gestalt-mobile 0.35.0 → 0.35.2

package/dist/server/server/features/autopilot/application/service.js

@@ -7,9 +7,9 @@ import { deriveSessionStatus } from '../../sessions/session-status.js';
 import { createHash } from 'node:crypto';
 import { AUTOPILOT_WAIT_MAX_MS, AUTOPILOT_WAIT_MIN_MS, } from '../../../../shared/contracts/autopilot-wait-lease.js';
 import { autopilotSnapshot, disabledAutopilot, } from '../domain/autopilot-session.js';
-import { classifyExecutorOutcome, decideSupervisedLifecycle, executorIdentity, validStructuredBlock, } from '../domain/supervised-lifecycle.js';
+import { classifyExecutorOutcome, decideSupervisedLifecycle, executorIdentity, validStructuredBlock, checkpointTarget, } from '../domain/supervised-lifecycle.js';
 import { classifyAgentActivity, decideAutopilot, executionComplete, } from './policy.js';
-import { consumeObservableWake, consumeWaitDeadline, recordAutomaticContinuation, recoverSafetyPause, registerProactiveWait as registerProtocolWait, reportProbe, semanticProgressKey, startSupervisionProtocol, } from '../domain/supervision-protocol.js';
+import { consumeCheckpointBoundary, consumeObsoleteWait, consumeObservableWake, consumeWaitDeadline, recordAutomaticContinuation, recoverSafetyPause, registerProactiveWait as registerProtocolWait, reportProbe, semanticProgressKey, startSupervisionProtocol, } from '../domain/supervision-protocol.js';
 export class AutopilotCoordinator {
     deps;
     timers = new Map();
@@ -272,8 +272,10 @@ export class AutopilotCoordinator {
         const prior = this.deps.store.find(sessionId) ?? disabledAutopilot(sessionId, now);
         const nextFingerprint = fingerprint(currentPlan.plan);
         const replacing = Boolean(prior.planIdentity && prior.planIdentity !== currentPlan.identity);
-        if (replacing)
+        if (replacing) {
             this.cancelWaitTimer(sessionId);
+            this.parkedSubscriptions.delete(sessionId);
+        }
         if (prior.requestedEnabled &&
             prior.planIdentity === currentPlan.identity &&
             prior.state !== 'attentionRequired')
@@ -290,12 +292,9 @@ export class AutopilotCoordinator {
             stopReason: null,
             executor: undefined,
             blocking: undefined,
-            // A replacement plan cannot inherit a parked lease, retry key, or probe
-            // budget from a different semantic plan identity. Re-enabling the same
-            // plan still preserves its non-terminal protocol state.
-            supervision: replacing
+            supervision: recoverSafetyPause(consumeObsoleteWait(replacing
                 ? startSupervisionProtocol(this.progressKey(sessionId))
-                : recoverSafetyPause(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
+                : (prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId))), this.progressKey(sessionId)), this.progressKey(sessionId)),
             updatedAt: now,
         };
         this.persist(next);
@@ -314,6 +313,7 @@ export class AutopilotCoordinator {
         if (!prior.requestedEnabled &&
             prior.state === 'disabled' &&
             !cancelled &&
+            !prior.supervision?.waitLease &&
             (!currentPlan || prior.planIdentity === currentPlan.identity))
             return this.snapshot(sessionId);
         const next = {
@@ -326,12 +326,13 @@ export class AutopilotCoordinator {
             ...(cancelled ? { lastControlId: null } : {}),
             stopReason: 'manualDisabled',
             blocking: undefined,
-            supervision: recoverSafetyPause(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
+            supervision: consumeObsoleteWait(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
             updatedAt: now,
         };
         this.persist(next, cancelled);
         this.cancelTimer(sessionId);
         this.cancelWaitTimer(sessionId);
+        this.parkedSubscriptions.delete(sessionId);
         return this.snapshot(sessionId);
     }
     cancel(sessionId, reason) {
@@ -349,10 +350,12 @@ export class AutopilotCoordinator {
             ...(cancelled ? { lastControlId: null } : {}),
             stopReason: reason,
             blocking: undefined,
+            supervision: consumeObsoleteWait(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
             updatedAt: now,
         }, cancelled);
         this.cancelTimer(sessionId);
         this.cancelWaitTimer(sessionId);
+        this.parkedSubscriptions.delete(sessionId);
     }
     evaluate(sessionId) {
         const prior = this.deps.store.find(sessionId);
@@ -526,7 +529,15 @@ export class AutopilotCoordinator {
                 (state.checkpoints.terminalReviewAccepted ? 'terminalReviewAccepted' : 'l1Accepted');
             this.persist({
                 ...state,
-                checkpoints: { ...state.checkpoints, pendingTurnId: null, pendingKind: null },
+                // The failure audit is durable history, but it is not a permanent
+                // health condition. A matching final or reconstructed runtime has
+                // completed the bounded recovery, so clear the live indicator.
+                checkpoints: {
+                    ...state.checkpoints,
+                    pendingTurnId: null,
+                    pendingKind: null,
+                    checkpointHandoffFailed: false,
+                },
                 updatedAt: occurredAt,
             }, undefined, [
                 {
@@ -555,7 +566,12 @@ export class AutopilotCoordinator {
             });
             this.flushOutbox(sessionId);
         }
-        this.activitySettled(sessionId, 'rootFinalAttempt');
+        // The persisted checkpoint is the continuation trigger. It becomes
+        // actionable only after the root final has closed its owning turn.
+        if (checkpointBoundary)
+            this.evaluate(sessionId);
+        else
+            this.activitySettled(sessionId, 'rootFinalAttempt');
         return finalAllowed;
     }
     /** Records an already validated root-only checkpoint; it never changes Org state. */
@@ -569,28 +585,50 @@ export class AutopilotCoordinator {
             return false;
         const reportedL1Ids = previous?.reportedL1Ids ?? [];
         const reportedL2Ids = previous?.reportedL2Ids ?? [];
-        const key = createHash('sha256').update(JSON.stringify(checkpoint)).digest('hex');
+        const canonicalPosition = checkpoint.kind === 'terminalReviewAccepted' ? 'terminal' : checkpoint.position;
+        const target = checkpoint.kind === 'l2Completed'
+            ? checkpointTarget('l2', checkpoint.l1Id, checkpoint.l2Id)
+            : checkpoint.kind === 'l1Accepted'
+                ? checkpointTarget('l1', checkpoint.l1Id)
+                : checkpointTarget('terminal');
+        const completionEpoch = previous?.completionEpochs?.find((entry) => entry.target === target);
+        const epoch = completionEpoch?.epoch ?? 0;
+        const key = createHash('sha256')
+            .update(JSON.stringify([retained.identity, checkpoint.kind, canonicalPosition, epoch]))
+            .digest('hex');
         const acceptedKeys = previous?.acceptedKeys ?? [];
         if (acceptedKeys.includes(key))
-            return true;
+            return previous?.pendingTurnId === turnId && previous.pendingKind === checkpoint.kind;
         const l2Key = checkpoint.kind === 'l2Completed' ? JSON.stringify([checkpoint.l1Id, checkpoint.l2Id]) : null;
-        if (l2Key && reportedL2Ids.includes(l2Key))
-            return false;
-        if (checkpoint.kind === 'l1Accepted' && reportedL1Ids.includes(checkpoint.l1Id))
-            return false;
         if (checkpoint.kind === 'terminalReviewAccepted' && previous?.terminalReviewAccepted)
             return false;
+        if (completionEpoch?.completed && !completionEpoch.reopened)
+            return false;
+        const completionEpochs = [
+            ...(previous?.completionEpochs ?? []).filter((entry) => entry.target !== target),
+            { target, epoch, reopened: false, completed: true },
+        ];
         const checkpoints = {
             protocolVersion: 1,
             planIdentity: retained.identity,
-            reportedL2Ids: l2Key ? [...reportedL2Ids, l2Key] : reportedL2Ids,
-            reportedL1Ids: checkpoint.kind === 'l1Accepted' ? [...reportedL1Ids, checkpoint.l1Id] : reportedL1Ids,
-            acceptedKeys: [...acceptedKeys, key],
+            completionEpochs: boundEpochs(completionEpochs, target),
+            reportedL2Ids: l2Key ? boundedUnique([...reportedL2Ids, l2Key], 512) : reportedL2Ids,
+            reportedL1Ids: checkpoint.kind === 'l1Accepted'
+                ? boundedUnique([...reportedL1Ids, checkpoint.l1Id], 128)
+                : reportedL1Ids,
+            acceptedKeys: boundedUnique([...acceptedKeys, key], 768),
             pendingTurnId: turnId,
             pendingKind: checkpoint.kind,
+            checkpointHandoffFailed: false,
             terminalReviewAccepted: checkpoint.kind === 'terminalReviewAccepted' || previous?.terminalReviewAccepted === true,
         };
-        this.persist({ ...prior, checkpoints, updatedAt: occurredAt }, undefined, [
+        const checkpointed = { ...prior, checkpoints, updatedAt: occurredAt };
+        this.persist({
+            ...checkpointed,
+            supervision: checkpointed.supervision
+                ? consumeCheckpointBoundary(checkpointed.supervision, this.progressKeyFor(sessionId, checkpointed, retained))
+                : checkpointed.supervision,
+        }, undefined, [
             {
                 sessionId,
                 type: checkpoint.kind === 'l2Completed'
@@ -611,13 +649,40 @@ export class AutopilotCoordinator {
                 occurredAt,
             },
         ]);
-        // A lease only optimizes a probe that deliberately yielded. Checkpoints are
-        // authoritative progress events in their own right, so an incomplete plan
-        // must be evaluated even when no probe (and therefore no lease) exists.
-        if (!this.semanticEvent(sessionId, 'checkpointChanged'))
-            this.evaluate(sessionId);
+        // Persistence and acknowledgement stay on the short checkpoint path. Any
+        // pre-boundary lease is already obsolete, but continuation is deliberately
+        // deferred until the matching root final closes the turn.
+        this.cancelWaitTimer(sessionId);
+        this.parkedSubscriptions.delete(sessionId);
+        this.cancelTimer(sessionId);
         return true;
     }
+    /**
+     * Records a failed checkpoint transport handoff without releasing its root
+     * boundary. The matching final (or a runtime recovery) remains the only
+     * authority allowed to schedule the next root continuation.
+     */
+    checkpointHandoffFailed(sessionId, requestTurnId) {
+        const prior = this.deps.store.find(sessionId);
+        if (!prior?.checkpoints?.pendingTurnId ||
+            prior.checkpoints.pendingTurnId !== requestTurnId ||
+            prior.checkpoints.checkpointHandoffFailed)
+            return false;
+        this.persist({
+            ...prior,
+            checkpoints: { ...prior.checkpoints, checkpointHandoffFailed: true },
+            updatedAt: this.deps.now(),
+        });
+        return true;
+    }
+    /** A replacement runtime is the explicit substitute for the lost root final. */
+    recoverCheckpointHandoff(sessionId) {
+        const pendingTurnId = this.deps.store.find(sessionId)?.checkpoints?.pendingTurnId;
+        if (!pendingTurnId)
+            return false;
+        this.checkpointHandoffFailed(sessionId, pendingTurnId);
+        return this.turnCompleted(sessionId);
+    }
     /** Handles only plan lifecycle safety; ordinary plan mutations are ignored. */
     planStatusChanged(sessionId) {
         const prior = this.deps.store.find(sessionId);
@@ -629,9 +694,21 @@ export class AutopilotCoordinator {
             return;
         }
         if (prior.planIdentity && prior.planIdentity !== plan.identity) {
+            this.supersedeExecutorCommands(sessionId, plan.identity, plan.plan);
             this.cancel(sessionId, 'planReplaced');
             return;
         }
+        this.supersedeExecutorCommands(sessionId, plan.identity, plan.plan);
+        // Supersession persists independently. Re-read before reopening epochs so
+        // this update cannot restore commands from the stale pre-supersession row.
+        const current = this.deps.store.find(sessionId) ?? prior;
+        const checkpointEpochs = this.reopenCheckpointEpochs(current, plan.plan);
+        if (checkpointEpochs !== current.checkpoints?.completionEpochs)
+            this.persist({
+                ...current,
+                checkpoints: { ...current.checkpoints, completionEpochs: checkpointEpochs },
+                updatedAt: this.deps.now(),
+            });
         if (this.semanticEvent(sessionId, 'planChanged') ||
             this.semanticEvent(sessionId, 'reviewChanged'))
             return;
@@ -645,6 +722,31 @@ export class AutopilotCoordinator {
         this.planEventKeys.set(sessionId, eventKey);
         this.evaluate(sessionId);
     }
+    /**
+     * Plan refinements are not a new completion.  Only a completed target that
+     * becomes ineligible opens its next reportable epoch.
+     */
+    reopenCheckpointEpochs(state, plan) {
+        const epochs = state.checkpoints?.completionEpochs;
+        if (!epochs?.length)
+            return epochs;
+        let changed = false;
+        const next = epochs.map((entry) => {
+            const [kind, l1Id, l2Id] = JSON.parse(entry.target);
+            const l1 = plan.steps.find((step) => step.id === l1Id);
+            const eligible = kind === 'l2'
+                ? Boolean(l1?.children.some((child) => child.id === l2Id && child.state === 'DONE'))
+                : kind === 'l1'
+                    ? l1?.state === 'DONE' && l1.reviewStatus === 'REVIEWED'
+                    : plan.executionComplete === true;
+            if (!eligible && !entry.reopened) {
+                changed = true;
+                return { ...entry, epoch: entry.epoch + 1, reopened: true, completed: false };
+            }
+            return entry;
+        });
+        return changed ? next : epochs;
+    }
     /**
      * Records a validated, session-private supervision request.  It intentionally
      * does not discover plans: composition must first bind the update to this
@@ -670,6 +772,7 @@ export class AutopilotCoordinator {
         if (replacing) {
             this.cancelTimer(sessionId);
             this.cancelWaitTimer(sessionId);
+            this.parkedSubscriptions.delete(sessionId);
         }
         const next = {
             ...prior,
@@ -684,9 +787,9 @@ export class AutopilotCoordinator {
             stopReason: null,
             executor: undefined,
             blocking: undefined,
-            supervision: replacing
+            supervision: recoverSafetyPause(consumeObsoleteWait(replacing
                 ? startSupervisionProtocol(this.progressKey(sessionId))
-                : recoverSafetyPause(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
+                : (prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId))), this.progressKey(sessionId)), this.progressKey(sessionId)),
             updatedAt: now,
         };
         this.persist(next, cancelled);
@@ -707,20 +810,10 @@ export class AutopilotCoordinator {
             this.evaluate(sessionId);
             return;
         }
-        const eventKey = JSON.stringify({
-            root: [activity.root.state, activity.root.reason],
-            children: activity.subagents.map((child) => [
-                child.id,
-                child.state,
-                child.reason,
-                child.continuationGeneration ?? 0,
-                (child.ownedProcesses ?? []).map((process) => [
-                    process.processId,
-                    process.state,
-                    process.ownership,
-                ]),
-            ]),
-        });
+        // Reuse the canonical semantic projection: child order, timestamps, and
+        // activity prose cannot manufacture an extra wake, while a child-only
+        // lifecycle transition remains visible with an unchanged root.
+        const eventKey = this.progressKey(sessionId);
         if (this.activityEventKeys.get(sessionId) === eventKey)
             return;
         this.activityEventKeys.set(sessionId, eventKey);
@@ -765,10 +858,10 @@ export class AutopilotCoordinator {
         this.completionTimers.get(sessionId)?.();
         this.completionTimers.set(sessionId, this.deps.schedule(() => {
             this.completionTimers.delete(sessionId);
-            const current = this.deps.store.find(sessionId);
-            if (!current?.requestedEnabled || current.state !== 'monitoring')
-                return;
             this.enqueue(sessionId, async () => {
+                const current = this.deps.store.find(sessionId);
+                if (!current?.requestedEnabled || current.state !== 'monitoring')
+                    return;
                 if (!(await this.enforceSupervisedLifecycle(sessionId, event)))
                     this.evaluate(sessionId);
             });
@@ -776,6 +869,8 @@ export class AutopilotCoordinator {
     }
     manualSend(sessionId) {
         this.cancelTimer(sessionId);
+        this.cancelWaitTimer(sessionId);
+        this.parkedSubscriptions.delete(sessionId);
         const prior = this.deps.store.find(sessionId);
         if (!prior || !prior.requestedEnabled)
             return;
@@ -787,6 +882,7 @@ export class AutopilotCoordinator {
             generation: prior.generation + 1,
             nextEvaluationAt: null,
             lastControlId: null,
+            supervision: consumeObsoleteWait(prior.supervision ?? startSupervisionProtocol(this.progressKey(sessionId)), this.progressKey(sessionId)),
             updatedAt: now,
         }, cancelled);
     }
@@ -843,6 +939,28 @@ export class AutopilotCoordinator {
         const current = this.deps.store.find(sessionId);
         if (!current || current.generation !== generation || !current.requestedEnabled)
             return;
+        if (current.executor?.replacement &&
+            !this.validReplacement(sessionId, current.executor.replacement)) {
+            const now = this.deps.now();
+            const cancelled = this.cancelScheduledControl(current, now);
+            this.persist({
+                ...current,
+                state: 'monitoring',
+                executor: {
+                    ...current.executor,
+                    replacement: undefined,
+                    commands: current.executor.commands?.map((command) => ['scheduled', 'issued'].includes(command.status)
+                        ? { ...command, status: 'superseded', updatedAt: now }
+                        : command),
+                },
+                ...(cancelled ? { generation: current.generation + 1, lastControlId: null } : {}),
+                nextEvaluationAt: null,
+                updatedAt: now,
+            }, cancelled);
+            this.audit(sessionId, 'autopilot.executor-replacement-superseded', {});
+            this.evaluate(sessionId);
+            return;
+        }
         const session = this.deps.session(sessionId);
         if (session?.activeTurnId ||
             this.deps.pendingInteraction(sessionId) ||
@@ -862,6 +980,7 @@ export class AutopilotCoordinator {
         const retained = this.deps.plan(sessionId);
         if (this.deps.executorController &&
             retained &&
+            !current.executor?.replacement &&
             this.currentExecutor(sessionId, retained.plan, current.consecutiveNoProgress, current.executor)) {
             const now = this.deps.now();
             const cancelled = this.cancelScheduledControl(current, now);
@@ -955,6 +1074,19 @@ export class AutopilotCoordinator {
         this.completionTimers.delete(sessionId);
         this.executorTimers.get(sessionId)?.();
         this.executorTimers.delete(sessionId);
+        const state = this.deps.store.find(sessionId);
+        const executor = state?.executor;
+        if (state && executor?.commands?.some((command) => command.status === 'scheduled'))
+            this.persist({
+                ...state,
+                executor: {
+                    ...executor,
+                    commands: executor.commands.map((command) => command.status === 'scheduled'
+                        ? { ...command, status: 'cancelled', updatedAt: this.deps.now() }
+                        : command),
+                },
+                updatedAt: this.deps.now(),
+            });
     }
     cancelWaitTimer(sessionId) {
         this.waitTimers.get(sessionId)?.();
@@ -967,6 +1099,12 @@ export class AutopilotCoordinator {
             const state = this.deps.store.find(sessionId);
             if (!state?.requestedEnabled || !state.supervision)
                 return;
+            const lease = state.supervision.waitLease;
+            if (state.supervision.outcome !== 'parked' ||
+                !lease ||
+                lease.id !== leaseId ||
+                lease.resumeAt !== resumeAt)
+                return;
             const protocol = consumeWaitDeadline(state.supervision, leaseId, this.deps.now());
             if (protocol === state.supervision) {
                 this.armWaitDeadline(sessionId, leaseId, resumeAt);
@@ -988,6 +1126,10 @@ export class AutopilotCoordinator {
             return false;
         const executor = this.currentExecutor(sessionId, retained.plan, state.consecutiveNoProgress, state.executor);
         const executorChanged = executor ? this.persistExecutor(sessionId, executor) : false;
+        if (executor && (await this.reconcileSplitBrain(sessionId, executor)))
+            return true;
+        if (executor)
+            this.supersedeExecutorCommands(sessionId, retained.identity, retained.plan, executor);
         if (executorChanged && this.wakeForExecutorChange(sessionId, executor))
             return true;
         const decision = decideSupervisedLifecycle({
@@ -1017,16 +1159,10 @@ export class AutopilotCoordinator {
                 const alreadyMonitoring = executor?.ownedProcesses.some((process) => process.processId === processId &&
                     process.ownership === 'supervisor' &&
                     process.state === 'detached-active');
-                if (!alreadyMonitoring)
-                    controller.transferProcess(sessionId, decision.action.process.ownerThreadId, processId);
-                if (executor)
-                    this.persistExecutor(sessionId, {
-                        ...executor,
-                        ownedProcesses: executor.ownedProcesses.map((process) => process.processId === processId
-                            ? { ...process, ownership: 'supervisor', state: 'detached-active' }
-                            : process),
-                    });
-                if (!alreadyMonitoring)
+                const transferred = alreadyMonitoring || !executor
+                    ? alreadyMonitoring
+                    : await this.performProcessAction(sessionId, executor, decision.action.process, 'transfer');
+                if (transferred && !alreadyMonitoring)
                     this.audit(sessionId, 'autopilot.process-monitoring', {
                         threadId: decision.action.process.ownerThreadId,
                         processId,
@@ -1035,42 +1171,41 @@ export class AutopilotCoordinator {
                 return true;
             }
             case 'consumeProcessResult': {
-                const processId = decision.action.processId;
-                controller.consumeProcess(sessionId, decision.action.threadId, processId);
-                if (executor)
-                    this.persistExecutor(sessionId, {
-                        ...executor,
-                        ownedProcesses: executor.ownedProcesses.map((process) => process.processId === processId ? { ...process, state: 'result-consumed' } : process),
+                const processAction = decision.action;
+                const processId = processAction.processId;
+                const process = executor?.ownedProcesses.find((candidate) => candidate.processId === processId &&
+                    candidate.ownerThreadId === processAction.threadId &&
+                    candidate.state === 'exited-awaiting-result');
+                const consumed = process && executor
+                    ? await this.performProcessAction(sessionId, executor, process, 'consume')
+                    : false;
+                if (consumed)
+                    this.audit(sessionId, 'autopilot.process-result-consumed', {
+                        threadId: processAction.threadId,
+                        processId,
+                        resultArtifact: processAction.resultArtifact,
                     });
-                this.audit(sessionId, 'autopilot.process-result-consumed', {
-                    threadId: decision.action.threadId,
-                    processId,
-                    resultArtifact: decision.action.resultArtifact,
-                });
-                if (executor)
+                if (consumed && executor)
                     this.armExecutorContinuation(sessionId, this.deps.policy.executorContinuationBaseMs, executor.threadId, executor.continuationGeneration + 1, {
                         kind: 'processExited',
                         processId,
-                        resultArtifact: decision.action.resultArtifact,
+                        resultArtifact: processAction.resultArtifact,
                     });
                 return true;
             }
             case 'terminateProcess': {
-                const processId = decision.action.processId;
-                const terminated = await controller.terminateProcess(sessionId, decision.action.threadId, processId);
+                const processAction = decision.action;
+                const processId = processAction.processId;
+                const process = executor?.ownedProcesses.find((candidate) => candidate.processId === processId && candidate.ownerThreadId === processAction.threadId);
+                const terminated = process && executor
+                    ? await this.performProcessAction(sessionId, executor, process, 'terminate')
+                    : false;
                 if (terminated)
                     this.audit(sessionId, 'autopilot.process-terminated', {
-                        threadId: decision.action.threadId,
+                        threadId: processAction.threadId,
                         processId,
                         reason: 'resourceBudget',
                     });
-                if (terminated && executor)
-                    this.persistExecutor(sessionId, {
-                        ...executor,
-                        ownedProcesses: executor.ownedProcesses.map((process) => process.processId === processId
-                            ? { ...process, state: 'terminated-for-budget' }
-                            : process),
-                    });
                 if (terminated && executor)
                     this.armExecutorContinuation(sessionId, this.deps.policy.executorContinuationBaseMs, executor.threadId, executor.continuationGeneration + 1, { kind: 'processResourceLimit', processId });
                 else
@@ -1090,12 +1225,9 @@ export class AutopilotCoordinator {
             .activity(sessionId)
             ?.subagents.filter((candidate) => candidate.canonicalPosition === canonicalPosition)
             .sort((left, right) => (right.continuationGeneration ?? 1) - (left.continuationGeneration ?? 1) ||
-            Date.parse(right.lastActivityAt) - Date.parse(left.lastActivityAt))[0];
-        if (!child?.taskPath ||
-            !child.canonicalTaskName ||
-            child.state === 'disconnected' ||
-            child.outcome === 'cancelled' ||
-            child.outcome === 'failed') {
+            Date.parse(right.lastActivityAt) - Date.parse(left.lastActivityAt) ||
+            (left.threadId ?? left.id).localeCompare(right.threadId ?? right.id))[0];
+        if (!child) {
             if (persisted?.canonicalPosition !== canonicalPosition ||
                 persisted.outcome === 'cancelled' ||
                 persisted.outcome === 'failed')
@@ -1107,6 +1239,13 @@ export class AutopilotCoordinator {
                 ownedProcesses: refreshPersistedProcesses(persisted.ownedProcesses, [], this.deps.now()),
             };
         }
+        // A roster entry for a newer generation is authoritative even when that
+        // generation is disconnected. Never fall back to an older persisted
+        // writer; incomplete owner metadata instead fences all continuation.
+        if (!child.taskPath || !child.canonicalTaskName)
+            return undefined;
+        if (child.outcome === 'cancelled' || child.outcome === 'failed')
+            return undefined;
         const activeL2 = step.children.find((candidate) => candidate.state === 'WIP');
         const outcome = classifyExecutorOutcome({
             objectiveComplete: step.state === 'DONE',
@@ -1127,8 +1266,270 @@ export class AutopilotCoordinator {
             continuationCount: persisted?.canonicalPosition === canonicalPosition
                 ? persisted.continuationCount
                 : continuationCount,
+            ...(persisted?.replacement &&
+                (child.continuationGeneration ?? 1) < persisted.replacement.generation
+                ? { replacement: persisted.replacement }
+                : {}),
+            ...(persisted?.replacement &&
+                (child.continuationGeneration ?? 1) >= persisted.replacement.generation
+                ? { resumeFailures: 0 }
+                : persisted?.resumeFailures
+                    ? { resumeFailures: persisted.resumeFailures }
+                    : {}),
+            ...(persisted?.commands ? { commands: persisted.commands } : {}),
         };
     }
+    /** A fresh roster may expose two physical writers for one canonical L1. */
+    async reconcileSplitBrain(sessionId, executor) {
+        const activity = this.deps.activity(sessionId);
+        if (activity?.confidence !== 'fresh')
+            return true;
+        const candidates = activity.subagents.filter((child) => child.canonicalPosition === executor.canonicalPosition);
+        if (candidates.length < 2)
+            return false;
+        if (candidates.some((child) => !child.threadId ||
+            !child.taskPath ||
+            child.canonicalTaskName !== executor.canonicalTaskName ||
+            child.continuationGeneration === undefined)) {
+            this.audit(sessionId, 'autopilot.executor-reconciliation-incomplete', {});
+            return true;
+        }
+        const ordered = [...candidates].sort((left, right) => (right.continuationGeneration ?? 0) - (left.continuationGeneration ?? 0) ||
+            Date.parse(right.lastActivityAt) - Date.parse(left.lastActivityAt) ||
+            (left.threadId ?? left.id).localeCompare(right.threadId ?? right.id));
+        const owner = ordered[0];
+        const obsolete = ordered
+            .slice(1)
+            .filter((child) => child.state === 'working' ||
+            child.state === 'awaitingAgent' ||
+            child.ownedProcesses?.some((process) => process.state === 'running' || process.state === 'detached-active'));
+        const controller = this.deps.executorController;
+        const ownerUnavailable = owner.state === 'disconnected' || owner.outcome === 'cancelled' || owner.outcome === 'failed';
+        if (!obsolete.length) {
+            if (!ownerUnavailable)
+                return false;
+            if (controller)
+                await controller.refresh(sessionId);
+            return true;
+        }
+        if (!controller)
+            return true;
+        for (const child of obsolete) {
+            try {
+                const interrupted = await controller.interrupt(sessionId, child.threadId);
+                this.audit(sessionId, interrupted ? 'autopilot.executor-superseded' : 'autopilot.executor-interrupt-failed', {
+                    ownerThreadId: owner.threadId,
+                    obsoleteThreadId: child.threadId,
+                });
+            }
+            catch {
+                this.audit(sessionId, 'autopilot.executor-interrupt-failed', {
+                    ownerThreadId: owner.threadId,
+                    obsoleteThreadId: child.threadId,
+                });
+            }
+        }
+        await controller.refresh(sessionId);
+        return true;
+    }
+    executorCommand(fence, executor, generation, trigger) {
+        const commandId = createHash('sha256')
+            .update(JSON.stringify([
+            fence.planIdentity,
+            fence.planFingerprint,
+            fence.canonicalPosition,
+            executor.canonicalTaskName,
+            executor.taskPath,
+            fence.executorThreadId,
+            generation,
+            ...(executor.resumeFailures ? [executor.resumeFailures] : []),
+            trigger.kind,
+        ]))
+            .digest('hex');
+        const now = this.deps.now();
+        return {
+            commandId,
+            status: 'scheduled',
+            planIdentity: fence.planIdentity,
+            planFingerprint: fence.planFingerprint,
+            canonicalPosition: fence.canonicalPosition ?? executor.canonicalPosition,
+            canonicalTaskName: executor.canonicalTaskName,
+            taskPath: executor.taskPath,
+            threadId: fence.executorThreadId,
+            generation,
+            ...(executor.resumeFailures ? { attempt: executor.resumeFailures } : {}),
+            trigger: trigger.kind,
+            createdAt: now,
+            updatedAt: now,
+        };
+    }
+    /** Process actions share the durable executor-command journal but carry a process-instance key. */
+    processActionCommand(sessionId, executor, process, kind) {
+        const retained = this.deps.plan(sessionId);
+        const processKey = executorProcessKey(process);
+        const now = this.deps.now();
+        return {
+            commandId: createHash('sha256')
+                .update(JSON.stringify([
+                retained?.identity ?? 'none',
+                retained ? fingerprint(retained.plan) : 'none',
+                executor.canonicalPosition,
+                executor.canonicalTaskName,
+                executor.taskPath,
+                executor.threadId,
+                executor.continuationGeneration,
+                kind,
+                processKey,
+            ]))
+                .digest('hex'),
+            status: 'scheduled',
+            planIdentity: retained?.identity ?? 'none',
+            planFingerprint: retained ? fingerprint(retained.plan) : 'none',
+            canonicalPosition: executor.canonicalPosition,
+            canonicalTaskName: executor.canonicalTaskName,
+            taskPath: executor.taskPath,
+            threadId: executor.threadId,
+            generation: executor.continuationGeneration,
+            // Process work never launches a writer itself; this preserves the command
+            // envelope without conflating it with a continuation prompt.
+            trigger: 'partial',
+            processAction: { kind, processKey },
+            createdAt: now,
+            updatedAt: now,
+        };
+    }
+    processActionCurrent(sessionId, command) {
+        const state = this.deps.store.find(sessionId);
+        const retained = this.deps.plan(sessionId);
+        const executor = state?.executor;
+        const child = this.deps
+            .activity(sessionId)
+            ?.subagents.find((candidate) => (candidate.threadId ?? candidate.id) === command.threadId);
+        if (!state?.requestedEnabled ||
+            !retained ||
+            !executor ||
+            !command.processAction ||
+            retained.identity !== command.planIdentity ||
+            fingerprint(retained.plan) !== command.planFingerprint ||
+            executor.canonicalPosition !== command.canonicalPosition ||
+            executor.canonicalTaskName !== command.canonicalTaskName ||
+            executor.taskPath !== command.taskPath ||
+            executor.threadId !== command.threadId ||
+            executor.continuationGeneration !== command.generation ||
+            child?.canonicalPosition !== command.canonicalPosition ||
+            child?.canonicalTaskName !== command.canonicalTaskName ||
+            (child.continuationGeneration ?? 1) !== command.generation)
+            return null;
+        const process = executor.ownedProcesses.find((candidate) => executorProcessKey(candidate) === command.processAction.processKey);
+        return process ? { state, executor, process } : null;
+    }
+    /**
+     * Records issued before crossing the external boundary. Repeating an issued
+     * action passes the same command id to an idempotent adapter, so a process
+     * loss after the external effect cannot duplicate ownership or consumption.
+     */
+    async performProcessAction(sessionId, executor, process, kind) {
+        const controller = this.deps.executorController;
+        if (!controller)
+            return false;
+        const requested = this.processActionCommand(sessionId, executor, process, kind);
+        const command = this.scheduleExecutorCommand(sessionId, requested);
+        if (!command || ['cancelled', 'superseded'].includes(command.status))
+            return false;
+        if (command.status === 'accepted')
+            return true;
+        const current = this.processActionCurrent(sessionId, command);
+        if (!current) {
+            this.executorCommandTransition(sessionId, command.commandId, 'superseded');
+            return false;
+        }
+        const issued = command.status === 'issued'
+            ? command
+            : this.executorCommandTransition(sessionId, command.commandId, 'issued');
+        if (!issued || issued.status !== 'issued')
+            return false;
+        try {
+            const accepted = kind === 'transfer'
+                ? (await controller.transferProcess(sessionId, current.process.ownerThreadId, current.process.processId, issued.commandId),
+                    true)
+                : kind === 'consume'
+                    ? (await controller.consumeProcess(sessionId, current.process.ownerThreadId, current.process.processId, issued.commandId),
+                        true)
+                    : await controller.terminateProcess(sessionId, current.process.ownerThreadId, current.process.processId, issued.commandId, {
+                        itemId: current.process.itemId,
+                        ...(current.process.osPid === undefined ? {} : { osPid: current.process.osPid }),
+                    });
+            if (!accepted) {
+                this.executorCommandTransition(sessionId, issued.commandId, 'failed');
+                return false;
+            }
+        }
+        catch (error) {
+            // The command remains issued: the same idempotency key is the only retry.
+            this.containOperationFailure(sessionId, error);
+            return false;
+        }
+        const latest = this.processActionCurrent(sessionId, issued);
+        if (!latest) {
+            this.executorCommandTransition(sessionId, issued.commandId, 'superseded');
+            return false;
+        }
+        this.persist({
+            ...latest.state,
+            executor: {
+                ...latest.executor,
+                commands: latest.executor.commands.map((candidate) => candidate.commandId === issued.commandId
+                    ? { ...candidate, status: 'accepted', updatedAt: this.deps.now() }
+                    : candidate),
+                ownedProcesses: latest.executor.ownedProcesses.map((candidate) => executorProcessKey(candidate) !== issued.processAction.processKey
+                    ? candidate
+                    : kind === 'transfer'
+                        ? {
+                            ...candidate,
+                            ownership: 'supervisor',
+                            state: 'detached-active',
+                        }
+                        : kind === 'consume'
+                            ? { ...candidate, state: 'result-consumed' }
+                            : { ...candidate, state: 'terminated-for-budget' }),
+            },
+            updatedAt: this.deps.now(),
+        });
+        return true;
+    }
+    executorCommandTransition(sessionId, commandId, status) {
+        const state = this.deps.store.find(sessionId);
+        const executor = state?.executor;
+        const command = executor?.commands?.find((candidate) => candidate.commandId === commandId);
+        if (!state || !executor || !command || command.status === status)
+            return command;
+        const next = { ...command, status, updatedAt: this.deps.now() };
+        this.persist({
+            ...state,
+            executor: {
+                ...executor,
+                commands: executor.commands.map((candidate) => candidate.commandId === commandId ? next : candidate),
+            },
+            updatedAt: this.deps.now(),
+        });
+        return next;
+    }
+    scheduleExecutorCommand(sessionId, command) {
+        const state = this.deps.store.find(sessionId);
+        const executor = state?.executor;
+        if (!state || !executor)
+            return undefined;
+        const existing = executor.commands?.find((candidate) => candidate.commandId === command.commandId);
+        if (existing)
+            return existing;
+        const commands = [...(executor.commands ?? []), command].slice(-32);
+        this.persist({
+            ...state,
+            executor: { ...executor, commands },
+            updatedAt: this.deps.now(),
+        });
+        return command;
+    }
     persistExecutor(sessionId, executor) {
         const current = this.deps.store.find(sessionId);
         if (!current || JSON.stringify(current.executor) === JSON.stringify(executor))
@@ -1136,6 +1537,40 @@ export class AutopilotCoordinator {
         this.persist({ ...current, executor, updatedAt: this.deps.now() });
         return true;
     }
+    /** Retain stale commands as evidence; they can never regain writer authority. */
+    supersedeExecutorCommands(sessionId, planIdentity, plan, current) {
+        const state = this.deps.store.find(sessionId);
+        const executor = state?.executor;
+        if (!state || !executor?.commands?.length)
+            return false;
+        const planFingerprint = fingerprint(plan);
+        let changed = false;
+        const commands = executor.commands.map((command) => {
+            const ownershipMismatch = Boolean(current) &&
+                (command.canonicalPosition !== current.canonicalPosition ||
+                    command.canonicalTaskName !== current.canonicalTaskName ||
+                    command.taskPath !== current.taskPath ||
+                    command.threadId !== current.threadId);
+            const stale = command.planIdentity !== planIdentity ||
+                command.planFingerprint !== planFingerprint ||
+                ownershipMismatch;
+            if (!stale || !['scheduled', 'issued'].includes(command.status))
+                return command;
+            changed = true;
+            return { ...command, status: 'superseded', updatedAt: this.deps.now() };
+        });
+        if (!changed)
+            return false;
+        this.persist({
+            ...state,
+            executor: { ...executor, commands },
+            updatedAt: this.deps.now(),
+        });
+        this.audit(sessionId, 'autopilot.executor-command-superseded', {
+            count: commands.filter((command) => command.status === 'superseded').length,
+        });
+        return true;
+    }
     wakeForExecutorChange(sessionId, executor) {
         const processes = executor.ownedProcesses;
         const conditions = [
@@ -1150,6 +1585,9 @@ export class AutopilotCoordinator {
         return conditions.some((condition) => this.semanticEvent(sessionId, condition));
     }
     freshExecutorIdentity(sessionId) {
+        const replacement = this.deps.store.find(sessionId)?.executor?.replacement;
+        if (replacement && this.validReplacement(sessionId, replacement))
+            return replacement;
         const plan = this.deps.plan(sessionId)?.plan;
         if (!plan)
             return undefined;
@@ -1164,29 +1602,232 @@ export class AutopilotCoordinator {
             .map((child) => child.continuationGeneration ?? 1) ?? [];
         return executorIdentity(canonicalTaskName, Math.max(0, ...generations) + 1);
     }
+    validReplacement(sessionId, replacement) {
+        const retained = this.deps.plan(sessionId);
+        if (!retained ||
+            retained.identity !== replacement.planIdentity ||
+            fingerprint(retained.plan) !== replacement.planFingerprint)
+            return false;
+        const index = retained.plan.steps.findIndex((step) => step.id === retained.plan.currentStepId || step.state === 'WIP');
+        return index >= 0 && replacement.canonicalPosition === `L${index + 1}`;
+    }
+    /** Converts an exhausted physical executor into one durable root-owned handoff. */
+    scheduleExecutorReplacement(sessionId, executor) {
+        const current = this.deps.store.find(sessionId);
+        const retained = this.deps.plan(sessionId);
+        if (!current?.requestedEnabled || !retained || current.executor?.replacement)
+            return;
+        const identity = executorIdentity(executor.canonicalTaskName, executor.continuationGeneration + 1);
+        const now = this.deps.now();
+        const controlId = this.deps.nextControlId(sessionId, current.generation);
+        const replacement = {
+            ...executor,
+            outcome: 'failed',
+            replacement: {
+                ...identity,
+                planIdentity: retained.identity,
+                planFingerprint: fingerprint(retained.plan),
+            },
+            commands: executor.commands?.map((command) => ['scheduled', 'issued'].includes(command.status)
+                ? { ...command, status: 'superseded', updatedAt: now }
+                : command),
+        };
+        this.arm(sessionId, current.generation, now);
+        this.persist({
+            ...current,
+            state: 'backoff',
+            executor: replacement,
+            nextEvaluationAt: now,
+            lastControlId: controlId,
+            updatedAt: now,
+        }, {
+            sessionId,
+            controlId,
+            status: 'scheduled',
+            createdAt: now,
+            updatedAt: now,
+            failureCode: null,
+        }, [
+            {
+                sessionId,
+                type: 'autopilot.executor-replacement-scheduled',
+                payload: {
+                    canonicalPosition: identity.canonicalPosition,
+                    taskName: identity.taskName,
+                    generation: identity.generation,
+                },
+                occurredAt: now,
+            },
+        ]);
+    }
     armExecutorRefresh(sessionId, delayMs) {
         if (this.executorTimers.has(sessionId))
             return;
+        const state = this.deps.store.find(sessionId);
+        const plan = this.deps.plan(sessionId);
+        const executor = state && plan
+            ? this.currentExecutor(sessionId, plan.plan, state.consecutiveNoProgress, state.executor)
+            : undefined;
+        const fence = state && plan && !this.deps.session(sessionId)?.activeTurnId
+            ? {
+                generation: state.generation,
+                identity: plan.identity,
+                fingerprint: fingerprint(plan.plan),
+                state: state.state,
+                supervision: state.supervision?.outcome ?? null,
+                checkpoint: JSON.stringify(state.checkpoints ?? null),
+                canonicalPosition: executor?.canonicalPosition ?? null,
+                executorThreadId: executor?.threadId ?? null,
+                executorGeneration: executor?.continuationGeneration ?? null,
+            }
+            : null;
+        if (!fence)
+            return;
+        let delivered = false;
         this.executorTimers.set(sessionId, this.deps.schedule(() => {
             this.executorTimers.delete(sessionId);
+            if (delivered) {
+                this.audit(sessionId, 'autopilot.executor-refresh-stale', { fence });
+                return;
+            }
+            delivered = true;
             this.enqueue(sessionId, async () => {
+                const current = this.deps.store.find(sessionId);
+                const currentPlan = this.deps.plan(sessionId);
+                const currentChild = fence.executorThreadId
+                    ? this.deps
+                        .activity(sessionId)
+                        ?.subagents.find((child) => (child.threadId ?? child.id) === fence.executorThreadId)
+                    : null;
+                if (!current?.requestedEnabled ||
+                    this.deps.pendingInteraction(sessionId) ||
+                    current.generation !== fence.generation ||
+                    current.state !== fence.state ||
+                    (current.supervision?.outcome ?? null) !== fence.supervision ||
+                    JSON.stringify(current.checkpoints ?? null) !== fence.checkpoint ||
+                    currentPlan?.identity !== fence.identity ||
+                    !currentPlan ||
+                    fingerprint(currentPlan.plan) !== fence.fingerprint ||
+                    Boolean(this.deps.session(sessionId)?.activeTurnId) ||
+                    (fence.executorThreadId !== null &&
+                        (currentChild?.canonicalPosition !== fence.canonicalPosition ||
+                            (currentChild.continuationGeneration ?? 1) !== fence.executorGeneration))) {
+                    this.audit(sessionId, 'autopilot.executor-refresh-stale', { fence });
+                    return;
+                }
                 await this.deps.executorController?.refresh(sessionId);
                 if (!(await this.enforceSupervisedLifecycle(sessionId, 'processObserved')))
                     this.evaluate(sessionId);
             });
         }, delayMs));
     }
+    /**
+     * A store read can fail after the timer that exposed it has already fired.
+     * This retry deliberately needs no lifecycle read to arm; once the store is
+     * available again, normal evaluation re-establishes a fully fenced timer.
+     */
+    armStoreRecovery(sessionId) {
+        if (this.executorTimers.has(sessionId))
+            return;
+        let delivered = false;
+        const cancel = this.deps.schedule(() => {
+            this.executorTimers.delete(sessionId);
+            if (delivered)
+                return;
+            delivered = true;
+            this.enqueue(sessionId, async () => {
+                const current = this.deps.store.find(sessionId);
+                if (!current?.requestedEnabled)
+                    return;
+                this.evaluate(sessionId);
+            });
+        }, this.deps.policy.executorContinuationMaxMs);
+        this.executorTimers.set(sessionId, cancel);
+    }
     armExecutorContinuation(sessionId, delayMs, threadId, generation, trigger) {
         if (this.executorTimers.has(sessionId))
             return;
+        const state = this.deps.store.find(sessionId);
+        const retained = this.deps.plan(sessionId);
+        const armedChild = this.deps
+            .activity(sessionId)
+            ?.subagents.find((child) => (child.threadId ?? child.id) === threadId);
+        const fence = state && retained
+            ? {
+                sessionGeneration: state.generation,
+                planIdentity: retained.identity,
+                planFingerprint: fingerprint(retained.plan),
+                canonicalPosition: armedChild?.canonicalPosition ?? state.executor?.canonicalPosition ?? null,
+                executorThreadId: threadId,
+                executorGeneration: generation - 1,
+                supervisionOutcome: state.supervision?.outcome ?? null,
+                checkpoint: JSON.stringify(state.checkpoints ?? null),
+                boundaryState: state.state,
+            }
+            : null;
+        if (!fence || this.deps.session(sessionId)?.activeTurnId)
+            return;
+        const commandExecutor = state?.executor;
+        if (!commandExecutor)
+            return;
+        const requested = this.executorCommand(fence, commandExecutor, generation, trigger);
+        const command = this.scheduleExecutorCommand(sessionId, requested);
+        // A command that crossed the durable issue boundary is deliberately not
+        // replayed: app-server acceptance may have happened before a crash.
+        if (!command || command.status !== 'scheduled')
+            return;
+        let delivered = false;
         this.executorTimers.set(sessionId, this.deps.schedule(() => {
             this.executorTimers.delete(sessionId);
+            if (delivered) {
+                this.audit(sessionId, 'autopilot.executor-continuation-stale', {
+                    threadId,
+                    generation,
+                    trigger: trigger.kind,
+                    fence,
+                });
+                return;
+            }
+            delivered = true;
             this.enqueue(sessionId, async () => {
                 const current = this.deps.store.find(sessionId);
-                if (!current?.requestedEnabled || this.deps.pendingInteraction(sessionId))
+                const latestPlan = this.deps.plan(sessionId);
+                const currentChild = this.deps
+                    .activity(sessionId)
+                    ?.subagents.find((child) => (child.threadId ?? child.id) === fence.executorThreadId);
+                const valid = current?.requestedEnabled &&
+                    !this.deps.pendingInteraction(sessionId) &&
+                    current.generation === fence.sessionGeneration &&
+                    current.state === fence.boundaryState &&
+                    (current.supervision?.outcome ?? null) === fence.supervisionOutcome &&
+                    JSON.stringify(current.checkpoints ?? null) === fence.checkpoint &&
+                    !this.deps.session(sessionId)?.activeTurnId &&
+                    latestPlan?.identity === fence.planIdentity &&
+                    latestPlan &&
+                    fingerprint(latestPlan.plan) === fence.planFingerprint &&
+                    currentChild?.canonicalPosition === fence.canonicalPosition &&
+                    (currentChild.continuationGeneration ?? 1) === fence.executorGeneration;
+                if (!valid) {
+                    const ownershipChanged = latestPlan?.identity !== fence.planIdentity ||
+                        !latestPlan ||
+                        fingerprint(latestPlan.plan) !== fence.planFingerprint ||
+                        currentChild?.canonicalPosition !== fence.canonicalPosition ||
+                        (currentChild.continuationGeneration ?? 1) !== fence.executorGeneration;
+                    this.executorCommandTransition(sessionId, command.commandId, ownershipChanged ? 'superseded' : 'cancelled');
+                    this.audit(sessionId, 'autopilot.executor-continuation-stale', {
+                        threadId,
+                        generation,
+                        trigger: trigger.kind,
+                        fence,
+                    });
+                    return;
+                }
+                const issued = this.executorCommandTransition(sessionId, command.commandId, 'issued');
+                if (issued?.status !== 'issued')
                     return;
                 try {
                     await this.deps.executorController?.resume(sessionId, threadId, generation, trigger);
+                    this.executorCommandTransition(sessionId, command.commandId, 'accepted');
                     this.audit(sessionId, 'autopilot.executor-resumed', {
                         threadId,
                         generation,
@@ -1213,8 +1854,30 @@ export class AutopilotCoordinator {
                             updatedAt: this.deps.now(),
                         });
                 }
-                catch {
-                    this.armExecutorRefresh(sessionId, this.deps.policy.executorContinuationMaxMs);
+                catch (error) {
+                    // Only an explicit app-server rejection is safe to retry. A lost
+                    // response may conceal accepted work, so retain its issued fence.
+                    if (!explicitExecutorRejection(error)) {
+                        this.containOperationFailure(sessionId, error);
+                        this.armExecutorRefresh(sessionId, this.deps.policy.executorContinuationMaxMs);
+                        return;
+                    }
+                    this.executorCommandTransition(sessionId, command.commandId, 'failed');
+                    const latest = this.deps.store.find(sessionId);
+                    const failedExecutor = latest?.executor;
+                    if (!latest?.requestedEnabled || !failedExecutor)
+                        return;
+                    const resumeFailures = (failedExecutor.resumeFailures ?? 0) + 1;
+                    const next = {
+                        ...latest,
+                        executor: { ...failedExecutor, resumeFailures },
+                        updatedAt: this.deps.now(),
+                    };
+                    this.persist(next);
+                    if (resumeFailures >= this.deps.policy.retryLimit)
+                        this.scheduleExecutorReplacement(sessionId, next.executor);
+                    else
+                        this.armExecutorRefresh(sessionId, this.deps.policy.executorContinuationMaxMs);
                 }
             });
         }, delayMs));
@@ -1405,6 +2068,10 @@ export class AutopilotCoordinator {
     }
     progressKey(sessionId) {
         const retained = this.deps.plan(sessionId);
+        const state = this.deps.store.find(sessionId);
+        return this.progressKeyFor(sessionId, state, retained);
+    }
+    progressKeyFor(sessionId, state, retained) {
         const activity = this.deps.activity(sessionId);
         const interactions = this.deps.pendingInteraction(sessionId)
             ? [{ id: 'pending', kind: 'session', state: 'pending' }]
@@ -1417,18 +2084,32 @@ export class AutopilotCoordinator {
             },
             review: { status: null },
             checkpoint: {
-                pendingTurnId: this.deps.store.find(sessionId)?.checkpoints?.pendingTurnId ?? null,
-                terminalReviewAccepted: this.deps.store.find(sessionId)?.checkpoints?.terminalReviewAccepted ?? false,
+                pendingTurnId: state?.checkpoints?.pendingTurnId ?? null,
+                terminalReviewAccepted: state?.checkpoints?.terminalReviewAccepted ?? false,
             },
             pendingInteractions: interactions,
             executor: {
-                generation: this.deps.store.find(sessionId)?.executor?.continuationGeneration ?? 0,
-                state: this.deps.store.find(sessionId)?.executor?.outcome ?? null,
+                generation: state?.executor?.continuationGeneration ?? 0,
+                state: state?.executor?.outcome ?? null,
             },
-            ownedProcesses: (this.deps.store.find(sessionId)?.executor?.ownedProcesses ?? []).map((process) => ({
+            ownedProcesses: (state?.executor?.ownedProcesses ?? []).map((process) => ({
                 id: process.processId,
                 state: process.state,
-                ownerGeneration: this.deps.store.find(sessionId)?.executor?.continuationGeneration ?? 0,
+                ownerGeneration: state?.executor?.continuationGeneration ?? 0,
+            })),
+            childActivity: (activity?.subagents ?? []).map((child) => ({
+                id: child.id,
+                threadId: child.threadId ?? null,
+                taskName: child.canonicalTaskName ?? null,
+                position: child.canonicalPosition ?? null,
+                generation: child.continuationGeneration ?? 0,
+                state: child.state,
+                outcome: child.outcome ?? null,
+                ownedProcesses: (child.ownedProcesses ?? []).map((process) => ({
+                    id: process.processId,
+                    state: process.state,
+                    ownership: process.ownership,
+                })),
             })),
             agentActivity: [
                 ...(activity
@@ -1485,16 +2166,142 @@ export class AutopilotCoordinator {
     }
     enqueue(sessionId, operation) {
         const previous = this.operations.get(sessionId);
-        // Start the first operation synchronously through its pre-await safety
-        // checks; later operations serialize behind it for this session.
-        const next = previous ? previous.catch(() => undefined).then(operation) : operation();
+        // Every asynchronous boundary settles locally. In particular, do not
+        // discard the promise returned by finally(): that would turn a rejected
+        // controller, store, or publisher call into an unhandled rejection and
+        // poison the next serial operation.
+        const run = async () => {
+            try {
+                await operation();
+            }
+            catch (error) {
+                this.containOperationFailure(sessionId, error);
+            }
+        };
+        const next = previous ? previous.then(run, run) : run();
         this.operations.set(sessionId, next);
-        void next.finally(() => {
+        void next.then(() => {
+            if (this.operations.get(sessionId) === next)
+                this.operations.delete(sessionId);
+        }, () => {
+            // run() contains failures, but retain a rejection observer as a final
+            // guard if a future containment change itself becomes asynchronous.
             if (this.operations.get(sessionId) === next)
                 this.operations.delete(sessionId);
         });
         return next;
     }
+    /**
+     * Converts an unexpected queued-operation failure into one opaque durable
+     * recovery outcome. The recovery path deliberately avoids publish(): an
+     * outbox publication failure must not recursively manufacture another
+     * rejected promise before a later journal flush can replay the event.
+     */
+    containOperationFailure(sessionId, error) {
+        const code = operationFailureCode(error);
+        try {
+            this.deps.diagnostic?.(sessionId, `operationFailed:${code}`);
+        }
+        catch {
+            // Diagnostics are advisory and cannot compromise queue liveness.
+        }
+        let current = null;
+        try {
+            current = this.deps.store.find(sessionId);
+        }
+        catch {
+            try {
+                this.armStoreRecovery(sessionId);
+            }
+            catch {
+                try {
+                    this.deps.diagnostic?.(sessionId, `operationRecoveryUnavailable:${code}`);
+                }
+                catch {
+                    // A later external lifecycle input may retry after both dependencies recover.
+                }
+            }
+            return;
+        }
+        if (!current?.requestedEnabled)
+            return;
+        const now = this.deps.now();
+        const recovery = {
+            ...current,
+            state: 'monitoring',
+            generation: current.generation + 1,
+            nextEvaluationAt: null,
+            stopReason: 'reconcileFailed',
+            updatedAt: now,
+        };
+        try {
+            this.commit({
+                state: recovery,
+                events: [
+                    {
+                        sessionId,
+                        type: 'autopilot.operation-failed',
+                        payload: { code },
+                        occurredAt: now,
+                    },
+                ],
+            });
+        }
+        catch {
+            // A failing persistence adapter has no durable surface available in this
+            // process. Its observable diagnostic is deliberately independent of
+            // that adapter; retain one bounded runtime recovery rather than treating
+            // a failed write as if the operation had safely settled.
+            try {
+                this.armExecutorRefresh(sessionId, this.deps.policy.executorContinuationMaxMs);
+            }
+            catch {
+                try {
+                    this.deps.diagnostic?.(sessionId, `operationRecoveryUnavailable:${code}`);
+                }
+                catch {
+                    // The queue itself remains settled for a future external event.
+                }
+            }
+            return;
+        }
+        try {
+            this.armExecutorRefresh(sessionId, this.deps.policy.executorContinuationMaxMs);
+        }
+        catch {
+            // Scheduling is the last recovery capability. If it is unavailable,
+            // leave a safe terminal state rather than claim enabled supervision with
+            // no reachable continuation.
+            try {
+                this.commit({
+                    state: {
+                        ...recovery,
+                        state: 'safetyPaused',
+                        requestedEnabled: false,
+                        stopReason: 'safetyPaused',
+                        updatedAt: this.deps.now(),
+                    },
+                    events: [
+                        {
+                            sessionId,
+                            type: 'autopilot.operation-recovery-unavailable',
+                            payload: { code },
+                            occurredAt: this.deps.now(),
+                        },
+                    ],
+                });
+            }
+            catch {
+                // There is no additional in-process action that can safely restore a
+                // failed store and scheduler; importantly the serial queue remains
+                // settled for a future external recovery event.
+            }
+        }
+    }
+}
+function explicitExecutorRejection(error) {
+    return (error instanceof Error &&
+        ['AUTOPILOT_EXECUTOR_UNAVAILABLE', 'AUTOPILOT_EXECUTOR_REJECTED'].includes(error.message));
 }
 function startFailureCode(error) {
     const code = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'
@@ -1506,6 +2313,19 @@ function startFailureCode(error) {
         ? 'START_UNAVAILABLE'
         : 'START_FAILED';
 }
+/** Keep failure telemetry bounded and free of prompts, paths, and error prose. */
+function operationFailureCode(error) {
+    const code = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'
+        ? error.code
+        : error instanceof Error
+            ? error.message
+            : '';
+    if (/PERSIST|SQLITE|DATABASE|STORE/i.test(code))
+        return 'PERSISTENCE';
+    if (/PUBLISH|OUTBOX|JOURNAL/i.test(code))
+        return 'PUBLICATION';
+    return 'OPERATION';
+}
 function fingerprint(plan) {
     return JSON.stringify(plan.steps.map((step) => [
         step.id,
@@ -1514,12 +2334,22 @@ function fingerprint(plan) {
         step.children.map((child) => [child.id, child.state]),
     ]));
 }
+function boundedUnique(values, limit) {
+    return [...new Set(values)].slice(-limit);
+}
+function boundEpochs(epochs, currentTarget) {
+    const current = epochs.find((entry) => entry.target === currentTarget);
+    const retained = epochs
+        .filter((entry) => entry.target !== currentTarget)
+        .sort((left, right) => left.target.localeCompare(right.target));
+    return [...retained.slice(0, current ? 639 : 640), ...(current ? [current] : [])].sort((left, right) => left.target.localeCompare(right.target));
+}
 function refreshPersistedProcesses(persisted, observed, now) {
     if (!observed.length)
         return persisted;
-    const priorById = new Map(persisted.map((process) => [process.processId, process]));
+    const priorById = new Map(persisted.map((process) => [executorProcessKey(process), process]));
     return observed.map((process) => {
-        const prior = priorById.get(process.processId);
+        const prior = priorById.get(executorProcessKey(process));
         if (!prior)
             return process;
         const observedAt = prior.observedAt;
@@ -1528,9 +2358,21 @@ function refreshPersistedProcesses(persisted, observed, now) {
             observedAt,
             elapsedMs: Math.max(process.elapsedMs, Date.parse(now) - Date.parse(observedAt)),
             ownership: prior.ownership === 'supervisor' ? 'supervisor' : process.ownership,
-            state: prior.ownership === 'supervisor' && process.state === 'running'
-                ? 'detached-active'
-                : process.state,
+            state: prior.state === 'result-consumed' || prior.state === 'terminated-for-budget'
+                ? prior.state
+                : prior.ownership === 'supervisor' && process.state === 'running'
+                    ? 'detached-active'
+                    : process.state,
         };
     });
 }
+/** A numeric OS PID or process id alone can be reused by a later child operation. */
+function executorProcessKey(process) {
+    return JSON.stringify([
+        process.ownerThreadId,
+        process.ownerTaskPath,
+        process.processId,
+        process.itemId,
+        process.osPid ?? null,
+    ]);
+}