 +5125,7 @@ export class AgentManager {
                 agent,
                 workdir: verifiedWorkdir,
                 skillRegistry: this.skillRegistry,
+                hasQaPartner: task.qaAgentId !== undefined,
                 ...(signalToken ? { signalToken } : {}),
                 ...(useIncrementalNudge
                     ? { postApproveRedispatchCount: opts.postApproveRedispatchCount }
@@ -4164,17 +5177,29 @@ export class AgentManager {
             const reason = `Workdir changed before prompt injection: ` +
                 `verified=${verifiedWorkdir}, current=${agentFresh.workdir ?? 'missing'}`;
             console.warn(`[AgentManager] continueSession[${phase}]: ${reason}; holding`);
-            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId });
+            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId, ...(opts.expectedHold ? { expectedHold: opts.expectedHold } : {}) });
             return false;
         }
         await this.assertTaskLockOwner(agentId, taskId, lockToken);
-        if (phase === 'post-approve') {
-            const completionFresh = await this.getPostApproveCompletion(taskId);
-            if (!completionFresh || completionFresh.token !== signalToken) {
-                console.warn(`[AgentManager] continueSession[post-approve]: token changed before paste for task ${taskId}; skipping`);
-                return false;
-            }
+        // A revoke marks before clearing and a push transitions before clearing; every half-window must abort the paste.
+        const postApprovePassStillLive = async () => {
+            const [taskFresh, completionFresh] = await Promise.all([
+                this.taskStore.get(taskId),
+                this.getPostApproveCompletion(taskId),
+            ]);
+            return taskFresh?.agentId === agentId
+                && taskFresh.status === 'approved'
+                && taskFresh.postApproveRevoked === undefined
+                && taskFresh.postApproveHeadSha !== undefined
+                && completionFresh !== null
+                && completionFresh.token === signalToken
+                && completionFresh.approvedHeadSha === taskFresh.postApproveHeadSha;
+        };
+        if (phase === 'post-approve' && !(await postApprovePassStillLive())) {
+            console.warn(`[AgentManager] continueSession[post-approve]: pass revoked or rotated before paste for task ${taskId}; skipping`);
+            return false;
         }
+        const guardBeforeInject = opts.guardBeforeInject ?? (phase === 'post-approve' ? postApprovePassStillLive : undefined);
         if (opts.armBeforeInject && !(await opts.armBeforeInject({}))) {
             return false;
         }
@@ -4205,11 +5230,19 @@ export class AgentManager {
             const reason = `Workdir changed before prompt injection: ` +
                 `verified=${verifiedWorkdir}, current=${stateBeforeInject.workdir ?? 'missing'}`;
             console.warn(`[AgentManager] continueSession[${phase}]: ${reason}; holding`);
-            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId });
+            await this.markAwaitingHuman(agentId, 'workdir-changed-during-dispatch', `${reason}. The prompt was not delivered; verify the agent runtime and Workdir before resuming.`, { expectedTaskId: taskId, ...(opts.expectedHold ? { expectedHold: opts.expectedHold } : {}) });
             return false;
         }
         await this.assertTaskLockOwner(agentId, taskId, lockToken);
-        await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime);
+        if (guardBeforeInject && !(await guardBeforeInject())) {
+            console.warn(`[AgentManager] continueSession[${phase}]: pre-inject guard rejected the paste for task ${taskId}; skipping`);
+            return false;
+        }
+        const delivery = await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime, guardBeforeInject);
+        if (delivery.aborted) {
+            console.warn(`[AgentManager] continueSession[${phase}]: pre-paste guard rejected the inject for task ${taskId}; skipping`);
+            return false;
+        }
         return true;
     }
     async rollbackUndeliveredBootstrap(state) {
@@ -4294,6 +5327,49 @@ export class AgentManager {
             return { ...rest, updatedAt: new Date().toISOString() };
         });
     }
+    // continueSession never runs startSession's post-ack finalization; a surviving marker would make recover() roll the running task back to pending.
+    async finalizeReplayedBootstrap(agentId, taskId, phase, expectedLockToken) {
+        let cleared = false;
+        let deliveredWorkdir;
+        try {
+            await this.agentStore.update(agentId, (latest) => {
+                if (!latest
+                    || latest.taskId !== taskId
+                    || latest.bootstrappingTaskId !== taskId
+                    || latest.lockToken !== expectedLockToken) {
+                    return AGENT_STORE_NOOP;
+                }
+                cleared = true;
+                deliveredWorkdir = latest.workdir;
+                const { bootstrappingTaskId: _delivered, ...rest } = latest;
+                return { ...rest, updatedAt: new Date().toISOString() };
+            });
+        }
+        catch (err) {
+            console.warn(`[AgentManager] replay: clearing bootstrap marker for task=${taskId} failed:`, err);
+            await this.markAwaitingHuman(agentId, 'bootstrap-marker-clear-failed', 'Prompt was replayed but clearing the in-flight bootstrap marker failed; held so recovery does ' +
+                'not roll back an already-running task. Verify the agent via web terminal, then Resume.', { expectedTaskId: taskId }).catch((holdErr) => {
+                console.warn(`[AgentManager] replay: hold after marker-clear failure for task=${taskId} failed:`, holdErr);
+            });
+            return;
+        }
+        if (!cleared)
+            return;
+        try {
+            await this.eventBus.emit({
+                id: '',
+                type: 'session.started',
+                timestamp: new Date().toISOString(),
+                projectId: this.getAgentConfig(agentId)?.projectId ?? '',
+                agentId,
+                taskId,
+                data: { phase, ...(deliveredWorkdir !== undefined ? { workdir: deliveredWorkdir } : {}) },
+            });
+        }
+        catch (err) {
+            console.warn(`[AgentManager] replay: session.started emit failed for task=${taskId}:`, err);
+        }
+    }
     async releaseOrphanedLocks(states) {
         const bindings = new Map(states.map(state => [state.id, state]));
         const claims = await this.lockManager.listClaims();
@@ -4463,13 +5539,7 @@ export class AgentManager {
                     continue;
                 }
                 if (err instanceof EnsureSessionError && err.partial.createdSession) {
-                    try {
-                        const runner = this.createRunnerFor(agentConfig);
-                        await new TmuxManager(runner).killSession(state.id);
-                    }
-                    catch (cleanupErr) {
-                        console.warn(`[recover] killSession rollback failed for agent=${state.id}:`, cleanupErr);
-                    }
+                    await this.rollbackCreatedSession(state.id, err.partial, 'recover ensure rollback');
                 }
                 const message = err instanceof Error ? err.message : String(err);
                 console.warn(`[recover] ensureSession failed for agent=${state.id}: ${message}`);
@@ -4821,13 +5891,38 @@ export class AgentManager {
                 ? 'review'
                 : 'recheck';
             const prevQa = await this.agentStore.get(qaId);
+            const resumingHeldDispatch = prevQa?.taskId === taskId && prevQa.status === 'awaiting_human';
             if (prevQa?.taskId === taskId) {
-                await this.releaseAgentForTask(qaId, taskId, 'idle');
+                if (prevQa.status === 'awaiting_human' && !isRecoverableQaDispatchHold(prevQa)) {
+                    throw new ApiError(409, `QA agent ${qaId} is awaiting human (${prevQa.awaitingPhase ?? 'unknown phase'}); resolve that hold before redispatching review`);
+                }
+                const released = await this.releaseAgentIfBound(qaId, taskId, prevQa.status === 'awaiting_human'
+                    ? {
+                        allowAwaitingHuman: true,
+                        expectedHold: {
+                            phase: prevQa.awaitingPhase,
+                            since: prevQa.awaitingSince,
+                            nonce: prevQa.awaitingNonce,
+                        },
+                    }
+                    : undefined);
+                if (!released) {
+                    const after = await this.agentStore.get(qaId);
+                    const holdNote = after?.status === 'awaiting_human'
+                        ? ` (awaiting_human: ${after.awaitingPhase ?? 'unknown phase'})`
+                        : '';
+                    throw new ApiError(409, `QA agent ${qaId} could not be released from task ${taskId}${holdNote}; review dispatch aborted`);
+                }
             }
             const acquired = await this.acquireAgentForTask(qaId, taskId, qaPhase);
             if (!acquired) {
                 throw new ApiError(409, `QA agent ${qaId} is busy or unavailable`);
             }
+            const acquiredClaim = await this.lockManager.claimOf(qaId);
+            const acquiredLockToken = acquiredClaim?.taskId === taskId ? acquiredClaim.token : undefined;
+            const releaseOwnAcquire = acquiredLockToken !== undefined
+                ? { expectedLockToken: acquiredLockToken }
+                : {};
             let devParked = false;
             if (!isTerminal && devAgentId) {
                 const devState = await this.agentStore.get(devAgentId);
@@ -4838,7 +5933,7 @@ export class AgentManager {
                         return false;
                     });
                     if (!devOk) {
-                        await this.releaseAgentForTask(qaId, taskId, 'idle')
+                        await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire)
                             .catch(() => undefined);
                         throw new ApiError(500, `Cannot park dev ${devAgentId} into waiting for manual QA review (task status=${taskStatusAtClaim}); QA released`);
                     }
@@ -4853,7 +5948,8 @@ export class AgentManager {
                 reviewDispatchedAt: pre?.reviewDispatchedAt,
             };
             const isTerminalAtClaim = TERMINAL_STATUSES.includes(taskStatusAtClaim);
-            const bumpRound = opts.bumpRound !== false;
+            // 仅当恢复的是任务当前 review pass 时沿用轮次；任务已离开 review 的手工调用是新 pass，保留加轮
+            const bumpRound = opts.bumpRound !== false && !(resumingHeldDispatch && taskStatusAtClaim === 'review');
             // 回滚在锁内判定 pass 是否已被并发接管并返回；仅未被接管时才释放本次 acquire 的 QA，
             // 否则会误清接管方 re-acquire 的同一 QA 绑定（同 task 同 agent，绕过 release 的 mismatch 保护）
             const abortDispatch = async (dispatchToken) => {
@@ -4866,13 +5962,18 @@ export class AgentManager {
             let transitionToken;
             if (!isTerminalAtClaim) {
                 const reviewAnchor = await this.fetchPrHeadSha(taskId).catch(() => undefined);
-                const preDispatched = await this.transitionTaskStatus(taskId, 'review', { fromStatus: [taskStatusAtClaim] }, {
+                const preDispatched = await this.transitionTaskStatus(taskId, 'review', {
+                    fromStatus: [taskStatusAtClaim],
+                    // 入口 claim 到此处之间 pass 可能被并发轮换；expect token 必须与写入同一原子段复核
+                    ...(opts.expectSignalToken !== undefined ? { expectSignalToken: opts.expectSignalToken } : {}),
+                }, {
                     reviewHeadAnchorSha: reviewAnchor,
                     reviewDispatchedAt: new Date().toISOString(),
                     signalToken: createSignalToken(),
                 });
                 if (!preDispatched) {
-                    await this.releaseAgentForTask(qaId, taskId, 'idle').catch(() => undefined);
+                    // fence 拒绝可能源于 successor 已换代并 re-acquire 同一 QA；释放必须钉在本次 acquire 的锁代上
+                    await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => undefined);
                     if (devParked)
                         await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
                     throw new ApiError(409, `Task ${taskId} status changed during dispatch; cannot enter review`);
@@ -4923,11 +6024,17 @@ export class AgentManager {
                 });
             }
             catch (err) {
-                if (await this.markAwaitingIfAckUnknown(qaId, err, taskId)) {
-                }
-                else if (err instanceof EnsureSessionError && err.partial.handled) {
+                if (err instanceof DispatchTerminalError && err.reason === 'ack_unknown') {
+                    // prompt 可能已注入：不回滚 armed pass、不释放 QA；hold 持久化失败也不得吞掉 ack_unknown 分类
+                    try {
+                        await this.markAwaitingIfAckUnknown(qaId, err, taskId);
+                    }
+                    catch (holdErr) {
+                        console.error(`[AgentManager] dispatchReviewToQa could not persist the ack_unknown hold for ${qaId}:`, holdErr);
+                    }
+                    throw err;
                 }
-                else {
+                if (!(err instanceof EnsureSessionError && err.partial.handled)) {
                     await abortDispatch(armedToken);
                 }
                 throw err;
@@ -5227,7 +6334,9 @@ export class AgentManager {
         const task = await this.taskStore.get(taskId);
         if (!task?.signalToken)
             return false;
-        return this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, task.signalToken, opts.skipSnapshot);
+        return this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, task.signalToken, {
+            skipSnapshot: opts.skipSnapshot ?? false,
+        });
     }
     async emitManualReviewDevParkedQaFailedIntervention(agentId, expectedTaskId) {
         if (!agentId)
@@ -5723,7 +6832,7 @@ export class AgentManager {
         }
         return publishDispatchedAt ? 'delivered' : false;
     }
-    async setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, skipSnapshot = false, onReadFile) {
+    async setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, opts = {}) {
         if (!this.phaseSignalWatcher)
             return true;
         const task = await this.taskStore.get(taskId);
@@ -5736,8 +6845,9 @@ export class AgentManager {
                 agentId,
                 expectedKinds,
                 token,
-                skipSnapshot,
-                ...(onReadFile ? { onReadFile } : {}),
+                skipSnapshot: opts.skipSnapshot ?? false,
+                ...(opts.onlyReplaceOwnToken ? { onlyReplaceOwnToken: true } : {}),
+                ...(opts.onReadFile ? { onReadFile: opts.onReadFile } : {}),
             });
         }
         catch (err) {
@@ -5746,7 +6856,10 @@ export class AgentManager {
         }
     }
     async armPostDispatchSignalOrHold(taskId, agentId, expectedKinds, token, skipSnapshot = false, onReadFile) {
-        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, skipSnapshot, onReadFile);
+        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, {
+            skipSnapshot,
+            ...(onReadFile ? { onReadFile } : {}),
+        });
         if (!armed)
             await this.holdAgentForUnarmedSignal(taskId, agentId, expectedKinds);
     }
@@ -5835,8 +6948,9 @@ export class AgentManager {
             const fresh = await this.taskStore.get(taskId);
             if (!fresh)
                 throw new ApiError(404, `Task ${taskId} not found`);
-            if (fresh.status !== 'spec-ready') {
-                throw new ApiError(409, `Task ${taskId} is ${fresh.status}; spec verdict requires spec-ready`);
+            const specMaxRounds = fresh.status === 'max_rounds' && isSpecStagePhase(fresh.phase);
+            if (fresh.status !== 'spec-ready' && !specMaxRounds) {
+                throw new ApiError(409, `Task ${taskId} is ${fresh.status}; spec verdict requires spec-ready or spec-phase max_rounds`);
             }
             if (verdict === 'archive' && !fresh.researchAgentId) {
                 throw new ApiError(409, `Task ${taskId} is not a Research task; only Research specs can be archived`);
@@ -5871,7 +6985,7 @@ export class AgentManager {
                 ...base,
                 userDecision: { verdict, ...(trimmed ? { comments: trimmed } : {}), at },
             });
-            const transition = await this.transitionTaskStatus(taskId, 'done', { fromStatus: ['spec-ready'] });
+            const transition = await this.transitionTaskStatus(taskId, 'done', { fromStatus: ['spec-ready', 'max_rounds'] });
             if (!transition)
                 throw new ApiError(409, `Task ${taskId} changed while archiving`);
             this.stopPhaseSignalWatcher(taskId);
@@ -5897,18 +7011,40 @@ export class AgentManager {
         }
         if (verdict === 'approve') {
             await store.putRound(taskId, 'spec', { ...base, userDecision: { verdict, at } });
-            const result = await this.transitionToCodePhase(taskId);
+            let result;
+            try {
+                result = await this.transitionToCodePhase(taskId);
+            }
+            catch (err) {
+                if (err instanceof ApiError)
+                    throw err;
+                const message = err instanceof Error ? err.message : String(err);
+                const after = await this.taskStore.get(taskId);
+                if (after?.status === 'failed') {
+                    const reason = err instanceof DispatchTerminalError ? ` (${err.reason})` : '';
+                    throw new ApiError(500, `Code-phase dispatch failed terminally for task ${taskId}${reason}: ${message}. `
+                        + 'The task has been marked failed; use Retry to run it as a fresh task.');
+                }
+                if (after?.phase === 'code' && after.status === 'in_progress') {
+                    throw new ApiError(500, `Code-phase dispatch failed for task ${taskId}: ${message}. `
+                        + 'The task already moved to the code phase and the dev is held; '
+                        + 'Resume the dev agent to redeliver the prompt.');
+                }
+                throw new ApiError(500, `Code-phase dispatch failed for task ${taskId}: ${message}. `
+                    + 'The task was rolled back to await the verdict; fix the dev Workdir '
+                    + '(Resume the dev first if it is still held), then retry the verdict.');
+            }
             if (!result) {
+                const after = await this.taskStore.get(taskId);
+                if (after?.phase === 'code' && after.status === 'in_progress') {
+                    throw new ApiError(500, `Code-phase prompt was not delivered for task ${taskId}; the task already moved to the `
+                        + 'code phase and the dev is held. Resume the dev agent to redeliver the prompt '
+                        + '(retrying the verdict will be rejected).');
+                }
                 throw new ApiError(409, `Dev is unavailable for task ${taskId}; approval was recorded and can be retried`);
             }
             return result;
         }
-        // 打回消耗一轮修订；到达上限时拒绝而非派发注定进 max_rounds 的修订，让用户当场决策
-        const cap = this.getConfig().review.rounds + (task.maxRoundsContinues ?? 0);
-        if (round >= cap) {
-            throw new ApiError(409, `Task ${taskId} has reached the spec review round cap (${cap}); `
-                + 'approve the spec, or cancel the task and retry with a refined description');
-        }
         if (!trimmed)
             throw new ApiError(400, 'comments is required for request-changes');
         const priorFindings = base.findings?.findings ?? [];
@@ -5918,16 +7054,106 @@ export class AgentManager {
             verdict: 'request-changes',
             findings: [...priorFindings, { id: nextUserId, severity: 'major', message: trimmed }],
         };
-        await store.putRound(taskId, 'spec', {
+        const rejectedRound = {
             ...base,
             findings: mergedFindings,
             userDecision: { verdict, comments: trimmed, at },
-        });
-        const dispatched = await this.dispatchServerFixToDev(taskId, JSON.stringify(mergedFindings));
+        };
+        // 到达上限后用户仍显式打回 = 对「再评一轮」的当场决策：扩 cap 而非拒绝。
+        // holder 恢复与扩 cap 正交：max_rounds 入态时 holder 已被释放清空，即便 cap
+        // 因配置热更新出现余量，打回前也必须先恢复 holder
+        const cap = this.getConfig().review.rounds + (task.maxRoundsContinues ?? 0);
+        const claim = task.status === 'max_rounds' || round >= cap
+            ? await this.claimSpecFixDispatch(taskId, { extendCapToFit: round >= cap ? round : null })
+            : null;
+        let dispatched = null;
+        try {
+            await store.putRound(taskId, 'spec', rejectedRound);
+            dispatched = await this.dispatchServerFixToDev(taskId, JSON.stringify(mergedFindings));
+        }
+        catch (err) {
+            if (err instanceof ApiError)
+                throw err;
+            const message = err instanceof Error ? err.message : String(err);
+            const after = await this.taskStore.get(taskId);
+            if (after?.status === 'failed') {
+                const reason = err instanceof DispatchTerminalError ? ` (${err.reason})` : '';
+                throw new ApiError(500, `Spec fix dispatch failed terminally for task ${taskId}${reason}: ${message}. `
+                    + 'The task has been marked failed with the rejection kept on record; '
+                    + 'use Retry to run it as a fresh task.');
+            }
+            if (after?.status === 'fixing') {
+                throw new ApiError(500, `Spec fix dispatch was interrupted for task ${taskId}: ${message}. `
+                    + 'The task moved to fixing with the rejection recorded; resume the holder agent to redeliver it.');
+            }
+            throw new ApiError(500, `Spec fix dispatch failed for task ${taskId}: ${message}. `
+                + 'The rejection was rolled back; fix the agent runtime or configuration, then retry.');
+        }
+        finally {
+            if (!dispatched)
+                await this.recoverSpecRejectionState(taskId, claim, base);
+        }
         if (!dispatched)
             throw new ApiError(500, `Failed to dispatch spec fix for task ${taskId}`);
         return dispatched;
     }
+    async claimSpecFixDispatch(taskId, opts) {
+        return await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh)
+                throw new ApiError(404, `Task ${taskId} not found`);
+            if (fresh.status !== 'spec-ready' && fresh.status !== 'max_rounds') {
+                throw new ApiError(409, `Task ${taskId} changed status during the spec verdict; aborted`);
+            }
+            const holder = fresh.agentId || fresh.researchAgentId || fresh.devAgentId;
+            if (!holder || !this.getAgentConfig(holder)) {
+                throw new ApiError(409, `Task ${taskId} spec holder agent ${holder || '(none)'} is not in the current config; `
+                    + 'restore the agent config or cancel the task');
+            }
+            const originalAgentId = fresh.agentId;
+            const originalCounter = fresh.maxRoundsContinues ?? 0;
+            let counterAfter = originalCounter;
+            if (opts.extendCapToFit !== null) {
+                // cap 必须容下下一轮（round+1）；rounds 被调低时一次 +1 可能不够
+                counterAfter = Math.max(originalCounter + 1, opts.extendCapToFit + 1 - this.getConfig().review.rounds);
+                fresh.maxRoundsContinues = counterAfter;
+            }
+            fresh.agentId = holder;
+            fresh.updatedAt = new Date().toISOString();
+            await this.taskStore.set(fresh);
+            return { originalAgentId, originalCounter, holderWritten: holder, counterAfter };
+        });
+    }
+    // 补偿以 claim 时的 status+counter+holder 为代际证明：任务已被推进（fixing/cancelled/新扩轮）
+    // 就放弃恢复——尤其派发把任务带进 held fixing 时，打回 round 必须保留给后续 Resume 重派
+    async recoverSpecRejectionState(taskId, claim, baseRound) {
+        const store = this.getReviewStore();
+        await this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh)
+                return;
+            if (fresh.status !== 'spec-ready' && fresh.status !== 'max_rounds') {
+                console.warn(`[AgentManager] spec rejection recovery(${taskId}) skipped: task moved to ${fresh.status}`);
+                return;
+            }
+            if (claim) {
+                if ((fresh.maxRoundsContinues ?? 0) !== claim.counterAfter
+                    || fresh.agentId !== claim.holderWritten) {
+                    console.warn(`[AgentManager] spec rejection recovery(${taskId}) skipped: `
+                        + `continues=${fresh.maxRoundsContinues ?? 0} agentId=${fresh.agentId} `
+                        + `(expected ${claim.counterAfter}/${claim.holderWritten})`);
+                    return;
+                }
+                fresh.maxRoundsContinues = claim.originalCounter;
+                fresh.agentId = claim.originalAgentId;
+                fresh.updatedAt = new Date().toISOString();
+                await this.taskStore.set(fresh);
+            }
+            await store?.putRound(taskId, 'spec', baseRound);
+        }).catch(err => {
+            console.error(`[AgentManager] spec rejection recovery(${taskId}) failed:`, err);
+        });
+    }
     async submitCodeVerdict(taskId, comments) {
         const trimmed = comments?.trim();
         if (!trimmed) {
@@ -6090,6 +7316,7 @@ export class AgentManager {
         if (task.qaAgentId && !await releaseParticipant(task.qaAgentId, 'code-phase-qa-release-failed')) {
             return null;
         }
+        const devBoundBefore = (await this.agentStore.get(devAgentId))?.taskId === taskId;
         const acquired = await this.acquireAgentForTask(devAgentId, taskId, 'code');
         if (!acquired) {
             await this.emitIntervention(task.projectId, devAgentId, taskId, {
@@ -6098,8 +7325,10 @@ export class AgentManager {
             });
             return null;
         }
+        const acquiredLockToken = (await this.agentStore.get(devAgentId))?.lockToken;
         const newToken = createSignalToken();
-        const transition = await this.transitionTaskStatus(taskId, 'in_progress', { fromStatus: ['review', 'fixing', 'in_progress', 'spec-ready'] }, { agentId: devAgentId, phase: 'code', signalToken: newToken });
+        // spec 阶段的扩轮决策不延续到 code 评审：cap 共享字段，进入编码时归零
+        const transition = await this.transitionTaskStatus(taskId, 'in_progress', { fromStatus: ['review', 'fixing', 'in_progress', 'spec-ready', 'max_rounds'] }, { agentId: devAgentId, phase: 'code', signalToken: newToken, maxRoundsContinues: 0 });
         if (!transition) {
             await this.releaseAgentForTask(devAgentId, taskId, 'idle', { allowAwaitingHuman: true })
                 .catch(() => undefined);
@@ -6114,6 +7343,33 @@ export class AgentManager {
             if (err instanceof DispatchTerminalError) {
                 await this.failTaskForDispatchError(taskId, 'code', devAgentId, err);
             }
+            else if (err instanceof EnsureSessionError && err.partial.handled
+                && (task.status === 'spec-ready' || task.status === 'max_rounds')) {
+                // dev 已被 checkout/dialog hold 且 prompt 未送达；resumeAgent 不重派这些 hold，
+                // 任务停在 in_progress 会同时封死 Resume 与 verdict——退回 verdict 门禁状态
+                const rolledBack = await this.transitionTaskStatus(taskId, task.status, { fromStatus: ['in_progress'] }, {
+                    ...(task.phase !== undefined ? { phase: task.phase } : {}),
+                    agentId: task.agentId,
+                    ...(task.signalToken ? { signalToken: task.signalToken } : {}),
+                    maxRoundsContinues: task.maxRoundsContinues ?? 0,
+                });
+                if (!rolledBack) {
+                    console.warn(`[AgentManager] transitionToCodePhase(${taskId}): handled dispatch failure but the task `
+                        + 'moved on; leaving its status as-is');
+                }
+                else if (!devBoundBefore) {
+                    // 转码前 dev 未持有本任务（如 research handoff / max_rounds 重占用）：任务已退回
+                    // verdict 门禁，释放本次新占用，否则 dev 会被回退后的任务永久占住
+                    const released = await this.releaseAgentForTask(devAgentId, taskId, 'idle', { allowAwaitingHuman: true })
+                        .catch(() => false);
+                    if (!released) {
+                        await this.emitIntervention(task.projectId, devAgentId, taskId, {
+                            phase: 'code-rollback-dev-release-failed',
+                            devAgentId,
+                        });
+                    }
+                }
+            }
             else if (!(err instanceof EnsureSessionError && err.partial.handled)) {
                 await this.markAwaitingHuman(devAgentId, 'code-dispatch-failed', 'Code-phase prompt was not delivered after spec approval; the task looks in_progress but the dev never received it. Resume/restart the agent or cancel the task.', { expectedTaskId: taskId }).catch(() => undefined);
             }
@@ -6128,6 +7384,11 @@ export class AgentManager {
             });
             return null;
         }
+        // 重占用（released dev）的 acquire 会写 bootstrappingTaskId，而 continueSession 不做
+        // startSession 的 post-ack finalize；残留标记会让 recover 把已运行的任务按未送达回滚
+        if (!researchHandoff) {
+            await this.finalizeReplayedBootstrap(devAgentId, taskId, 'code', acquiredLockToken);
+        }
         return await this.taskStore.get(taskId);
     }
     async dispatchServerReviewToQa(taskId, opts) {
@@ -6270,7 +7531,11 @@ export class AgentManager {
             armBeforeInject: (ctx) => {
                 dispatchedCheckoutMode = ctx.serverReviewCheckout;
                 const allowReadFile = opts.phase === 'spec' || opts.continuation || ctx.serverReviewCheckout === 'base';
-                return this.setupPhaseSignalWatcher(taskId, qaId, expectedKind, newToken, false, allowReadFile ? (req) => { void this.handleReadFileRequest(taskId, qaId, req); } : undefined);
+                return this.setupPhaseSignalWatcher(taskId, qaId, expectedKind, newToken, {
+                    ...(allowReadFile
+                        ? { onReadFile: (req) => { void this.handleReadFileRequest(taskId, qaId, req); } }
+                        : {}),
+                });
             },
         };
         const rearmConsumedSignal = async () => {
@@ -6364,6 +7629,16 @@ export class AgentManager {
             const reviewedKind = taskPhase === 'spec' ? 'spec-reviewed' : 'code-reviewed';
             await this.setupPhaseSignal(taskId, qaAgentId, reviewedKind, { skipSnapshot: true });
         };
+        const devBoundBefore = (await this.agentStore.get(devAgentId))?.taskId === taskId;
+        const releaseFreshAcquire = async () => {
+            if (devBoundBefore)
+                return;
+            const released = await this.releaseAgentForTask(devAgentId, taskId, 'idle')
+                .catch(() => false);
+            if (!released) {
+                console.error(`[AgentManager] dispatchServerFixToDev: releasing freshly acquired dev ${devAgentId} for ${taskId} failed`);
+            }
+        };
         const acquired = await this.acquireAgentForTask(devAgentId, taskId, 'server-feedback');
         if (!acquired) {
             await rearmReviewedSignal();
@@ -6374,6 +7649,7 @@ export class AgentManager {
             const released = await this.releaseAgentIfBound(qaAgentId, taskId)
                 .catch(() => false);
             if (!released) {
+                await releaseFreshAcquire();
                 await rearmReviewedSignal();
                 await this.emitIntervention(projectId, qaAgentId, taskId, { phase: 'server-fix-qa-release-failed', qaAgentId });
                 return null;
@@ -6381,6 +7657,7 @@ export class AgentManager {
         }
         const transition = await this.transitionTaskStatus(taskId, 'fixing', { fromStatus: ['review', 'max_rounds', 'spec-ready', 'ready'] }, { signalToken: newToken, fixDispatchedAt: new Date().toISOString() });
         if (!transition) {
+            await releaseFreshAcquire();
             await this.emitIntervention(projectId, devAgentId, taskId, { phase: 'server-fix-transition-failed', devAgentId });
             return null;
         }