pi-daddy 0.19.0 → 0.20.0

package/extensions/delegate-chain.ts

@@ -19,126 +19,41 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import type { InheritableApproval } from "../src/approval.ts";
-import { DELEGATE_SUBJECT, shouldSeekApproval } from "../src/approval.ts";
-import { chainStepSpec, PLACEHOLDER, type ChainStep } from "../src/chain.ts";
-import { planDelegation } from "../src/delegate.ts";
+import { DELEGATE_SUBJECT } from "../src/approval.ts";
+import { chainStepSpec, PLACEHOLDER } from "../src/chain.ts";
 import { MAX_CHAIN_STEPS, childSpawnId, splitBudget } from "../src/fanout.ts";
 import { PAINT_INTERVAL_MS, appendTail, emptyTail, renderProgress, replaceTail, throttle, type ChildProgress } from "../src/progress.ts";
-import type { Capability } from "../src/resolve.ts";
 import { recordChainRefusal } from "./chain-ledger.ts";
-import { obtainApprovals, snapshotOf } from "./approvals.ts";
+import { obtainApprovals, snapshotOf, type ApprovalOutcome } from "./approvals.ts";
 import { runOneDelegation } from "./run-delegation.ts";
 import { isCriticalAssuranceBlock } from "./execute-child.ts";
 import type { GrantsSession } from "./session.ts";
 import { GovernanceRefusal, refusal, type StructuredRefusal } from "../src/refusals.ts";
 import { chainApprovalFacts, newChainApprovalAudit, rememberChainApproval } from "./chain-approval-facts.ts";
+import { newExecutionId } from "../src/execution-id.ts";
+import { planChain, type GateRequest } from "./chain-plan.ts";
 
-/** One step of a chain, as the model describes it. */
-type StepSpec = ChainStep;
-
-/**
- * One dialog's worth of gate: a single capability, for a single subject, described by the step that needs it.
- *
- * **One request per `capability@subject`, not per subject.** Grouping by subject alone merged every `tools:`-only
- * step under the constant `<delegate>` and froze the *first* step's task into the dialog — so an operator approved
- * `tool:write` while reading a task that only listed files. The dialog is the one place a human learns what they are
- * authorising, so it names the step that actually needs the capability.
- */
-interface GateRequest {
-  subject: string;
-  /** `"definition"` offers `always`; `"delegate"` must not (ADR-0019). Derived from the subject, never assumed. */
-  path: "definition" | "delegate";
-  capability: Capability;
-  /** The task of the step that needs this capability. */
-  task: string;
-  stepIndex: number;
-  plan: ReturnType<typeof planDelegation>;
-}
-
-/** Either every gate the chain will hit, or the first step that can never run and why. */
-interface ChainPlan {
-  requests: GateRequest[];
-  /** Exact approval keys each step would spend, including duplicate subjects across steps. */
-  uses: Map<number, Set<string>>;
-  /** Set when a step is refused for a reason no approval can fix. The chain must refuse before asking anyone. */
-  doomed?: { step: number; reason: string; plan: ReturnType<typeof planDelegation>; agent?: string; refusal?: StructuredRefusal };
-}
-
-/**
- * Plan every step and collect the gates — or find a step that can never run.
- *
- * **`plan.ok` is honoured here, and ignoring it was a privilege path.** The first version read only
- * `gatedBlocked`, so a step refused for an unheld `agent:` id, an unknown definition, an empty task or a universal
- * capability still raised its gate and the answer was still banked. Measured: `delegate({tools:["bash","agent:x"]})`
- * asks nobody and refuses, while the same step inside a chain raised a dialog, took *Allow for this session*, refused
- * anyway — and left `tool:bash` pre-approved for every later delegation in the session. On the `agent:` path it
- * banked a **30-day** entry, including for a step whose task was whitespace, whose dialog therefore read `task:`
- * followed by nothing.
- *
- * `shouldSeekApproval` is the rule every other gate in this package already applies, and its own docstring names
- * this hazard: *"both banked against a spawn that never happened, and both reachable by a model that appends one
- * unheld capability to an otherwise ordinary request."* The chain reimplemented the decision beside it instead of
- * routing through it. So a doomed step now refuses the whole chain **before any dialog**, which is the same
- * principle the executor check follows.
- *
- * Planned with no UI: `planWithApprovals` would open a dialog per step during the very phase whose purpose is to ask
- * upfront. A step's task is unknown for everything after the first, which is fine — an approval key never contains
- * the task (ADR-0021), so the set of gates is fully determined without it.
- */
-async function planChain(session: GrantsSession, steps: StepSpec[], perStepBudget: number): Promise<ChainPlan> {
-  const requests: GateRequest[] = [];
-  const uses = new Map<number, Set<string>>();
-  const seen = new Set<string>();
-  const context = await session.delegationContext();
-
-  for (const [index, step] of steps.entries()) {
-    // The real task, not a placeholder: the planner's own empty-task guard must run here rather than at spawn time,
-    // or a step with a whitespace task raises a dialog and is refused afterwards. The handoff is absent at planning
-    // time and cannot change which capabilities are gated.
-    const plan = planDelegation(
-      {
-        task: step.task,
-        agent: step.agent,
-        tools: step.tools,
-        model: step.model,
-        correlation: step.workspace
-          ? { ...(step.correlation ?? {}), workspace_id: step.workspace.workspace_id }
-          : step.correlation,
-        // Routing spec, not the model's correlation claim — see R-110 in `src/correlation.ts`.
-        boundWorkspaceId: step.workspace?.workspace_id,
-        boundContextId: step.correlation?.context_id,
-      },
-      { ...context, spawnId: session.ownSpawnId, childSpawnId: childSpawnId(session.ownSpawnId, index) },
-    );
-
-    // A gate is the ONLY refusal an approval can lift. Anything else is doomed, and asking about it banks authority
-    // for a spawn that will never happen.
-    if (!plan.ok && !shouldSeekApproval(plan.result)) {
-      return {
-        requests: [], uses, doomed: {
-          step: index + 1, reason: plan.reason ?? "this step cannot run", plan, agent: step.agent,
-          ...(plan.refusal ? { refusal: plan.refusal } : {}),
-        },
-      };
-    }
-
-    // A correlated approval is bound to the exact task. Step N's final task does not exist until step N-1
-    // finishes, so asking upfront would bind the template and then spend it on different instructions.
-    // Legacy chains keep their upfront dialogs; correlated steps gate when their composed task exists.
-    if (plan.approvalBinding) continue;
-
-    const subject = step.agent ?? DELEGATE_SUBJECT;
-    uses.set(index, new Set(plan.result.gatedBlocked.map((capability) => `${capability}@${subject}`)));
-    for (const capability of plan.result.gatedBlocked) {
-      const key = `${capability}@${subject}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      requests.push({
-        subject, path: step.agent ? "definition" : "delegate", capability, task: step.task, stepIndex: index, plan,
-      });
-    }
-  }
-  return { requests, uses };
+/** One chain step is one execution occurrence, however many capability dialogs contributed to its answer. */
+function mergeGateOutcomes(outcomes: readonly ApprovalOutcome[]): ApprovalOutcome {
+  const merged = {
+    approved: [...new Set(outcomes.flatMap((outcome) => outcome.approved))],
+    sources: Object.assign({}, ...outcomes.map((outcome) => outcome.sources)),
+    scopes: Object.assign({}, ...outcomes.map((outcome) => outcome.scopes)),
+    recordedScopes: Object.assign({}, ...outcomes.map((outcome) => outcome.recordedScopes)),
+    bindings: Object.assign({}, ...outcomes.map((outcome) => outcome.bindings)),
+    expiresAt: Object.assign({}, ...outcomes.map((outcome) => outcome.expiresAt)),
+    uses: Object.assign({}, ...outcomes.map((outcome) => outcome.uses)),
+    humanDenied: outcomes.some((outcome) => outcome.humanDenied),
+  } satisfies ApprovalOutcome;
+  const last = outcomes.findLast((outcome) => outcome.gateOutcome !== undefined);
+  const banked = outcomes.flatMap((outcome) => outcome.banked ?? []);
+  return {
+    ...merged,
+    ...(last?.gateOutcome ? { gateOutcome: last.gateOutcome } : {}),
+    ...(last?.refusalCode ? { refusalCode: last.refusalCode } : {}),
+    ...(last?.reason ? { reason: last.reason } : {}),
+    ...(banked.length > 0 ? { banked } : {}),
+  };
 }
 
 export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): void {
@@ -209,12 +124,15 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
 
       // Plan every step first. A step that can never run refuses the chain HERE, before anyone is asked — see
       // `planChain`.
-      const chainPlan = await planChain(session, steps, split.perChild);
+      const executionIds = steps.map(() => newExecutionId());
+      const parentExecutionId = session.ownExecutionId ?? null;
+      const chainPlan = await planChain(session, steps, executionIds);
       if (chainPlan.doomed) {
         const message = `chain refused at step ${chainPlan.doomed.step}: ${chainPlan.doomed.reason} No step ran, and nobody was ` +
           `asked to approve anything — a step that cannot run must not bank authority for a spawn that will never happen.`;
         await recordChainRefusal({
           session, plan: chainPlan.doomed.plan, stepIndex: chainPlan.doomed.step - 1,
+          executionId: executionIds[chainPlan.doomed.step - 1], parentExecutionId,
           agent: chainPlan.doomed.agent, reason: message, refusal: chainPlan.doomed.refusal,
         });
         if (chainPlan.doomed.refusal) throw new GovernanceRefusal({ ...chainPlan.doomed.refusal, message });
@@ -255,16 +173,29 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
         const message = `chain refused: ${request.capability} was not approved for ${request.subject}, so no step ran. A chain ` +
           `is gated as a unit — running only its approved steps would return a partial result that reads like a complete one.`;
         const structured = outcome.refusalCode ? refusal(outcome.refusalCode, message) : undefined;
+        const decisions = new Map<number, { request: GateRequest; outcomes: ApprovalOutcome[]; refusal?: typeof structured }>();
         for (const approved of approvedDecisions) {
+          const decision = decisions.get(approved.request.stepIndex) ?? {
+            request: approved.request,
+            outcomes: [],
+          };
+          decision.outcomes.push(approved.outcome);
+          decisions.set(approved.request.stepIndex, decision);
+        }
+        const deniedDecision = decisions.get(request.stepIndex) ?? { request, outcomes: [] };
+        deniedDecision.request = request;
+        deniedDecision.outcomes.push(outcome);
+        deniedDecision.refusal = structured;
+        decisions.set(request.stepIndex, deniedDecision);
+
+        for (const [stepIndex, decision] of [...decisions].sort(([left], [right]) => left - right)) {
           await recordChainRefusal({
-            session, plan: approved.request.plan, stepIndex: approved.request.stepIndex,
-            agent: steps[approved.request.stepIndex]?.agent, reason: message, approval: approved.outcome,
+            session, plan: decision.request.plan, stepIndex,
+            executionId: executionIds[stepIndex], parentExecutionId,
+            agent: steps[stepIndex]?.agent, reason: message, refusal: decision.refusal,
+            approval: mergeGateOutcomes(decision.outcomes),
           });
         }
-        await recordChainRefusal({
-          session, plan: request.plan, stepIndex: request.stepIndex, agent: steps[request.stepIndex]?.agent,
-          reason: message, refusal: structured, approval: outcome,
-        });
         if (structured) throw new GovernanceRefusal(structured);
         throw new Error(message);
       }
@@ -276,9 +207,13 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
         tail: emptyTail,
       }));
       const paint = throttle(() => {
-        (onUpdate as ((partial: { content: Array<{ type: "text"; text: string }> }) => void) | undefined)?.({
-          content: [{ type: "text", text: renderProgress(children, session.executor.kind, Date.now()) }],
-        });
+        try {
+          (onUpdate as ((partial: { content: Array<{ type: "text"; text: string }> }) => void) | undefined)?.({
+            content: [{ type: "text", text: renderProgress(children, session.executor.kind, Date.now()) }],
+          });
+        } catch {
+          // Display only: a broken partial-result sink must not become a child cancellation mechanism.
+        }
       }, PAINT_INTERVAL_MS);
 
       const outcomes: Array<{
@@ -310,7 +245,12 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
         const outcome = await runOneDelegation(
           session,
           chainStepSpec(step, previous),
-          { parentId: session.ownSpawnId, childId },
+          {
+            parentId: session.ownSpawnId,
+            childId,
+            executionId: executionIds[index],
+            parentExecutionId,
+          },
           split.perChild,
           ctx,
           signal,
@@ -331,6 +271,7 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
             },
             // Provenance: which child's output composed THIS step's task (ADR-0033). Absent for step 1.
             taskFrom: index === 0 ? undefined : childSpawnId(session.ownSpawnId, index - 1),
+            taskFromExecutionId: index === 0 ? undefined : executionIds[index - 1],
           },
         );
 

package/extensions/delegation-ledger.ts

@@ -0,0 +1,60 @@
+import type { Delegation } from "../src/delegate.ts";
+import { appendRecord, buildRecord } from "../src/ledger.ts";
+import type { ApprovalOutcome } from "./approvals.ts";
+import type { ExecutionOccurrenceIds } from "./execution-occurrence.ts";
+import type { GrantsSession } from "./session.ts";
+
+export type ApprovalLedgerFacts = Pick<
+  ApprovalOutcome,
+  "approved" | "sources" | "scopes" | "expiresAt" | "uses" | "humanDenied"
+>;
+
+/**
+ * The load-bearing capability decision append. Kept in one function so every delegation form writes the
+ * same unique identity, approval provenance, trusted digests and refusal facts before a child can start.
+ */
+export async function recordDelegationDecision(input: {
+  session: GrantsSession;
+  plan: Delegation;
+  ids: ExecutionOccurrenceIds;
+  agent?: string;
+  taskFrom?: string;
+  taskFromExecutionId?: string;
+  approval?: ApprovalOutcome;
+  approvalFacts?: ApprovalLedgerFacts;
+}): Promise<void> {
+  const ledgerPath = input.session.ledgerPath;
+  if (!ledgerPath) return;
+  const { session, plan, ids, approval, approvalFacts } = input;
+  await appendRecord(
+    { path: ledgerPath, strict: true },
+    buildRecord({
+      executionId: ids.executionId,
+      parentExecutionId: ids.parentExecutionId,
+      parentId: ids.parentId,
+      childId: ids.childId,
+      depth: plan.childDepth,
+      agentType: input.agent ?? "delegate",
+      executor: session.executor.kind,
+      taskFrom: input.taskFrom,
+      taskFromExecutionId: input.taskFromExecutionId,
+      requested: plan.requested,
+      parentGrant: session.ownGrant,
+      result: plan.result,
+      blocked: !plan.ok,
+      reason: plan.reason,
+      approved: approval?.approved ?? approvalFacts?.approved,
+      approvalSources: approval?.sources ?? approvalFacts?.sources,
+      approvalScopes: approval?.recordedScopes ?? approvalFacts?.scopes,
+      approvalExpiresAt: approval?.expiresAt ?? approvalFacts?.expiresAt,
+      approvalUses: approval?.uses ?? approvalFacts?.uses,
+      humanDenied: approval?.humanDenied ?? approvalFacts?.humanDenied,
+      gateOutcome: approval?.gateOutcome,
+      definitionDigest: plan.definitionDigest,
+      taskDigest: plan.taskDigest,
+      correlation: plan.correlation,
+      refusal: plan.refusal,
+      now: new Date(),
+    }),
+  );
+}

package/extensions/delegation.ts

@@ -12,15 +12,9 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { maySpawnDefinition } from "../src/delegate.ts";
-import { MAX_CHILDREN_PER_CALL, childSpawnId, splitBudget } from "../src/fanout.ts";
+import { MAX_CHILDREN_PER_CALL, splitBudget } from "../src/fanout.ts";
 import {
-  PAINT_INTERVAL_MS,
-  appendTail,
-  emptyTail,
-  renderProgress,
-  replaceTail,
-  throttle,
-  type ChildProgress,
+  PAINT_INTERVAL_MS, appendTail, emptyTail, renderProgress, replaceTail, throttle, type ChildProgress,
 } from "../src/progress.ts";
 import { registerChainTool } from "./delegate-chain.ts";
 import { GovernanceRefusal, refusal } from "../src/refusals.ts";
@@ -33,6 +27,7 @@ import {
 } from "./fanout-outcome.ts";
 import { isCriticalAssuranceBlock, type DelegationOutcome } from "./execute-child.ts";
 import { type GrantsSession } from "./session.ts";
+import { newDelegationOccurrence } from "./execution-occurrence.ts";
 
 /**
  * Wire a set of children to pi's partial-result channel — ADR-0032.
@@ -61,9 +56,14 @@ function progressReporter(
   }));
 
   const paint = throttle(() => {
-    onUpdate?.({
-      content: [{ type: "text", text: renderProgress(children, session.executor.kind, Date.now()) }],
-    });
+    try {
+      onUpdate?.({
+        content: [{ type: "text", text: renderProgress(children, session.executor.kind, Date.now()) }],
+      });
+    } catch {
+      // Display only. In particular, this callback can run inside runChild's security-sensitive onSpawn;
+      // letting it escape makes runChild kill an otherwise healthy governed child.
+    }
   }, PAINT_INTERVAL_MS);
 
   return {
@@ -256,7 +256,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
           correlation: params.correlation,
           workspace: params.workspace,
         },
-        { parentId: session.ownSpawnId, childId: childSpawnId(session.ownSpawnId, 0) },
+        newDelegationOccurrence(session, 0),
         // A single blocking delegation spends nothing from the subtree budget: cardinality is already
         // bounded to one by the call being blocking, which is the accident fan-out removes. Passing the
         // budget through unchanged means a child can still fan out with what this session was given.
@@ -338,7 +338,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
           try {
             return await runOneDelegation(
               session, child,
-              { parentId: session.ownSpawnId, childId: childSpawnId(session.ownSpawnId, index) },
+              newDelegationOccurrence(session, index),
               split.perChild, ctx, signal, { onProgress: progress.sink(index) },
             );
           } catch (error) {

package/extensions/execute-child.ts

@@ -2,7 +2,7 @@ import type { Delegation } from "../src/delegate.ts";
 import { appendLedgerEvent, buildChildLifecycleEvent } from "../src/ledger.ts";
 import { mergeChildEnv } from "../src/propagation.ts";
 import type { Capability } from "../src/resolve.ts";
-import { ENV_CHILD_TIMEOUT, runChild, timeoutFromEnv } from "../src/run-child.ts";
+import { DEFAULT_KILL_GRACE_MS, ENV_CHILD_TIMEOUT, runChild, timeoutFromEnv } from "../src/run-child.ts";
 import { resolveWorkspace } from "../src/herdr-cli.ts";
 import { HerdrWriterCloseError, runHerdrPane } from "../src/run-herdr.ts";
 import { GovernanceRefusal, refusal, type StructuredRefusal } from "../src/refusals.ts";
@@ -45,12 +45,20 @@ export function isCriticalAssuranceBlock(
   return outcome.text.trimStart().startsWith("BLOCKED_CRITICAL_ASSURANCE");
 }
 
+export async function appendAfterRuntimeRecord<T>(
+  runtimeRecord: Promise<void> | undefined,
+  appendTerminal: () => Promise<T>,
+): Promise<T> {
+  if (runtimeRecord) await runtimeRecord;
+  return appendTerminal();
+}
+
 export interface ChildProgressUpdate {
   chunk?: string;
   snapshot?: string[];
   paneId?: string;
   agentName?: string;
-  state?: "running" | "completed" | "failed";
+  state?: "starting" | "running" | "completed" | "failed";
 }
 
 /**
@@ -68,30 +76,46 @@ export async function executePlannedChild(input: {
   plan: Delegation;
   agent?: string;
   childId: string;
+  executionId: string;
+  parentExecutionId: string | null;
   cwd: string;
   preparedWorkspace?: PreparedWorkspace;
   signal?: AbortSignal;
   onProgress?: (update: ChildProgressUpdate) => void;
 }): Promise<DelegationOutcome> {
-  const { session, plan, childId, preparedWorkspace, signal, onProgress } = input;
-  if (session.ledgerPath) {
+  const { session, plan, childId, executionId, parentExecutionId, preparedWorkspace, signal, onProgress } = input;
+  const ledgerPath = session.ledgerPath;
+  const configuredTimeoutMs = timeoutFromEnv(process.env[ENV_CHILD_TIMEOUT]);
+  const startedAt = new Date();
+  const deadlineAt = new Date(startedAt.getTime() + configuredTimeoutMs).toISOString();
+  if (ledgerPath) {
     try {
       await appendLedgerEvent(
-        { path: session.ledgerPath, strict: true },
+        { path: ledgerPath, strict: true },
         buildChildLifecycleEvent({
+          executionId,
+          parentExecutionId,
           childId,
           state: "starting",
           executor: session.executor.kind,
+          deadlineAt,
           correlation: plan.correlation,
-          now: new Date(),
+          now: startedAt,
         }),
       );
     } catch (error) {
-      await releaseDelegationWorkspace({ prepared: preparedWorkspace, childId, reason: "ledger-failed" });
+      await releaseDelegationWorkspace({
+        prepared: preparedWorkspace, childId, executionId, parentExecutionId, reason: "ledger-failed",
+      });
       throw error;
     }
   }
 
+  // The recorded deadline and executor timer are one fact. Waiting for the strict starting append consumes
+  // the budget; handing the child a fresh full timeout would leave it live after the dashboard truthfully
+  // marked that deadline incomplete.
+  const remainingTimeoutMs = Math.max(1, Date.parse(deadlineAt) - Date.now());
+  const terminationGraceMs = Math.min(DEFAULT_KILL_GRACE_MS, Math.max(1, Math.floor(remainingTimeoutMs / 10)));
   const cwd = preparedWorkspace?.workspace.root ?? input.cwd;
   const leaseAbort = new AbortController();
   const writerLease = preparedWorkspace?.lease.access === "write" ? preparedWorkspace.lease : undefined;
@@ -107,6 +131,26 @@ export async function executePlannedChild(input: {
   let retainWriterLease = false;
   let terminalAttempted = false;
   const teardownFailures: string[] = [];
+  let runtimeRecord: Promise<void> | undefined;
+  const recordRunning = (executor: "process" | "herdr", pane?: { id: string; agentName: string }): void => {
+    if (!ledgerPath) return;
+    try {
+      runtimeRecord = appendLedgerEvent(
+        {
+          path: ledgerPath,
+          strict: false,
+          onFailure: (cause) => teardownFailures.push(`child runtime identity record failed: ${String(cause)}`),
+        },
+        buildChildLifecycleEvent({
+          executionId, parentExecutionId, childId, state: "running", executor, deadlineAt,
+          ...(pane ? { herdrPaneId: pane.id, herdrAgentName: pane.agentName } : {}),
+          correlation: plan.correlation, now: new Date(),
+        }),
+      );
+    } catch (error) {
+      teardownFailures.push(`child runtime identity record failed: ${String(error)}`);
+    }
+  };
   try {
     const output = session.executor.kind === "herdr"
       ? await runHerdrPane({
@@ -117,10 +161,16 @@ export async function executePlannedChild(input: {
           name: `${input.agent ?? "delegate"}-${childId}`,
           workspace: resolveWorkspace(process.env),
           signal: executionSignal,
-          timeoutMs: timeoutFromEnv(process.env[ENV_CHILD_TIMEOUT]),
+          timeoutMs: remainingTimeoutMs,
           keepPane: writerLease ? false : process.env[ENV_HERDR_KEEP_PANE] === "1",
           closeOnSettle: Boolean(writerLease),
-          onPane: onProgress ? (paneId, agentName) => onProgress({ paneId, agentName, state: "running" }) : undefined,
+          onPane: (paneId, agentName) => onProgress?.({ paneId, agentName, state: "starting" }),
+          onRunning: (paneId, agentName) => {
+            // Record first: runHerdrPane isolates this display callback, so a renderer exception after the
+            // observation cannot suppress the authoritative running event.
+            recordRunning("herdr", { id: paneId, agentName });
+            onProgress?.({ paneId, agentName, state: "running" });
+          },
           onTab: preparedWorkspace ? (tabId) => preparedWorkspace.lease.attachHerdrTab(tabId) : undefined,
           onSnapshot: onProgress ? (snapshot) => onProgress({ snapshot }) : undefined,
         })
@@ -130,18 +180,28 @@ export async function executePlannedChild(input: {
           env: mergeChildEnv(process.env, plan.env),
           cwd,
           signal: executionSignal,
-          timeoutMs: timeoutFromEnv(process.env[ENV_CHILD_TIMEOUT]),
+          // SIGTERM gets only grace that fits INSIDE the recorded deadline. The independent hard timer
+          // prevents a delayed soft-timeout callback from starting a fresh grace period beyond that bound.
+          timeoutMs: Math.max(1, remainingTimeoutMs - terminationGraceMs),
+          hardDeadlineAt: Date.parse(deadlineAt),
           onOutput: onProgress ? (chunk) => onProgress({ chunk }) : undefined,
-          onSpawn: preparedWorkspace ? (pid) => preparedWorkspace.lease.attachProcess(pid) : undefined,
+          onSpawn: (pid) => {
+            // Lease attachment is a security hook and may fail the spawn. The shared reporters isolate
+            // display exceptions before they reach this callback; runChild deliberately kills on any error
+            // here, so presentation must never be added directly without that reporter boundary.
+            preparedWorkspace?.lease.attachProcess(pid);
+            recordRunning("process");
+            onProgress?.({ state: "running" });
+          },
         });
 
     const childFailed = Boolean(output.spawnError || output.aborted || output.timedOut || output.code !== 0);
     releaseReason = output.timedOut ? "timeout" : output.aborted ? "cancelled" : childFailed ? "failed" : "completed";
-    if (session.ledgerPath) {
+    if (ledgerPath) {
       terminalAttempted = true;
-      await appendLedgerEvent(
+      await appendAfterRuntimeRecord(runtimeRecord, () => appendLedgerEvent(
         {
-          path: session.ledgerPath,
+          path: ledgerPath,
           // NOT strict, and this line is the whole point of R-99. The child has already run: failing
           // closed here prevents nothing and used to discard a completed child's entire output while
           // blaming "ledger" — under `delegate_all` it discarded every sibling's work too. The docstring
@@ -151,6 +211,8 @@ export async function executePlannedChild(input: {
           onFailure: (cause) => teardownFailures.push(`child lifecycle record failed: ${String(cause)}`),
         },
         buildChildLifecycleEvent({
+          executionId,
+          parentExecutionId,
           childId,
           state: childFailed ? "failed" : "completed",
           executor: session.executor.kind,
@@ -163,7 +225,7 @@ export async function executePlannedChild(input: {
           correlation: plan.correlation,
           now: new Date(),
         }),
-      );
+      ));
     }
 
     const leaseWasLost = writerLease ? leaseLost : false;
@@ -218,24 +280,24 @@ export async function executePlannedChild(input: {
     return withTeardownNotes(succeeded);
   } catch (error) {
     retainWriterLease = Boolean(writerLease && error instanceof HerdrWriterCloseError);
-    if (session.ledgerPath && !terminalAttempted) {
+    if (ledgerPath && !terminalAttempted) {
       // Best-effort: this records the failure, so it must not REPLACE the failure. A strict append that
       // throws here would discard the original error — including HerdrWriterCloseError, whose whole
       // meaning is "a lease is deliberately retained" (R-108).
-      await appendLedgerEvent(
+      await appendAfterRuntimeRecord(runtimeRecord, () => appendLedgerEvent(
         {
-          path: session.ledgerPath,
+          path: ledgerPath,
           strict: false,
           onFailure: (cause) => teardownFailures.push(`child lifecycle record failed: ${String(cause)}`),
         },
         buildChildLifecycleEvent({
-          childId, state: "failed", executor: session.executor.kind,
+          executionId, parentExecutionId, childId, state: "failed", executor: session.executor.kind,
           reason: error instanceof GovernanceRefusal
             ? error.code
             : error instanceof Error ? error.name : "unknown executor error",
           correlation: plan.correlation, now: new Date(),
         }),
-      );
+      ));
     }
     await teardown();
     // Attached, not dropped. `withTeardownNotes` was applied on both return paths and neither throw path,
@@ -278,7 +340,9 @@ function errorWithTeardownNotes(error: unknown, notes: readonly string[]): unkno
       await releaseDelegationWorkspace({
         prepared: preparedWorkspace,
         childId,
-        ledgerPath: session.ledgerPath,
+        executionId,
+        parentExecutionId,
+        ledgerPath,
         reason: releaseReason,
         retain: retainWriterLease,
       });

package/extensions/execution-occurrence.ts

@@ -0,0 +1,20 @@
+import { newExecutionId } from "../src/execution-id.ts";
+import { childSpawnId } from "../src/fanout.ts";
+import type { GrantsSession } from "./session.ts";
+
+/** Readable logical position plus the unique identity used for every lifecycle join. */
+export interface ExecutionOccurrenceIds {
+  parentId: string;
+  childId: string;
+  executionId: string;
+  parentExecutionId: string | null;
+}
+
+export function newDelegationOccurrence(session: GrantsSession, index: number): ExecutionOccurrenceIds {
+  return {
+    parentId: session.ownSpawnId,
+    childId: childSpawnId(session.ownSpawnId, index),
+    executionId: newExecutionId(),
+    parentExecutionId: session.ownExecutionId ?? null,
+  };
+}