diff --git a/.changeset/durable-turn-input-cancellation.md b/.changeset/durable-turn-input-cancellation.md
new file mode 100644
index 0000000000..14ef6b443f
--- /dev/null
+++ b/.changeset/durable-turn-input-cancellation.md
@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Preserve queued prompts and unfinished turn context across interruptions and restarts, and stop in-flight model streams promptly when a turn is cancelled.
diff --git a/.changeset/preserve-interrupted-turn-context.md b/.changeset/preserve-interrupted-turn-context.md
new file mode 100644
index 0000000000..d1d91e0f52
--- /dev/null
+++ b/.changeset/preserve-interrupted-turn-context.md
@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Tell the model when a previous turn failed or was interrupted so follow-up prompts retain the unfinished request context.
diff --git a/apps/kimi-code/src/tui/components/dialogs/compaction.ts b/apps/kimi-code/src/tui/components/dialogs/compaction.ts
index 9ade9350c7..b00f67ad46 100644
--- a/apps/kimi-code/src/tui/components/dialogs/compaction.ts
+++ b/apps/kimi-code/src/tui/components/dialogs/compaction.ts
@@ -8,6 +8,8 @@
  *     "Compaction complete (X → Y tokens)"
  *   - `markCanceled()` on `compaction.cancelled` → solid warning bullet +
  *     "Compaction cancelled"
+ *   - `markFailed()` when the compaction error event arrives without a
+ *     terminal event → solid error bullet + "Compaction failed"
  *
  * Bullet animation mirrors `ToolCallComponent` (500ms blink) so the user
  * reads the same "work in progress" signal across the UI.
@@ -31,6 +33,7 @@ export class CompactionComponent extends Container {
   private blinkTimer: ReturnType<typeof setInterval> | null = null;
   private done = false;
   private canceled = false;
+  private failed = false;
   private tokensBefore: number | undefined;
   private tokensAfter: number | undefined;
   private summary: string | undefined;
@@ -87,7 +90,7 @@ export class CompactionComponent extends Container {
   }
 
   markDone(tokensBefore?: number, tokensAfter?: number, summary?: string): void {
-    if (this.done || this.canceled) return;
+    if (this.done || this.canceled || this.failed) return;
     this.done = true;
     this.tokensBefore = tokensBefore;
     this.tokensAfter = tokensAfter;
@@ -101,13 +104,21 @@ export class CompactionComponent extends Container {
   }
 
   markCanceled(): void {
-    if (this.done || this.canceled) return;
+    if (this.done || this.canceled || this.failed) return;
     this.canceled = true;
     this.stopBlink();
     this.headerText.setText(this.buildHeader());
     this.ui?.requestRender();
   }
 
+  markFailed(): void {
+    if (this.done || this.canceled || this.failed) return;
+    this.failed = true;
+    this.stopBlink();
+    this.headerText.setText(this.buildHeader());
+    this.ui?.requestRender();
+  }
+
   setExpanded(expanded: boolean): void {
     if (this.expanded === expanded) return;
     this.expanded = expanded;
@@ -164,6 +175,11 @@ export class CompactionComponent extends Container {
       const label = currentTheme.boldFg('warning', 'Compaction cancelled');
       return `${bullet}${label}`;
     }
+    if (this.failed) {
+      const bullet = currentTheme.fg('error', STATUS_BULLET);
+      const label = currentTheme.boldFg('error', 'Compaction failed');
+      return `${bullet}${label}`;
+    }
     const bullet = this.blinkOn ? currentTheme.fg('text', STATUS_BULLET) : '  ';
     const label = currentTheme.boldFg('primary', 'Compacting context...');
     const tip = this.tip ? currentTheme.fg('textDim', ` · Tip: ${this.tip}`) : '';
diff --git a/apps/kimi-code/src/tui/controllers/session-event-handler.ts b/apps/kimi-code/src/tui/controllers/session-event-handler.ts
index 82257c86cf..c17c2ef04d 100644
--- a/apps/kimi-code/src/tui/controllers/session-event-handler.ts
+++ b/apps/kimi-code/src/tui/controllers/session-event-handler.ts
@@ -260,7 +260,7 @@ export class SessionEventHandler {
       case 'goal.updated': this.handleGoalUpdated(event); break;
       case 'skill.activated': this.handleSkillActivated(event); break;
       case 'plugin_command.activated': this.handlePluginCommandActivated(event); break;
-      case 'error': this.handleSessionError(event); break;
+      case 'error': this.handleSessionError(event, sendQueued); break;
       case 'warning': this.handleSessionWarning(event); break;
       case 'compaction.started': this.handleCompactionBegin(event); break;
       case 'compaction.completed': this.handleCompactionEnd(event, sendQueued); break;
@@ -851,10 +851,24 @@ export class SessionEventHandler {
     }
   }
 
-  private handleSessionError(event: ErrorEvent): void {
+  private handleSessionError(
+    event: ErrorEvent,
+    sendQueued: (item: QueuedMessage) => void,
+  ): void {
     this.host.streamingUI.flushNow();
     this.host.streamingUI.resetToolUi();
     this.host.streamingUI.finalizeLiveTextBuffers('idle');
+    if (
+      this.host.state.appState.isCompacting &&
+      (event.code.startsWith('compaction.') ||
+        event.code === 'auth.login_required' ||
+        event.code === 'provider.auth_error')
+    ) {
+      // Pre-commit compaction failures have no completed/cancelled terminal:
+      // the error event itself is the terminal signal for the UI.
+      this.host.streamingUI.failCompaction();
+      this.finishCompaction(sendQueued);
+    }
     if (event.code === OAUTH_LOGIN_REQUIRED_CODE) {
       this.host.showError(OAUTH_LOGIN_REQUIRED_STARTUP_NOTICE);
       return;
@@ -1012,7 +1026,13 @@ export class SessionEventHandler {
   private finishCompaction(sendQueued: (item: QueuedMessage) => void): void {
     const hasActiveTurn = this.host.streamingUI.hasActiveTurn();
     if (!hasActiveTurn) {
-      const next = this.host.shiftQueuedMessage();
+      // Auto-compaction failures terminate the owning turn first and emit the
+      // compaction error second. finalizeTurn may therefore have already
+      // removed and scheduled one queued message; never drain a second item for
+      // the same terminal sequence.
+      const next = this.host.state.queuedMessageDispatchPending
+        ? undefined
+        : this.host.shiftQueuedMessage();
       if (next !== undefined) {
         this.host.state.queuedMessageDispatchPending = true;
       }
diff --git a/apps/kimi-code/src/tui/controllers/session-replay.ts b/apps/kimi-code/src/tui/controllers/session-replay.ts
index 00ee5a64b5..245ce101c5 100644
--- a/apps/kimi-code/src/tui/controllers/session-replay.ts
+++ b/apps/kimi-code/src/tui/controllers/session-replay.ts
@@ -8,6 +8,7 @@ import type {
   Session,
   ToolCall,
 } from '@moonshot-ai/kimi-code-sdk';
+import { extractImageCompressionCaptions } from '@moonshot-ai/kimi-code-sdk';
 
 import { ToolCallComponent } from '../components/messages/tool-call';
 import { currentTheme } from '../theme';
@@ -334,8 +335,16 @@ export class SessionReplayRenderer {
     }
 
     this.advanceTurn(context);
+    const content =
+      message.origin?.kind === 'user'
+        ? message.content.map((part) =>
+            part.type === 'text'
+              ? { ...part, text: extractImageCompressionCaptions(part.text).text }
+              : part,
+          )
+        : message.content;
     this.host.appendTranscriptEntry(
-      replayEntry(context, 'user', contentPartsToText(message.content), 'plain'),
+      replayEntry(context, 'user', contentPartsToText(content), 'plain'),
     );
   }
 
diff --git a/apps/kimi-code/src/tui/controllers/streaming-ui.ts b/apps/kimi-code/src/tui/controllers/streaming-ui.ts
index ae5eac7681..122921e059 100644
--- a/apps/kimi-code/src/tui/controllers/streaming-ui.ts
+++ b/apps/kimi-code/src/tui/controllers/streaming-ui.ts
@@ -752,6 +752,14 @@ export class StreamingUIController {
     this.host.state.ui.requestRender();
   }
 
+  failCompaction(): void {
+    const block = this._activeCompactionBlock;
+    if (block === undefined) return;
+    block.markFailed();
+    this._activeCompactionBlock = undefined;
+    this.host.state.ui.requestRender();
+  }
+
   // ---------------------------------------------------------------------------
   // Tool call grouping
   // ---------------------------------------------------------------------------
diff --git a/apps/kimi-code/test/tui/components/dialogs/compaction.test.ts b/apps/kimi-code/test/tui/components/dialogs/compaction.test.ts
index 4f415bc322..ffcd285a76 100644
--- a/apps/kimi-code/test/tui/components/dialogs/compaction.test.ts
+++ b/apps/kimi-code/test/tui/components/dialogs/compaction.test.ts
@@ -56,6 +56,20 @@ describe('CompactionComponent', () => {
     }
   });
 
+  it('stops the progress animation and renders a failed terminal', () => {
+    const component = new CompactionComponent();
+
+    try {
+      component.markFailed();
+
+      const output = component.render(80).map(strip).join('\n');
+      expect(output).toContain('Compaction failed');
+      expect(output).not.toContain('Compacting context');
+    } finally {
+      component.dispose();
+    }
+  });
+
   it('renders a cancelled terminal state', () => {
     const component = new CompactionComponent();
 
diff --git a/apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts b/apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts
index f285be77dd..0b654d465e 100644
--- a/apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts
+++ b/apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts
@@ -3235,6 +3235,101 @@ command = "vim"
     expect(transcript).not.toContain('kimi export');
   });
 
+  it('treats a compaction error as a failed terminal and leaves compacting state', async () => {
+    const { driver } = await makeDriver();
+    const sendQueued = vi.fn();
+
+    driver.sessionEventHandler.handleEvent(
+      {
+        type: 'compaction.started',
+        agentId: 'main',
+        sessionId: 'ses-1',
+      } as Event,
+      sendQueued,
+    );
+    expect(driver.state.appState.isCompacting).toBe(true);
+
+    driver.sessionEventHandler.handleEvent(
+      {
+        type: 'error',
+        agentId: 'main',
+        sessionId: 'ses-1',
+        code: 'compaction.failed',
+        message: 'provider aborted without a cancellation signal',
+        retryable: false,
+      } as Event,
+      sendQueued,
+    );
+
+    expect(driver.state.appState.isCompacting).toBe(false);
+    expect(driver.state.appState.streamingPhase).toBe('idle');
+    const transcript = stripSgr(renderTranscript(driver));
+    expect(transcript).toContain('Compaction failed');
+    expect(transcript).not.toContain('Compacting context');
+  });
+
+  it('does not drain a second queued message when turn failure precedes compaction error', async () => {
+    vi.useFakeTimers();
+    try {
+      const { driver } = await makeDriver();
+      const sendQueued = vi.fn();
+      driver.sessionEventHandler.handleEvent(
+        {
+          type: 'turn.started',
+          agentId: 'main',
+          sessionId: 'ses-1',
+          turnId: 1,
+          origin: { kind: 'user' },
+        } as Event,
+        sendQueued,
+      );
+      driver.sessionEventHandler.handleEvent(
+        {
+          type: 'compaction.started',
+          agentId: 'main',
+          sessionId: 'ses-1',
+          turnId: 1,
+          trigger: 'auto',
+        } as Event,
+        sendQueued,
+      );
+      driver.state.queuedMessages = [{ text: 'first' }, { text: 'second' }];
+
+      driver.sessionEventHandler.handleEvent(
+        {
+          type: 'turn.ended',
+          agentId: 'main',
+          sessionId: 'ses-1',
+          turnId: 1,
+          reason: 'failed',
+          durationMs: 1,
+          error: { code: 'compaction.failed', message: 'summary failed', retryable: false },
+        } as Event,
+        sendQueued,
+      );
+      driver.sessionEventHandler.handleEvent(
+        {
+          type: 'error',
+          agentId: 'main',
+          sessionId: 'ses-1',
+          code: 'compaction.failed',
+          message: 'summary failed',
+          retryable: false,
+        } as Event,
+        sendQueued,
+      );
+
+      expect(driver.state.queuedMessages).toEqual([{ text: 'second' }]);
+      expect(driver.state.queuedMessageDispatchPending).toBe(true);
+      await vi.runAllTimersAsync();
+      expect(sendQueued).toHaveBeenCalledTimes(1);
+      expect(sendQueued).toHaveBeenCalledWith({ text: 'first' });
+      expect(driver.state.queuedMessages).toEqual([{ text: 'second' }]);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('shows concise provider filter text for filtered session errors', async () => {
     const { driver } = await makeDriver();
     const verboseMessage =
diff --git a/apps/kimi-code/test/tui/message-replay.test.ts b/apps/kimi-code/test/tui/message-replay.test.ts
index 5e4e11670f..95f84246f5 100644
--- a/apps/kimi-code/test/tui/message-replay.test.ts
+++ b/apps/kimi-code/test/tui/message-replay.test.ts
@@ -4,6 +4,7 @@ import type {
   AgentReplayRecord,
   BackgroundTaskInfo,
   ContentPart,
+  Event,
   GoalSnapshot,
   PromptOrigin,
   ResumedAgentState,
@@ -289,6 +290,135 @@ function backgroundTask(
 }
 
 describe('KimiTUI resume message replay', () => {
+  it('does not render turn outcome reminders between visible user messages', async () => {
+    const driver = await replayIntoDriver([
+      message('user', [{ type: 'text', text: 'Finish the requested change.' }]),
+      message(
+        'user',
+        [
+          {
+            type: 'text',
+            text:
+              '<system-reminder>\n' +
+              'The previous turn ended before producing a final response.\n\n' +
+              'Error: API request failed with HTTP 500.\n\n' +
+              'The preceding user request may still be unfinished. Treat the next user message as a follow-up.\n' +
+              '</system-reminder>',
+          },
+        ],
+        { origin: { kind: 'injection', variant: 'turn_outcome' } },
+      ),
+      message('user', [{ type: 'text', text: 'Continue.' }]),
+    ]);
+
+    expect(
+      driver.state.transcriptEntries
+        .filter((entry) => entry.kind === 'user')
+        .map((entry) => entry.content),
+    ).toEqual(['Finish the requested change.', 'Continue.']);
+    const transcript = stripAnsi(driver.state.transcriptContainer.render(140).join('\n'));
+    expect(transcript).not.toContain('API request failed with HTTP 500');
+    expect(transcript).not.toContain('preceding user request');
+  });
+
+  it('renders ordinary user text that contains system reminder tags', async () => {
+    const literalText =
+      '<system-reminder>\nThis text was typed by the user and is not an injection.\n</system-reminder>';
+    const driver = await replayIntoDriver([
+      message('user', [{ type: 'text', text: literalText }], {
+        origin: { kind: 'user' },
+      }),
+    ]);
+
+    expect(
+      driver.state.transcriptEntries
+        .filter((entry) => entry.kind === 'user')
+        .map((entry) => entry.content),
+    ).toEqual([literalText]);
+    const transcript = stripAnsi(driver.state.transcriptContainer.render(140).join('\n'));
+    expect(transcript).toContain('This text was typed by the user and is not an injection.');
+  });
+
+  it('renders one synthetic tool failure without exposing its turn outcome reminder', async () => {
+    const abandonedOutput =
+      'Tool call did not complete: the turn failed before its result was recorded. Do not assume the tool completed successfully.';
+    const driver = await replayIntoDriver([
+      message('user', [{ type: 'text', text: 'Run the operation.' }]),
+      message(
+        'assistant',
+        [{ type: 'text', text: 'Starting the operation.' }],
+        { toolCalls: [toolCall('call_abandoned', 'Run', {})] },
+      ),
+      message('tool', [{ type: 'text', text: abandonedOutput }], {
+        toolCallId: 'call_abandoned',
+        isError: true,
+      }),
+      message(
+        'user',
+        [
+          {
+            type: 'text',
+            text:
+              '<system-reminder>\n' +
+              'The previous turn ended before producing a final response.\n\n' +
+              'Error: tool result dispatch failed\n\n' +
+              'The preceding user request may still be unfinished. Treat the next user message as a follow-up.\n' +
+              '</system-reminder>',
+          },
+        ],
+        { origin: { kind: 'injection', variant: 'turn_outcome' } },
+      ),
+      message('user', [{ type: 'text', text: 'Continue.' }]),
+    ]);
+
+    const transcript = stripAnsi(driver.state.transcriptContainer.render(140).join('\n'));
+    expect(transcript.split('Tool call did not complete').length - 1).toBe(1);
+    expect(transcript).not.toContain('tool result dispatch failed');
+    expect(transcript).not.toContain('preceding user request');
+    expect(
+      driver.state.transcriptEntries
+        .filter((entry) => entry.kind === 'user')
+        .map((entry) => entry.content),
+    ).toEqual(['Run the operation.', 'Continue.']);
+  });
+
+  it('does not render live context splice events containing turn outcome reminders', async () => {
+    const driver = await replayIntoDriver([]);
+
+    // The v2 server forwards this domain event on the v1 session channel even
+    // though it is intentionally absent from the SDK's public Event union.
+    driver.sessionEventHandler.handleEvent(
+      {
+        type: 'context.spliced',
+        sessionId: 'ses-replay',
+        agentId: 'main',
+        start: 1,
+        deleteCount: 0,
+        messages: [
+          {
+            role: 'user',
+            content: [
+              {
+                type: 'text',
+                text:
+                  '<system-reminder>\n' +
+                  'The user interrupted the previous turn before it finished.\n' +
+                  '</system-reminder>',
+              },
+            ],
+            toolCalls: [],
+            origin: { kind: 'injection', variant: 'turn_outcome' },
+          },
+        ],
+      } as unknown as Event,
+      () => {},
+    );
+
+    expect(driver.state.transcriptEntries).toEqual([]);
+    const transcript = stripAnsi(driver.state.transcriptContainer.render(140).join('\n'));
+    expect(transcript).not.toContain('user interrupted the previous turn');
+  });
+
   it('does not render legacy goal completion context reminders as transcript messages', async () => {
     const driver = await replayIntoDriver([
       message(
@@ -613,6 +743,30 @@ describe('KimiTUI resume message replay', () => {
     expect(driver.streamingUI.getToolComponent('call_agent_2')).toBeUndefined();
   });
 
+  it('hides legacy image-compression metadata when replaying a user message', async () => {
+    const legacyCaption =
+      '<system>Image compressed to fit model limits: original 3264x666 image/png (344 KB) -> ' +
+      '2000x408 image/png (282 KB). Full-detail original: /tmp/originals/shot.png.</system>';
+    const driver = await replayIntoDriver([
+      message(
+        'user',
+        [
+          {
+            type: 'text',
+            text: `Inspect this${legacyCaption}<system>ordinary user text</system>`,
+          },
+        ],
+        { origin: { kind: 'user' } },
+      ),
+    ]);
+
+    expect(
+      driver.state.transcriptEntries
+        .filter((entry) => entry.kind === 'user')
+        .map((entry) => entry.content),
+    ).toEqual(['Inspect this<system>ordinary user text</system>']);
+  });
+
   it('groups replayed Read calls from one assistant message using live grouping', async () => {
     const replay: AgentReplayRecord[] = [
       message('user', [{ type: 'text', text: 'read files' }]),
diff --git a/apps/kimi-web/src/composables/client/useWorkspaceState.ts b/apps/kimi-web/src/composables/client/useWorkspaceState.ts
index fa9891bf22..72ada9cc31 100644
--- a/apps/kimi-web/src/composables/client/useWorkspaceState.ts
+++ b/apps/kimi-web/src/composables/client/useWorkspaceState.ts
@@ -55,6 +55,7 @@ const MESSAGES_PAGE_SIZE = 50;
 // sidebar can fall back to it when a workspace's first-page size is unknown.
 export const SESSIONS_INITIAL_PAGE_SIZE = 5;
 const PROMPT_NOT_FOUND_CODE = 40402;
+const PROMPT_ALREADY_COMPLETED_CODE = 40903;
 const WORKSPACE_NOT_FOUND_CODE = 40410;
 // Shared "already resolved" conflict (40902). The daemon reuses it for both
 // approvals and questions when a second client races the resolve, so a
@@ -118,6 +119,48 @@ const pendingLocalTurnStarts = new Map<string, Set<number>>();
 const afterLocalTurnsSettled = new Map<string, () => void>();
 let nextLocalTurnToken = 0;
 
+/**
+ * A queued prompt becomes part of the active turn only after the steer request
+ * is admitted. Keep that short transaction visible to Stop: once the user asks
+ * to stop the session, a concurrent steer failure is the expected result of
+ * cancelling that transaction, not a second operation error to surface.
+ *
+ * There can be more than one browser request in flight for a session (for
+ * example, a double Ctrl+S before the first response), so track operation
+ * objects rather than one prompt id per session. The daemon remains the source
+ * of truth for queue ownership; this set records only local cancellation
+ * intent and is always cleared by steerPrompt's finally block.
+ */
+interface PendingSteerOperation {
+  stopRequested: boolean;
+}
+
+const pendingSteersBySession = new Map<string, Set<PendingSteerOperation>>();
+
+function registerPendingSteer(sessionId: string): PendingSteerOperation {
+  const operation: PendingSteerOperation = { stopRequested: false };
+  const pending = pendingSteersBySession.get(sessionId) ?? new Set<PendingSteerOperation>();
+  pending.add(operation);
+  pendingSteersBySession.set(sessionId, pending);
+  return operation;
+}
+
+function finishPendingSteer(sessionId: string, operation: PendingSteerOperation): void {
+  const pending = pendingSteersBySession.get(sessionId);
+  if (pending === undefined) return;
+  pending.delete(operation);
+  if (pending.size === 0) pendingSteersBySession.delete(sessionId);
+}
+
+function markPendingSteersStopping(sessionId: string): boolean {
+  let marked = false;
+  for (const operation of pendingSteersBySession.get(sessionId) ?? []) {
+    operation.stopRequested = true;
+    marked = true;
+  }
+  return marked;
+}
+
 export interface LocalTurnStartState {
   generation: number;
   pending: boolean;
@@ -1610,6 +1653,11 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
     };
     updateSessionMessages(sid, (msgs) => [...msgs, optimisticMsg]);
 
+    // Register before submitting B. prompt.submitted may reach the browser and
+    // replace promptIdBySession with B before the submit HTTP response returns;
+    // Stop must still know it is cancelling a pending A+B steer transaction in
+    // that window.
+    const pendingSteer = registerPendingSteer(sid);
     const localTurnToken = beginLocalTurn(sid);
     try {
       const api = getKimiWebApi();
@@ -1640,6 +1688,25 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
         return updated;
       });
 
+      if (pendingSteer.stopRequested) {
+        // Stop may have won before submit returned, when B was only queued and
+        // aborting A alone could let B auto-start. Pair the session-level stop
+        // issued by abortCurrentPrompt() with an idempotent abort(B) once its
+        // authoritative id is known. Never attempt the steer after Stop.
+        try {
+          await api.abortPrompt(sid, result.promptId);
+        } catch (error) {
+          const alreadyGone =
+            isDaemonApiError(error) &&
+            (error.code === PROMPT_NOT_FOUND_CODE ||
+              error.code === PROMPT_ALREADY_COMPLETED_CODE);
+          if (!alreadyGone) {
+            pushOperationFailure('abortCurrentPrompt', error, { sessionId: sid });
+          }
+        }
+        return;
+      }
+
       if (result.status !== 'queued') {
         // The turn ended while the user was typing — the prompt started a turn
         // of its own. Wire it up like a regular send so :abort keeps working.
@@ -1650,16 +1717,29 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
 
       try {
         await api.steerPrompts(sid, [result.promptId]);
-      } catch {
-        // The active turn finished between submit and steer — the daemon starts
-        // the parked prompt as its own turn. Nothing to roll back.
+      } catch (error) {
+        // PROMPT_NOT_FOUND is the one server response that proves the original
+        // active-turn target disappeared before steer admission. A concurrent
+        // local Stop is also expected to reject the steer request: aborting the
+        // reserved queued prompt linearizes as cancelling both it and the
+        // active prompt. Every other failure leaves the queued prompt's fate
+        // unknown (it may still be parked), so do not claim it auto-started —
+        // surface the failure while retaining its accepted transcript echo.
+        const activeTurnEnded =
+          isDaemonApiError(error) && error.code === PROMPT_NOT_FOUND_CODE;
+        if (!activeTurnEnded && !pendingSteer.stopRequested) {
+          pushOperationFailure('steer', error, { sessionId: sid });
+        }
       }
-    } catch (err) {
+    } catch (error) {
       // Submit failed: drop the optimistic echo so the transcript doesn't show
       // a delivered-looking message the daemon never received.
       updateSessionMessages(sid, (msgs) => msgs.filter((m) => m.id !== tempId));
-      pushOperationFailure('steer', err, { sessionId: sid });
+      if (!pendingSteer.stopRequested) {
+        pushOperationFailure('steer', error, { sessionId: sid });
+      }
     } finally {
+      finishPendingSteer(sid, pendingSteer);
       settleLocalTurn(sid, localTurnToken);
     }
   }
@@ -1761,6 +1841,12 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
   async function abortCurrentPrompt(): Promise<void> {
     const sid = rawState.activeSessionId;
     if (!sid) return;
+    // Mark before the first await. The authoritative prompt id may still name
+    // active A or may already have been overwritten by queued B's
+    // prompt.submitted event; stopping either side of an admitted steer
+    // transaction cancels A+B, and the concurrent steer request is then
+    // expected to fail.
+    const stoppingSteer = markPendingSteersStopping(sid);
     const session = rawState.sessions.find((s) => s.id === sid);
 
     // 1. Authoritative id captured at submit time.
@@ -1777,6 +1863,16 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
     }
 
     const api = getKimiWebApi();
+    // During a local steer, per-prompt abort and session abort are both needed
+    // to close the pre-admission window: queued B may already be cached while
+    // the server has not reserved it against active A yet. Start the session
+    // abort concurrently so a slow per-prompt request cannot delay Stop.
+    const steerSessionAbort = stoppingSteer
+      ? api.abortSession(sid).then(
+          () => ({ ok: true as const }),
+          (error: unknown) => ({ ok: false as const, error }),
+        )
+      : undefined;
 
     // 3. If we have a real id, try the per-prompt abort first. If the daemon
     //    reports the prompt is missing/already completed, clear the stale id and
@@ -1784,29 +1880,37 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
     if (promptId !== undefined) {
       try {
         const result = await api.abortPrompt(sid, promptId);
-        if (result.aborted) return;
+        if (result.aborted && !stoppingSteer) return;
         const nextPromptIds = { ...rawState.promptIdBySession };
         delete nextPromptIds[sid];
         rawState.promptIdBySession = nextPromptIds;
-      } catch (err) {
-        if (isDaemonApiError(err) && err.code === PROMPT_NOT_FOUND_CODE) {
+      } catch (error) {
+        if (isDaemonApiError(error) && error.code === PROMPT_NOT_FOUND_CODE) {
           // Stale id — try the session-level fallback below.
           const nextPromptIds = { ...rawState.promptIdBySession };
           delete nextPromptIds[sid];
           rawState.promptIdBySession = nextPromptIds;
         } else {
-          pushOperationFailure('abortCurrentPrompt', err, { sessionId: sid });
-          return;
+          pushOperationFailure('abortCurrentPrompt', error, { sessionId: sid });
+          if (!stoppingSteer) return;
         }
       }
     }
 
+    if (steerSessionAbort !== undefined) {
+      const outcome = await steerSessionAbort;
+      if (!outcome.ok) {
+        pushOperationFailure('abortCurrentPrompt', outcome.error, { sessionId: sid });
+      }
+      return;
+    }
+
     // 4. No real id, or the prompt id is no longer recognized: cancel whatever
     //    is running in the session (including skill activations).
     try {
       await api.abortSession(sid);
-    } catch (err) {
-      pushOperationFailure('abortCurrentPrompt', err, { sessionId: sid });
+    } catch (error) {
+      pushOperationFailure('abortCurrentPrompt', error, { sessionId: sid });
     }
   }
 
diff --git a/apps/kimi-web/test/workspace-state.test.ts b/apps/kimi-web/test/workspace-state.test.ts
index bc882d0bac..4f66834524 100644
--- a/apps/kimi-web/test/workspace-state.test.ts
+++ b/apps/kimi-web/test/workspace-state.test.ts
@@ -23,6 +23,7 @@ const apiMock = vi.hoisted(() => ({
   exportSession: vi.fn(),
   updateSession: vi.fn(),
   submitPrompt: vi.fn(),
+  steerPrompts: vi.fn(),
   respondQuestion: vi.fn(),
   respondApproval: vi.fn(),
   dismissQuestion: vi.fn(),
@@ -289,6 +290,128 @@ describe('useWorkspaceState — abortCurrentPrompt', () => {
   });
 });
 
+describe('useWorkspaceState — steer and Stop transaction', () => {
+  beforeEach(() => {
+    apiMock.submitPrompt.mockReset();
+    apiMock.steerPrompts.mockReset();
+    apiMock.abortPrompt.mockReset();
+    apiMock.abortSession.mockReset();
+  });
+
+  it('stops queued B without reporting the steer rejection caused by cancelling A+B', async () => {
+    let rejectSteer!: (reason: unknown) => void;
+    let resolvePromptAbort!: (result: { aborted: boolean }) => void;
+    apiMock.submitPrompt.mockResolvedValue({
+      promptId: 'prompt_b',
+      userMessageId: 'message_b',
+      status: 'queued',
+    });
+    apiMock.steerPrompts.mockReturnValue(
+      new Promise((_, reject) => {
+        rejectSteer = reject;
+      }),
+    );
+    const steerCancelled = new DaemonApiError({
+      code: 50000,
+      msg: 'steer cancelled with its active turn',
+      requestId: 'req_steer',
+    });
+    apiMock.abortPrompt.mockImplementation(() => {
+      rejectSteer(steerCancelled);
+      return new Promise((resolve) => {
+        resolvePromptAbort = resolve;
+      });
+    });
+    apiMock.abortSession.mockResolvedValue({ aborted: true });
+    const state = createState();
+    state.promptIdBySession = { sess_1: 'prompt_a' };
+    const deps = createDeps();
+    const workspace = useWorkspaceState(state, deps);
+
+    const steering = workspace.steerPrompt('follow up B');
+    await vi.waitFor(() => {
+      expect(apiMock.steerPrompts).toHaveBeenCalledWith('sess_1', ['prompt_b']);
+    });
+
+    // The prompt.submitted WS event for queued B is allowed to replace A's
+    // cached id. With the daemon's steer reservation, abort(B) linearizes as
+    // cancelling both the active target A and selected queued prompt B.
+    state.promptIdBySession = { sess_1: 'prompt_b' };
+    const stopping = workspace.abortCurrentPrompt();
+    await vi.waitFor(() => {
+      // Session cancellation must not wait behind a slow abort(B) response.
+      expect(apiMock.abortSession).toHaveBeenCalledWith('sess_1');
+    });
+    resolvePromptAbort({ aborted: true });
+    await stopping;
+    await steering;
+
+    expect(apiMock.abortPrompt).toHaveBeenCalledWith('sess_1', 'prompt_b');
+    expect(apiMock.abortSession).toHaveBeenCalledWith('sess_1');
+    expect(deps.pushOperationFailure).not.toHaveBeenCalled();
+  });
+
+  it('cancels A and accepted B when Stop wins before the steer submit response', async () => {
+    let resolveSubmit!: (result: {
+      promptId: string;
+      userMessageId: string;
+      status: 'queued';
+    }) => void;
+    apiMock.submitPrompt.mockReturnValue(
+      new Promise((resolve) => {
+        resolveSubmit = resolve;
+      }),
+    );
+    apiMock.abortPrompt.mockResolvedValue({ aborted: true });
+    apiMock.abortSession.mockResolvedValue({ aborted: true });
+    const state = createState();
+    state.promptIdBySession = { sess_1: 'prompt_a' };
+    const deps = createDeps();
+    const workspace = useWorkspaceState(state, deps);
+
+    const steering = workspace.steerPrompt('follow up B');
+    await vi.waitFor(() => {
+      expect(apiMock.submitPrompt).toHaveBeenCalledOnce();
+    });
+
+    // The WS prompt.submitted event is allowed to overtake the HTTP response.
+    // Stop must not treat a successful queued-only abort(B) as sufficient:
+    // session abort cancels A, then the steer path aborts B again once its
+    // accepted response arrives and never attempts prompts:steer.
+    state.promptIdBySession = { sess_1: 'prompt_b' };
+    await workspace.abortCurrentPrompt();
+    resolveSubmit({
+      promptId: 'prompt_b',
+      userMessageId: 'message_b',
+      status: 'queued',
+    });
+    await steering;
+
+    expect(apiMock.abortPrompt).toHaveBeenCalledWith('sess_1', 'prompt_b');
+    expect(apiMock.abortSession).toHaveBeenCalledWith('sess_1');
+    expect(apiMock.steerPrompts).not.toHaveBeenCalled();
+    expect(deps.pushOperationFailure).not.toHaveBeenCalled();
+  });
+
+  it('reports an unexpected steer failure instead of assuming queued B started', async () => {
+    const error = new Error('steer transport failed');
+    apiMock.submitPrompt.mockResolvedValue({
+      promptId: 'prompt_b',
+      userMessageId: 'message_b',
+      status: 'queued',
+    });
+    apiMock.steerPrompts.mockRejectedValue(error);
+    const deps = createDeps();
+    const workspace = useWorkspaceState(createState(), deps);
+
+    await workspace.steerPrompt('follow up B');
+
+    expect(deps.pushOperationFailure).toHaveBeenCalledWith('steer', error, {
+      sessionId: 'sess_1',
+    });
+  });
+});
+
 describe('useWorkspaceState — exportSession', () => {
   let anchor: {
     href: string;
diff --git a/apps/vis/server/src/lib/context-projector.ts b/apps/vis/server/src/lib/context-projector.ts
index df9271b3a1..03652274b7 100644
--- a/apps/vis/server/src/lib/context-projector.ts
+++ b/apps/vis/server/src/lib/context-projector.ts
@@ -501,8 +501,14 @@ export function projectContext(
       case 'metadata':
       case 'forked':
       case 'turn.prompt':
+      case 'turn.deferred_prompt_started':
       case 'turn.steer':
       case 'turn.cancel':
+      case 'turn.input_consumed':
+      // A turn outcome is durable intent, not context by itself. Recovery
+      // materializes it later as a context.append_message record; projecting
+      // both would expose the reminder too early and then duplicate it.
+      case 'turn.outcome':
       case 'permission.record_approval_result':
       case 'full_compaction.begin':
       case 'full_compaction.cancel':
diff --git a/apps/vis/server/test/lib/context-projector.test.ts b/apps/vis/server/test/lib/context-projector.test.ts
index 0a5ded18fe..219bebdd4e 100644
--- a/apps/vis/server/test/lib/context-projector.test.ts
+++ b/apps/vis/server/test/lib/context-projector.test.ts
@@ -35,6 +35,41 @@ describe('context-projector', () => {
     expect(proj.planMode.active).toBe(false);
   });
 
+  it('does not project a pending turn outcome before it is materialized into context', () => {
+    const reminder = 'The previous turn ended before producing a final response.';
+    const entries = [
+      {
+        lineNo: 1,
+        data: {
+          type: 'context.append_message' as const,
+          message: {
+            role: 'user' as const,
+            content: [{ type: 'text' as const, text: 'continue' }],
+            toolCalls: [],
+          },
+        },
+        raw: {},
+      },
+      {
+        lineNo: 2,
+        data: {
+          type: 'turn.outcome' as const,
+          outcomeId: 'outcome-1',
+          turnId: 0,
+          content: reminder,
+        },
+        raw: {},
+      },
+    ];
+
+    for (const mode of ['model', 'full'] as const) {
+      const proj = projectContext(entries, mode);
+      expect(proj.messages.map((message) => message.message.content)).toEqual([
+        [{ type: 'text', text: 'continue' }],
+      ]);
+    }
+  });
+
   it('reconstructs assistant tool-call messages and separates tool results', async () => {
     const entries = [
       {
diff --git a/apps/vis/web/src/components/wire/renderers.tsx b/apps/vis/web/src/components/wire/renderers.tsx
index 6ec3eb67fd..d9dec742eb 100644
--- a/apps/vis/web/src/components/wire/renderers.tsx
+++ b/apps/vis/web/src/components/wire/renderers.tsx
@@ -120,6 +120,19 @@ export const WIRE_RENDERERS: RendererMap = {
     ),
   },
 
+  'turn.deferred_prompt_started': {
+    tone: 'turn',
+    label: 'prompt→',
+    headline: (r) => ({
+      main: (
+        <span className="flex items-center gap-2 min-w-0">
+          <Mono>turn {r.turnId}</Mono>
+          <Dim className="truncate">deferred {r.deferredPromptId}</Dim>
+        </span>
+      ),
+    }),
+  },
+
   'turn.steer': {
     tone: 'turn',
     label: 'steer',
@@ -165,6 +178,50 @@ export const WIRE_RENDERERS: RendererMap = {
     }),
   },
 
+  'turn.outcome': {
+    tone: 'warning',
+    label: 'outcome',
+    headline: (r) => ({
+      main: (
+        <span className="flex items-center gap-2 min-w-0">
+          <Mono>turn {r.turnId}</Mono>
+          <Dim className="truncate">{truncate(r.content, 80)}</Dim>
+        </span>
+      ),
+    }),
+    detail: (r) => (
+      <div className="grid grid-cols-[140px_1fr] gap-x-3 gap-y-[2px]">
+        <FieldRow label="outcomeId" wide>
+          <Mono className="break-all">{r.outcomeId}</Mono>
+        </FieldRow>
+        <FieldRow label="turnId">
+          <span className="text-[var(--color-sev-info)]">{r.turnId}</span>
+        </FieldRow>
+        <FieldRow label="content" wide>
+          <SizePreview label="content" sizeBytes={r.content.length} preview={r.content}>
+            <pre className="whitespace-pre-wrap break-words text-fg-1">{r.content}</pre>
+          </SizePreview>
+        </FieldRow>
+      </div>
+    ),
+  },
+
+  'turn.input_consumed': {
+    tone: 'meta',
+    label: 'consumed',
+    headline: (r) => ({
+      main: (
+        <span className="flex items-center gap-2 min-w-0">
+          <Pill tone="turn" variant="soft">
+            {r.consumedTurnInput.kind}
+          </Pill>
+          <Mono>turn {r.consumedTurnInput.turnId}</Mono>
+          <Dim className="truncate">{r.consumedTurnInput.id}</Dim>
+        </span>
+      ),
+    }),
+  },
+
   'context.append_message': {
     tone: 'assistant',
     label: 'message',
diff --git a/packages/agent-core-v2/src/_base/errors/unexpectedError.ts b/packages/agent-core-v2/src/_base/errors/unexpectedError.ts
index b16c766b02..a6659fd540 100644
--- a/packages/agent-core-v2/src/_base/errors/unexpectedError.ts
+++ b/packages/agent-core-v2/src/_base/errors/unexpectedError.ts
@@ -24,8 +24,13 @@ export function onUnexpectedError(err: unknown): void {
   try {
     currentHandler(err);
   } catch (handlerErr) {
-    // eslint-disable-next-line no-console
-    console.error('[unexpected] handler threw', handlerErr, 'while reporting', err);
+    try {
+      // eslint-disable-next-line no-console
+      console.error('[unexpected] handler threw', handlerErr, 'while reporting', err);
+    } catch {
+      // Unexpected-error reporting is the final diagnostic boundary. A broken
+      // custom handler and a broken console fallback must both remain isolated.
+    }
   }
 }
 
diff --git a/packages/agent-core-v2/src/_base/log/logService.ts b/packages/agent-core-v2/src/_base/log/logService.ts
index 0697c5b5b2..fcbf060bfb 100644
--- a/packages/agent-core-v2/src/_base/log/logService.ts
+++ b/packages/agent-core-v2/src/_base/log/logService.ts
@@ -89,7 +89,13 @@ export class BoundLogger extends Disposable implements ILogger {
   }
 
   child(ctx: LogContext): ILogger {
-    return new BoundLogger(this.writer, this.levelState, { ...this.bound, ...ctx });
+    try {
+      return new BoundLogger(this.writer, this.levelState, { ...this.bound, ...ctx });
+    } catch {
+      // A hostile binding object must not make logger creation a business
+      // failure. Keep the parent's bindings and return a usable child.
+      return new BoundLogger(this.writer, this.levelState, this.bound);
+    }
   }
 
   error(message: string, payload?: LogPayload): void {
@@ -110,23 +116,28 @@ export class BoundLogger extends Disposable implements ILogger {
     message: string,
     payload?: LogPayload,
   ): void {
-    if (!levelEnabled(level, this.levelState.level)) return;
-    const extracted = extractPayload(payload);
-    if (extracted === undefined) return;
-    const payloadCtx = extracted.ctx;
-    const error = extracted.error;
-    const ctx =
-      payloadCtx !== undefined || Object.keys(this.bound).length > 0
-        ? { ...payloadCtx, ...this.bound }
-        : undefined;
-    const entry: LogEntry = {
-      t: Date.now(),
-      level,
-      msg: message,
-      ...(ctx !== undefined ? { ctx } : {}),
-      ...(error !== undefined ? { error } : {}),
-    };
-    this.writer.write(entry);
+    try {
+      if (!levelEnabled(level, this.levelState.level)) return;
+      const extracted = extractPayload(payload);
+      if (extracted === undefined) return;
+      const payloadCtx = extracted.ctx;
+      const error = extracted.error;
+      const ctx =
+        payloadCtx !== undefined || Object.keys(this.bound).length > 0
+          ? { ...payloadCtx, ...this.bound }
+          : undefined;
+      const entry: LogEntry = {
+        t: Date.now(),
+        level,
+        msg: message,
+        ...(ctx !== undefined ? { ctx } : {}),
+        ...(error !== undefined ? { error } : {}),
+      };
+      this.writer.write(entry);
+    } catch {
+      // Logging is observational. Hostile payload accessors, entry construction,
+      // and broken sinks must never change the caller's control flow.
+    }
   }
 }
 
diff --git a/packages/agent-core-v2/src/agent/contextInjector/contextInjectorService.ts b/packages/agent-core-v2/src/agent/contextInjector/contextInjectorService.ts
index 0c0934a166..7ec02fa06e 100644
--- a/packages/agent-core-v2/src/agent/contextInjector/contextInjectorService.ts
+++ b/packages/agent-core-v2/src/agent/contextInjector/contextInjectorService.ts
@@ -6,7 +6,7 @@
  * those positions after `wire` restoration. Bound at Agent scope.
  */
 
-import { Disposable, toDisposable } from "#/_base/di/lifecycle";
+import { Disposable, toDisposable } from '#/_base/di/lifecycle';
 import { InstantiationType } from '#/_base/di/extensions';
 import { LifecycleScope, registerScopedService } from '#/_base/di/scope';
 
@@ -43,7 +43,7 @@ export class AgentContextInjectorService extends Disposable implements IAgentCon
     this._register(
       loopService.hooks.onWillBeginStep.register('context-injector', async (_ctx, next) => {
         await next();
-        await this.inject();
+        await this.inject(false);
       }),
     );
     this._register(
@@ -82,10 +82,10 @@ export class AgentContextInjectorService extends Disposable implements IAgentCon
 
   async injectAfterCompaction(): Promise<void> {
     this.isNewTurn = true;
-    await this.inject();
+    await this.inject(true);
   }
 
-  private async inject(): Promise<void> {
+  private async inject(deduplicate = false): Promise<void> {
     const isNewTurn = this.isNewTurn;
     this.isNewTurn = false;
     for (const entry of this.entries) {
@@ -97,6 +97,7 @@ export class AgentContextInjectorService extends Disposable implements IAgentCon
       });
       if (!this.entries.has(entry)) continue;
       if (content === undefined) continue;
+      if (deduplicate && injectedPositions.length > 0) continue;
       const origin = { kind: 'injection' as const, variant: entry.name };
       if (typeof content === 'string') {
         if (content.trim().length === 0) continue;
diff --git a/packages/agent-core-v2/src/agent/contextMemory/compactionHandoff.ts b/packages/agent-core-v2/src/agent/contextMemory/compactionHandoff.ts
index f17242652b..815b3db699 100644
--- a/packages/agent-core-v2/src/agent/contextMemory/compactionHandoff.ts
+++ b/packages/agent-core-v2/src/agent/contextMemory/compactionHandoff.ts
@@ -12,8 +12,12 @@ export const COMPACTION_SUMMARY_PREFIX = summaryPrefixTemplate.trimEnd();
 export const COMPACT_USER_MESSAGE_MAX_TOKENS = 20_000;
 export const COMPACT_USER_MESSAGE_HEAD_TOKENS = 2_000;
 export const COMPACTION_ELISION_VARIANT = 'compaction_elision';
+export const TURN_OUTCOME_VARIANT = 'turn_outcome';
+
+const COMPACTION_SOURCE_INDEX = Symbol('compactionSourceIndex');
 
 type MessageLike = ContextMessage;
+type IndexedMessage = ContextMessage & { readonly [COMPACTION_SOURCE_INDEX]: number };
 
 export interface CompactionUserSelection<T> {
   readonly head: T[];
@@ -22,6 +26,11 @@ export interface CompactionUserSelection<T> {
   readonly omittedTokens: number;
 }
 
+export interface CompactionTurnOutcome {
+  readonly index: number;
+  readonly message: ContextMessage;
+}
+
 export interface ContextCompactionShapeInput {
   readonly summary: string;
   readonly legacySummaryMessage?: ContextMessage;
@@ -31,6 +40,7 @@ export interface ContextCompactionShapeInput {
   readonly tokensAfter?: number;
   readonly keptUserMessageCount?: number;
   readonly keptHeadUserMessageCount?: number;
+  readonly keptTurnOutcomeCount?: number;
   readonly droppedCount?: number;
   readonly legacyTail?: boolean;
 }
@@ -43,6 +53,7 @@ export interface ContextCompactionShape {
   readonly tokensAfter: number;
   readonly keptUserMessageCount: number;
   readonly keptHeadUserMessageCount?: number;
+  readonly keptTurnOutcomeCount?: number;
   readonly droppedCount?: number;
   readonly messages: readonly ContextMessage[];
 }
@@ -64,19 +75,19 @@ export function buildContextCompactionShape(
       tokensBefore: input.tokensBefore,
       tokensAfter: input.tokensAfter ?? estimateTokensForMessages(messages),
       keptUserMessageCount: 0,
+      keptTurnOutcomeCount: input.keptTurnOutcomeCount,
       droppedCount: input.droppedCount,
       messages,
     };
   }
 
-  const compactableUserMessages = collectCompactableUserMessages(history);
+  const compactableUserMessages = collectIndexedCompactableUserMessages(history);
   const selection = selectCompactionUserMessages(compactableUserMessages);
   const elisionMessage = selection.elided
     ? createCompactionElisionMessage(selection.omittedTokens)
     : undefined;
-  const keptMessages = elisionMessage === undefined
-    ? [...selection.head, ...selection.tail]
-    : [...selection.head, elisionMessage, ...selection.tail];
+  const turnOutcome = latestTurnOutcomeAfterLastAssistant(history);
+  const keptMessages = mergeCompactionHandoff(selection, elisionMessage, turnOutcome);
   const contextSummary = input.contextSummary ?? input.summary;
   const tokensAfter =
     input.tokensAfter ?? estimateTokens(contextSummary) + estimateTokensForMessages(keptMessages);
@@ -93,6 +104,7 @@ export function buildContextCompactionShape(
     tokensAfter,
     keptUserMessageCount,
     keptHeadUserMessageCount,
+    keptTurnOutcomeCount: turnOutcome === undefined ? undefined : 1,
     droppedCount: input.droppedCount,
     messages: [...keptMessages, createCompactionSummaryMessage(contextSummary)],
   };
@@ -135,6 +147,30 @@ export function collectCompactableUserMessages<T extends MessageLike>(messages:
   );
 }
 
+export function latestTurnOutcomeAfterLastAssistant(
+  messages: readonly ContextMessage[],
+): CompactionTurnOutcome | undefined {
+  let lastAssistantIndex = -1;
+  for (let index = messages.length - 1; index >= 0; index--) {
+    const message = messages[index];
+    if (message?.role === 'assistant' && message.origin === undefined) {
+      lastAssistantIndex = index;
+      break;
+    }
+  }
+  for (let index = messages.length - 1; index > lastAssistantIndex; index--) {
+    const message = messages[index];
+    if (
+      message?.role === 'user' &&
+      message.origin?.kind === 'injection' &&
+      message.origin.variant === TURN_OUTCOME_VARIANT
+    ) {
+      return { index, message };
+    }
+  }
+  return undefined;
+}
+
 export function isCompactionSummaryMessage(message: MessageLike): boolean {
   return message.origin?.kind === 'compaction_summary';
 }
@@ -260,6 +296,57 @@ function usesLegacyTailShape(input: ContextCompactionShapeInput): boolean {
   return input.legacyTail === true;
 }
 
+function collectIndexedCompactableUserMessages(
+  history: readonly ContextMessage[],
+): IndexedMessage[] {
+  const messages: IndexedMessage[] = [];
+  history.forEach((message, index) => {
+    if (!isRealUserInput(message) || isCompactionSummaryMessage(message)) return;
+    messages.push({ ...message, [COMPACTION_SOURCE_INDEX]: index });
+  });
+  return messages;
+}
+
+function mergeCompactionHandoff(
+  selection: CompactionUserSelection<IndexedMessage>,
+  elisionMessage: ContextMessage | undefined,
+  turnOutcome: CompactionTurnOutcome | undefined,
+): ContextMessage[] {
+  const head = [...selection.head];
+  const tail = [...selection.tail];
+  if (turnOutcome !== undefined) {
+    const headInsertAt = head.findIndex(
+      (message) => message[COMPACTION_SOURCE_INDEX] > turnOutcome.index,
+    );
+    if (headInsertAt >= 0) {
+      head.splice(headInsertAt, 0, withSourceIndex(turnOutcome.message, turnOutcome.index));
+    } else {
+      const tailInsertAt = tail.findIndex(
+        (message) => message[COMPACTION_SOURCE_INDEX] > turnOutcome.index,
+      );
+      tail.splice(
+        tailInsertAt < 0 ? tail.length : tailInsertAt,
+        0,
+        withSourceIndex(turnOutcome.message, turnOutcome.index),
+      );
+    }
+  }
+  const indexed = elisionMessage === undefined
+    ? [...head, ...tail]
+    : [...head, elisionMessage, ...tail];
+  return indexed.map(stripSourceIndex);
+}
+
+function withSourceIndex(message: ContextMessage, index: number): IndexedMessage {
+  return { ...message, [COMPACTION_SOURCE_INDEX]: index };
+}
+
+function stripSourceIndex(message: ContextMessage | IndexedMessage): ContextMessage {
+  const { [COMPACTION_SOURCE_INDEX]: _index, ...plain } = message as IndexedMessage;
+  void _index;
+  return plain;
+}
+
 function extractText(content: readonly ContentPart[]): string {
   let text = '';
   for (const part of content) {
diff --git a/packages/agent-core-v2/src/agent/contextMemory/contextMemory.ts b/packages/agent-core-v2/src/agent/contextMemory/contextMemory.ts
index 3334d76ab4..705ab978e5 100644
--- a/packages/agent-core-v2/src/agent/contextMemory/contextMemory.ts
+++ b/packages/agent-core-v2/src/agent/contextMemory/contextMemory.ts
@@ -1,4 +1,4 @@
-import { createDecorator } from "#/_base/di/instantiation";
+import { createDecorator } from '#/_base/di/instantiation';
 
 import type { UndoCut } from './contextOps';
 import type { LoopRecordedEvent } from './loopEventFold';
@@ -12,6 +12,7 @@ export interface ContextCompactionInput {
   readonly tokensAfter?: number;
   readonly keptUserMessageCount?: number;
   readonly keptHeadUserMessageCount?: number;
+  readonly keptTurnOutcomeCount?: number;
   readonly droppedCount?: number;
 }
 
@@ -23,6 +24,7 @@ export interface ContextCompactionResult {
   tokensAfter: number;
   keptUserMessageCount: number;
   keptHeadUserMessageCount?: number;
+  keptTurnOutcomeCount?: number;
   droppedCount?: number;
 }
 
@@ -33,8 +35,12 @@ export interface IAgentContextMemoryService {
 
   append(...messages: readonly ContextMessage[]): void;
 
+  appendTurnOutcome(message: ContextMessage, outcomeId: string): void;
+
   appendLoopEvent(event: LoopRecordedEvent): void;
 
+  closeAbandonedToolExchange(output: string): number;
+
   clear(): void;
 
   undo(count: number): UndoCut;
diff --git a/packages/agent-core-v2/src/agent/contextMemory/contextMemoryService.ts b/packages/agent-core-v2/src/agent/contextMemory/contextMemoryService.ts
index d18d7c6942..66081498e1 100644
--- a/packages/agent-core-v2/src/agent/contextMemory/contextMemoryService.ts
+++ b/packages/agent-core-v2/src/agent/contextMemory/contextMemoryService.ts
@@ -47,7 +47,7 @@ import {
   isFullyUndoable,
   type UndoCut,
 } from './contextOps';
-import type { LoopRecordedEvent } from './loopEventFold';
+import { openStepUuid, pendingToolCallIds, type LoopRecordedEvent } from './loopEventFold';
 import type { ContextMessage } from './types';
 
 declare module '#/app/event/eventBus' {
@@ -82,13 +82,46 @@ export class AgentContextMemoryService extends Disposable implements IAgentConte
     this.publishSplice({ start, deleteCount: 0, messages: [...messages] });
   }
 
+  appendTurnOutcome(message: ContextMessage, outcomeId: string): void {
+    const start = this.get().length;
+    this.wire.dispatch(
+      contextAppendMessage({ message, materializedTurnOutcomeId: outcomeId }),
+    );
+    this.publishSplice({ start, deleteCount: 0, messages: [message] });
+  }
+
   appendLoopEvent(event: LoopRecordedEvent): void {
     this.wire.dispatch(contextAppendLoopEvent({ event }));
   }
 
+  closeAbandonedToolExchange(output: string): number {
+    const history = this.get();
+    const toolCallIds = pendingToolCallIds(history);
+    if (toolCallIds.length === 0) return 0;
+    const stepUuid = openStepUuid(history);
+    this.wire.dispatch(
+      ...toolCallIds.map((toolCallId) =>
+        contextAppendLoopEvent({
+          event: {
+            type: 'tool.result',
+            parentUuid: toolCallId,
+            toolCallId,
+            result: { output, isError: true },
+          },
+        }),
+      ),
+      ...(stepUuid === undefined
+        ? []
+        : [contextAppendLoopEvent({ event: { type: 'step.end', uuid: stepUuid } })]),
+    );
+    return toolCallIds.length;
+  }
+
   clear(): void {
     const deleteCount = this.get().length;
-    if (deleteCount === 0) return;
+    // Persist even for an empty transcript: context.clear is also the durable
+    // tombstone for a cancellation/failure outcome intent that may have been
+    // written immediately before its reminder append.
     this.wire.dispatch(contextClear({}), contextSizeMeasured({ length: 0, tokens: 0 }));
     this.publishSplice({ start: 0, deleteCount, messages: [] });
   }
@@ -119,6 +152,7 @@ export class AgentContextMemoryService extends Disposable implements IAgentConte
         tokensAfter: result.tokensAfter,
         keptUserMessageCount: result.keptUserMessageCount,
         keptHeadUserMessageCount: result.keptHeadUserMessageCount,
+        keptTurnOutcomeCount: result.keptTurnOutcomeCount,
         droppedCount: result.droppedCount,
       }),
       contextSizeMeasured({ length: result.messages.length, tokens: result.tokensAfter }),
diff --git a/packages/agent-core-v2/src/agent/contextMemory/contextOps.ts b/packages/agent-core-v2/src/agent/contextMemory/contextOps.ts
index 7638a5c3d3..372a9975a4 100644
--- a/packages/agent-core-v2/src/agent/contextMemory/contextOps.ts
+++ b/packages/agent-core-v2/src/agent/contextMemory/contextOps.ts
@@ -135,7 +135,10 @@ const contextMessageSchema = z.custom<ContextMessage>();
 const loopRecordedEventSchema = z.custom<LoopRecordedEvent>();
 
 export const contextAppendMessage = ContextModel.defineOp('context.append_message', {
-  schema: z.object({ message: contextMessageSchema }),
+  schema: z.object({
+    message: contextMessageSchema,
+    materializedTurnOutcomeId: z.string().optional(),
+  }),
   apply: (state, p) => foldAppendMessage(state, p.message) as ContextMessage[],
 });
 
@@ -154,6 +157,7 @@ const contextCompactionBaseShape = {
   tokensAfter: z.number().optional(),
   keptUserMessageCount: z.number().optional(),
   keptHeadUserMessageCount: z.number().optional(),
+  keptTurnOutcomeCount: z.number().optional(),
   droppedCount: z.number().optional(),
   legacyTail: z.boolean().optional(),
 };
@@ -217,6 +221,7 @@ export function readContextCompactionShapeInput(
     tokensAfter: readOptionalNumber(fields, 'tokensAfter'),
     keptUserMessageCount,
     keptHeadUserMessageCount: readOptionalNumber(fields, 'keptHeadUserMessageCount'),
+    keptTurnOutcomeCount: readOptionalNumber(fields, 'keptTurnOutcomeCount'),
     droppedCount: readOptionalNumber(fields, 'droppedCount'),
     legacyTail: readOptionalBoolean(fields, 'legacyTail') ?? keptUserMessageCount === undefined,
   };
diff --git a/packages/agent-core-v2/src/agent/contextMemory/contextTranscript.ts b/packages/agent-core-v2/src/agent/contextMemory/contextTranscript.ts
index 481dd5865f..368aabbe50 100644
--- a/packages/agent-core-v2/src/agent/contextMemory/contextTranscript.ts
+++ b/packages/agent-core-v2/src/agent/contextMemory/contextTranscript.ts
@@ -22,8 +22,8 @@
  *   - `context.apply_compaction`  → keep the full history, append the user-role
  *                                   summary marker, recover `foldedLength` from
  *                                   the recorded kept-count fields
- *   - `context.undo`              → remove tail messages (skip injections, stop
- *                                   at compaction summaries / clear floor)
+ *   - `context.undo`              → remove the target prompt and its full tail,
+ *                                   stopping at compaction summaries / clear floor
  *   - `context.clear`             → keep prior transcript entries but reset the
  *                                   folded view
  */
@@ -34,9 +34,9 @@ import type { WireRecord } from '#/wire/record';
 import {
   COMPACT_USER_MESSAGE_MAX_TOKENS,
   collectCompactableUserMessages,
-  isRealUserInput,
   selectRecentUserMessages,
 } from './compactionHandoff';
+import { computeUndoCut, isFullyUndoable } from './contextOps';
 import type { LoopRecordedEvent } from './loopEventFold';
 import type { ContextMessage } from './types';
 
@@ -172,18 +172,16 @@ export function createContextTranscriptReducer(): ContextTranscriptReducer {
 
   const applyUndo = (count: number): void => {
     if (count <= 0) return;
-    let removedUserCount = 0;
-    for (let i = transcript.length - 1; i >= clearFloor; i--) {
-      const message = transcript[i]!.message;
-      if (message.origin?.kind === 'injection') continue;
-      if (message.origin?.kind === 'compaction_summary') break;
-      transcript.splice(i, 1);
-      foldedLength = Math.max(0, foldedLength - 1);
-      if (isRealUserInput(message)) {
-        removedUserCount++;
-        if (removedUserCount >= count) break;
-      }
-    }
+    const visibleEntries = transcript.slice(clearFloor);
+    const cut = computeUndoCut(
+      visibleEntries.map((entry) => entry.message),
+      count,
+    );
+    if (!isFullyUndoable(cut, count)) return;
+    const cutIndex = clearFloor + cut.cutIndex;
+    const removedLength = transcript.length - cutIndex;
+    transcript.splice(cutIndex);
+    foldedLength = Math.max(0, foldedLength - removedLength);
     resetOpenState();
   };
 
@@ -258,9 +256,14 @@ function recoverFoldedLength(
 ): number {
   const keptUserMessageCount = readNumber(record, 'keptUserMessageCount');
   const keptHeadUserMessageCount = readNumber(record, 'keptHeadUserMessageCount');
+  const keptTurnOutcomeCount = readNumber(record, 'keptTurnOutcomeCount') ?? 0;
   const compactedCount = readNumber(record, 'compactedCount');
   if (keptUserMessageCount !== undefined) {
-    return keptUserMessageCount + (keptHeadUserMessageCount === undefined ? 1 : 2);
+    return (
+      keptUserMessageCount +
+      keptTurnOutcomeCount +
+      (keptHeadUserMessageCount === undefined ? 1 : 2)
+    );
   }
   if (compactedCount !== undefined && compactedCount < foldedLength) {
     return 1 + (foldedLength - compactedCount);
diff --git a/packages/agent-core-v2/src/agent/contextMemory/loopEventFold.ts b/packages/agent-core-v2/src/agent/contextMemory/loopEventFold.ts
index 546efab460..1fc813690a 100644
--- a/packages/agent-core-v2/src/agent/contextMemory/loopEventFold.ts
+++ b/packages/agent-core-v2/src/agent/contextMemory/loopEventFold.ts
@@ -139,6 +139,14 @@ export function foldAppendMessage(
   return bind([...state, message], ctx);
 }
 
+export function pendingToolCallIds(state: readonly ContextMessage[]): readonly string[] {
+  return [...ctxOf(state).pending];
+}
+
+export function openStepUuid(state: readonly ContextMessage[]): string | undefined {
+  return ctxOf(state).openStepUuid;
+}
+
 export function foldLoopEvent(
   state: readonly ContextMessage[],
   event: LoopRecordedEvent,
diff --git a/packages/agent-core-v2/src/agent/fullCompaction/compactionOps.ts b/packages/agent-core-v2/src/agent/fullCompaction/compactionOps.ts
index 858ec85c36..5431f27b68 100644
--- a/packages/agent-core-v2/src/agent/fullCompaction/compactionOps.ts
+++ b/packages/agent-core-v2/src/agent/fullCompaction/compactionOps.ts
@@ -2,29 +2,30 @@
  * `fullCompaction` domain (L4) — wire Model (`CompactionModel`) and the
  * `full_compaction.begin` (`fullCompactionBegin`) / `full_compaction.cancel`
  * (`fullCompactionCancel`) / `full_compaction.complete`
- * (`fullCompactionComplete`) Ops that mirror the full-compaction lifecycle into
- * a persisted, replayable phase, plus the `compaction.*` edge events
+ * (`fullCompactionComplete`) Ops that mirror the full-compaction lifecycle
+ * into a persisted, replayable phase, plus the `compaction.*` edge events
  * (`started` / `blocked` / `cancelled` / `completed`) declared on `DomainEventMap`
  * (`compaction.started` is derived from the `full_compaction.begin` Op's
  * `toEvent`; the rest publish directly from the service).
  *
- * The Model is intentionally phase-only — `{ phase }` (initial `idle`). The
- * richer per-compaction data is NOT resume state: `instruction` is only needed
- * by the live worker (which does not survive a restart) and by telemetry, so it
- * rides the `begin` payload (and is persisted on the record for audit) but is
- * not stored in the Model; result numbers are consumed live by the
- * `compaction.completed` signal and their durable effect (the summary message
- * plus compaction metrics) already lives in `contextMemory`. The live
- * `complete` payload is empty to match the v1 wire shape; legacy logs may still
- * carry result numbers, and `apply` accepts and ignores them while collapsing
- * to `idle`. Each `apply` returns the same reference on a no-op so the wire's
- * reference-equality gate stays quiet; it carries no non-determinism.
+ * The Model is intentionally phase-only — `{ phase }` (initial `idle`). A
+ * `context.apply_compaction` cross-reducer advances a running compaction to
+ * `committed`, making the context replacement the durable commit point. The
+ * richer per-compaction data is not resume state: `instruction` is only needed
+ * by the live worker and telemetry, while the committed summary and accounting
+ * already live in `contextMemory`. A pre-commit failure uses the existing
+ * `full_compaction.complete` record type with `outcome: 'failed'`, preserving
+ * the v1 wire vocabulary while distinguishing it from a successful terminal;
+ * legacy complete records omit that field and remain successful. Older records
+ * may also carry result numbers, which `apply` ignores. Each reducer returns the
+ * same reference on a no-op so the wire's reference-equality gate stays quiet
+ * and carries no non-determinism.
  *
  * The runtime orchestration — `ActiveCompaction`, its `AbortController`, and
  * the in-flight worker promise — stays OUT of the Model (live-only service
- * members): none of it can be resumed, and a session never restores mid-flight.
- * A `running` phase stranded by a crash is reset to `idle` by the service's
- * `wire.hooks.onDidRestore` hook (mirroring `goal`'s post-replay normalization).
+ * members): none of it can be resumed. The service's `wire.hooks.onDidRestore`
+ * hook fails a stranded pre-commit run and converges a committed run before
+ * returning the Agent to `idle`.
  *
  * The `compaction.*` events publish to `IEventBus` (`compaction.started` via the
  * `begin` Op's `toEvent`; the rest directly from the service); they are
@@ -61,15 +62,22 @@ export interface CompactionCompletedEvent {
   readonly result: CompactionResult;
 }
 
-export type CompactionPhase = 'idle' | 'running' | 'cancelled' | 'completed';
+export type CompactionPhase = 'idle' | 'running' | 'committed';
 
 export interface CompactionState {
   readonly phase: CompactionPhase;
 }
 
-export const CompactionModel = defineModel<CompactionState>('fullCompaction', () => ({
-  phase: 'idle',
-}));
+export const CompactionModel = defineModel<CompactionState>(
+  'fullCompaction',
+  () => ({ phase: 'idle' }),
+  {
+    reducers: {
+      'context.apply_compaction': (state) =>
+        state.phase === 'running' ? { phase: 'committed' } : state,
+    },
+  },
+);
 
 declare module '#/app/event/eventBus' {
   interface DomainEventMap {
@@ -104,6 +112,10 @@ export const fullCompactionCancel = CompactionModel.defineOp('full_compaction.ca
 });
 
 export const fullCompactionComplete = CompactionModel.defineOp('full_compaction.complete', {
-  schema: z.object({}),
+  schema: z.object({ outcome: z.literal('failed').optional() }),
   apply: (s) => (s.phase === 'idle' ? s : { phase: 'idle' }),
 });
+
+export function fullCompactionFail(): ReturnType<typeof fullCompactionComplete> {
+  return fullCompactionComplete({ outcome: 'failed' });
+}
diff --git a/packages/agent-core-v2/src/agent/fullCompaction/fullCompactionService.ts b/packages/agent-core-v2/src/agent/fullCompaction/fullCompactionService.ts
index 03e169ac5b..f9174f3af4 100644
--- a/packages/agent-core-v2/src/agent/fullCompaction/fullCompactionService.ts
+++ b/packages/agent-core-v2/src/agent/fullCompaction/fullCompactionService.ts
@@ -1,16 +1,20 @@
-import { Disposable, type IDisposable } from "#/_base/di/lifecycle";
+import { Disposable, type IDisposable } from '#/_base/di/lifecycle';
 import { InstantiationType } from '#/_base/di/extensions';
 import { IInstantiationService } from '#/_base/di/instantiation';
 import { LifecycleScope, registerScopedService } from '#/_base/di/scope';
 import { ILogService } from '#/_base/log/log';
-import { renderPrompt } from "#/_base/utils/render-prompt";
+import { renderPrompt } from '#/_base/utils/render-prompt';
 import {
   estimateTokens,
   estimateTokensForMessage,
   estimateTokensForMessages,
   estimateTokensForTools,
-} from "#/_base/utils/tokens";
-import { buildCompactionSummaryText, isRealUserInput } from '#/agent/contextMemory/compactionHandoff';
+} from '#/_base/utils/tokens';
+import {
+  buildCompactionSummaryText,
+  buildContextCompactionShape,
+  isRealUserInput,
+} from '#/agent/contextMemory/compactionHandoff';
 import { IAgentContextInjectorService } from '#/agent/contextInjector/contextInjector';
 import { IAgentContextMemoryService } from '#/agent/contextMemory/contextMemory';
 import type { ContextMessage } from '#/agent/contextMemory/types';
@@ -38,7 +42,14 @@ import { inputTotal, type TokenUsage } from '#/app/llmProtocol/usage';
 import { IEventBus } from '#/app/event/eventBus';
 import type { CompactionFinishedEvent } from '#/app/telemetry/events';
 import { ITelemetryService } from '#/app/telemetry/telemetry';
-import { ErrorCodes, Error2, isCodedError, isError2, toKimiErrorPayload, unwrapErrorCause } from "#/errors";
+import {
+  ErrorCodes,
+  Error2,
+  isCodedError,
+  isError2,
+  toKimiErrorPayload,
+  unwrapErrorCause,
+} from '#/errors';
 import { IWireService } from '#/wire/wire';
 import compactionInstructionTemplate from './compaction-instruction.md?raw';
 import {
@@ -55,6 +66,7 @@ import {
   fullCompactionBegin,
   fullCompactionCancel,
   fullCompactionComplete,
+  fullCompactionFail,
 } from './compactionOps';
 import {
   type CompactionBeginData,
@@ -81,6 +93,9 @@ type CompactionTelemetryProperties = Pick<
 
 interface ActiveCompaction extends FullCompactionTask {
   blockedByTurn: boolean;
+  turnId?: number;
+  phase: 'running' | 'cancelling' | 'committing' | 'committed' | 'finished';
+  committedResult?: CompactionResult;
   bgRegistration?: IDisposable;
 }
 
@@ -111,6 +126,10 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
   private lastCompactedTokenCount: number | null = null;
   private consecutiveOverflowCompactions = 0;
   private contextInjectorService: IAgentContextInjectorService | undefined;
+  private systemPromptRefreshPending = false;
+  private systemPromptRefreshTurnId: number | undefined;
+  private contextReinjectionPending = false;
+  private postCommitMaintenance: Promise<Error | undefined> | undefined;
 
   constructor(
     @IAgentContextMemoryService private readonly context: IAgentContextMemoryService,
@@ -132,8 +151,8 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
     this.strategy = new RuntimeCompactionStrategy(() => this.resolveModelContextWithEffectiveMax());
     this._register(
       this.wire.hooks.onDidRestore.register('full-compaction', async (_ctx, next) => {
-        this.normalizeAfterReplay();
         await next();
+        await this.normalizeAfterReplay();
       }),
     );
     this._register(
@@ -146,8 +165,8 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
       }),
     );
     this._register(
-      this.loopService.hooks.onDidFinishStep.register('full-compaction', async (_ctx, next) => {
-        await this.afterStep();
+      this.loopService.hooks.onDidFinishStep.register('full-compaction', async (ctx, next) => {
+        await this.afterStep(ctx.turnId);
         await next();
       }),
     );
@@ -236,15 +255,15 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
     this.observedMaxContextTokensByModel.set(modelAlias, observed);
   }
 
-  begin(input: FullCompactionInput): boolean {
-    if (this._compacting) return false;
+  begin(input: FullCompactionInput, turnId?: number): boolean {
+    if (this._compacting || this.wire.getModel(CompactionModel).phase !== 'idle') return false;
     const data: CompactionBeginData = { source: input.source, instruction: input.instruction };
     if (!this.reserveCompactionSlot(data.source)) return false;
 
     const tokenCount = this.validateCompactionStart(data.source);
     this.wire.dispatch(fullCompactionBegin(data));
 
-    const active = this.createActiveCompaction(data.source, tokenCount);
+    const active = this.createActiveCompaction(data.source, tokenCount, turnId);
     this._compacting = active.task;
     active.task.abortController.signal.addEventListener(
       'abort',
@@ -282,6 +301,7 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
   private createActiveCompaction(
     trigger: CompactionBeginData['source'],
     tokenCount: number,
+    turnId?: number,
   ): {
     readonly task: ActiveCompaction;
     readonly resolve: (result: CompactionResult) => void;
@@ -301,6 +321,8 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
         trigger,
         tokenCount,
         blockedByTurn: false,
+        turnId,
+        phase: 'running',
         bgRegistration: this.activity.registerBackground('compaction', abortController),
       },
       resolve,
@@ -309,7 +331,8 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
   }
 
   private cancelActive(active: ActiveCompaction): boolean {
-    if (this._compacting !== active) return false;
+    if (this._compacting !== active || active.phase !== 'running') return false;
+    active.phase = 'cancelling';
     this.wire.dispatch(fullCompactionCancel({}));
     this._compacting = null;
     active.bgRegistration?.dispose();
@@ -320,17 +343,37 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
     return true;
   }
 
-  private markCompleted(active: ActiveCompaction): boolean {
-    if (this._compacting !== active) return false;
-    this.wire.dispatch(fullCompactionComplete({}));
+  private failActive(active: ActiveCompaction): boolean {
+    if (
+      this._compacting !== active ||
+      (active.phase !== 'running' && active.phase !== 'committing')
+    ) {
+      return false;
+    }
+    active.phase = 'finished';
+    this.wire.dispatch(fullCompactionFail());
     this._compacting = null;
     active.bgRegistration?.dispose();
     return true;
   }
 
-  private normalizeAfterReplay(): void {
-    if (this.wire.getModel(CompactionModel).phase !== 'running') return;
-    this.wire.dispatch(fullCompactionCancel({}));
+  private releaseCommitted(active: ActiveCompaction): boolean {
+    if (this._compacting !== active || active.phase !== 'committed') return false;
+    active.phase = 'finished';
+    this._compacting = null;
+    active.bgRegistration?.dispose();
+    return true;
+  }
+
+  private async normalizeAfterReplay(): Promise<void> {
+    const phase = this.wire.getModel(CompactionModel).phase;
+    if (phase === 'running') {
+      this.wire.dispatch(fullCompactionFail());
+      return;
+    }
+    if (phase !== 'committed') return;
+    this.schedulePostCommitMaintenance();
+    await this.retryPostCommitMaintenance(false);
   }
 
   private resetForTurn(): void {
@@ -343,7 +386,7 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
     context: LoopErrorContext,
   ): Promise<boolean> {
     this.recordOverflowRecovery(context.error);
-    const didStartCompaction = this.beginAutoCompaction();
+    const didStartCompaction = this.beginAutoCompaction(true, context.turnId);
     if (!didStartCompaction && !this._compacting) return false;
 
     await this.block(context.signal, context.turnId);
@@ -370,20 +413,22 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
   }
 
   private async beforeStep(signal: AbortSignal, turnId?: number): Promise<void> {
-    this.checkAutoCompaction();
+    await this.retryPostCommitMaintenance(true);
+    this.checkAutoCompaction(true, turnId);
     if (this.strategy.shouldBlock(this.tokenCountWithPending())) {
       await this.block(signal, turnId);
     }
+    await this.retryPostCommitMaintenance(true);
   }
 
-  private async afterStep(): Promise<void> {
+  private async afterStep(turnId: number): Promise<void> {
     this.consecutiveOverflowCompactions = 0;
     if (this.strategy.checkAfterStep) {
-      this.checkAutoCompaction(false);
+      this.checkAutoCompaction(false, turnId);
     }
   }
 
-  private checkAutoCompaction(throwOnLimit = true): boolean {
+  private checkAutoCompaction(throwOnLimit = true, turnId?: number): boolean {
     if (this._compacting) return true;
     if (
       this.lastCompactedTokenCount !== null &&
@@ -392,10 +437,10 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
       return false;
     }
     if (!this.strategy.shouldCompact(this.tokenCountWithPending())) return false;
-    return this.beginAutoCompaction(throwOnLimit);
+    return this.beginAutoCompaction(throwOnLimit, turnId);
   }
 
-  private beginAutoCompaction(throwOnLimit = true): boolean {
+  private beginAutoCompaction(throwOnLimit = true, turnId?: number): boolean {
     if (this._compacting) return true;
     const maxCompactions = this.strategy.maxCompactionPerTurn;
     if (this.compactionCountInTurn >= maxCompactions) {
@@ -406,13 +451,14 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
       }
       return false;
     }
-    return this.begin({ source: 'auto' });
+    return this.begin({ source: 'auto' }, turnId);
   }
 
   private async block(signal?: AbortSignal, turnId?: number): Promise<void> {
     const active = this._compacting;
     if (active === null) return;
     active.blockedByTurn = true;
+    active.turnId ??= turnId;
     this.propagateBlockingAbort(active, signal);
     this.eventBus.publish({ type: 'compaction.blocked', turnId });
     try {
@@ -451,30 +497,24 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
     try {
       const result = await this.compactionRound(active, data);
       if (this._compacting !== active) throw compactionCancelledReason(active);
-      try {
-        await this.profile.refreshSystemPrompt();
-      } catch (error) {
-        this.log.error('failed to refresh system prompt after compaction', { error });
+      return await this.finishCommittedCompaction(active, result);
+    } catch (error) {
+      if (
+        active.phase === 'committing' &&
+        this.wire.getModel(CompactionModel).phase === 'committed'
+      ) {
+        active.phase = 'committed';
       }
-      this.lastCompactedTokenCount = result.tokensAfter;
-      await this.contextInjector.injectAfterCompaction();
-      this.lastCompactedTokenCount = this.tokenCountWithPending();
-      if (!this.markCompleted(active)) {
-        throw compactionCancelledReason(active);
+      if (active.phase === 'committed' && active.committedResult !== undefined) {
+        this.reportDiagnosticError('post-commit compaction work failed', error);
+        return await this.finishCommittedCompaction(active, active.committedResult);
       }
-      const { contextSummary: _contextSummary, ...eventResult } = result;
-      void _contextSummary;
-      this.eventBus.publish({ type: 'compaction.completed', result: eventResult });
-      return result;
-    } catch (error) {
-      if (active.abortController.signal.aborted || isAbortError(error)) {
+      if (active.abortController.signal.aborted) {
         this.cancelActive(active);
         throw error;
       }
       const blockedByTurn = this._compacting === active && active.blockedByTurn;
-      if (this._compacting === active) {
-        this.cancelActive(active);
-      }
+      this.failActive(active);
       if (blockedByTurn) {
         throw error;
       }
@@ -488,6 +528,20 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
     }
   }
 
+  private async finishCommittedCompaction(
+    active: ActiveCompaction,
+    result: CompactionResult,
+  ): Promise<CompactionResult> {
+    this.lastCompactedTokenCount = result.tokensAfter;
+    this.schedulePostCommitMaintenance(active.turnId);
+    await this.retryPostCommitMaintenance(false);
+    this.releaseCommitted(active);
+    const { contextSummary: _contextSummary, ...eventResult } = result;
+    void _contextSummary;
+    this.eventBus.publish({ type: 'compaction.completed', result: eventResult });
+    return result;
+  }
+
   private async compactionRound(
     active: ActiveCompaction,
     data: Readonly<CompactionBeginData>,
@@ -611,13 +665,21 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
       }
 
       const summary = this.postProcessSummary(attempt.summary);
-      const result = this.context.applyCompaction({
+      const compactionInput = {
         summary,
         contextSummary: buildCompactionSummaryText(summary),
         compactedCount: originalHistory.length,
         tokensBefore,
         droppedCount: droppedCount === 0 ? undefined : droppedCount,
-      });
+      };
+      const prepared = buildContextCompactionShape(this.context.get(), compactionInput);
+      const { messages: _messages, ...preparedResult } = prepared;
+      void _messages;
+      active.phase = 'committing';
+      active.committedResult = preparedResult;
+      const result = this.context.applyCompaction(compactionInput);
+      active.phase = 'committed';
+      active.committedResult = result;
 
       const properties: CompactionFinishedEvent = {
         source: data.source,
@@ -634,7 +696,7 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
       this.telemetry.track2('compaction_finished', properties);
       return result;
     } catch (error) {
-      if (isAbortError(error)) throw error;
+      if (isAbortError(error) && active.abortController.signal.aborted) throw error;
       this.telemetry.track2('compaction_failed', {
         source: data.source,
         tokens_before: tokensBefore,
@@ -671,6 +733,81 @@ export class AgentFullCompactionService extends Disposable implements IAgentFull
     return this.contextSize.get().size;
   }
 
+  private schedulePostCommitMaintenance(turnId?: number): void {
+    this.systemPromptRefreshPending = true;
+    this.systemPromptRefreshTurnId = turnId;
+    this.contextReinjectionPending = true;
+  }
+
+  private async retryPostCommitMaintenance(throwOnFailure: boolean): Promise<void> {
+    if (
+      !this.systemPromptRefreshPending &&
+      !this.contextReinjectionPending &&
+      this.wire.getModel(CompactionModel).phase !== 'committed'
+    ) {
+      return;
+    }
+    let maintenance = this.postCommitMaintenance;
+    if (maintenance === undefined) {
+      maintenance = this.performPostCommitMaintenance();
+      this.postCommitMaintenance = maintenance;
+      void maintenance.finally(() => {
+        if (this.postCommitMaintenance === maintenance) {
+          this.postCommitMaintenance = undefined;
+        }
+      });
+    }
+    const error = await maintenance;
+    if (throwOnFailure && error !== undefined) throw error;
+  }
+
+  private async performPostCommitMaintenance(): Promise<Error | undefined> {
+    let firstError: Error | undefined;
+    if (this.systemPromptRefreshPending) {
+      try {
+        const systemPrompt = await this.profile.refreshSystemPrompt();
+        if (systemPrompt !== undefined && this.systemPromptRefreshTurnId !== undefined) {
+          this.llmRequester.refreshTurnSystemPrompt(
+            this.systemPromptRefreshTurnId,
+            systemPrompt,
+          );
+        }
+        this.systemPromptRefreshPending = false;
+        this.systemPromptRefreshTurnId = undefined;
+      } catch (error) {
+        firstError = error instanceof Error ? error : new Error(String(error));
+        this.reportDiagnosticError('failed to refresh system prompt after compaction', error);
+      }
+    }
+    if (this.contextReinjectionPending) {
+      try {
+        await this.contextInjector.injectAfterCompaction();
+        this.contextReinjectionPending = false;
+      } catch (error) {
+        firstError ??= error instanceof Error ? error : new Error(String(error));
+        this.reportDiagnosticError('failed to inject context after compaction', error);
+      }
+    }
+    this.lastCompactedTokenCount = this.tokenCountWithPending();
+    if (
+      !this.systemPromptRefreshPending &&
+      !this.contextReinjectionPending &&
+      this.wire.getModel(CompactionModel).phase === 'committed'
+    ) {
+      this.wire.dispatch(fullCompactionComplete({}));
+    }
+    return firstError;
+  }
+
+  private reportDiagnosticError(message: string, error: unknown): void {
+    try {
+      this.log.error(message, { error });
+    } catch {
+      // Post-commit diagnostics must not alter compaction convergence or make
+      // an already-committed result appear to have failed.
+    }
+  }
+
   private get contextInjector(): IAgentContextInjectorService {
     if (this.contextInjectorService === undefined) {
       this.contextInjectorService = this.instantiation.invokeFunction((accessor) =>
diff --git a/packages/agent-core-v2/src/agent/fullCompaction/types.ts b/packages/agent-core-v2/src/agent/fullCompaction/types.ts
index 2d7f38f70e..1d84c915ca 100644
--- a/packages/agent-core-v2/src/agent/fullCompaction/types.ts
+++ b/packages/agent-core-v2/src/agent/fullCompaction/types.ts
@@ -21,6 +21,7 @@ export interface CompactionResult {
    * backward compatibility with older wire records.
    */
   keptHeadUserMessageCount?: number;
+  keptTurnOutcomeCount?: number;
   /**
    * Oldest messages trimmed from the summarizer input when the compaction
    * request overflowed the model window; not covered by the produced summary.
diff --git a/packages/agent-core-v2/src/agent/llmRequester/llmRequester.ts b/packages/agent-core-v2/src/agent/llmRequester/llmRequester.ts
index 259ecf019b..e27513347e 100644
--- a/packages/agent-core-v2/src/agent/llmRequester/llmRequester.ts
+++ b/packages/agent-core-v2/src/agent/llmRequester/llmRequester.ts
@@ -59,6 +59,14 @@ export interface LLMRequestOverrides {
 export interface IAgentLLMRequesterService {
   readonly _serviceBrand: undefined;
 
+  /**
+   * Replace only the system-prompt field of a turn's request snapshot after
+   * full compaction re-renders the active profile. Model/provider/thinking
+   * choices remain frozen for the turn, and ordinary config updates still
+   * take effect only on a later turn.
+   */
+  refreshTurnSystemPrompt(turnId: number, systemPrompt: string): void;
+
   request(
     overrides?: LLMRequestOverrides,
     onPart?: LLMRequestPartHandler,
diff --git a/packages/agent-core-v2/src/agent/llmRequester/llmRequesterService.ts b/packages/agent-core-v2/src/agent/llmRequester/llmRequesterService.ts
index 7a27849d62..a00d2a1a6f 100644
--- a/packages/agent-core-v2/src/agent/llmRequester/llmRequesterService.ts
+++ b/packages/agent-core-v2/src/agent/llmRequester/llmRequesterService.ts
@@ -146,6 +146,12 @@ export class AgentLLMRequesterService implements IAgentLLMRequesterService {
     @IFaultInjectionService private readonly faultInjection: IFaultInjectionService,
   ) {}
 
+  refreshTurnSystemPrompt(turnId: number, systemPrompt: string): void {
+    const snapshot = this.turnConfigs.get(turnId);
+    if (snapshot === undefined) return;
+    this.turnConfigs.set(turnId, { ...snapshot, systemPrompt });
+  }
+
   async request(
     overrides: LLMRequestOverrides = {},
     onPart: LLMRequestPartHandler = noopOnPart,
diff --git a/packages/agent-core-v2/src/agent/loop/loopService.ts b/packages/agent-core-v2/src/agent/loop/loopService.ts
index f15f148d4f..56a7aee48d 100644
--- a/packages/agent-core-v2/src/agent/loop/loopService.ts
+++ b/packages/agent-core-v2/src/agent/loop/loopService.ts
@@ -23,8 +23,10 @@
  * `stepRetry` re-enqueues the failed driver after backoff, `fullCompaction`
  * compacts and re-enqueues it — so the loop only learns caught-or-not, while
  * an unclaimed or uncaught error fails the turn. Emits `turn.*` / delta
- * events through `event`, persists loop events through `contextMemory`, and
- * reads the step budget from `config`. Bound at Agent scope.
+ * events through `event`, persists loop events through `contextMemory`, appends
+ * abnormal-turn context through `systemReminder`, reads the step budget from
+ * `config`, and reports reminder-persistence failures through `log`. Bound at
+ * Agent scope.
  */
 
 import { randomUUID } from 'node:crypto';
@@ -34,6 +36,7 @@ import { createControlledPromise } from '@antfu/utils';
 import { InstantiationType } from '#/_base/di/extensions';
 import { Disposable, toDisposable, type IDisposable } from '#/_base/di/lifecycle';
 import { LifecycleScope, registerScopedService } from '#/_base/di/scope';
+import { ILogService } from '#/_base/log/log';
 import { abortError, isAbortError, isUserCancellation, userCancellationReason } from '#/_base/utils/abort';
 import { toErrorMessage } from '#/_base/errors/errorMessage';
 import { IAgentLLMRequesterService, type LLMRequestFinish } from '#/agent/llmRequester/llmRequester';
@@ -49,6 +52,7 @@ import { OrderedHookSlot } from '#/hooks';
 import type { ActivityLease } from '#/activity/activity';
 import { IAgentActivityService } from '#/activity/activity';
 import { IAgentContextMemoryService } from '#/agent/contextMemory/contextMemory';
+import { IAgentSystemReminderService } from '#/agent/systemReminder/systemReminder';
 import { IAgentTelemetryContextService } from '#/app/telemetry/agentTelemetryContext';
 import type {
   TurnEndedEvent as TurnEndedTelemetryEvent,
@@ -81,7 +85,18 @@ import {
   type TurnSeed,
 } from './stepRequest';
 import { StepRequestQueue, type StepRequestBatch } from './stepRequestQueue';
-import { cancelTurn, promptTurn, TurnModel } from './turnOps';
+import {
+  cancelTurn,
+  promptTurn,
+  TurnModel,
+  turnOutcome,
+  type TurnOutcomeIntent,
+} from './turnOps';
+import {
+  renderTurnCancellationReminder,
+  renderTurnFailureReminder,
+  TURN_OUTCOME_REMINDER_VARIANT,
+} from './turnOutcomeReminder';
 // Loads the `DomainEventMap` augmentation for the `turn.*` / delta events this
 // service publishes (the augmentation lives with the event definitions;
 // without an import it would not enter every consumer's program).
@@ -103,10 +118,13 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
   private readonly pendingTurns: TurnJob[] = [];
   private activeTurnJob: TurnJob | undefined;
   private nextReservedTurnId: number | undefined;
+  private readonly cancellingTurnIds = new Set<number>();
   private disposing = false;
 
   constructor(
     @IAgentContextMemoryService private readonly context: IAgentContextMemoryService,
+    @IAgentSystemReminderService private readonly reminders: IAgentSystemReminderService,
+    @ILogService private readonly log: ILogService,
     @IAgentLLMRequesterService private readonly llmRequester: IAgentLLMRequesterService,
     @IEventBus private readonly eventBus: IEventBus,
     @IAgentToolExecutorService private readonly toolExecutor: IAgentToolExecutorService,
@@ -117,6 +135,12 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
     @IAgentTelemetryContextService private readonly telemetryContext: IAgentTelemetryContextService,
   ) {
     super();
+    this._register(
+      this.wire.hooks.onDidRestore.register('loop-turn-outcome', async (_ctx, next) => {
+        await next();
+        this.materializePendingTurnOutcomes(true);
+      }),
+    );
   }
 
   override dispose(): void {
@@ -198,7 +222,15 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
   private cancelActiveTurn(turnId: number | undefined, cancellation: unknown): boolean {
     const turn = this.activeTurnJob?.turn;
     if (turn === undefined || (turnId !== undefined && turn.id !== turnId)) return false;
-    this.wire.dispatch(cancelTurn({ turnId }));
+    if (this.cancellingTurnIds.has(turn.id)) return true;
+    this.cancellingTurnIds.add(turn.id);
+    const outcome = this.createCancellationOutcome(turn.id, cancellation);
+    this.wire.dispatch(cancelTurn({
+      turnId,
+      outcomeId: outcome?.outcomeId,
+      outcomeTurnId: outcome?.turnId,
+      outcomeContent: outcome?.content,
+    }));
     return this.activity.cancel(cancellation);
   }
 
@@ -321,19 +353,37 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
     return true;
   }
 
-  private pumpTurns(): void {
+  private pumpTurns(continueAfterStartFailure = false): void {
     if (this.disposing || this.activeTurnJob !== undefined) return;
-    const job = this.pendingTurns.shift();
-    if (job === undefined) return;
-    this.startTurn(job);
+    while (!this.disposing && this.activeTurnJob === undefined) {
+      const job = this.pendingTurns.shift();
+      if (job === undefined) return;
+      try {
+        this.startTurn(job);
+        return;
+      } catch (error) {
+        if (!continueAfterStartFailure || job.turn.state !== 'failed') throw error;
+      }
+    }
   }
 
   private startTurn(job: TurnJob): void {
     const lease = this.activity.begin('turn', { origin: job.seed.origin, turnId: job.turn.id });
-    this.wire.dispatch(promptTurn({ input: job.seed.input, origin: lease.origin }));
     job.turn.state = 'running';
     job.turn.signal = lease.signal;
     this.activeTurnJob = job;
+    try {
+      // An abnormal-turn intent is a durable ordering barrier: the reminder
+      // must reach context before the next prompt can be admitted. If the
+      // append actually committed and only a downstream observer threw, the
+      // TurnModel acknowledgement below lets this continue without retrying or
+      // duplicating it.
+      this.materializePendingTurnOutcomes(true);
+    } catch (error) {
+      this.failTurnStart(job, lease, error);
+      throw error;
+    }
+    this.wire.dispatch(promptTurn({ input: job.seed.input, origin: lease.origin }));
     this.eventBus.publish({ type: 'turn.started', turnId: job.turn.id, origin: lease.origin });
     void this.runTurn(job.turn, lease, job.ready).then(job.result.resolve, job.result.reject);
   }
@@ -348,6 +398,7 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
     const turnTelemetry = this.telemetry.withContext(telemetryContext);
     const { mode, provider_type, protocol } = telemetryContext;
     let result: TurnResult | undefined;
+    let terminalOutcome: TurnOutcomeIntent | undefined;
     try {
       const started: TurnStartedTelemetryEvent = { turn_id: turn.id, mode, provider_type, protocol };
       turnTelemetry.track2('turn_started', started);
@@ -361,12 +412,17 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
       result = this.resultFromTurnError(lease, error);
       return result;
     } finally {
+      const error = result?.type === 'failed' ? toKimiErrorPayload(result.error) : undefined;
+      if (result !== undefined) {
+        terminalOutcome = this.ensureTurnOutcomeIntent(turn.id, result, error);
+      }
       this.settleTurnReady(ready, result);
       this.releaseActiveTurn(turn, result);
       const outcome = result?.type ?? 'failed';
       lease.end(outcome, result?.type === 'failed' ? { error: result.error } : undefined);
       if (result !== undefined) {
-        const error = result.type === 'failed' ? toKimiErrorPayload(result.error) : undefined;
+        this.closeAbandonedToolExchange(turn.id, result, error);
+        if (terminalOutcome !== undefined) this.materializeTurnOutcome(terminalOutcome);
         this.eventBus.publish({
           type: 'turn.ended',
           turnId: turn.id,
@@ -396,10 +452,151 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
         protocol,
       };
       turnTelemetry.track2('turn_ended', ended);
-      this.pumpTurns();
+      this.pumpTurns(true);
+    }
+  }
+
+  private failTurnStart(job: TurnJob, lease: ActivityLease, error: unknown): void {
+    const failure: TurnResult = { type: 'failed', error, steps: 0 };
+    for (const step of job.steps.values()) step.cancel(error);
+    job.controller.abort(error);
+    job.turn.state = 'failed';
+    this.cancellingTurnIds.delete(job.turn.id);
+    if (this.activeTurnJob === job) this.activeTurnJob = undefined;
+    if (
+      this.pendingTurns.length === 0 &&
+      this.nextReservedTurnId === job.turn.id + 1
+    ) {
+      this.nextReservedTurnId = job.turn.id;
+    }
+    job.ready.reject(error instanceof Error ? error : new Error(toErrorMessage(error)));
+    job.result.resolve(failure);
+    lease.end('failed', { error });
+  }
+
+  private ensureTurnOutcomeIntent(
+    turnId: number,
+    result: TurnResult,
+    error: ReturnType<typeof toKimiErrorPayload> | undefined,
+  ): TurnOutcomeIntent | undefined {
+    if (result.type === 'completed') return undefined;
+    const existing = this.pendingTurnOutcome(turnId);
+    if (existing !== undefined) return existing;
+    // Active cancellation reserves its stable intent in turn.cancel. If a
+    // destructive context operation consumed that intent before the worker
+    // observed the abort, it is a tombstone—not permission to mint a second
+    // outcome after the clear/undo boundary.
+    if (result.type === 'cancelled' && this.cancellingTurnIds.has(turnId)) {
+      return undefined;
+    }
+    try {
+      const content = result.type === 'failed'
+        ? renderTurnFailureReminder(error)
+        : renderTurnCancellationReminder(result.reason, isUserCancellation(result.reason));
+      const outcome = { outcomeId: randomUUID(), turnId, content };
+      this.wire.dispatch(turnOutcome(outcome));
+      return this.pendingTurnOutcome(turnId) ?? outcome;
+    } catch (outcomeError) {
+      this.safeDiagnostic('failed to persist turn outcome intent', {
+        turnId,
+        error: outcomeError,
+      });
+      return undefined;
+    }
+  }
+
+  private createCancellationOutcome(
+    turnId: number,
+    cancellation: unknown,
+  ): TurnOutcomeIntent | undefined {
+    const existing = this.pendingTurnOutcome(turnId);
+    if (existing !== undefined) return existing;
+    try {
+      return {
+        outcomeId: randomUUID(),
+        turnId,
+        content: renderTurnCancellationReminder(
+          cancellation,
+          isUserCancellation(cancellation),
+        ),
+      };
+    } catch (error) {
+      this.safeDiagnostic('failed to render turn cancellation outcome', { turnId, error });
+      return undefined;
+    }
+  }
+
+  private pendingTurnOutcome(turnId: number): TurnOutcomeIntent | undefined {
+    return this.wire
+      .getModel(TurnModel)
+      .pendingOutcomes.find((outcome) => outcome.turnId === turnId);
+  }
+
+  private materializePendingTurnOutcomes(strict = false): void {
+    for (const outcome of this.wire.getModel(TurnModel).pendingOutcomes) {
+      this.materializeTurnOutcome(outcome, strict);
     }
   }
 
+  private materializeTurnOutcome(outcome: TurnOutcomeIntent, strict = false): void {
+    if (!this.hasPendingTurnOutcome(outcome.outcomeId)) return;
+    try {
+      this.reminders.appendSystemReminder(
+        outcome.content,
+        { kind: 'injection', variant: TURN_OUTCOME_REMINDER_VARIANT },
+        outcome.outcomeId,
+      );
+    } catch (error) {
+      if (this.pendingTurnOutcome(outcome.turnId)?.outcomeId !== outcome.outcomeId) {
+        this.safeDiagnostic('turn outcome reminder committed with observer failure', {
+          turnId: outcome.turnId,
+          error,
+        });
+        return;
+      }
+      if (strict) throw error;
+      this.safeDiagnostic('failed to append turn outcome reminder', {
+        turnId: outcome.turnId,
+        error,
+      });
+    }
+  }
+
+  private hasPendingTurnOutcome(outcomeId: string): boolean {
+    return this.wire
+      .getModel(TurnModel)
+      .pendingOutcomes.some((outcome) => outcome.outcomeId === outcomeId);
+  }
+
+  private closeAbandonedToolExchange(
+    turnId: number,
+    result: TurnResult,
+    error: ReturnType<typeof toKimiErrorPayload> | undefined,
+  ): void {
+    try {
+      const closed = this.context.closeAbandonedToolExchange(
+        abandonedToolResultOutput(result, error),
+      );
+      if (closed === 0) return;
+      this.safeDiagnostic('closed abandoned tool exchange at turn end', {
+        turnId,
+        reason: result.type,
+        closed,
+      });
+    } catch (closeError) {
+      this.safeDiagnostic('failed to close abandoned tool exchange', {
+        turnId,
+        error: closeError,
+      });
+    }
+  }
+
+  private safeDiagnostic(message: string, payload?: unknown): void {
+    try {
+      this.log.warn(message, payload);
+    } catch { }
+  }
+
   private resultFromTurnError(lease: ActivityLease, error: unknown): TurnResult {
     if (!lease.signal.aborted) return { type: 'failed', error, steps: 0 };
     return { type: 'cancelled', steps: 0, reason: lease.signal.reason ?? error };
@@ -420,6 +617,7 @@ export class AgentLoopService extends Disposable implements IAgentLoopService {
 
   private releaseActiveTurn(turn: Turn, result: TurnResult | undefined): void {
     (turn as MutableTurn).state = result?.type ?? 'failed';
+    this.cancellingTurnIds.delete(turn.id);
     const job = this.activeTurnJob?.turn === turn ? this.activeTurnJob : undefined;
     if (job === undefined) return;
     const reason = result?.type === 'cancelled' ? result.reason : abortError('Turn ended');
@@ -991,6 +1189,19 @@ function interruptReasonFor(
   return 'error';
 }
 
+function abandonedToolResultOutput(
+  result: TurnResult,
+  error: ReturnType<typeof toKimiErrorPayload> | undefined,
+): string {
+  const cause =
+    result.type === 'cancelled'
+      ? 'the turn was cancelled'
+      : result.type === 'failed'
+        ? `the turn failed${error !== undefined ? ` (${error.message})` : ''}`
+        : 'the turn ended';
+  return `Tool call did not complete: ${cause} before its result was recorded. Do not assume the tool completed successfully.`;
+}
+
 type StepExecutionResult = {
   readonly stopReason: FinishReason;
   readonly hookStopTurn: boolean;
diff --git a/packages/agent-core-v2/src/agent/loop/turnOps.ts b/packages/agent-core-v2/src/agent/loop/turnOps.ts
index 8cad5371a3..5ac0ef7f18 100644
--- a/packages/agent-core-v2/src/agent/loop/turnOps.ts
+++ b/packages/agent-core-v2/src/agent/loop/turnOps.ts
@@ -1,6 +1,6 @@
 /**
  * `loop` domain (L4) — wire Model (`TurnModel`) and the Ops that bookkeep the
- * agent's turn lifecycle on the wire.
+ * agent's turn lifecycle and abnormal outcome handoffs on the wire.
  *
  * Declares the next turn id as a wire Model (initial `0`). The persisted
  * `turn.prompt` record carries exactly v1's field set (`{ input, origin }` —
@@ -8,8 +8,11 @@
  * advances the counter by one, so the counter is restored by counting
  * turn starts. Every turn is started by `loopService.enqueue` admitting a
  * request that creates a new Turn, which dispatches one
- * `turn.prompt` per start. As a belt-and-suspenders for v1-written logs whose
- * internally-driven turns (goal continuations) have no `turn.prompt` record,
+ * `turn.prompt` per start. `turn.cancel` carries cancellation reminder intent
+ * atomically, while `turn.outcome` records failure intent; a
+ * `context.append_message` acknowledgement consumes the intent after the
+ * reminder reaches model context. As a belt-and-suspenders for v1-written logs
+ * whose internally-driven turns (goal continuations) have no `turn.prompt` record,
  * `TurnModel` also registers a cross-model reducer on
  * `context.append_loop_event` that raises the counter past any `turnId`
  * observed in a replayed loop event — the v1 `observeRestoredTurnId`
@@ -27,22 +30,46 @@ import type { PromptOrigin } from '#/agent/contextMemory/types';
 
 export interface TurnModelState {
   readonly nextTurnId: number;
+  readonly pendingOutcomes: readonly TurnOutcomeIntent[];
 }
 
-export const TurnModel = defineModel<TurnModelState>('turn', () => ({ nextTurnId: 0 }), {
-  reducers: {
-    'context.append_loop_event': (state, { event }) => {
-      if (event.type === 'tool.result' || event.turnId === undefined) {
-        return state;
-      }
+export interface TurnOutcomeIntent {
+  readonly outcomeId: string;
+  readonly turnId: number;
+  readonly content: string;
+}
+
+export const TurnModel = defineModel<TurnModelState>(
+  'turn',
+  () => ({ nextTurnId: 0, pendingOutcomes: [] }),
+  {
+    reducers: {
+      'context.append_loop_event': (state, { event }) => {
+        if (event.type === 'tool.result' || event.turnId === undefined) {
+          return state;
+        }
 
-      const turnId = Number.parseInt(event.turnId, 10);
-      return Number.isInteger(turnId) && turnId >= state.nextTurnId
-        ? { nextTurnId: turnId + 1 }
-        : state;
+        const turnId = Number.parseInt(event.turnId, 10);
+        return Number.isInteger(turnId) && turnId >= state.nextTurnId
+          ? { ...state, nextTurnId: turnId + 1 }
+          : state;
+      },
+      'context.append_message': (state, payload) => {
+        const outcomeId = payload.materializedTurnOutcomeId;
+        if (outcomeId === undefined) return state;
+        const pendingOutcomes = state.pendingOutcomes.filter(
+          (outcome) => outcome.outcomeId !== outcomeId,
+        );
+        return pendingOutcomes.length === state.pendingOutcomes.length
+          ? state
+          : { ...state, pendingOutcomes };
+      },
+      'context.clear': (state) => clearPendingOutcomes(state),
+      'context.undo': (state, payload) =>
+        payload.count > 0 ? clearPendingOutcomes(state) : state,
     },
   },
-});
+);
 
 const turnInputShape = {
   input: z.custom<readonly ContentPart[]>(),
@@ -54,12 +81,13 @@ declare module '#/wire/types' {
     'turn.prompt': typeof promptTurn;
     'turn.steer': typeof steerTurn;
     'turn.cancel': typeof cancelTurn;
+    'turn.outcome': typeof turnOutcome;
   }
 }
 
 export const promptTurn = TurnModel.defineOp('turn.prompt', {
   schema: z.object(turnInputShape),
-  apply: (s) => ({ nextTurnId: s.nextTurnId + 1 }),
+  apply: (s) => ({ ...s, nextTurnId: s.nextTurnId + 1 }),
 });
 
 export const steerTurn = TurnModel.defineOp('turn.steer', {
@@ -68,6 +96,54 @@ export const steerTurn = TurnModel.defineOp('turn.steer', {
 });
 
 export const cancelTurn = TurnModel.defineOp('turn.cancel', {
-  schema: z.object({ turnId: z.number().optional() }),
-  apply: (s) => s,
+  schema: z.object({
+    turnId: z.number().optional(),
+    outcomeId: z.string().optional(),
+    outcomeTurnId: z.number().optional(),
+    outcomeContent: z.string().optional(),
+  }),
+  apply: (s, payload) => addOutcomeFromCancel(s, payload),
 });
+
+export const turnOutcome = TurnModel.defineOp('turn.outcome', {
+  schema: z.object({
+    outcomeId: z.string(),
+    turnId: z.number(),
+    content: z.string(),
+  }),
+  apply: (s, payload) => addPendingOutcome(s, payload),
+});
+
+function addOutcomeFromCancel(
+  state: TurnModelState,
+  payload: {
+    readonly outcomeId?: string;
+    readonly outcomeTurnId?: number;
+    readonly outcomeContent?: string;
+  },
+): TurnModelState {
+  if (
+    payload.outcomeId === undefined ||
+    payload.outcomeTurnId === undefined ||
+    payload.outcomeContent === undefined
+  ) {
+    return state;
+  }
+  return addPendingOutcome(state, {
+    outcomeId: payload.outcomeId,
+    turnId: payload.outcomeTurnId,
+    content: payload.outcomeContent,
+  });
+}
+
+function addPendingOutcome(
+  state: TurnModelState,
+  outcome: TurnOutcomeIntent,
+): TurnModelState {
+  if (state.pendingOutcomes.some((pending) => pending.turnId === outcome.turnId)) return state;
+  return { ...state, pendingOutcomes: [...state.pendingOutcomes, outcome] };
+}
+
+function clearPendingOutcomes(state: TurnModelState): TurnModelState {
+  return state.pendingOutcomes.length === 0 ? state : { ...state, pendingOutcomes: [] };
+}
diff --git a/packages/agent-core-v2/src/agent/loop/turnOutcomeReminder.ts b/packages/agent-core-v2/src/agent/loop/turnOutcomeReminder.ts
new file mode 100644
index 0000000000..176aa6b158
--- /dev/null
+++ b/packages/agent-core-v2/src/agent/loop/turnOutcomeReminder.ts
@@ -0,0 +1,106 @@
+/**
+ * `loop` domain (L4) — renders model-visible context for abnormal turn endings.
+ *
+ * Converts terminal failures and cancellations into compact, XML-safe reminders.
+ * Provider failures expose only public categories and status codes; raw provider
+ * payloads, request identifiers, and internal infrastructure details stay out of
+ * model context.
+ */
+
+import { escapeXml } from '#/_base/utils/xml-escape';
+
+export const TURN_OUTCOME_REMINDER_VARIANT = 'turn_outcome';
+
+const MAX_ERROR_SUMMARY_LENGTH = 500;
+
+interface TurnErrorSummary {
+  readonly code: string;
+  readonly message: string;
+  readonly name?: string;
+  readonly details?: Readonly<Record<string, unknown>>;
+}
+
+export function renderTurnFailureReminder(error: TurnErrorSummary | undefined): string {
+  return [
+    'The previous turn ended before producing a final response.',
+    '',
+    `Error: ${renderPublicError(error)}`,
+    '',
+    'The preceding user request may still be unfinished. Treat the next user message as a follow-up.',
+  ].join('\n');
+}
+
+export function renderTurnCancellationReminder(reason: unknown, userInitiated: boolean): string {
+  const lines = [
+    userInitiated
+      ? 'The user interrupted the previous turn before it finished.'
+      : 'The previous turn was interrupted by the runtime before it finished.',
+  ];
+  const renderedReason = userInitiated ? undefined : renderInterruptionReason(reason);
+  if (renderedReason !== undefined) lines.push('', `Reason: ${renderedReason}`);
+  lines.push(
+    '',
+    'Some operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.',
+  );
+  return lines.join('\n');
+}
+
+function renderPublicError(error: TurnErrorSummary | undefined): string {
+  if (error === undefined) return 'The turn failed.';
+  switch (error.code) {
+    case 'provider.api_error': {
+      const statusCode = numericDetail(error, 'statusCode');
+      return statusCode === undefined
+        ? 'The model provider API request failed.'
+        : `API request failed with HTTP ${String(statusCode)}.`;
+    }
+    case 'provider.rate_limit':
+      return 'The model provider rate-limited the request.';
+    case 'provider.auth_error':
+      return 'Authentication with the model provider failed.';
+    case 'provider.connection_error':
+      return error.name?.toLowerCase().includes('timeout') === true
+        ? 'The model provider request timed out.'
+        : 'The request could not reach the model provider.';
+    case 'provider.overloaded':
+      return 'The model provider was overloaded.';
+    case 'provider.filtered':
+      return 'The model provider blocked the response due to its safety policy.';
+    case 'context.overflow':
+      return 'The request exceeded the model context limit.';
+    case 'loop.max_steps_exceeded': {
+      const maxSteps = numericDetail(error, 'maxSteps');
+      return maxSteps === undefined
+        ? 'The turn exceeded its step limit.'
+        : `The turn exceeded its ${String(maxSteps)}-step limit.`;
+    }
+    case 'model.not_configured':
+      return 'No model is configured.';
+    case 'model.config_invalid':
+      return 'The model configuration is invalid.';
+    default:
+      return escapeXml(normalizeSummary(error.message) || 'The turn failed.');
+  }
+}
+
+function renderInterruptionReason(reason: unknown): string | undefined {
+  const raw = reason instanceof Error ? reason.message : typeof reason === 'string' ? reason : undefined;
+  if (raw === undefined) return undefined;
+  const normalized = normalizeSummary(raw);
+  if (normalized.length === 0 || normalized === 'Aborted' || normalized === 'This operation was aborted') {
+    return undefined;
+  }
+  return escapeXml(normalized);
+}
+
+function numericDetail(error: TurnErrorSummary, key: string): number | undefined {
+  const value = error.details?.[key];
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+
+function normalizeSummary(value: string): string {
+  const normalized = value.replaceAll(/\s+/g, ' ').trim();
+  return normalized.length <= MAX_ERROR_SUMMARY_LENGTH
+    ? normalized
+    : `${normalized.slice(0, MAX_ERROR_SUMMARY_LENGTH - 3)}...`;
+}
diff --git a/packages/agent-core-v2/src/agent/profile/profile.ts b/packages/agent-core-v2/src/agent/profile/profile.ts
index e8dbf7ad48..62ea8a2bab 100644
--- a/packages/agent-core-v2/src/agent/profile/profile.ts
+++ b/packages/agent-core-v2/src/agent/profile/profile.ts
@@ -100,7 +100,7 @@ export interface IAgentProfileService {
   getModel(): string;
   useProfile(profile: ResolvedAgentProfile, context: SystemPromptContext): void;
   applyProfile(profile: ResolvedAgentProfile, options?: ApplyProfileOptions): Promise<void>;
-  refreshSystemPrompt(): Promise<void>;
+  refreshSystemPrompt(): Promise<string | undefined>;
   getAgentsMdWarning(): string | undefined;
   data(): ProfileData;
   getEffectiveThinkingLevel(): ThinkingEffort;
diff --git a/packages/agent-core-v2/src/agent/profile/profileService.ts b/packages/agent-core-v2/src/agent/profile/profileService.ts
index 98fd708486..a82cdc22b2 100644
--- a/packages/agent-core-v2/src/agent/profile/profileService.ts
+++ b/packages/agent-core-v2/src/agent/profile/profileService.ts
@@ -239,18 +239,20 @@ export class AgentProfileService implements IAgentProfileService {
     this.publishAgentsMdWarning();
   }
 
-  async refreshSystemPrompt(): Promise<void> {
+  async refreshSystemPrompt(): Promise<string | undefined> {
     const profile = this.resolveActiveProfile();
-    if (profile === undefined) return;
+    if (profile === undefined) return undefined;
 
     const context = await this.buildSystemPromptContext(this.cwd);
+    const systemPrompt = profile.systemPrompt(context);
     this.activeProfile = profile;
     this.update({
       profileName: profile.name,
-      systemPrompt: profile.systemPrompt(context),
+      systemPrompt,
     });
     this.cacheAgentsMdWarning(context);
     this.publishAgentsMdWarning();
+    return systemPrompt;
   }
 
   getAgentsMdWarning(): string | undefined {
diff --git a/packages/agent-core-v2/src/agent/systemReminder/systemReminder.ts b/packages/agent-core-v2/src/agent/systemReminder/systemReminder.ts
index 3ecf30eaed..4de08fbd9a 100644
--- a/packages/agent-core-v2/src/agent/systemReminder/systemReminder.ts
+++ b/packages/agent-core-v2/src/agent/systemReminder/systemReminder.ts
@@ -1,11 +1,15 @@
-import { createDecorator } from "#/_base/di/instantiation";
+import { createDecorator } from '#/_base/di/instantiation';
 
 import type { ContextMessage, PromptOrigin } from '#/agent/contextMemory/types';
 
 export interface IAgentSystemReminderService {
   readonly _serviceBrand: undefined;
 
-  appendSystemReminder(content: string, origin: PromptOrigin): ContextMessage;
+  appendSystemReminder(
+    content: string,
+    origin: PromptOrigin,
+    materializedTurnOutcomeId?: string,
+  ): ContextMessage;
 }
 
 export const IAgentSystemReminderService = createDecorator<IAgentSystemReminderService>('agentSystemReminderService');
diff --git a/packages/agent-core-v2/src/agent/systemReminder/systemReminderService.ts b/packages/agent-core-v2/src/agent/systemReminder/systemReminderService.ts
index d590c18254..156d725a84 100644
--- a/packages/agent-core-v2/src/agent/systemReminder/systemReminderService.ts
+++ b/packages/agent-core-v2/src/agent/systemReminder/systemReminderService.ts
@@ -1,4 +1,4 @@
-import { Disposable } from "#/_base/di/lifecycle";
+import { Disposable } from '#/_base/di/lifecycle';
 import { InstantiationType } from '#/_base/di/extensions';
 import { LifecycleScope, registerScopedService } from '#/_base/di/scope';
 import { IAgentContextMemoryService } from '#/agent/contextMemory/contextMemory';
@@ -15,7 +15,11 @@ export class AgentSystemReminderService extends Disposable implements IAgentSyst
     super();
   }
 
-  appendSystemReminder(content: string, origin: PromptOrigin): ContextMessage {
+  appendSystemReminder(
+    content: string,
+    origin: PromptOrigin,
+    materializedTurnOutcomeId?: string,
+  ): ContextMessage {
     const message: ContextMessage = {
       role: 'user',
       content: [
@@ -27,7 +31,11 @@ export class AgentSystemReminderService extends Disposable implements IAgentSyst
       toolCalls: [],
       origin,
     };
-    this.context.append(message);
+    if (materializedTurnOutcomeId === undefined) {
+      this.context.append(message);
+    } else {
+      this.context.appendTurnOutcome(message, materializedTurnOutcomeId);
+    }
     return message;
   }
 }
diff --git a/packages/agent-core-v2/src/app/llmProtocol/generate.ts b/packages/agent-core-v2/src/app/llmProtocol/generate.ts
index bc33baa7b7..67c24f02e0 100644
--- a/packages/agent-core-v2/src/app/llmProtocol/generate.ts
+++ b/packages/agent-core-v2/src/app/llmProtocol/generate.ts
@@ -1,3 +1,10 @@
+/**
+ * `llmProtocol` domain (L0) — streams and assembles one provider response.
+ *
+ * Owns abort-aware provider, iterator, and streamed-part callback boundaries
+ * with best-effort cleanup while preserving post-stream tool-call dispatch.
+ */
+
 import { APIEmptyResponseError } from './errors';
 import {
   isContentPart,
@@ -49,16 +56,20 @@ export async function generate(
     : tools;
 
   options?.onRequestStart?.();
-  const stream = await provider.generate(systemPrompt, wireTools, history, options);
+  const stream = await waitForAbort(
+    provider.generate(systemPrompt, wireTools, history, options),
+    options?.signal,
+    { onLateResolve: requestCancellation },
+  );
 
-  await throwIfAborted(options?.signal, stream);
+  throwIfAborted(options?.signal, stream);
 
   let serverDecodeMs = 0;
   let clientConsumeMs = 0;
   let firstPartAt: number | undefined;
   let lastResumeAt = 0;
 
-  for await (const part of stream) {
+  for await (const part of iterateWithAbort(stream, options?.signal)) {
     const arrivedAt = Date.now();
     if (firstPartAt === undefined) {
       firstPartAt = arrivedAt;
@@ -67,11 +78,11 @@ export async function generate(
     }
 
     try {
-      await throwIfAborted(options?.signal, stream);
+      throwIfAborted(options?.signal);
 
       if (callbacks?.onMessagePart !== undefined) {
-        await callbacks.onMessagePart(deepCopyPart(part));
-        await throwIfAborted(options?.signal, stream);
+        await waitForAbort(callbacks.onMessagePart(deepCopyPart(part)), options?.signal);
+        throwIfAborted(options?.signal);
       }
 
       if (
@@ -104,7 +115,7 @@ export async function generate(
     }
   }
 
-  await throwIfAborted(options?.signal, stream);
+  throwIfAborted(options?.signal, stream);
   if (firstPartAt !== undefined) {
     serverDecodeMs += Date.now() - lastResumeAt;
   }
@@ -146,9 +157,9 @@ export async function generate(
     );
   }
 
-  if (callbacks?.onToolCall !== undefined) {
+  if (callbacks?.onToolCall !== undefined && message.toolCalls.length > 0) {
+    throwIfAborted(options?.signal, stream);
     for (const toolCall of message.toolCalls) {
-      await throwIfAborted(options?.signal, stream);
       await callbacks.onToolCall(toolCall);
     }
   }
@@ -162,34 +173,144 @@ export async function generate(
   };
 }
 
-type CancelableStream = StreamedMessage & {
+type CancelableTarget = {
   cancel?: () => unknown;
   return?: () => unknown;
 };
 
 function throwAbortError(): never {
-  throw new DOMException('The operation was aborted.', 'AbortError');
+  throw createAbortError();
 }
 
-async function cancelStream(stream: StreamedMessage): Promise<void> {
-  const cancelable = stream as CancelableStream;
+function requestCancellation(target: unknown): void {
+  if (target === null || (typeof target !== 'object' && typeof target !== 'function')) {
+    return;
+  }
+  const cancelable = target as CancelableTarget;
+  invokeCancellation(cancelable, 'cancel');
+  invokeCancellation(cancelable, 'return');
+}
 
+function invokeCancellation(target: CancelableTarget, method: keyof CancelableTarget): void {
   try {
-    await cancelable.cancel?.();
+    const cleanup = target[method]?.();
+    void Promise.resolve(cleanup).catch(() => {});
   } catch {}
+}
+
+interface AbortWaitOptions<T> {
+  readonly onAbort?: () => void;
+  readonly onLateResolve?: (value: T) => void;
+}
+
+function waitForAbort<T>(
+  value: T | PromiseLike<T>,
+  signal?: AbortSignal,
+  options?: AbortWaitOptions<T>,
+): Promise<T> {
+  const promise = Promise.resolve(value);
+  if (signal === undefined) {
+    return promise;
+  }
+
+  return new Promise<T>((resolve, reject) => {
+    let settled = false;
+    const removeAbortListener = (): void => {
+      signal.removeEventListener('abort', onAbort);
+    };
+    const onAbort = (): void => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      removeAbortListener();
+      try {
+        options?.onAbort?.();
+      } catch {}
+      reject(createAbortError());
+    };
+
+    if (signal.aborted) {
+      onAbort();
+    } else {
+      signal.addEventListener('abort', onAbort, { once: true });
+    }
+
+    void promise.then(
+      (result) => {
+        if (settled) {
+          try {
+            options?.onLateResolve?.(result);
+          } catch {}
+          return;
+        }
+        settled = true;
+        removeAbortListener();
+        resolve(result);
+      },
+      (error: unknown) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        removeAbortListener();
+        reject(error);
+      },
+    );
+  });
+}
+
+async function* iterateWithAbort(
+  stream: StreamedMessage,
+  signal?: AbortSignal,
+): AsyncGenerator<StreamedMessagePart> {
+  const iterator = stream[Symbol.asyncIterator]();
+  let completed = false;
+  let cancellationRequested = false;
+  const cancel = (): void => {
+    if (cancellationRequested) {
+      return;
+    }
+    cancellationRequested = true;
+    invokeCancellation(stream as CancelableTarget, 'cancel');
+    invokeCancellation(iterator as CancelableTarget, 'return');
+  };
 
   try {
-    await cancelable.return?.();
-  } catch {}
+    while (true) {
+      if (signal?.aborted) {
+        cancel();
+        throwAbortError();
+      }
+      const next = await waitForAbort(iterator.next(), signal, { onAbort: cancel });
+      if (signal?.aborted) {
+        cancel();
+        throwAbortError();
+      }
+      if (next.done === true) {
+        completed = true;
+        return;
+      }
+      yield next.value;
+    }
+  } finally {
+    if (!completed) {
+      cancel();
+    }
+  }
+}
+
+function createAbortError(): DOMException {
+  return new DOMException('The operation was aborted.', 'AbortError');
 }
 
-async function throwIfAborted(signal?: AbortSignal, stream?: StreamedMessage): Promise<void> {
+function throwIfAborted(signal?: AbortSignal, stream?: StreamedMessage): void {
   if (!signal?.aborted) {
     return;
   }
 
   if (stream !== undefined) {
-    await cancelStream(stream);
+    requestCancellation(stream);
   }
 
   throwAbortError();
diff --git a/packages/agent-core-v2/src/app/llmProtocol/provider.ts b/packages/agent-core-v2/src/app/llmProtocol/provider.ts
index 04547944fb..1467eebd21 100644
--- a/packages/agent-core-v2/src/app/llmProtocol/provider.ts
+++ b/packages/agent-core-v2/src/app/llmProtocol/provider.ts
@@ -44,6 +44,7 @@ export type FinishReason =
 
 export interface StreamedMessage {
   [Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart>;
+  cancel?(): void;
   readonly id: string | null;
   readonly usage: TokenUsage | null;
   readonly finishReason: FinishReason | null;
diff --git a/packages/agent-core-v2/src/app/llmProtocol/providers/anthropic.ts b/packages/agent-core-v2/src/app/llmProtocol/providers/anthropic.ts
index c9a6f297c3..fdfe9db210 100644
--- a/packages/agent-core-v2/src/app/llmProtocol/providers/anthropic.ts
+++ b/packages/agent-core-v2/src/app/llmProtocol/providers/anthropic.ts
@@ -48,6 +48,7 @@ import {
   sanitizeToolCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 
 function normalizeAnthropicStopReason(raw: string | null | undefined): {
   finishReason: FinishReason | null;
@@ -586,8 +587,10 @@ class AnthropicStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(response: unknown, isStream: boolean) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(response as AsyncIterable<MessageStreamEvent>);
     } else {
@@ -632,6 +635,10 @@ class AnthropicStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/agent-core-v2/src/app/llmProtocol/providers/google-genai.ts b/packages/agent-core-v2/src/app/llmProtocol/providers/google-genai.ts
index 893bf9d93c..cd70b03284 100644
--- a/packages/agent-core-v2/src/app/llmProtocol/providers/google-genai.ts
+++ b/packages/agent-core-v2/src/app/llmProtocol/providers/google-genai.ts
@@ -1,3 +1,10 @@
+/**
+ * `llmProtocol` domain (L0) — adapts Google GenAI requests and responses.
+ *
+ * Owns protocol translation, provider error normalization, and composition of
+ * configured, per-request, and transport cancellation signals. Owns no scoped state.
+ */
+
 import {
   APIConnectionError,
   APITimeoutError,
@@ -21,6 +28,7 @@ import { ApiError as GoogleApiError, GoogleGenAI as GenAIClient } from '@google/
 import { mergeConsecutiveUserMessages } from './merge-user-messages';
 
 import { requireProviderApiKey, resolveAuthBackedClient } from './request-auth';
+import { cancelNativeStream } from './stream-cancellation';
 
 function normalizeGoogleGenAIFinishReason(raw: unknown): {
   finishReason: FinishReason | null;
@@ -185,23 +193,13 @@ function createAbortError(): DOMException {
   return new DOMException('The operation was aborted.', 'AbortError');
 }
 
-async function abortPromise(signal: AbortSignal | undefined): Promise<never> {
-  if (signal === undefined) {
-    return new Promise(() => {
-    });
-  }
-  if (signal.aborted) {
-    throw createAbortError();
-  }
-  return new Promise((_, reject) => {
-    signal.addEventListener(
-      'abort',
-      () => {
-        reject(createAbortError());
-      },
-      { once: true },
-    );
-  });
+function mergeAbortSignals(
+  ...signals: Array<AbortSignal | null | undefined>
+): AbortSignal {
+  const definedSignals = signals.filter(
+    (signal): signal is AbortSignal => signal !== null && signal !== undefined,
+  );
+  return AbortSignal.any(definedSignals);
 }
 
 function messageToGoogleGenAI(message: Message): GoogleContent {
@@ -428,12 +426,15 @@ export class GoogleGenAIStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(
     response: AsyncIterable<Record<string, unknown>> | Record<string, unknown>,
     isStream: boolean,
     signal?: AbortSignal,
+    private readonly _transportController?: AbortController,
   ) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(
         response as AsyncIterable<Record<string, unknown>>,
@@ -460,6 +461,13 @@ export class GoogleGenAIStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    try {
+      this._transportController?.abort();
+    } catch {}
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
@@ -730,10 +738,24 @@ export class GoogleGenAIChatProvider implements ChatProvider {
     }
 
     const contents = messagesToGoogleGenAIContents(history);
+    const transportController = new AbortController();
+    const configuredSignal = this._generationKwargs['abortSignal'] as
+      | AbortSignal
+      | null
+      | undefined;
+    const requestSignal = mergeAbortSignals(
+      configuredSignal,
+      options?.signal,
+      transportController.signal,
+    );
+    if (requestSignal.aborted) {
+      throw createAbortError();
+    }
 
     const config: Record<string, unknown> = {
       ...this._generationKwargs,
       systemInstruction: systemPrompt,
+      abortSignal: requestSignal,
       ...(tools.length > 0 ? { tools: tools.map((t) => toolToGoogleGenAI(t)) } : {}),
     };
     applyResponseFormat(config, options?.responseFormat);
@@ -749,25 +771,21 @@ export class GoogleGenAIChatProvider implements ChatProvider {
 
       options?.onRequestSent?.();
       if (this._stream) {
-        const stream = await Promise.race([
-          models.generateContentStream(params),
-          abortPromise(options?.signal),
-        ]);
+        const stream = await models.generateContentStream(params);
         return new GoogleGenAIStreamedMessage(
           stream as AsyncIterable<Record<string, unknown>>,
           true,
-          options?.signal,
+          requestSignal,
+          transportController,
         );
       }
 
-      const response = await Promise.race([
-        models.generateContent(params),
-        abortPromise(options?.signal),
-      ]);
+      const response = await models.generateContent(params);
       return new GoogleGenAIStreamedMessage(
         response as Record<string, unknown>,
         false,
-        options?.signal,
+        requestSignal,
+        transportController,
       );
     } catch (error: unknown) {
       if (error instanceof DOMException && error.name === 'AbortError') {
diff --git a/packages/agent-core-v2/src/app/llmProtocol/providers/kimi.ts b/packages/agent-core-v2/src/app/llmProtocol/providers/kimi.ts
index c77e6fc106..b71b4b15cc 100644
--- a/packages/agent-core-v2/src/app/llmProtocol/providers/kimi.ts
+++ b/packages/agent-core-v2/src/app/llmProtocol/providers/kimi.ts
@@ -40,6 +40,7 @@ import {
   sanitizeToolCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 export interface KimiOptions {
   apiKey?: string | undefined;
   baseUrl?: string | undefined;
@@ -228,11 +229,13 @@ class KimiStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(
     response: OpenAI.Chat.ChatCompletion | AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
     isStream: boolean,
   ) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(
         response as AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
@@ -258,6 +261,10 @@ class KimiStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/agent-core-v2/src/app/llmProtocol/providers/openai-legacy.ts b/packages/agent-core-v2/src/app/llmProtocol/providers/openai-legacy.ts
index 421cc2f310..ecae138641 100644
--- a/packages/agent-core-v2/src/app/llmProtocol/providers/openai-legacy.ts
+++ b/packages/agent-core-v2/src/app/llmProtocol/providers/openai-legacy.ts
@@ -41,6 +41,7 @@ import {
   sanitizeToolCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 
 const KNOWN_REASONING_KEYS = ['reasoning_content', 'reasoning_details', 'reasoning'] as const;
 const DEFAULT_OUTBOUND_REASONING_KEY = KNOWN_REASONING_KEYS[0];
@@ -295,12 +296,14 @@ export class OpenAILegacyStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(
     response: OpenAI.Chat.ChatCompletion | AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
     isStream: boolean,
     reasoningKey: string | undefined,
   ) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(
         response as AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
@@ -330,6 +333,10 @@ export class OpenAILegacyStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/agent-core-v2/src/app/llmProtocol/providers/openai-responses.ts b/packages/agent-core-v2/src/app/llmProtocol/providers/openai-responses.ts
index 9953a0d148..c890a4193f 100644
--- a/packages/agent-core-v2/src/app/llmProtocol/providers/openai-responses.ts
+++ b/packages/agent-core-v2/src/app/llmProtocol/providers/openai-responses.ts
@@ -37,6 +37,7 @@ import {
   sanitizeOpenAIResponsesCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 
 function normalizeResponsesFinishReason(
   status: string | null | undefined,
@@ -621,8 +622,10 @@ export class OpenAIResponsesStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(response: unknown, isStream: boolean) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(response as AsyncIterable<RawObject>);
     } else {
@@ -646,6 +649,10 @@ export class OpenAIResponsesStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/agent-core-v2/src/app/llmProtocol/providers/stream-cancellation.ts b/packages/agent-core-v2/src/app/llmProtocol/providers/stream-cancellation.ts
new file mode 100644
index 0000000000..40f9547fd0
--- /dev/null
+++ b/packages/agent-core-v2/src/app/llmProtocol/providers/stream-cancellation.ts
@@ -0,0 +1,28 @@
+/**
+ * `llmProtocol` domain (L0) — best-effort native stream transport cancellation.
+ *
+ * Bridges provider SDK stream handles to the protocol-level cancellation
+ * contract. Owns no scoped state.
+ */
+
+type NativeCancelableStream = {
+  abort?: () => unknown;
+  controller?: {
+    abort(): unknown;
+  };
+};
+
+export function cancelNativeStream(stream: unknown): void {
+  if (stream === null || (typeof stream !== 'object' && typeof stream !== 'function')) {
+    return;
+  }
+
+  const cancelable = stream as NativeCancelableStream;
+  try {
+    if (typeof cancelable.abort === 'function') {
+      void Promise.resolve(cancelable.abort()).catch(() => {});
+      return;
+    }
+    void Promise.resolve(cancelable.controller?.abort()).catch(() => {});
+  } catch {}
+}
diff --git a/packages/agent-core-v2/src/app/telemetry/telemetryService.ts b/packages/agent-core-v2/src/app/telemetry/telemetryService.ts
index e5eb2d68d1..36b9ed3b01 100644
--- a/packages/agent-core-v2/src/app/telemetry/telemetryService.ts
+++ b/packages/agent-core-v2/src/app/telemetry/telemetryService.ts
@@ -55,7 +55,14 @@ export class TelemetryService implements ITelemetryService {
 
   withContext(patch: TelemetryContextPatch): ITelemetryService {
     const child = new TelemetryService();
-    child.appenders = this.appenders.map((appender) => appender.withContext?.(patch) ?? appender);
+    child.appenders = this.appenders.map((appender) => {
+      try {
+        return appender.withContext?.(patch) ?? appender;
+      } catch (error) {
+        onUnexpectedError(error);
+        return appender;
+      }
+    });
     child.context = { ...this.context, ...patch };
     child.enabled = this.enabled;
     return child;
@@ -64,7 +71,11 @@ export class TelemetryService implements ITelemetryService {
   setContext(patch: TelemetryContextPatch): void {
     this.context = { ...this.context, ...patch };
     for (const appender of this.appenders) {
-      appender.setContext?.(patch);
+      try {
+        appender.setContext?.(patch);
+      } catch (error) {
+        onUnexpectedError(error);
+      }
     }
   }
 
diff --git a/packages/agent-core-v2/test/_base/errors/errors.test.ts b/packages/agent-core-v2/test/_base/errors/errors.test.ts
index 67eabc4ffa..43b3317e67 100644
--- a/packages/agent-core-v2/test/_base/errors/errors.test.ts
+++ b/packages/agent-core-v2/test/_base/errors/errors.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 
 import {
   onUnexpectedError,
@@ -43,6 +43,21 @@ describe('onUnexpectedError + setUnexpectedErrorHandler', () => {
     expect(() => onUnexpectedError(new Error('original'))).not.toThrow();
   });
 
+  it('does not propagate when the handler and console fallback both throw', () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {
+      throw new Error('console failed');
+    });
+    setUnexpectedErrorHandler(() => {
+      throw new Error('handler failed');
+    });
+
+    try {
+      expect(() => onUnexpectedError(new Error('original'))).not.toThrow();
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
+
   it('resetUnexpectedErrorHandler restores the module default', () => {
     const seen: unknown[] = [];
     setUnexpectedErrorHandler((err) => seen.push(err));
diff --git a/packages/agent-core-v2/test/_base/log/logService.test.ts b/packages/agent-core-v2/test/_base/log/logService.test.ts
index 24865b14c6..b64e0954b3 100644
--- a/packages/agent-core-v2/test/_base/log/logService.test.ts
+++ b/packages/agent-core-v2/test/_base/log/logService.test.ts
@@ -91,6 +91,34 @@ describe('BoundLogger', () => {
     expect(sink.entries.map((e) => e.msg)).not.toContain('proxy payload');
   });
 
+  it('does not let throwing Error accessors escape into caller flow', () => {
+    const hostile = new Error('placeholder');
+    Object.defineProperty(hostile, 'message', {
+      get() {
+        throw new Error('message getter failed');
+      },
+    });
+    Object.defineProperty(hostile, 'stack', {
+      get() {
+        throw new Error('stack getter failed');
+      },
+    });
+
+    expect(() => logger.error('hostile error', hostile)).not.toThrow();
+    expect(sink.entries.map((e) => e.msg)).not.toContain('hostile error');
+  });
+
+  it('does not let a throwing writer escape into caller flow', () => {
+    const brokenWriter = {
+      write: () => {
+        throw new Error('sink failed');
+      },
+    };
+    const brokenLogger = new BoundLogger(brokenWriter, { level: 'info' });
+
+    expect(() => brokenLogger.warn('diagnostic only')).not.toThrow();
+  });
+
   it('merges object payload into ctx', () => {
     const debugLogger = new BoundLogger(sink, { level: 'debug' });
     debugLogger.info('with ctx', { requestId: 'r1', count: 2 });
@@ -112,6 +140,24 @@ describe('BoundLogger', () => {
     leaf.info('evt');
     expect(sink.entries[0]?.ctx).toEqual({ a: 1, b: 2 });
   });
+
+  it('creates a usable child when binding accessors throw', () => {
+    const hostileContext = new Proxy(
+      {},
+      {
+        ownKeys() {
+          throw new Error('binding ownKeys failed');
+        },
+      },
+    );
+
+    let child!: ReturnType<BoundLogger['child']>;
+    expect(() => {
+      child = logger.child(hostileContext);
+    }).not.toThrow();
+    expect(() => child.warn('child survived')).not.toThrow();
+    expect(sink.entries.at(-1)?.msg).toBe('child survived');
+  });
 });
 
 describe('levelEnabled', () => {
diff --git a/packages/agent-core-v2/test/agent/contextInjector/contextInjector.test.ts b/packages/agent-core-v2/test/agent/contextInjector/contextInjector.test.ts
index eb748ba943..053484fe7c 100644
--- a/packages/agent-core-v2/test/agent/contextInjector/contextInjector.test.ts
+++ b/packages/agent-core-v2/test/agent/contextInjector/contextInjector.test.ts
@@ -311,4 +311,25 @@ describe('AgentContextInjectorService', () => {
       { kind: 'injection', variant: 'per_turn_test' },
     ]);
   });
+
+  it('does not duplicate a surviving injection when post-compaction work retries', async () => {
+    let calls = 0;
+    injector(ix).register('retry_test', () => {
+      calls += 1;
+      return 'retry-safe reminder';
+    });
+
+    await injector(ix).injectAfterCompaction();
+    await injector(ix).injectAfterCompaction();
+
+    expect(calls).toBe(2);
+    expect(
+      context
+        .get()
+        .filter(
+          (message) =>
+            message.origin?.kind === 'injection' && message.origin.variant === 'retry_test',
+        ),
+    ).toHaveLength(1);
+  });
 });
diff --git a/packages/agent-core-v2/test/agent/contextMemory/context.test.ts b/packages/agent-core-v2/test/agent/contextMemory/context.test.ts
index 859ead8399..a933c1ef48 100644
--- a/packages/agent-core-v2/test/agent/contextMemory/context.test.ts
+++ b/packages/agent-core-v2/test/agent/contextMemory/context.test.ts
@@ -116,6 +116,63 @@ describe('Agent context', () => {
     ]);
   });
 
+  it('closes an abandoned tool exchange before releasing deferred reminders', () => {
+    context.appendLoopEvent({ type: 'step.begin', uuid: 'step_abandoned' });
+    context.appendLoopEvent({
+      type: 'tool.call',
+      stepUuid: 'step_abandoned',
+      toolCallId: 'call_abandoned',
+      name: 'Run',
+      args: {},
+    });
+    context.appendLoopEvent({
+      type: 'tool.call',
+      stepUuid: 'step_abandoned',
+      toolCallId: 'call_also_abandoned',
+      name: 'Read',
+      args: {},
+    });
+    ctx.appendSystemReminder('Turn failed.', {
+      kind: 'injection',
+      variant: 'turn_outcome',
+    });
+
+    expect(context.get().map((message) => message.role)).toEqual(['assistant']);
+    expect(
+      context.closeAbandonedToolExchange(
+        'Tool call did not complete because the turn failed.',
+      ),
+    ).toBe(2);
+
+    expect(context.get()).toMatchObject([
+      {
+        role: 'assistant',
+        toolCalls: [
+          { id: 'call_abandoned', name: 'Run' },
+          { id: 'call_also_abandoned', name: 'Read' },
+        ],
+      },
+      {
+        role: 'tool',
+        toolCallId: 'call_abandoned',
+        isError: true,
+        content: [{ type: 'text', text: 'Tool call did not complete because the turn failed.' }],
+      },
+      {
+        role: 'tool',
+        toolCallId: 'call_also_abandoned',
+        isError: true,
+        content: [{ type: 'text', text: 'Tool call did not complete because the turn failed.' }],
+      },
+      {
+        role: 'user',
+        origin: { kind: 'injection', variant: 'turn_outcome' },
+        content: [{ type: 'text', text: '<system-reminder>\nTurn failed.\n</system-reminder>' }],
+      },
+    ]);
+    expect(context.closeAbandonedToolExchange('unused')).toBe(0);
+  });
+
   it('drops empty text parts only in LLM projection', () => {
     const history: ContextMessage[] = [
       {
@@ -663,6 +720,104 @@ describe('Agent context', () => {
     ]);
   });
 
+  it('keeps the latest unseen turn outcome intact before an oversized follow-up', () => {
+    const outcomeText = 'The previous turn was interrupted before it completed.';
+    context.append(
+      userMessage('old request', { kind: 'user' }),
+      {
+        role: 'assistant',
+        content: [{ type: 'text', text: 'partial answer' }],
+        toolCalls: [],
+      },
+      userMessage(outcomeText, { kind: 'injection', variant: 'turn_outcome' }),
+      userMessage(`follow-up ${'f'.repeat(100_000)}`, { kind: 'user' }),
+    );
+
+    const result = context.applyCompaction({
+      summary: 'summary',
+      compactedCount: context.get().length,
+      tokensBefore: estimateTokensForMessages(context.get()),
+    });
+
+    const messages = context.get();
+    const outcomes = messages.filter(
+      (message) =>
+        message.origin?.kind === 'injection' && message.origin.variant === 'turn_outcome',
+    );
+    const outcomeIndex = messages.indexOf(outcomes[0]!);
+    const followUpIndex = messages.findIndex(
+      (message) => message.origin?.kind === 'user' && textOf(message).startsWith('follow-up '),
+    );
+    expect(outcomes).toHaveLength(1);
+    expect(textOf(outcomes[0]!)).toBe(outcomeText);
+    expect(outcomeIndex).toBeLessThan(followUpIndex);
+    expect(result.keptTurnOutcomeCount).toBe(1);
+    expect(result.keptUserMessageCount).toBe(3);
+  });
+
+  it('keeps only the latest unseen turn outcome and ignores hook assistant messages', () => {
+    context.append(
+      userMessage('request', { kind: 'user' }),
+      {
+        role: 'assistant',
+        content: [{ type: 'text', text: 'model answer' }],
+        toolCalls: [],
+      },
+      userMessage('older pending outcome', { kind: 'injection', variant: 'turn_outcome' }),
+      userMessage('latest pending outcome', { kind: 'injection', variant: 'turn_outcome' }),
+      {
+        role: 'assistant',
+        content: [{ type: 'text', text: 'hook blocked without an LLM request' }],
+        toolCalls: [],
+        origin: { kind: 'hook_result', event: 'UserPromptSubmit', blocked: true },
+      },
+      userMessage('continue', { kind: 'user' }),
+    );
+
+    context.applyCompaction({
+      summary: 'summary',
+      compactedCount: context.get().length,
+      tokensBefore: estimateTokensForMessages(context.get()),
+    });
+
+    expect(
+      context
+        .get()
+        .filter(
+          (message) =>
+            message.origin?.kind === 'injection' && message.origin.variant === 'turn_outcome',
+        )
+        .map(textOf),
+    ).toEqual(['latest pending outcome']);
+  });
+
+  it('drops a turn outcome that a later model assistant has already seen', () => {
+    context.append(
+      userMessage('request', { kind: 'user' }),
+      userMessage('seen outcome', { kind: 'injection', variant: 'turn_outcome' }),
+      {
+        role: 'assistant',
+        content: [{ type: 'text', text: 'model continued' }],
+        toolCalls: [],
+      },
+      userMessage('next request', { kind: 'user' }),
+    );
+
+    const result = context.applyCompaction({
+      summary: 'summary',
+      compactedCount: context.get().length,
+      tokensBefore: estimateTokensForMessages(context.get()),
+    });
+
+    expect(
+      context.get().some(
+        (message) =>
+          message.origin?.kind === 'injection' && message.origin.variant === 'turn_outcome',
+      ),
+    ).toBe(false);
+    expect(result.keptTurnOutcomeCount).toBeUndefined();
+  });
+
   describe('notification projection', () => {
     it('does not merge a cron-fire envelope into an adjacent user message', () => {
       const cronEnvelope =
diff --git a/packages/agent-core-v2/test/agent/contextMemory/contextTranscript.test.ts b/packages/agent-core-v2/test/agent/contextMemory/contextTranscript.test.ts
index d6e2170d7a..ef4ae6b62b 100644
--- a/packages/agent-core-v2/test/agent/contextMemory/contextTranscript.test.ts
+++ b/packages/agent-core-v2/test/agent/contextMemory/contextTranscript.test.ts
@@ -29,6 +29,10 @@ function assistantMessage(text: string): ContextMessage {
   return { role: 'assistant', content: [{ type: 'text', text }], toolCalls: [] };
 }
 
+function turnOutcomeMessage(text: string): ContextMessage {
+  return userMessage(text, { kind: 'injection', variant: 'turn_outcome' });
+}
+
 function appendMessage(message: ContextMessage): WireRecord {
   return { type: 'context.append_message', message };
 }
@@ -50,6 +54,7 @@ function compaction(
   compactedCount: number,
   keptUserMessageCount?: number,
   keptHeadUserMessageCount?: number,
+  keptTurnOutcomeCount?: number,
 ): WireRecord {
   return {
     type: 'context.apply_compaction',
@@ -60,6 +65,7 @@ function compaction(
     tokensAfter: 100,
     ...(keptUserMessageCount === undefined ? {} : { keptUserMessageCount }),
     ...(keptHeadUserMessageCount === undefined ? {} : { keptHeadUserMessageCount }),
+    ...(keptTurnOutcomeCount === undefined ? {} : { keptTurnOutcomeCount }),
   };
 }
 
@@ -120,6 +126,17 @@ describe('reduceContextTranscript', () => {
     expect(result.foldedLength).toBe(4);
   });
 
+  it('accounts for a protected turn outcome separately from real user messages', () => {
+    const result = reduceContextTranscript([
+      appendMessage(userMessage('u1')),
+      appendMessage(turnOutcomeMessage('outcome')),
+      appendMessage(userMessage('u2')),
+      compaction('SUM', 3, 2, undefined, 1),
+    ]);
+
+    expect(result.foldedLength).toBe(4);
+  });
+
   it('carries the originating wire record time per entry', () => {
     const result = reduceContextTranscript([
       { type: 'context.append_message', message: userMessage('u1'), time: 100 },
@@ -172,7 +189,44 @@ describe('reduceContextTranscript', () => {
     expect(texts(result)).toEqual(['message A', 'reply A']);
   });
 
-  it('undo stops at a compaction summary', () => {
+  it('removes a turn outcome reminder when its user prompt is undone', () => {
+    const result = reduceContextTranscript([
+      appendMessage(userMessage('message A')),
+      appendMessage(turnOutcomeMessage('outcome A')),
+      undo(1),
+    ]);
+
+    expect(texts(result)).toEqual([]);
+    expect(result.foldedLength).toBe(0);
+  });
+
+  it('keeps the preceding turn outcome reminder when only the latest prompt is undone', () => {
+    const result = reduceContextTranscript([
+      appendMessage(userMessage('message A')),
+      appendMessage(turnOutcomeMessage('outcome A')),
+      appendMessage(userMessage('message B')),
+      appendMessage(turnOutcomeMessage('outcome B')),
+      undo(1),
+    ]);
+
+    expect(texts(result)).toEqual(['message A', 'outcome A']);
+    expect(result.foldedLength).toBe(2);
+  });
+
+  it('removes the full two-turn tail when undoing two prompts', () => {
+    const result = reduceContextTranscript([
+      appendMessage(userMessage('message A')),
+      appendMessage(turnOutcomeMessage('outcome A')),
+      appendMessage(userMessage('message B')),
+      appendMessage(turnOutcomeMessage('outcome B')),
+      undo(2),
+    ]);
+
+    expect(texts(result)).toEqual([]);
+    expect(result.foldedLength).toBe(0);
+  });
+
+  it('leaves the transcript unchanged when the requested undo crosses a compaction boundary', () => {
     const result = reduceContextTranscript([
       appendMessage(userMessage('old')),
       compaction('SUM', 1, 1),
@@ -180,7 +234,9 @@ describe('reduceContextTranscript', () => {
       appendMessage(assistantMessage('answer')),
       undo(2),
     ]);
-    expect(texts(result)).toEqual(['old', 'SUM']);
+
+    expect(texts(result)).toEqual(['old', 'SUM', 'recent', 'answer']);
+    expect(result.foldedLength).toBe(4);
   });
 
   it('clear keeps prior transcript entries but resets the folded view', () => {
@@ -206,6 +262,19 @@ describe('reduceContextTranscript', () => {
     expect(result.foldedLength).toBe(0);
   });
 
+  it('leaves the transcript unchanged when the requested undo crosses a clear floor', () => {
+    const result = reduceContextTranscript([
+      appendMessage(userMessage('u1')),
+      { type: 'context.clear' },
+      appendMessage(userMessage('u2')),
+      appendMessage(assistantMessage('a2')),
+      undo(2),
+    ]);
+
+    expect(texts(result)).toEqual(['u1', 'u2', 'a2']);
+    expect(result.foldedLength).toBe(2);
+  });
+
   it('folds tool calls and results from loop events', () => {
     const result = reduceContextTranscript([
       appendMessage(userMessage('q')),
diff --git a/packages/agent-core-v2/test/agent/contextMemory/stubs.ts b/packages/agent-core-v2/test/agent/contextMemory/stubs.ts
index ba6aef5624..50be0d211a 100644
--- a/packages/agent-core-v2/test/agent/contextMemory/stubs.ts
+++ b/packages/agent-core-v2/test/agent/contextMemory/stubs.ts
@@ -52,7 +52,13 @@ export function stubContextMemory(eventBus?: IEventBus): StubContextMemory {
       messages.push(...inserted);
       publishSplice(eventBus, { start, deleteCount: 0, messages: [...inserted] });
     },
+    appendTurnOutcome: (message) => {
+      const start = messages.length;
+      messages.push(message);
+      publishSplice(eventBus, { start, deleteCount: 0, messages: [message] });
+    },
     appendLoopEvent: () => {},
+    closeAbandonedToolExchange: () => 0,
     clear: () => {
       const deleteCount = messages.length;
       if (deleteCount === 0) return;
@@ -100,12 +106,18 @@ class StubContextMemoryService implements IAgentContextMemoryService {
   append(...messages: readonly ContextMessage[]): void {
     this.impl.append(...messages);
   }
+  appendTurnOutcome(message: ContextMessage, outcomeId: string): void {
+    this.impl.appendTurnOutcome(message, outcomeId);
+  }
   clear(): void {
     this.impl.clear();
   }
   appendLoopEvent(event: LoopRecordedEvent): void {
     this.impl.appendLoopEvent(event);
   }
+  closeAbandonedToolExchange(output: string): number {
+    return this.impl.closeAbandonedToolExchange(output);
+  }
   undo(count: number): UndoCut {
     return this.impl.undo(count);
   }
diff --git a/packages/agent-core-v2/test/agent/fullCompaction/compactionOps.test.ts b/packages/agent-core-v2/test/agent/fullCompaction/compactionOps.test.ts
index 167d5d656e..97258a29a0 100644
--- a/packages/agent-core-v2/test/agent/fullCompaction/compactionOps.test.ts
+++ b/packages/agent-core-v2/test/agent/fullCompaction/compactionOps.test.ts
@@ -10,7 +10,9 @@ import {
   fullCompactionBegin,
   fullCompactionCancel,
   fullCompactionComplete,
+  fullCompactionFail,
 } from '#/agent/fullCompaction/compactionOps';
+import { contextApplyCompaction } from '#/agent/contextMemory/contextOps';
 import { AppendLogStore } from '#/persistence/backends/node-fs/appendLogStore';
 import { InMemoryStorageService } from '#/persistence/backends/memory/inMemoryStorageService';
 import { IAppendLogStore } from '#/persistence/interface/appendLogStore';
@@ -58,7 +60,7 @@ async function readRecords(key = KEY): Promise<WireRecord[]> {
 }
 
 describe('fullCompaction ops (wire-backed)', () => {
-  it('begin/complete/cancel drive the phase and persist flat records', async () => {
+  it('begin/complete/cancel/fail drive the phase and persist flat records', async () => {
     expect(wire.getModel(CompactionModel).phase).toBe('idle');
 
     wire.dispatch(fullCompactionBegin({ source: 'manual', instruction: 'keep facts' }));
@@ -72,12 +74,19 @@ describe('fullCompaction ops (wire-backed)', () => {
     wire.dispatch(fullCompactionCancel({}));
     expect(wire.getModel(CompactionModel).phase).toBe('idle');
 
+    wire.dispatch(fullCompactionBegin({ source: 'manual' }));
+    expect(wire.getModel(CompactionModel).phase).toBe('running');
+    wire.dispatch(fullCompactionFail());
+    expect(wire.getModel(CompactionModel).phase).toBe('idle');
+
     const records = await readRecords();
     expect(records.map((record) => record.type)).toEqual([
       'full_compaction.begin',
       'full_compaction.complete',
       'full_compaction.begin',
       'full_compaction.cancel',
+      'full_compaction.begin',
+      'full_compaction.complete',
     ]);
     expect(records.every((record) => 'payload' in record === false)).toBe(true);
     expect(records[0]).toEqual(
@@ -88,6 +97,22 @@ describe('fullCompaction ops (wire-backed)', () => {
       }),
     );
     expect(records[1]).toEqual({ type: 'full_compaction.complete', time: expect.any(Number) });
+    expect(records.at(-1)).toEqual({
+      type: 'full_compaction.complete',
+      outcome: 'failed',
+      time: expect.any(Number),
+    });
+  });
+
+  it('treats context replacement as the durable commit point', () => {
+    wire.dispatch(fullCompactionBegin({ source: 'manual' }));
+    wire.dispatch(contextApplyCompaction({
+      summary: 'Committed summary',
+      compactedCount: 0,
+      tokensBefore: 0,
+    }));
+
+    expect(wire.getModel(CompactionModel).phase).toBe('committed');
   });
 
   it('apply returns the same reference on a no-op (gate stays quiet)', () => {
diff --git a/packages/agent-core-v2/test/agent/fullCompaction/fullCompaction.test.ts b/packages/agent-core-v2/test/agent/fullCompaction/fullCompaction.test.ts
index b5f4d8f4fe..a59c09477c 100644
--- a/packages/agent-core-v2/test/agent/fullCompaction/fullCompaction.test.ts
+++ b/packages/agent-core-v2/test/agent/fullCompaction/fullCompaction.test.ts
@@ -36,7 +36,15 @@ import { MASTER_ENV } from '#/app/flag/flagService';
 import { estimateTokensForMessages } from '#/_base/utils/tokens';
 import { recordingTelemetry, type TelemetryRecord } from '../../app/telemetry/stubs';
 import type { TestAgentContext, TestAgentOptions, TestAgentServiceOverride } from '../../harness';
-import { appServices, createCommandRunner, execEnvServices, hostEnvironmentServices, sessionServices, testAgent } from '../../harness';
+import {
+  appServices,
+  createCommandRunner,
+  execEnvServices,
+  hostEnvironmentServices,
+  logServices,
+  sessionServices,
+  testAgent,
+} from '../../harness';
 import {
   IAgentFullCompactionService,
   IOAuthService,
@@ -50,7 +58,10 @@ import {
 } from '#/index';
 import { IAgentLoopService } from '#/agent/loop/loop';
 import { IAgentContextSizeService } from '#/agent/contextSize/contextSize';
+import { IAgentContextInjectorService } from '#/agent/contextInjector/contextInjector';
 import { IAgentGoalService } from '#/agent/goal/goal';
+import { CompactionModel } from '#/agent/fullCompaction/compactionOps';
+import { IWireService } from '#/wire/wire';
 import { HostFileSystem } from '#/os/backends/node-local/hostFsService';
 
 type GenerateFn = NonNullable<TestAgentOptions['generate']>;
@@ -354,6 +365,77 @@ describe('FullCompaction', () => {
     }
   });
 
+  it('uses the captured compaction prompt when retrying the same turn', async () => {
+    const homeDir = mkdtempSync(join(tmpdir(), 'kimi-compact-turn-refresh-home-'));
+    const workDir = mkdtempSync(join(tmpdir(), 'kimi-compact-turn-refresh-work-'));
+    try {
+      writeFileSync(join(workDir, 'AGENTS.md'), 'old project instructions', 'utf-8');
+      let callCount = 0;
+      const systemPrompts: string[] = [];
+      const modelNames: string[] = [];
+      const thinkingEfforts: Array<string | null> = [];
+      const generate: GenerateFn = async (
+        provider,
+        systemPrompt,
+        _tools,
+        _history,
+        callbacks,
+      ) => {
+        callCount += 1;
+        systemPrompts.push(systemPrompt);
+        modelNames.push(provider.modelName);
+        thinkingEfforts.push(provider.thinkingEffort);
+        if (callCount === 1) {
+          writeFileSync(join(workDir, 'AGENTS.md'), 'new project instructions', 'utf-8');
+          throw new APIContextOverflowError(400, 'Context length exceeded', 'req-refresh-turn');
+        }
+        if (callCount === 2) return textResult('Compacted summary.');
+        if (callCount === 3) {
+          await callbacks?.onMessagePart?.({
+            type: 'text',
+            text: 'Retried with refreshed instructions.',
+          });
+          return textResult('Retried with refreshed instructions.');
+        }
+        throw new Error(`Unexpected generate call ${String(callCount)}`);
+      };
+      const ctx = testAgent(
+        execEnvServices({ hostFs: new HostFileSystem() }),
+        hostEnvironmentServices(homeDir),
+        { autoConfigure: false, cwd: workDir, generate },
+      );
+      ctx.configureRuntimeModel(CATALOGUED_PROVIDER, CATALOGUED_MODEL_CAPABILITIES);
+      const profile = ctx.get(IAgentProfileService);
+      await profile.applyProfile(EXACT_COMPACTION_REFRESH_PROFILE);
+      ctx.appendExchange(1, 'old user one', 'old assistant one', 20);
+      ctx.emitter.once('compaction.completed', () => {
+        profile.update({
+          systemPrompt: 'ORDINARY-MID-TURN-CONFIG',
+          thinkingLevel: 'high',
+        });
+      });
+
+      await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Retry after overflow' }] });
+      await ctx.untilTurnEnd();
+
+      expect(systemPrompts).toEqual([
+        exactCompactionRefreshPrompt(workDir, 'old project instructions'),
+        exactCompactionRefreshPrompt(workDir, 'old project instructions'),
+        exactCompactionRefreshPrompt(workDir, 'new project instructions'),
+      ]);
+      expect(modelNames).toEqual(['kimi-code', 'kimi-code', 'kimi-code']);
+      expect(thinkingEfforts[2]).toBe(thinkingEfforts[0]);
+      expect(profile.data()).toMatchObject({
+        systemPrompt: 'ORDINARY-MID-TURN-CONFIG',
+        thinkingLevel: 'on',
+      });
+      await ctx.expectResumeMatches();
+    } finally {
+      rmSync(homeDir, { recursive: true, force: true });
+      rmSync(workDir, { recursive: true, force: true });
+    }
+  });
+
   it('rejects a manual compaction while a turn is active', async () => {
     const ctx = testAgent(execEnvServices({ processRunner: createCommandRunner('should-not-run') }));
     ctx.configure({
@@ -957,7 +1039,7 @@ describe('FullCompaction', () => {
     await ctx.expectResumeMatches();
   });
 
-  it('cancels the compaction lifecycle when manual compaction generation fails', async () => {
+  it('fails the compaction lifecycle when manual compaction generation fails', async () => {
     const records: TelemetryRecord[] = [];
     const generate: GenerateFn = async () => {
       throw new Error('compaction exploded');
@@ -977,12 +1059,18 @@ describe('FullCompaction', () => {
     const events = ctx.newEvents();
     expect(events).toEqual(
       expect.arrayContaining([
-        expect.objectContaining({ type: '[wire]', event: 'full_compaction.cancel' }),
-        expect.objectContaining({ type: '[rpc]', event: 'compaction.cancelled' }),
+        expect.objectContaining({
+          type: '[wire]',
+          event: 'full_compaction.complete',
+          args: expect.objectContaining({ outcome: 'failed' }),
+        }),
         expect.objectContaining({ type: '[rpc]', event: 'error' }),
       ]),
     );
-    expect(eventIndex(events, 'compaction.cancelled')).toBeLessThan(eventIndex(events, 'error'));
+    expect(countEvents(events, 'full_compaction.cancel')).toBe(0);
+    expect(countEvents(events, 'compaction.cancelled')).toBe(0);
+    expect(countEvents(events, 'compaction.completed')).toBe(0);
+    expect(eventIndex(events, 'full_compaction.complete')).toBeLessThan(eventIndex(events, 'error'));
     expect(ctx.compactHistory()).toEqual([
       { role: 'user', text: 'old user one' },
       { role: 'assistant', text: 'old assistant one' },
@@ -1006,6 +1094,163 @@ describe('FullCompaction', () => {
     await ctx.expectResumeMatches();
   });
 
+  it('treats a provider-originated AbortError as failure rather than cancellation', async () => {
+    const generate: GenerateFn = async () => {
+      const error = new Error('provider aborted its own request');
+      error.name = 'AbortError';
+      throw error;
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure({
+      provider: CATALOGUED_PROVIDER,
+      modelCapabilities: CATALOGUED_MODEL_CAPABILITIES,
+    });
+    ctx.appendExchange(1, 'old user one', 'old assistant one', 20);
+    ctx.appendExchange(2, 'recent user two', 'recent assistant two', 80);
+    const failed = ctx.once('error');
+
+    await ctx.rpc.beginCompaction({});
+    await failed;
+
+    const events = ctx.newEvents();
+    expect(countEvents(events, 'full_compaction.complete')).toBe(1);
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        type: '[wire]',
+        event: 'full_compaction.complete',
+        args: expect.objectContaining({ outcome: 'failed' }),
+      }),
+    );
+    expect(countEvents(events, 'full_compaction.cancel')).toBe(0);
+    expect(countEvents(events, 'compaction.cancelled')).toBe(0);
+    expect(countEvents(events, 'compaction.completed')).toBe(0);
+    await ctx.expectResumeMatches();
+  });
+
+  it('keeps a committed summary and retries transient reinjection before the next request', async () => {
+    const ctx = testAgent(
+      logServices({
+        info() {},
+        warn() {},
+        error() {
+          throw new Error('error sink failed');
+        },
+        debug() {},
+      }),
+    );
+    ctx.configure({
+      provider: CATALOGUED_PROVIDER,
+      modelCapabilities: CATALOGUED_MODEL_CAPABILITIES,
+    });
+    ctx.appendExchange(1, 'old user one', 'old assistant one', 20);
+    ctx.appendExchange(2, 'recent user two', 'recent assistant two', 80);
+    const inject = vi
+      .spyOn(ctx.get(IAgentContextInjectorService), 'injectAfterCompaction')
+      .mockRejectedValueOnce(new Error('transient reinjection failure'))
+      .mockResolvedValue(undefined);
+    const completed = ctx.once('compaction.completed');
+
+    ctx.mockNextResponse({ type: 'text', text: 'Committed summary.' });
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('committed');
+    expect(ctx.compactHistory().map((entry) => entry.text).join('\n')).toContain(
+      'Committed summary.',
+    );
+    expect(countEvents(ctx.allEvents, 'full_compaction.complete')).toBe(0);
+    expect(countEvents(ctx.allEvents, 'compaction.cancelled')).toBe(0);
+
+    ctx.mockNextResponse({ type: 'text', text: 'Continued after maintenance.' });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await ctx.untilTurnEnd();
+
+    expect(inject).toHaveBeenCalledTimes(2);
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('idle');
+    expect(countEvents(ctx.allEvents, 'full_compaction.complete')).toBe(1);
+    expect(countEvents(ctx.allEvents, 'full_compaction.cancel')).toBe(0);
+    expect(countEvents(ctx.allEvents, 'compaction.completed')).toBe(1);
+    expect(
+      ctx.llmCalls
+        .at(-1)!
+        .history.map(messageText)
+        .some((text) => text.includes('Committed summary.')),
+    ).toBe(true);
+    await ctx.expectResumeMatches();
+  });
+
+  it('retries a transient system-prompt refresh without re-running successful reinjection', async () => {
+    const ctx = testAgent();
+    ctx.configure({
+      provider: CATALOGUED_PROVIDER,
+      modelCapabilities: CATALOGUED_MODEL_CAPABILITIES,
+    });
+    ctx.appendExchange(1, 'old user one', 'old assistant one', 20);
+    ctx.appendExchange(2, 'recent user two', 'recent assistant two', 80);
+    const refresh = vi
+      .spyOn(ctx.get(IAgentProfileService), 'refreshSystemPrompt')
+      .mockRejectedValueOnce(new Error('transient refresh failure'))
+      .mockResolvedValue(undefined);
+    const inject = vi.spyOn(
+      ctx.get(IAgentContextInjectorService),
+      'injectAfterCompaction',
+    );
+    const completed = ctx.once('compaction.completed');
+
+    ctx.mockNextResponse({ type: 'text', text: 'Committed summary.' });
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('committed');
+
+    ctx.mockNextResponse({ type: 'text', text: 'Continued after refresh.' });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await ctx.untilTurnEnd();
+
+    expect(refresh).toHaveBeenCalledTimes(2);
+    expect(inject).toHaveBeenCalledTimes(1);
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('idle');
+    expect(countEvents(ctx.allEvents, 'full_compaction.complete')).toBe(1);
+    expect(countEvents(ctx.allEvents, 'full_compaction.cancel')).toBe(0);
+    await ctx.expectResumeMatches();
+  });
+
+  it('does not cancel or roll back after the context replacement commits', async () => {
+    const ctx = testAgent();
+    ctx.configure({
+      provider: CATALOGUED_PROVIDER,
+      modelCapabilities: CATALOGUED_MODEL_CAPABILITIES,
+    });
+    ctx.appendExchange(1, 'old user one', 'old assistant one', 20);
+    ctx.appendExchange(2, 'recent user two', 'recent assistant two', 80);
+    const maintenanceStarted = deferred<void>();
+    const releaseMaintenance = deferred<void>();
+    vi.spyOn(ctx.get(IAgentContextInjectorService), 'injectAfterCompaction').mockImplementation(
+      async () => {
+        maintenanceStarted.resolve();
+        await releaseMaintenance.promise;
+      },
+    );
+    const completed = ctx.once('compaction.completed');
+
+    ctx.mockNextResponse({ type: 'text', text: 'Committed summary.' });
+    await ctx.rpc.beginCompaction({});
+    await maintenanceStarted.promise;
+    await ctx.rpc.cancelCompaction({});
+    releaseMaintenance.resolve();
+    await completed;
+
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('idle');
+    expect(ctx.compactHistory().map((entry) => entry.text).join('\n')).toContain(
+      'Committed summary.',
+    );
+    expect(countEvents(ctx.allEvents, 'full_compaction.complete')).toBe(1);
+    expect(countEvents(ctx.allEvents, 'full_compaction.cancel')).toBe(0);
+    expect(countEvents(ctx.allEvents, 'compaction.cancelled')).toBe(0);
+    expect(countEvents(ctx.allEvents, 'compaction.completed')).toBe(1);
+    await ctx.expectResumeMatches();
+  });
+
   it('fails a blocked turn when auto compaction generation fails', async () => {
     let attempts = 0;
     const generate: GenerateFn = async () => {
@@ -2918,7 +3163,7 @@ describe('prompt deferral during full compaction', () => {
     });
     ctx.appendExchange(1, 'old user one', 'old assistant one', 20);
     ctx.appendExchange(2, 'recent user two', 'recent assistant two', 80);
-    const cancelled = ctx.once('compaction.cancelled');
+    const failed = ctx.once('full_compaction.complete');
 
     await ctx.rpc.beginCompaction({});
     await compactionRequested.promise;
@@ -2928,9 +3173,18 @@ describe('prompt deferral during full compaction', () => {
     expect(launch).toBeUndefined();
 
     releaseCompaction.resolve();
-    await cancelled;
+    await failed;
     const events = await ctx.untilTurnEnd();
 
+    expect(countEvents(events, 'full_compaction.complete')).toBe(1);
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        type: '[wire]',
+        event: 'full_compaction.complete',
+        args: expect.objectContaining({ outcome: 'failed' }),
+      }),
+    );
+    expect(countEvents(events, 'compaction.cancelled')).toBe(0);
     expect(countEvents(events, 'compaction.completed')).toBe(0);
     expect(events).toContainEqual(
       expect.objectContaining({
diff --git a/packages/agent-core-v2/test/agent/llmRequester/llmRequesterService.test.ts b/packages/agent-core-v2/test/agent/llmRequester/llmRequesterService.test.ts
index 4b5626b8bc..e1630323da 100644
--- a/packages/agent-core-v2/test/agent/llmRequester/llmRequesterService.test.ts
+++ b/packages/agent-core-v2/test/agent/llmRequester/llmRequesterService.test.ts
@@ -260,6 +260,34 @@ describe('AgentLLMRequesterService strict resend', () => {
   });
 });
 
+describe('AgentLLMRequesterService turn prompt refresh', () => {
+  it('updates only an existing turn snapshot', async () => {
+    const calls = { value: 0 };
+    const inputs: LLMRequestInput[] = [];
+    const { service } = createService(createModel(calls, null, [], inputs), undefined);
+
+    await service.request({ source: { type: 'turn', turnId: 1, step: 1 } });
+    service.refreshTurnSystemPrompt(1, 'refreshed after compaction');
+    await service.request({ source: { type: 'turn', turnId: 1, step: 2 } });
+
+    expect(inputs.map((input) => input.systemPrompt)).toEqual([
+      'system',
+      'refreshed after compaction',
+    ]);
+  });
+
+  it('does not create a turn snapshot before its first request', async () => {
+    const calls = { value: 0 };
+    const inputs: LLMRequestInput[] = [];
+    const { service } = createService(createModel(calls, null, [], inputs), undefined);
+
+    service.refreshTurnSystemPrompt(1, 'premature compaction prompt');
+    await service.request({ source: { type: 'turn', turnId: 1, step: 1 } });
+
+    expect(inputs[0]?.systemPrompt).toBe('system');
+  });
+});
+
 describe('AgentLLMRequesterService media-stripped resend', () => {
   const IMAGE_FORMAT_400 = new APIStatusError(
     400,
diff --git a/packages/agent-core-v2/test/agent/loop/loop.test.ts b/packages/agent-core-v2/test/agent/loop/loop.test.ts
index 889d83135a..7c8f0c95f1 100644
--- a/packages/agent-core-v2/test/agent/loop/loop.test.ts
+++ b/packages/agent-core-v2/test/agent/loop/loop.test.ts
@@ -1,17 +1,24 @@
-import { type ToolCall } from '#/app/llmProtocol/message';
+import { APIStatusError } from '#/app/llmProtocol/errors';
+import { type Message, type ToolCall } from '#/app/llmProtocol/message';
 import { emptyUsage } from '#/app/llmProtocol/usage';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { IAgentProfileService } from '#/index';
 import { IAgentLLMRequesterService, type LLMStreamTiming } from '#/agent/llmRequester/llmRequester';
 import { IAgentGoalService } from '#/agent/goal/goal';
+import { IAgentContextProjectorService } from '#/agent/contextProjector/contextProjector';
+import { IAgentContextMemoryService } from '#/agent/contextMemory/contextMemory';
 import { IAgentLoopService, type Turn } from '#/agent/loop/loop';
+import { TurnModel, turnOutcome } from '#/agent/loop/turnOps';
 import { ContinuationStepRequest, MessageStepRequest } from '#/agent/loop/stepRequest';
+import { IAgentToolExecutorService } from '#/agent/toolExecutor/toolExecutor';
 import type { ExecutableTool } from '#/tool/toolContract';
 import { IAgentToolRegistryService } from '#/agent/toolRegistry/toolRegistry';
 import { IAgentUsageService } from '#/agent/usage/usage';
 import { IEventBus } from '#/app/event/eventBus';
 import { userCancellationReason } from '#/_base/utils/abort';
+import { ILogService } from '#/_base/log/log';
+import { IWireService } from '#/wire/wire';
 
 import {
   agentService,
@@ -21,9 +28,21 @@ import {
   type TestAgentOptions,
 } from '../../harness';
 import { recordingTelemetry, type TelemetryRecord } from '../../app/telemetry/stubs';
+import { stubLog } from '../../_base/log/stubs';
+import { stubToolExecutor } from './stubs';
 
 type GenerateFn = NonNullable<TestAgentOptions['generate']>;
 
+function throwingDiagnosticLog(): {
+  readonly log: ILogService;
+  readonly warn: ReturnType<typeof vi.fn>;
+} {
+  const warn = vi.fn(() => {
+    throw new Error('diagnostic sink failed');
+  });
+  return { log: { ...stubLog(), warn }, warn };
+}
+
 describe('Agent loop', () => {
   let ctx: TestAgentContext;
   let loop: IAgentLoopService;
@@ -115,7 +134,9 @@ describe('Agent loop', () => {
       [emit] agent.activity.updated      { "lifecycle": "ready", "turn": { "turnId": 0, "origin": { "kind": "user" }, "phase": "running", "step": 1, "ending": false, "pendingApprovals": [], "activeToolCalls": [], "since": "<time>" }, "background": [] }
       [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "blocked" } }, "time": "<time>" }
       [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "finishReason": "filtered", "usage": { "inputOther": 3, "output": 5, "inputCacheRead": 0, "inputCacheCreation": 0 }, "messageId": "mock-1", "providerFinishReason": "filtered", "rawFinishReason": "filtered" }, "time": "<time>" }
+      [wire] turn.outcome                { "outcomeId": "<uuid-3>", "turnId": 0, "content": "The previous turn ended before producing a final response.\\n\\nError: The model provider blocked the response due to its safety policy.\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.", "time": "<time>" }
       [emit] agent.activity.updated      { "lifecycle": "ready", "lastTurn": { "turnId": 0, "reason": "failed", "at": "<time>" }, "background": [] }
+      [emit] context.spliced             { "start": 2, "deleteCount": 0, "messages": [ { "role": "user", "content": [ { "type": "text", "text": "<system-reminder>\\nThe previous turn ended before producing a final response.\\n\\nError: The model provider blocked the response due to its safety policy.\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.\\n</system-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "turn_outcome" } } ] }
       [emit] turn.ended                  { "turnId": 0, "reason": "failed", "error": { "code": "provider.filtered", "message": "Provider safety policy blocked the response.", "name": "ProviderFilteredError", "details": { "finishReason": "filtered" }, "retryable": false } }
     `);
 
@@ -224,6 +245,11 @@ describe('Agent loop', () => {
         args: expect.objectContaining({ reason: 'completed' }),
       }),
     );
+    expect(ctx.contextData().history).not.toContainEqual(
+      expect.objectContaining({
+        origin: { kind: 'injection', variant: 'turn_outcome' },
+      }),
+    );
   });
 
   it('reports an untyped LLM error message without an internal-code prefix', async () => {
@@ -243,6 +269,502 @@ describe('Agent loop', () => {
     );
   });
 
+  it('preserves the failed-turn boundary when the user follows up after a terminal provider error', async () => {
+    await ctx.dispose();
+    const histories: Message[][] = [];
+    let calls = 0;
+    const generate: GenerateFn = async (_provider, _system, _tools, history) => {
+      histories.push(structuredClone(history));
+      calls += 1;
+      if (calls === 1) {
+        throw new APIStatusError(
+          500,
+          '500 request req-example failed at http://internal-cache.example.test:26677',
+          'req-example-500',
+        );
+      }
+      return {
+        id: 'follow-up-response',
+        message: {
+          role: 'assistant',
+          content: [{ type: 'text', text: 'Continued.' }],
+          toolCalls: [],
+        },
+        usage: emptyUsage(),
+        finishReason: 'completed',
+        rawFinishReason: 'stop',
+      };
+    };
+    ctx = createTestAgent({
+      generate,
+      initialConfig: { loopControl: { maxRetriesPerStep: 1 } },
+    });
+    loop = ctx.get(IAgentLoopService);
+    profile = ctx.get(IAgentProfileService);
+    profile.update({ activeToolNames: [] });
+
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'Would optimization 2 increase memory usage?' }],
+    });
+    await ctx.untilTurnEnd();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await ctx.untilTurnEnd();
+
+    expect(histories[1]).toEqual([
+      {
+        role: 'user',
+        content: [{ type: 'text', text: 'Would optimization 2 increase memory usage?' }],
+        toolCalls: [],
+      },
+      {
+        role: 'user',
+        content: [
+          {
+            type: 'text',
+            text: [
+              '<system-reminder>',
+              'The previous turn ended before producing a final response.',
+              '',
+              'Error: API request failed with HTTP 500.',
+              '',
+              'The preceding user request may still be unfinished. Treat the next user message as a follow-up.',
+              '</system-reminder>',
+            ].join('\n'),
+          },
+        ],
+        toolCalls: [],
+      },
+      {
+        role: 'user',
+        content: [{ type: 'text', text: 'Continue.' }],
+        toolCalls: [],
+      },
+    ]);
+    const followUpContext = JSON.stringify(histories[1]);
+    expect(followUpContext).not.toContain('req-example');
+    expect(followUpContext).not.toContain('internal-cache.example.test');
+  });
+
+  it('keeps one outcome identity when the next turn starts during terminal activity publication', async () => {
+    await ctx.dispose();
+    const histories: Message[][] = [];
+    let calls = 0;
+    const generate: GenerateFn = async (_provider, _system, _tools, history) => {
+      histories.push(structuredClone(history));
+      calls += 1;
+      if (calls === 1) {
+        throw new APIStatusError(500, 'first turn failed', 'reentrant-outcome');
+      }
+      return {
+        id: 'reentrant-follow-up-response',
+        message: {
+          role: 'assistant',
+          content: [{ type: 'text', text: 'Recovered without duplication.' }],
+          toolCalls: [],
+        },
+        usage: emptyUsage(),
+        finishReason: 'completed',
+        rawFinishReason: 'stop',
+      };
+    };
+    ctx = createTestAgent({
+      generate,
+      initialConfig: { loopControl: { maxRetriesPerStep: 1 } },
+    });
+    loop = ctx.get(IAgentLoopService);
+    profile = ctx.get(IAgentProfileService);
+    profile.update({ activeToolNames: [] });
+
+    let reentrantTurn: Promise<Turn> | undefined;
+    const subscription = ctx.get(IEventBus).subscribe('agent.activity.updated', (event) => {
+      if (
+        reentrantTurn !== undefined ||
+        event.turn !== undefined ||
+        event.lastTurn?.reason !== 'failed'
+      ) {
+        return;
+      }
+      reentrantTurn = loop
+        .enqueue(nextTurnMessage('Continue from the reentrant observer.'))
+        .assigned.then((assignment) => assignment.turn);
+    });
+
+    const firstEnded = ctx.once('turn.ended');
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Fail before the observer.' }] });
+    await firstEnded;
+    const followUp = await reentrantTurn;
+    expect(followUp).toBeDefined();
+    await followUp!.result;
+    subscription.dispose();
+
+    const outcomeMessages = ctx.context.get().filter(
+      (message) =>
+        message.origin?.kind === 'injection' && message.origin.variant === 'turn_outcome',
+    );
+    expect(outcomeMessages).toHaveLength(1);
+    expect(histories[1]!.map(textContent)).toEqual([
+      'Fail before the observer.',
+      expect.stringContaining('API request failed with HTTP 500.'),
+      'Continue from the reentrant observer.',
+    ]);
+  });
+
+  it('records a model-visible reminder when the user cancels an active turn', async () => {
+    let stepStarted!: () => void;
+    const started = new Promise<void>((resolve) => {
+      stepStarted = resolve;
+    });
+    loop.hooks.onWillBeginStep.register('test-user-cancel-reminder', async (hookCtx, next) => {
+      stepStarted();
+      await new Promise<void>((_, reject) => {
+        hookCtx.signal.addEventListener(
+          'abort',
+          () => {
+            reject(hookCtx.signal.reason);
+          },
+          { once: true },
+        );
+      });
+      await next();
+    });
+
+    const turn = (await loop.enqueue(nextTurnMessage('Wait for cancellation.')).assigned).turn;
+    await started;
+    expect(loop.cancel(turn.id)).toBe(true);
+    expect(loop.cancel(turn.id)).toBe(true);
+    await expect(turn.result).resolves.toMatchObject({ type: 'cancelled' });
+
+    expect(
+      ctx.allEvents.filter(
+        (event) =>
+          event.event === 'turn.cancel' && JSON.stringify(event.args).includes('outcomeId'),
+      ),
+    ).toHaveLength(1);
+    expect(
+      ctx.contextData().history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' && message.origin.variant === 'turn_outcome',
+      ),
+    ).toHaveLength(1);
+
+    expect(ctx.contextData().history.at(-1)).toMatchObject({
+      role: 'user',
+      content: [
+        {
+          type: 'text',
+          text: [
+            '<system-reminder>',
+            'The user interrupted the previous turn before it finished.',
+            '',
+            'Some operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.',
+            '</system-reminder>',
+          ].join('\n'),
+        },
+      ],
+      origin: { kind: 'injection', variant: 'turn_outcome' },
+    });
+  });
+
+  it('tombstones pending turn outcomes when context is cleared or undone', () => {
+    const wire = ctx.get(IWireService);
+    const context = ctx.get(IAgentContextMemoryService);
+    wire.dispatch(turnOutcome({ outcomeId: 'clear-outcome', turnId: 10, content: 'clear me' }));
+
+    // A crash may leave only the intent, before either the old prompt or the
+    // reminder reached context. Clear must still persist its tombstone.
+    context.clear();
+    expect(wire.getModel(TurnModel).pendingOutcomes).toEqual([]);
+
+    context.append({
+      role: 'user',
+      content: [{ type: 'text', text: 'undo me' }],
+      toolCalls: [],
+      origin: { kind: 'user' },
+    });
+    wire.dispatch(turnOutcome({ outcomeId: 'undo-outcome', turnId: 11, content: 'undo me too' }));
+
+    context.undo(1);
+    expect(wire.getModel(TurnModel).pendingOutcomes).toEqual([]);
+  });
+
+  it('does not recreate a cancelled-turn outcome after context clear tombstones it', async () => {
+    let stepStarted!: () => void;
+    const started = new Promise<void>((resolve) => {
+      stepStarted = resolve;
+    });
+    loop.hooks.onWillBeginStep.register('test-clear-cancelled-outcome', async (hookCtx, next) => {
+      stepStarted();
+      await new Promise<void>((_, reject) => {
+        hookCtx.signal.addEventListener(
+          'abort',
+          () => {
+            reject(hookCtx.signal.reason);
+          },
+          { once: true },
+        );
+      });
+      await next();
+    });
+
+    const turn = (await loop.enqueue(nextTurnMessage('Clear this cancelled turn.')).assigned).turn;
+    await started;
+    expect(loop.cancel(turn.id)).toBe(true);
+    ctx.get(IAgentContextMemoryService).clear();
+    await expect(turn.result).resolves.toMatchObject({ type: 'cancelled' });
+
+    expect(ctx.get(IWireService).getModel(TurnModel).pendingOutcomes).toEqual([]);
+    expect(
+      ctx.context.get().filter(
+        (message) =>
+          message.origin?.kind === 'injection' && message.origin.variant === 'turn_outcome',
+      ),
+    ).toHaveLength(0);
+  });
+
+  it('blocks a new turn when an older outcome reminder fails before acceptance', async () => {
+    const wire = ctx.get(IWireService);
+    const context = ctx.get(IAgentContextMemoryService);
+    const append = vi
+      .spyOn(context, 'appendTurnOutcome')
+      .mockImplementationOnce(() => {
+        throw new Error('outcome append failed before acceptance');
+      });
+    wire.dispatch(
+      turnOutcome({
+        outcomeId: 'preaccept-outcome',
+        turnId: 10,
+        content: 'Older turn failed before the follow-up.',
+      }),
+    );
+
+    expect(() => loop.enqueue(nextTurnMessage('Must not reach the model.'))).toThrow(
+      'outcome append failed before acceptance',
+    );
+
+    expect(ctx.llmCalls).toHaveLength(0);
+    expect(loop.status()).toMatchObject({ state: 'idle', pendingTurnIds: [] });
+    expect(wire.getModel(TurnModel).pendingOutcomes).toHaveLength(1);
+
+    ctx.mockNextResponse({ type: 'text', text: 'Continued after the barrier retry.' });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue after retry.' }] });
+    await ctx.untilTurnEnd();
+
+    expect(append).toHaveBeenCalledTimes(2);
+    expect(wire.getModel(TurnModel).pendingOutcomes).toEqual([]);
+    expect(ctx.llmCalls).toHaveLength(1);
+    expect(ctx.llmCalls[0]!.history.map(textContent)).toEqual([
+      '<system-reminder>\nOlder turn failed before the follow-up.\n</system-reminder>',
+      'Continue after retry.',
+    ]);
+  });
+
+  it('keeps the terminal result and drains later turns when one queued turn fails its outcome barrier', async () => {
+    const context = ctx.get(IAgentContextMemoryService);
+    const appendFailure = new Error('outcome append failed before acceptance');
+    const append = vi
+      .spyOn(context, 'appendTurnOutcome')
+      .mockImplementationOnce(() => {
+        throw appendFailure;
+      })
+      .mockImplementationOnce(() => {
+        throw appendFailure;
+      });
+    const firstStepStarted = deferred();
+    const releaseFirstStep = deferred();
+    loop.hooks.onWillBeginStep.register('test-queued-start-failure', async (hookCtx, next) => {
+      if (hookCtx.turnId === 0) {
+        firstStepStarted.resolve();
+        await releaseFirstStep.promise;
+      }
+      await next();
+    });
+    ctx.mockNextProviderResponse({
+      parts: [{ type: 'text', text: 'blocked' }],
+      finishReason: 'filtered',
+    });
+    ctx.mockNextResponse({ type: 'text', text: 'third turn completed' });
+
+    const first = (await loop.enqueue(nextTurnMessage('first')).assigned).turn;
+    await firstStepStarted.promise;
+    const second = (await loop.enqueue(nextTurnMessage('second')).assigned).turn;
+    const third = (await loop.enqueue(nextTurnMessage('third')).assigned).turn;
+    releaseFirstStep.resolve();
+
+    await expect(first.result).resolves.toMatchObject({
+      type: 'failed',
+      error: { code: 'provider.filtered' },
+    });
+    await expect(second.result).resolves.toEqual({
+      type: 'failed',
+      error: appendFailure,
+      steps: 0,
+    });
+    await expect(third.result).resolves.toMatchObject({ type: 'completed' });
+    expect(append).toHaveBeenCalledTimes(3);
+    expect(ctx.llmCalls).toHaveLength(2);
+    expect(ctx.llmCalls[1]!.history.map(textContent)).toEqual([
+      'first',
+      'blocked',
+      expect.stringContaining('model provider blocked the response'),
+      'third',
+    ]);
+    expect(loop.status()).toEqual({
+      state: 'idle',
+      activeTurnId: undefined,
+      pendingTurnIds: [],
+      hasPendingRequests: false,
+    });
+  });
+
+  it('continues without duplicating an accepted outcome when its observer and diagnostic logger throw', async () => {
+    await ctx.dispose();
+    const diagnosticLog = throwingDiagnosticLog();
+    ctx = createTestAgent(agentService(ILogService, diagnosticLog.log));
+    loop = ctx.get(IAgentLoopService);
+    const wire = ctx.get(IWireService);
+    const context = ctx.get(IAgentContextMemoryService);
+    const originalAppend = context.appendTurnOutcome.bind(context);
+    const append = vi
+      .spyOn(context, 'appendTurnOutcome')
+      .mockImplementationOnce((message, outcomeId) => {
+        originalAppend(message, outcomeId);
+        throw new Error('outcome observer failed after acceptance');
+      });
+    wire.dispatch(
+      turnOutcome({
+        outcomeId: 'postaccept-outcome',
+        turnId: 11,
+        content: 'Accepted outcome must appear exactly once.',
+      }),
+    );
+    ctx.mockNextResponse({ type: 'text', text: 'Follow-up completed.' });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue once.' }] });
+    await ctx.untilTurnEnd();
+
+    expect(ctx.allEvents).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'completed' }),
+      }),
+    );
+    expect(diagnosticLog.warn).toHaveBeenCalledWith(
+      'turn outcome reminder committed with observer failure',
+      expect.objectContaining({ turnId: 11 }),
+    );
+    expect(append).toHaveBeenCalledOnce();
+    expect(wire.getModel(TurnModel).pendingOutcomes).toEqual([]);
+    expect(
+      ctx.context
+        .get()
+        .filter((message) => textContent(message).includes('Accepted outcome must appear')),
+    ).toHaveLength(1);
+    expect(ctx.llmCalls[0]!.history.map(textContent)).toEqual([
+      '<system-reminder>\nAccepted outcome must appear exactly once.\n</system-reminder>',
+      'Continue once.',
+    ]);
+    await ctx.expectResumeMatches();
+  });
+
+  it('ends a cancelled turn and pumps the queue when rendering and diagnostic logging throw', async () => {
+    await ctx.dispose();
+    const diagnosticLog = throwingDiagnosticLog();
+    ctx = createTestAgent(agentService(ILogService, diagnosticLog.log));
+    loop = ctx.get(IAgentLoopService);
+    let stepStarted!: () => void;
+    const started = new Promise<void>((resolve) => {
+      stepStarted = resolve;
+    });
+    loop.hooks.onWillBeginStep.register('test-hostile-cancel-reason', async (hookCtx, next) => {
+      if (hookCtx.turnId === 0) {
+        stepStarted();
+        await new Promise<void>((_, reject) => {
+          hookCtx.signal.addEventListener('abort', () => reject(hookCtx.signal.reason), {
+            once: true,
+          });
+        });
+      }
+      await next();
+    });
+    ctx.mockNextResponse({ type: 'text', text: 'second turn completed' });
+
+    const first = (await loop.enqueue(nextTurnMessage('first')).assigned).turn;
+    const second = (await loop.enqueue(nextTurnMessage('second')).assigned).turn;
+    await started;
+    loop.cancel(first.id, cancellationReasonWithHostileMessage());
+
+    await expect(first.result).resolves.toMatchObject({ type: 'cancelled' });
+    await expect(second.result).resolves.toMatchObject({ type: 'completed' });
+    expect(diagnosticLog.warn).toHaveBeenCalledWith(
+      'failed to render turn cancellation outcome',
+      expect.objectContaining({ turnId: 0 }),
+    );
+    expect(
+      ctx.allEvents
+        .filter((event) => event.type === '[rpc]' && event.event === 'turn.ended')
+        .map((event) => event.args),
+    ).toMatchObject([
+      { turnId: 0, reason: 'cancelled' },
+      { turnId: 1, reason: 'completed' },
+    ]);
+  });
+
+  it('closes a dangling tool exchange before a failed-turn reminder and follow-up', async () => {
+    const toolExecutor: IAgentToolExecutorService = {
+      ...stubToolExecutor(),
+      async *execute(calls, options) {
+        const call = calls[0];
+        if (call === undefined) return;
+        options.onToolCall?.({ toolCallId: call.id, name: call.name, args: {} });
+        yield await Promise.reject(new Error('tool result dispatch failed'));
+      },
+    };
+    const local = createTestAgent(agentService(IAgentToolExecutorService, toolExecutor));
+    try {
+      local.mockNextResponse({
+        type: 'function',
+        id: 'call_abandoned',
+        name: 'Run',
+        arguments: '{}',
+      });
+      await local.rpc.prompt({ input: [{ type: 'text', text: 'Run the tool.' }] });
+      await local.untilTurnEnd();
+
+      expect(local.project()).toMatchObject([
+        { role: 'user' },
+        { role: 'assistant', toolCalls: [{ id: 'call_abandoned' }] },
+        { role: 'tool', toolCallId: 'call_abandoned' },
+        { role: 'user' },
+      ]);
+      expect(local.contextData().history.at(-1)?.origin).toEqual({
+        kind: 'injection',
+        variant: 'turn_outcome',
+      });
+      expect(
+        local
+          .get(IAgentContextProjectorService)
+          .projectStrict(local.contextData().history)
+          .map((message) => message.role),
+      ).toEqual(['user', 'assistant', 'tool', 'user']);
+
+      local.mockNextResponse({ type: 'text', text: 'continued safely' });
+      await local.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+      await local.untilTurnEnd();
+
+      expect(local.project().map((message) => message.role)).toEqual([
+        'user',
+        'assistant',
+        'tool',
+        'user',
+        'user',
+        'assistant',
+      ]);
+      await local.expectResumeMatches();
+    } finally {
+      await local.dispose();
+    }
+  });
+
   it('does not run loop error handlers for aborted turns', async () => {
     let called = false;
     loop.registerLoopErrorHandler({
@@ -598,6 +1120,18 @@ describe('Agent loop', () => {
     expect(active.state).toBe('cancelled');
     expect(queued.state).toBe('cancelled');
     expect(ctx.llmCalls).toHaveLength(0);
+    expect(
+      ctx.allEvents.filter(
+        (event) =>
+          event.event === 'turn.cancel' && JSON.stringify(event.args).includes('outcomeId'),
+      ),
+    ).toHaveLength(1);
+    expect(
+      ctx.contextData().history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' && message.origin.variant === 'turn_outcome',
+      ),
+    ).toHaveLength(1);
     expect(() => loop.enqueue(nextTurnMessage('rejected'))).toThrow();
   });
 
@@ -852,6 +1386,13 @@ function nextTurnMessage(text: string): MessageStepRequest {
   );
 }
 
+function textContent(message: Pick<Message, 'content'>): string {
+  return message.content
+    .filter((part) => part.type === 'text')
+    .map((part) => part.text)
+    .join('');
+}
+
 function createTimingRequester(): IAgentLLMRequesterService {
   const timing: LLMStreamTiming = {
     firstTokenLatencyMs: 100,
@@ -864,6 +1405,7 @@ function createTimingRequester(): IAgentLLMRequesterService {
 
   return {
     _serviceBrand: undefined,
+    refreshTurnSystemPrompt: vi.fn(),
     async request(_overrides, onPart = () => {}) {
       await onPart({ type: 'text', text: 'answer' });
       return {
@@ -953,3 +1495,14 @@ function deferred(): { readonly promise: Promise<void>; readonly resolve: () =>
   });
   return { promise, resolve };
 }
+
+function cancellationReasonWithHostileMessage(): Error {
+  const reason = new Error('hostile cancellation diagnostic');
+  Object.defineProperty(reason, 'message', {
+    configurable: true,
+    get() {
+      throw new Error('message getter failed');
+    },
+  });
+  return reason;
+}
diff --git a/packages/agent-core-v2/test/agent/toolSelect/toolSelectService.test.ts b/packages/agent-core-v2/test/agent/toolSelect/toolSelectService.test.ts
index 0e30e87d00..a6f728d122 100644
--- a/packages/agent-core-v2/test/agent/toolSelect/toolSelectService.test.ts
+++ b/packages/agent-core-v2/test/agent/toolSelect/toolSelectService.test.ts
@@ -241,10 +241,18 @@ class FakeContextMemory implements IAgentContextMemoryService {
     this.appended.push(...messages);
   }
 
+  appendTurnOutcome(message: ContextMessage): void {
+    this.appended.push(message);
+  }
+
   appendLoopEvent(_event: LoopRecordedEvent): void {
     throw new Error('unused in this suite');
   }
 
+  closeAbandonedToolExchange(): number {
+    return 0;
+  }
+
   clear(): void {
     this.history.length = 0;
     this.appended.length = 0;
diff --git a/packages/agent-core-v2/test/app/externalHooksRunner/integration.test.ts b/packages/agent-core-v2/test/app/externalHooksRunner/integration.test.ts
index 8744c3e224..372e96df14 100644
--- a/packages/agent-core-v2/test/app/externalHooksRunner/integration.test.ts
+++ b/packages/agent-core-v2/test/app/externalHooksRunner/integration.test.ts
@@ -99,7 +99,11 @@ function stubContextMemory(): IAgentContextMemoryService & {
     append: (...inserted) => {
       messages.push(...inserted);
     },
+    appendTurnOutcome: (message) => {
+      messages.push(message);
+    },
     appendLoopEvent: () => {},
+    closeAbandonedToolExchange: () => 0,
     clear: () => {
       messages.splice(0);
     },
diff --git a/packages/agent-core-v2/test/app/llmProtocol/generate.test.ts b/packages/agent-core-v2/test/app/llmProtocol/generate.test.ts
new file mode 100644
index 0000000000..8cd66eaac7
--- /dev/null
+++ b/packages/agent-core-v2/test/app/llmProtocol/generate.test.ts
@@ -0,0 +1,355 @@
+/**
+ * `llmProtocol` generation cancellation scenarios — verifies abort authority
+ * across the provider request, streamed iteration, and streamed-part callback
+ * while keeping tool-call dispatch after stream completion. The provider is
+ * the only stubbed external boundary.
+ *
+ * Run: pnpm --filter @moonshot-ai/agent-core-v2 exec vitest run test/app/llmProtocol/generate.test.ts
+ */
+
+import { generate } from '#/app/llmProtocol/generate';
+import type { StreamedMessagePart } from '#/app/llmProtocol/message';
+import type {
+  ChatProvider,
+  GenerateOptions,
+  StreamedMessage,
+  ThinkingEffort,
+} from '#/app/llmProtocol/provider';
+import { describe, expect, it, vi } from 'vitest';
+
+interface Deferred<T> {
+  readonly promise: Promise<T>;
+  readonly resolve: (value: T) => void;
+}
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise;
+  });
+  return { promise, resolve };
+}
+
+function createProvider(
+  request: (options?: GenerateOptions) => Promise<StreamedMessage>,
+): ChatProvider {
+  return {
+    name: 'test-provider',
+    modelName: 'test-model',
+    thinkingEffort: null,
+    generate: (_systemPrompt, _tools, _history, options) => request(options),
+    withThinking(_effort: ThinkingEffort): ChatProvider {
+      return this;
+    },
+  };
+}
+
+function createStream(iterator: AsyncIterator<StreamedMessagePart>): StreamedMessage {
+  return {
+    id: 'response-1',
+    usage: null,
+    finishReason: 'completed',
+    rawFinishReason: 'stop',
+    [Symbol.asyncIterator]: () => iterator,
+  };
+}
+
+describe('generate cancellation boundaries', () => {
+  it('rejects with AbortError when the provider request never settles', async () => {
+    const controller = new AbortController();
+    const request = deferred<StreamedMessage>();
+    const result = generate(
+      createProvider(() => request.promise),
+      '',
+      [],
+      [],
+      undefined,
+      { signal: controller.signal },
+    );
+
+    controller.abort();
+
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+  });
+
+  it('retires a stream that the provider resolves after cancellation', async () => {
+    const controller = new AbortController();
+    const request = deferred<StreamedMessage>();
+    const cancel = vi.fn<() => void>();
+    const streamIterator = vi.fn<() => AsyncIterator<StreamedMessagePart>>();
+    const lateStream: StreamedMessage & { cancel(): void } = {
+      id: 'late-response',
+      usage: null,
+      finishReason: null,
+      rawFinishReason: null,
+      cancel,
+      [Symbol.asyncIterator]: streamIterator,
+    };
+    const result = generate(
+      createProvider(() => request.promise),
+      '',
+      [],
+      [],
+      undefined,
+      { signal: controller.signal },
+    );
+
+    controller.abort();
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+    request.resolve(lateStream);
+    await request.promise;
+
+    expect(cancel).toHaveBeenCalledOnce();
+    expect(streamIterator).not.toHaveBeenCalled();
+  });
+
+  it('rejects without waiting when iterator progress and cleanup never settle', async () => {
+    const controller = new AbortController();
+    const nextStarted = deferred<void>();
+    const nextResult = deferred<IteratorResult<StreamedMessagePart>>();
+    const cancel = vi.fn(() => Promise.reject(new Error('cleanup failed')));
+    const returnIterator = vi.fn(() => new Promise<IteratorResult<StreamedMessagePart>>(() => {}));
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        nextStarted.resolve(undefined);
+        return nextResult.promise;
+      },
+      return: returnIterator,
+    };
+    const stream = Object.assign(createStream(iterator), { cancel });
+    const result = generate(
+      createProvider(() => Promise.resolve(stream)),
+      '',
+      [],
+      [],
+      undefined,
+      { signal: controller.signal },
+    );
+    await nextStarted.promise;
+
+    controller.abort();
+
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+    expect(cancel).toHaveBeenCalledOnce();
+    expect(returnIterator).toHaveBeenCalledOnce();
+  });
+
+  it('does not deliver an iterator result that arrives after cancellation', async () => {
+    const controller = new AbortController();
+    const nextStarted = deferred<void>();
+    const nextResult = deferred<IteratorResult<StreamedMessagePart>>();
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        nextStarted.resolve(undefined);
+        return nextResult.promise;
+      },
+      return: () => Promise.resolve({ done: true, value: undefined }),
+    };
+    const onMessagePart = vi.fn<(part: StreamedMessagePart) => void>();
+    const result = generate(
+      createProvider(() => Promise.resolve(createStream(iterator))),
+      '',
+      [],
+      [],
+      { onMessagePart },
+      { signal: controller.signal },
+    );
+    await nextStarted.promise;
+
+    controller.abort();
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+    nextResult.resolve({ done: false, value: { type: 'text', text: 'late output' } });
+    await nextResult.promise;
+
+    expect(onMessagePart).not.toHaveBeenCalled();
+  });
+
+  it('does not deliver a chunk when cancellation lands between next resolution and yield', async () => {
+    const controller = new AbortController();
+    const nextStarted = deferred<void>();
+    const nextResult = deferred<IteratorResult<StreamedMessagePart>>();
+    const returnIterator = vi.fn<
+      () => Promise<IteratorResult<StreamedMessagePart>>
+    >(() => Promise.resolve({ done: true, value: undefined }));
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        nextStarted.resolve(undefined);
+        return nextResult.promise;
+      },
+      return: returnIterator,
+    };
+    const onMessagePart = vi.fn<(part: StreamedMessagePart) => void>();
+    const result = generate(
+      createProvider(() => Promise.resolve(createStream(iterator))),
+      '',
+      [],
+      [],
+      { onMessagePart },
+      { signal: controller.signal },
+    );
+    await nextStarted.promise;
+    void nextResult.promise.then(() => {
+      controller.abort();
+    });
+
+    nextResult.resolve({ done: false, value: { type: 'text', text: 'raced output' } });
+
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+    expect(onMessagePart).not.toHaveBeenCalled();
+    expect(returnIterator).toHaveBeenCalledOnce();
+  });
+
+  it('rejects with AbortError when the message callback never settles', async () => {
+    const controller = new AbortController();
+    const callbackStarted = deferred<void>();
+    const callbackResult = deferred<void>();
+    let nextCount = 0;
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        nextCount += 1;
+        return Promise.resolve(
+          nextCount === 1
+            ? { done: false, value: { type: 'text', text: 'partial output' } }
+            : { done: true, value: undefined },
+        );
+      },
+      return: () => Promise.resolve({ done: true, value: undefined }),
+    };
+    const result = generate(
+      createProvider(() => Promise.resolve(createStream(iterator))),
+      '',
+      [],
+      [],
+      {
+        onMessagePart: () => {
+          callbackStarted.resolve(undefined);
+          return callbackResult.promise;
+        },
+      },
+      { signal: controller.signal },
+    );
+    await callbackStarted.promise;
+
+    controller.abort();
+
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+  });
+
+  it('requests each iteration cleanup operation once when callback settlement races cancellation', async () => {
+    const controller = new AbortController();
+    const callbackStarted = deferred<void>();
+    const callbackResult = deferred<void>();
+    const cancel = vi.fn<() => void>();
+    const returnIterator = vi.fn<
+      () => Promise<IteratorResult<StreamedMessagePart>>
+    >(() => Promise.resolve({ done: true, value: undefined }));
+    let nextCount = 0;
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        nextCount += 1;
+        return Promise.resolve(
+          nextCount === 1
+            ? { done: false, value: { type: 'text', text: 'partial output' } }
+            : { done: true, value: undefined },
+        );
+      },
+      return: returnIterator,
+    };
+    const stream = Object.assign(createStream(iterator), { cancel });
+    const result = generate(
+      createProvider(() => Promise.resolve(stream)),
+      '',
+      [],
+      [],
+      {
+        onMessagePart: () => {
+          callbackStarted.resolve(undefined);
+          return callbackResult.promise;
+        },
+      },
+      { signal: controller.signal },
+    );
+    await callbackStarted.promise;
+    void callbackResult.promise.then(() => {
+      controller.abort();
+    });
+
+    callbackResult.resolve(undefined);
+
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+    expect(cancel).toHaveBeenCalledOnce();
+    expect(returnIterator).toHaveBeenCalledOnce();
+  });
+
+  it('dispatches assembled tool calls only after the stream completes', async () => {
+    const events: string[] = [];
+    let nextCount = 0;
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        nextCount += 1;
+        if (nextCount === 1) {
+          return Promise.resolve({
+            done: false,
+            value: { type: 'function', id: 'tool-1', name: 'read_file', arguments: '{}' },
+          });
+        }
+        events.push('stream completed');
+        return Promise.resolve({ done: true, value: undefined });
+      },
+    };
+
+    await generate(createProvider(() => Promise.resolve(createStream(iterator))), '', [], [], {
+      onToolCall: () => {
+        events.push('tool dispatched');
+      },
+    });
+
+    expect(events).toEqual(['stream completed', 'tool dispatched']);
+  });
+
+  it('dispatches every completed tool call when the first post-stream callback aborts', async () => {
+    const controller = new AbortController();
+    const dispatched: string[] = [];
+    let nextCount = 0;
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        nextCount += 1;
+        if (nextCount === 1) {
+          return Promise.resolve({
+            done: false,
+            value: { type: 'function', id: 'tool-1', name: 'read_file', arguments: '{}' },
+          });
+        }
+        if (nextCount === 2) {
+          return Promise.resolve({
+            done: false,
+            value: { type: 'function', id: 'tool-2', name: 'write_file', arguments: '{}' },
+          });
+        }
+        return Promise.resolve({ done: true, value: undefined });
+      },
+    };
+
+    const result = await generate(
+      createProvider(() => Promise.resolve(createStream(iterator))),
+      '',
+      [],
+      [],
+      {
+        onToolCall: (toolCall) => {
+          dispatched.push(toolCall.id);
+          if (toolCall.id === 'tool-1') {
+            controller.abort();
+          }
+        },
+      },
+      { signal: controller.signal },
+    );
+
+    expect(dispatched).toEqual(['tool-1', 'tool-2']);
+    expect(result.message.toolCalls).toEqual([
+      { type: 'function', id: 'tool-1', name: 'read_file', arguments: '{}' },
+      { type: 'function', id: 'tool-2', name: 'write_file', arguments: '{}' },
+    ]);
+  });
+});
diff --git a/packages/agent-core-v2/test/app/llmProtocol/providers/stream-cancellation.test.ts b/packages/agent-core-v2/test/app/llmProtocol/providers/stream-cancellation.test.ts
new file mode 100644
index 0000000000..9ebf661bbf
--- /dev/null
+++ b/packages/agent-core-v2/test/app/llmProtocol/providers/stream-cancellation.test.ts
@@ -0,0 +1,194 @@
+/**
+ * `llmProtocol` provider stream cancellation scenarios — verifies that the
+ * public `StreamedMessage.cancel()` contract reaches every built-in SDK
+ * transport, that Google composes request/config signals, and that late native
+ * streams are retired. Each SDK client is the only stubbed external boundary.
+ *
+ * Run: pnpm --filter @moonshot-ai/agent-core-v2 exec vitest run test/app/llmProtocol/providers/stream-cancellation.test.ts
+ */
+
+import { generate } from '#/app/llmProtocol/generate';
+import { AnthropicChatProvider } from '#/app/llmProtocol/providers/anthropic';
+import { GoogleGenAIChatProvider } from '#/app/llmProtocol/providers/google-genai';
+import { KimiChatProvider } from '#/app/llmProtocol/providers/kimi';
+import { OpenAILegacyChatProvider } from '#/app/llmProtocol/providers/openai-legacy';
+import { OpenAIResponsesChatProvider } from '#/app/llmProtocol/providers/openai-responses';
+import type { StreamedMessage } from '#/app/llmProtocol/provider';
+import { describe, expect, it, vi } from 'vitest';
+
+const HISTORY = [
+  { role: 'user' as const, content: [{ type: 'text' as const, text: 'Hello' }], toolCalls: [] },
+];
+
+interface Deferred<T> {
+  readonly promise: Promise<T>;
+  readonly resolve: (value: T) => void;
+}
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise;
+  });
+  return { promise, resolve };
+}
+
+function nativeStream(abort: () => void): AsyncIterable<never> & {
+  readonly controller: { abort(): void };
+} {
+  return {
+    controller: { abort },
+    [Symbol.asyncIterator]: () => ({
+      next: () => new Promise<IteratorResult<never>>(() => {}),
+    }),
+  };
+}
+
+function cancel(stream: StreamedMessage): void {
+  stream.cancel?.();
+}
+
+describe('built-in provider stream cancellation', () => {
+  it('aborts the Kimi SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new KimiChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ chat: { completions: { create } } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the OpenAI chat SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new OpenAILegacyChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ chat: { completions: { create } } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the OpenAI responses SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new OpenAIResponsesChatProvider({
+      model: 'test-model',
+      clientFactory: () => ({ responses: { create } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the Anthropic SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new AnthropicChatProvider({
+      model: 'test-model',
+      stream: true,
+      defaultMaxTokens: 1024,
+      clientFactory: () => ({ messages: { create } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the Google SDK request signal when a returned stream is cancelled', async () => {
+    let transportSignal: AbortSignal | undefined;
+    const generateContentStream = vi.fn((params: Record<string, unknown>) => {
+      transportSignal = (params['config'] as Record<string, unknown>)['abortSignal'] as AbortSignal;
+      return Promise.resolve(nativeStream(() => {}));
+    });
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(transportSignal?.aborted).toBe(true);
+  });
+
+  it('aborts the Google SDK request signal when the caller signal aborts', async () => {
+    let transportSignal: AbortSignal | undefined;
+    const generateContentStream = vi.fn((params: Record<string, unknown>) => {
+      transportSignal = (params['config'] as Record<string, unknown>)['abortSignal'] as AbortSignal;
+      return Promise.resolve(nativeStream(() => {}));
+    });
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    });
+    const controller = new AbortController();
+    const stream = await provider.generate('', [], HISTORY, { signal: controller.signal });
+
+    controller.abort();
+
+    expect(transportSignal?.aborted).toBe(true);
+    cancel(stream);
+  });
+
+  it('includes the configured signal when a per-request Google signal is also present', async () => {
+    let transportSignal: AbortSignal | undefined;
+    const generateContentStream = vi.fn((params: Record<string, unknown>) => {
+      transportSignal = (params['config'] as Record<string, unknown>)['abortSignal'] as AbortSignal;
+      return Promise.resolve(nativeStream(() => {}));
+    });
+    const configuredController = new AbortController();
+    const requestController = new AbortController();
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    }).withGenerationKwargs({ abortSignal: configuredController.signal });
+    const stream = await provider.generate('', [], HISTORY, { signal: requestController.signal });
+
+    configuredController.abort();
+
+    expect(transportSignal?.aborted).toBe(true);
+    expect(requestController.signal.aborted).toBe(false);
+    cancel(stream);
+  });
+
+  it('cancels a Google native stream that resolves after generate cancellation', async () => {
+    const request = deferred<ReturnType<typeof nativeStream>>();
+    const transportCancelled = deferred<void>();
+    const abort = vi.fn(() => {
+      transportCancelled.resolve(undefined);
+    });
+    const generateContentStream = vi.fn(() => request.promise);
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    });
+    const controller = new AbortController();
+    const result = generate(provider, '', [], HISTORY, undefined, { signal: controller.signal });
+
+    controller.abort();
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+    request.resolve(nativeStream(abort));
+    await transportCancelled.promise;
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+});
diff --git a/packages/agent-core-v2/test/app/messageLegacy/messageLegacy.test.ts b/packages/agent-core-v2/test/app/messageLegacy/messageLegacy.test.ts
index b7b576cdc3..aecb4d5466 100644
--- a/packages/agent-core-v2/test/app/messageLegacy/messageLegacy.test.ts
+++ b/packages/agent-core-v2/test/app/messageLegacy/messageLegacy.test.ts
@@ -1,3 +1,9 @@
+/**
+ * Legacy message-list projection contracts over reduced wire transcripts.
+ * Uses in-memory scope/service boundaries and verifies pagination and filtering.
+ * Run: pnpm --dir packages/agent-core-v2 exec vitest run test/app/messageLegacy/messageLegacy.test.ts
+ */
+
 import { describe, expect, it } from 'vitest';
 
 import { toDisposable } from '#/_base/di/lifecycle';
@@ -21,6 +27,13 @@ function textMessage(role: ContextMessage['role'], text: string): ContextMessage
   return { role, content: [{ type: 'text', text }], toolCalls: [] };
 }
 
+function turnOutcomeMessage(text: string): ContextMessage {
+  return {
+    ...textMessage('user', text),
+    origin: { kind: 'injection', variant: 'turn_outcome' },
+  };
+}
+
 function buildService(opts: {
   readonly summary: SessionSummary;
   readonly records: readonly Record<string, unknown>[];
@@ -124,6 +137,22 @@ describe('MessageLegacyService', () => {
     expect(page.has_more).toBe(false);
   });
 
+  it('omits a stale turn outcome reminder after its user prompt is undone', async () => {
+    const svc = buildService({
+      summary,
+      records: [
+        { type: 'context.append_message', message: textMessage('user', 'message A') },
+        { type: 'context.append_message', message: turnOutcomeMessage('outcome A') },
+        { type: 'context.undo', count: 1 },
+      ],
+      contextMessages: [],
+    });
+
+    const page = await svc.list('s1', {});
+
+    expect(page.items).toEqual([]);
+  });
+
   it('throws session.not_found for an unknown session id', async () => {
     const svc = buildService({ summary, records: [], contextMessages: [] });
     await expect(svc.list('missing', {})).rejects.toMatchObject({ code: 'session.not_found' });
diff --git a/packages/agent-core-v2/test/app/telemetry/telemetryService.test.ts b/packages/agent-core-v2/test/app/telemetry/telemetryService.test.ts
index df4d86e368..13685e8c33 100644
--- a/packages/agent-core-v2/test/app/telemetry/telemetryService.test.ts
+++ b/packages/agent-core-v2/test/app/telemetry/telemetryService.test.ts
@@ -174,6 +174,55 @@ describe('TelemetryService (error isolation)', () => {
     expect(good.events).toEqual([{ event: 'evt', properties: {} }]);
   });
 
+  it('a throwing withContext appender does not prevent creating a usable child', () => {
+    const bad: ITelemetryAppender = {
+      track() {},
+      withContext() {
+        throw new Error('context fork failed');
+      },
+    };
+    const good = new CapturingAppender();
+    const svc = telemetryWithAppenders(bad, good);
+
+    let child!: ReturnType<TelemetryService['withContext']>;
+    expect(() => {
+      child = svc.withContext({ turnId: 't1' });
+    }).not.toThrow();
+    child.track('turn.started');
+
+    expect(good.events).toEqual([
+      { event: 'turn.started', properties: { turnId: 't1' } },
+    ]);
+  });
+
+  it('a throwing setContext appender does not prevent later appenders or local context', () => {
+    const bad: ITelemetryAppender = {
+      track() {},
+      setContext() {
+        throw new Error('context update failed');
+      },
+    };
+    let observedPatch: TelemetryProperties | undefined;
+    const goodEvents: { event: string; properties?: TelemetryProperties }[] = [];
+    const good: ITelemetryAppender = {
+      track(event, properties) {
+        goodEvents.push({ event, properties });
+      },
+      setContext(patch) {
+        observedPatch = patch;
+      },
+    };
+    const svc = telemetryWithAppenders(bad, good);
+
+    expect(() => svc.setContext({ sessionId: 's1' })).not.toThrow();
+    svc.track('session.updated');
+
+    expect(observedPatch).toEqual({ sessionId: 's1' });
+    expect(goodEvents).toEqual([
+      { event: 'session.updated', properties: { sessionId: 's1' } },
+    ]);
+  });
+
   it('flush tolerates a rejecting appender and still flushes the rest', async () => {
     const bad: ITelemetryAppender = {
       track() {},
diff --git a/packages/agent-core-v2/test/index.test.ts b/packages/agent-core-v2/test/index.test.ts
index c7e0a11db2..b3cfa88de7 100644
--- a/packages/agent-core-v2/test/index.test.ts
+++ b/packages/agent-core-v2/test/index.test.ts
@@ -34,6 +34,7 @@ const V1_RECORD_TYPES: ReadonlySet<string> = new Set([
   'turn.prompt',
   'turn.steer',
   'turn.cancel',
+  'turn.outcome',
   'config.update',
   'permission.set_mode',
   'permission.record_approval_result',
diff --git a/packages/agent-core-v2/test/wire/resume.test.ts b/packages/agent-core-v2/test/wire/resume.test.ts
index 92afce4d32..3cf8c7e9a8 100644
--- a/packages/agent-core-v2/test/wire/resume.test.ts
+++ b/packages/agent-core-v2/test/wire/resume.test.ts
@@ -14,6 +14,8 @@ import { IAgentTaskService } from '#/agent/task/task';
 import { IAgentPlanService } from '#/agent/plan/plan';
 import { IAgentPromptService } from '#/agent/prompt/prompt';
 import { TurnModel } from '#/agent/loop/turnOps';
+import { CompactionModel } from '#/agent/fullCompaction/compactionOps';
+import { IAgentContextInjectorService } from '#/agent/contextInjector/contextInjector';
 import { IWireService } from '#/wire/wire';
 import {
   createAgentTaskPersistence,
@@ -431,6 +433,195 @@ describe('Agent resume', () => {
     ]);
   });
 
+  it('converges a committed compaction crash prefix without cancelling the summary', async () => {
+    const persistence = new RecordingAgentPersistence([
+      resumeConfigRecord(),
+      contextAppendRecord(0, [
+        { role: 'user', text: 'Historical prompt', origin: { kind: 'user' } },
+      ]),
+      { type: 'full_compaction.begin', source: 'manual' },
+      {
+        type: 'context.apply_compaction',
+        summary: 'Durably committed summary.',
+        compactedCount: 1,
+        tokensBefore: 120,
+        tokensAfter: 24,
+      },
+    ] as unknown as WireRecord[]);
+    const ctx = testAgent({ persistence, autoConfigure: false });
+
+    await ctx.restorePersisted();
+    await ctx.get(IWireService).flush();
+
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('idle');
+    expect(ctx.context.get().map(textContent)).toContain('Durably committed summary.');
+    expect(persistence.appended.filter((record) => record.type === 'full_compaction.complete')).toHaveLength(1);
+    expect(persistence.appended.some((record) => record.type === 'full_compaction.cancel')).toBe(false);
+    expect(ctx.allEvents.some((event) => event.event === 'compaction.cancelled')).toBe(false);
+    expect(ctx.allEvents.some((event) => event.event === 'compaction.completed')).toBe(false);
+  });
+
+  it('marks a stranded pre-commit compaction as failed on replay', async () => {
+    const persistence = new RecordingAgentPersistence([
+      resumeConfigRecord(),
+      contextAppendRecord(0, [
+        { role: 'user', text: 'Historical prompt', origin: { kind: 'user' } },
+      ]),
+      { type: 'full_compaction.begin', source: 'manual' },
+    ] as unknown as WireRecord[]);
+    const ctx = testAgent({ persistence, autoConfigure: false });
+
+    await ctx.restorePersisted();
+    await ctx.get(IWireService).flush();
+
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('idle');
+    expect(
+      persistence.appended.filter(
+        (record) =>
+          record.type === 'full_compaction.complete' && record['outcome'] === 'failed',
+      ),
+    ).toHaveLength(1);
+    expect(persistence.appended.some((record) => record.type === 'full_compaction.cancel')).toBe(false);
+    expect(ctx.context.get().map(textContent)).toEqual(['Historical prompt']);
+    expect(ctx.allEvents.some((event) => event.event === 'compaction.cancelled')).toBe(false);
+    expect(ctx.allEvents.some((event) => event.event === 'compaction.completed')).toBe(false);
+  });
+
+  it('retries failed post-commit maintenance before the first resumed model request', async () => {
+    const persistence = new RecordingAgentPersistence([
+      resumeConfigRecord(),
+      contextAppendRecord(0, [
+        { role: 'user', text: 'Historical prompt', origin: { kind: 'user' } },
+      ]),
+      { type: 'full_compaction.begin', source: 'manual' },
+      {
+        type: 'context.apply_compaction',
+        summary: 'Durably committed summary.',
+        compactedCount: 1,
+        tokensBefore: 120,
+        tokensAfter: 24,
+      },
+    ] as unknown as WireRecord[]);
+    const ctx = testAgent({ persistence, autoConfigure: false });
+    const inject = vi
+      .spyOn(ctx.get(IAgentContextInjectorService), 'injectAfterCompaction')
+      .mockRejectedValueOnce(new Error('transient reinjection failure'))
+      .mockResolvedValue(undefined);
+
+    await ctx.restorePersisted();
+    await ctx.get(IWireService).flush();
+
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('committed');
+    expect(persistence.appended.some((record) => record.type === 'full_compaction.complete')).toBe(false);
+
+    ctx.mockNextResponse({ type: 'text', text: 'Continued after recovery.' });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await ctx.untilTurnEnd();
+    await ctx.get(IWireService).flush();
+
+    expect(inject).toHaveBeenCalledTimes(2);
+    expect(ctx.get(IWireService).getModel(CompactionModel).phase).toBe('idle');
+    expect(persistence.appended.filter((record) => record.type === 'full_compaction.complete')).toHaveLength(1);
+    expect(persistence.appended.some((record) => record.type === 'full_compaction.cancel')).toBe(false);
+    expect(persistence.appended.findIndex((record) => record.type === 'full_compaction.complete'))
+      .toBeLessThan(persistence.appended.findIndex((record) => record.type === 'llm.request'));
+    expect(ctx.llmCalls.at(-1)!.history.map(textContent)).toContain(
+      'Durably committed summary.',
+    );
+  });
+
+  it('materializes a cancellation intent once after a crash and before the follow-up prompt', async () => {
+    const outcomeId = 'cancel-outcome-0';
+    const outcomeContent = 'The user interrupted the previous turn before it finished.';
+    const persistence = new RecordingAgentPersistence([
+      resumeConfigRecord(),
+      contextAppendRecord(0, [
+        { role: 'user', text: 'Do the long-running work.', origin: { kind: 'user' } },
+      ]),
+      turnPromptRecord(0, { kind: 'user' }),
+      {
+        type: 'turn.cancel',
+        turnId: 0,
+        outcomeId,
+        outcomeTurnId: 0,
+        outcomeContent,
+      },
+    ] as unknown as WireRecord[]);
+    const ctx = testAgent({ persistence, autoConfigure: false });
+
+    await ctx.restorePersisted();
+    await ctx.get(IWireService).flush();
+
+    expect(ctx.get(IWireService).getModel(TurnModel).pendingOutcomes).toEqual([]);
+    expect(
+      persistence.appended.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record['materializedTurnOutcomeId'] === outcomeId,
+      ),
+    ).toHaveLength(1);
+
+    ctx.mockNextResponse({ type: 'text', text: 'Continued safely.' });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await ctx.untilTurnEnd();
+
+    const followUpHistory = ctx.llmCalls.at(-1)!.history;
+    expect(followUpHistory.filter((message) => textContent(message).includes(outcomeContent))).toHaveLength(1);
+    expect(followUpHistory.map(textContent)).toEqual([
+      'Do the long-running work.',
+      `<system-reminder>\n${outcomeContent}\n</system-reminder>`,
+      'Continue.',
+    ]);
+
+    const replayPersistence = new RecordingAgentPersistence(persistence.records);
+    const replay = testAgent({ persistence: replayPersistence, autoConfigure: false });
+    await replay.restorePersisted();
+    await replay.get(IWireService).flush();
+
+    expect(
+      replayPersistence.appended.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record['materializedTurnOutcomeId'] === outcomeId,
+      ),
+    ).toHaveLength(0);
+    expect(
+      replay.context.get().filter((message) => textContent(message).includes(outcomeContent)),
+    ).toHaveLength(1);
+  });
+
+  it('materializes a failed-turn intent after a crash for the next prompt', async () => {
+    const outcomeId = 'failed-outcome-0';
+    const outcomeContent = 'The previous turn failed with HTTP 500 before producing a response.';
+    const persistence = new RecordingAgentPersistence([
+      resumeConfigRecord(),
+      contextAppendRecord(0, [
+        { role: 'user', text: 'Investigate the failure.', origin: { kind: 'user' } },
+      ]),
+      turnPromptRecord(0, { kind: 'user' }),
+      { type: 'turn.outcome', outcomeId, turnId: 0, content: outcomeContent },
+    ] as unknown as WireRecord[]);
+    const ctx = testAgent({ persistence, autoConfigure: false });
+
+    await ctx.restorePersisted();
+    await ctx.get(IWireService).flush();
+    ctx.mockNextResponse({ type: 'text', text: 'Recovered.' });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await ctx.untilTurnEnd();
+
+    expect(ctx.get(IWireService).getModel(TurnModel).pendingOutcomes).toEqual([]);
+    expect(
+      persistence.records.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record['materializedTurnOutcomeId'] === outcomeId,
+      ),
+    ).toHaveLength(1);
+    expect(
+      ctx.llmCalls.at(-1)!.history.filter((message) => textContent(message).includes(outcomeContent)),
+    ).toHaveLength(1);
+  });
+
 
   it('persists undelivered restored background notifications during resume', async () => {
     const persistence = new RecordingAgentPersistence([
diff --git a/packages/agent-core/src/agent/background/index.ts b/packages/agent-core/src/agent/background/index.ts
index c9cb88fc7b..b85931a920 100644
--- a/packages/agent-core/src/agent/background/index.ts
+++ b/packages/agent-core/src/agent/background/index.ts
@@ -975,6 +975,18 @@ export class BackgroundManager {
     entry: ManagedTask,
     settlement: BackgroundTaskSettlement,
   ): Promise<void> {
+    // Process tasks settle after their streams have drained (up to the
+    // process-task grace boundary), but output.log appends are intentionally
+    // serialized on a separate queue. Drain the writes already queued at
+    // settlement before exposing a terminal status or persisting terminal
+    // metadata. A later chunk from a stream that outlives the drain grace is
+    // outside this snapshot and keeps the existing bounded-late-output
+    // behavior.
+    if (this.persistence !== undefined && entry.outputPersistStarted) {
+      const queuedOutputWrites = entry.outputWriteQueue;
+      await queuedOutputWrites;
+    }
+
     entry.status = settlement.status;
     entry.endedAt = Date.now();
     entry.stopReason =
diff --git a/packages/agent-core/src/agent/compaction/full.ts b/packages/agent-core/src/agent/compaction/full.ts
index b3a17b752f..68c52764ce 100644
--- a/packages/agent-core/src/agent/compaction/full.ts
+++ b/packages/agent-core/src/agent/compaction/full.ts
@@ -18,12 +18,13 @@ import {
   createUserMessage,
   isImageFormatError,
 } from '@moonshot-ai/kosong';
+import { createControlledPromise, type ControlledPromise } from '@antfu/utils';
 
 import type { Agent } from '..';
 import type { GenerateOptionsWithRequestLogFields } from '../llm-request-logger';
-import type { ContextMessage } from '../context/types';
+import type { ContextMessage, TurnInputConsumption } from '../context/types';
 import { stripDynamicToolContext } from '../context/dynamic-tools';
-import { isAbortError } from '../../loop/errors';
+import type { PromptOrigin } from '../context';
 import {
   retryBackoffDelays,
   sleepForRetry,
@@ -42,7 +43,10 @@ import {
 import {
   applyCompletionBudget,
   resolveCompletionBudget,
-} from '../../utils/completion-budget';import { renderPrompt } from '../../utils/render-prompt';
+} from '../../utils/completion-budget';
+import { renderPrompt } from '../../utils/render-prompt';
+import type { AgentReplayRecord } from '../../rpc/resumed';
+import { agentRecordAppendAccepted } from '../records';
 import compactionInstructionTemplate from './compaction-instruction.md?raw';
 import type { CompactionBeginData, CompactionResult } from './types';
 import {
@@ -65,13 +69,77 @@ class CompactionTruncatedError extends Error {
   }
 }
 
+type CompactionPhase = 'running' | 'cancelling' | 'committing' | 'committed';
+
+interface ActiveCompaction {
+  readonly abortController: AbortController;
+  readonly promise: ControlledPromise;
+  blockedByTurn: boolean;
+  phase: CompactionPhase;
+  cancellation?: Promise<void>;
+  committedResult?: CompactionResult;
+  completionRecordWritten: boolean;
+  completionEventEmitted: boolean;
+  postCompactHookTriggered: boolean;
+  released: boolean;
+  postCommit?: Promise<void>;
+}
+
+type CompactionReplayRecord = Extract<AgentReplayRecord, { type: 'compaction' }>;
+
+interface RestoredCompaction {
+  readonly data: Readonly<CompactionBeginData>;
+  readonly replay: CompactionReplayRecord;
+}
+
+interface RestoredCompactionRecovery {
+  readonly active: ActiveCompaction;
+  readonly data: Readonly<CompactionBeginData>;
+  readonly result: CompactionResult;
+  started: boolean;
+}
+
+interface PostCommitOptions {
+  readonly emitCompletionEvent: boolean;
+  readonly triggerPostCompactHook: boolean;
+  readonly deferSystemPromptRefresh: boolean;
+}
+
+const LIVE_POST_COMMIT_OPTIONS: PostCommitOptions = {
+  emitCompletionEvent: true,
+  triggerPostCompactHook: true,
+  deferSystemPromptRefresh: false,
+};
+
+const RECOVERED_POST_COMMIT_OPTIONS: PostCommitOptions = {
+  // A resumed client reconstructs the completed compaction from replay. Emitting
+  // a live completion without a matching live `compaction.started` would render
+  // a second, phantom compaction row in clients.
+  emitCompletionEvent: false,
+  // Hooks are external side effects and cannot be replayed exactly once after a
+  // crash. The durable context/reminder/terminal invariants are recovered; the
+  // observational hook is deliberately not replayed.
+  triggerPostCompactHook: false,
+  // Session profile handles are restored by Session immediately after
+  // Agent.resume(). Retry the refresh at the next request boundary, when that
+  // handle is guaranteed to exist.
+  deferSystemPromptRefresh: true,
+};
+
+const POST_COMMIT_ATTEMPTS = 2;
+
 export class FullCompaction {
   protected compactionCountInTurn = 0;
-  protected compacting: {
-    abortController: AbortController;
-    promise: Promise<void>;
-    blockedByTurn: boolean;
-  } | null = null;
+  protected compacting: ActiveCompaction | null = null;
+  private restoredCompaction: RestoredCompaction | null = null;
+  private restoredCompactionRecovery: RestoredCompactionRecovery | null = null;
+  private restoreRecoverySubscribed = false;
+  private postCompactionInjectionPending = false;
+  private systemPromptRefreshPending = false;
+  private _systemPromptRefreshSnapshot: Readonly<{
+    revision: number;
+    systemPrompt: string | undefined;
+  }> = { revision: 0, systemPrompt: undefined };
   private readonly observedMaxContextTokensByModel = new Map<string, number>();
   // Token count right after the last successful compaction. While no new
   // content has been appended (tokenCountWithPending <= this value), the
@@ -157,10 +225,14 @@ export class FullCompaction {
     }
     if (this.compactionCountInTurn > this.strategy.maxCompactionPerTurn) return;
     if (this.agent.records.restoring) {
-      this.agent.replayBuilder.push({
+      const replay = this.agent.replayBuilder.push({
         type: 'compaction',
         instruction: data.instruction,
       });
+      if (replay?.type === 'compaction') {
+        this.restoredCompaction = { data, replay };
+        this.subscribeRestoreRecovery();
+      }
       return;
     }
     if (this.agent.context.history.length === 0) {
@@ -179,41 +251,139 @@ export class FullCompaction {
         'Cannot compact while a turn is active. Wait for it to finish, then retry.',
       );
     }
-    this.agent.records.logRecord({
-      type: 'full_compaction.begin',
-      ...data,
-    });
-    this.agent.emitEvent({
-      type: 'compaction.started',
-      trigger: data.source,
-      instruction: data.instruction,
-    });
     const abortController = new AbortController();
-    this.compacting = {
+    const promise = createControlledPromise<void>();
+    const reservation: NonNullable<FullCompaction['compacting']> = {
       abortController,
-      promise: this.compactionWorker(abortController.signal, data),
+      promise,
       blockedByTurn: false,
+      phase: 'running',
+      completionRecordWritten: false,
+      completionEventEmitted: false,
+      postCompactHookTriggered: false,
+      released: false,
     };
+    this.compacting = reservation;
+    void promise.catch(() => undefined);
+    try {
+      this.agent.records.logRecord({
+        type: 'full_compaction.begin',
+        ...data,
+      });
+    } catch (error) {
+      if (this.compacting === reservation) this.compacting = null;
+      abortController.abort(error);
+      promise.reject(error);
+      throw error;
+    }
+    if (this.compacting !== reservation || abortController.signal.aborted) {
+      if (this.compacting === reservation) this.compacting = null;
+      promise.resolve();
+      this.agent.turn.onCompactionFinished();
+      return;
+    }
+    try {
+      this.agent.emitEvent({
+        type: 'compaction.started',
+        trigger: data.source,
+        instruction: data.instruction,
+      });
+    } catch (error) {
+      if (this.compacting === reservation) this.compacting = null;
+      abortController.abort(error);
+      promise.reject(error);
+      this.agent.turn.onCompactionFinished();
+      throw error;
+    }
+    if (abortController.signal.aborted) {
+      if (this.compacting === reservation) this.compacting = null;
+      promise.resolve();
+      this.agent.turn.onCompactionFinished();
+      return;
+    }
+    const worker = this.compactionWorker(abortController.signal, data);
+    void worker.then(promise.resolve, promise.reject);
   }
 
-  cancel(): void {
-    this.agent.replayBuilder.patchLast('compaction', {
-      result: 'cancelled',
-    });
-    if (!this.compacting) return;
-    this.agent.records.logRecord({
-      type: 'full_compaction.cancel',
-    });
-    this.compacting.abortController.abort();
-    this.compacting = null;
+  cancel(): Promise<void> {
+    if (this.agent.records.restoring) {
+      this.restoredCompaction = null;
+      this.agent.replayBuilder.patchLast('compaction', { result: 'cancelled' });
+      return Promise.resolve();
+    }
+    const active = this.compacting;
+    if (!active) {
+      this.agent.replayBuilder.patchLast('compaction', { result: 'cancelled' });
+      return Promise.resolve();
+    }
+    // Once context application begins, cancellation would create a half-
+    // committed state by skipping prompt refresh/reinjection. From this point
+    // callers join the terminal barrier without changing the outcome.
+    if (active.phase === 'cancelling') return active.cancellation ?? active.promise;
+    if (active.phase !== 'running') return active.promise;
+    if (active.abortController.signal.aborted) return active.promise;
+    // Publish the cancellation barrier before invoking persistence callbacks:
+    // a synchronous observer may re-enter cancel(), and must join this exact
+    // operation instead of recursively appending cancellation records.
+    const cancellation = createControlledPromise<void>();
+    active.cancellation = cancellation;
+    active.phase = 'cancelling';
+    void cancellation.catch(() => undefined);
+    this.agent.replayBuilder.patchLast('compaction', { result: 'cancelled' });
+    let recordFailed = false;
+    let recordError: unknown;
+    try {
+      this.agent.records.logRecord({
+        type: 'full_compaction.cancel',
+      });
+    } catch (error) {
+      recordFailed = true;
+      recordError = error;
+    }
+    active.abortController.abort();
     this.agent.emitEvent({ type: 'compaction.cancelled' });
+    const barrier = active.promise.then(
+      () => {
+        if (recordFailed) throw recordError;
+      },
+      (error: unknown) => {
+        throw recordFailed ? recordError : error;
+      },
+    );
+    void barrier.then(cancellation.resolve, cancellation.reject);
+    return cancellation;
   }
 
-  markCompleted() {
-    this.agent.records.logRecord({
-      type: 'full_compaction.complete',
+  private cancelInBackground(): void {
+    void this.cancel().catch((error: unknown) => {
+      this.logPostCommitFailure('failed to persist compaction cancellation', error);
     });
-    this.compacting = null;
+  }
+
+  markCompleted(): void {
+    if (this.agent.records.restoring) {
+      this.restoredCompaction = null;
+      return;
+    }
+    this.writeCompletionRecord(this.compacting);
+  }
+
+  private writeCompletionRecord(active: ActiveCompaction | null): void {
+    if (active?.completionRecordWritten === true) return;
+    try {
+      this.agent.records.logRecord({
+        type: 'full_compaction.complete',
+      });
+      if (active !== null) active.completionRecordWritten = true;
+    } catch (error) {
+      // Built-in persistence implementations report which side of the append
+      // boundary failed. Retry only an explicit pre-accept rejection; unknown
+      // third-party semantics stay conservative to avoid two durable terminals.
+      if (active !== null && agentRecordAppendAccepted(error) !== false) {
+        active.completionRecordWritten = true;
+      }
+      throw error;
+    }
   }
 
   private get tokenCountWithPending(): number {
@@ -236,6 +406,19 @@ export class FullCompaction {
     this.consecutiveOverflowCompactions = 0;
   }
 
+  /**
+   * Atomically identifies the prompt text produced by the latest successful
+   * compaction refresh. Keeping the revision and text together prevents an
+   * unrelated config update between compaction and the next step from being
+   * mistaken for the prompt that compaction rendered.
+   */
+  get systemPromptRefreshSnapshot(): Readonly<{
+    revision: number;
+    systemPrompt: string | undefined;
+  }> {
+    return this._systemPromptRefreshSnapshot;
+  }
+
   async handleOverflowError(signal: AbortSignal, error: unknown) {
     this.consecutiveOverflowCompactions += 1;
     const maxAttempts = this.strategy.maxOverflowCompactionAttempts;
@@ -253,6 +436,7 @@ export class FullCompaction {
   }
 
   async beforeStep(signal: AbortSignal): Promise<void> {
+    await this.retryPendingPostCommitMaintenance();
     this.checkAutoCompaction();
     if (this.strategy.shouldBlock(this.tokenCountWithPending)) {
       await this.block(signal);
@@ -303,7 +487,7 @@ export class FullCompaction {
       active.blockedByTurn = true;
       signal.addEventListener('abort', () => {
         if (this.compacting === active) {
-          this.cancel();
+          this.cancelInBackground();
         }
       });
       this.agent.emitEvent({
@@ -318,38 +502,43 @@ export class FullCompaction {
     signal: AbortSignal,
     data: Readonly<CompactionBeginData>,
   ): Promise<void> {
+    const active = this.compacting;
     try {
       const result = await this.compactionRound(signal, data);
       if (!result) return;
-      // Stay "compacting" through reinjection: a follow-up prompt/steer that lands
-      // now is buffered (TurnFlow defers on `isCompacting`) until the
-      // post-compaction reminders are back, so the first post-compaction turn
-      // never builds a request before they are reinjected. Only after reinjection
-      // do we clear the flag, announce completion, and replay deferred input.
-      try {
-        await this.agent.refreshSystemPrompt();
-      } catch (error) {
-        this.agent.log.error('failed to refresh system prompt after compaction', { error });
-      }
-      await this.agent.injection.injectAfterCompaction();
-      // The reinjected reminders (loadable-tools manifest, goal) are part of
-      // the post-compaction floor: every compaction strips and re-appends
-      // them, so a baseline captured before this point would leave them
-      // outside the "nothing new since compaction" guard — with a large
-      // manifest checkAutoCompaction would re-trigger against a shape that
-      // cannot shrink. Raise the guard to the true floor before deferred
-      // input replays (markCompleted), so only genuinely new content counts.
-      this.lastCompactedTokenCount = this.tokenCountWithPending;
-      this.markCompleted();
-      const { contextSummary: _contextSummary, ...eventResult } = result;
-      void _contextSummary;
-      this.agent.emitEvent({ type: 'compaction.completed', result: eventResult });
-      this.triggerPostCompactHook(data, result);
+      if (active === null || this.compacting !== active) return;
+      await this.convergeCommittedCompaction(
+        active,
+        data,
+        result,
+        LIVE_POST_COMMIT_OPTIONS,
+      );
     } catch (error) {
-      if (isAbortError(error)) return;
-      const blockedByTurn = this.compacting?.blockedByTurn === true;
-      this.cancel();
-      this.agent.log.error('compaction failed', { error });
+      // applyCompaction is the commit point. Anything that throws after it must
+      // converge to the one completed terminal; treating it as cancellation is
+      // both false (the context is already replaced) and used to self-wait on
+      // active.promise from inside the worker that owns that promise.
+      if (
+        active !== null &&
+        this.compacting === active &&
+        active.phase === 'committed' &&
+        active.committedResult !== undefined
+      ) {
+        this.logPostCommitFailure('post-commit compaction work failed', error);
+        await this.convergeCommittedCompaction(
+          active,
+          data,
+          active.committedResult,
+          LIVE_POST_COMMIT_OPTIONS,
+        );
+        return;
+      }
+      // AbortError is not proof of cancellation: providers sometimes throw one
+      // on their own. The controller is the source of truth for whether this
+      // particular compaction was actually cancelled.
+      if (signal.aborted) return;
+      const blockedByTurn = active?.blockedByTurn === true;
+      this.logCompactionFailure(error);
       if (blockedByTurn) {
         throw error;
       }
@@ -360,9 +549,365 @@ export class FullCompaction {
     } finally {
       // Replay prompts/steers deferred while compaction held the context — on the
       // success path (after reinjection above), on an A1 prefix/tail cancel
-      // (`!result`), and on failure/abort. `compacting` is null by now in every
-      // path, so the replay's launch actually starts a turn instead of re-buffering.
-      this.agent.turn.onCompactionFinished();
+      // (`!result`), and on failure/abort. A cancelled worker retains its
+      // reservation through asynchronous cleanup; release that exact worker now
+      // so replay cannot overlap it and can actually start instead of re-buffering.
+      if (active !== null) this.releaseCompaction(active);
+    }
+  }
+
+  private subscribeRestoreRecovery(): void {
+    if (this.restoreRecoverySubscribed) return;
+    this.restoreRecoverySubscribed = true;
+    this.agent.records.onOpened(() => {
+      try {
+        this.prepareRestoredCompactionRecovery();
+      } catch (error) {
+        this.logPostCommitFailure('failed to prepare restored compaction recovery', error);
+      }
+    });
+  }
+
+  private prepareRestoredCompactionRecovery(): void {
+    this.scheduleRestoredPostCompactionMaintenance();
+    const restored = this.restoredCompaction;
+    this.restoredCompaction = null;
+    const result = restored?.replay.result;
+    // A begin record without context.apply_compaction is still pre-commit. It
+    // has no state to finalize and, crucially, must not be re-labelled as a
+    // cancellation just because the process exited.
+    if (restored === null || result === undefined || result === 'cancelled') return;
+    if (this.compacting !== null) {
+      this.logPostCommitFailure(
+        'cannot recover committed compaction while another compaction is active',
+        new Error('Compaction reservation collision during restore'),
+      );
+      return;
+    }
+
+    const abortController = new AbortController();
+    const promise = createControlledPromise<void>();
+    const active: ActiveCompaction = {
+      abortController,
+      promise,
+      blockedByTurn: false,
+      phase: 'committed',
+      committedResult: result,
+      completionRecordWritten: false,
+      completionEventEmitted: false,
+      postCompactHookTriggered: false,
+      released: false,
+    };
+    this.compacting = active;
+    void promise.catch(() => undefined);
+    this.restoredCompactionRecovery = {
+      active,
+      data: restored.data,
+      result,
+      started: false,
+    };
+  }
+
+  private scheduleRestoredPostCompactionMaintenance(): void {
+    const hasCompactedContext = this.agent.context.history.some(
+      (message) => message.origin?.kind === 'compaction_summary',
+    );
+    if (!hasCompactedContext) return;
+    // Even a durable `full_compaction.complete` may have been followed by a
+    // process exit before transient refresh/injection maintenance retried at
+    // the next request boundary. These flags are intentionally reconstructed
+    // from the surviving summary on every resume. The retry path deduplicates
+    // reminders that were already durable, so this closes that crash window
+    // without stacking a second copy after ordinary completed compactions.
+    this.systemPromptRefreshPending = true;
+    this.postCompactionInjectionPending = true;
+  }
+
+  /**
+   * Finish a committed compaction discovered during record replay. Agent.resume
+   * calls this only after background/cron/context/turn restore has settled. The
+   * reservation prepared in onOpened keeps TurnFlow from starting restored
+   * deferred work before that point.
+   */
+  async finishResume(): Promise<void> {
+    const recovery = this.restoredCompactionRecovery;
+    if (recovery === null) return;
+    if (!recovery.started) {
+      recovery.started = true;
+      const worker = this.recoveredCompactionWorker(
+        recovery.active,
+        recovery.data,
+        recovery.result,
+      );
+      void worker.then(recovery.active.promise.resolve, recovery.active.promise.reject);
+    }
+    await recovery.active.promise;
+    if (this.restoredCompactionRecovery === recovery) {
+      this.restoredCompactionRecovery = null;
+    }
+  }
+
+  private async recoveredCompactionWorker(
+    active: ActiveCompaction,
+    data: Readonly<CompactionBeginData>,
+    result: CompactionResult,
+  ): Promise<void> {
+    try {
+      await this.convergeCommittedCompaction(
+        active,
+        data,
+        result,
+        RECOVERED_POST_COMMIT_OPTIONS,
+      );
+    } catch (error) {
+      // convergeCommittedCompaction isolates every stage, but keep the recovery
+      // worker fail-open so an unexpected diagnostic failure cannot strand the
+      // restored agent in `isCompacting` forever.
+      this.logPostCommitFailure('restored compaction convergence failed', error);
+      await this.ensureCompletionRecord(active);
+    } finally {
+      this.releaseCompaction(active);
+    }
+  }
+
+  private convergeCommittedCompaction(
+    active: ActiveCompaction,
+    data: Readonly<CompactionBeginData>,
+    result: CompactionResult,
+    options: PostCommitOptions,
+  ): Promise<void> {
+    if (active.postCommit !== undefined) return active.postCommit;
+    // Defer the body by one microtask so the joinable promise is published
+    // before any synchronous persistence callback can re-enter cancellation.
+    const postCommit = Promise.resolve().then(async () => {
+      if (options.deferSystemPromptRefresh) {
+        this.systemPromptRefreshPending = true;
+      } else {
+        await this.refreshSystemPromptAfterCompaction();
+      }
+      await this.injectAfterCompactionWithRetry();
+      this.capturePostCompactionTokenFloor();
+      await this.ensureCompletionRecord(active);
+      this.emitCompletionOnce(active, result, options.emitCompletionEvent);
+      if (options.triggerPostCompactHook) {
+        this.triggerPostCompactHookOnce(active, data, result);
+      }
+      // Keep the reservation through synchronous completion observers, then
+      // release and replay deferred work before those observers' promises
+      // resume on the next microtask.
+      this.releaseCompaction(active);
+    });
+    active.postCommit = postCommit;
+    return postCommit;
+  }
+
+  private async retryPendingPostCommitMaintenance(): Promise<void> {
+    if (this.systemPromptRefreshPending) {
+      await this.refreshSystemPromptAfterCompaction();
+    }
+    if (this.postCompactionInjectionPending) {
+      await this.injectAfterCompactionWithRetry();
+      this.capturePostCompactionTokenFloor();
+    }
+  }
+
+  private async refreshSystemPromptAfterCompaction(): Promise<void> {
+    this.systemPromptRefreshPending = true;
+    for (let attempt = 1; attempt <= POST_COMMIT_ATTEMPTS; attempt += 1) {
+      try {
+        const systemPrompt = await this.agent.refreshSystemPrompt();
+        if (systemPrompt !== undefined) {
+          this._systemPromptRefreshSnapshot = {
+            revision: this._systemPromptRefreshSnapshot.revision + 1,
+            systemPrompt,
+          };
+        }
+        this.systemPromptRefreshPending = false;
+        return;
+      } catch (error) {
+        this.logPostCommitFailure(
+          `failed to refresh system prompt after compaction (attempt ${String(attempt)})`,
+          error,
+        );
+      }
+    }
+  }
+
+  private async injectAfterCompactionWithRetry(): Promise<void> {
+    this.postCompactionInjectionPending = true;
+    for (let attempt = 1; attempt <= POST_COMMIT_ATTEMPTS; attempt += 1) {
+      try {
+        await this.injectAfterCompactionIdempotently();
+        this.postCompactionInjectionPending = false;
+        return;
+      } catch (error) {
+        this.logPostCommitFailure(
+          `failed to inject post-compaction reminders (attempt ${String(attempt)})`,
+          error,
+        );
+        // DynamicInjector advances its cursor before appendSystemReminder. If
+        // persistence throws before accepting that append, the cursor would
+        // otherwise make the retry look successful while permanently skipping
+        // the missing reminder. Reset lifecycle cursors; exact durable reminders
+        // are still consumed by injectAfterCompactionIdempotently on the retry.
+        this.agent.injection.onContextCompacted();
+      }
+    }
+  }
+
+  /**
+   * Re-running InjectionManager after a crash is necessary, but doing so
+   * blindly duplicates any reminder records that made it to disk before the
+   * crash. Interpose only on the manager's append boundary and consume exact
+   * origin+content matches already present after the latest summary. Missing
+   * reminders still use ContextMemory's normal append path, so persistence,
+   * replay and injector bookkeeping stay aligned.
+   */
+  private async injectAfterCompactionIdempotently(): Promise<void> {
+    const context = this.agent.context;
+    const existing = this.postCompactionReminderCounts();
+    // Kept unbound so the exact original property can be restored in finally;
+    // calls below always provide ContextMemory explicitly.
+    // oxlint-disable-next-line typescript-eslint/unbound-method
+    const original = context.appendSystemReminder;
+    const wrapper = (
+      content: string,
+      origin: PromptOrigin,
+      consumedTurnInput?: TurnInputConsumption,
+      materializedTurnOutcomeId?: string,
+    ): void => {
+      const signature = systemReminderSignature(content, origin);
+      const remaining = existing.get(signature) ?? 0;
+      if (remaining > 0) {
+        existing.set(signature, remaining - 1);
+        return;
+      }
+      original.call(
+        context,
+        content,
+        origin,
+        consumedTurnInput,
+        materializedTurnOutcomeId,
+      );
+    };
+    const mutableContext = context as unknown as {
+      appendSystemReminder(
+        content: string,
+        origin: PromptOrigin,
+        consumedTurnInput?: TurnInputConsumption,
+        materializedTurnOutcomeId?: string,
+      ): void;
+    };
+    mutableContext.appendSystemReminder = wrapper;
+    try {
+      await this.agent.injection.injectAfterCompaction();
+    } finally {
+      // Restore only our own interposition. If a test/host deliberately replaced
+      // the method while injection awaited, do not overwrite that newer owner.
+      if (mutableContext.appendSystemReminder === wrapper) {
+        mutableContext.appendSystemReminder = original;
+      }
+    }
+  }
+
+  private postCompactionReminderCounts(): Map<string, number> {
+    const history = this.agent.context.history;
+    const summaryIndex = history.findLastIndex(
+      (message) => message.origin?.kind === 'compaction_summary',
+    );
+    const counts = new Map<string, number>();
+    for (const message of history.slice(summaryIndex + 1)) {
+      const origin = message.origin;
+      if (origin === undefined || message.role !== 'user') continue;
+      if (message.content.length !== 1 || message.content[0]?.type !== 'text') continue;
+      const content = unwrapSystemReminder(message.content[0].text);
+      if (content === undefined) continue;
+      const signature = systemReminderSignature(content, origin);
+      counts.set(signature, (counts.get(signature) ?? 0) + 1);
+    }
+    return counts;
+  }
+
+  private capturePostCompactionTokenFloor(): void {
+    try {
+      // Reinjected reminders are part of the minimal post-compaction floor. A
+      // lower baseline can immediately re-trigger a compaction that cannot make
+      // the context any smaller.
+      this.lastCompactedTokenCount = this.tokenCountWithPending;
+    } catch (error) {
+      this.logPostCommitFailure('failed to capture post-compaction token floor', error);
+    }
+  }
+
+  private async ensureCompletionRecord(active: ActiveCompaction): Promise<void> {
+    try {
+      // Preserve the synchronous production path so persistence observers see
+      // the reservation released in the same stack, while still accepting an
+      // async fault-injected replacement in tests/hosts.
+      const completion = (this.markCompleted as () => unknown)();
+      if (isPromiseLike(completion)) await completion;
+      return;
+    } catch (error) {
+      this.logPostCommitFailure('failed to mark compaction completed', error);
+    }
+    // A spy may throw before entering markCompleted. Bypass that replaceable
+    // surface once; the per-reservation write guard still guarantees one record
+    // when the first call accepted the record and then threw.
+    if (!active.completionRecordWritten) {
+      try {
+        this.writeCompletionRecord(active);
+      } catch (error) {
+        this.logPostCommitFailure('failed to persist compaction completion fallback', error);
+      }
+    }
+  }
+
+  private emitCompletionOnce(
+    active: ActiveCompaction,
+    result: CompactionResult,
+    enabled: boolean,
+  ): void {
+    if (!enabled || active.completionEventEmitted) return;
+    active.completionEventEmitted = true;
+    const { contextSummary: _contextSummary, ...eventResult } = result;
+    void _contextSummary;
+    this.agent.emitEvent({ type: 'compaction.completed', result: eventResult });
+  }
+
+  private triggerPostCompactHookOnce(
+    active: ActiveCompaction,
+    data: Readonly<CompactionBeginData>,
+    result: CompactionResult,
+  ): void {
+    if (active.postCompactHookTriggered) return;
+    active.postCompactHookTriggered = true;
+    try {
+      this.triggerPostCompactHook(data, result);
+    } catch (error) {
+      this.logPostCommitFailure('failed to trigger post-compaction hook', error);
+    }
+  }
+
+  private releaseCompaction(active: ActiveCompaction): void {
+    if (active.released) return;
+    active.released = true;
+    if (this.compacting === active) this.compacting = null;
+    this.agent.turn.onCompactionFinished();
+  }
+
+  private logCompactionFailure(error: unknown): void {
+    try {
+      this.agent.log.error('compaction failed', { error });
+    } catch {
+      // Diagnostics must not alter the compaction terminal state.
+    }
+  }
+
+  private logPostCommitFailure(message: string, error: unknown): void {
+    try {
+      this.agent.log.error(message, { error });
+    } catch {
+      // Diagnostics must not alter the compaction terminal state.
     }
   }
 
@@ -544,6 +1089,11 @@ export class FullCompaction {
         }
       }
 
+      // A provider may ignore AbortSignal and resolve after cancellation. Do
+      // not record its usage or let its stale summary rebuild context while a
+      // concurrently arriving prompt is waiting behind the cancellation
+      // reservation.
+      signal.throwIfAborted();
       if (usage !== null) {
         this.agent.usage.record(model, usage);
       }
@@ -552,7 +1102,7 @@ export class FullCompaction {
       for (let i = 0; i < originalHistory.length; i++) {
         if (newHistory[i] !== originalHistory[i]) {
           // The compacted prefix changed under us (e.g. undo). Bail.
-          this.cancel();
+          this.cancelInBackground();
           return undefined;
         }
       }
@@ -565,19 +1115,33 @@ export class FullCompaction {
       // covers originalHistory) nor kept, so it would silently vanish. Cancel and
       // let a later clean-boundary compaction handle it.
       if (newHistory.slice(originalHistory.length).some((message) => !isRealUserInput(message))) {
-        this.cancel();
+        this.cancelInBackground();
         return undefined;
       }
 
       const rawSummary = this.postProcessSummary(summary ?? '');
       const contextSummary = buildCompactionSummaryText(rawSummary);
-      const result = this.agent.context.applyCompaction({
-        summary: rawSummary,
-        contextSummary,
-        compactedCount: originalHistory.length,
-        tokensBefore,
-        droppedCount: droppedCount === 0 ? undefined : droppedCount,
-      });
+      signal.throwIfAborted();
+      const active = this.compacting;
+      if (!active || active.abortController.signal !== signal) return undefined;
+      active.phase = 'committing';
+      let result: CompactionResult;
+      try {
+        result = this.agent.context.applyCompaction({
+          summary: rawSummary,
+          contextSummary,
+          compactedCount: originalHistory.length,
+          tokensBefore,
+          droppedCount: droppedCount === 0 ? undefined : droppedCount,
+        });
+      } catch (error) {
+        if (this.compacting === active) active.phase = 'running';
+        throw error;
+      }
+      if (this.compacting === active) {
+        active.committedResult = result;
+        active.phase = 'committed';
+      }
       // Loaded dynamic tool schemas are deliberately NOT rebuilt: compaction
       // discards the loaded set entirely (the boundary announcement re-lists
       // every loadable name, and the model re-selects what it still needs).
@@ -591,20 +1155,26 @@ export class FullCompaction {
       // record written below keeps its persisted camelCase field names
       // (consumed by external projectors). The two channels intentionally
       // diverge — don't rename the record side to match.
-      this.agent.telemetry.track('compaction_finished', {
-        source: data.source,
-        tokens_before: result.tokensBefore,
-        tokens_after: result.tokensAfter,
-        duration_ms: Date.now() - startedAt,
-        compacted_count: result.compactedCount,
-        dropped_count: result.droppedCount,
-        retry_count: retryCount,
-        round: 1,
-        thinking_effort: this.agent.config.thinkingEffort,
-        ...(usage === null
-          ? {}
-          : { input_tokens: inputTotal(usage), output_tokens: usage.output }),
-      });
+      try {
+        this.agent.telemetry.track('compaction_finished', {
+          source: data.source,
+          tokens_before: result.tokensBefore,
+          tokens_after: result.tokensAfter,
+          duration_ms: Date.now() - startedAt,
+          compacted_count: result.compactedCount,
+          dropped_count: result.droppedCount,
+          retry_count: retryCount,
+          round: 1,
+          thinking_effort: this.agent.config.thinkingEffort,
+          ...(usage === null
+            ? {}
+            : { input_tokens: inputTotal(usage), output_tokens: usage.output }),
+        });
+      } catch (error) {
+        // Telemetry is observational. Once context application committed, a
+        // broken sink must not divert the state machine away from completion.
+        this.logPostCommitFailure('failed to record compaction telemetry', error);
+      }
       // Baseline the "nothing new since compaction" guard on the live counter
       // (== result.tokensAfter here, since nothing has been appended since
       // applyCompaction). compactionWorker raises it once more after
@@ -613,7 +1183,13 @@ export class FullCompaction {
       this.lastCompactedTokenCount = this.tokenCountWithPending;
       return result;
     } catch (error) {
-      if (isAbortError(error)) return undefined;
+      if (
+        this.compacting?.phase === 'committed' &&
+        this.compacting.committedResult !== undefined
+      ) {
+        throw error;
+      }
+      if (signal.aborted) return undefined;
       this.agent.telemetry.track('compaction_failed', {
         source: data.source,
         tokens_before: tokensBefore,
@@ -664,6 +1240,29 @@ export class FullCompaction {
   }
 }
 
+function systemReminderSignature(content: string, origin: PromptOrigin): string {
+  return JSON.stringify([
+    origin,
+    `<system-reminder>\n${content.trim()}\n</system-reminder>`,
+  ]);
+}
+
+function unwrapSystemReminder(text: string): string | undefined {
+  const prefix = '<system-reminder>\n';
+  const suffix = '\n</system-reminder>';
+  if (!text.startsWith(prefix) || !text.endsWith(suffix)) return undefined;
+  return text.slice(prefix.length, -suffix.length);
+}
+
+function isPromiseLike(value: unknown): value is PromiseLike<unknown> {
+  return (
+    (typeof value === 'object' || typeof value === 'function') &&
+    value !== null &&
+    'then' in value &&
+    typeof value.then === 'function'
+  );
+}
+
 const MAX_COMPACTION_OVERFLOW_SHRINK_ATTEMPTS = 3;
 const COMPACTION_OVERFLOW_SHRINK_RATIOS = [0.7, 0.5, 0.35] as const;
 
diff --git a/packages/agent-core/src/agent/compaction/handoff.ts b/packages/agent-core/src/agent/compaction/handoff.ts
index 540da9b27e..72455a770b 100644
--- a/packages/agent-core/src/agent/compaction/handoff.ts
+++ b/packages/agent-core/src/agent/compaction/handoff.ts
@@ -100,18 +100,48 @@ export function isCompactionSummaryMessage(message: MessageLike): boolean {
   return message.origin?.kind === 'compaction_summary';
 }
 
+function isTurnOutcomeReminder(message: MessageLike): boolean {
+  return (
+    message.role === 'user' &&
+    message.origin?.kind === 'injection' &&
+    message.origin.variant === 'turn_outcome'
+  );
+}
+
 /**
- * Keep only genuine user input (real user prompts and user-slash skill
- * activations). See `compactionUserMessageDisposition` for the full keep/drop
- * policy and the rationale for each origin.
+ * Keep genuine user input plus the latest abnormal-turn reminder that has not
+ * yet been followed by an assistant message. See
+ * `compactionUserMessageDisposition` for the baseline keep/drop policy.
  */
 export function isRealUserInput(message: MessageLike): boolean {
   return message.role === 'user' && compactionUserMessageDisposition(message.origin) === 'keep';
 }
 
 export function collectCompactableUserMessages<T extends MessageLike>(messages: readonly T[]): T[] {
+  let latestAssistantIndex = -1;
+  let latestTurnOutcomeIndex = -1;
+  for (const [index, message] of messages.entries()) {
+    // Only a provider-produced assistant message proves that a model request
+    // crossed this point. A hook block also uses role=assistant, but no request
+    // was sent and therefore must not retire an unseen outcome reminder.
+    if (message.role === 'assistant' && message.origin === undefined) {
+      latestAssistantIndex = index;
+    }
+    if (isTurnOutcomeReminder(message)) {
+      latestTurnOutcomeIndex = index;
+    }
+  }
+  // An abnormal-turn reminder is pending model input until a later assistant
+  // message proves that the model has seen it. Preserve only that latest unseen
+  // reminder across compaction; older/stale outcomes and all other injections
+  // remain ephemeral. Keep this separate from isRealUserInput so undo still
+  // counts only genuine user prompts.
+  const unseenTurnOutcomeIndex =
+    latestTurnOutcomeIndex > latestAssistantIndex ? latestTurnOutcomeIndex : -1;
   return messages.filter(
-    (message) => isRealUserInput(message) && !isCompactionSummaryMessage(message),
+    (message, index) =>
+      (isRealUserInput(message) && !isCompactionSummaryMessage(message)) ||
+      index === unseenTurnOutcomeIndex,
   );
 }
 
@@ -259,6 +289,11 @@ export function selectCompactionUserMessages<T extends MessageLike>(
   maxTokens: number = COMPACT_USER_MESSAGE_MAX_TOKENS,
   headTokens: number = COMPACT_USER_MESSAGE_HEAD_TOKENS,
 ): CompactionUserSelection<T> {
+  // `collectCompactableUserMessages` contributes at most one unseen outcome.
+  // Treat it as a protected control message: a giant follow-up prompt must not
+  // consume the entire tail budget and silently elide the interruption/error
+  // context that gives that follow-up its meaning.
+  const protectedOutcome = messages.findLast(isTurnOutcomeReminder);
   let totalTokens = 0;
   for (const message of messages) {
     totalTokens += estimateTokensForMessage(message);
@@ -319,6 +354,25 @@ export function selectCompactionUserMessages<T extends MessageLike>(
     break;
   }
 
+  if (
+    protectedOutcome !== undefined &&
+    !head.includes(protectedOutcome) &&
+    !tail.includes(protectedOutcome)
+  ) {
+    // A boundary truncation retains origin metadata, so first remove any
+    // partial clone of the outcome. Keep the full reminder outside the regular
+    // budget: it is bounded diagnostic control text, not arbitrary user data.
+    const truncatedInHead = head.some(isTurnOutcomeReminder);
+    for (let i = head.length - 1; i >= 0; i--) {
+      if (isTurnOutcomeReminder(head[i]!)) head.splice(i, 1);
+    }
+    for (let i = tail.length - 1; i >= 0; i--) {
+      if (isTurnOutcomeReminder(tail[i]!)) tail.splice(i, 1);
+    }
+    if (truncatedInHead) head.push(protectedOutcome);
+    else tail.unshift(protectedOutcome);
+  }
+
   let keptTokens = 0;
   for (const message of head) keptTokens += estimateTokensForMessage(message);
   for (const message of tail) keptTokens += estimateTokensForMessage(message);
diff --git a/packages/agent-core/src/agent/context/index.ts b/packages/agent-core/src/agent/context/index.ts
index 798fc6e32a..a4f7e49048 100644
--- a/packages/agent-core/src/agent/context/index.ts
+++ b/packages/agent-core/src/agent/context/index.ts
@@ -17,6 +17,10 @@ import {
   type CompactionInput,
   type CompactionResult,
 } from '../compaction';
+import { agentRecordAppendAccepted } from '../records/append-error';
+import type { AgentRecord } from '../records/types';
+import { TURN_OUTCOME_REMINDER_VARIANT } from '../turn/outcome-reminder';
+import { stripDynamicToolContext } from './dynamic-tools';
 import {
   captureMediaStripSnapshot,
   degradeOlderMediaParts,
@@ -27,12 +31,12 @@ import {
   type ProjectOptions,
   trimTrailingOpenToolExchange,
 } from './projector';
-import { stripDynamicToolContext } from './dynamic-tools';
 import {
   USER_PROMPT_ORIGIN,
   type AgentContextData,
   type ContextMessage,
   type PromptOrigin,
+  type TurnInputConsumption,
 } from './types';
 
 export * from './types';
@@ -52,6 +56,13 @@ export class ContextMemory {
   private openSteps: Map<string, ContextMessage> = new Map();
   private pendingToolResultIds = new Set<string>();
   private deferredMessages: ContextMessage[] = [];
+  private readonly committedTurnInputParts = new Map<string, Set<number>>();
+  private readonly committedTurnInputPartMessages = new Map<string, Map<number, ContextMessage>>();
+  private readonly inFlightTurnInputParts = new Map<string, { final: boolean }>();
+  private readonly consumedTurnInputs = new Set<string>();
+  private readonly cancelledTurnInputs = new Set<string>();
+  private readonly materializedTurnOutcomeIds = new Set<string>();
+  private contextMutationPersistenceDepth = 0;
   private _lastAssistantAt: number | null = null;
   // Signature of the last logged set of projection repairs, so a repair that
   // recurs identically on every send is logged once rather than per step.
@@ -59,6 +70,47 @@ export class ContextMemory {
 
   constructor(protected readonly agent: Agent) {}
 
+  private assertNotPersistingContextMutation(): void {
+    if (this.contextMutationPersistenceDepth > 0) {
+      throw new KimiError(
+        ErrorCodes.SESSION_STATE_INVALID,
+        'Cannot mutate context re-entrantly from record persistence',
+      );
+    }
+  }
+
+  private persistContextMutation(record: AgentRecord): unknown {
+    this.assertNotPersistingContextMutation();
+    this.contextMutationPersistenceDepth++;
+    try {
+      this.agent.records.logRecord(record);
+      return undefined;
+    } catch (error) {
+      if (agentRecordAppendAccepted(error) === true) return error;
+      throw error;
+    } finally {
+      this.contextMutationPersistenceDepth--;
+    }
+  }
+
+  private reportAcceptedContextObserverError(error: unknown, operation: string): void {
+    if (error === undefined) return;
+    this.reportContextWarning('context record committed with observer failure', {
+      error,
+      operation,
+    });
+  }
+
+  private reportContextWarning(message: string, payload: unknown): void {
+    try {
+      this.agent.log.warn(message, payload);
+    } catch {
+      // The context mutation is already durable and applied locally. Logging
+      // is best-effort here: surfacing a diagnostic sink failure would invite
+      // the caller to retry an accepted record. Do not recurse into logging.
+    }
+  }
+
   get lastAssistantAt(): number | null {
     return this._lastAssistantAt;
   }
@@ -66,8 +118,12 @@ export class ContextMemory {
   appendUserMessage(
     content: readonly ContentPart[],
     origin: PromptOrigin = USER_PROMPT_ORIGIN,
+    consumedTurnInput?: TurnInputConsumption,
   ): void {
-    if (content.length === 0) return;
+    if (content.length === 0) {
+      if (consumedTurnInput !== undefined) this.consumeEmptyTurnInput(consumedTurnInput);
+      return;
+    }
     // Prompt ingestion (server upload/base64 route, TUI paste, ACP) annotates
     // a compressed image with an inline `<system>` caption next to the image.
     // Left inside the user message, that raw markup is user-visible in every
@@ -78,26 +134,57 @@ export class ContextMemory {
       origin.kind === 'user'
         ? splitImageCompressionCaptions(content)
         : { captions: [], parts: [...content] };
-    for (const caption of captions) {
-      this.appendSystemReminder(caption, { kind: 'injection', variant: 'image_compression' });
+    const messages: ContextMessage[] = captions.map((caption) =>
+      this.buildSystemReminderMessage(caption, { kind: 'injection', variant: 'image_compression' }),
+    );
+    if (parts.length > 0) {
+      messages.push({
+        role: 'user',
+        content: parts,
+        toolCalls: [],
+        origin,
+      });
+    }
+    if (messages.length === 0) {
+      if (consumedTurnInput !== undefined) this.consumeEmptyTurnInput(consumedTurnInput);
+      return;
+    }
+    for (const [index, message] of messages.entries()) {
+      const turnInputPart =
+        consumedTurnInput !== undefined && messages.length > 1
+          ? { consumedTurnInput, index }
+          : undefined;
+      if (turnInputPart !== undefined && this.hasCommittedTurnInputPart(turnInputPart)) continue;
+      this.appendMessage(
+        message,
+        index === messages.length - 1 ? consumedTurnInput : undefined,
+        turnInputPart,
+      );
     }
-    if (parts.length === 0) return;
-    this.appendMessage({
-      role: 'user',
-      content: parts,
-      toolCalls: [],
-      origin,
-    });
   }
 
-  appendSystemReminder(content: string, origin: PromptOrigin): void {
+  appendSystemReminder(
+    content: string,
+    origin: PromptOrigin,
+    consumedTurnInput?: TurnInputConsumption,
+    materializedTurnOutcomeId?: string,
+  ): void {
+    this.appendMessage(
+      this.buildSystemReminderMessage(content, origin),
+      consumedTurnInput,
+      undefined,
+      materializedTurnOutcomeId,
+    );
+  }
+
+  private buildSystemReminderMessage(content: string, origin: PromptOrigin): ContextMessage {
     const text = `<system-reminder>\n${content.trim()}\n</system-reminder>`;
-    this.appendMessage({
+    return {
       role: 'user',
       content: [{ type: 'text', text }],
       toolCalls: [],
       origin,
-    });
+    };
   }
 
   /**
@@ -153,6 +240,12 @@ export class ContextMemory {
   }
 
   popMatchedMessage(matcher: (origin: PromptOrigin | undefined) => boolean): boolean {
+    // Unlike record-backed mutations, this projection cleanup has no durable
+    // event of its own. Letting it run inside an outer context append observer
+    // would reverse live/replay order, so reject before inspecting or changing
+    // either history buffer. Turn-cancellation convergence intentionally uses
+    // cancelTurnInputExpansions instead and remains available in this window.
+    this.assertNotPersistingContextMutation();
     const lastDeferred = this.deferredMessages.at(-1);
     const last = lastDeferred ?? this._history.at(-1);
     if (last === undefined) return false;
@@ -165,26 +258,73 @@ export class ContextMemory {
     return true;
   }
 
+  /**
+   * Tombstone incomplete child records belonging to a cancelled prompt/steer.
+   * A completed expansion has already cleared its child map and is retained;
+   * only orphan captions staged before the final consumption record are
+   * removed.
+   */
+  cancelTurnInputExpansions(inputs: readonly TurnInputConsumption[]): void {
+    const removed = new Set<ContextMessage>();
+    for (const input of inputs) {
+      const key = turnInputKey(input);
+      this.cancelledTurnInputs.add(key);
+      for (const message of this.committedTurnInputPartMessages.get(key)?.values() ?? []) {
+        removed.add(message);
+      }
+      this.committedTurnInputParts.delete(key);
+      this.committedTurnInputPartMessages.delete(key);
+    }
+    if (removed.size === 0) return;
+
+    for (let i = this._history.length - 1; i >= 0; i--) {
+      const message = this._history[i];
+      if (message === undefined || !removed.has(message)) continue;
+      this._history.splice(i, 1);
+      this.agent.injection.onContextMessageRemoved(i);
+      if (i < this.tokenCountCoveredMessageCount) {
+        this.tokenCountCoveredMessageCount--;
+        this._tokenCount -= estimateTokensForMessages([message]);
+      }
+    }
+    this.deferredMessages = this.deferredMessages.filter((message) => !removed.has(message));
+    this.agent.replayBuilder.removeLastMessages(removed);
+  }
+
+  hasIncompleteTurnInput(input: Pick<TurnInputConsumption, 'kind' | 'id'>): boolean {
+    const key = turnInputKey(input);
+    const inFlight = this.inFlightTurnInputParts.get(key);
+    if (inFlight?.final === true) return false;
+    return inFlight !== undefined || this.committedTurnInputParts.has(key);
+  }
+
   clear(): void {
-    this.agent.records.logRecord({ type: 'context.clear' });
+    const acceptedError = this.persistContextMutation({
+      type: 'context.clear',
+    });
     this._history = [];
     this._tokenCount = 0;
     this.tokenCountCoveredMessageCount = 0;
     this.openSteps.clear();
     this.pendingToolResultIds.clear();
     this.deferredMessages = [];
+    this.committedTurnInputParts.clear();
+    this.committedTurnInputPartMessages.clear();
+    this.inFlightTurnInputParts.clear();
     this._lastAssistantAt = null;
+    this.agent.turn.clearPendingOutcomes();
     this.agent.microCompaction.reset();
     this.agent.injection.onContextClear();
     this.agent.tools.onContextCleared();
     this.agent.emitStatusUpdated();
+    this.reportAcceptedContextObserverError(acceptedError, 'clear');
   }
 
   undo(count: number): void {
     if (count <= 0) return;
     if (this._history.length === 0) return;
 
-    this.agent.records.logRecord({ type: 'context.undo', count });
+    const acceptedError = this.persistContextMutation({ type: 'context.undo', count });
 
     let removedUserCount = 0;
     const removedMessages = new Set<ContextMessage>();
@@ -192,7 +332,12 @@ export class ContextMemory {
     for (let i = this._history.length - 1; i >= 0; i--) {
       const message = this._history[i];
       if (message === undefined) continue;
-      if (message.origin?.kind === 'injection') continue;
+      if (
+        message.origin?.kind === 'injection' &&
+        message.origin.variant !== TURN_OUTCOME_REMINDER_VARIANT
+      ) {
+        continue;
+      }
       if (message.origin?.kind === 'compaction_summary') {
         stoppedAtBoundary = true;
         break;
@@ -209,6 +354,23 @@ export class ContextMemory {
 
       if (isRealUserInput(message)) {
         removedUserCount++;
+        // Image-compression captions are hidden children of this exact user
+        // prompt and were appended immediately before it. Undoing the parent
+        // must remove those children too; otherwise an orphan system reminder
+        // remains in model context after the image/text itself is gone.
+        for (let j = i - 1; j >= 0; j--) {
+          const child = this._history[j];
+          if (child?.origin?.kind !== 'injection' || child.origin.variant !== 'image_compression') {
+            break;
+          }
+          removedMessages.add(child);
+          this._history.splice(j, 1);
+          this.agent.injection.onContextMessageRemoved(j);
+          if (j < this.tokenCountCoveredMessageCount) {
+            this.tokenCountCoveredMessageCount--;
+            this._tokenCount -= estimateTokensForMessages([child]);
+          }
+        }
         if (removedUserCount >= count) break;
       }
     }
@@ -218,13 +380,12 @@ export class ContextMemory {
     this.openSteps.clear();
     this.pendingToolResultIds.clear();
     this.deferredMessages = [];
+    if (removedUserCount > 0) this.agent.turn.clearPendingOutcomes();
     this.agent.microCompaction.reset(this._history.length);
     this.agent.emitStatusUpdated();
+    this.reportAcceptedContextObserverError(acceptedError, 'undo');
 
-    if (
-      !this.agent.records.restoring &&
-      (stoppedAtBoundary || removedUserCount < count)
-    ) {
+    if (!this.agent.records.restoring && (stoppedAtBoundary || removedUserCount < count)) {
       throw new KimiError(
         ErrorCodes.REQUEST_INVALID,
         formatUndoUnavailableMessage(count, removedUserCount, stoppedAtBoundary),
@@ -285,8 +446,7 @@ export class ContextMemory {
     // so their `summary` remains the model-context text during restore.
     const contextSummary = input.contextSummary ?? input.summary;
     const tokensAfter =
-      input.tokensAfter ??
-      estimateTokens(contextSummary) + estimateTokensForMessages(keptMessages);
+      input.tokensAfter ?? estimateTokens(contextSummary) + estimateTokensForMessages(keptMessages);
     const keptUserMessageCount =
       input.keptUserMessageCount ?? selection.head.length + selection.tail.length;
     const keptHeadUserMessageCount =
@@ -301,10 +461,17 @@ export class ContextMemory {
       keptHeadUserMessageCount,
       droppedCount: input.droppedCount,
     };
-    this.agent.records.logRecord({
+    const acceptedError = this.persistContextMutation({
       type: 'context.apply_compaction',
       ...result,
     });
+    // A partial prompt expansion can have durable caption children without
+    // its final user message. Compaction drops those injections, so their
+    // child acknowledgements must be reset as well; retry then reconstructs
+    // the complete prompt exactly once in the new context.
+    this.committedTurnInputParts.clear();
+    this.committedTurnInputPartMessages.clear();
+    this.inFlightTurnInputParts.clear();
     this.agent.replayBuilder.patchLast('compaction', {
       result: {
         summary: result.summary,
@@ -355,6 +522,7 @@ export class ContextMemory {
     this.agent.injection.onContextCompacted();
     this.agent.tools.onContextCompacted();
     this.agent.emitStatusUpdated();
+    this.reportAcceptedContextObserverError(acceptedError, 'apply_compaction');
     return result;
   }
 
@@ -414,7 +582,9 @@ export class ContextMemory {
       return;
     }
     const signature = notable
-      .map((anomaly) => ('toolCallId' in anomaly ? `${anomaly.kind}:${anomaly.toolCallId}` : anomaly.kind))
+      .map((anomaly) =>
+        'toolCallId' in anomaly ? `${anomaly.kind}:${anomaly.toolCallId}` : anomaly.kind,
+      )
       .toSorted()
       .join('|');
     if (signature === this.lastProjectionRepairSignature) return;
@@ -572,124 +742,236 @@ export class ContextMemory {
   }
 
   appendLoopEvent(event: LoopRecordedEvent): void {
-    this.agent.records.logRecord({
+    const acceptedError = this.persistContextMutation({
       type: 'context.append_loop_event',
       event,
     });
-    switch (event.type) {
-      case 'step.begin': {
-        // A new assistant step means any tool calls still pending from an
-        // earlier step were interrupted (the invariant guarantees this never
-        // happens live, so this is a no-op outside replay). Close them in place
-        // before opening the new step so mid-history gaps stay aligned.
-        const closed = this.closePendingToolResults();
-        if (closed.length > 0) {
-          // A mid-history gap means results were lost before this boundary —
-          // a genuine defect worth investigating, unlike the expected trailing
-          // interruption `finishResume` closes.
-          this.agent.log.warn('closed unresolved tool calls at a step boundary', {
-            closed: closed.length,
-            toolCallIds: closed.slice(0, 5),
-          });
+    try {
+      switch (event.type) {
+        case 'step.begin': {
+          // A new assistant step means any tool calls still pending from an
+          // earlier step were interrupted (the invariant guarantees this never
+          // happens live, so this is a no-op outside replay). Close them in place
+          // before opening the new step so mid-history gaps stay aligned.
+          const closed = this.closePendingToolResults();
+          if (closed.length > 0) {
+            // A mid-history gap means results were lost before this boundary —
+            // a genuine defect worth investigating, unlike the expected trailing
+            // interruption `finishResume` closes.
+            this.reportContextWarning('closed unresolved tool calls at a step boundary', {
+              closed: closed.length,
+              toolCallIds: closed.slice(0, 5),
+            });
+          }
+          const message: ContextMessage = {
+            role: 'assistant',
+            content: [],
+            toolCalls: [],
+          };
+          this.pushHistory(message);
+          this.openSteps.set(event.uuid, message);
+          return;
         }
-        const message: ContextMessage = {
-          role: 'assistant',
-          content: [],
-          toolCalls: [],
-        };
-        this.pushHistory(message);
-        this.openSteps.set(event.uuid, message);
-        return;
-      }
-      case 'step.end': {
-        const openStep = this.openSteps.get(event.uuid);
-        this.openSteps.delete(event.uuid);
-        if (event.usage !== undefined) {
-          const openStepIndex = openStep === undefined ? -1 : this._history.indexOf(openStep);
-          const coveredCount =
-            openStepIndex === -1 ? this._history.length : openStepIndex + 1;
-          const totalUsage =
-            event.usage.inputCacheRead +
-            event.usage.inputCacheCreation +
-            event.usage.inputOther +
-            event.usage.output;
-          if (totalUsage > 0) {
-            this._tokenCount = totalUsage;
-          } else {
-            // The provider reported zero usage (e.g. content filter). Do not
-            // overwrite the accumulated context token count with 0; add an
-            // estimate for the newly covered messages so the invariant between
-            // _tokenCount and tokenCountCoveredMessageCount stays intact.
-            const previousCoveredCount = this.tokenCountCoveredMessageCount;
-            this._tokenCount += estimateTokensForMessages(
-              this._history.slice(previousCoveredCount, coveredCount),
+        case 'step.end': {
+          const openStep = this.openSteps.get(event.uuid);
+          this.openSteps.delete(event.uuid);
+          if (event.usage !== undefined) {
+            const openStepIndex = openStep === undefined ? -1 : this._history.indexOf(openStep);
+            const coveredCount = openStepIndex === -1 ? this._history.length : openStepIndex + 1;
+            const totalUsage =
+              event.usage.inputCacheRead +
+              event.usage.inputCacheCreation +
+              event.usage.inputOther +
+              event.usage.output;
+            if (totalUsage > 0) {
+              this._tokenCount = totalUsage;
+            } else {
+              // The provider reported zero usage (e.g. content filter). Do not
+              // overwrite the accumulated context token count with 0; add an
+              // estimate for the newly covered messages so the invariant between
+              // _tokenCount and tokenCountCoveredMessageCount stays intact.
+              const previousCoveredCount = this.tokenCountCoveredMessageCount;
+              this._tokenCount += estimateTokensForMessages(
+                this._history.slice(previousCoveredCount, coveredCount),
+              );
+            }
+            this.tokenCountCoveredMessageCount = coveredCount;
+          }
+          this.flushDeferredMessagesIfToolExchangeClosed();
+          return;
+        }
+        case 'content.part': {
+          const openStep = this.openSteps.get(event.stepUuid);
+          if (openStep === undefined) {
+            throw new Error(
+              `Received content_part for unknown step_uuid '${event.stepUuid}' (no open step_begin)`,
             );
           }
-          this.tokenCountCoveredMessageCount = coveredCount;
+          openStep.content.push(event.part);
+          return;
         }
-        this.flushDeferredMessagesIfToolExchangeClosed();
-        return;
-      }
-      case 'content.part': {
-        const openStep = this.openSteps.get(event.stepUuid);
-        if (openStep === undefined) {
-          throw new Error(
-            `Received content_part for unknown step_uuid '${event.stepUuid}' (no open step_begin)`,
-          );
+        case 'tool.call': {
+          const openStep = this.openSteps.get(event.stepUuid);
+          if (openStep === undefined) {
+            throw new Error(
+              `Received tool_call for unknown step_uuid '${event.stepUuid}' (no open step_begin)`,
+            );
+          }
+          openStep.toolCalls.push({
+            type: 'function',
+            id: event.toolCallId,
+            name: event.name,
+            arguments: event.args === undefined ? null : JSON.stringify(event.args),
+            extras: event.extras,
+          });
+          this.pendingToolResultIds.add(event.toolCallId);
+          return;
         }
-        openStep.content.push(event.part);
-        return;
-      }
-      case 'tool.call': {
-        const openStep = this.openSteps.get(event.stepUuid);
-        if (openStep === undefined) {
-          throw new Error(
-            `Received tool_call for unknown step_uuid '${event.stepUuid}' (no open step_begin)`,
-          );
+        case 'tool.result': {
+          // Drop a result for an id that is not awaiting one: it was already
+          // closed in place at a step boundary (a stale duplicate from an older
+          // tail-only finishResume), or its call is gone.
+          if (!this.pendingToolResultIds.has(event.toolCallId)) return;
+          // History stores the fact verbatim: the tool's own output plus the
+          // structured isError/note fields. Model-facing status text (error
+          // prefix, empty placeholder) and the note are rendered only at LLM
+          // projection time (see tool-result-render.ts).
+          const message = createToolMessage(event.toolCallId, event.result.output);
+          this.pushHistory({
+            ...message,
+            role: 'tool',
+            isError: event.result.isError,
+            note: event.result.note,
+          });
+          this.pendingToolResultIds.delete(event.toolCallId);
+          this.flushDeferredMessagesIfToolExchangeClosed();
+          return;
         }
-        openStep.toolCalls.push({
-          type: 'function',
-          id: event.toolCallId,
-          name: event.name,
-          arguments: event.args === undefined ? null : JSON.stringify(event.args),
-          extras: event.extras,
-        });
-        this.pendingToolResultIds.add(event.toolCallId);
-        return;
       }
-      case 'tool.result': {
-        // Drop a result for an id that is not awaiting one: it was already
-        // closed in place at a step boundary (a stale duplicate from an older
-        // tail-only finishResume), or its call is gone.
-        if (!this.pendingToolResultIds.has(event.toolCallId)) return;
-        // History stores the fact verbatim: the tool's own output plus the
-        // structured isError/note fields. Model-facing status text (error
-        // prefix, empty placeholder) and the note are rendered only at LLM
-        // projection time (see tool-result-render.ts).
-        const message = createToolMessage(event.toolCallId, event.result.output);
-        this.pushHistory({
-          ...message,
-          role: 'tool',
-          isError: event.result.isError,
-          note: event.result.note,
-        });
-        this.pendingToolResultIds.delete(event.toolCallId);
-        this.flushDeferredMessagesIfToolExchangeClosed();
+    } finally {
+      this.reportAcceptedContextObserverError(acceptedError, 'append_loop_event');
+    }
+  }
+
+  appendMessage(
+    message: ContextMessage,
+    consumedTurnInput?: TurnInputConsumption,
+    turnInputPart?: { consumedTurnInput: TurnInputConsumption; index: number },
+    materializedTurnOutcomeId?: string,
+  ): void {
+    if (
+      materializedTurnOutcomeId !== undefined &&
+      this.materializedTurnOutcomeIds.has(materializedTurnOutcomeId)
+    ) {
+      this.agent.turn.consumeOutcome(materializedTurnOutcomeId);
+      return;
+    }
+    if (
+      consumedTurnInput !== undefined &&
+      this.consumedTurnInputs.has(turnInputKey(consumedTurnInput))
+    ) {
+      this.agent.turn.consumeTurnInput(consumedTurnInput);
+      return;
+    }
+    if (turnInputPart !== undefined) {
+      const partKey = turnInputKey(turnInputPart.consumedTurnInput);
+      if (
+        this.consumedTurnInputs.has(partKey) ||
+        this.hasCommittedTurnInputPart(turnInputPart) ||
+        this.cancelledTurnInputs.has(partKey)
+      ) {
         return;
       }
     }
-  }
 
-  appendMessage(message: ContextMessage): void {
-    this.agent.records.logRecord({
-      type: 'context.append_message',
-      message,
-    });
+    let acceptedError: unknown;
+    const inFlightPartKey =
+      turnInputPart === undefined ? undefined : turnInputKey(turnInputPart.consumedTurnInput);
+    if (inFlightPartKey !== undefined) {
+      this.inFlightTurnInputParts.set(inFlightPartKey, {
+        final: consumedTurnInput !== undefined,
+      });
+    }
+    try {
+      acceptedError = this.persistContextMutation({
+        type: 'context.append_message',
+        message,
+        consumedTurnInput,
+        turnInputPart,
+        materializedTurnOutcomeId,
+      });
+    } catch (error) {
+      if (inFlightPartKey !== undefined) this.inFlightTurnInputParts.delete(inFlightPartKey);
+      throw error;
+    }
+
+    if (
+      turnInputPart !== undefined &&
+      this.cancelledTurnInputs.has(turnInputKey(turnInputPart.consumedTurnInput))
+    ) {
+      if (inFlightPartKey !== undefined) this.inFlightTurnInputParts.delete(inFlightPartKey);
+      this.reportAcceptedContextObserverError(acceptedError, 'append_message');
+      return;
+    }
+
+    if (turnInputPart !== undefined) this.markTurnInputPartCommitted(turnInputPart, message);
+    if (inFlightPartKey !== undefined) this.inFlightTurnInputParts.delete(inFlightPartKey);
+    if (consumedTurnInput !== undefined) {
+      const key = turnInputKey(consumedTurnInput);
+      this.committedTurnInputParts.delete(key);
+      this.committedTurnInputPartMessages.delete(key);
+      this.consumedTurnInputs.add(key);
+      this.agent.turn.consumeTurnInput(consumedTurnInput);
+    }
+    if (materializedTurnOutcomeId !== undefined) {
+      this.materializedTurnOutcomeIds.add(materializedTurnOutcomeId);
+      this.agent.turn.consumeOutcome(materializedTurnOutcomeId);
+    }
     if (this.hasOpenToolExchange()) {
       this.deferredMessages.push(message);
+    } else {
+      this.pushHistory(message);
+    }
+    this.reportAcceptedContextObserverError(acceptedError, 'append_message');
+  }
+
+  private consumeEmptyTurnInput(consumedTurnInput: TurnInputConsumption): void {
+    const key = turnInputKey(consumedTurnInput);
+    if (this.consumedTurnInputs.has(key)) {
+      this.agent.turn.consumeTurnInput(consumedTurnInput);
       return;
     }
-    this.pushHistory(message);
+    const acceptedError = this.persistContextMutation({
+      type: 'turn.input_consumed',
+      consumedTurnInput,
+    });
+    this.consumedTurnInputs.add(key);
+    this.agent.turn.consumeTurnInput(consumedTurnInput);
+    this.reportAcceptedContextObserverError(acceptedError, 'consume_empty_turn_input');
+  }
+
+  private hasCommittedTurnInputPart(part: {
+    consumedTurnInput: TurnInputConsumption;
+    index: number;
+  }): boolean {
+    return (
+      this.committedTurnInputParts.get(turnInputKey(part.consumedTurnInput))?.has(part.index) ===
+      true
+    );
+  }
+
+  private markTurnInputPartCommitted(
+    part: { consumedTurnInput: TurnInputConsumption; index: number },
+    message: ContextMessage,
+  ): void {
+    const key = turnInputKey(part.consumedTurnInput);
+    const indices = this.committedTurnInputParts.get(key) ?? new Set<number>();
+    indices.add(part.index);
+    this.committedTurnInputParts.set(key, indices);
+    const messages =
+      this.committedTurnInputPartMessages.get(key) ?? new Map<number, ContextMessage>();
+    messages.set(part.index, message);
+    this.committedTurnInputPartMessages.set(key, messages);
   }
 
   private flushDeferredMessagesIfToolExchangeClosed(): void {
@@ -750,13 +1032,19 @@ function splitImageCompressionCaptions(content: readonly ContentPart[]): {
   return { captions, parts };
 }
 
+function turnInputKey(input: Pick<TurnInputConsumption, 'kind' | 'id'>): string {
+  return `${input.kind}:${input.id}`;
+}
+
 function formatUndoUnavailableMessage(
   requestedCount: number,
   undoableCount: number,
   stoppedAtCompaction: boolean,
 ): string {
   const reason = stoppedAtCompaction ? ' after the last compaction' : '';
-  return `Cannot undo ${formatPromptCount(requestedCount)}; only ${formatPromptCount(undoableCount)} can be undone in the active context${reason}.`;
+  return `Cannot undo ${formatPromptCount(requestedCount)}; only ${formatPromptCount(
+    undoableCount,
+  )} can be undone in the active context${reason}.`;
 
   function formatPromptCount(count: number): string {
     return `${String(count)} ${count === 1 ? 'prompt' : 'prompts'}`;
diff --git a/packages/agent-core/src/agent/context/types.ts b/packages/agent-core/src/agent/context/types.ts
index d16b0c5204..0c6e3647f5 100644
--- a/packages/agent-core/src/agent/context/types.ts
+++ b/packages/agent-core/src/agent/context/types.ts
@@ -111,6 +111,19 @@ export type ContextMessage = Message & {
   readonly note?: string;
 };
 
+/**
+ * Durable acknowledgement that an accepted prompt/steer has reached context.
+ *
+ * This metadata is persisted on the same record as the context mutation, so
+ * replay can distinguish an admission that still needs delivery from one that
+ * was already committed immediately before a process crash.
+ */
+export interface TurnInputConsumption {
+  readonly kind: 'prompt' | 'steer';
+  readonly id: string;
+  readonly turnId: number;
+}
+
 export interface UserMessageRecord {
   content: readonly ContentPart[];
   origin: PromptOrigin;
diff --git a/packages/agent-core/src/agent/index.ts b/packages/agent-core/src/agent/index.ts
index 49da2182c0..7435fe79db 100644
--- a/packages/agent-core/src/agent/index.ts
+++ b/packages/agent-core/src/agent/index.ts
@@ -104,6 +104,14 @@ export interface AgentOptions {
   readonly systemPromptContextProvider?: (() => Promise<PreparedSystemPromptContext>) | undefined;
 }
 
+export interface AgentResumeOptions extends AgentRecordsReplayOptions {
+  /**
+   * Session integration point: restore runtime-only handles after durable state
+   * is rebuilt, but before replayed prompts/steers are allowed to start work.
+   */
+  readonly beforePendingWorkResume?: (() => void | Promise<void>) | undefined;
+}
+
 export class Agent {
   readonly type: AgentType;
   private _kaos: Kaos;
@@ -162,6 +170,7 @@ export class Agent {
   private additionalDirs: readonly string[];
   private activeProfile?: ResolvedAgentProfile;
   private brandHome?: string;
+  private eventStreamClosed = false;
   private readonly systemPromptContextProvider?: (() => Promise<PreparedSystemPromptContext>) | undefined;
 
   constructor(options: AgentOptions) {
@@ -343,20 +352,20 @@ export class Agent {
    * compaction so the post-compaction turns do not keep a snapshot captured
    * at session bootstrap. Invalidates the prompt-cache prefix by design.
    */
-  async refreshSystemPrompt(): Promise<void> {
-    if (this.activeProfile === undefined) return;
+  async refreshSystemPrompt(): Promise<string | undefined> {
+    if (this.activeProfile === undefined) return undefined;
     const context = this.systemPromptContextProvider === undefined
       ? await prepareSystemPromptContext(this.kaos, this.brandHome, {
           additionalDirs: this.additionalDirs,
         })
       : await this.systemPromptContextProvider();
-    this.updateSystemPromptFromProfile(this.activeProfile, context);
+    return this.updateSystemPromptFromProfile(this.activeProfile, context);
   }
 
   private updateSystemPromptFromProfile(
     profile: ResolvedAgentProfile,
     context?: PreparedSystemPromptContext,
-  ): void {
+  ): string {
     const systemPrompt = profile.systemPrompt({
       osEnv: this.kaos.osEnv,
       cwd: this.config.cwd,
@@ -366,18 +375,28 @@ export class Agent {
       additionalDirsInfo: context?.additionalDirsInfo,
     });
     this.config.update({ profileName: profile.name, systemPrompt });
+    return systemPrompt;
   }
 
-  async resume(options?: AgentRecordsReplayOptions): Promise<{ warning?: string }> {
+  async resume(options: AgentResumeOptions = {}): Promise<{ warning?: string }> {
     const result = await this.records.replay(options);
     try {
       this.replayBuilder.postRestoring = true;
       this.goal.normalizeAfterReplay();
+      // Runtime profile/config handles must be ready before reconciliation can
+      // emit a background/cron steer or recovered admissions can launch. This
+      // hook may perform async default-profile bootstrap for migrated wires.
+      await options.beforePendingWorkResume?.();
       await this.background.loadFromDisk();
       await this.background.reconcile();
       await this.cron?.loadFromDisk();
       this.context.finishResume();
       this.turn.finishResume();
+      // A crash may leave a compaction durably committed but missing its
+      // refresh/reinjection/terminal tail. Records replay installs a reservation
+      // synchronously so pending turn inputs stay parked; converge it only after
+      // background, cron, context, and turn state are fully reconstructed.
+      await this.fullCompaction.finishResume();
     } finally {
       this.replayBuilder.postRestoring = false;
     }
@@ -387,19 +406,51 @@ export class Agent {
   get rpcMethods(): PromisableMethods<AgentAPI> {
     return {
       prompt: (payload) => {
-        this.turn.prompt(payload.input);
+        const result = this.turn.submitPrompt(payload.input, undefined, payload.promptId);
+        if (result.kind === 'busy') {
+          throw new KimiError(result.error.code, result.error.message, {
+            details: result.error.details,
+          });
+        }
+        return result;
       },
       runShellCommand: (payload) => this.tools.runShellCommand(payload.command, payload.commandId),
       cancelShellCommand: (payload) => this.tools.cancelShellCommand(payload.commandId),
       steer: (payload) => {
         this.telemetry.track('input_steer', { parts: payload.input.length });
-        this.turn.steer(payload.input);
+        this.turn.steer(
+          payload.input,
+          undefined,
+          payload.expectedTurnId,
+          payload.expectedPromptId,
+          payload.requireActive,
+        );
       },
-      cancel: (payload) => {
+      cancel: async (payload) => {
+        this.turn.assertCancellationTarget(
+          payload.turnId,
+          payload.expectedPromptId,
+          payload.requireActive,
+        );
+        // Capture the worker before aborting it. A goal worker owns every
+        // continuation turn id it allocated, not only its latest id; using the
+        // same predicate as TurnFlow.cancel keeps this RPC a true terminal
+        // barrier even when a delayed request carries an earlier id.
+        const waitForTurn = this.turn.isActiveTurn(payload.turnId)
+          ? this.turn.waitForCurrentTurn()
+          : undefined;
         if (this.turn.hasActiveTurn) {
           this.telemetry.track('cancel', { from: 'streaming' });
         }
-        this.turn.cancel(payload.turnId);
+        const waitForSubagents = this.turn.cancel(payload.turnId, undefined, {
+          expectedPromptId: payload.expectedPromptId,
+          requireActive: payload.requireActive,
+        });
+        const settlements = await Promise.allSettled([waitForTurn, waitForSubagents]);
+        const rejected = settlements.find(
+          (result): result is PromiseRejectedResult => result.status === 'rejected',
+        );
+        if (rejected !== undefined) throw rejected.reason;
       },
       undoHistory: (payload) => {
         this.context.undo(payload.count);
@@ -470,7 +521,7 @@ export class Agent {
         if (this.fullCompaction.isCompacting) {
           this.telemetry.track('cancel', { from: 'compacting' });
         }
-        this.fullCompaction.cancel();
+        return this.fullCompaction.cancel();
       },
       registerTool: (payload) => {
         this.tools.registerUserTool(payload);
@@ -545,8 +596,31 @@ export class Agent {
   }
 
   emitEvent(event: AgentEvent): void {
-    if (this.records.restoring) return;
-    void this.rpc?.emitEvent?.(event);
+    if (this.records.restoring || this.turn?.isClosed || this.eventStreamClosed) return;
+    try {
+      const delivery = this.rpc?.emitEvent?.(event);
+      if (delivery !== undefined) {
+        void Promise.resolve(delivery).catch((error: unknown) => {
+          this.reportEventDeliveryFailure(event.type, error);
+        });
+      }
+    } catch (error) {
+      this.reportEventDeliveryFailure(event.type, error);
+    }
+  }
+
+  private reportEventDeliveryFailure(eventType: AgentEvent['type'], error: unknown): void {
+    try {
+      this.log.warn('agent event delivery failed', { eventType, error });
+    } catch {
+      // Event observers are outside engine control flow. A broken diagnostic
+      // sink must not turn an already-isolated delivery failure into one.
+    }
+  }
+
+  /** Permanently detach this Agent from its owning session's outbound event stream. */
+  closeEventStream(): void {
+    this.eventStreamClosed = true;
   }
 
   emitStatusUpdated(includeThinkingEffort = false): void {
diff --git a/packages/agent-core/src/agent/injection/manager.ts b/packages/agent-core/src/agent/injection/manager.ts
index 823603ac6c..fe301d92a5 100644
--- a/packages/agent-core/src/agent/injection/manager.ts
+++ b/packages/agent-core/src/agent/injection/manager.ts
@@ -72,8 +72,9 @@ export class InjectionManager {
    * started them and their status updates, so without this the model can forget
    * a task is running and spawn a duplicate. Appended as an `injection`-origin
    * reminder, so the next compaction drops and rebuilds it — kept fresh, never
-   * stacked. Runs only on the live path: restore replays the persisted reminder
-   * and `FullCompaction.begin` short-circuits before compaction there.
+   * stacked. A crash after context application can rerun this boundary during
+   * compaction recovery; that path deduplicates already-durable reminders before
+   * appending anything missing.
    */
   private injectActiveBackgroundTasks(): void {
     const tasks = this.agent.background.list(true);
diff --git a/packages/agent-core/src/agent/records/append-error.ts b/packages/agent-core/src/agent/records/append-error.ts
new file mode 100644
index 0000000000..af5bc709cf
--- /dev/null
+++ b/packages/agent-core/src/agent/records/append-error.ts
@@ -0,0 +1,19 @@
+const appendAcceptance = new WeakMap<Error, boolean>();
+
+/**
+ * Preserve the original error identity while recording whether the requested
+ * record crossed the persistence append boundary. Callers can then retry an
+ * explicitly rejected append without duplicating one whose observer failed
+ * after acceptance.
+ */
+export function markAgentRecordAppendError(error: unknown, accepted: boolean): Error {
+  const normalized =
+    error instanceof Error ? error : new Error(String(error), { cause: error });
+  appendAcceptance.set(normalized, accepted);
+  return normalized;
+}
+
+/** `undefined` means the persistence implementation supplied no acceptance contract. */
+export function agentRecordAppendAccepted(error: unknown): boolean | undefined {
+  return error instanceof Error ? appendAcceptance.get(error) : undefined;
+}
diff --git a/packages/agent-core/src/agent/records/index.ts b/packages/agent-core/src/agent/records/index.ts
index 6873c52771..44e8241b4d 100644
--- a/packages/agent-core/src/agent/records/index.ts
+++ b/packages/agent-core/src/agent/records/index.ts
@@ -1,4 +1,8 @@
 import type { Agent } from '..';
+import {
+  agentRecordAppendAccepted,
+  markAgentRecordAppendError,
+} from './append-error';
 import {
   AGENT_WIRE_PROTOCOL_VERSION,
   isNewerWireVersion,
@@ -10,6 +14,7 @@ import {
 import type { AgentRecord, AgentRecordPersistence } from './types';
 
 export * from './types';
+export { agentRecordAppendAccepted, markAgentRecordAppendError } from './append-error';
 export { AGENT_WIRE_PROTOCOL_VERSION } from './migration';
 export {
   FileSystemAgentRecordPersistence,
@@ -37,13 +42,49 @@ function restoreAgentRecord(agent: Agent, input: AgentRecord): void {
       agent.goal.restoreForked(input);
       return;
     case 'turn.prompt':
-      agent.turn.restorePrompt();
+      agent.turn.restorePrompt(
+        input.input,
+        input.origin,
+        input.deferredPromptId,
+        input.promptId,
+        input.admissionId,
+        input.turnId,
+      );
+      return;
+    case 'turn.deferred_prompt_started':
+      agent.turn.restoreDeferredPromptStarted(input.deferredPromptId, input.turnId);
       return;
     case 'turn.steer':
-      agent.turn.restoreSteer(input.input, input.origin);
+      agent.turn.restoreSteer(
+        input.input,
+        input.origin,
+        input.expectedPromptId,
+        input.ownerTurnId,
+        input.ownerDeferredPromptId,
+        input.admissionId,
+        input.turnId,
+      );
       return;
     case 'turn.cancel':
-      agent.turn.cancel(input.turnId);
+      if (
+        input.outcomeId !== undefined &&
+        input.outcomeTurnId !== undefined &&
+        input.outcomeContent !== undefined
+      ) {
+        agent.turn.restoreOutcome(input.outcomeId, input.outcomeTurnId, input.outcomeContent);
+      }
+      void agent.turn.cancel(input.turnId, undefined, {
+        restoredPromptId: input.promptId,
+        restoredOwnerTurnId: input.ownerTurnId,
+        restoredOwnerDeferredPromptId: input.ownerDeferredPromptId,
+        restoredOutcomeId: input.outcomeId,
+        restoredOutcomeTurnId: input.outcomeTurnId,
+        restoredOutcomeContent: input.outcomeContent,
+        restoredCancelledTurnInputs: input.cancelledTurnInputs,
+      });
+      return;
+    case 'turn.outcome':
+      agent.turn.restoreOutcome(input.outcomeId, input.turnId, input.content);
       return;
     case 'config.update':
       agent.config.update(input);
@@ -61,7 +102,7 @@ function restoreAgentRecord(agent: Agent, input: AgentRecord): void {
       agent.fullCompaction.begin(input);
       return;
     case 'full_compaction.cancel':
-      agent.fullCompaction.cancel();
+      void agent.fullCompaction.cancel();
       return;
     case 'full_compaction.complete':
       agent.fullCompaction.markCompleted();
@@ -85,7 +126,15 @@ function restoreAgentRecord(agent: Agent, input: AgentRecord): void {
       agent.swarmMode.exit();
       return;
     case 'context.append_message':
-      agent.context.appendMessage(input.message);
+      agent.context.appendMessage(
+        input.message,
+        input.consumedTurnInput,
+        input.turnInputPart,
+        input.materializedTurnOutcomeId,
+      );
+      return;
+    case 'turn.input_consumed':
+      agent.turn.consumeTurnInput(input.consumedTurnInput);
       return;
     case 'context.append_loop_event':
       agent.context.appendLoopEvent(input.event);
@@ -187,8 +236,8 @@ export class AgentRecords {
 
   /**
    * Register a callback fired once, when the log opens. Not fired for a
-   * range-limited (frozen) replay — those agents are transient previews and
-   * must not append new records.
+   * range-limited replay or another read-only projection — those agents are
+   * transient previews and must not append new records.
    */
   onOpened(callback: () => void): void {
     if (this._opened) {
@@ -216,12 +265,21 @@ export class AgentRecords {
       !this.metadataInitialized &&
       stamped.type !== 'metadata'
     ) {
-      this.persistence.append({
-        type: 'metadata',
-        protocol_version: AGENT_WIRE_PROTOCOL_VERSION,
-        created_at: Date.now(),
-      });
-      this.metadataInitialized = true;
+      try {
+        this.persistence.append({
+          type: 'metadata',
+          protocol_version: AGENT_WIRE_PROTOCOL_VERSION,
+          created_at: Date.now(),
+        });
+        this.metadataInitialized = true;
+      } catch (error) {
+        if (agentRecordAppendAccepted(error) === true) {
+          this.metadataInitialized = true;
+        }
+        // The caller's requested record has not been attempted yet, regardless
+        // of whether the prerequisite metadata append itself was accepted.
+        throw markAgentRecordAppendError(error, false);
+      }
     }
     if (stamped.type === 'metadata') {
       this.metadataInitialized = true;
@@ -232,7 +290,12 @@ export class AgentRecords {
     // (currently hypothetical) mid-replay logRecord — opening there would
     // let observability writes race the dedup-cursor restore.
     if (!this._replaying) {
-      this.markOpened();
+      try {
+        this.markOpened();
+      } catch (error) {
+        // The record was accepted before log-open observers ran.
+        throw markAgentRecordAppendError(error, true);
+      }
     }
   }
 
@@ -247,6 +310,18 @@ export class AgentRecords {
   }
 
   async replay(options: AgentRecordsReplayOptions = {}): Promise<{ warning?: string }> {
+    return this.replayRecords(options, true);
+  }
+
+  /** Restore records for a transient projection without opening the live log. */
+  async replayReadOnly(options: AgentRecordsReplayOptions = {}): Promise<{ warning?: string }> {
+    return this.replayRecords(options, false);
+  }
+
+  private async replayRecords(
+    options: AgentRecordsReplayOptions,
+    openAfterReplay: boolean,
+  ): Promise<{ warning?: string }> {
     if (!this.persistence) throw new Error('No persistence provided for AgentRecords');
     const rewriteMigratedRecords = options.rewriteMigratedRecords ?? true;
     let migrations: readonly WireMigration[] = [];
@@ -303,8 +378,8 @@ export class AgentRecords {
     }
     // Open only AFTER the migration rewrite has flushed — records appended by
     // onOpened callbacks before the rewrite would be wiped by it. A frozen
-    // (range-limited) replay never opens: see onOpened.
-    if (completed) {
+    // range or an explicitly read-only projection never opens: see onOpened.
+    if (completed && openAfterReplay) {
       this.markOpened();
     }
     return { warning };
diff --git a/packages/agent-core/src/agent/records/persistence.ts b/packages/agent-core/src/agent/records/persistence.ts
index 0e51942faf..340941a37c 100644
--- a/packages/agent-core/src/agent/records/persistence.ts
+++ b/packages/agent-core/src/agent/records/persistence.ts
@@ -3,6 +3,7 @@ import { mkdir, open } from 'node:fs/promises';
 import { dirname } from 'pathe';
 
 import { syncDir } from '../../utils/fs';
+import { markAgentRecordAppendError } from './append-error';
 import type { BlobStore } from './blobref';
 import { type AgentRecord, type AgentRecordPersistence } from './types';
 
@@ -33,7 +34,13 @@ export class InMemoryAgentRecordPersistence implements AgentRecordPersistence {
 
   append(input: AgentRecord): void {
     this.records.push(input);
-    this.options.onRecord?.(input);
+    try {
+      this.options.onRecord?.(input);
+    } catch (error) {
+      // The in-memory record is already visible. Preserve that acceptance fact
+      // when a fault-injection/observer callback fails afterward.
+      throw markAgentRecordAppendError(error, true);
+    }
   }
 
   rewrite(records: readonly AgentRecord[]): void {
@@ -97,7 +104,13 @@ export class FileSystemAgentRecordPersistence implements AgentRecordPersistence
   }
 
   append(input: AgentRecord): void {
-    this.throwIfError();
+    try {
+      this.throwIfError();
+    } catch (error) {
+      // A latched filesystem failure rejects new records before they enter the
+      // pending queue, so a caller may safely retry if the sink later recovers.
+      throw markAgentRecordAppendError(error, false);
+    }
     this.pendingRecords.push(input);
     this.scheduleFlush();
   }
diff --git a/packages/agent-core/src/agent/records/types.ts b/packages/agent-core/src/agent/records/types.ts
index fed30c675b..2b438b6427 100644
--- a/packages/agent-core/src/agent/records/types.ts
+++ b/packages/agent-core/src/agent/records/types.ts
@@ -6,7 +6,7 @@ import type { MCPToolDefinition } from '../../mcp/types';
 import type { ToolStoreUpdate } from '../../tools/store';
 import type { CompactionBeginData, CompactionResult } from '../compaction';
 import type { AgentConfigUpdateData } from '../config';
-import type { ContextMessage, PromptOrigin } from '../context';
+import type { ContextMessage, PromptOrigin, TurnInputConsumption } from '../context';
 import type { PermissionApprovalResultRecord, PermissionMode } from '../permission';
 import type { McpToolCollision, UserToolRegistration } from '../tool';
 import type { UsageRecordScope } from '../usage';
@@ -44,12 +44,48 @@ export interface AgentRecordEvents {
   'turn.prompt': {
     input: readonly ContentPart[];
     origin: PromptOrigin;
+    /** Stable identity used to acknowledge this admission atomically with context. */
+    admissionId?: string;
+    /** Allocated immediately for a prompt that starts without being deferred. */
+    turnId?: number;
+    /** Durable identity for a prompt accepted while manual compaction is active. */
+    deferredPromptId?: string;
+    /** Optional caller correlation echoed when the prompt eventually starts. */
+    promptId?: string;
+  };
+  'turn.deferred_prompt_started': {
+    deferredPromptId: string;
+    turnId: number;
   };
   'turn.steer': {
     input: readonly ContentPart[];
     origin: PromptOrigin;
+    /** Stable identity used to acknowledge this admission atomically with context. */
+    admissionId?: string;
+    /** Allocated immediately when an idle steer starts a standalone turn. */
+    turnId?: number;
+    /** Prompt that owns a queued steer. Absent for background/cron notifications. */
+    expectedPromptId?: string;
+    /** Fallback owner for ordinary SDK prompts that omit promptId. */
+    ownerTurnId?: number;
+    /** Fallback owner while such a prompt is deferred behind compaction. */
+    ownerDeferredPromptId?: string;
+  };
+  'turn.cancel': {
+    turnId?: number;
+    /** Durable owner used to discard only that prompt's unconsumed steers on replay. */
+    promptId?: string;
+    ownerTurnId?: number;
+    ownerDeferredPromptId?: string;
+    /** Cancellation reminder intent, committed atomically with the cancel. */
+    outcomeId?: string;
+    outcomeTurnId?: number;
+    outcomeContent?: string;
+    /** Incomplete multi-record prompt/steer expansions tombstoned by this cancel. */
+    cancelledTurnInputs?: readonly TurnInputConsumption[];
   };
-  'turn.cancel': { turnId?: number };
+  /** Failure/cancellation reminder intent, materialized by a context record. */
+  'turn.outcome': { outcomeId: string; turnId: number; content: string };
 
   'config.update': AgentConfigUpdateData;
 
@@ -93,7 +129,17 @@ export interface AgentRecordEvents {
   'full_compaction.complete': {};
   'micro_compaction.apply': { cutoff: number };
 
-  'context.append_message': { message: ContextMessage };
+  'context.append_message': {
+    message: ContextMessage;
+    /** Admission consumed by this exact, durable context mutation. */
+    consumedTurnInput?: TurnInputConsumption;
+    /** Stable child identity for a multi-message prompt expansion. */
+    turnInputPart?: { consumedTurnInput: TurnInputConsumption; index: number };
+    /** Durable acknowledgement that a turn outcome reminder reached context. */
+    materializedTurnOutcomeId?: string;
+  };
+  /** Consumption marker for an accepted empty input, which has no message to append. */
+  'turn.input_consumed': { consumedTurnInput: TurnInputConsumption };
   'context.append_loop_event': { event: LoopRecordedEvent };
   'context.clear': {};
   'context.apply_compaction': CompactionResult;
@@ -212,6 +258,12 @@ export type AgentRecordOf<K extends keyof AgentRecordEvents> = Extract<
 
 export interface AgentRecordPersistence {
   read(): AsyncIterable<AgentRecord>;
+  /**
+   * Accept a record into the implementation's durable-write queue. When an
+   * implementation can throw on either side of that boundary, tag the error
+   * with `markAgentRecordAppendError(error, accepted)` so terminal writers can
+   * distinguish a safe retry from an already-accepted append.
+   */
   append(input: AgentRecord): void;
   rewrite(records: readonly AgentRecord[]): void;
   flush(): Promise<void>;
diff --git a/packages/agent-core/src/agent/replay/build.ts b/packages/agent-core/src/agent/replay/build.ts
index 3181ec434d..ae88525065 100644
--- a/packages/agent-core/src/agent/replay/build.ts
+++ b/packages/agent-core/src/agent/replay/build.ts
@@ -15,6 +15,10 @@ export async function buildReplay(
     type: 'sub',
     replay: { range },
   });
-  await agent.resume({ rewriteMigratedRecords: false });
+  // A replay projection is not a resumable runtime. Rebuild state only; do not
+  // run Agent.resume's background reconciliation, pending-turn launch, or
+  // compaction recovery, and keep record-open callbacks parked so they cannot
+  // append observability/recovery records to the source being projected.
+  await agent.records.replayReadOnly({ rewriteMigratedRecords: false });
   return agent.replayBuilder.buildResult();
 }
diff --git a/packages/agent-core/src/agent/replay/index.ts b/packages/agent-core/src/agent/replay/index.ts
index aea14be969..df9803f606 100644
--- a/packages/agent-core/src/agent/replay/index.ts
+++ b/packages/agent-core/src/agent/replay/index.ts
@@ -25,15 +25,17 @@ export class ReplayBuilder {
     private readonly options: ReplayBuilderOptions = {},
   ) {}
 
-  push(record: AgentReplayRecordPayload): void {
+  push(record: AgentReplayRecordPayload): AgentReplayRecord | undefined {
     if (this.captureLiveRecords || this.agent.records.restoring || this.postRestoring) {
-      if (this.frozen) return;
+      if (this.frozen) return undefined;
       const stamped: AgentReplayRecord = {
         ...record,
         time: this.agent.records.restoring?.time ?? Date.now(),
       };
       this.records.push(stamped);
+      return stamped;
     }
+    return undefined;
   }
 
   patchLast<T extends AgentReplayRecord['type']>(
@@ -42,9 +44,18 @@ export class ReplayBuilder {
   ): void {
     if (this.frozen) return;
     if (this.agent.records.restoring) {
-      const last = this.records.at(-1);
-      if (last && last.type === type) {
-        Object.assign(last, patch);
+      // A compaction remains open while unrelated config/permission/goal replay
+      // records may be appended. Locate the latest matching record rather than
+      // assuming the target is the array tail. For compactions, never rewrite a
+      // prior terminal if a malformed/duplicate terminal arrives with no open
+      // begin record.
+      const target = this.records.findLast(
+        (record) =>
+          record.type === type &&
+          (record.type !== 'compaction' || record.result === undefined),
+      );
+      if (target !== undefined) {
+        Object.assign(target, patch);
       }
     }
   }
diff --git a/packages/agent-core/src/agent/turn/index.ts b/packages/agent-core/src/agent/turn/index.ts
index 587d801ae2..b6b8485a44 100644
--- a/packages/agent-core/src/agent/turn/index.ts
+++ b/packages/agent-core/src/agent/turn/index.ts
@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 
 import { createControlledPromise, type ControlledPromise } from '@antfu/utils';
 import {
@@ -18,6 +18,7 @@ import { basename } from 'pathe';
 import type { Agent } from '..';
 import {
   ErrorCodes,
+  KimiError,
   type KimiErrorPayload,
   isKimiError,
   makeErrorPayload,
@@ -33,11 +34,16 @@ import {
   type LoopTurnInterruptedEvent,
   type LoopTurnStopReason,
 } from '../../loop/index';
-import type { AgentEvent, TurnEndedEvent, TurnEndReason } from '../../rpc';
+import type { AgentEvent, PromptResult, TurnEndedEvent, TurnEndReason } from '../../rpc';
 import type { TelemetryPropertyValue } from '../../telemetry';
 import { gateImageFormatParts } from '../../tools/support/image-compress';
 import { abortable, isUserCancellation, userCancellationReason } from '../../utils/abort';
-import { USER_PROMPT_ORIGIN, type PromptOrigin } from '../context';
+import {
+  USER_PROMPT_ORIGIN,
+  type PromptOrigin,
+  type TurnInputConsumption,
+} from '../context';
+import { agentRecordAppendAccepted } from '../records/append-error';
 import {
   captureMediaStripSnapshot,
   stripMediaPartsBySnapshot,
@@ -45,19 +51,75 @@ import {
 } from '../context/projector';
 import { renderUserPromptHookBlockResult, renderUserPromptHookResult } from '../../session/hooks';
 import { canonicalTelemetryArgs, isPlainRecord } from './canonical-args';
+import {
+  renderTurnCancellationReminder,
+  renderTurnFailureReminder,
+  TURN_OUTCOME_REMINDER_VARIANT,
+} from './outcome-reminder';
 import { ToolCallDeduplicator } from './tool-dedup';
 import { budgetToolResultForModel } from './tool-result-budget';
 
 interface ActiveTurn {
   readonly turnId: number;
+  readonly promptId?: string;
+  readonly admission?: Pick<TurnInputConsumption, 'kind' | 'id'>;
   readonly controller: AbortController;
   readonly promise: Promise<TurnEndResult>;
   readonly firstRequest: ControlledPromise<void>;
+  admitting: boolean;
+  terminalizing: boolean;
+  steerFlushFailed: boolean;
+  steerFlushError: unknown;
 }
 
 interface BufferedSteer {
+  /** Stable identity shared by turn.steer and its context consumption marker. */
+  readonly admissionId?: string;
   readonly input: readonly ContentPart[];
   readonly origin: PromptOrigin;
+  /** Prompt that owns this queued steer; absent for background/cron notifications. */
+  readonly expectedPromptId?: string;
+  /** Fallback owner for ordinary SDK prompts that do not supply promptId. */
+  readonly ownerTurnId?: number;
+  /** Fallback owner while such a prompt is deferred behind compaction. */
+  readonly ownerDeferredPromptId?: string;
+  /** Replay-only: this steer was known to still be behind a deferred prompt. */
+  restorePending?: boolean;
+}
+
+export type PromptLaunchResult =
+  | PromptResult
+  | { readonly kind: 'busy'; readonly error: KimiErrorPayload };
+
+interface DeferredPrompt {
+  /** Public identity used only when manual compaction deferred the prompt. */
+  readonly id?: string;
+  /** Stable identity shared by turn.prompt and its context consumption marker. */
+  readonly admissionId?: string;
+  /** Turn allocated before a crash, used to replay owner-qualified cancellation. */
+  turnId?: number;
+  readonly input: readonly ContentPart[];
+  readonly origin: PromptOrigin;
+  readonly promptId?: string;
+}
+
+interface PendingTurnOutcome {
+  readonly id: string;
+  readonly turnId: number;
+  readonly content: string;
+}
+
+interface TurnCancelOptions {
+  readonly expectedPromptId?: string;
+  readonly requireActive?: boolean;
+  /** Owner persisted on turn.cancel; replay uses it without live-target validation. */
+  readonly restoredPromptId?: string;
+  readonly restoredOwnerTurnId?: number;
+  readonly restoredOwnerDeferredPromptId?: string;
+  readonly restoredOutcomeId?: string;
+  readonly restoredOutcomeTurnId?: number;
+  readonly restoredOutcomeContent?: string;
+  readonly restoredCancelledTurnInputs?: readonly TurnInputConsumption[];
 }
 
 export interface TurnEndResult {
@@ -121,8 +183,13 @@ const GOAL_CONTINUATION_PROMPT = [
 
 export class TurnFlow {
   private steerBuffer: BufferedSteer[] = [];
+  private deferredPrompts: DeferredPrompt[] = [];
+  private readonly pendingOutcomes = new Map<string, PendingTurnOutcome>();
   private turnId = -1;
   private activeTurn: 'resuming' | ActiveTurn | null = null;
+  private closed = false;
+  private shutdownPromise: Promise<void> | null = null;
+  private cancelSetupPromise: ControlledPromise | null = null;
   private readonly toolCallStartedAt = new Map<string, { name: string; startedAt: number }>();
   private readonly toolCallDupType = new Map<string, 'normal' | 'cross_step'>();
   private readonly stepToolCallKeys = new Map<number, Set<string>>();
@@ -134,94 +201,411 @@ export class TurnFlow {
 
   constructor(protected readonly agent: Agent) {}
 
+  private bestEffortWarn(message: string, payload?: unknown): void {
+    try {
+      this.agent.log.warn(message, payload);
+    } catch {
+      // These diagnostics report work that is already durable or a control
+      // transition that must continue. A broken log sink cannot roll either
+      // back, and surfacing its error would invite an unsafe retry.
+    }
+  }
+
+  private bestEffortError(message: string, payload?: unknown): void {
+    try {
+      this.agent.log.error(message, payload);
+    } catch {
+      // Same fail-open boundary as bestEffortWarn. In these call sites the
+      // original failure is already being contained; the diagnostic sink must
+      // not replace it with a second failure or interrupt terminal cleanup.
+    }
+  }
+
   /** Best-effort agent id (main / generated id) derived from the agent homedir. */
   private get agentId(): string {
     return this.agent.homedir ? basename(this.agent.homedir) : this.agent.type;
   }
 
-  // Returns the new turnId, or null if the turn was marked as resuming.
+  // Returns the new turnId, or null if the prompt was deferred or rejected as busy.
+  // Existing in-process callers intentionally retain the historical API; RPC
+  // callers use submitPrompt() to distinguish those two null outcomes.
   prompt(input: readonly ContentPart[], origin: PromptOrigin = USER_PROMPT_ORIGIN): number | null {
+    const result = this.submitPrompt(input, origin);
+    return result.kind === 'started' ? result.turnId : null;
+  }
+
+  /**
+   * Submit a prompt while preserving the distinction between an accepted
+   * prompt deferred by manual compaction and a prompt rejected by an active
+   * turn. Rejected input is never written to the replay log.
+   */
+  submitPrompt(
+    input: readonly ContentPart[],
+    origin: PromptOrigin = USER_PROMPT_ORIGIN,
+    promptId?: string,
+  ): PromptLaunchResult {
     // The last funnel before a prompt lands in the session history: images
     // in formats providers reject (AVIF, HEIC, …) become text notices here,
     // so no caller — the SDK/RPC prompt path included — can poison the
     // session. Upstream ingestion points already gate; this is the backstop.
     const gated = gateImageFormatParts(input);
-    this.agent.records.logRecord({
-      type: 'turn.prompt',
-      input: gated,
-      origin,
+    const admission = { kind: 'prompt', id: randomUUID() } as const;
+    return this.launch(gated, origin, promptId, admission, (deferredPromptId, turnId) => {
+      this.agent.records.logRecord({
+        type: 'turn.prompt',
+        input: gated,
+        origin,
+        admissionId: admission.id,
+        turnId,
+        deferredPromptId,
+        promptId,
+      });
     });
-    return this.launch(gated, origin);
   }
 
   // Returns the new turnId, or null if the input was buffered as a steer
   // message or the turn was marked as resuming.
-  steer(input: readonly ContentPart[], origin: PromptOrigin = USER_PROMPT_ORIGIN): number | null {
+  steer(
+    input: readonly ContentPart[],
+    origin: PromptOrigin = USER_PROMPT_ORIGIN,
+    expectedTurnId?: number,
+    expectedPromptId?: string,
+    requireActive = false,
+  ): number | null {
+    if (this.closed) {
+      if (expectedTurnId !== undefined || expectedPromptId !== undefined || requireActive) {
+        throw new KimiError(ErrorCodes.SESSION_CLOSED, 'Cannot steer after the agent has closed');
+      }
+      return null;
+    }
+    const active = this.activeTurn;
+    const steerAdmissionClosed =
+      active !== null && active !== 'resuming' && active.terminalizing;
+    if (
+      steerAdmissionClosed &&
+      (origin.kind === 'user' ||
+        expectedTurnId !== undefined ||
+        expectedPromptId !== undefined ||
+        requireActive)
+    ) {
+      throw new KimiError(
+        ErrorCodes.TURN_AGENT_BUSY,
+        expectedPromptId !== undefined
+          ? `Cannot steer prompt ${expectedPromptId} because it is no longer active`
+          : expectedTurnId !== undefined
+            ? `Cannot steer turn ${String(expectedTurnId)} because it is no longer active`
+            : 'Cannot steer because the active turn is ending',
+        {
+          details: {
+            expectedTurnId,
+            activeTurnId: active.turnId,
+            expectedPromptId,
+            activePromptId: active.promptId,
+          },
+        },
+      );
+    }
+    if (expectedTurnId !== undefined || expectedPromptId !== undefined || requireActive) {
+      const activeTurnId = active === null || active === 'resuming' ? undefined : this.currentId;
+      const activePromptId =
+        active === null
+          ? this.deferredPrompts[0]?.promptId
+          : active === 'resuming'
+            ? undefined
+            : active.promptId;
+      if (
+        (requireActive && activeTurnId === undefined && activePromptId === undefined) ||
+        (expectedTurnId !== undefined && activeTurnId !== expectedTurnId) ||
+        (expectedPromptId !== undefined && activePromptId !== expectedPromptId)
+      ) {
+        throw new KimiError(
+          ErrorCodes.TURN_AGENT_BUSY,
+          expectedPromptId !== undefined
+            ? `Cannot steer prompt ${expectedPromptId} because it is no longer active`
+            : expectedTurnId !== undefined
+              ? `Cannot steer turn ${String(expectedTurnId)} because it is no longer active`
+              : 'Cannot steer because no prompt is active',
+          { details: { expectedTurnId, activeTurnId, expectedPromptId, activePromptId } },
+        );
+      }
+    }
     // Same format gate as prompt() — steer input enters the history too.
     const gated = gateImageFormatParts(input);
-    this.agent.records.logRecord({
-      type: 'turn.steer',
-      input: gated,
-      origin,
-    });
+    // Direct user steers (the public session.steer() path) do not carry an
+    // expectedPromptId, but they still belong to the prompt being interrupted.
+    // Bind them to that logical owner so Esc/cancel cannot leak them into the
+    // next prompt. Background/cron origins intentionally remain unowned.
+    const inferredPromptId =
+      active === null
+        ? this.deferredPrompts[0]?.promptId
+        : active === 'resuming'
+          ? undefined
+          : active.promptId;
+    const ownerPromptId =
+      expectedPromptId ?? (origin.kind === 'user' ? inferredPromptId : undefined);
+    const hasUserOwner =
+      origin.kind === 'user' || expectedPromptId !== undefined || expectedTurnId !== undefined;
+    const ownerTurnId =
+      hasUserOwner && active !== null && active !== 'resuming' ? active.turnId : undefined;
+    const ownerDeferredPromptId =
+      hasUserOwner && active === null ? this.deferredPrompts[0]?.id : undefined;
+    const admission = { kind: 'steer', id: randomUUID() } as const;
     // Buffer while a turn is active OR a manual compaction holds the context;
     // `onCompactionFinished` replays the buffer once compaction's full lifecycle
     // (summary + reinjection) is done. Returning null means "buffered" — which is
     // exactly what fire-and-forget callers (background notifications, cron) assume.
-    if (this.activeTurn || this.agent.fullCompaction.isCompacting) {
-      this.steerBuffer.push({ input: gated, origin });
+    if (
+      this.activeTurn ||
+      this.agent.fullCompaction.isCompacting ||
+      this.deferredPrompts.length > 0
+    ) {
+      // Install the reservation before persistence. A synchronous persistence
+      // observer may cancel the owner; it must be able to find and remove this
+      // steer before the outer admission returns success.
+      const reservation: BufferedSteer = {
+        admissionId: admission.id,
+        input: gated,
+        origin,
+        expectedPromptId: ownerPromptId,
+        ownerTurnId,
+        ownerDeferredPromptId,
+      };
+      this.steerBuffer.push(reservation);
+      try {
+        this.agent.records.logRecord({
+          type: 'turn.steer',
+          input: gated,
+          origin,
+          admissionId: admission.id,
+          expectedPromptId: ownerPromptId,
+          ownerTurnId,
+          ownerDeferredPromptId,
+        });
+      } catch (error) {
+        if (agentRecordAppendAccepted(error) !== true) {
+          const index = this.steerBuffer.indexOf(reservation);
+          if (index !== -1) this.steerBuffer.splice(index, 1);
+          throw error;
+        }
+        this.bestEffortWarn('steer admission committed with observer failure', { error });
+      }
+      if (!this.steerBuffer.includes(reservation)) {
+        throw new KimiError(
+          this.closed ? ErrorCodes.SESSION_CLOSED : ErrorCodes.TURN_AGENT_BUSY,
+          this.closed
+            ? 'Cannot steer after the agent has closed'
+            : 'Cannot steer because cancellation won the admission race',
+          {
+            details: {
+              expectedTurnId,
+              expectedPromptId,
+              ownerTurnId,
+              ownerDeferredPromptId,
+            },
+          },
+        );
+      }
       return null;
     }
-    return this.launch(gated, origin);
+    // Idle steer becomes a standalone turn. Persist from startTurn's accepted
+    // callback so the active reservation exists before any synchronous record
+    // observer can re-enter cancel/prompt.
+    const result = this.launch(gated, origin, undefined, admission, (_deferredPromptId, turnId) => {
+      this.agent.records.logRecord({
+        type: 'turn.steer',
+        input: gated,
+        origin,
+        admissionId: admission.id,
+        turnId,
+        expectedPromptId: ownerPromptId,
+        ownerTurnId,
+        ownerDeferredPromptId,
+      });
+    });
+    return result.kind === 'started' ? result.turnId : null;
   }
 
   retry(trigger?: string): number | null {
     return this.prompt([], { kind: 'retry', trigger });
   }
 
-  private launch(input: readonly ContentPart[], origin: PromptOrigin): number | null {
+  private launch(
+    input: readonly ContentPart[],
+    origin: PromptOrigin,
+    promptId?: string,
+    admission?: Pick<TurnInputConsumption, 'kind' | 'id'>,
+    onAccepted?: (deferredPromptId: string | undefined, turnId: number | undefined) => void,
+  ): PromptLaunchResult {
+    if (this.closed) {
+      return {
+        kind: 'busy',
+        error: makeErrorPayload(
+          ErrorCodes.SESSION_CLOSED,
+          'Cannot launch a turn after the agent has closed',
+        ),
+      };
+    }
     if (this.activeTurn) {
+      const error = makeErrorPayload(
+        ErrorCodes.TURN_AGENT_BUSY,
+        `Cannot launch a new turn while another turn (ID ${this.turnId}) is active`,
+        { details: { turnId: this.turnId } },
+      );
       this.agent.emitEvent({
         type: 'error',
-        ...makeErrorPayload(
-          'turn.agent_busy',
-          `Cannot launch a new turn while another turn (ID ${this.turnId}) is active`,
-          { details: { turnId: this.turnId } },
-        ),
+        ...error,
       });
-      return null;
+      return { kind: 'busy', error };
+    }
+    if (this.deferredPrompts.length > 0) {
+      const error = makeErrorPayload(
+        ErrorCodes.TURN_AGENT_BUSY,
+        'Cannot launch a new turn while another prompt is waiting for compaction to finish',
+        { details: { deferredPromptId: this.deferredPrompts[0]!.id } },
+      );
+      this.agent.emitEvent({ type: 'error', ...error });
+      return { kind: 'busy', error };
     }
 
     // While a manual/SDK compaction holds the context, defer the launch instead
-    // of rejecting it: buffer the input and replay it from `onCompactionFinished`
+    // of rejecting it: persist a separately identified prompt and replay it
+    // from `onCompactionFinished`
     // once compaction's full lifecycle (summary + reinjection) completes. The
     // deferred turn's eventual `turn.started` lets PromptService associate the
     // pending prompt, so a prompt submitted mid-compaction completes normally
     // rather than getting stuck "running". (Auto compaction runs inside an active
     // turn, so the `activeTurn` check above already covers it.)
     if (this.agent.fullCompaction.isCompacting) {
-      this.steerBuffer.push({ input, origin });
-      return null;
+      const deferredPromptId = randomUUID();
+      const reservation = {
+        id: deferredPromptId,
+        admissionId: admission?.id,
+        input,
+        origin,
+        promptId,
+      };
+      this.deferredPrompts.push(reservation);
+      try {
+        onAccepted?.(deferredPromptId, undefined);
+      } catch (error) {
+        if (agentRecordAppendAccepted(error) !== true) {
+          const index = this.deferredPrompts.indexOf(reservation);
+          if (index !== -1) this.deferredPrompts.splice(index, 1);
+          throw error;
+        }
+        this.bestEffortWarn('deferred prompt admission committed with observer failure', {
+          error,
+        });
+      }
+      if (!this.deferredPrompts.includes(reservation)) {
+        throw new KimiError(
+          this.closed ? ErrorCodes.SESSION_CLOSED : ErrorCodes.TURN_AGENT_BUSY,
+          this.closed
+            ? 'Cannot prompt after the agent has closed'
+            : 'Cannot prompt because cancellation won the admission race',
+          { details: { promptId, deferredPromptId } },
+        );
+      }
+      return { kind: 'deferred', deferredPromptId };
     }
 
+    return this.startTurn(input, origin, undefined, promptId, admission, onAccepted);
+  }
+
+  private startTurn(
+    input: readonly ContentPart[],
+    origin: PromptOrigin,
+    deferredPromptId?: string,
+    promptId?: string,
+    admission?: Pick<TurnInputConsumption, 'kind' | 'id'>,
+    onAccepted?: (deferredPromptId: string | undefined, turnId: number | undefined) => void,
+  ): PromptResult {
     // Per-turn setup (telemetry, usage window, `turn.started`, appending the
     // prompt) now lives in `runOneTurn`, so a goal-driven run emits a clean
     // start/end pair per continuation turn rather than one mega-turn.
     const turnId = this.allocateTurnId();
     const controller = new AbortController();
-    const promise = this.turnWorker(turnId, input, origin, controller.signal);
+    const promise = createControlledPromise<TurnEndResult>();
     const firstRequest = createControlledPromise<void>();
-    this.activeTurn = {
+    const reservation: ActiveTurn = {
       turnId,
+      promptId,
+      admission,
       controller,
       promise,
       firstRequest,
+      admitting: true,
+      terminalizing: false,
+      steerFlushFailed: false,
+      steerFlushError: undefined,
     };
+    this.activeTurn = reservation;
 
     void firstRequest.catch(() => undefined);
     void promise.then(firstRequest.reject, firstRequest.reject);
-
-    return turnId;
+    try {
+      // A previous abnormal turn may have durably reserved, but not yet
+      // appended, its outcome reminder. The active reservation is installed
+      // first so a synchronous persistence observer cannot re-enter launch and
+      // overtake or duplicate this convergence barrier.
+      try {
+        this.materializePendingOutcomes();
+      } catch (error) {
+        if (agentRecordAppendAccepted(error) !== true) throw error;
+        this.bestEffortWarn('turn outcome reminder committed with observer failure', { error });
+      }
+      if (this.closed) {
+        throw new KimiError(ErrorCodes.SESSION_CLOSED, 'Cannot launch after the agent has closed');
+      }
+      // The prompt admission is the next durable operation. From this point a
+      // synchronous observer may cancel: its record will necessarily follow
+      // the prompt/activation record it owns.
+      reservation.admitting = false;
+      // The active reservation is already installed, but no turn event has
+      // fired yet. Persistence callbacks may re-enter prompt/cancel safely.
+      if (deferredPromptId !== undefined) {
+        try {
+          this.agent.records.logRecord({
+            type: 'turn.deferred_prompt_started',
+            deferredPromptId,
+            turnId,
+          });
+        } catch (error) {
+          if (agentRecordAppendAccepted(error) !== true) throw error;
+          this.bestEffortWarn('deferred prompt activation committed with observer failure', {
+            error,
+            turnId,
+          });
+        }
+      }
+      try {
+        onAccepted?.(undefined, turnId);
+      } catch (error) {
+        if (agentRecordAppendAccepted(error) !== true) throw error;
+        this.bestEffortWarn('turn admission committed with observer failure', { error, turnId });
+      }
+    } catch (error) {
+      const active = this.activeTurn;
+      if (active !== null && active.controller === controller) {
+        this.activeTurn = null;
+        this.turnId -= 1;
+      }
+      controller.abort(error);
+      promise.reject(error);
+      throw error;
+    }
+    const worker = this.turnWorker(
+      turnId,
+      input,
+      origin,
+      controller.signal,
+      deferredPromptId,
+      promptId,
+      admission,
+    );
+    void worker.then(promise.resolve, promise.reject);
+
+    return { kind: 'started', turnId };
   }
 
   /** Allocates the next monotonic turn id. */
@@ -230,7 +614,59 @@ export class TurnFlow {
     return this.turnId;
   }
 
-  restorePrompt(): void {
+  restorePrompt(
+    input: readonly ContentPart[],
+    origin: PromptOrigin,
+    deferredPromptId?: string,
+    promptId?: string,
+    admissionId?: string,
+    turnId?: number,
+  ): void {
+    if (admissionId !== undefined) {
+      if (!this.deferredPrompts.some((prompt) => prompt.admissionId === admissionId)) {
+        this.deferredPrompts.push({
+          id: deferredPromptId,
+          admissionId,
+          turnId,
+          input,
+          origin,
+          promptId,
+        });
+      }
+      if (turnId !== undefined) this.observeRestoredTurnId(turnId);
+      return;
+    }
+    if (deferredPromptId !== undefined) {
+      if (!this.deferredPrompts.some((prompt) => prompt.id === deferredPromptId)) {
+        this.deferredPrompts.push({ id: deferredPromptId, input, origin, promptId });
+      }
+      return;
+    }
+    this.restoreStartedTurn();
+  }
+
+  /** Marks a replayed deferred prompt as durably activated, even when its input is empty. */
+  restoreDeferredPromptStarted(deferredPromptId: string, turnId: number): void {
+    const index = this.deferredPrompts.findIndex((prompt) => prompt.id === deferredPromptId);
+    const prompt = index === -1 ? undefined : this.deferredPrompts[index];
+    if (prompt?.admissionId !== undefined) {
+      // Activation is intentionally not consumption: a crash after this record
+      // but before context append must retry the admitted prompt. The context
+      // record's consumption marker is the only durable acknowledgement.
+      prompt.turnId = turnId;
+      this.observeRestoredTurnId(turnId);
+      return;
+    }
+    if (index !== -1) this.deferredPrompts.splice(index, 1);
+    // Activation means every steer queued behind this deferred prompt now
+    // belongs to the started turn. Do not replay it as fresh work after a
+    // crash; subsequent context records contain anything that was consumed.
+    for (const steer of this.steerBuffer) steer.restorePending = false;
+    this.observeRestoredTurnId(turnId);
+    this.activeTurn ??= 'resuming';
+  }
+
+  private restoreStartedTurn(): void {
     if (this.activeTurn) {
       return;
     }
@@ -253,27 +689,509 @@ export class TurnFlow {
     }
   }
 
-  restoreSteer(input: readonly ContentPart[], origin: PromptOrigin): void {
-    if (this.activeTurn) {
-      this.steerBuffer.push({ input, origin });
+  restoreSteer(
+    input: readonly ContentPart[],
+    origin: PromptOrigin,
+    expectedPromptId?: string,
+    ownerTurnId?: number,
+    ownerDeferredPromptId?: string,
+    admissionId?: string,
+    turnId?: number,
+  ): void {
+    if (admissionId !== undefined) {
+      if (!this.steerBuffer.some((steer) => steer.admissionId === admissionId)) {
+        this.steerBuffer.push({
+          admissionId,
+          input,
+          origin,
+          expectedPromptId,
+          ownerTurnId,
+          ownerDeferredPromptId,
+        });
+      }
+      if (turnId !== undefined) this.observeRestoredTurnId(turnId);
+      return;
+    }
+    if (this.activeTurn || this.deferredPrompts.length > 0) {
+      this.steerBuffer.push({
+        input,
+        origin,
+        expectedPromptId,
+        ownerTurnId,
+        ownerDeferredPromptId,
+        restorePending: this.deferredPrompts.length > 0,
+      });
       return;
     }
     this.turnId += 1;
     this.activeTurn = 'resuming';
   }
 
-  cancel(turnId?: number, reason?: unknown): void {
-    this.agent.records.logRecord({ type: 'turn.cancel', turnId });
-    if (turnId !== undefined && turnId !== this.currentId) {
-      return; // Ignore cancel for non-active turn
+  /** Apply a durable admission acknowledgement during live append or replay. */
+  consumeTurnInput(consumption: TurnInputConsumption): void {
+    this.observeRestoredTurnId(consumption.turnId);
+    if (consumption.kind === 'prompt') {
+      this.deferredPrompts = this.deferredPrompts.filter(
+        (prompt) => prompt.admissionId !== consumption.id,
+      );
+      return;
+    }
+    this.steerBuffer = this.steerBuffer.filter(
+      (steer) => steer.admissionId !== consumption.id,
+    );
+  }
+
+  restoreOutcome(id: string, turnId: number, content: string): void {
+    this.observeRestoredTurnId(turnId);
+    this.pendingOutcomes.set(id, { id, turnId, content });
+  }
+
+  consumeOutcome(id: string): void {
+    this.pendingOutcomes.delete(id);
+  }
+
+  /** A destructive user context operation also tombstones unseen outcomes. */
+  clearPendingOutcomes(): void {
+    this.pendingOutcomes.clear();
+  }
+
+  cancel(
+    turnId?: number,
+    reason?: unknown,
+    options: TurnCancelOptions = {},
+  ): Promise<void> {
+    if (this.closed) return this.shutdownPromise ?? Promise.resolve();
+    if (this.activeTurn === 'resuming' && this.agent.records.restoring === null) {
+      return Promise.resolve();
     }
+    if (
+      this.activeTurn !== null &&
+      this.activeTurn !== 'resuming' &&
+      this.activeTurn.admitting
+    ) {
+      // The caller has not yet received an admission acknowledgement and no
+      // owner record exists to order a cancellation after. Treat this tiny
+      // launch window as not-yet-active; once admission is durable, ordinary
+      // cancellation is allowed synchronously from its persistence observer.
+      return Promise.resolve();
+    }
+    if (options.restoredPromptId === undefined) {
+      this.assertCancellationTarget(turnId, options.expectedPromptId, options.requireActive);
+    }
+    if (this.cancelSetupPromise !== null) return this.cancelSetupPromise;
+    if (
+      this.activeTurn !== null &&
+      this.activeTurn !== 'resuming' &&
+      this.activeTurn.terminalizing
+    ) {
+      return this.activeTurn.promise.then(() => undefined);
+    }
+
+    // Install a synchronous re-entrancy guard before logging. Record
+    // persistence hooks are allowed to call back into the engine; a nested
+    // cancel must join the outer operation instead of recursively logging.
+    const completion = createControlledPromise<void>();
+    this.cancelSetupPromise = completion;
+    void completion.catch(() => undefined);
+    const releaseSetup = (): void => {
+      if (this.cancelSetupPromise === completion) this.cancelSetupPromise = null;
+    };
+    void completion.then(releaseSetup, releaseSetup);
+    try {
+      const barrier = this.startCancellation(
+        turnId,
+        reason,
+        options.restoredPromptId,
+        options.restoredOwnerTurnId,
+        options.restoredOwnerDeferredPromptId,
+        options.restoredOutcomeId,
+        options.restoredOutcomeTurnId,
+        options.restoredOutcomeContent,
+        options.restoredCancelledTurnInputs,
+      );
+      void barrier.then(completion.resolve, completion.reject);
+    } catch (error) {
+      completion.reject(error);
+    }
+    return completion;
+  }
+
+  assertCancellationTarget(
+    turnId?: number,
+    expectedPromptId?: string,
+    requireActive = false,
+  ): void {
+    if (expectedPromptId === undefined && !requireActive) return;
+    const active = this.activeTurn;
+    const activeTurnId = active === null || active === 'resuming' ? undefined : this.currentId;
+    const activePromptId =
+      active === null
+        ? this.deferredPrompts[0]?.promptId
+        : active === 'resuming'
+          ? undefined
+          : active.promptId;
+    const hasLogicalPrompt =
+      (active !== null && active !== 'resuming') ||
+      (active === null && this.deferredPrompts.length > 0);
+    const ownsTurn = turnId === undefined || this.isActiveTurn(turnId);
+    if (
+      (requireActive && !hasLogicalPrompt) ||
+      !ownsTurn ||
+      (expectedPromptId !== undefined && activePromptId !== expectedPromptId)
+    ) {
+      throw new KimiError(
+        ErrorCodes.TURN_AGENT_BUSY,
+        expectedPromptId !== undefined
+          ? `Cannot cancel prompt ${expectedPromptId} because it is no longer active`
+          : 'Cannot cancel because no prompt is active',
+        { details: { expectedTurnId: turnId, activeTurnId, expectedPromptId, activePromptId } },
+      );
+    }
+  }
+
+  private startCancellation(
+    turnId?: number,
+    reason?: unknown,
+    restoredPromptId?: string,
+    restoredOwnerTurnId?: number,
+    restoredOwnerDeferredPromptId?: string,
+    restoredOutcomeId?: string,
+    restoredOutcomeTurnId?: number,
+    restoredOutcomeContent?: string,
+    restoredCancelledTurnInputs?: readonly TurnInputConsumption[],
+  ): Promise<void> {
+    const ownsActiveTurn =
+      turnId === undefined || turnId === this.currentId || this.activeWorkerOwnsTurn(turnId);
+    const active = this.activeTurn;
+    const terminalizingBeforeCancellation =
+      active === null || active === 'resuming' ? undefined : active.terminalizing;
+    const canCreateCancellationOutcome =
+      ownsActiveTurn &&
+      active !== null &&
+      active !== 'resuming' &&
+      !active.terminalizing;
+    if (ownsActiveTurn && active !== null && active !== 'resuming') {
+      active.terminalizing = true;
+    }
+    const inferredPromptId =
+      restoredPromptId ??
+      (ownsActiveTurn && active !== null && active !== 'resuming'
+        ? active.promptId
+        : ownsActiveTurn && active === null && turnId === undefined
+          ? this.deferredPrompts[0]?.promptId
+          : undefined);
+    const inferredOwnerTurnId =
+      restoredOwnerTurnId ??
+      (ownsActiveTurn && active !== null && active !== 'resuming' ? active.turnId : undefined);
+    const inferredOwnerDeferredPromptId =
+      restoredOwnerDeferredPromptId ??
+      (ownsActiveTurn && active === null && turnId === undefined
+        ? this.deferredPrompts[0]?.id
+        : undefined);
+    const cancelledTurnInputs =
+      restoredCancelledTurnInputs ??
+      this.collectIncompleteTurnInputsOwnedBy(
+        ownsActiveTurn,
+        inferredPromptId,
+        inferredOwnerTurnId,
+        inferredOwnerDeferredPromptId,
+      );
     // A direct cancel (RPC / replay) is the user pressing stop. When the cancel
     // is propagated from an aborting signal (e.g. a subagent's deadline via
     // waitForCurrentTurn), carry that original reason instead so a timeout is
     // not mislabeled to the model as a deliberate user interruption.
     const cancelReason = reason ?? userCancellationReason();
+    let outcome: PendingTurnOutcome | undefined;
+    let outcomeReservedByCancellation = false;
+    if (
+      restoredOutcomeId !== undefined &&
+      restoredOutcomeTurnId !== undefined &&
+      restoredOutcomeContent !== undefined
+    ) {
+      outcome = {
+        id: restoredOutcomeId,
+        turnId: restoredOutcomeTurnId,
+        content: restoredOutcomeContent,
+      };
+      outcomeReservedByCancellation = !this.pendingOutcomes.has(outcome.id);
+      this.pendingOutcomes.set(outcome.id, outcome);
+    } else if (ownsActiveTurn && active !== null && active !== 'resuming') {
+      // The reminder intent is part of the cancel record itself. A process may
+      // die after that record is durable but before the worker appends the
+      // reminder to context; replay can therefore finish the materialization
+      // before releasing any pending follow-up prompt.
+      try {
+        outcome = [...this.pendingOutcomes.values()].find(
+          (candidate) => candidate.turnId === this.currentId,
+        );
+        if (outcome === undefined && canCreateCancellationOutcome) {
+          outcome = {
+            id: randomUUID(),
+            turnId: this.currentId,
+            content: renderTurnCancellationReminder(
+              cancelReason,
+              isUserCancellation(cancelReason),
+            ),
+          };
+        }
+        if (outcome !== undefined) {
+          outcomeReservedByCancellation = !this.pendingOutcomes.has(outcome.id);
+          this.pendingOutcomes.set(outcome.id, outcome);
+        }
+      } catch (error) {
+        // Rendering diagnostics must never prevent the cancellation itself.
+        this.bestEffortWarn('failed to render turn cancellation reminder', { error });
+      }
+    }
+    let recordFailed = false;
+    let recordError: unknown;
+    try {
+      this.agent.records.logRecord({
+        type: 'turn.cancel',
+        turnId,
+        promptId: inferredPromptId,
+        ownerTurnId: inferredOwnerTurnId,
+        ownerDeferredPromptId: inferredOwnerDeferredPromptId,
+        outcomeId: outcome?.id,
+        outcomeTurnId: outcome?.turnId,
+        outcomeContent: outcome?.content,
+        cancelledTurnInputs:
+          cancelledTurnInputs.length === 0 ? undefined : cancelledTurnInputs,
+      });
+    } catch (error) {
+      if (agentRecordAppendAccepted(error) === false) {
+        // Nothing durable owns the destructive transition. Restore every
+        // reservation made before persistence and leave the admitted work
+        // running; otherwise replay would execute a prompt that live state
+        // had already aborted or tombstoned.
+        if (outcomeReservedByCancellation && outcome !== undefined) {
+          this.pendingOutcomes.delete(outcome.id);
+        }
+        if (
+          ownsActiveTurn &&
+          active !== null &&
+          active !== 'resuming' &&
+          this.activeTurn === active &&
+          terminalizingBeforeCancellation !== undefined
+        ) {
+          active.terminalizing = terminalizingBeforeCancellation;
+        }
+        return Promise.reject(error);
+      }
+      recordFailed = true;
+      recordError = error;
+    }
+    try {
+      this.agent.context.cancelTurnInputExpansions(cancelledTurnInputs);
+    } catch (error) {
+      recordFailed = true;
+      recordError ??= error;
+    }
+    if (
+      turnId !== undefined &&
+      !ownsActiveTurn
+    ) {
+      return recordFailed
+        ? Promise.reject(recordError)
+        : Promise.resolve(); // Ignore cancel for non-active turn
+    }
+    // A prompt accepted during manual compaction has no turn id yet. Only an
+    // unscoped user stop may own that pending prompt; a delayed explicit id can
+    // belong to an older worker. Steers live in their own buffer and survive —
+    // cancelling a user prompt must not erase a background notification.
+    if (
+      !this.hasActiveTurn &&
+      turnId === undefined &&
+      isUserCancellation(cancelReason)
+    ) {
+      const cancelled = this.deferredPrompts.shift();
+      this.discardSteersOwnedBy(
+        inferredPromptId ?? cancelled?.promptId,
+        inferredOwnerTurnId,
+        inferredOwnerDeferredPromptId ?? cancelled?.id,
+      );
+      this.discardPromptsOwnedBy(
+        inferredPromptId ?? cancelled?.promptId,
+        inferredOwnerTurnId,
+        inferredOwnerDeferredPromptId ?? cancelled?.id,
+      );
+    } else {
+      this.discardSteersOwnedBy(
+        inferredPromptId,
+        inferredOwnerTurnId,
+        inferredOwnerDeferredPromptId,
+      );
+      this.discardPromptsOwnedBy(
+        inferredPromptId,
+        inferredOwnerTurnId,
+        inferredOwnerDeferredPromptId,
+      );
+    }
     this.abortTurn(cancelReason);
-    this.agent.subagentHost?.cancelAll(cancelReason);
+    let subagentCancellation: Promise<void>;
+    try {
+      subagentCancellation = this.agent.subagentHost?.cancelAll(cancelReason) ?? Promise.resolve();
+    } catch (error) {
+      subagentCancellation = Promise.reject(error);
+    }
+    return Promise.allSettled([subagentCancellation]).then((settlements) => {
+      if (recordFailed) throw recordError;
+      const rejected = settlements.find(
+        (result): result is PromiseRejectedResult => result.status === 'rejected',
+      );
+      if (rejected !== undefined) throw rejected.reason;
+    });
+  }
+
+  /** Permanently stop turn/compaction work before the owning session is disposed. */
+  shutdown(reason: unknown): Promise<void> {
+    if (this.shutdownPromise !== null) return this.shutdownPromise;
+
+    const completion = createControlledPromise<void>();
+    this.shutdownPromise = completion;
+    void completion.catch(() => undefined);
+
+    const active =
+      this.activeTurn !== null && this.activeTurn !== 'resuming'
+        ? this.activeTurn
+        : undefined;
+    const admittedActive = active?.admitting === false ? active : undefined;
+    const deferred = active === undefined ? this.deferredPrompts[0] : undefined;
+    const cancelledTurnInputs =
+      admittedActive === undefined
+        ? []
+        : this.collectIncompleteTurnInputsOwnedBy(
+            true,
+            admittedActive.promptId,
+            admittedActive.turnId,
+            undefined,
+          );
+    const closedBeforeShutdown = this.closed;
+    const deferredPromptsBeforeShutdown = [...this.deferredPrompts];
+    const steerBufferBeforeShutdown = [...this.steerBuffer];
+    this.closed = true;
+    this.deferredPrompts.length = 0;
+    this.steerBuffer.length = 0;
+    let outcome: PendingTurnOutcome | undefined;
+    let outcomeReservedByShutdown = false;
+    if (admittedActive !== undefined) {
+      try {
+        outcome = [...this.pendingOutcomes.values()].find(
+          (candidate) => candidate.turnId === this.currentId,
+        );
+        if (outcome === undefined && !admittedActive.terminalizing) {
+          outcome = {
+            id: randomUUID(),
+            turnId: this.currentId,
+            content: renderTurnCancellationReminder(reason, isUserCancellation(reason)),
+          };
+        }
+        if (outcome !== undefined) {
+          outcomeReservedByShutdown = !this.pendingOutcomes.has(outcome.id);
+          this.pendingOutcomes.set(outcome.id, outcome);
+        }
+      } catch (error) {
+        this.bestEffortWarn('failed to render turn shutdown reminder', { error });
+      }
+    }
+    let recordFailed = false;
+    let recordError: unknown;
+    const cleanup: Promise<unknown>[] = [];
+    if (active !== undefined) cleanup.push(active.promise);
+    if (admittedActive !== undefined || deferred !== undefined) {
+      try {
+        this.agent.records.logRecord({
+          type: 'turn.cancel',
+          promptId: admittedActive?.promptId ?? deferred?.promptId,
+          ownerTurnId: admittedActive?.turnId,
+          ownerDeferredPromptId: deferred?.id,
+          outcomeId: outcome?.id,
+          outcomeTurnId: outcome?.turnId,
+          outcomeContent: outcome?.content,
+          cancelledTurnInputs:
+            cancelledTurnInputs.length === 0 ? undefined : cancelledTurnInputs,
+        });
+      } catch (error) {
+        if (agentRecordAppendAccepted(error) === false) {
+          // A rejected shutdown record cannot authorize any local teardown.
+          // Restore the exact pre-shutdown reservations so the live worker and
+          // a future replay continue from the same admitted state.
+          if (outcomeReservedByShutdown && outcome !== undefined) {
+            this.pendingOutcomes.delete(outcome.id);
+          }
+          this.closed = closedBeforeShutdown;
+          this.deferredPrompts = deferredPromptsBeforeShutdown;
+          this.steerBuffer = steerBufferBeforeShutdown;
+          if (this.shutdownPromise === completion) this.shutdownPromise = null;
+          completion.reject(error);
+          return completion;
+        }
+        recordFailed = true;
+        recordError = error;
+      }
+    }
+    try {
+      this.agent.context.cancelTurnInputExpansions(cancelledTurnInputs);
+    } catch (error) {
+      recordFailed = true;
+      recordError ??= error;
+    }
+    if (active !== undefined) {
+      try {
+        active.controller.abort(reason);
+      } catch (error) {
+        cleanup.push(Promise.reject(error));
+      }
+    } else if (this.activeTurn === 'resuming') {
+      this.activeTurn = null;
+    }
+
+    try {
+      cleanup.push(this.agent.fullCompaction.cancel());
+    } catch (error) {
+      cleanup.push(Promise.reject(error));
+    }
+    try {
+      cleanup.push(this.agent.subagentHost?.cancelAll(reason) ?? Promise.resolve());
+    } catch (error) {
+      cleanup.push(Promise.reject(error));
+    }
+    const barrier = Promise.allSettled(cleanup).then((settlements) => {
+      if (recordFailed) throw recordError;
+      const rejected = settlements.find(
+        (result): result is PromiseRejectedResult => result.status === 'rejected',
+      );
+      if (rejected !== undefined) throw rejected.reason;
+    });
+    void barrier.then(completion.resolve, completion.reject);
+    return completion;
+  }
+
+  /**
+   * Whether the requested turn id belongs to the worker that is active now.
+   * Goal continuations allocate multiple ids inside one worker, so callers
+   * must use this predicate both when cancelling and when capturing the
+   * worker's terminal barrier.
+   */
+  isActiveTurn(turnId?: number): boolean {
+    if (!this.hasActiveTurn) return false;
+    return turnId === undefined || this.activeWorkerOwnsTurn(turnId);
+  }
+
+  /**
+   * A goal drive keeps one worker alive while allocating a new id for each
+   * continuation turn. An RPC issued for an earlier turn in that same worker
+   * must still cancel it, but the same stale id must not cancel a replacement
+   * worker launched after the original worker settled.
+   */
+  private activeWorkerOwnsTurn(turnId: number): boolean {
+    const active = this.activeTurn;
+    return (
+      active !== null &&
+      active !== 'resuming' &&
+      turnId >= active.turnId &&
+      turnId <= this.currentId
+    );
   }
 
   get currentId() {
@@ -284,6 +1202,10 @@ export class TurnFlow {
     return this.activeTurn !== null && this.activeTurn !== 'resuming';
   }
 
+  get isClosed(): boolean {
+    return this.closed;
+  }
+
   private ensureActiveTurn(): ActiveTurn {
     if (this.activeTurn === null || this.activeTurn === 'resuming') {
       throw new Error('No active turn');
@@ -291,15 +1213,24 @@ export class TurnFlow {
     return this.activeTurn;
   }
 
-  waitForCurrentTurn(signal?: AbortSignal | undefined): Promise<TurnEndResult> {
+  waitForCurrentTurn(signal?: AbortSignal): Promise<TurnEndResult> {
     const active = this.ensureActiveTurn();
-    signal?.throwIfAborted();
     if (signal === undefined) return active.promise;
 
-    const turnId = this.currentId;
     const onAbort = (): void => {
-      this.agent.turn.cancel(turnId, signal.reason);
+      // A goal drive reuses one active worker across multiple turn IDs. Cancel
+      // that captured worker rather than the ID that happened to be current
+      // when this wait began, while also avoiding a later replacement turn.
+      if (this.activeTurn === active) {
+        void this.agent.turn.cancel(undefined, signal.reason).catch((error: unknown) => {
+          this.bestEffortError('failed to cancel turn after waiter abort', { error });
+        });
+      }
     };
+    if (signal.aborted) {
+      onAbort();
+      signal.throwIfAborted();
+    }
     signal.addEventListener('abort', onAbort, { once: true });
 
     return abortable(active.promise, signal).finally(() => {
@@ -311,27 +1242,178 @@ export class TurnFlow {
     return this.ensureActiveTurn().firstRequest;
   }
 
-  private abortTurn(reason: unknown) {
-    if (this.activeTurn !== 'resuming') {
-      // The reason (a user cancellation by default, or the originating signal's
-      // reason when propagated) travels as signal.reason so tools settling on
-      // this signal can report a deliberate user interruption distinctly from a
-      // timeout/system abort. linkAbortSignal forwards it to linked subagents.
-      this.activeTurn?.controller.abort(reason);
+  private abortTurn(reason: unknown): void {
+    if (this.activeTurn === 'resuming') {
+      this.activeTurn = null;
+      return;
     }
-    this.activeTurn = null;
+    if (this.activeTurn === null) return;
+
+    // Keep the turn active until its worker has closed any open tool exchange,
+    // appended the terminal outcome reminder, and emitted turn.ended. This
+    // lets the RPC cancellation wait on a true terminal barrier and prevents a
+    // follow-up turn from overlapping the cancelled turn's asynchronous cleanup.
+    const cancelledTurn = this.activeTurn;
+    // The reason (a user cancellation by default, or the originating signal's
+    // reason when propagated) travels as signal.reason so tools settling on
+    // this signal can report a deliberate user interruption distinctly from a
+    // timeout/system abort. linkAbortSignal forwards it to linked subagents.
+    cancelledTurn.controller.abort(reason);
   }
 
   private flushSteerBuffer(): boolean {
-    const steers = this.steerBuffer;
-    if (steers.length === 0) return false;
-    for (const steer of steers) {
-      this.agent.context.appendUserMessage(steer.input, steer.origin);
+    if (this.steerBuffer.length === 0) return false;
+    while (this.steerBuffer.length > 0) {
+      const steer = this.steerBuffer[0]!;
+      try {
+        this.agent.context.appendUserMessage(
+          steer.input,
+          steer.origin,
+          steer.admissionId === undefined
+            ? undefined
+            : { kind: 'steer', id: steer.admissionId, turnId: this.currentId },
+        );
+      } catch (error) {
+        const active = this.activeTurn;
+        if (active !== null && active !== 'resuming') {
+          active.steerFlushFailed = true;
+          active.steerFlushError = error;
+        }
+        throw error;
+      }
+      // Remove only after append succeeds. If a later item fails, earlier
+      // committed items are not replayed by a retry. A persistence observer
+      // may synchronously cancel and replace the buffer while append runs, so
+      // remove the captured item by identity rather than shifting a new head.
+      const index = this.steerBuffer.indexOf(steer);
+      if (index !== -1) this.steerBuffer.splice(index, 1);
     }
-    steers.length = 0;
     return true;
   }
 
+  private sealAndFlushSteers(turnId: number): { error: unknown } | undefined {
+    this.closeSteerAdmission(turnId);
+    const active = this.activeTurn;
+    if (active !== null && active !== 'resuming' && active.steerFlushFailed) {
+      this.steerBuffer.length = 0;
+      return { error: active.steerFlushError };
+    }
+    try {
+      this.flushSteerBuffer();
+      return undefined;
+    } catch (error) {
+      // A terminal worker cannot carry unpersisted input into a later prompt:
+      // that would reorder it behind newer user input. The durable turn.steer
+      // record remains available for diagnostics, while this turn reports the
+      // persistence failure and still emits its terminal event.
+      this.steerBuffer.length = 0;
+      return { error };
+    }
+  }
+
+  private closeSteerAdmission(turnId: number): void {
+    const active = this.activeTurn;
+    if (
+      active !== null &&
+      active !== 'resuming' &&
+      this.activeWorkerOwnsTurn(turnId)
+    ) {
+      active.terminalizing = true;
+    }
+  }
+
+  private discardSteersOwnedBy(
+    promptId: string | undefined,
+    ownerTurnId: number | undefined,
+    ownerDeferredPromptId: string | undefined,
+  ): void {
+    if (
+      promptId === undefined &&
+      ownerTurnId === undefined &&
+      ownerDeferredPromptId === undefined
+    ) {
+      return;
+    }
+    this.steerBuffer = this.steerBuffer.filter(
+      (steer) =>
+        !this.isSteerOwnedBy(steer, promptId, ownerTurnId, ownerDeferredPromptId),
+    );
+  }
+
+  private collectIncompleteTurnInputsOwnedBy(
+    ownsActiveTurn: boolean,
+    promptId: string | undefined,
+    ownerTurnId: number | undefined,
+    ownerDeferredPromptId: string | undefined,
+  ): TurnInputConsumption[] {
+    const inputs = new Map<string, TurnInputConsumption>();
+    const add = (kind: TurnInputConsumption['kind'], id: string | undefined): void => {
+      if (id === undefined) return;
+      inputs.set(`${kind}:${id}`, { kind, id, turnId: this.currentId });
+    };
+    const active = this.activeTurn;
+    if (ownsActiveTurn && active !== null && active !== 'resuming') {
+      if (
+        active.admission !== undefined &&
+        this.agent.context.hasIncompleteTurnInput(active.admission)
+      ) {
+        add(active.admission.kind, active.admission.id);
+      }
+    }
+    for (const steer of this.steerBuffer) {
+      if (
+        steer.admissionId !== undefined &&
+        this.isSteerOwnedBy(steer, promptId, ownerTurnId, ownerDeferredPromptId) &&
+        this.agent.context.hasIncompleteTurnInput({ kind: 'steer', id: steer.admissionId })
+      ) {
+        add('steer', steer.admissionId);
+      }
+    }
+    return [...inputs.values()];
+  }
+
+  private isSteerOwnedBy(
+    steer: BufferedSteer,
+    promptId: string | undefined,
+    ownerTurnId: number | undefined,
+    ownerDeferredPromptId: string | undefined,
+  ): boolean {
+    if (
+      promptId === undefined &&
+      ownerTurnId === undefined &&
+      ownerDeferredPromptId === undefined
+    ) {
+      return false;
+    }
+    if (promptId !== undefined) return steer.expectedPromptId === promptId;
+    if (ownerTurnId !== undefined) {
+      return steer.expectedPromptId === undefined && steer.ownerTurnId === ownerTurnId;
+    }
+    return (
+      steer.expectedPromptId === undefined &&
+      steer.ownerDeferredPromptId === ownerDeferredPromptId
+    );
+  }
+
+  private discardPromptsOwnedBy(
+    promptId: string | undefined,
+    ownerTurnId: number | undefined,
+    ownerDeferredPromptId: string | undefined,
+  ): void {
+    if (
+      promptId === undefined &&
+      ownerTurnId === undefined &&
+      ownerDeferredPromptId === undefined
+    ) {
+      return;
+    }
+    this.deferredPrompts = this.deferredPrompts.filter((prompt) => {
+      if (promptId !== undefined) return prompt.promptId !== promptId;
+      if (ownerTurnId !== undefined) return prompt.turnId !== ownerTurnId;
+      return prompt.id !== ownerDeferredPromptId;
+    });
+  }
+
   /**
    * Replay inputs (prompts or steers) that were deferred while a manual compaction
    * held the context. Called by `FullCompaction` once the compaction lifecycle
@@ -342,20 +1424,85 @@ export class TurnFlow {
    * draining into it via `flushSteerBuffer`.
    */
   onCompactionFinished(): void {
+    if (this.closed) {
+      this.deferredPrompts.length = 0;
+      this.steerBuffer.length = 0;
+      return;
+    }
+    // Resume may rebuild pending admissions before a committed compaction has
+    // finished its post-commit recovery. Keep them parked behind that durable
+    // reservation; converting a steer through launch() here would misclassify
+    // its consumption as a prompt and could deliver it twice.
+    if (this.agent.fullCompaction.isCompacting) return;
+    if (this.startNextDeferredPrompt()) return;
     if (this.steerBuffer.length === 0) return;
     if (this.activeTurn !== null) {
       this.flushSteerBuffer();
       return;
     }
-    const next = this.steerBuffer.shift()!;
-    this.launch(next.input, next.origin);
+    const next = this.steerBuffer[0]!;
+    if (next.admissionId === undefined) this.steerBuffer.shift();
+    const result = this.launch(
+      next.input,
+      next.origin,
+      undefined,
+      next.admissionId === undefined
+        ? undefined
+        : { kind: 'steer', id: next.admissionId },
+    );
+    if (result.kind === 'busy' && next.admissionId === undefined) {
+      this.steerBuffer.unshift(next);
+    }
   }
 
   finishResume(): void {
-    if (this.activeTurn === 'resuming') {
-      this.activeTurn = null;
+    // Hold a synchronous launch/cancel reservation while converging outcome
+    // acknowledgements. Persistence observers may re-enter public APIs; none
+    // may overtake this barrier or recursively materialize the same outcome.
+    this.activeTurn ??= 'resuming';
+    // New records have explicit admission/consumption identities: every
+    // remaining identified steer is genuinely pending. Preserve the old
+    // heuristic only for legacy records that predate those identities.
+    this.steerBuffer = this.steerBuffer.filter(
+      (steer) => steer.admissionId !== undefined || steer.restorePending === true,
+    );
+    for (const steer of this.steerBuffer) steer.restorePending = false;
+    // A crash can leave a durable cancellation/failure intent immediately
+    // before its context append. Complete those appends before any recovered
+    // prompt or steer is allowed to start a model request.
+    this.materializePendingOutcomes();
+    if (this.activeTurn === 'resuming') this.activeTurn = null;
+    if (this.startNextDeferredPrompt()) return;
+    this.onCompactionFinished();
+  }
+
+  private startNextDeferredPrompt(): boolean {
+    if (
+      this.closed ||
+      this.activeTurn !== null ||
+      this.agent.fullCompaction.isCompacting ||
+      this.deferredPrompts.length === 0
+    ) {
+      return false;
     }
-    this.steerBuffer.length = 0;
+    const next = this.deferredPrompts[0]!;
+    const legacy = next.admissionId === undefined;
+    if (legacy) this.deferredPrompts.shift();
+    try {
+      this.startTurn(
+        next.input,
+        next.origin,
+        next.id,
+        next.promptId,
+        next.admissionId === undefined
+          ? undefined
+          : { kind: 'prompt', id: next.admissionId },
+      );
+    } catch (error) {
+      if (legacy && !this.closed) this.deferredPrompts.unshift(next);
+      throw error;
+    }
+    return true;
   }
 
   /**
@@ -369,6 +1516,9 @@ export class TurnFlow {
     input: readonly ContentPart[],
     origin: PromptOrigin,
     signal: AbortSignal,
+    deferredPromptId?: string,
+    promptId?: string,
+    admission?: Pick<TurnInputConsumption, 'kind' | 'id'>,
   ): Promise<TurnEndResult> {
     const ownsActiveTurn = (): boolean =>
       this.activeTurn !== null &&
@@ -377,9 +1527,26 @@ export class TurnFlow {
     try {
       const initialGoalStatus = this.agent.goal.getGoal().goal?.status;
       if (initialGoalStatus === 'active') {
-        return await this.driveGoal(firstTurnId, input, origin, signal);
+        return await this.driveGoal(
+          firstTurnId,
+          input,
+          origin,
+          signal,
+          deferredPromptId,
+          promptId,
+          admission,
+        );
       }
-      const end = await this.runOneTurn(firstTurnId, input, origin, signal, true);
+      const end = await this.runOneTurn(
+        firstTurnId,
+        input,
+        origin,
+        signal,
+        true,
+        deferredPromptId,
+        promptId,
+        admission,
+      );
       // A goal can become active during an ordinary turn: the model creates one
       // with CreateGoal, or resumes a paused/blocked goal via UpdateGoal. Either
       // way, hand the now-active goal to the driver so it is actually pursued,
@@ -410,10 +1577,24 @@ export class TurnFlow {
     } finally {
       if (ownsActiveTurn()) {
         this.activeTurn = null;
+        // A deferred/buffered admission whose context commit failed remains in
+        // memory for durable recovery. Do not spin by immediately retrying the
+        // same failing append; all normally consumed admissions can drain the
+        // next prompt/background notification now.
+        if (!this.isAdmissionPending(admission)) this.onCompactionFinished();
       }
     }
   }
 
+  private isAdmissionPending(
+    admission: Pick<TurnInputConsumption, 'kind' | 'id'> | undefined,
+  ): boolean {
+    if (admission === undefined) return false;
+    return admission.kind === 'prompt'
+      ? this.deferredPrompts.some((prompt) => prompt.admissionId === admission.id)
+      : this.steerBuffer.some((steer) => steer.admissionId === admission.id);
+  }
+
   /**
    * Drives an active goal as a sequence of ordinary turns — the autonomous
    * equivalent of the user repeatedly typing "continue". Each iteration runs one
@@ -429,15 +1610,31 @@ export class TurnFlow {
     input: readonly ContentPart[],
     origin: PromptOrigin,
     signal: AbortSignal,
+    firstDeferredPromptId?: string,
+    firstPromptId?: string,
+    firstAdmission?: Pick<TurnInputConsumption, 'kind' | 'id'>,
   ): Promise<TurnEndResult> {
     let turnId = firstTurnId;
     let turnInput = input;
     let turnOrigin = origin;
+    let deferredPromptId = firstDeferredPromptId;
+    let promptId = firstPromptId;
+    let admission = firstAdmission;
     while (true) {
       const goalBeforeTurn = this.agent.goal.getGoal().goal;
       if (goalBeforeTurn?.status === 'active' && goalBeforeTurn.budget.overBudget) {
+        // No model step will run, so close targeted steer admission before the
+        // asynchronous goal update creates a window for a falsely-ACKed steer.
+        this.closeSteerAdmission(turnId);
         await this.agent.goal.markBlocked({ reason: 'A configured budget was reached' });
-        const ended = await this.endGoalTurnWithoutModel(turnId, turnInput, turnOrigin);
+        const ended = await this.endGoalTurnWithoutModel(
+          turnId,
+          turnInput,
+          turnOrigin,
+          deferredPromptId,
+          promptId,
+          admission,
+        );
         return { event: ended };
       }
 
@@ -446,7 +1643,16 @@ export class TurnFlow {
       // Wall-clock is tracked live by the store (anchored while `active`), so the
       // timer is correct even when the model completes mid-turn.
       await this.agent.goal.incrementTurn();
-      const end = await this.runOneTurn(turnId, turnInput, turnOrigin, signal, false);
+      const end = await this.runOneTurn(
+        turnId,
+        turnInput,
+        turnOrigin,
+        signal,
+        false,
+        deferredPromptId,
+        promptId,
+        admission,
+      );
 
       if (end.event.reason === 'cancelled') {
         await this.agent.goal.pauseOnInterrupt({ reason: 'Paused after interruption' });
@@ -476,9 +1682,17 @@ export class TurnFlow {
         return end;
       }
 
+      // Background/cron notifications may arrive while the completed goal
+      // turn is awaiting goal-store bookkeeping. Commit them before appending
+      // the synthetic continuation prompt so durable arrival order is kept.
+      this.flushSteerBuffer();
+
       turnId = this.allocateTurnId();
       turnInput = [{ type: 'text', text: GOAL_CONTINUATION_PROMPT }];
       turnOrigin = GOAL_CONTINUATION_ORIGIN;
+      deferredPromptId = undefined;
+      promptId = undefined;
+      admission = undefined;
     }
   }
 
@@ -486,19 +1700,45 @@ export class TurnFlow {
     turnId: number,
     input: readonly ContentPart[],
     origin: PromptOrigin,
+    deferredPromptId?: string,
+    promptId?: string,
+    admission?: Pick<TurnInputConsumption, 'kind' | 'id'>,
   ): Promise<TurnEndedEvent> {
     this.agent.usage.beginTurn();
     const startedAt = Date.now();
-    this.agent.emitEvent({ type: 'turn.started', turnId, origin });
-    this.agent.context.appendUserMessage(input, origin);
-    const ended: TurnEndedEvent = {
+    this.agent.emitEvent({ type: 'turn.started', turnId, origin, promptId, deferredPromptId });
+    this.agent.context.appendUserMessage(
+      input,
+      origin,
+      admission === undefined ? undefined : { ...admission, turnId },
+    );
+    let ended: TurnEndedEvent = {
       type: 'turn.ended',
       turnId,
       reason: 'completed',
       durationMs: Date.now() - startedAt,
     };
+    let errorEvent: AgentEvent | undefined;
+    const steerFlushError = this.sealAndFlushSteers(turnId);
+    if (steerFlushError !== undefined) {
+      const summary = summarizeTurnError(steerFlushError.error, turnId);
+      ended = {
+        type: 'turn.ended',
+        turnId,
+        reason: 'failed',
+        error: summary,
+        durationMs: Date.now() - startedAt,
+      };
+      errorEvent = { type: 'error', ...summary };
+      try {
+        this.appendTurnOutcomeReminder(ended, undefined);
+      } catch (error) {
+        this.bestEffortError('goal turn terminal reminder failed', { error, turnId });
+      }
+    }
     this.agent.usage.endTurn();
     this.agent.emitEvent(ended);
+    if (errorEvent !== undefined) this.agent.emitEvent(errorEvent);
     return ended;
   }
 
@@ -514,7 +1754,18 @@ export class TurnFlow {
     origin: PromptOrigin,
     signal: AbortSignal,
     standalone: boolean,
+    deferredPromptId?: string,
+    promptId?: string,
+    admission?: Pick<TurnInputConsumption, 'kind' | 'id'>,
   ): Promise<TurnEndResult> {
+    const active = this.activeTurn;
+    if (
+      active !== null &&
+      active !== 'resuming' &&
+      this.activeWorkerOwnsTurn(turnId)
+    ) {
+      active.terminalizing = false;
+    }
     this.currentStep = 0;
     this.stepToolCallKeys.clear();
     this.toolCallDupType.clear();
@@ -524,8 +1775,12 @@ export class TurnFlow {
     this.agent.telemetry.track('turn_started', { turn_id: turnId, mode: telemetryMode, ...this.requestProtocolProps() });
     this.agent.fullCompaction.resetForTurn();
     this.agent.usage.beginTurn();
-    this.agent.emitEvent({ type: 'turn.started', turnId, origin });
-    this.agent.context.appendUserMessage(input, origin);
+    this.agent.emitEvent({ type: 'turn.started', turnId, origin, promptId, deferredPromptId });
+    this.agent.context.appendUserMessage(
+      input,
+      origin,
+      admission === undefined ? undefined : { ...admission, turnId },
+    );
 
     const startedAt = Date.now();
     let ended: TurnEndedEvent;
@@ -553,7 +1808,12 @@ export class TurnFlow {
           };
           errorEvent = { type: 'error', ...summary };
         } else {
-          const reason: TurnEndReason = stopReason === 'aborted' ? 'cancelled' : 'completed';
+          // A synchronous context/persistence observer can cancel while the
+          // loop is flushing accepted steers after a provider response. The
+          // loop may still report its prior stop reason, so the signal is the
+          // final authority at this boundary.
+          const reason: TurnEndReason =
+            stopReason === 'aborted' || signal.aborted ? 'cancelled' : 'completed';
           ended = {
             type: 'turn.ended',
             turnId,
@@ -563,7 +1823,7 @@ export class TurnFlow {
         }
       }
     } catch (error) {
-      if (isAbortError(error)) {
+      if (isAbortError(error) || signal.aborted) {
         ended = { type: 'turn.ended', turnId, reason: 'cancelled', durationMs: Date.now() - startedAt };
       } else {
         const summary = summarizeTurnError(error, turnId);
@@ -594,11 +1854,60 @@ export class TurnFlow {
         }
       }
     }
+    if (ended.reason === 'failed' || ended.reason === 'cancelled') {
+      try {
+        this.ensureTurnOutcomeIntent(ended, signal.reason);
+      } catch (error) {
+        // The worker still has a chance to materialize the reserved intent
+        // below. Never let reminder persistence suppress turn terminalization.
+        this.bestEffortError('turn outcome intent persistence failed', { error, turnId });
+      }
+    }
     // A live turn must never end with recorded tool calls still awaiting
     // results; if one does (a dispatch failure mid-batch broke the "every
     // recorded call gets a result" invariant), close the exchange now so the
     // context state machine cannot strand later messages in deferredMessages.
     this.closeAbandonedToolExchange(ended);
+    // Seal steer admission at the unified terminal boundary, including paths
+    // that never entered shouldContinueAfterStop (provider failure, prompt-hook
+    // block/failure, cancellation). Anything already acknowledged belongs to
+    // this turn and must land before its outcome reminder; otherwise a later
+    // prompt would reorder older steer input behind itself.
+    const recordTerminalizationFailure = (error: unknown): void => {
+      if (ended.reason === 'completed' || ended.reason === 'blocked') {
+        const summary = summarizeTurnError(error, turnId);
+        ended = {
+          type: 'turn.ended',
+          turnId,
+          reason: 'failed',
+          error: summary,
+          durationMs: Date.now() - startedAt,
+        };
+        errorEvent = { type: 'error', ...summary };
+        try {
+          this.ensureTurnOutcomeIntent(ended, signal.reason);
+        } catch (outcomeError) {
+          this.bestEffortError('turn outcome intent persistence failed', {
+            error: outcomeError,
+            turnId,
+          });
+        }
+        return;
+      }
+      this.bestEffortError('turn terminal context finalization failed', {
+        error,
+        turnId,
+      });
+    };
+    const steerFlushError = this.sealAndFlushSteers(turnId);
+    if (steerFlushError !== undefined) {
+      recordTerminalizationFailure(steerFlushError.error);
+    }
+    try {
+      this.appendTurnOutcomeReminder(ended, signal.reason);
+    } catch (error) {
+      recordTerminalizationFailure(error);
+    }
     // Emit the terminal turn.ended and (for a standalone turn) release the active
     // turn in the SAME synchronous frame, so the session is observably idle the
     // instant turn.ended fires. A goal drive keeps the active turn across its
@@ -666,6 +1975,66 @@ export class TurnFlow {
     return { event: ended, stopReason: completedStopReason, blockedByUserPromptHook };
   }
 
+  private appendTurnOutcomeReminder(ended: TurnEndedEvent, cancellationReason: unknown): void {
+    const outcome = this.ensureTurnOutcomeIntent(ended, cancellationReason);
+    if (outcome === undefined) return;
+    this.materializeTurnOutcome(outcome);
+  }
+
+  /**
+   * Persist the fact that an abnormal turn still needs a model-visible
+   * reminder. Cancellation normally installs this intent atomically on
+   * `turn.cancel`; failures get their own record as soon as their terminal
+   * outcome is known.
+   */
+  private ensureTurnOutcomeIntent(
+    ended: TurnEndedEvent,
+    cancellationReason: unknown,
+  ): PendingTurnOutcome | undefined {
+    if (ended.reason !== 'failed' && ended.reason !== 'cancelled') return undefined;
+    const existing = [...this.pendingOutcomes.values()].find(
+      (outcome) => outcome.turnId === ended.turnId,
+    );
+    if (existing !== undefined) return existing;
+
+    const content =
+      ended.reason === 'failed'
+        ? renderTurnFailureReminder(ended.error)
+        : renderTurnCancellationReminder(
+            cancellationReason,
+            isUserCancellation(cancellationReason),
+          );
+    const outcome = { id: randomUUID(), turnId: ended.turnId, content };
+    // Reserve before persistence so a synchronous record observer that
+    // re-enters terminalization sees one stable identity, never two.
+    this.pendingOutcomes.set(outcome.id, outcome);
+    this.agent.records.logRecord({
+      type: 'turn.outcome',
+      outcomeId: outcome.id,
+      turnId: outcome.turnId,
+      content: outcome.content,
+    });
+    return outcome;
+  }
+
+  private materializeTurnOutcome(outcome: PendingTurnOutcome): void {
+    this.agent.context.appendSystemReminder(
+      outcome.content,
+      {
+        kind: 'injection',
+        variant: TURN_OUTCOME_REMINDER_VARIANT,
+      },
+      undefined,
+      outcome.id,
+    );
+  }
+
+  private materializePendingOutcomes(): void {
+    for (const outcome of this.pendingOutcomes.values()) {
+      this.materializeTurnOutcome(outcome);
+    }
+  }
+
   private async applyUserPromptHook(
     turnId: number,
     input: readonly ContentPart[],
@@ -740,16 +2109,27 @@ export class TurnFlow {
       mediaStripSnapshot ??= captureMediaStripSnapshot(messages);
       return stripMediaPartsBySnapshot(messages, mediaStripSnapshot);
     };
+    let turnLlm = this.agent.llm;
+    let systemPromptRefreshSnapshot = this.agent.fullCompaction.systemPromptRefreshSnapshot;
     while (true) {
       signal.throwIfAborted();
-      const model = this.agent.config.model;
       const loopControl = this.agent.kimiConfig?.loopControl;
       let stopForGoalBudget = false;
       try {
         const result = await runTurn({
           turnId: String(turnId),
           signal,
-          llm: this.agent.llm,
+          llm: turnLlm,
+          buildLlm: () => {
+            const snapshot = this.agent.fullCompaction.systemPromptRefreshSnapshot;
+            if (snapshot.revision !== systemPromptRefreshSnapshot.revision) {
+              systemPromptRefreshSnapshot = snapshot;
+              if (snapshot.systemPrompt !== undefined) {
+                turnLlm = turnLlm.withSystemPrompt(snapshot.systemPrompt);
+              }
+            }
+            return turnLlm;
+          },
           buildMessages: () => this.agent.context.messages,
           buildMessagesStrict: () => this.agent.context.strictMessages,
           buildMessagesMediaDegraded: () => this.agent.context.mediaDegradedMessages,
@@ -785,8 +2165,8 @@ export class TurnFlow {
               deduper.beginStep();
               return;
             },
-            afterStep: async ({ usage }) => {
-              this.agent.usage.record(model, usage, 'turn');
+            afterStep: async ({ usage, llm }) => {
+              this.agent.usage.record(llm.modelName, usage, 'turn');
               await this.agent.fullCompaction.afterStep();
               deduper.endStep();
               return stopForGoalBudget ? { stopTurn: true } : undefined;
@@ -804,6 +2184,7 @@ export class TurnFlow {
               //    turn. A goal the model just marked terminal is no longer
               //    active, so its final outcome message (step 2 below) still runs.
               if (stopForGoalBudget && this.agent.goal.getActiveGoal() !== null) {
+                this.closeSteerAdmission(turnId);
                 return { continue: false };
               }
               // 1. If steered user messages were flushed and no active-goal
@@ -844,6 +2225,7 @@ export class TurnFlow {
                 goalOutcomeMessageContinuationUsed = true;
                 goalOutcomeToolResultPending = false;
                 if (!hasStepBudgetRemaining(loopControl?.maxStepsPerTurn, ctx.stepNumber)) {
+                  this.closeSteerAdmission(turnId);
                   return { continue: false };
                 }
                 return { continue: true };
@@ -873,6 +2255,12 @@ export class TurnFlow {
               // 4. Otherwise stop. Goal continuation is no longer driven here:
               //    each goal turn is an ordinary turn, and the goal driver decides
               //    whether to run another after this one ends.
+              // Re-check after the asynchronous Stop hook. A steer accepted
+              // while that hook was pending must either get a model step in
+              // this turn or be rejected once the terminal gate closes; it
+              // must never receive an ACK and leak into a future prompt.
+              if (this.flushSteerBuffer()) return { continue: true };
+              this.closeSteerAdmission(turnId);
               return { continue: false };
             },
             prepareToolExecution: async (ctx) => {
@@ -964,7 +2352,7 @@ export class TurnFlow {
         abandonedToolResultOutput(ended),
       );
       if (closed === 0) return;
-      this.agent.log.warn('closed abandoned tool exchange at turn end', {
+      this.bestEffortWarn('closed abandoned tool exchange at turn end', {
         turnId: ended.turnId,
         reason: ended.reason,
         closed,
@@ -974,7 +2362,7 @@ export class TurnFlow {
         closed,
       });
     } catch (error) {
-      this.agent.log.warn('failed to close abandoned tool exchange', { error });
+      this.bestEffortWarn('failed to close abandoned tool exchange', { error });
     }
   }
 
diff --git a/packages/agent-core/src/agent/turn/kosong-llm.ts b/packages/agent-core/src/agent/turn/kosong-llm.ts
index 2e0e4beea7..6f8667d88e 100644
--- a/packages/agent-core/src/agent/turn/kosong-llm.ts
+++ b/packages/agent-core/src/agent/turn/kosong-llm.ts
@@ -86,6 +86,24 @@ export class KosongLLM implements LLM {
     this.usedContextTokens = config.usedContextTokens;
   }
 
+  /**
+   * Refresh only the prompt text while preserving this turn's provider,
+   * capability, completion budget, and transport. Full compaction uses this
+   * after it re-renders the active profile; ordinary mid-turn config updates
+   * must remain deferred until the next turn.
+   */
+  withSystemPrompt(systemPrompt: string): KosongLLM {
+    if (systemPrompt === this.systemPrompt) return this;
+    return new KosongLLM({
+      provider: this.provider,
+      systemPrompt,
+      capability: this.capability,
+      generate: this.generate,
+      completionBudgetConfig: this.completionBudgetConfig,
+      usedContextTokens: this.usedContextTokens,
+    });
+  }
+
   async chat(params: LLMChatParams): Promise<LLMChatResponse> {
     let requestStartedAt = Date.now();
     let requestSentAt: number | undefined;
diff --git a/packages/agent-core/src/agent/turn/outcome-reminder.ts b/packages/agent-core/src/agent/turn/outcome-reminder.ts
new file mode 100644
index 0000000000..938b5e65de
--- /dev/null
+++ b/packages/agent-core/src/agent/turn/outcome-reminder.ts
@@ -0,0 +1,95 @@
+import { escapeXml } from '../../utils/xml-escape';
+
+export const TURN_OUTCOME_REMINDER_VARIANT = 'turn_outcome';
+
+const MAX_ERROR_SUMMARY_LENGTH = 500;
+
+interface TurnErrorSummary {
+  readonly code: string;
+  readonly message: string;
+  readonly name?: string;
+  readonly details?: Readonly<Record<string, unknown>>;
+}
+
+export function renderTurnFailureReminder(error: TurnErrorSummary | undefined): string {
+  return [
+    'The previous turn ended before producing a final response.',
+    '',
+    `Error: ${renderPublicError(error)}`,
+    '',
+    'The preceding user request may still be unfinished. Treat the next user message as a follow-up.',
+  ].join('\n');
+}
+
+export function renderTurnCancellationReminder(reason: unknown, userInitiated: boolean): string {
+  const lines = [
+    userInitiated
+      ? 'The user interrupted the previous turn before it finished.'
+      : 'The previous turn was interrupted by the runtime before it finished.',
+  ];
+  const renderedReason = userInitiated ? undefined : renderInterruptionReason(reason);
+  if (renderedReason !== undefined) lines.push('', `Reason: ${renderedReason}`);
+  lines.push(
+    '',
+    'Some operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.',
+  );
+  return lines.join('\n');
+}
+
+function renderPublicError(error: TurnErrorSummary | undefined): string {
+  if (error === undefined) return 'The turn failed.';
+  switch (error.code) {
+    case 'provider.api_error': {
+      const statusCode = numericDetail(error, 'statusCode');
+      return statusCode === undefined
+        ? 'The model provider API request failed.'
+        : `API request failed with HTTP ${String(statusCode)}.`;
+    }
+    case 'provider.rate_limit':
+      return 'The model provider rate-limited the request.';
+    case 'provider.auth_error':
+      return 'Authentication with the model provider failed.';
+    case 'provider.connection_error':
+      return error.name?.toLowerCase().includes('timeout') === true
+        ? 'The model provider request timed out.'
+        : 'The request could not reach the model provider.';
+    case 'provider.filtered':
+      return 'The model provider blocked the response due to its safety policy.';
+    case 'context.overflow':
+      return 'The request exceeded the model context limit.';
+    case 'loop.max_steps_exceeded': {
+      const maxSteps = numericDetail(error, 'maxSteps');
+      return maxSteps === undefined
+        ? 'The turn exceeded its step limit.'
+        : `The turn exceeded its ${String(maxSteps)}-step limit.`;
+    }
+    case 'model.not_configured':
+      return 'No model is configured.';
+    case 'model.config_invalid':
+      return 'The model configuration is invalid.';
+    default:
+      return escapeXml(normalizeSummary(error.message) || 'The turn failed.');
+  }
+}
+
+function renderInterruptionReason(reason: unknown): string | undefined {
+  const raw = reason instanceof Error ? reason.message : typeof reason === 'string' ? reason : undefined;
+  if (raw === undefined) return undefined;
+  const normalized = normalizeSummary(raw);
+  if (normalized.length === 0 || normalized === 'Aborted' || normalized === 'This operation was aborted') {
+    return undefined;
+  }
+  return escapeXml(normalized);
+}
+
+function numericDetail(error: TurnErrorSummary, key: string): number | undefined {
+  const value = error.details?.[key];
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+
+function normalizeSummary(value: string): string {
+  const normalized = value.replaceAll(/\s+/g, ' ').trim();
+  return normalized.length <= MAX_ERROR_SUMMARY_LENGTH
+    ? normalized
+    : `${normalized.slice(0, MAX_ERROR_SUMMARY_LENGTH - 3)}...`;
+}
diff --git a/packages/agent-core/src/index.ts b/packages/agent-core/src/index.ts
index 97ccf3f068..e0220edaba 100644
--- a/packages/agent-core/src/index.ts
+++ b/packages/agent-core/src/index.ts
@@ -60,6 +60,7 @@ export type { ToolServices } from './tools/support/services';
 // them without a deep subpath.
 export {
   buildImageCompressionCaption,
+  extractImageCompressionCaptions,
   compressImageForModel,
   compressBase64ForModel,
   compressImageContentParts,
diff --git a/packages/agent-core/src/loop/run-turn.ts b/packages/agent-core/src/loop/run-turn.ts
index f681e73999..e0fe79913f 100644
--- a/packages/agent-core/src/loop/run-turn.ts
+++ b/packages/agent-core/src/loop/run-turn.ts
@@ -61,6 +61,12 @@ export interface RunTurnInput {
   readonly buildMessagesMediaStripped?: LoopMessageBuilder | undefined;
   readonly dispatchEvent: LoopEventDispatcher;
   readonly tools?: readonly ExecutableTool[] | undefined;
+  /**
+   * Rebuilds provider/system-prompt state after `beforeStep`. Hosts that can
+   * refresh runtime config at that boundary should provide this instead of
+   * relying on the turn-start `llm` snapshot.
+   */
+  readonly buildLlm?: (() => LLM) | undefined;
   /**
    * Per-step tool table builder. When present it wins over `tools` and is
    * re-invoked before every step, so a tool loaded mid-turn (select_tools
@@ -96,6 +102,7 @@ export async function runTurn(input: RunTurnInput): Promise<TurnResult> {
     buildMessagesMediaStripped,
     dispatchEvent,
     tools,
+    buildLlm,
     buildTools,
     describeMissingTool,
     hooks,
@@ -154,6 +161,7 @@ export async function runTurn(input: RunTurnInput): Promise<TurnResult> {
         buildMessagesMediaStripped,
         dispatchEvent,
         llm,
+        buildLlm,
         tools,
         // Passed through unresolved: the step evaluates it AFTER beforeStep,
         // next to buildMessages, so the tool table and the request messages
@@ -184,7 +192,7 @@ export async function runTurn(input: RunTurnInput): Promise<TurnResult> {
         usage: stepResult.usage,
         stopReason: terminalStopReason,
         signal,
-        llm,
+        llm: stepResult.llm,
       });
       if (continuation?.continue !== true) {
         break;
diff --git a/packages/agent-core/src/loop/turn-step.ts b/packages/agent-core/src/loop/turn-step.ts
index ca110a408c..b229f8e0a9 100644
--- a/packages/agent-core/src/loop/turn-step.ts
+++ b/packages/agent-core/src/loop/turn-step.ts
@@ -52,6 +52,8 @@ export interface ExecuteLoopStepDeps {
   readonly buildMessagesMediaStripped?: LoopMessageBuilder | undefined;
   readonly dispatchEvent: LoopEventDispatcher;
   readonly llm: LLM;
+  /** Re-evaluated after beforeStep so refreshed request config reaches this step. */
+  readonly buildLlm?: (() => LLM) | undefined;
   readonly tools?: readonly ExecutableTool[] | undefined;
   /**
    * Per-step tool table builder; wins over the static `tools` snapshot.
@@ -70,6 +72,8 @@ export interface ExecuteLoopStepDeps {
 }
 
 export async function executeLoopStep(deps: ExecuteLoopStepDeps): Promise<{
+  /** The exact LLM instance used for this step after the post-beforeStep rebuild. */
+  readonly llm: LLM;
   readonly usage: TokenUsage;
   readonly stopReason: LoopStepStopReason;
   /**
@@ -96,7 +100,8 @@ export async function executeLoopStep(deps: ExecuteLoopStepDeps): Promise<{
     buildMessagesMediaDegraded,
     buildMessagesMediaStripped,
     dispatchEvent,
-    llm,
+    llm: initialLlm,
+    buildLlm,
     tools,
     buildTools,
     describeMissingTool,
@@ -112,7 +117,7 @@ export async function executeLoopStep(deps: ExecuteLoopStepDeps): Promise<{
       turnId,
       stepNumber: currentStep,
       signal,
-      llm,
+      llm: initialLlm,
     });
     if (beforeStep?.block === true) {
       throw new Error(beforeStep.reason ?? `Step ${String(currentStep)} was blocked`);
@@ -121,6 +126,8 @@ export async function executeLoopStep(deps: ExecuteLoopStepDeps): Promise<{
 
   signal.throwIfAborted();
 
+  const llm = buildLlm?.() ?? initialLlm;
+
   // Resolve the tool table AFTER beforeStep so it reflects the same state as
   // the messages built below (beforeStep can run compaction, which discards
   // loaded dynamic tool schemas from the context and the ledger — a table
@@ -434,6 +441,7 @@ export async function executeLoopStep(deps: ExecuteLoopStepDeps): Promise<{
   }
 
   return {
+    llm,
     usage,
     stopReason:
       stopTurnAfterStep && effectiveStopReason === 'tool_use' ? 'end_turn' : effectiveStopReason,
diff --git a/packages/agent-core/src/rpc/core-api.ts b/packages/agent-core/src/rpc/core-api.ts
index 8bef899e09..c250ec0abf 100644
--- a/packages/agent-core/src/rpc/core-api.ts
+++ b/packages/agent-core/src/rpc/core-api.ts
@@ -172,7 +172,17 @@ export interface SessionSummary {
 
 export interface PromptPayload {
   readonly input: readonly ContentPart[];
+  /**
+   * Optional caller correlation echoed by the owning `turn.started` event.
+   * Ordinary SDK callers may omit it.
+   */
+  readonly promptId?: string;
 }
+
+/** Synchronous admission acknowledgement for an agent prompt. */
+export type PromptResult =
+  | { readonly kind: 'started'; readonly turnId: number }
+  | { readonly kind: 'deferred'; readonly deferredPromptId: string };
 export interface RunShellCommandPayload {
   readonly command: string;
   /**
@@ -198,9 +208,19 @@ export interface CancelShellCommandPayload {
 }
 export interface SteerPayload {
   readonly input: readonly ContentPart[];
+  /** Only steer when this exact turn is still the current active turn. */
+  readonly expectedTurnId?: number;
+  /** Only steer the logical prompt with this stable caller correlation. */
+  readonly expectedPromptId?: string;
+  /** Reject unless an active or compaction-deferred logical prompt owns the steer. */
+  readonly requireActive?: boolean;
 }
 export interface CancelPayload {
   readonly turnId?: number;
+  /** Cancel only the logical prompt with this stable caller correlation. */
+  readonly expectedPromptId?: string;
+  /** Reject unless an active or compaction-deferred logical prompt owns the cancellation. */
+  readonly requireActive?: boolean;
 }
 export interface SetThinkingPayload {
   readonly effort: string;
@@ -386,7 +406,7 @@ export interface GetCronTasksResult {
 }
 
 export interface AgentAPI {
-  prompt: (payload: PromptPayload) => void;
+  prompt: (payload: PromptPayload) => PromptResult;
   runShellCommand: (payload: RunShellCommandPayload) => Promise<ShellCommandResult>;
   cancelShellCommand: (payload: CancelShellCommandPayload) => void;
   steer: (payload: SteerPayload) => void;
@@ -403,7 +423,7 @@ export interface AgentAPI {
   exitSwarm: (payload: EmptyPayload) => void;
   getSwarmMode: (payload: EmptyPayload) => boolean;
   beginCompaction: (payload: BeginCompactionPayload) => void;
-  cancelCompaction: (payload: EmptyPayload) => void;
+  cancelCompaction: (payload: EmptyPayload) => Promise<void>;
   registerTool: (payload: RegisterToolPayload) => void;
   unregisterTool: (payload: UnregisterToolPayload) => void;
   setActiveTools: (payload: SetActiveToolsPayload) => void;
diff --git a/packages/agent-core/src/services/message/transcript.ts b/packages/agent-core/src/services/message/transcript.ts
index c3d2e25aba..3f2afef39d 100644
--- a/packages/agent-core/src/services/message/transcript.ts
+++ b/packages/agent-core/src/services/message/transcript.ts
@@ -29,8 +29,9 @@
  *                                     `foldedLength` from the recorded
  *                                     kept-count fields
  *   - `context.undo`                → remove tail messages exactly like
- *                                     `ContextMemory.undo` (skip injections, stop at
- *                                     compaction summaries / `context.clear` floors)
+ *                                     `ContextMemory.undo` (preserve state injections,
+ *                                     remove turn outcomes, and stop at compaction
+ *                                     summaries / `context.clear` floors)
  *   - `context.clear`               → keep prior messages in the transcript (the TUI
  *                                     replay keeps them too) but reset the folded view
  *
@@ -58,6 +59,7 @@ import {
   isRealUserInput,
   selectRecentUserMessages,
 } from '../../agent/compaction';
+import { TURN_OUTCOME_REMINDER_VARIANT } from '../../agent/turn/outcome-reminder';
 
 type ContentPart = ContextMessage['content'][number];
 
@@ -213,7 +215,12 @@ export function reduceWireRecords(records: Iterable<AgentRecord>): {
     let removedUserCount = 0;
     for (let i = transcript.length - 1; i >= clearFloor; i--) {
       const message = transcript[i]!.message;
-      if (message.origin?.kind === 'injection') continue;
+      if (
+        message.origin?.kind === 'injection' &&
+        message.origin.variant !== TURN_OUTCOME_REMINDER_VARIANT
+      ) {
+        continue;
+      }
       if (message.origin?.kind === 'compaction_summary') break;
       transcript.splice(i, 1);
       foldedLength = Math.max(0, foldedLength - 1);
diff --git a/packages/agent-core/src/services/prompt/prompt.ts b/packages/agent-core/src/services/prompt/prompt.ts
index fd02f32854..0b86c63ef6 100644
--- a/packages/agent-core/src/services/prompt/prompt.ts
+++ b/packages/agent-core/src/services/prompt/prompt.ts
@@ -14,13 +14,13 @@
  *      `IEventService.onDidPublish(handler)` (VSCode-style
  *      accessor returning an `IDisposable`) in its constructor. We use this
  *      to:
- *      - capture `turn.started` → record `promptId ↔ turnId` mapping (so
- *        later abort can pass the correct numeric `turnId` to
- *        `core.rpc.cancel({turnId})`).
- *      - capture `turn.ended` for the prompt's top-level turn → SYNTHESIZE a
- *        `prompt.completed` (reason='completed', 'failed', or 'blocked') or
- *        `prompt.aborted` (reason='cancelled') event. The event service then
- *        broadcasts these. agent-core's event union has no prompt-level
+ *      - capture `turn.started` → keep the active `promptId ↔ turnId` mapping
+ *        current across goal-continuation turns, so abort always targets the
+ *        turn that is actually running.
+ *      - capture candidate terminal `turn.ended` events, verify that no goal
+ *        continuation is still running, then SYNTHESIZE `prompt.completed`
+ *        (reason='completed', 'failed', or 'blocked') or `prompt.aborted`
+ *        (reason='cancelled'). agent-core's event union has no prompt-level
  *        types.
  *      VSCode-style accessors `onDidComplete: Event<...>` /
  *      `onDidAbort: Event<...>` are also exposed so callers can observe the
@@ -37,18 +37,17 @@
  * **prompt_id ↔ turnId mapping**:
  * - Daemon mints `prompt_<ULID>` on submit. This is a daemon-only id; agent-core
  *   knows nothing about it.
- * - `turn.started.turnId: number` is the agent-core counterpart. On the FIRST
- *   `turn.started` after a submit, we associate `promptId ↔ turnId` for the
- *   session's active prompt. Future `turn.started` events on the same session
- *   without an intervening submit are nested turns — they don't reset the
- *   mapping.
- * - On `turn.ended` matching the top-level turn (turnId equal to the original
- *   mapping), we synthesize the lifecycle event and clear `activePromptId`.
+ * - `turn.started.turnId: number` is the agent-core counterpart. Every main
+ *   agent `turn.started` while the prompt is active refreshes the mapping;
+ *   subagent events use a different `agentId` and therefore a different key.
+ * - A completed turn does not finish the prompt while an active goal is
+ *   driving continuations. The final turn, or a goal transition that stops
+ *   between turns, synthesizes the lifecycle event and clears the mapping.
  *
  * **queueing**: the impl maintains an active `Map<sessionId, PromptState>` plus
  * a per-session FIFO queue. A second submit while a non-terminal prompt exists
- * returns status=`queued`; when the top-level active turn ends, the daemon
- * starts the next queued prompt.
+ * returns status=`queued`; once the active prompt reaches its verified terminal
+ * boundary, the daemon starts the next queued prompt.
  *
  * **`user_message_id` derivation**: SCHEMAS §5 mandates a `user_message_id`
  * in the submit response. When the full message history adapter is available,
@@ -139,11 +138,15 @@ export interface IPromptService {
 
   /**
    * `POST /v1/sessions/{sid}/prompts/{pid}:steer` and collection
-   * `POST /v1/sessions/{sid}/prompts:steer` — remove queued prompt(s) and
-   * inject their content into the active turn via agent-core steer.
+   * `POST /v1/sessions/{sid}/prompts:steer` — reserve queued prompt(s) and
+   * inject their content into the active turn via agent-core steer. Reserved
+   * prompts remain visible in `list()` until admission succeeds; an ordinary
+   * steer failure leaves them queued.
    *
    * Throws `SessionNotFoundError` (→ 40401) for unknown `sid`.
    * Throws `PromptNotFoundError`  (→ 40402) when any pid is not queued.
+   * Throws `PromptAlreadyCompletedError` (→ 40903) when a concurrent stop
+   * cancels the reserved prompt(s) with their active owner.
    */
   steer(sid: string, promptIds: readonly string[]): Promise<PromptSteerResult>;
 
@@ -154,7 +157,11 @@ export interface IPromptService {
    * For an active prompt, this issues `core.rpc.cancel` and synthesizes a
    * `prompt.aborted` event. For a queued prompt, it removes the prompt from
    * the queue and synthesizes `prompt.aborted` without dispatching to
-   * agent-core.
+   * agent-core. If `pid` belongs to a steer admission currently reserved
+   * against the active prompt, the selected prompt(s) and active prompt form
+   * one cancellation transaction: all selected ids are removed and receive
+   * `prompt.aborted`, then the active owner is cancelled. Unselected queued
+   * prompts continue normally.
    *
    * Per REST.md §3.5: aborting an already-completed prompt returns
    * `PromptAlreadyCompletedError` (→ 40903 with `data.aborted: false`).
@@ -176,9 +183,9 @@ export interface IPromptService {
    * `core.rpc.cancel({ sessionId, agentId: 'main' })` without a `turnId`, which
    * cancels any active agent-core turn (including skill activations).
    *
-   * Returns `{ aborted: true }` when a cancel RPC was issued, `{ aborted: false }`
-   * when the session was idle. Throws `SessionNotFoundError` (→ 40401) for
-   * unknown `sid`.
+   * Returns `{ aborted: true }` after the daemon-managed prompt or direct
+   * agent-core cancellation settles. Throws `SessionNotFoundError` (→ 40401)
+   * for unknown `sid`.
    */
   abortBySession(sid: string): Promise<PromptAbortResult>;
 
@@ -214,9 +221,8 @@ export interface IPromptService {
 
   /**
    * VSCode-style accessor for `prompt.completed` synthetic events. The
-   * listener fires synchronously when a top-level `turn.ended`
-   * (reason='completed'|'failed'|'blocked') is synthesised into a prompt-lifecycle
-   * event, BEFORE `bus.publish(synth)`.
+   * listener fires after a candidate terminal turn has been verified as the
+   * prompt boundary, BEFORE `bus.publish(synth)`.
    *
    * Returns an `IDisposable`. Owners stash it via
    * `Disposable._register(svc.onDidComplete(handler))`.
@@ -226,8 +232,8 @@ export interface IPromptService {
   /**
    * VSCode-style accessor for `prompt.aborted` synthetic events. Same
    * `IDisposable` contract as `onDidComplete`. The listener fires when a
-   * top-level `turn.ended` (reason='cancelled') or an abort RPC synthesises
-   * a prompt-lifecycle event, BEFORE `bus.publish(synth)`.
+   * verified cancelled turn or an abort RPC synthesises a prompt-lifecycle
+   * event, BEFORE `bus.publish(synth)`.
    */
   readonly onDidAbort: Event<SyntheticPromptAbortedEvent>;
 
diff --git a/packages/agent-core/src/services/prompt/promptService.ts b/packages/agent-core/src/services/prompt/promptService.ts
index cd6add7e88..0f6595c50f 100644
--- a/packages/agent-core/src/services/prompt/promptService.ts
+++ b/packages/agent-core/src/services/prompt/promptService.ts
@@ -21,10 +21,13 @@ import { IAuthSummaryService } from '../authSummary/authSummary';
 import { IEventService } from '../event/event';
 import { ILogService } from '../logger/logger';
 import { ISessionService, SessionNotFoundError } from '../session/session';
+import { abortable, abortError, userCancellationReason } from '../../utils/abort';
+import { isKimiError } from '../../errors';
 import {
   IPromptService,
   PromptNotFoundError,
   PromptAlreadyCompletedError,
+  SessionBusyError,
   type AgentStatePatch,
   type AgentStateSnapshot,
   type AgentStateSource,
@@ -44,6 +47,7 @@ function promptKey(sessionId: string, agentId: string): string {
 
 /** Cap per-session dispatch-log entries; ring-buffer drops oldest on overflow. */
 const DISPATCH_LOG_CAP = 100;
+const TERMINAL_PROMPT_CAP = 100;
 
 /**
  * `true` iff any of the runtime-control fields is defined on the patch.
@@ -87,8 +91,8 @@ function pickAgentStatePatch(body: PromptSubmission): AgentStatePatch | undefine
  * `turn.started` hasn't arrived yet (the RPC pair queues calls before
  * `ready()` so the gap is small but non-zero in practice).
  *
- * `terminal === true` is set when `turn.ended` arrives — we keep the record
- * around so abort-on-already-completed surfaces as 40903, not 40402.
+ * Terminal states are removed from the active map; the service separately
+ * remembers the most recent terminal prompt id for idempotent aborts.
  */
 interface PromptState {
   agentId: string;
@@ -96,18 +100,58 @@ interface PromptState {
   userMessageId: string;
   body: PromptSubmission;
   createdAt: string;
+  sessionRevision: number;
+  preflightPending: boolean;
+  readyToStart: boolean;
+  submitted: boolean;
+  startupPending: boolean;
+  startupFailed: boolean;
+  promptDispatched: boolean;
+  dispatchAcknowledged: boolean;
+  acceptedTurnId: number | null;
+  acceptedDeferredPromptId: string | null;
+  dispatchController: AbortController;
+  workerTerminal: boolean;
+  workerTerminalBarrier: Promise<void>;
+  resolveWorkerTerminal: () => void;
   turnId: number | null;
-  /** Set on `turn.ended` for the top-level turn (reason='completed'|'failed'|'blocked'). */
+  turnObserved: boolean;
+  turnRevision: number;
+  goalStatus: string | null;
+  goalActive: boolean;
+  goalDriven: boolean;
+  goalRevision: number;
+  deferredOutcome: 'completed' | 'cancelled' | 'failed' | 'blocked' | null;
+  terminalCheckPending: boolean;
+  aborting: boolean;
+  abortPromise: Promise<PromptAbortResult> | undefined;
   completed: boolean;
-  /** Set on `turn.ended` with reason='cancelled' or after a successful abort RPC. */
   aborted: boolean;
 }
 
+interface SteerReservation {
+  readonly sessionRevision: number;
+  readonly target: PromptState;
+  readonly selected: readonly PromptState[];
+  readonly controller: AbortController;
+}
+
 type CorePromptPart =
   | { readonly type: 'text'; readonly text: string }
   | { readonly type: 'image_url'; readonly imageUrl: { readonly url: string } }
   | { readonly type: 'video_url'; readonly videoUrl: { readonly url: string } };
 
+function createWorkerTerminalBarrier(): {
+  promise: Promise<void>;
+  resolve: () => void;
+} {
+  let resolve!: () => void;
+  const promise = new Promise<void>((settle) => {
+    resolve = settle;
+  });
+  return { promise, resolve };
+}
+
 function toPromptItem(state: PromptState, status: 'running' | 'queued'): PromptItem {
   return {
     prompt_id: state.promptId,
@@ -195,7 +239,12 @@ function steerContentToCoreParts(states: readonly PromptState[]): CorePromptPart
 /**
  * Type guard for `turn.started` agent-core events.
  */
-function isTurnStarted(e: Event): e is Event & { type: 'turn.started'; turnId: number } {
+function isTurnStarted(e: Event): e is Event & {
+  type: 'turn.started';
+  turnId: number;
+  promptId?: string;
+  deferredPromptId?: string;
+} {
   return (e as { type?: string }).type === 'turn.started';
 }
 
@@ -213,19 +262,26 @@ function isTurnEnded(e: Event): e is Event & {
 /**
  * Type guard for `agent.status.updated` agent-core events. Carries the
  * subset of fields we mirror into the per-session shadow on every live
- * change (model / permission / planMode). `thinkingEffort` is NOT on this
- * event — bootstrap seeds it from `getConfig` and per-request diff dispatch
- * keeps it in sync from there.
+ * change.
  */
 function isAgentStatusUpdated(e: Event): e is Event & {
   type: 'agent.status.updated';
   model?: string;
+  thinkingEffort?: string;
   permission?: PermissionMode;
   planMode?: boolean;
+  swarmMode?: boolean;
 } {
   return (e as { type?: string }).type === 'agent.status.updated';
 }
 
+function isGoalUpdated(e: Event): e is Event & {
+  type: 'goal.updated';
+  snapshot: null | { status: string };
+} {
+  return (e as { type?: string }).type === 'goal.updated';
+}
+
 /**
  * Per-session shadow of `model` / `thinking` / `permissionMode` /
  * `planMode`. Type re-exported from `./prompt` so the daemon debug route
@@ -245,6 +301,31 @@ export class PromptService
 
   private readonly _queued = new Map<string, PromptState[]>();
 
+  private readonly _steerReservations = new Map<string, SteerReservation>();
+
+  private readonly _terminalPromptIds = new Map<string, Set<string>>();
+
+  /**
+   * Monotonic lifecycle revision per session id. A close increments it before
+   * clearing state, so async work from the retired lifecycle cannot repopulate
+   * shadows or dispatch controls into a later session reusing the same id.
+   */
+  private readonly _sessionRevision = new Map<string, number>();
+
+  /**
+   * Session-scoped single-writer tails for runtime controls. The lifecycle
+   * revision is part of the key so work from a closed session can never block
+   * or overwrite a replacement session that reuses the same id.
+   */
+  private readonly _controlTails = new Map<string, Promise<void>>();
+
+  private readonly _sessionLifecycleControllers = new Map<
+    string,
+    { revision: number; controller: AbortController }
+  >();
+
+  private _disposed = false;
+
   /**
    * Per-session shadow of `model` / `thinking` / `permissionMode` /
    * `planMode`. Absent until first `submit` bootstraps. See
@@ -252,6 +333,18 @@ export class PromptService
    */
   private readonly _agentState = new Map<string, AgentStateSnapshot>();
 
+  private readonly _agentStatusRevision = new Map<string, number>();
+
+  private readonly _agentStatusFieldRevision = new Map<
+    string,
+    Partial<Record<keyof AgentStateSnapshot, number>>
+  >();
+
+  private readonly _latestAgentStatus = new Map<
+    string,
+    { revision: number; snapshot: AgentStateSnapshot }
+  >();
+
   /**
    * Per-session ring buffer of stateless-control setter dispatches.
    * Each entry records `{ts, kind, payload, promptId}` immediately after
@@ -305,10 +398,45 @@ export class PromptService
     // submit for a freshly-recreated session re-bootstraps cleanly.
     this._register(
       this.sessionService.onDidClose(({ sessionId }) => {
+        this._sessionLifecycleControllers
+          .get(sessionId)
+          ?.controller.abort(abortError('Session closed'));
+        this._sessionLifecycleControllers.delete(sessionId);
+        this._sessionRevision.set(sessionId, this._getSessionRevision(sessionId) + 1);
         this._agentState.delete(sessionId);
+        this._agentStatusRevision.delete(sessionId);
+        this._agentStatusFieldRevision.delete(sessionId);
+        this._latestAgentStatus.delete(sessionId);
         this._dispatchLog.delete(sessionId);
+        for (const key of this._terminalPromptIds.keys()) {
+          if (key.startsWith(`${sessionId}\u0000`)) {
+            this._terminalPromptIds.delete(key);
+          }
+        }
         for (const key of this._queued.keys()) {
-          if (key.startsWith(`${sessionId}\u0000`)) this._queued.delete(key);
+          if (!key.startsWith(`${sessionId}\u0000`)) continue;
+          for (const state of this._queued.get(key) ?? []) {
+            state.dispatchController.abort(abortError('Session closed'));
+            this._signalWorkerTerminal(state);
+          }
+          this._queued.delete(key);
+        }
+        for (const key of this._steerReservations.keys()) {
+          if (!key.startsWith(`${sessionId}\u0000`)) continue;
+          this._steerReservations
+            .get(key)
+            ?.controller.abort(abortError('Session closed'));
+          this._steerReservations.delete(key);
+        }
+        // Active prompt state belongs to the session lifecycle too. Removing
+        // it makes any in-flight terminal verification harmless: its identity
+        // guard observes that the state is no longer authoritative and exits
+        // without publishing a synthetic completion for the closed session.
+        for (const [key, state] of this._active) {
+          if (!key.startsWith(`${sessionId}\u0000`)) continue;
+          state.dispatchController.abort(abortError('Session closed'));
+          this._signalWorkerTerminal(state);
+          this._active.delete(key);
         }
       }),
     );
@@ -322,97 +450,229 @@ export class PromptService
     const active = this._active.get(key);
     return {
       active:
-        active !== undefined && !active.completed && !active.aborted
+        active !== undefined && active.submitted && !active.completed && !active.aborted
           ? toPromptItem(active, 'running')
           : null,
-      queued: (this._queued.get(key) ?? []).map((state) =>
-        toPromptItem(state, 'queued'),
-      ),
+      queued: (this._queued.get(key) ?? [])
+        .filter((state) => state.submitted)
+        .map((state) => toPromptItem(state, 'queued')),
     };
   }
 
   async submit(sid: string, body: PromptSubmission): Promise<PromptSubmitResult> {
-    await this._requireSession(sid);
-    await this.core.rpc.resumeSession({ sessionId: sid });
-
-    // Readiness gate. Throws AuthProvisioningRequired /
-    // AuthTokenMissing / AuthModelNotResolved before we mint a prompt_id and
-    // hand off to agent-core. Daemon route layer maps to 40110/40111/40113.
-    await this.auth.ensureReady();
-
+    // Register every submission synchronously, before any preflight await.
+    // This fixes both admission order and stop-vs-preflight races: a follower
+    // keeps its invocation-order queue position even if a later request finishes
+    // auth first, and promotion makes an unfinished preflight visible to the
+    // session abort path instead of letting it revive after stop returns.
+    const sessionRevision = this._getSessionRevision(sid);
     const promptId = `prompt_${ulid()}`;
-    const state = this._createPromptState(sid, promptId, body);
+    const state = this._createPromptState(sid, promptId, body, sessionRevision);
     const key = promptKey(sid, state.agentId);
-
-    const existing = this._active.get(key);
-    if (existing !== undefined && !existing.completed && !existing.aborted) {
+    if (
+      this._active.get(key) === undefined &&
+      this._steerReservations.get(key) === undefined
+    ) {
+      this._active.set(key, state);
+    } else {
       this._enqueue(sid, state);
-      const item = toPromptItem(state, 'queued');
-      this._publishSubmitted(sid, state, item);
-      return item;
     }
+    const signal = state.dispatchController.signal;
 
-    const item = toPromptItem(state, 'running');
-    await this._startPrompt(sid, state, () => {
-      this._publishSubmitted(sid, state, item);
-    });
-    return item;
+    try {
+      await this._requireSession(sid, signal);
+      this._assertSubmissionAuthority(sid, key, state);
+      const resumeRequest = this._trackStartupFence(
+        sid,
+        key,
+        state,
+        this.core.rpc.resumeSession({ sessionId: sid }, { signal }),
+      );
+      await abortable(
+        resumeRequest,
+        signal,
+      );
+      this._assertSubmissionAuthority(sid, key, state);
+
+      // Readiness gate. Throws AuthProvisioningRequired / AuthTokenMissing /
+      // AuthModelNotResolved before the prompt is handed off to agent-core.
+      // Daemon route layer maps these to 40110/40111/40113.
+      await abortable(this.auth.ensureReady(), signal);
+      this._assertSubmissionAuthority(sid, key, state);
+      state.preflightPending = false;
+      state.readyToStart = true;
+
+      if (this._active.get(key) !== state) {
+        const item = toPromptItem(state, 'queued');
+        state.submitted = true;
+        this._publishSubmitted(sid, state, item);
+        return item;
+      }
+
+      const item = toPromptItem(state, 'running');
+      const startup = this._startPrompt(sid, state, () => {
+        state.submitted = true;
+        this._publishSubmitted(sid, state, item);
+      });
+      // A stop must settle the HTTP submit even when a mocked/uncooperative
+      // control RPC ignores its transport signal. The internal startup promise
+      // remains observed and retains the scheduler fence until that mutation
+      // itself settles, so a queued successor cannot overlap it.
+      await abortable(startup, signal);
+      return item;
+    } catch (error) {
+      state.preflightPending = false;
+      if (!state.readyToStart) {
+        this._discardRegisteredSubmission(sid, key, state);
+      }
+      if (signal.aborted) {
+        throw new PromptAlreadyCompletedError(sid, state.promptId);
+      }
+      throw error;
+    }
   }
 
   async startBtw(sid: string): Promise<string> {
-    await this._requireSession(sid);
-    await this.core.rpc.resumeSession({ sessionId: sid });
-    await this.auth.ensureReady();
-    return this.core.rpc.startBtw({ sessionId: sid, agentId: MAIN_AGENT_ID });
+    const sessionRevision = this._getSessionRevision(sid);
+    const signal = this._getSessionLifecycleSignal(sid, sessionRevision);
+    await this._requireSession(sid, signal);
+    this._assertSessionRevision(sid, sessionRevision);
+    await abortable(
+      this.core.rpc.resumeSession({ sessionId: sid }, { signal }),
+      signal,
+    );
+    this._assertSessionRevision(sid, sessionRevision);
+    await abortable(this.auth.ensureReady(), signal);
+    this._assertSessionRevision(sid, sessionRevision);
+    const agentId = await abortable(
+      this.core.rpc.startBtw(
+        {
+          sessionId: sid,
+          agentId: MAIN_AGENT_ID,
+        },
+        { signal },
+      ),
+      signal,
+    );
+    this._assertSessionRevision(sid, sessionRevision);
+    return agentId;
   }
 
   async steer(sid: string, promptIds: readonly string[]): Promise<PromptSteerResult> {
-    await this._requireSession(sid);
+    const sessionRevision = this._getSessionRevision(sid);
+    const lifecycleSignal = this._getSessionLifecycleSignal(sid, sessionRevision);
+    await this._requireSession(sid, lifecycleSignal);
+    this._assertSessionRevision(sid, sessionRevision);
     if (promptIds.length === 0) {
       throw new PromptNotFoundError(sid, '');
     }
     const key = promptKey(sid, MAIN_AGENT_ID);
+    if (this._steerReservations.has(key)) {
+      const activePromptId = this._steerReservations.get(key)?.target.promptId ?? '';
+      throw new SessionBusyError(sid, activePromptId);
+    }
     const active = this._active.get(key);
-    if (active === undefined || active.completed || active.aborted) {
+    if (active === undefined || active.completed || active.aborted || active.aborting) {
       throw new PromptNotFoundError(sid, promptIds[0]!);
     }
-
     const queue = this._queued.get(key) ?? [];
-    const selected: PromptState[] = [];
-    for (const promptId of promptIds) {
-      const state = queue.find((item) => item.promptId === promptId);
-      if (state === undefined) {
+    const requestedPromptIds = new Set(promptIds);
+    for (const promptId of requestedPromptIds) {
+      if (!queue.some((item) => item.submitted && item.promptId === promptId)) {
         throw new PromptNotFoundError(sid, promptId);
       }
-      selected.push(state);
+    }
+    const selected = queue.filter(
+      (state) => state.submitted && requestedPromptIds.has(state.promptId),
+    );
+    const selectedPromptIds = selected.map((state) => state.promptId);
+
+    if (!active.promptDispatched) {
+      throw new SessionBusyError(sid, active.promptId);
     }
 
-    const selectedIds = new Set(promptIds);
-    const remaining = queue.filter((item) => !selectedIds.has(item.promptId));
-    this._replaceQueue(sid, MAIN_AGENT_ID, remaining);
+    const reservation: SteerReservation = {
+      sessionRevision,
+      target: active,
+      selected,
+      controller: new AbortController(),
+    };
+    this._steerReservations.set(key, reservation);
+    // Keep reserved prompts in the authoritative queue until core admission
+    // succeeds. The reservation itself blocks scheduling and mutation, while
+    // list() continues to expose the pending work. Failure and cancellation
+    // therefore need no error-prone remove/restore dance.
+    const signal = AbortSignal.any([
+      lifecycleSignal,
+      reservation.controller.signal,
+    ]);
 
     try {
-      await this.core.rpc.steer({
-        sessionId: sid,
+      await abortable(
+        this.core.rpc.steer(
+          {
+            sessionId: sid,
+            agentId: MAIN_AGENT_ID,
+            input: steerContentToCoreParts(selected),
+            expectedPromptId: active.promptId,
+            requireActive: true,
+          },
+          { signal },
+        ),
+        signal,
+      );
+      this._assertSessionRevision(sid, sessionRevision);
+      signal.throwIfAborted();
+
+      const selectedSet = new Set(selected);
+      const currentQueue = this._queued.get(key) ?? [];
+      this._replaceQueue(
+        sid,
+        MAIN_AGENT_ID,
+        currentQueue.filter((state) => !selectedSet.has(state)),
+      );
+      for (const state of selected) {
+        this._recordTerminalPromptId(key, state.promptId);
+      }
+      // Admission is committed before observers see prompt.steered. A
+      // synchronous listener that acts on a selected id must observe it as a
+      // terminal child, never as a still-pending reservation that can cancel
+      // the active owner.
+      if (this._steerReservations.get(key) === reservation) {
+        this._steerReservations.delete(key);
+      }
+
+      const event: SyntheticPromptSteeredEvent = {
+        type: 'prompt.steered',
         agentId: MAIN_AGENT_ID,
-        input: steerContentToCoreParts(selected),
-      });
+        sessionId: sid,
+        activePromptId: active.promptId,
+        promptIds: selectedPromptIds,
+        content: selected.flatMap((state) => state.body.content),
+        steeredAt: new Date().toISOString(),
+      };
+      this.eventService.publish(event as unknown as Event);
+      return { steered: true, prompt_ids: selectedPromptIds };
     } catch (error) {
-      this._restoreSteeredQueueItems(sid, selected);
+      if (reservation.selected.every((state) => state.aborted)) {
+        // A concurrent stop linearized this steer selection into the active
+        // cancellation transaction. Surface the declared terminal-prompt
+        // sentinel instead of leaking an internal AbortError as a generic 500.
+        throw new PromptAlreadyCompletedError(sid, selectedPromptIds[0]!);
+      }
+      if (isKimiError(error) && error.code === 'turn.agent_busy') {
+        throw new SessionBusyError(sid, active.promptId);
+      }
       throw error;
+    } finally {
+      if (this._steerReservations.get(key) === reservation) {
+        this._steerReservations.delete(key);
+      }
+      if (!this._disposed && this._getSessionRevision(sid) === sessionRevision) {
+        this._resumeTerminalAfterSteer(sid, key, active);
+        this._startNextQueued(sid, MAIN_AGENT_ID);
+      }
     }
-
-    const event: SyntheticPromptSteeredEvent = {
-      type: 'prompt.steered',
-      agentId: MAIN_AGENT_ID,
-      sessionId: sid,
-      activePromptId: active.promptId,
-      promptIds: [...promptIds],
-      content: selected.flatMap((state) => state.body.content),
-      steeredAt: new Date().toISOString(),
-    };
-    this.eventService.publish(event as unknown as Event);
-    return { steered: true, prompt_ids: [...promptIds] };
   }
 
   private async _startPrompt(
@@ -420,46 +680,117 @@ export class PromptService
     state: PromptState,
     onStarted?: () => void,
   ): Promise<void> {
-    const overridePatch = state.agentId === MAIN_AGENT_ID ? pickAgentStatePatch(state.body) : undefined;
-    if (overridePatch !== undefined) {
-      await this._ensureAgentStateBootstrapped(sid);
-      await this._applyAgentStateInternal(sid, overridePatch, 'prompt', state.promptId);
-    }
-
     const key = promptKey(sid, state.agentId);
-    this._active.set(key, state);
-    const input = contentToCoreParts(state.body.content);
-    onStarted?.();
-
-    // Fire-and-forget. agent-core streams events via the SDK side of the
-    // RPC pair which lands on `BridgeClientAPI.emitEvent → IEventService.publish`.
-    // The submit RPC returns synchronously (PromptPayload → void); errors
-    // would manifest as later `error` events, not as a rejection here.
+    if (this._active.get(key) !== state) {
+      if (this._active.get(key) !== undefined) {
+        throw new PromptAlreadyCompletedError(sid, state.promptId);
+      }
+      this._assertSessionRevision(sid, state.sessionRevision);
+      this._active.set(key, state);
+    }
     try {
-      this._logger.debug(
-        { sid, promptId: state.promptId, agentId: state.agentId, partCount: input.length },
-        '[DBG prompt-service.submit] -> core.rpc.prompt(...)',
-      );
-      await this.core.rpc.prompt({
-        sessionId: sid,
-        agentId: state.agentId,
-        input,
+      const assertAuthority = (): void => {
+        this._assertPromptAuthority(sid, key, state);
+      };
+      const signal = state.dispatchController.signal;
+
+      await this._withSessionControlLock(sid, state.sessionRevision, async () => {
+        assertAuthority();
+        state.startupPending = true;
+        const overridePatch =
+          state.agentId === MAIN_AGENT_ID ? pickAgentStatePatch(state.body) : undefined;
+        if (overridePatch !== undefined) {
+          const bootstrapped = await this._ensureAgentStateBootstrapped(
+            sid,
+            state.sessionRevision,
+            assertAuthority,
+            signal,
+          );
+          assertAuthority();
+          if (!bootstrapped) {
+            throw new PromptAlreadyCompletedError(sid, state.promptId);
+          }
+          await this._applyAgentStateInternal(
+            sid,
+            overridePatch,
+            'prompt',
+            state.promptId,
+            assertAuthority,
+          );
+        }
+        assertAuthority();
+
+        if (state.agentId === MAIN_AGENT_ID) {
+          const goalRevision = state.goalRevision;
+          const goal = await this.core.rpc.getGoal(
+            {
+              sessionId: sid,
+              agentId: state.agentId,
+            },
+            { signal },
+          );
+          assertAuthority();
+          if (state.goalRevision === goalRevision) {
+            this._recordGoalSnapshot(state, goal.goal);
+          }
+        }
+
+        const input = contentToCoreParts(state.body.content);
+        onStarted?.();
+        assertAuthority();
+        this._logger.debug(
+          { sid, promptId: state.promptId, agentId: state.agentId, partCount: input.length },
+          '[DBG prompt-service.submit] -> core.rpc.prompt(...)',
+        );
+        state.promptDispatched = true;
+        const promptRequest = this.core.rpc
+          .prompt(
+            {
+              sessionId: sid,
+              agentId: state.agentId,
+              input,
+              promptId: state.promptId,
+            },
+            { signal },
+          )
+          .then((result) => {
+            state.dispatchAcknowledged = true;
+            if (result?.kind === 'started') {
+              state.acceptedTurnId = result.turnId;
+              if (!state.turnObserved) state.turnId = result.turnId;
+            } else if (result?.kind === 'deferred') {
+              state.acceptedDeferredPromptId = result.deferredPromptId;
+            }
+            return result;
+          });
+        // The RPC proxy invokes the actual Agent handler asynchronously. Keep
+        // the single-writer lock through its acknowledgement so a later profile
+        // setter cannot overtake this prompt's overrides. A verified terminal
+        // worker event is an equivalent barrier and releases the lock even if
+        // the transport response itself is uncooperative.
+        await Promise.race([promptRequest, state.workerTerminalBarrier]);
       });
+
       this._logger.debug(
         { sid, promptId: state.promptId },
-        '[DBG prompt-service.submit] core.rpc.prompt(...) resolved',
+        '[DBG prompt-service.submit] core.rpc.prompt(...) acknowledged',
       );
     } catch (error) {
-      // Clear our active-prompt state so the next submit succeeds; surface
-      // the error to the route layer.
-      if (this._active.get(key)?.promptId === state.promptId) {
-        this._active.delete(key);
-      }
+      state.startupFailed = true;
+      if (!state.aborting) this._settleStartupFailure(sid, key, state);
       this._logger.debug(
         { sid, promptId: state.promptId, err: (error as Error)?.message ?? error },
-        '[DBG prompt-service.submit] core.rpc.prompt(...) threw',
+        '[DBG prompt-service.submit] failed to start prompt',
       );
+      if (isKimiError(error) && error.code === 'turn.agent_busy') {
+        throw new SessionBusyError(sid, state.promptId);
+      }
       throw error;
+    } finally {
+      state.startupPending = false;
+      if ((state.aborted || state.completed) && !state.aborting) {
+        this._retireStartupState(sid, key, state);
+      }
     }
   }
 
@@ -493,64 +824,221 @@ export class PromptService
   }
 
   async abort(sid: string, pid: string): Promise<PromptAbortResult> {
-    await this._requireSession(sid);
-    const key = promptKey(sid, MAIN_AGENT_ID);
-    const state = this._active.get(key);
-    if (state !== undefined && state.promptId === pid) {
-      if (state.completed || state.aborted) {
+    // Claim active authority before the first await. A stop request must beat
+    // an older submit whose list/auth preflight is still pending.
+    const active = this._findActivePrompt(sid, pid);
+    if (active !== undefined) {
+      const [key, state] = active;
+      if (state.completed || state.aborted || state.aborting) {
         throw new PromptAlreadyCompletedError(sid, pid);
       }
-      // Mark aborted optimistically — _handleBusEvent will not re-synthesize.
-      state.aborted = true;
-      try {
-        const cancelArgs: { sessionId: string; agentId: string; turnId?: number } = {
-          sessionId: sid,
-          agentId: state.agentId,
-        };
-        if (state.turnId !== null) cancelArgs.turnId = state.turnId;
-        await this.core.rpc.cancel(cancelArgs);
-      } catch (error) {
-        // Roll back the optimistic flag so the route surfaces a real error;
-        // the caller will see a 50001 (internal) via the global error handler.
-        state.aborted = false;
-        throw error;
+      return this._beginActiveAbort(sid, key, state);
+    }
+
+    const reserved = this._findSteerReservation(sid, pid);
+    if (reserved !== undefined) {
+      const [key, reservation] = reserved;
+      if (reservation.target.aborting && reservation.target.abortPromise !== undefined) {
+        return reservation.target.abortPromise;
+      }
+      if (
+        reservation.target.completed ||
+        reservation.target.aborted ||
+        reservation.target.aborting
+      ) {
+        throw new PromptAlreadyCompletedError(sid, pid);
       }
-      this._publishAborted(sid, state.agentId, pid);
+      // A selected queued prompt and its active target form one transaction
+      // once steer admission is reserved. Stopping either id cancels both,
+      // which gives clients holding the newer queued id a race-free stop path.
+      return this._beginActiveAbort(sid, key, reservation.target);
+    }
+
+    // Queued prompt: remove it synchronously. The queue is the session proof;
+    // waiting for listSessions first would reopen the same preflight race.
+    const queued = this._findQueuedPrompt(sid, pid);
+    if (queued !== undefined) {
+      const [key, queue, index, state] = queued;
+      state.dispatchController.abort(userCancellationReason());
+      state.aborted = true;
+      state.preflightPending = false;
+      queue.splice(index, 1);
+      if (queue.length === 0) this._queued.delete(key);
+      this._recordTerminalPromptId(key, pid);
+      if (state.submitted) this._publishAborted(sid, state.agentId, pid);
       return { aborted: true };
     }
 
-    // Queued prompt: remove it from the queue and synthesize prompt.aborted.
-    // No core RPC is needed because the prompt was never dispatched.
-    const queue = this._queued.get(key) ?? [];
-    const index = queue.findIndex((item) => item.promptId === pid);
-    if (index === -1) {
-      throw new PromptNotFoundError(sid, pid);
+    await this._requireSession(sid);
+    if (this._hasTerminalPrompt(sid, pid)) {
+      throw new PromptAlreadyCompletedError(sid, pid);
     }
-    queue.splice(index, 1);
-    if (queue.length === 0) {
-      this._queued.delete(key);
+    throw new PromptNotFoundError(sid, pid);
+  }
+
+  private _beginActiveAbort(
+    sid: string,
+    key: string,
+    state: PromptState,
+  ): Promise<PromptAbortResult> {
+    const signal = this._getSessionLifecycleSignal(sid, state.sessionRevision);
+    const turnId = state.turnId;
+    state.aborting = true;
+    state.dispatchController.abort(userCancellationReason());
+    const reservation = this._steerReservations.get(key);
+    if (reservation?.target === state) {
+      // Do not let an uncooperative/hung steer acknowledgement pin stop and
+      // the scheduler forever. The correlated core cancel below removes any
+      // owner-targeted steer that was admitted before this signal won the race.
+      reservation.controller.abort(userCancellationReason());
+      this._cancelReservedPrompts(sid, key, reservation.selected);
+    }
+    const operation = Promise.resolve().then(() =>
+      this._performActiveAbort(sid, key, state, turnId, signal),
+    );
+    state.abortPromise = operation;
+    void operation.then(
+      () => {
+        if (state.abortPromise === operation) state.abortPromise = undefined;
+      },
+      () => {
+        if (state.abortPromise === operation) state.abortPromise = undefined;
+      },
+    );
+    return operation;
+  }
+
+  private async _performActiveAbort(
+    sid: string,
+    key: string,
+    state: PromptState,
+    turnId: number | null,
+    signal: AbortSignal,
+  ): Promise<PromptAbortResult> {
+    try {
+      signal.throwIfAborted();
+      if (
+        this._getSessionRevision(sid) !== state.sessionRevision ||
+        this._active.get(key) !== state
+      ) {
+        return { aborted: true };
+      }
+      if (!state.promptDispatched) {
+        state.aborting = false;
+        this._markAbortedPrompt(sid, key, state);
+        if (!state.startupPending) this._retireStartupState(sid, key, state);
+        return { aborted: true };
+      }
+      const cancelArgs: {
+        sessionId: string;
+        agentId: string;
+        turnId?: number;
+        expectedPromptId: string;
+        requireActive: true;
+      } = {
+        sessionId: sid,
+        agentId: state.agentId,
+        expectedPromptId: state.promptId,
+        requireActive: true,
+      };
+      if (turnId !== null) cancelArgs.turnId = turnId;
+      await abortable(this.core.rpc.cancel(cancelArgs, { signal }), signal);
+    } catch (error) {
+      state.aborting = false;
+      if (isKimiError(error) && error.code === 'turn.agent_busy') {
+        // The owner-qualified cancellation is allowed to lose a race with the
+        // target's natural terminal boundary, but it can never affect a newer
+        // unrelated worker. Treat that safe miss as an idempotent stop.
+        if (this._active.get(key) === state) {
+          this._markAbortedPrompt(sid, key, state);
+          this._signalWorkerTerminal(state);
+          this._retireStartupState(sid, key, state);
+        }
+        return { aborted: true };
+      }
+      if (this._active.get(key) === state) {
+        if (!state.promptDispatched) {
+          this._markAbortedPrompt(sid, key, state);
+          if (!state.startupPending) this._retireStartupState(sid, key, state);
+        } else if (state.startupFailed) {
+          this._settleStartupFailure(sid, key, state);
+        } else if (state.deferredOutcome !== null) {
+          if (state.goalActive) {
+            void this._verifyTerminalPrompt(sid, key, state);
+          } else {
+            this._settleTerminalPrompt(
+              sid,
+              key,
+              state,
+              state.deferredOutcome,
+              state.turnRevision,
+            );
+          }
+        }
+      }
+      throw error;
+    }
+
+    state.aborting = false;
+    if (
+      this._getSessionRevision(sid) !== state.sessionRevision ||
+      this._active.get(key) !== state
+    ) {
+      return { aborted: true };
+    }
+    this._markAbortedPrompt(sid, key, state);
+    if (state.promptDispatched) this._signalWorkerTerminal(state);
+    if (state.promptDispatched || !state.startupPending) {
+      // Once prompt dispatch is issued, the same lifecycle signal prevents a
+      // not-yet-invoked RPC handler from launching late; if the handler already
+      // ran, successful cancel is its terminal barrier. Before dispatch, retain
+      // only an uncooperative raw control mutation until it truly settles.
+      this._retireStartupState(sid, key, state);
     }
-    this._publishAborted(sid, MAIN_AGENT_ID, pid);
     return { aborted: true };
   }
 
   async abortBySession(sid: string): Promise<PromptAbortResult> {
-    await this._requireSession(sid);
-    const state = this._active.get(promptKey(sid, MAIN_AGENT_ID));
-    if (state !== undefined && !state.completed && !state.aborted) {
-      // Normal prompt path: let abort() handle turnId mapping and event synthesis.
-      return this.abort(sid, state.promptId);
-    }
-    // No daemon-managed active prompt. Cancel whatever agent-core turn is
-    // running (e.g. a skill activation) without requiring a turnId.
-    // TurnFlow.cancel(undefined) is a safe no-op when idle.
-    await this.core.rpc.cancel({ sessionId: sid, agentId: MAIN_AGENT_ID });
+    const sessionRevision = this._getSessionRevision(sid);
+    const signal = this._getSessionLifecycleSignal(sid, sessionRevision);
+    const key = promptKey(sid, MAIN_AGENT_ID);
+    const state = this._active.get(key);
+    if (state !== undefined && !state.completed && !state.aborted && !state.aborting) {
+      return this._beginActiveAbort(sid, key, state);
+    }
+    if (state?.aborting === true && state.abortPromise !== undefined) {
+      return state.abortPromise;
+    }
+    if (state?.aborted === true) return { aborted: true };
+
+    await this._requireSession(sid, signal);
+    this._assertSessionRevision(sid, sessionRevision);
+    // A submit can reserve the scheduler slot while validation is in flight.
+    const current = this._active.get(key);
+    if (current !== undefined && !current.completed && !current.aborted && !current.aborting) {
+      return this._beginActiveAbort(sid, key, current);
+    }
+    if (current?.aborting === true && current.abortPromise !== undefined) {
+      return current.abortPromise;
+    }
+    if (current?.aborted === true) return { aborted: true };
+
+    // No daemon-managed active prompt. Cancel any direct agent-core turn such
+    // as a skill activation without requiring a turn id.
+    this._assertSessionRevision(sid, sessionRevision);
+    await abortable(
+      this.core.rpc.cancel(
+        { sessionId: sid, agentId: MAIN_AGENT_ID },
+        { signal },
+      ),
+      signal,
+    );
     return { aborted: true };
   }
 
   getCurrentPromptId(sid: string): string | undefined {
     const state = this._active.get(promptKey(sid, MAIN_AGENT_ID));
-    if (state === undefined || state.completed || state.aborted) {
+    if (state === undefined || !state.submitted || state.completed || state.aborted) {
       return undefined;
     }
     return state.promptId;
@@ -578,9 +1066,32 @@ export class PromptService
     promptId?: string,
   ): Promise<void> {
     if (!hasAnyAgentStateField(patch)) return;
-    await this._requireSession(sid);
-    await this._ensureAgentStateBootstrapped(sid);
-    await this._applyAgentStateInternal(sid, patch, source, promptId ?? '');
+    const sessionRevision = this._getSessionRevision(sid);
+    const signal = this._getSessionLifecycleSignal(sid, sessionRevision);
+    await this._requireSession(sid, signal);
+    const assertAuthority = (): void => {
+      this._assertSessionRevision(sid, sessionRevision);
+    };
+    assertAuthority();
+    await this._withSessionControlLock(sid, sessionRevision, async () => {
+      assertAuthority();
+      const bootstrapped = await this._ensureAgentStateBootstrapped(
+        sid,
+        sessionRevision,
+        assertAuthority,
+        signal,
+      );
+      assertAuthority();
+      if (!bootstrapped) throw new SessionNotFoundError(sid);
+      await this._applyAgentStateInternal(
+        sid,
+        patch,
+        source,
+        promptId ?? '',
+        assertAuthority,
+        signal,
+      );
+    });
   }
 
   // --- IPromptService typed event accessors ---------------------------------
@@ -599,14 +1110,23 @@ export class PromptService
    *
    * The three RPCs run in parallel — they share no preconditions.
    */
-  private async _ensureAgentStateBootstrapped(sid: string): Promise<void> {
-    if (this._agentState.has(sid)) return;
+  private async _ensureAgentStateBootstrapped(
+    sid: string,
+    sessionRevision: number,
+    assertAuthority: () => void = () => {},
+    signal?: AbortSignal,
+  ): Promise<boolean> {
+    if (this._getSessionRevision(sid) !== sessionRevision) return false;
+    if (this._agentState.has(sid)) return true;
+    const statusRevision = this._agentStatusRevision.get(sid) ?? 0;
     const [config, permission, plan, swarmMode] = await Promise.all([
-      this.core.rpc.getConfig({ sessionId: sid, agentId: MAIN_AGENT_ID }),
-      this.core.rpc.getPermission({ sessionId: sid, agentId: MAIN_AGENT_ID }),
-      this.core.rpc.getPlan({ sessionId: sid, agentId: MAIN_AGENT_ID }),
-      this.core.rpc.getSwarmMode({ sessionId: sid, agentId: MAIN_AGENT_ID }),
+      this.core.rpc.getConfig({ sessionId: sid, agentId: MAIN_AGENT_ID }, { signal }),
+      this.core.rpc.getPermission({ sessionId: sid, agentId: MAIN_AGENT_ID }, { signal }),
+      this.core.rpc.getPlan({ sessionId: sid, agentId: MAIN_AGENT_ID }, { signal }),
+      this.core.rpc.getSwarmMode({ sessionId: sid, agentId: MAIN_AGENT_ID }, { signal }),
     ]);
+    assertAuthority();
+    if (this._getSessionRevision(sid) !== sessionRevision) return false;
     const snapshot: AgentStateSnapshot = {};
     if (config.modelAlias !== undefined) snapshot.model = config.modelAlias;
     // `AgentConfigData.thinkingEffort` is typed `string` but in practice
@@ -617,7 +1137,12 @@ export class PromptService
     snapshot.permissionMode = permission.mode;
     snapshot.planMode = plan !== null;
     snapshot.swarmMode = swarmMode;
+    const liveStatus = this._latestAgentStatus.get(sid);
+    if (liveStatus !== undefined && liveStatus.revision > statusRevision) {
+      Object.assign(snapshot, liveStatus.snapshot);
+    }
     this._agentState.set(sid, snapshot);
+    return true;
   }
 
   /**
@@ -636,7 +1161,10 @@ export class PromptService
     patch: AgentStatePatch,
     source: AgentStateSource,
     promptId: string,
+    assertAuthority: () => void = () => {},
+    signal?: AbortSignal,
   ): Promise<void> {
+    assertAuthority();
     const shadow = this._agentState.get(sid);
     if (shadow === undefined) {
       // Bootstrap is a precondition; a missing shadow here is a bug,
@@ -646,18 +1174,61 @@ export class PromptService
       );
     }
     const agentId = MAIN_AGENT_ID;
+    type ShadowField = keyof AgentStateSnapshot;
+    interface DispatchToken {
+      field: ShadowField | undefined;
+      revision: number;
+    }
+    const dispatch = async <T>(
+      operation: () => T | PromiseLike<T>,
+      field?: ShadowField,
+    ): Promise<DispatchToken> => {
+      assertAuthority();
+      const revision =
+        field === undefined
+          ? 0
+          : (this._agentStatusFieldRevision.get(sid)?.[field] ?? 0);
+      await operation();
+      return { field, revision };
+    };
+    const commitDispatch = (
+      token: DispatchToken,
+      commit: (writeShadow: boolean) => void,
+    ): void => {
+      // The mutation may already have taken effect before an abort/close wins
+      // the response race. Commit it to the same-lifecycle shadow first, then
+      // re-check prompt authority to prevent any following setter or dispatch.
+      if (this._agentState.get(sid) === shadow) {
+        const writeShadow =
+          token.field === undefined ||
+          (this._agentStatusFieldRevision.get(sid)?.[token.field] ?? 0) ===
+            token.revision;
+        commit(writeShadow);
+      }
+      assertAuthority();
+    };
 
     if (patch.model !== undefined && patch.model !== shadow.model) {
       const payload = { sessionId: sid, agentId, model: patch.model };
-      await this.core.rpc.setModel(payload);
-      shadow.model = patch.model;
-      this._recordDispatch(sid, 'setModel', payload, promptId, source);
+      const token = await dispatch(
+        () => this.core.rpc.setModel(payload, { signal }),
+        'model',
+      );
+      commitDispatch(token, (writeShadow) => {
+        if (writeShadow) shadow.model = patch.model;
+        this._recordDispatch(sid, 'setModel', payload, promptId, source);
+      });
     }
     if (patch.thinking !== undefined && patch.thinking !== shadow.thinking) {
       const payload = { sessionId: sid, agentId, effort: patch.thinking as PromptThinking };
-      await this.core.rpc.setThinking(payload);
-      shadow.thinking = patch.thinking;
-      this._recordDispatch(sid, 'setThinking', payload, promptId, source);
+      const token = await dispatch(
+        () => this.core.rpc.setThinking(payload, { signal }),
+        'thinking',
+      );
+      commitDispatch(token, (writeShadow) => {
+        if (writeShadow) shadow.thinking = patch.thinking;
+        this._recordDispatch(sid, 'setThinking', payload, promptId, source);
+      });
     }
     if (
       patch.permission_mode !== undefined &&
@@ -668,23 +1239,39 @@ export class PromptService
         agentId,
         mode: patch.permission_mode as PermissionMode,
       };
-      await this.core.rpc.setPermission(payload);
-      shadow.permissionMode = patch.permission_mode as PermissionMode;
-      this._recordDispatch(sid, 'setPermission', payload, promptId, source);
+      const token = await dispatch(
+        () => this.core.rpc.setPermission(payload, { signal }),
+        'permissionMode',
+      );
+      commitDispatch(token, (writeShadow) => {
+        if (writeShadow) shadow.permissionMode = patch.permission_mode as PermissionMode;
+        this._recordDispatch(sid, 'setPermission', payload, promptId, source);
+      });
     }
     if (patch.plan_mode !== undefined && patch.plan_mode !== shadow.planMode) {
       const payload = { sessionId: sid, agentId };
       if (patch.plan_mode) {
-        await this.core.rpc.enterPlan(payload);
-        this._recordDispatch(sid, 'enterPlan', payload, promptId, source);
+        const token = await dispatch(
+          () => this.core.rpc.enterPlan(payload, { signal }),
+          'planMode',
+        );
+        commitDispatch(token, (writeShadow) => {
+          if (writeShadow) shadow.planMode = true;
+          this._recordDispatch(sid, 'enterPlan', payload, promptId, source);
+        });
       } else {
         // `cancelPlan({id?})` accepts an omitted id — `PlanMode.cancel`
         // clears whatever id is currently active. Shadow doesn't track
         // ids, so we always omit.
-        await this.core.rpc.cancelPlan(payload);
-        this._recordDispatch(sid, 'cancelPlan', payload, promptId, source);
+        const token = await dispatch(
+          () => this.core.rpc.cancelPlan(payload, { signal }),
+          'planMode',
+        );
+        commitDispatch(token, (writeShadow) => {
+          if (writeShadow) shadow.planMode = false;
+          this._recordDispatch(sid, 'cancelPlan', payload, promptId, source);
+        });
       }
-      shadow.planMode = patch.plan_mode;
     }
 
     // Swarm mode toggle. enterSwarm/exitSwarm are idempotent no-throw on
@@ -694,13 +1281,24 @@ export class PromptService
       const payload = { sessionId: sid, agentId };
       if (patch.swarm_mode) {
         const enterPayload = { ...payload, trigger: 'manual' as const };
-        await this.core.rpc.enterSwarm(enterPayload);
-        this._recordDispatch(sid, 'enterSwarm', enterPayload, promptId, source);
+        const token = await dispatch(
+          () => this.core.rpc.enterSwarm(enterPayload, { signal }),
+          'swarmMode',
+        );
+        commitDispatch(token, (writeShadow) => {
+          if (writeShadow) shadow.swarmMode = true;
+          this._recordDispatch(sid, 'enterSwarm', enterPayload, promptId, source);
+        });
       } else {
-        await this.core.rpc.exitSwarm(payload);
-        this._recordDispatch(sid, 'exitSwarm', payload, promptId, source);
+        const token = await dispatch(
+          () => this.core.rpc.exitSwarm(payload, { signal }),
+          'swarmMode',
+        );
+        commitDispatch(token, (writeShadow) => {
+          if (writeShadow) shadow.swarmMode = false;
+          this._recordDispatch(sid, 'exitSwarm', payload, promptId, source);
+        });
       }
-      shadow.swarmMode = patch.swarm_mode;
     }
 
     // Goal creation. createGoal throws KimiError on invalid input
@@ -714,8 +1312,10 @@ export class PromptService
         objective: patch.goal_objective,
         replace: false,
       };
-      await this.core.rpc.createGoal(payload);
-      this._recordDispatch(sid, 'createGoal', payload, promptId, source);
+      const token = await dispatch(() => this.core.rpc.createGoal(payload, { signal }));
+      commitDispatch(token, () => {
+        this._recordDispatch(sid, 'createGoal', payload, promptId, source);
+      });
       // `goal_objective` is a one-shot creation trigger; do not keep it on
       // the shadow.
     }
@@ -726,16 +1326,34 @@ export class PromptService
       const payload = { sessionId: sid, agentId };
       switch (patch.goal_control) {
         case 'pause':
-          await this.core.rpc.pauseGoal(payload);
-          this._recordDispatch(sid, 'pauseGoal', payload, promptId, source);
+          {
+            const token = await dispatch(() =>
+              this.core.rpc.pauseGoal(payload, { signal }),
+            );
+            commitDispatch(token, () => {
+              this._recordDispatch(sid, 'pauseGoal', payload, promptId, source);
+            });
+          }
           break;
         case 'resume':
-          await this.core.rpc.resumeGoal(payload);
-          this._recordDispatch(sid, 'resumeGoal', payload, promptId, source);
+          {
+            const token = await dispatch(() =>
+              this.core.rpc.resumeGoal(payload, { signal }),
+            );
+            commitDispatch(token, () => {
+              this._recordDispatch(sid, 'resumeGoal', payload, promptId, source);
+            });
+          }
           break;
         case 'cancel':
-          await this.core.rpc.cancelGoal(payload);
-          this._recordDispatch(sid, 'cancelGoal', payload, promptId, source);
+          {
+            const token = await dispatch(() =>
+              this.core.rpc.cancelGoal(payload, { signal }),
+            );
+            commitDispatch(token, () => {
+              this._recordDispatch(sid, 'cancelGoal', payload, promptId, source);
+            });
+          }
           break;
       }
       // `goal_control` is a one-shot action trigger; do not keep it on the
@@ -781,18 +1399,47 @@ export class PromptService
     const sid = (event as { sessionId?: string }).sessionId;
     if (sid === undefined || sid === '') return;
 
-    // Mirror live `agent.status.updated` into the per-session shadow. This
-    // keeps the shadow honest when out-of-band callers (TUI / SDK / agent
-    // itself) mutate `model` / `permission` / `planMode` between prompts.
-    // Only fields present on the event update the shadow — `thinking` is
-    // not carried here and stays whatever the last `setThinking` (or
-    // bootstrap getConfig) put there.
+    // Mirror live main-agent status into the per-session shadow. A BTW or
+    // subagent has independent controls and must never poison main's diff
+    // suppression state.
     if (isAgentStatusUpdated(event)) {
+      const statusAgentId = (event as { agentId?: string }).agentId ?? MAIN_AGENT_ID;
+      if (statusAgentId !== MAIN_AGENT_ID) return;
+      const revision = (this._agentStatusRevision.get(sid) ?? 0) + 1;
+      this._agentStatusRevision.set(sid, revision);
+      const fieldRevisions = this._agentStatusFieldRevision.get(sid) ?? {};
+      const liveSnapshot: AgentStateSnapshot = {};
+      if (event.model !== undefined) {
+        liveSnapshot.model = event.model;
+        fieldRevisions.model = revision;
+      }
+      if (event.thinkingEffort !== undefined) {
+        liveSnapshot.thinking = event.thinkingEffort as PromptThinking;
+        fieldRevisions.thinking = revision;
+      }
+      if (event.permission !== undefined) {
+        liveSnapshot.permissionMode = event.permission;
+        fieldRevisions.permissionMode = revision;
+      }
+      if (event.planMode !== undefined) {
+        liveSnapshot.planMode = event.planMode;
+        fieldRevisions.planMode = revision;
+      }
+      if (event.swarmMode !== undefined) {
+        liveSnapshot.swarmMode = event.swarmMode;
+        fieldRevisions.swarmMode = revision;
+      }
+      this._agentStatusFieldRevision.set(sid, fieldRevisions);
+      this._latestAgentStatus.set(sid, {
+        revision,
+        snapshot: {
+          ...this._latestAgentStatus.get(sid)?.snapshot,
+          ...liveSnapshot,
+        },
+      });
       const shadow = this._agentState.get(sid);
       if (shadow !== undefined) {
-        if (event.model !== undefined) shadow.model = event.model;
-        if (event.permission !== undefined) shadow.permissionMode = event.permission;
-        if (event.planMode !== undefined) shadow.planMode = event.planMode;
+        Object.assign(shadow, liveSnapshot);
       }
       // status events are also published normally; fall through to allow
       // other event-type handlers below — but there's no overlap today.
@@ -804,70 +1451,283 @@ export class PromptService
     const state = this._active.get(key);
     if (state === undefined) return;
 
+    if (isGoalUpdated(event)) {
+      if (state.agentId !== MAIN_AGENT_ID) return;
+      this._recordGoalSnapshot(state, event.snapshot);
+      if (!state.goalActive && !state.aborting && state.deferredOutcome !== null) {
+        // A live goal.updated event is newer and more authoritative than any
+        // getGoal verification already in flight. Settle directly so an
+        // uncooperative/stale verification RPC cannot pin the prompt and its
+        // queue forever; the normal identity/revision guards make a late RPC
+        // result harmless.
+        this._settleTerminalPrompt(
+          sid,
+          key,
+          state,
+          state.deferredOutcome,
+          state.turnRevision,
+        );
+      }
+      return;
+    }
+
     if (isTurnStarted(event)) {
-      // Capture the FIRST turn.started after submit as the "top-level" turn.
-      // Subsequent nested turns (e.g. subagent) carry different turnId values
-      // and are NOT promoted to the prompt's top-level.
-      state.turnId ??= event.turnId;
+      if (!state.promptDispatched) return;
+      if (!this._ownsTurnStartedEvent(state, event)) return;
+      state.turnId = event.turnId;
+      state.turnObserved = true;
+      state.turnRevision += 1;
+      state.deferredOutcome = null;
       return;
     }
 
     if (isTurnEnded(event)) {
+      if (!state.promptDispatched) return;
       // Only fire on the top-level turn end. Nested turn.ended events fly
       // through without prompt-level synthesis.
       if (state.turnId === null || event.turnId !== state.turnId) return;
 
-      // If we already synthesized via abort RPC, don't double-emit. Mark
-      // completed to prevent stale lookups, but emit nothing.
-      if (state.aborted) {
-        this._active.delete(key);
-        void this._startNextQueued(sid, state.agentId);
+      state.turnId = null;
+      state.turnRevision += 1;
+      state.deferredOutcome = event.reason;
+
+      if (state.aborting) {
         return;
       }
 
-      const reason = event.reason;
-      if (reason === 'cancelled') {
-        // The model produced a cancellation that we didn't initiate via
-        // abort RPC (or it slipped past the optimistic flag). Synthesize
-        // prompt.aborted.
-        state.aborted = true;
-        const synth: SyntheticPromptAbortedEvent = {
-          type: 'prompt.aborted',
-          agentId: state.agentId,
-          sessionId: sid,
-          promptId: state.promptId,
-          abortedAt: new Date().toISOString(),
-        };
-        this._active.delete(key);
-        // Fire typed listeners BEFORE publishing the synth event.
-        this._onDidAbort.fire(synth);
-        this.eventService.publish(synth as unknown as Event);
-        void this._startNextQueued(sid, state.agentId);
+      if (state.agentId === MAIN_AGENT_ID) {
+        void this._verifyTerminalPrompt(sid, key, state);
         return;
       }
 
-      state.completed = true;
-      const synth: SyntheticPromptCompletedEvent = {
-        type: 'prompt.completed',
-        agentId: state.agentId,
-        sessionId: sid,
-        promptId: state.promptId,
-        finishedAt: new Date().toISOString(),
-        reason: reason === 'failed' || reason === 'blocked' ? reason : 'completed',
-      };
-      this._active.delete(key);
-      // Fire typed listeners BEFORE publishing the synth event.
-      this._onDidComplete.fire(synth);
-      this.eventService.publish(synth as unknown as Event);
-      void this._startNextQueued(sid, state.agentId);
+      this._settleTerminalPrompt(sid, key, state, event.reason, state.turnRevision);
+    }
+  }
+
+  private _ownsTurnStartedEvent(
+    state: PromptState,
+    event: Event & {
+      type: 'turn.started';
+      turnId: number;
+      promptId?: string;
+      deferredPromptId?: string;
+    },
+  ): boolean {
+    if (!state.turnObserved) {
+      if (event.promptId !== undefined) {
+        if (event.promptId !== state.promptId) return false;
+        if (state.acceptedTurnId !== null && event.turnId !== state.acceptedTurnId) {
+          return false;
+        }
+        if (
+          state.acceptedDeferredPromptId !== null &&
+          event.deferredPromptId !== state.acceptedDeferredPromptId
+        ) {
+          return false;
+        }
+        return true;
+      }
+
+      // Current workers always echo `promptId`. The acknowledgement checks are
+      // retained for in-process/older bridges and make the fallback precise
+      // whenever the admission result carries a turn/deferred id.
+      if (!state.dispatchAcknowledged) return false;
+      if (state.acceptedTurnId !== null) return event.turnId === state.acceptedTurnId;
+      if (state.acceptedDeferredPromptId !== null) {
+        return event.deferredPromptId === state.acceptedDeferredPromptId;
+      }
+      return true;
     }
+
+    // A goal worker owns continuation turns after the initially correlated
+    // turn. They intentionally carry no caller prompt id; accept them only
+    // after the previous owned turn ended while the same goal remains active.
+    return state.turnId === null && state.goalActive && event.promptId === undefined;
+  }
+
+  private _recordGoalSnapshot(
+    state: PromptState,
+    snapshot: null | { status: string },
+  ): void {
+    state.goalRevision += 1;
+    state.goalStatus = snapshot?.status ?? null;
+    state.goalActive = state.goalStatus === 'active';
+    if (state.goalActive) state.goalDriven = true;
+  }
+
+  private async _verifyTerminalPrompt(
+    sid: string,
+    key: string,
+    state: PromptState,
+  ): Promise<void> {
+    if (state.terminalCheckPending || state.deferredOutcome === null) return;
+
+    state.terminalCheckPending = true;
+    const outcome = state.deferredOutcome;
+    const goalRevision = state.goalRevision;
+    const turnRevision = state.turnRevision;
+    try {
+      try {
+        const current = await this.core.rpc.getGoal({
+          sessionId: sid,
+          agentId: state.agentId,
+        });
+        if (this._active.get(key) !== state) return;
+        if (state.goalRevision === goalRevision) {
+          this._recordGoalSnapshot(state, current.goal);
+        }
+      } catch (error) {
+        this._warnBestEffort(
+          { sid, promptId: state.promptId, error },
+          'failed to verify prompt termination goal state',
+        );
+      }
+
+      this._settleTerminalPrompt(sid, key, state, outcome, turnRevision);
+    } finally {
+      state.terminalCheckPending = false;
+      if (
+        this._active.get(key) === state &&
+        !state.aborting &&
+        state.turnId === null &&
+        !state.goalActive &&
+        state.deferredOutcome !== null &&
+        state.turnRevision !== turnRevision
+      ) {
+        void this._verifyTerminalPrompt(sid, key, state);
+      }
+    }
+  }
+
+  private _warnBestEffort(obj: object | string, msg?: string): void {
+    try {
+      this._logger.warn(obj, msg);
+    } catch {
+      // Goal verification is advisory at this terminal boundary. A broken
+      // diagnostic sink must not prevent the prompt from settling.
+    }
+  }
+
+  private _settleTerminalPrompt(
+    sid: string,
+    key: string,
+    state: PromptState,
+    outcome: NonNullable<PromptState['deferredOutcome']>,
+    turnRevision: number,
+  ): void {
+    if (
+      this._active.get(key) !== state ||
+      state.aborting ||
+      state.aborted ||
+      state.turnId !== null ||
+      state.turnRevision !== turnRevision ||
+      state.deferredOutcome !== outcome ||
+      this._steerReservations.get(key)?.target === state ||
+      (state.agentId === MAIN_AGENT_ID && state.goalActive)
+    ) {
+      return;
+    }
+
+    state.deferredOutcome = null;
+    if (outcome === 'cancelled') {
+      this._finishAbortedPrompt(sid, key, state, true);
+      return;
+    }
+
+    const reason =
+      outcome === 'completed' && state.goalDriven && state.goalStatus === 'blocked'
+        ? 'blocked'
+        : outcome;
+    this._completePrompt(sid, key, state, reason);
+  }
+
+  private _resumeTerminalAfterSteer(
+    sid: string,
+    key: string,
+    state: PromptState,
+  ): void {
+    if (
+      this._active.get(key) !== state ||
+      state.aborting ||
+      state.turnId !== null ||
+      state.deferredOutcome === null
+    ) {
+      return;
+    }
+    if (state.agentId === MAIN_AGENT_ID && state.terminalCheckPending) {
+      // The in-flight verification observes the reservation removal before it
+      // attempts settlement. Re-querying after a completed verification would
+      // create a TOCTOU window that can attach a newly-created goal to this old
+      // prompt.
+      return;
+    }
+    this._settleTerminalPrompt(
+      sid,
+      key,
+      state,
+      state.deferredOutcome,
+      state.turnRevision,
+    );
+  }
+
+  private _finishAbortedPrompt(
+    sid: string,
+    key: string,
+    state: PromptState,
+    terminalBarrier = false,
+  ): void {
+    if (this._active.get(key) !== state) return;
+    state.aborting = false;
+    if (terminalBarrier) this._signalWorkerTerminal(state);
+    this._markAbortedPrompt(sid, key, state);
+    if (terminalBarrier || !state.startupPending) {
+      this._retireStartupState(sid, key, state);
+    }
+  }
+
+  private _markAbortedPrompt(sid: string, key: string, state: PromptState): void {
+    if (state.aborted) return;
+    state.aborted = true;
+    state.deferredOutcome = null;
+    this._recordTerminalPromptId(key, state.promptId);
+    if (state.submitted) this._publishAborted(sid, state.agentId, state.promptId);
+  }
+
+  private _completePrompt(
+    sid: string,
+    key: string,
+    state: PromptState,
+    reason: SyntheticPromptCompletedEvent['reason'],
+  ): void {
+    if (this._active.get(key) !== state) return;
+    if (state.completed) return;
+    this._signalWorkerTerminal(state);
+    state.completed = true;
+    const synth: SyntheticPromptCompletedEvent = {
+      type: 'prompt.completed',
+      agentId: state.agentId,
+      sessionId: sid,
+      promptId: state.promptId,
+      finishedAt: new Date().toISOString(),
+      reason,
+    };
+    this._recordTerminalPromptId(key, state.promptId);
+    this._onDidComplete.fire(synth);
+    this.eventService.publish(synth as unknown as Event);
+    // A verified turn.ended is itself the terminal worker barrier. A delayed
+    // response to the earlier prompt RPC cannot restart that worker, so it
+    // must not pin this completed prompt or the queue.
+    this._retireStartupState(sid, key, state);
   }
 
   /**
    * Test helper — peek at active prompt state.
    */
-  _activeForTest(sid: string): Readonly<PromptState> | undefined {
-    const state = this._active.get(promptKey(sid, MAIN_AGENT_ID));
+  _activeForTest(
+    sid: string,
+    agentId = MAIN_AGENT_ID,
+  ): Readonly<PromptState> | undefined {
+    const state = this._active.get(promptKey(sid, agentId));
     return state === undefined ? undefined : { ...state };
   }
 
@@ -911,13 +1771,38 @@ export class PromptService
    * contract; the underscore prefix is a "do not use in prod" signal.
    */
   _injectActiveForTest(sid: string, promptId: string, turnId: number | null): void {
+    const terminal = createWorkerTerminalBarrier();
     this._active.set(promptKey(sid, MAIN_AGENT_ID), {
       agentId: MAIN_AGENT_ID,
       promptId,
       userMessageId: `msg_${sid}_pending_${promptId}`,
       body: { content: [{ type: 'text', text: 'test' }] },
       createdAt: new Date().toISOString(),
+      sessionRevision: this._getSessionRevision(sid),
+      preflightPending: false,
+      readyToStart: true,
+      submitted: true,
+      startupPending: false,
+      startupFailed: false,
+      promptDispatched: turnId !== null,
+      dispatchAcknowledged: turnId !== null,
+      acceptedTurnId: turnId,
+      acceptedDeferredPromptId: null,
+      dispatchController: new AbortController(),
+      workerTerminal: false,
+      workerTerminalBarrier: terminal.promise,
+      resolveWorkerTerminal: terminal.resolve,
       turnId,
+      turnObserved: turnId !== null,
+      turnRevision: 0,
+      goalStatus: null,
+      goalActive: false,
+      goalDriven: false,
+      goalRevision: 0,
+      deferredOutcome: null,
+      terminalCheckPending: false,
+      aborting: false,
+      abortPromise: undefined,
       completed: false,
       aborted: false,
     });
@@ -929,19 +1814,144 @@ export class PromptService
     sid: string,
     promptId: string,
     body: PromptSubmission,
+    sessionRevision: number,
   ): PromptState {
+    const terminal = createWorkerTerminalBarrier();
     return {
       agentId: body.agent_id ?? MAIN_AGENT_ID,
       promptId,
       userMessageId: `msg_${sid}_pending_${promptId}`,
       body,
       createdAt: new Date().toISOString(),
+      sessionRevision,
+      preflightPending: true,
+      readyToStart: false,
+      submitted: false,
+      startupPending: false,
+      startupFailed: false,
+      promptDispatched: false,
+      dispatchAcknowledged: false,
+      acceptedTurnId: null,
+      acceptedDeferredPromptId: null,
+      dispatchController: new AbortController(),
+      workerTerminal: false,
+      workerTerminalBarrier: terminal.promise,
+      resolveWorkerTerminal: terminal.resolve,
       turnId: null,
+      turnObserved: false,
+      turnRevision: 0,
+      goalStatus: null,
+      goalActive: false,
+      goalDriven: false,
+      goalRevision: 0,
+      deferredOutcome: null,
+      terminalCheckPending: false,
+      aborting: false,
+      abortPromise: undefined,
       completed: false,
       aborted: false,
     };
   }
 
+  private _getSessionRevision(sid: string): number {
+    return this._sessionRevision.get(sid) ?? 0;
+  }
+
+  private _getSessionLifecycleSignal(sid: string, revision: number): AbortSignal {
+    if (this._disposed || this._getSessionRevision(sid) !== revision) {
+      const retired = new AbortController();
+      retired.abort(
+        abortError(this._disposed ? 'Prompt service disposed' : 'Session closed'),
+      );
+      return retired.signal;
+    }
+    const existing = this._sessionLifecycleControllers.get(sid);
+    if (existing?.revision === revision) return existing.controller.signal;
+    const controller = new AbortController();
+    this._sessionLifecycleControllers.set(sid, { revision, controller });
+    return controller.signal;
+  }
+
+  private _assertSessionRevision(sid: string, expected: number): void {
+    if (this._disposed || this._getSessionRevision(sid) !== expected) {
+      throw new SessionNotFoundError(sid);
+    }
+  }
+
+  private _assertSubmissionAuthority(sid: string, key: string, state: PromptState): void {
+    this._assertSessionRevision(sid, state.sessionRevision);
+    const registered =
+      this._active.get(key) === state ||
+      (this._queued.get(key) ?? []).some((item) => item === state);
+    if (!registered || state.aborting || state.aborted) {
+      throw new PromptAlreadyCompletedError(sid, state.promptId);
+    }
+  }
+
+  private _assertPromptAuthority(sid: string, key: string, state: PromptState): void {
+    if (
+      this._getSessionRevision(sid) !== state.sessionRevision ||
+      this._active.get(key) !== state ||
+      state.aborting ||
+      state.aborted
+    ) {
+      throw new PromptAlreadyCompletedError(sid, state.promptId);
+    }
+  }
+
+  private _retireStartupState(sid: string, key: string, state: PromptState): void {
+    if (this._active.get(key) !== state) return;
+    this._active.delete(key);
+    this._startNextQueued(sid, state.agentId);
+  }
+
+  private _discardRegisteredSubmission(sid: string, key: string, state: PromptState): void {
+    if (this._active.get(key) === state) {
+      if ((state.aborted || state.aborting) && state.startupPending) return;
+      this._retireStartupState(sid, key, state);
+      return;
+    }
+    const queue = this._queued.get(key);
+    const index = queue?.indexOf(state) ?? -1;
+    if (queue === undefined || index < 0) return;
+    queue.splice(index, 1);
+    if (queue.length === 0) this._queued.delete(key);
+  }
+
+  private _settleStartupFailure(sid: string, key: string, state: PromptState): void {
+    if (this._active.get(key) !== state) return;
+    if (state.aborted || state.completed) {
+      this._retireStartupState(sid, key, state);
+      return;
+    }
+    if (state.submitted) {
+      this._completePrompt(sid, key, state, 'failed');
+      return;
+    }
+    this._retireStartupState(sid, key, state);
+  }
+
+  private _signalWorkerTerminal(state: PromptState): void {
+    if (state.workerTerminal) return;
+    state.workerTerminal = true;
+    state.resolveWorkerTerminal();
+  }
+
+  private _trackStartupFence<T>(
+    sid: string,
+    key: string,
+    state: PromptState,
+    request: Promise<T>,
+  ): Promise<T> {
+    state.startupPending = true;
+    return request.finally(() => {
+      state.startupPending = false;
+      if ((state.aborted || state.completed) && !state.aborting) {
+        this._retireStartupState(sid, key, state);
+      }
+    });
+  }
+
   private _enqueue(sid: string, state: PromptState): void {
     const key = promptKey(sid, state.agentId);
     let queue = this._queued.get(key);
@@ -961,40 +1971,179 @@ export class PromptService
     this._queued.set(key, queue);
   }
 
-  private _restoreSteeredQueueItems(sid: string, selected: readonly PromptState[]): void {
-    const queue = this._queued.get(promptKey(sid, MAIN_AGENT_ID)) ?? [];
-    const queueIds = new Set(queue.map((state) => state.promptId));
-    const missing = selected.filter((state) => !queueIds.has(state.promptId));
-    this._replaceQueue(sid, MAIN_AGENT_ID, [...missing, ...queue]);
+  private _cancelReservedPrompts(
+    sid: string,
+    key: string,
+    selected: readonly PromptState[],
+  ): void {
+    const selectedSet = new Set(selected);
+    const queue = this._queued.get(key) ?? [];
+    const claimed = selected.filter((state) => queue.includes(state));
+
+    // Commit the entire batch before the first abort signal or event exposes a
+    // synchronous re-entrancy point. Observers must never see an aborted prompt
+    // still present in the authoritative queue, nor a half-cancelled selection.
+    this._replaceQueue(
+      sid,
+      MAIN_AGENT_ID,
+      queue.filter((state) => !selectedSet.has(state)),
+    );
+    for (const state of claimed) {
+      state.aborted = true;
+      state.preflightPending = false;
+      this._recordTerminalPromptId(key, state.promptId);
+    }
+    for (const state of claimed) {
+      state.dispatchController.abort(userCancellationReason());
+    }
+    for (const state of claimed) {
+      if (state.submitted) this._publishAborted(sid, state.agentId, state.promptId);
+    }
   }
 
-  private async _startNextQueued(sid: string, agentId = MAIN_AGENT_ID): Promise<void> {
+  private _startNextQueued(sid: string, agentId = MAIN_AGENT_ID): void {
+    if (this._disposed) return;
     const key = promptKey(sid, agentId);
+    if (this._steerReservations.has(key)) return;
     const active = this._active.get(key);
-    if (active !== undefined && !active.completed && !active.aborted) return;
+    if (active !== undefined) return;
     const queue = this._queued.get(key);
     const next = queue?.shift();
     if (queue !== undefined && queue.length === 0) {
       this._queued.delete(key);
     }
     if (next === undefined) return;
-    await this._startPrompt(sid, next).catch(() => {
-      void this._startNextQueued(sid, agentId);
-    });
+    this._active.set(key, next);
+    if (!next.readyToStart) return;
+    void this._startPrompt(sid, next).catch(() => undefined);
   }
 
-  private async _requireSession(sid: string): Promise<void> {
-    const matches = await this.core.rpc.listSessions({ sessionId: sid });
+  private async _requireSession(sid: string, signal?: AbortSignal): Promise<void> {
+    if (this._disposed) throw abortError('Prompt service disposed');
+    const request = this.core.rpc.listSessions({ sessionId: sid }, { signal });
+    const matches = signal === undefined ? await request : await abortable(request, signal);
+    if (this._disposed) throw abortError('Prompt service disposed');
     if (matches.length === 0) {
       throw new SessionNotFoundError(sid);
     }
   }
 
+  private async _withSessionControlLock<T>(
+    sid: string,
+    sessionRevision: number,
+    operation: () => Promise<T>,
+  ): Promise<T> {
+    const key = `${sid}\u0000revision:${String(sessionRevision)}`;
+    const previous = this._controlTails.get(key) ?? Promise.resolve();
+    let release!: () => void;
+    const barrier = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const tail = previous.then(
+      () => barrier,
+      () => barrier,
+    );
+    this._controlTails.set(key, tail);
+    await previous.catch(() => undefined);
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (this._controlTails.get(key) === tail) this._controlTails.delete(key);
+    }
+  }
+
+  private _findActivePrompt(sid: string, pid: string): [string, PromptState] | undefined {
+    const prefix = `${sid}\u0000`;
+    for (const [key, state] of this._active) {
+      if (key.startsWith(prefix) && state.promptId === pid) return [key, state];
+    }
+    return undefined;
+  }
+
+  private _findQueuedPrompt(
+    sid: string,
+    pid: string,
+  ): [string, PromptState[], number, PromptState] | undefined {
+    const prefix = `${sid}\u0000`;
+    for (const [key, queue] of this._queued) {
+      if (!key.startsWith(prefix)) continue;
+      const index = queue.findIndex((state) => state.promptId === pid);
+      if (index >= 0) return [key, queue, index, queue[index]!];
+    }
+    return undefined;
+  }
+
+  private _findSteerReservation(
+    sid: string,
+    pid: string,
+  ): [string, SteerReservation] | undefined {
+    const prefix = `${sid}\u0000`;
+    for (const [key, reservation] of this._steerReservations) {
+      if (
+        key.startsWith(prefix) &&
+        reservation.selected.some((state) => !state.aborted && state.promptId === pid)
+      ) {
+        return [key, reservation];
+      }
+    }
+    return undefined;
+  }
+
+  private _hasTerminalPrompt(sid: string, pid: string): boolean {
+    const prefix = `${sid}\u0000`;
+    for (const [key, terminalIds] of this._terminalPromptIds) {
+      if (key.startsWith(prefix) && terminalIds.has(pid)) return true;
+    }
+    return false;
+  }
+
+  private _recordTerminalPromptId(key: string, pid: string): void {
+    let terminalIds = this._terminalPromptIds.get(key);
+    if (terminalIds === undefined) {
+      terminalIds = new Set<string>();
+      this._terminalPromptIds.set(key, terminalIds);
+    }
+    terminalIds.delete(pid);
+    terminalIds.add(pid);
+    while (terminalIds.size > TERMINAL_PROMPT_CAP) {
+      const oldest = terminalIds.values().next().value;
+      if (oldest === undefined) break;
+      terminalIds.delete(oldest);
+    }
+  }
+
   override dispose(): void {
-    if (this._store.isDisposed) return;
+    if (this._store.isDisposed || this._disposed) return;
+    this._disposed = true;
+    const reason = abortError('Prompt service disposed');
+    for (const state of this._active.values()) {
+      state.dispatchController.abort(reason);
+      this._signalWorkerTerminal(state);
+    }
+    for (const queue of this._queued.values()) {
+      for (const state of queue) {
+        state.dispatchController.abort(reason);
+        this._signalWorkerTerminal(state);
+      }
+    }
+    for (const reservation of this._steerReservations.values()) {
+      reservation.controller.abort(reason);
+    }
+    for (const { controller } of this._sessionLifecycleControllers.values()) {
+      controller.abort(reason);
+    }
     this._active.clear();
     this._queued.clear();
+    this._steerReservations.clear();
+    this._terminalPromptIds.clear();
+    this._sessionRevision.clear();
+    this._controlTails.clear();
+    this._sessionLifecycleControllers.clear();
     this._agentState.clear();
+    this._agentStatusRevision.clear();
+    this._agentStatusFieldRevision.clear();
+    this._latestAgentStatus.clear();
     this._dispatchLog.clear();
     // `_onDidComplete` and `_onDidAbort` are registered via `this._register(...)`,
     // so `super.dispose()` flushes their listeners.
diff --git a/packages/agent-core/src/session/index.ts b/packages/agent-core/src/session/index.ts
index 2442b900b1..d3741f068f 100644
--- a/packages/agent-core/src/session/index.ts
+++ b/packages/agent-core/src/session/index.ts
@@ -6,7 +6,7 @@ import type { SessionWarning } from '@moonshot-ai/protocol';
 import { ErrorCodes, KimiError } from '#/errors';
 import { getRootLogger, log } from '#/logging/logger';
 import type { Logger, SessionLogHandle } from '#/logging/types';
-import type { KimiConfig, SDKSessionRPC } from '#/rpc';
+import type { AgentEvent, KimiConfig, SDKSessionRPC } from '#/rpc';
 import { proxyWithExtraPayload } from '#/rpc/types';
 
 import { Agent, type AgentOptions, type AgentType } from '../agent';
@@ -55,7 +55,7 @@ import { sessionMediaOriginalsDir } from '../tools/support/image-originals';
 import type { ToolServices } from '../tools/support/services';
 import { FlagResolver, type ExperimentalFlagResolver } from '../flags';
 import { ImageLimits } from '../tools/support/image-limits';
-import { abortError } from '../utils/abort';
+import { abortable, abortError } from '../utils/abort';
 
 export interface SessionOptions {
   readonly kaos: Kaos;
@@ -113,12 +113,14 @@ interface ResumedAgent {
 }
 
 type AgentEntry = Agent | Promise<ResumedAgent>;
+type SessionAgentEvent = AgentEvent & { readonly agentId: string };
 
 export interface CreateAgentOptions {
   readonly profile?: ResolvedAgentProfile;
   readonly parentAgentId?: string;
   readonly swarmItem?: string;
   readonly persistMetadata?: boolean;
+  readonly signal?: AbortSignal;
 }
 
 export interface SessionMeta {
@@ -193,6 +195,13 @@ export class Session {
   private agentsMdWarning: string | undefined;
   private printSteerDeadline: number | undefined;
   private printSteerTurns = 0;
+  private lifecycleState: 'open' | 'closing' | 'closed' = 'open';
+  private closePromise: Promise<void> | null = null;
+  private readonly pendingAgentOperations = new Set<Promise<unknown>>();
+  private readonly pendingSessionStartOperations = new Set<Promise<void>>();
+  private readonly provisionalAgents = new Set<Agent>();
+  private readonly lifecycleAbortController = new AbortController();
+  private sessionEventStreamClosed = false;
 
   constructor(public readonly options: SessionOptions) {
     // Attach the per-session log sink up front so the constructor's
@@ -308,26 +317,41 @@ export class Session {
     return this.persistenceKaos.withCwd(cwd);
   }
 
-  async createMain() {
+  createMain(): Promise<Agent> {
+    this.assertOpen();
+    return this.trackPendingAgentOperation(this.createMainInternal());
+  }
+
+  private async createMainInternal(): Promise<Agent> {
     const { agent } = await this.createAgent({ type: 'main' }, {
       profile: DEFAULT_AGENT_PROFILES['agent'],
     });
+    this.assertOpen();
     if (this.options.drainAgentTasksOnStop) {
       agent.printDrainAgentTasksOnStop = true;
     }
     await this.triggerSessionStart('startup');
+    this.assertOpen();
     return agent;
   }
 
-  async resume(): Promise<{ warning?: string }> {
+  resume(): Promise<{ warning?: string }> {
+    this.assertOpen();
+    return this.trackPendingAgentOperation(this.resumeInternal());
+  }
+
+  private async resumeInternal(): Promise<{ warning?: string }> {
     await this.skillsReady;
+    this.assertOpen();
     this.log.info('session resume', { app_version: this.options.appVersion });
     const { agents } = await this.readMetadata();
+    this.assertOpen();
     this.agents.clear();
     // Only the main agent is needed to reopen the session; subagents replay
     // lazily when an RPC or Agent(resume=...) call asks for their state.
     const { warning } =
       agents['main'] === undefined ? { warning: undefined } : await this.resumeAgent('main');
+    this.assertOpen();
     // A session migrated from an external tool ships a wire without the
     // `config.update` bootstrap events a natively-created agent writes, so the
     // main agent comes back with an empty system prompt and no tools. Apply the
@@ -337,21 +361,63 @@ export class Session {
     const profile = DEFAULT_AGENT_PROFILES['agent'];
     if (main !== undefined && profile !== undefined && main.config.systemPrompt === '') {
       await this.bootstrapAgentProfile(main, profile);
+      this.assertOpen();
     }
     await this.triggerSessionStart('resume');
+    this.assertOpen();
     return { warning };
   }
 
-  async close(): Promise<void> {
+  close(): Promise<void> {
+    return this.startClose(false);
+  }
+
+  closeForReload(): Promise<void> {
+    return this.startClose(true);
+  }
+
+  private startClose(forReload: boolean): Promise<void> {
+    if (this.closePromise !== null) return this.closePromise;
+    this.lifecycleState = 'closing';
+    this.lifecycleAbortController.abort(abortError('Session closed'));
+    let resolveClose!: () => void;
+    let rejectClose!: (reason: unknown) => void;
+    const close = new Promise<void>((resolve, reject) => {
+      resolveClose = resolve;
+      rejectClose = reject;
+    });
+    this.closePromise = close;
+    void this.performClose(forReload).then(
+      () => {
+        this.lifecycleState = 'closed';
+        resolveClose();
+      },
+      (error: unknown) => {
+        this.lifecycleState = 'closed';
+        rejectClose(error);
+      },
+    );
+    return close;
+  }
+
+  private async performClose(forReload: boolean): Promise<void> {
     try {
+      // SessionStart is an ordering barrier, not merely best-effort setup:
+      // SessionEnd must never overtake an already-started hook. Real hook
+      // processes observe lifecycleAbortController and settle promptly; the
+      // unbounded join also preserves ordering if an external hook boundary
+      // ignores cancellation.
+      await this.settlePendingSessionStartOperationsOnClose();
+      await this.settlePendingAgentOperationsOnClose();
       await Promise.allSettled(
         Array.from(this.readyAgents(), async (agent) => agent.cron?.stop()),
       );
       await this.cancelActiveTurnsOnClose();
-      await this.stopBackgroundTasksOnExit();
+      if (!forReload) await this.stopBackgroundTasksOnExit();
       await this.flushMetadata();
-      await this.triggerSessionEnd('exit');
+      if (!forReload) await this.triggerSessionEnd('exit');
     } finally {
+      this.closeAgentEventStreams();
       try {
         await this.mcp.shutdown();
       } finally {
@@ -360,18 +426,34 @@ export class Session {
     }
   }
 
-  async closeForReload(): Promise<void> {
-    try {
-      await Promise.allSettled(
-        Array.from(this.readyAgents(), async (agent) => agent.cron?.stop()),
-      );
-      await this.flushMetadata();
-    } finally {
-      try {
-        await this.mcp.shutdown();
-      } finally {
-        await this.logHandle?.close();
-      }
+  private async settlePendingSessionStartOperationsOnClose(): Promise<void> {
+    while (this.pendingSessionStartOperations.size > 0) {
+      await Promise.allSettled(this.pendingSessionStartOperations);
+    }
+  }
+
+  private async settlePendingAgentOperationsOnClose(): Promise<void> {
+    const pending = new Set<Promise<unknown>>(this.pendingAgentOperations);
+    for (const entry of this.agents.values()) {
+      if (entry instanceof Promise) pending.add(entry);
+    }
+
+    for (const agent of this.provisionalAgents) {
+      agent.closeEventStream();
+      pending.add(agent.cron?.stop() ?? Promise.resolve());
+      pending.add(agent.turn.shutdown(abortError('Session closed')));
+    }
+    if (pending.size === 0) return;
+
+    const settled = await waitForSettlementOrTimeout(
+      Promise.allSettled(pending),
+      ACTIVE_TURN_CLOSE_TIMEOUT_MS,
+    );
+    if (!settled) {
+      this.reportWarning('timed out waiting for pending agent setup during session close', {
+        pendingCount: pending.size,
+        timeoutMs: ACTIVE_TURN_CLOSE_TIMEOUT_MS,
+      });
     }
   }
 
@@ -385,6 +467,11 @@ export class Session {
     await Promise.allSettled(cancellations);
   }
 
+  private closeAgentEventStreams(): void {
+    this.sessionEventStreamClosed = true;
+    for (const agent of this.readyAgents()) agent.closeEventStream();
+  }
+
   private activeBackgroundAgentIds(): Set<string> {
     const agentIds = new Set<string>();
     for (const agent of this.readyAgents()) {
@@ -398,24 +485,10 @@ export class Session {
   }
 
   private async cancelAgentTurnOnClose(agent: Agent): Promise<void> {
-    if (!agent.turn.hasActiveTurn) return;
-
-    let waitForTurn: Promise<unknown>;
-    try {
-      waitForTurn = agent.turn.waitForCurrentTurn();
-    } catch (error: unknown) {
-      this.log.debug('active turn wait unavailable during session close', {
-        agentType: agent.type,
-        agentHomedir: agent.homedir,
-        error,
-      });
-      return;
-    }
-
-    agent.turn.cancel(undefined, abortError('Session closed'));
-    const settled = await waitForSettlementOrTimeout(waitForTurn, ACTIVE_TURN_CLOSE_TIMEOUT_MS);
+    const shutdown = agent.turn.shutdown(abortError('Session closed'));
+    const settled = await waitForSettlementOrTimeout(shutdown, ACTIVE_TURN_CLOSE_TIMEOUT_MS);
     if (!settled) {
-      this.log.warn('timed out waiting for active turn to cancel during session close', {
+      this.reportWarning('timed out waiting for agent work to stop during session close', {
         agentType: agent.type,
         agentHomedir: agent.homedir,
         timeoutMs: ACTIVE_TURN_CLOSE_TIMEOUT_MS,
@@ -592,37 +665,94 @@ export class Session {
     config: Partial<AgentOptions>,
     options: CreateAgentOptions = {},
   ): Promise<{ readonly id: string; readonly agent: Agent }> {
-    await this.skillsReady;
+    this.assertOpen();
+    return this.trackPendingAgentOperation(this.createAgentInternal(config, options));
+  }
+
+  private trackPendingAgentOperation<T>(operation: Promise<T>): Promise<T> {
+    this.pendingAgentOperations.add(operation);
+    void operation.then(
+      () => this.pendingAgentOperations.delete(operation),
+      () => this.pendingAgentOperations.delete(operation),
+    );
+    return operation;
+  }
+
+  private async createAgentInternal(
+    config: Partial<AgentOptions>,
+    options: CreateAgentOptions,
+  ): Promise<{ readonly id: string; readonly agent: Agent }> {
+    if (options.signal === undefined) {
+      await this.skillsReady;
+    } else {
+      await abortable(this.skillsReady, options.signal);
+    }
+    this.assertOpen();
     const type = config.type ?? 'main';
     const id = type === 'main' ? 'main' : this.nextGeneratedAgentId();
     const homedir = config.homedir ?? join(this.options.homedir, 'agents', id);
     const parentAgentId = options.parentAgentId ?? null;
     const agent = this.instantiateAgent(id, homedir, type, config, parentAgentId);
-    if (options.profile) {
-      await this.bootstrapAgentProfile(agent, options.profile);
-    }
+    this.provisionalAgents.add(agent);
+    try {
+      if (options.profile) {
+        const bootstrap = this.bootstrapAgentProfile(agent, options.profile);
+        if (options.signal === undefined) {
+          await bootstrap;
+        } else {
+          await abortable(bootstrap, options.signal);
+        }
+        this.assertOpen();
+      }
 
-    this.agents.set(id, agent);
-    if (options.persistMetadata !== false) {
-      this.metadata.agents[id] = {
-        homedir,
-        type,
-        parentAgentId,
-        swarmItem: options.swarmItem,
-      };
-      void this.writeMetadata();
-    }
+      this.assertOpen();
+      this.agents.set(id, agent);
+      this.provisionalAgents.delete(agent);
+      if (options.persistMetadata !== false) {
+        this.metadata.agents[id] = {
+          homedir,
+          type,
+          parentAgentId,
+          swarmItem: options.swarmItem,
+        };
+        void this.writeMetadata();
+      }
 
-    return { id, agent };
+      return { id, agent };
+    } catch (error) {
+      await this.disposeProvisionalAgent(agent);
+      throw error;
+    }
   }
 
   async ensureAgentResumed(id: string): Promise<Agent> {
+    this.assertOpen();
     const entry = this.agents.get(id);
-    if (entry !== undefined) return (await this.resolveAgentEntry(entry)).agent;
+    if (entry !== undefined) {
+      const agent = (await this.resolveAgentEntry(entry)).agent;
+      this.assertOpen();
+      return agent;
+    }
     if (this.metadata.agents[id] === undefined) {
       throw new KimiError(ErrorCodes.AGENT_NOT_FOUND, `Agent "${id}" was not found`);
     }
-    return (await this.resumeAgent(id)).agent;
+    const agent = (await this.resumeAgent(id)).agent;
+    this.assertOpen();
+    return agent;
+  }
+
+  private assertOpen(): void {
+    if (this.lifecycleState === 'open') return;
+    throw new KimiError(ErrorCodes.SESSION_CLOSED, 'Session is closing or already closed');
+  }
+
+  private async disposeProvisionalAgent(agent: Agent): Promise<void> {
+    this.provisionalAgents.delete(agent);
+    agent.closeEventStream();
+    await Promise.allSettled([
+      agent.cron?.stop(),
+      agent.turn.shutdown(abortError('Session closed')),
+    ]);
   }
 
   /**
@@ -639,6 +769,7 @@ export class Session {
       this.options.kimiHomeDir,
       { additionalDirs: this.additionalDirs },
     );
+    this.assertOpen();
     agent.useProfile(profile, context, this.options.kimiHomeDir);
     const { agentsMdWarning } = context;
     if (agentsMdWarning !== undefined) {
@@ -852,7 +983,7 @@ export class Session {
   private emitInitialMcpLoadError(error: unknown): void {
     const message = error instanceof Error ? error.message : String(error);
     this.log.error('mcp initial load failed', error);
-    void this.rpc.emitEvent({
+    this.emitEvent({
       type: 'error',
       agentId: 'main',
       ...makeErrorPayload(ErrorCodes.MCP_STARTUP_FAILED, message),
@@ -862,7 +993,7 @@ export class Session {
   private onMcpServerStatusChange(entry: McpServerEntry): void {
     // Always surface server-level status changes to clients so the TUI/SDK
     // can keep its dashboard in sync, even before the main agent exists.
-    void this.rpc.emitEvent({
+    this.emitEvent({
       type: 'mcp.server.status',
       agentId: 'main',
       server: {
@@ -875,6 +1006,34 @@ export class Session {
     });
   }
 
+  /** Deliver a session-scoped event without letting an external observer steer engine control flow. */
+  emitEvent(event: SessionAgentEvent): void {
+    if (this.sessionEventStreamClosed) return;
+    try {
+      const delivery = this.rpc.emitEvent(event);
+      if (delivery !== undefined) {
+        void Promise.resolve(delivery).catch((error: unknown) => {
+          this.reportEventDeliveryFailure(event.type, error);
+        });
+      }
+    } catch (error) {
+      this.reportEventDeliveryFailure(event.type, error);
+    }
+  }
+
+  private reportEventDeliveryFailure(eventType: AgentEvent['type'], error: unknown): void {
+    this.reportWarning('session event delivery failed', { eventType, error });
+  }
+
+  private reportWarning(message: string, payload: unknown): void {
+    try {
+      this.log.warn(message, payload);
+    } catch {
+      // Diagnostic sinks are outside session control flow. They must not turn
+      // event delivery or bounded close-timeout reporting into a failure.
+    }
+  }
+
   private refreshAgentBuiltinTools(): void {
     for (const agent of this.readyAgents()) {
       if (!agent.config.hasProvider) continue;
@@ -962,6 +1121,7 @@ export class Session {
     id: string,
     stack: readonly string[] = [],
   ): Promise<ResumedAgent> {
+    this.assertOpen();
     if (stack.includes(id)) {
       throw new KimiError(
         ErrorCodes.SESSION_STATE_INVALID,
@@ -982,6 +1142,7 @@ export class Session {
     stack: readonly string[] = [],
   ): Promise<ResumedAgent> {
     await this.skillsReady;
+    this.assertOpen();
     const meta = this.metadata.agents[id];
     if (meta === undefined) {
       throw new KimiError(ErrorCodes.SESSION_STATE_INVALID, `Session agent "${id}" is missing`);
@@ -992,20 +1153,39 @@ export class Session {
       parentAgentId === null
         ? undefined
         : await this.resumeAgent(parentAgentId, [...stack, id]);
+    this.assertOpen();
 
+    let agent: Agent | undefined;
     try {
-      const agent = this.instantiateAgent(
+      const resumedAgent = this.instantiateAgent(
         id,
         join(this.options.homedir, 'agents', id),
         meta.type,
         {},
         parentAgentId,
       );
-      const result = await agent.resume();
-      this.restoreAgentProfileHandle(agent, meta, parent?.agent);
-      this.agents.set(id, agent);
-      return { agent, warning: parent?.warning ?? result.warning };
+      agent = resumedAgent;
+      this.provisionalAgents.add(resumedAgent);
+      const result = await resumedAgent.resume({
+        beforePendingWorkResume: async () => {
+          this.assertOpen();
+          if (resumedAgent.config.systemPrompt === '' && meta.type === 'main') {
+            const defaultProfile = DEFAULT_AGENT_PROFILES['agent'];
+            if (defaultProfile !== undefined) {
+              await this.bootstrapAgentProfile(resumedAgent, defaultProfile);
+              this.assertOpen();
+              return;
+            }
+          }
+          this.restoreAgentProfileHandle(resumedAgent, meta, parent?.agent);
+        },
+      });
+      this.assertOpen();
+      this.agents.set(id, resumedAgent);
+      this.provisionalAgents.delete(resumedAgent);
+      return { agent: resumedAgent, warning: parent?.warning ?? result.warning };
     } catch (error) {
+      if (agent !== undefined) await this.disposeProvisionalAgent(agent);
       const entry = this.agents.get(id);
       if (entry instanceof Promise) {
         this.agents.delete(id);
@@ -1059,11 +1239,26 @@ export class Session {
     return agent;
   }
 
-  private async triggerSessionStart(source: 'startup' | 'resume'): Promise<void> {
-    await this.hookEngine.trigger('SessionStart', {
-      matcherValue: source,
-      inputData: { source },
-    });
+  private triggerSessionStart(source: 'startup' | 'resume'): Promise<void> {
+    // Reserve the close barrier before invoking HookEngine. Deferring invocation
+    // by one microtask also makes a close immediately following createMain /
+    // resume authoritative: the hook sees an already-aborted signal and never
+    // escapes the lifecycle barrier.
+    const operation = Promise.resolve()
+      .then(() =>
+        this.hookEngine.trigger('SessionStart', {
+          matcherValue: source,
+          inputData: { source },
+          signal: this.lifecycleAbortController.signal,
+        }),
+      )
+      .then(() => undefined);
+    this.pendingSessionStartOperations.add(operation);
+    void operation.then(
+      () => this.pendingSessionStartOperations.delete(operation),
+      () => this.pendingSessionStartOperations.delete(operation),
+    );
+    return operation;
   }
 
   private async triggerSessionEnd(reason: 'exit'): Promise<void> {
diff --git a/packages/agent-core/src/session/rpc.ts b/packages/agent-core/src/session/rpc.ts
index bbc85c7763..aa3f1526f7 100644
--- a/packages/agent-core/src/session/rpc.ts
+++ b/packages/agent-core/src/session/rpc.ts
@@ -328,7 +328,7 @@ export class SessionAPIImpl implements PromisableMethods<SessionAPI> {
 
     this.session.metadata = nextMetadata;
     await this.session.writeMetadata();
-    await this.session.rpc.emitEvent({
+    this.session.emitEvent({
       type: 'session.meta.updated',
       agentId: 'main',
       title,
diff --git a/packages/agent-core/src/session/subagent-host.ts b/packages/agent-core/src/session/subagent-host.ts
index a014c248a2..ef04b9a1cf 100644
--- a/packages/agent-core/src/session/subagent-host.ts
+++ b/packages/agent-core/src/session/subagent-host.ts
@@ -3,6 +3,7 @@ import {
   isProviderRateLimitError,
   type TokenUsage,
 } from '@moonshot-ai/kosong';
+import { createControlledPromise } from '@antfu/utils';
 
 import type { Agent } from '../agent';
 import type { PromptOrigin } from '../agent/context';
@@ -16,6 +17,7 @@ import {
   type ResolvedAgentProfile,
 } from '../profile';
 import {
+  abortable,
   linkAbortSignal,
   userCancellationReason,
 } from '../utils/abort';
@@ -141,6 +143,7 @@ export class SessionSubagentHost {
     {
       readonly controller: AbortController;
       runInBackground: boolean;
+      readonly settled: Promise<void>;
     }
   >();
 
@@ -152,16 +155,27 @@ export class SessionSubagentHost {
   async spawn(options: SpawnSubagentOptions): Promise<SubagentHandle> {
     options.signal.throwIfAborted();
 
-    const parent = await this.session.ensureAgentResumed(this.ownerAgentId);
+    const parent = await abortable(
+      this.session.ensureAgentResumed(this.ownerAgentId),
+      options.signal,
+    );
     const profile = this.resolveProfile(parent, options.profileName);
-    const { id, agent } = await this.session.createAgent(
-      { type: 'sub', generate: parent.rawGenerate },
-      { parentAgentId: this.ownerAgentId, swarmItem: options.swarmItem },
+    const { id, agent } = await abortable(
+      this.session.createAgent(
+        { type: 'sub', generate: parent.rawGenerate },
+        {
+          parentAgentId: this.ownerAgentId,
+          swarmItem: options.swarmItem,
+          signal: options.signal,
+        },
+      ),
+      options.signal,
     );
     const completion = this.runWithActiveChild(id, options, async (runOptions) => {
+      runOptions.signal.throwIfAborted();
       this.emitSubagentSpawned(parent, id, profile.name, runOptions);
       try {
-        await this.configureChild(parent, agent, profile);
+        await this.configureChild(parent, agent, profile, runOptions.signal);
         return await this.runPromptTurn(parent, id, agent, profile.name, runOptions);
       } catch (error) {
         this.emitSubagentFailed(parent, id, runOptions, error);
@@ -178,8 +192,12 @@ export class SessionSubagentHost {
 
   async resume(agentId: string, options: RunSubagentOptions): Promise<SubagentHandle> {
     options.signal.throwIfAborted();
-    const { parent, child, profileName } = await this.ensureIdleSubagent(agentId);
+    const { parent, child, profileName } = await this.ensureIdleSubagent(
+      agentId,
+      options.signal,
+    );
     const completion = this.runWithActiveChild(agentId, options, async (runOptions) => {
+      runOptions.signal.throwIfAborted();
       this.emitSubagentSpawned(parent, agentId, profileName, runOptions);
       try {
         child.config.update({ modelAlias: parent.config.modelAlias });
@@ -194,7 +212,10 @@ export class SessionSubagentHost {
 
   async retry(agentId: string, options: RunSubagentOptions): Promise<SubagentHandle> {
     options.signal.throwIfAborted();
-    const { parent, child, profileName } = await this.ensureIdleSubagent(agentId);
+    const { parent, child, profileName } = await this.ensureIdleSubagent(
+      agentId,
+      options.signal,
+    );
     const completion = this.runWithActiveChild(agentId, options, async (runOptions) => {
       try {
         runOptions.signal.throwIfAborted();
@@ -216,8 +237,9 @@ export class SessionSubagentHost {
 
   private async ensureIdleSubagent(
     agentId: string,
+    signal: AbortSignal,
   ): Promise<{ readonly parent: Agent; readonly child: Agent; readonly profileName: string }> {
-    const parent = await this.session.ensureAgentResumed(this.ownerAgentId);
+    const parent = await abortable(this.session.ensureAgentResumed(this.ownerAgentId), signal);
     const metadata = this.session.metadata.agents[agentId];
     if (metadata?.type !== 'sub') {
       throw new Error(`Agent instance "${agentId}" is not a subagent`);
@@ -225,7 +247,7 @@ export class SessionSubagentHost {
     if (metadata.parentAgentId !== this.ownerAgentId) {
       throw new Error(`Agent instance "${agentId}" does not belong to this parent agent`);
     }
-    const child = await this.session.ensureAgentResumed(agentId);
+    const child = await abortable(this.session.ensureAgentResumed(agentId), signal);
     if (this.activeChildren.has(agentId) || child.turn.hasActiveTurn) {
       throw new Error(`Agent instance "${agentId}" is already running and cannot run concurrently`);
     }
@@ -274,16 +296,39 @@ export class SessionSubagentHost {
     return id;
   }
 
-  cancelAll(reason: unknown = userCancellationReason()): void {
+  cancelAll(reason: unknown = userCancellationReason()): Promise<void> {
     const foregroundChildren = Array.from(this.activeChildren).filter(
       ([, child]) => !child.runInBackground,
     );
+    const barriers: Promise<unknown>[] = [];
     for (const [childId, child] of foregroundChildren) {
-      this.session.getReadyAgent(childId)?.subagentHost?.cancelAll(reason);
+      const childAgent = this.session.getReadyAgent(childId);
+      let childTurnSettlement: Promise<unknown> | undefined;
+      if (childAgent?.turn.hasActiveTurn === true) {
+        try {
+          // Capture the un-abort-raced worker promise before signalling the
+          // child. `waitForCurrentTurn(signal)` deliberately rejects as soon as
+          // its caller aborts, which is too early for a cancellation barrier.
+          childTurnSettlement = childAgent.turn.waitForCurrentTurn();
+        } catch {
+          // The child may have settled between the public state check and the
+          // wait. Its host lifecycle barrier below still covers final cleanup.
+        }
+      }
+      const descendantBarrier = childAgent?.subagentHost?.cancelAll(reason);
       // Abort with the cancel reason (a user interruption by default) so the
       // subagent's in-flight tools report the cause accurately to the model.
       child.controller.abort(reason);
+
+      barriers.push(child.settled);
+      if (childTurnSettlement !== undefined) barriers.push(childTurnSettlement);
+      if (descendantBarrier !== undefined) barriers.push(descendantBarrier);
     }
+
+    // This method is also called from replay and direct fire-and-forget paths.
+    // Never reject: callers that need the barrier can await it, while legacy
+    // callers can safely ignore it without creating an unhandled rejection.
+    return Promise.allSettled(barriers).then(() => undefined);
   }
 
   markActiveChildDetached(agentId: string): void {
@@ -324,15 +369,25 @@ export class SessionSubagentHost {
   ): Promise<SubagentCompletion> {
     const controller = new AbortController();
     const unlinkAbortSignal = linkAbortSignal(options.signal, controller);
+    const settled = createControlledPromise<void>();
     this.activeChildren.set(childId, {
       controller,
       runInBackground: options.runInBackground,
+      settled,
     });
 
-    return run({ ...options, signal: controller.signal }).finally(() => {
+    const finish = (): void => {
       unlinkAbortSignal();
       this.activeChildren.delete(childId);
-    });
+      settled.resolve();
+    };
+
+    try {
+      return run({ ...options, signal: controller.signal }).finally(finish);
+    } catch (error) {
+      finish();
+      return Promise.reject(error);
+    }
   }
 
   private async runPromptTurn(
@@ -348,7 +403,10 @@ export class SessionSubagentHost {
 
     let childPrompt = options.prompt;
     if (profileName === 'explore') {
-      const gitContext = await collectGitContext(child.kaos, child.config.cwd);
+      const gitContext = await abortable(
+        collectGitContext(child.kaos, child.config.cwd),
+        options.signal,
+      );
       if (gitContext) childPrompt = `${gitContext}\n\n${childPrompt}`;
     }
 
@@ -399,7 +457,9 @@ export class SessionSubagentHost {
     parent: Agent,
     child: Agent,
     profile: ResolvedAgentProfile,
+    signal: AbortSignal,
   ): Promise<void> {
+    signal.throwIfAborted();
     // A subagent always inherits the parent agent's model.
     child.config.update({
       cwd: parent.config.cwd,
@@ -407,10 +467,13 @@ export class SessionSubagentHost {
       thinkingEffort: parent.config.thinkingEffort,
     });
 
-    const context = await prepareSystemPromptContext(
-      this.session.systemContextKaos(child.kaos.getcwd()),
-      this.session.options.kimiHomeDir,
-      { additionalDirs: child.getAdditionalDirs() },
+    const context = await abortable(
+      prepareSystemPromptContext(
+        this.session.systemContextKaos(child.kaos.getcwd()),
+        this.session.options.kimiHomeDir,
+        { additionalDirs: child.getAdditionalDirs() },
+      ),
+      signal,
     );
     child.useProfile(profile, context, this.session.options.kimiHomeDir);
     child.tools.inheritUserTools(parent.tools);
@@ -422,7 +485,7 @@ export class SessionSubagentHost {
     prompt: string,
     signal: AbortSignal,
   ): Promise<void> {
-    await parent.hooks?.trigger('SubagentStart', {
+    const trigger = parent.hooks?.trigger('SubagentStart', {
       matcherValue: profileName,
       signal,
       inputData: {
@@ -430,6 +493,7 @@ export class SessionSubagentHost {
         prompt: prompt.slice(0, HOOK_TEXT_PREVIEW_LENGTH),
       },
     });
+    if (trigger !== undefined) await abortable(trigger, signal);
   }
 
   private triggerSubagentStop(parent: Agent, profileName: string, result: string): void {
@@ -504,7 +568,28 @@ export class SessionSubagentHost {
 }
 
 async function runChildTurnToCompletion(child: Agent, signal: AbortSignal): Promise<void> {
-  const completion = await child.turn.waitForCurrentTurn(signal);
+  const turnSettlement = child.turn.waitForCurrentTurn();
+  let cancellationBarrier: Promise<void> | undefined;
+  const onAbort = (): void => {
+    cancellationBarrier = child.turn.cancel(undefined, signal.reason);
+  };
+  if (signal.aborted) {
+    onAbort();
+  } else {
+    signal.addEventListener('abort', onAbort, { once: true });
+  }
+
+  let completion;
+  try {
+    completion = await abortable(turnSettlement, signal);
+  } catch (error) {
+    if (signal.aborted) {
+      await Promise.allSettled([turnSettlement, cancellationBarrier ?? Promise.resolve()]);
+    }
+    throw error;
+  } finally {
+    signal.removeEventListener('abort', onAbort);
+  }
   const turnEnded = completion.event;
   if (turnEnded.reason !== 'completed') {
     if (turnEnded.error?.code === ErrorCodes.PROVIDER_FILTERED) {
diff --git a/packages/agent-core/src/utils/abort.ts b/packages/agent-core/src/utils/abort.ts
index d452f0079e..30728f7af0 100644
--- a/packages/agent-core/src/utils/abort.ts
+++ b/packages/agent-core/src/utils/abort.ts
@@ -33,7 +33,10 @@ export function isUserCancellation(value: unknown): value is UserCancellationErr
 }
 
 export function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
-  if (signal.aborted) return Promise.reject(abortReason(signal));
+  if (signal.aborted) {
+    void promise.catch(() => undefined);
+    return Promise.reject(abortReason(signal));
+  }
   return new Promise<T>((resolve, reject) => {
     const onAbort = () => {
       reject(abortReason(signal));
diff --git a/packages/agent-core/test/agent/background/output-access.test.ts b/packages/agent-core/test/agent/background/output-access.test.ts
index 16bbc0cdec..17db6e2041 100644
--- a/packages/agent-core/test/agent/background/output-access.test.ts
+++ b/packages/agent-core/test/agent/background/output-access.test.ts
@@ -8,6 +8,7 @@ import { Readable } from 'node:stream';
 import type { Writable } from 'node:stream';
 import { join } from 'pathe';
 
+import { createControlledPromise } from '@antfu/utils';
 import type { KaosProcess } from '@moonshot-ai/kaos';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
@@ -43,7 +44,11 @@ describe('BackgroundManager — readOutput / getOutputSnapshot', () => {
     persistence = fixture.persistence!;
   });
 
-  afterEach(() => {
+  afterEach(async () => {
+    // Include tasks whose status flipped to terminal just before their final
+    // persistence completed. Active-only listing would hide them and let the
+    // temporary directory be removed underneath the queued write.
+    await Promise.all(manager.list(false).map((task) => manager.wait(task.taskId)));
     rmSync(sessionDir, { recursive: true, force: true });
   });
 
@@ -131,4 +136,57 @@ describe('BackgroundManager — readOutput / getOutputSnapshot', () => {
 
     expect(await manager.readOutput(taskId, 5)).toBe('ddddd');
   });
+
+  it('wait exposes a completed process only after queued output reaches output.log', async () => {
+    const outputWriteStarted = createControlledPromise<void>();
+    const releaseOutputWrite = createControlledPromise<void>();
+    const processDisposed = createControlledPromise<void>();
+    const events: string[] = [];
+    const appendTaskOutput = persistence.appendTaskOutput.bind(persistence);
+    const writeTask = persistence.writeTask.bind(persistence);
+
+    vi.spyOn(persistence, 'appendTaskOutput').mockImplementation(async (taskId, chunk) => {
+      events.push('output write started');
+      outputWriteStarted.resolve();
+      await releaseOutputWrite;
+      await appendTaskOutput(taskId, chunk);
+      events.push('output write finished');
+    });
+    vi.spyOn(persistence, 'writeTask').mockImplementation(async (info) => {
+      if (info.status !== 'completed') return;
+      events.push('terminal write started');
+      await writeTask(info);
+    });
+
+    const proc = immediateProcess(0, 'persisted before wait\n');
+    vi.mocked(proc.dispose).mockImplementation(async () => {
+      processDisposed.resolve();
+    });
+    const taskId = registerProcess(manager, proc, 'echo', 'demo');
+    let waitReturned = false;
+    const waitResult = manager.wait(taskId).then((info) => {
+      waitReturned = true;
+      return info;
+    });
+
+    await Promise.all([outputWriteStarted, processDisposed]);
+    // Cross one event-loop boundary after the process streams drained and the
+    // process was disposed, giving lifecycle finalization a chance to run
+    // without relying on wall-clock time.
+    await new Promise<void>((resolve) => setImmediate(resolve));
+    const statusWhileOutputWriteBlocked = manager.getTask(taskId)?.status;
+    const waitReturnedWhileOutputWriteBlocked = waitReturned;
+    releaseOutputWrite.resolve();
+
+    await expect(waitResult).resolves.toMatchObject({ status: 'completed' });
+    expect(statusWhileOutputWriteBlocked).toBe('running');
+    expect(waitReturnedWhileOutputWriteBlocked).toBe(false);
+    expect(events).toEqual([
+      'output write started',
+      'output write finished',
+      'terminal write started',
+    ]);
+    await expect(manager.readOutput(taskId)).resolves.toBe('persisted before wait\n');
+    await expect(persistence.readTask(taskId)).resolves.toMatchObject({ status: 'completed' });
+  });
 });
diff --git a/packages/agent-core/test/agent/basic.test.ts b/packages/agent-core/test/agent/basic.test.ts
index dd0fc16376..a83abf94cf 100644
--- a/packages/agent-core/test/agent/basic.test.ts
+++ b/packages/agent-core/test/agent/basic.test.ts
@@ -22,19 +22,19 @@ it('runs a text-only agent turn from prompt to completion', async () => {
   await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Hello' }] });
 
   expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
-    [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Hello" } ], "origin": { "kind": "user" }, "time": "<time>" }
+    [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Hello" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
     [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-    [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Hello" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-    [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-    [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+    [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Hello" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+    [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+    [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
     [wire] llm.tools_snapshot          { "hash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "tools": [], "time": "<time>" }
     [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
     [emit] thinking.delta              { "turnId": 0, "delta": "<think-1>" }
     [emit] assistant.delta             { "turnId": 0, "delta": "<text-1>" }
-    [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "think", "think": "<think-1>" } }, "time": "<time>" }
-    [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "<text-1>" } }, "time": "<time>" }
-    [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-1" }, "time": "<time>" }
-    [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+    [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "think", "think": "<think-1>" } }, "time": "<time>" }
+    [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "<text-1>" } }, "time": "<time>" }
+    [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-1" }, "time": "<time>" }
+    [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
     [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
     [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 11, "maxContextTokens": 1000000, "contextUsage": 0.000011, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 3, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
     [emit] turn.ended                  { "turnId": 0, "reason": "completed" }
@@ -101,16 +101,16 @@ it('runs an agent turn through builtin tool approval and execution', async () =>
     input: [{ type: 'text', text: 'Run a command that prints lookup-result' }],
   });
   expect(await ctx.untilApproval(true)).toMatchInlineSnapshot(`
-    [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run a command that prints lookup-result" } ], "origin": { "kind": "user" }, "time": "<time>" }
+    [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run a command that prints lookup-result" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
     [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-    [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run a command that prints lookup-result" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-    [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-    [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+    [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run a command that prints lookup-result" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+    [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+    [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
     [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
     [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
     [emit] assistant.delta             { "turnId": 0, "delta": "I will run that." }
     [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf lookup-result\\",\\"timeout\\":60}" }
-    [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will run that." } }, "time": "<time>" }
+    [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will run that." } }, "time": "<time>" }
     [emit] requestApproval             { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf lookup-result", "display": { "kind": "command", "command": "printf lookup-result", "cwd": "<cwd>", "language": "bash" } }
   `);
   expect(ctx.lastLlmInput()).toMatchInlineSnapshot(`
@@ -123,22 +123,22 @@ it('runs an agent turn through builtin tool approval and execution', async () =>
   ctx.mockNextResponse({ type: 'text', text: 'The command printed lookup-result.' });
   expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
     [wire] permission.record_approval_result   { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf lookup-result", "result": { "decision": "approved", "selectedLabel": "approve" }, "time": "<time>" }
-    [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf lookup-result", "timeout": 60 }, "description": "Running: printf lookup-result", "display": { "kind": "command", "command": "printf lookup-result", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+    [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf lookup-result", "timeout": 60 }, "description": "Running: printf lookup-result", "display": { "kind": "command", "command": "printf lookup-result", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
     [emit] tool.call.started                   { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf lookup-result", "timeout": 60 }, "description": "Running: printf lookup-result", "display": { "kind": "command", "command": "printf lookup-result", "cwd": "<cwd>", "language": "bash" } }
     [emit] tool.progress                       { "turnId": 0, "toolCallId": "call_bash", "update": { "kind": "stdout", "text": "lookup-result" } }
     [wire] context.append_loop_event           { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "lookup-result" } }, "time": "<time>" }
     [emit] tool.result                         { "turnId": 0, "toolCallId": "call_bash", "output": "lookup-result" }
-    [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-    [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+    [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+    [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
     [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
     [emit] agent.status.updated                { "model": "mock-model", "contextTokens": 33, "maxContextTokens": 1000000, "contextUsage": 0.000033, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 11, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-    [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-    [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+    [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+    [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
     [wire] llm.request                         { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999967, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 3, "turnStep": "0.2", "time": "<time>" }
     [emit] assistant.delta                     { "turnId": 0, "delta": "The command printed lookup-result." }
-    [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "The command printed lookup-result." } }, "time": "<time>" }
-    [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 38, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-    [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 38, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+    [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "The command printed lookup-result." } }, "time": "<time>" }
+    [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 38, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+    [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 38, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
     [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 38, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
     [emit] agent.status.updated                { "model": "mock-model", "contextTokens": 50, "maxContextTokens": 1000000, "contextUsage": 0.00005, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 49, "output": 34, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 49, "output": 34, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 49, "output": 34, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
     [emit] turn.ended                          { "turnId": 0, "reason": "completed" }
diff --git a/packages/agent-core/test/agent/compaction/compaction-scenarios.test.ts b/packages/agent-core/test/agent/compaction/compaction-scenarios.test.ts
index f9ac8d6ea7..7daebb5cd6 100644
--- a/packages/agent-core/test/agent/compaction/compaction-scenarios.test.ts
+++ b/packages/agent-core/test/agent/compaction/compaction-scenarios.test.ts
@@ -13,17 +13,21 @@
 // Agent/ContextMemory/FullCompaction machinery through the test harness rather
 // than mocking it.
 import type { ContentPart, Message } from '@moonshot-ai/kosong';
-import { describe, expect, it } from 'vitest';
+import { createControlledPromise } from '@antfu/utils';
+import { describe, expect, it, vi } from 'vitest';
 
-import type { AgentOptions } from '../../../src/agent';
+import type { AgentOptions, AgentRecord, AgentRecordPersistence } from '../../../src/agent';
+import type { BackgroundTaskInfo } from '../../../src/agent/background';
 import { COMPACTION_ELISION_VARIANT, COMPACTION_SUMMARY_PREFIX } from '../../../src/agent/compaction';
-import type { AgentRecord } from '../../../src/agent';
 import {
   AGENT_WIRE_PROTOCOL_VERSION,
   InMemoryAgentRecordPersistence,
+  markAgentRecordAppendError,
 } from '../../../src/agent/records';
 import type { ContextMessage } from '../../../src/agent/context';
 import { FLAG_DEFINITIONS, FlagResolver } from '../../../src/flags';
+import type { ResolvedAgentProfile } from '../../../src/profile';
+import { abortError } from '../../../src/utils/abort';
 import { testAgent, type TestAgentContext } from '../harness/agent';
 
 type GenerateFn = NonNullable<AgentOptions['generate']>;
@@ -38,6 +42,19 @@ const CAPS = {
   max_context_tokens: 256_000,
 } as const;
 
+const RUNNING_BACKGROUND_TASK = {
+  taskId: 'process-example',
+  kind: 'process',
+  description: 'important background work',
+  status: 'running',
+  detached: true,
+  startedAt: 1,
+  endedAt: null,
+  command: 'example-command',
+  pid: 42,
+  exitCode: null,
+} satisfies BackgroundTaskInfo;
+
 function textResult(text: string): Awaited<ReturnType<GenerateFn>> {
   return {
     id: 'mock-compaction-summary',
@@ -61,7 +78,815 @@ function summaryMessageText(ctx: TestAgentContext): string {
   return summary?.content.map((part) => (part.type === 'text' ? part.text : '')).join('') ?? '';
 }
 
+function recordsThrough(
+  records: readonly AgentRecord[],
+  predicate: (record: AgentRecord) => boolean,
+): AgentRecord[] {
+  const index = records.findIndex(predicate);
+  if (index < 0) throw new Error('record boundary not found');
+  return structuredClone(records.slice(0, index + 1));
+}
+
 describe('compaction — guard tests', () => {
+  it('continues compaction when a synchronous started-event observer throws', async () => {
+    const ctx = testAgent();
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    ctx.emitter.once('compaction.started', () => {
+      throw new Error('observer failed');
+    });
+    const completed = ctx.once('compaction.completed');
+
+    await expect(ctx.rpc.beginCompaction({})).resolves.toBeUndefined();
+    await completed;
+
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+    expect(summaryMessageText(ctx)).toContain('Compacted summary.');
+  });
+
+  it('reserves compaction before its persistence callback can re-enter prompt', async () => {
+    let ctx!: TestAgentContext;
+    let reentrantAdmission: ReturnType<TestAgentContext['agent']['turn']['submitPrompt']> | undefined;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type !== 'full_compaction.begin' || reentrantAdmission !== undefined) return;
+        reentrantAdmission = ctx.agent.turn.submitPrompt([
+          { type: 'text', text: 'PROMPT-FROM-COMPACTION-REENTRY' },
+        ]);
+      },
+    });
+    let generateCalls = 0;
+    ctx = testAgent({
+      persistence,
+      generate: async () => {
+        generateCalls += 1;
+        return generateCalls === 1
+          ? textResult('Compacted summary.')
+          : textResult('Deferred prompt completed.');
+      },
+    });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    const ended = ctx.once('turn.ended');
+
+    await ctx.rpc.beginCompaction({});
+    expect(reentrantAdmission).toMatchObject({ kind: 'deferred' });
+    await ended;
+
+    expect(generateCalls).toBe(2);
+    expect(historyTexts(ctx).join('\n')).toContain('PROMPT-FROM-COMPACTION-REENTRY');
+  });
+
+  it('keeps the successful compaction reservation through synchronous completed listeners', async () => {
+    let generateCalls = 0;
+    const ctx = testAgent({
+      generate: async () => {
+        generateCalls += 1;
+        return generateCalls === 1
+          ? textResult('Compacted summary.')
+          : textResult('Deferred prompt completed.');
+      },
+    });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    let admission: ReturnType<typeof ctx.agent.turn.submitPrompt> | undefined;
+    ctx.emitter.once('compaction.completed', () => {
+      admission = ctx.agent.turn.submitPrompt([
+        { type: 'text', text: 'PROMPT-FROM-COMPLETED-LISTENER' },
+      ]);
+    });
+    const ended = ctx.once('turn.ended');
+
+    await ctx.rpc.beginCompaction({});
+    await ended;
+
+    expect(admission).toMatchObject({ kind: 'deferred' });
+    expect(generateCalls).toBe(2);
+    expect(historyTexts(ctx).join('\n')).toContain('PROMPT-FROM-COMPLETED-LISTENER');
+  });
+
+  it('treats cancellation after context commit as a join on the completed outcome', async () => {
+    const refreshStarted = createControlledPromise<void>();
+    const releaseRefresh = createControlledPromise<void>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    vi.spyOn(ctx.agent, 'refreshSystemPrompt').mockImplementation(async () => {
+      refreshStarted.resolve();
+      await releaseRefresh;
+      return 'refreshed system prompt';
+    });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await refreshStarted;
+    let cancelSettled = false;
+    const cancel = ctx.rpc.cancelCompaction({}).then(() => {
+      cancelSettled = true;
+    });
+    await Promise.resolve();
+    expect(cancelSettled).toBe(false);
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(true);
+    expect(ctx.allEvents.some((event) => event.event === 'compaction.cancelled')).toBe(false);
+
+    releaseRefresh.resolve();
+    await cancel;
+    await completed;
+
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.cancel'),
+    ).toHaveLength(0);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+  });
+
+  it('does not turn a completed-listener cancellation into a second terminal outcome', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    let listenerCancellation: ReturnType<typeof ctx.rpc.cancelCompaction> | undefined;
+    ctx.emitter.once('compaction.completed', () => {
+      listenerCancellation = ctx.rpc.cancelCompaction({});
+    });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+    await listenerCancellation;
+
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.cancel'),
+    ).toHaveLength(0);
+  });
+
+  it('converges to one completed terminal when system-prompt refresh rejects after commit', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    vi.spyOn(ctx.agent, 'refreshSystemPrompt').mockRejectedValue(
+      abortError('refresh failed independently of compaction cancellation'),
+    );
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.cancel'),
+    ).toHaveLength(0);
+  });
+
+  it('retries an async post-compaction injection failure without duplicating reminders', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    vi.spyOn(ctx.agent.background, 'list').mockReturnValue([RUNNING_BACKGROUND_TASK]);
+    const originalInjection = ctx.agent.injection.injectAfterCompaction.bind(ctx.agent.injection);
+    let attempts = 0;
+    vi.spyOn(ctx.agent.injection, 'injectAfterCompaction').mockImplementation(async () => {
+      attempts += 1;
+      await originalInjection();
+      if (attempts === 1) throw new Error('injection failed after appending reminders');
+    });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(attempts).toBe(2);
+    expect(
+      ctx.agent.context.history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' &&
+          message.origin.variant === 'background_task_status',
+      ),
+    ).toHaveLength(1);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+  });
+
+  it('resets injector cursors when a reminder append throws before persistence', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.agent.permission.setMode('auto');
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    const originalAppend = ctx.agent.context.appendSystemReminder.bind(ctx.agent.context);
+    let permissionAppendAttempts = 0;
+    vi.spyOn(ctx.agent.context, 'appendSystemReminder').mockImplementation((content, origin) => {
+      if (origin.kind === 'injection' && origin.variant === 'permission_mode') {
+        permissionAppendAttempts += 1;
+        if (permissionAppendAttempts === 1) {
+          throw new Error('append rejected before accepting the reminder');
+        }
+      }
+      originalAppend(content, origin);
+    });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(permissionAppendAttempts).toBe(2);
+    expect(
+      ctx.agent.context.history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' && message.origin.variant === 'permission_mode',
+      ),
+    ).toHaveLength(1);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+  });
+
+  it('persists one completion when markCompleted throws before entering its implementation', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    vi.spyOn(ctx.agent.fullCompaction, 'markCompleted').mockImplementationOnce(() => {
+      throw new Error('completion callback failed before persistence');
+    });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+  });
+
+  it('retries completion after persistence explicitly rejects it before acceptance', async () => {
+    const persistenceError = new Error('completion rejected before append');
+    const accepted = new InMemoryAgentRecordPersistence();
+    let completionAttempts = 0;
+    const persistence: AgentRecordPersistence = {
+      read: () => accepted.read(),
+      append: (record) => {
+        if (record.type === 'full_compaction.complete') {
+          completionAttempts += 1;
+          if (completionAttempts === 1) {
+            throw markAgentRecordAppendError(persistenceError, false);
+          }
+        }
+        accepted.append(record);
+      },
+      rewrite: (records) => {
+        accepted.rewrite(records);
+      },
+      flush: () => accepted.flush(),
+      close: () => accepted.close(),
+    };
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(completionAttempts).toBe(2);
+    expect(
+      accepted.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+  });
+
+  it('does not duplicate completion when persistence throws after accepting the terminal record', async () => {
+    const persistenceError = new Error('completion observer failed after append');
+    let ctx!: TestAgentContext;
+    let reentrantCancellation: Promise<void> | undefined;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type !== 'full_compaction.complete') return;
+        reentrantCancellation = ctx.agent.fullCompaction.cancel();
+        throw persistenceError;
+      },
+    });
+    ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+    await reentrantCancellation;
+
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+  });
+
+  it('does not duplicate completion when an async markCompleted wrapper rejects after persistence', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    const originalMarkCompleted = ctx.agent.fullCompaction.markCompleted.bind(
+      ctx.agent.fullCompaction,
+    );
+    vi.spyOn(ctx.agent.fullCompaction, 'markCompleted').mockImplementationOnce(
+      (() => {
+        originalMarkCompleted();
+        return Promise.reject(new Error('async completion observer failed after persistence'));
+      }) as () => void,
+    );
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await completed;
+
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(1);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+  });
+
+  it('keeps deferred work blocked until a transient post-commit injection failure recovers', async () => {
+    const injectionStarted = createControlledPromise<void>();
+    const releaseFailure = createControlledPromise<void>();
+    let generateCalls = 0;
+    const ctx = testAgent({
+      generate: async () => {
+        generateCalls += 1;
+        return generateCalls === 1
+          ? textResult('Compacted summary.')
+          : textResult('Deferred prompt completed.');
+      },
+    });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    const originalInjection = ctx.agent.injection.injectAfterCompaction.bind(ctx.agent.injection);
+    let injectionAttempts = 0;
+    vi.spyOn(ctx.agent.injection, 'injectAfterCompaction').mockImplementation(async () => {
+      injectionAttempts += 1;
+      if (injectionAttempts === 1) {
+        injectionStarted.resolve();
+        await releaseFailure;
+      }
+      if (injectionAttempts <= 2) throw new Error('transient injection failure');
+      await originalInjection();
+    });
+    const completed = ctx.once('compaction.completed');
+
+    await ctx.rpc.beginCompaction({});
+    await injectionStarted;
+    const admission = await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'PROMPT-WAITING-FOR-FINALIZATION' }],
+    });
+    expect(admission).toMatchObject({ kind: 'deferred' });
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+    expect(generateCalls).toBe(1);
+
+    const ended = ctx.once('turn.ended');
+    releaseFailure.resolve();
+    await completed;
+    await ended;
+
+    // The two post-commit attempts are exhausted first. Completion may release
+    // the TUI reservation, but the deferred turn's beforeStep must repair the
+    // pending injection before its first model request is built.
+    expect(injectionAttempts).toBe(3);
+    expect(generateCalls).toBe(2);
+    expect(historyTexts(ctx).join('\n')).toContain('PROMPT-WAITING-FOR-FINALIZATION');
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+  });
+
+  it('reports a provider AbortError as failure when the compaction signal was not aborted', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({
+      persistence,
+      generate: async () => {
+        throw abortError('provider aborted its own request');
+      },
+    });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    const failed = ctx.once('error');
+
+    await ctx.rpc.beginCompaction({});
+    await failed;
+
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+    expect(ctx.allEvents.filter((event) => event.event === 'compaction.cancelled')).toHaveLength(0);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.cancel'),
+    ).toHaveLength(0);
+    expect(
+      persistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(0);
+    expect(ctx.allEvents).toContainEqual(
+      expect.objectContaining({
+        type: '[rpc]',
+        event: 'error',
+        args: expect.objectContaining({ code: 'compaction.failed' }),
+      }),
+    );
+  });
+
+  it('patches the pending compaction across interleaved replay updates for crash and complete prefixes', async () => {
+    const summaryRequested = createControlledPromise<void>();
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const originalPersistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({
+      persistence: originalPersistence,
+      generate: () => {
+        summaryRequested.resolve();
+        return summary;
+      },
+    });
+    original.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    original.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await original.rpc.beginCompaction({});
+    await summaryRequested;
+    // These replay entries intentionally land between full_compaction.begin and
+    // context.apply_compaction. The apply record must patch the open compaction,
+    // not assume that compaction is still the replay array tail.
+    original.agent.config.update({ systemPrompt: 'INTERLEAVED-SYSTEM-PROMPT' });
+    original.agent.permission.setMode('auto');
+    const originalCompleted = original.once('compaction.completed');
+    summary.resolve(textResult('Compacted summary with interleaved updates.'));
+    await originalCompleted;
+
+    for (const terminalIncluded of [false, true]) {
+      const prefix = recordsThrough(
+        originalPersistence.records,
+        (record) =>
+          record.type ===
+          (terminalIncluded ? 'full_compaction.complete' : 'context.apply_compaction'),
+      );
+      const resumedPersistence = new InMemoryAgentRecordPersistence(prefix);
+      const resumed = testAgent({ persistence: resumedPersistence });
+
+      await resumed.agent.resume();
+
+      const replay = resumed.agent.replayBuilder.buildResult();
+      const compactionIndex = replay.findIndex((record) => record.type === 'compaction');
+      const compaction = replay[compactionIndex];
+      expect(compaction).toMatchObject({
+        type: 'compaction',
+        result: expect.objectContaining({
+          summary: 'Compacted summary with interleaved updates.',
+        }),
+      });
+      expect(
+        replay.slice(compactionIndex + 1).some((record) => record.type === 'config_updated'),
+      ).toBe(true);
+      expect(
+        replay.slice(compactionIndex + 1).some((record) => record.type === 'permission_updated'),
+      ).toBe(true);
+      expect(
+        resumedPersistence.records.filter(
+          (record) => record.type === 'full_compaction.complete',
+        ),
+      ).toHaveLength(1);
+      expect(
+        resumed.allEvents.filter((event) => event.event === 'compaction.completed'),
+      ).toHaveLength(0);
+    }
+  });
+
+  it('recovers missing after-compaction reminders from a crash immediately after context commit', async () => {
+    const originalPersistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence: originalPersistence });
+    original.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    original.appendExchange(1, 'older user context', 'older assistant context', 40);
+    original.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    vi.spyOn(original.agent.background, 'list').mockReturnValue([RUNNING_BACKGROUND_TASK]);
+    const originalCompleted = original.once('compaction.completed');
+    await original.rpc.beginCompaction({});
+    await originalCompleted;
+
+    const prefix = recordsThrough(
+      originalPersistence.records,
+      (record) => record.type === 'context.apply_compaction',
+    );
+    const recoveryCompleted = createControlledPromise<void>();
+    const resumedPersistence = new InMemoryAgentRecordPersistence(prefix, {
+      onRecord: (record) => {
+        if (record.type === 'full_compaction.complete') recoveryCompleted.resolve();
+      },
+    });
+    const loadStarted = createControlledPromise<void>();
+    const releaseLoad = createControlledPromise<void>();
+    let backgroundLoaded = false;
+    let firstModelRequestText = '';
+    const resumed = testAgent({
+      persistence: resumedPersistence,
+      generate: async (_provider, _system, _tools, messages) => {
+        firstModelRequestText = messages
+          .flatMap((message) => message.content)
+          .filter((part): part is Extract<ContentPart, { type: 'text' }> => part.type === 'text')
+          .map((part) => part.text)
+          .join('\n');
+        return textResult('Recovered request completed.');
+      },
+      initialConfig: {
+        providers: {
+          'test-provider': { type: 'kimi', apiKey: 'test-key' },
+        },
+        models: {
+          'kimi-code': {
+            provider: 'test-provider',
+            model: 'kimi-code',
+            maxContextSize: CAPS.max_context_tokens,
+          },
+        },
+      },
+    });
+    vi.spyOn(resumed.agent.background, 'loadFromDisk').mockImplementation(async () => {
+      loadStarted.resolve();
+      await releaseLoad;
+      backgroundLoaded = true;
+    });
+    vi.spyOn(resumed.agent.background, 'list').mockImplementation(() =>
+      backgroundLoaded ? [RUNNING_BACKGROUND_TASK] : [],
+    );
+
+    const resume = resumed.agent.resume();
+    await loadStarted;
+    await Promise.resolve();
+
+    // The replay callback may reserve compaction, but recovery must not read
+    // background state or emit the terminal until background restoration has
+    // actually completed.
+    expect(resumed.agent.fullCompaction.isCompacting).toBe(true);
+    expect(
+      resumedPersistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(0);
+
+    releaseLoad.resolve();
+    await recoveryCompleted;
+    await resume;
+
+    expect(resumed.agent.fullCompaction.isCompacting).toBe(false);
+    expect(
+      resumed.agent.context.history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' &&
+          message.origin.variant === 'background_task_status',
+      ),
+    ).toHaveLength(1);
+    expect(
+      resumedPersistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(
+      resumedPersistence.records.filter((record) => record.type === 'full_compaction.cancel'),
+    ).toHaveLength(0);
+    expect(resumed.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(0);
+
+    const admission = await resumed.rpc.prompt({
+      input: [{ type: 'text', text: 'FIRST-REQUEST-AFTER-RECOVERY' }],
+    });
+    expect(admission).toMatchObject({ kind: 'started' });
+    const end = await resumed.agent.turn.waitForCurrentTurn();
+    expect(end.event.reason).toBe('completed');
+    expect(firstModelRequestText).toContain(RUNNING_BACKGROUND_TASK.description);
+  });
+
+  it('does not duplicate an after-compaction reminder that was durable before a crash', async () => {
+    const originalPersistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence: originalPersistence });
+    original.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    original.appendExchange(1, 'older user context', 'older assistant context', 40);
+    original.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    vi.spyOn(original.agent.background, 'list').mockReturnValue([RUNNING_BACKGROUND_TASK]);
+    const originalCompleted = original.once('compaction.completed');
+    await original.rpc.beginCompaction({});
+    await originalCompleted;
+
+    const prefix = recordsThrough(
+      originalPersistence.records,
+      (record) => record.type === 'full_compaction.complete',
+    );
+    const resumedPersistence = new InMemoryAgentRecordPersistence(prefix);
+    const resumed = testAgent({ persistence: resumedPersistence });
+    vi.spyOn(resumed.agent.background, 'list').mockReturnValue([RUNNING_BACKGROUND_TASK]);
+
+    await resumed.agent.resume();
+    await resumed.agent.fullCompaction.beforeStep(new AbortController().signal);
+
+    expect(
+      resumed.agent.context.history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' &&
+          message.origin.variant === 'background_task_status',
+      ),
+    ).toHaveLength(1);
+    expect(
+      resumedPersistence.records.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.message.origin?.kind === 'injection' &&
+          record.message.origin.variant === 'background_task_status',
+      ),
+    ).toHaveLength(1);
+    expect(
+      resumedPersistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(resumed.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(0);
+  });
+
+  it('repairs missing reminders after a crash following the completed terminal', async () => {
+    const originalPersistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence: originalPersistence });
+    original.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    original.appendExchange(1, 'older user context', 'older assistant context', 40);
+    original.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    vi.spyOn(original.agent.background, 'list').mockReturnValue([RUNNING_BACKGROUND_TASK]);
+    vi.spyOn(original.agent.injection, 'injectAfterCompaction').mockRejectedValue(
+      new Error('post-compaction injection remained unavailable'),
+    );
+    const originalCompleted = original.once('compaction.completed');
+
+    await original.rpc.beginCompaction({});
+    await originalCompleted;
+
+    expect(
+      original.agent.context.history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' &&
+          message.origin.variant === 'background_task_status',
+      ),
+    ).toHaveLength(0);
+    const prefix = recordsThrough(
+      originalPersistence.records,
+      (record) => record.type === 'full_compaction.complete',
+    );
+
+    let firstModelRequestText = '';
+    const resumedPersistence = new InMemoryAgentRecordPersistence(prefix);
+    const resumed = testAgent({
+      persistence: resumedPersistence,
+      generate: async (_provider, _system, _tools, messages) => {
+        firstModelRequestText = messages
+          .flatMap((message) => message.content)
+          .filter((part): part is Extract<ContentPart, { type: 'text' }> => part.type === 'text')
+          .map((part) => part.text)
+          .join('\n');
+        return textResult('Recovered request completed.');
+      },
+      initialConfig: {
+        providers: {
+          'test-provider': { type: 'kimi', apiKey: 'test-key' },
+        },
+        models: {
+          'kimi-code': {
+            provider: 'test-provider',
+            model: 'kimi-code',
+            maxContextSize: CAPS.max_context_tokens,
+          },
+        },
+      },
+    });
+    vi.spyOn(resumed.agent.background, 'list').mockReturnValue([RUNNING_BACKGROUND_TASK]);
+
+    await resumed.agent.resume();
+    expect(resumed.agent.fullCompaction.isCompacting).toBe(false);
+    expect(
+      resumed.agent.context.history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' &&
+          message.origin.variant === 'background_task_status',
+      ),
+    ).toHaveLength(0);
+
+    await resumed.rpc.prompt({ input: [{ type: 'text', text: 'FIRST-REQUEST-AFTER-RESTART' }] });
+    await resumed.agent.turn.waitForCurrentTurn();
+
+    expect(firstModelRequestText).toContain(RUNNING_BACKGROUND_TASK.description);
+    expect(
+      resumed.agent.context.history.filter(
+        (message) =>
+          message.origin?.kind === 'injection' &&
+          message.origin.variant === 'background_task_status',
+      ),
+    ).toHaveLength(1);
+    expect(
+      resumedPersistence.records.filter((record) => record.type === 'full_compaction.complete'),
+    ).toHaveLength(1);
+    expect(resumed.allEvents.filter((event) => event.event === 'compaction.completed')).toHaveLength(0);
+  });
+
+  it('restores runtime profile handles before recovered compaction releases deferred work', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const compactionApplied = createControlledPromise<void>();
+    const originalPersistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type === 'context.apply_compaction') compactionApplied.resolve();
+      },
+    });
+    const original = testAgent({ persistence: originalPersistence, generate: () => summary });
+    original.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    original.agent.config.update({
+      profileName: 'recovered-runtime-profile',
+      systemPrompt: 'STALE-PERSISTED-SYSTEM-PROMPT',
+    });
+    original.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await original.rpc.beginCompaction({});
+    await expect(
+      original.rpc.prompt({
+        input: [{ type: 'text', text: 'DEFERRED-BEHIND-RECOVERY' }],
+      }),
+    ).resolves.toMatchObject({ kind: 'deferred' });
+    const originalCompleted = original.once('compaction.completed');
+    const originalTurnEnded = original.once('turn.ended');
+    summary.resolve(textResult('Compacted summary.'));
+    await compactionApplied;
+    const prefix = recordsThrough(
+      originalPersistence.records,
+      (record) => record.type === 'context.apply_compaction',
+    );
+    await originalCompleted;
+    await originalTurnEnded;
+
+    let runtimeProfileInstalled = false;
+    let refreshedRuntimeContext: Parameters<ResolvedAgentProfile['systemPrompt']>[0] | undefined;
+    let runtimeProfileInstalledAtGenerate = false;
+    let generatedSystemPrompt = '';
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(prefix),
+      generate: async (_provider, systemPrompt) => {
+        runtimeProfileInstalledAtGenerate = runtimeProfileInstalled;
+        generatedSystemPrompt = systemPrompt;
+        return textResult('Recovered deferred request completed.');
+      },
+      initialConfig: {
+        providers: {
+          'test-provider': { type: 'kimi', apiKey: 'test-key' },
+        },
+        models: {
+          'kimi-code': {
+            provider: 'test-provider',
+            model: 'kimi-code',
+            maxContextSize: CAPS.max_context_tokens,
+          },
+        },
+      },
+    });
+    const runtimeProfile: ResolvedAgentProfile = {
+      name: 'recovered-runtime-profile',
+      tools: [],
+      systemPrompt: (context) => {
+        refreshedRuntimeContext = context;
+        return `REFRESHED-RUNTIME-SYSTEM-PROMPT\n${context.cwdListing ?? ''}`;
+      },
+    };
+    const resumedTurnEnded = resumed.once('turn.ended');
+
+    await resumed.agent.resume({
+      beforePendingWorkResume: () => {
+        runtimeProfileInstalled = true;
+        resumed.agent.setActiveProfile(runtimeProfile);
+      },
+    });
+    await resumedTurnEnded;
+
+    expect(runtimeProfileInstalledAtGenerate).toBe(true);
+    expect(refreshedRuntimeContext).toBeDefined();
+    expect(generatedSystemPrompt).toContain('REFRESHED-RUNTIME-SYSTEM-PROMPT');
+    expect(generatedSystemPrompt).not.toContain('STALE-PERSISTED-SYSTEM-PROMPT');
+    expect(resumed.agent.config.systemPrompt).toContain('REFRESHED-RUNTIME-SYSTEM-PROMPT');
+    expect(historyTexts(resumed).join('\n')).toContain('DEFERRED-BEHIND-RECOVERY');
+  });
+
   it('repeated compaction folds the prior summary into the new one, never stacking two summaries', async () => {
     const ctx = testAgent();
     ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
@@ -158,6 +983,563 @@ describe('compaction — guard tests', () => {
     expect(historyTexts(ctx).join('\n')).toContain('DEFERRED-PROMPT');
   });
 
+  it('clears a deferred prompt when the user cancels before compaction finishes', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let generateCalls = 0;
+    const generate: GenerateFn = () => {
+      generateCalls += 1;
+      return summary;
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'user one', 'assistant one', 40);
+
+    const compaction = ctx.rpc.beginCompaction({});
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(true);
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'CANCELLED-DEFERRED-PROMPT' }] });
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'CANCELLED-DEFERRED-STEER' }],
+    });
+
+    await ctx.rpc.cancel({});
+    summary.resolve(textResult('Compacted summary.'));
+    await compaction;
+
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+    expect(generateCalls).toBe(1);
+    const texts = historyTexts(ctx).join('\n');
+    expect(texts).not.toContain('CANCELLED-DEFERRED-PROMPT');
+    expect(texts).not.toContain('CANCELLED-DEFERRED-STEER');
+  });
+
+  it('does not let a stale prompt-owned cancel kill its deferred replacement', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let generateCalls = 0;
+    const ctx = testAgent({
+      generate: () => {
+        generateCalls += 1;
+        return generateCalls === 1
+          ? summary
+          : Promise.resolve(textResult('Replacement completed.'));
+      },
+    });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    await ctx.rpc.beginCompaction({});
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'DEFERRED-A' }],
+      promptId: 'prompt-deferred-a',
+    });
+
+    await ctx.rpc.cancel({
+      expectedPromptId: 'prompt-deferred-a',
+      requireActive: true,
+    });
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'DEFERRED-REPLACEMENT-X' }],
+      promptId: 'prompt-replacement-x',
+    });
+    await expect(
+      ctx.rpc.cancel({
+        expectedPromptId: 'prompt-deferred-a',
+        requireActive: true,
+      }),
+    ).rejects.toMatchObject({ code: 'turn.agent_busy' });
+
+    const ended = ctx.once('turn.ended');
+    summary.resolve(textResult('Compacted summary.'));
+    await ended;
+
+    expect(generateCalls).toBe(2);
+    const texts = historyTexts(ctx).join('\n');
+    expect(texts).not.toContain('DEFERRED-A');
+    expect(texts).toContain('DEFERRED-REPLACEMENT-X');
+  });
+
+  it('keeps a deferred prompt when a stale turn-scoped cancel arrives during compaction', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let generateCalls = 0;
+    const generate: GenerateFn = () => {
+      generateCalls += 1;
+      if (generateCalls === 1) return Promise.resolve(textResult('Initial turn completed.'));
+      if (generateCalls === 2) return summary;
+      return Promise.resolve(textResult('Deferred turn completed.'));
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'INITIAL-PROMPT' }] });
+    await ctx.agent.turn.waitForCurrentTurn();
+    const staleTurnId = ctx.agent.turn.currentId;
+    expect(staleTurnId).toBe(0);
+    ctx.appendExchange(2, 'older user context', 'older assistant context', 40);
+
+    const compaction = ctx.rpc.beginCompaction({});
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(true);
+    expect(
+      ctx.agent.turn.submitPrompt([{ type: 'text', text: 'PRESERVED-DEFERRED-PROMPT' }]),
+    ).toMatchObject({ kind: 'deferred', deferredPromptId: expect.any(String) });
+    await ctx.agent.turn.cancel(staleTurnId);
+
+    const deferredTurnEnded = ctx.once('turn.ended');
+    summary.resolve(textResult('Compacted summary.'));
+    await compaction;
+    await deferredTurnEnded;
+
+    expect(generateCalls).toBe(3);
+    expect(historyTexts(ctx).join('\n')).toContain('PRESERVED-DEFERRED-PROMPT');
+  });
+
+  it('admits only one direct deferred prompt and echoes both correlations when it starts', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    let generateCalls = 0;
+    const generate: GenerateFn = () => {
+      generateCalls += 1;
+      return generateCalls === 1
+        ? summary
+        : Promise.resolve(textResult('Deferred turn completed.'));
+    };
+    const ctx = testAgent({ generate, persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await ctx.rpc.beginCompaction({});
+    const accepted = await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'FIRST-DEFERRED-PROMPT' }],
+      promptId: 'prompt-first',
+    });
+    expect(accepted).toMatchObject({
+      kind: 'deferred',
+      deferredPromptId: expect.any(String),
+    });
+    if (accepted.kind !== 'deferred') throw new Error('expected deferred prompt admission');
+
+    await expect(
+      ctx.rpc.prompt({
+        input: [{ type: 'text', text: 'SECOND-DEFERRED-PROMPT' }],
+        promptId: 'prompt-second',
+      }),
+    ).rejects.toMatchObject({ code: 'turn.agent_busy' });
+
+    const ended = ctx.once('turn.ended');
+    summary.resolve(textResult('Compacted summary.'));
+    await ended;
+
+    expect(
+      persistence.records
+        .filter((record) => record.type === 'turn.prompt')
+        .flatMap((record) => record.input)
+        .filter((part) => part.type === 'text')
+        .map((part) => part.text),
+    ).toEqual(['FIRST-DEFERRED-PROMPT']);
+    expect(ctx.allEvents).toContainEqual(
+      expect.objectContaining({
+        type: '[rpc]',
+        event: 'turn.started',
+        args: expect.objectContaining({
+          promptId: 'prompt-first',
+          deferredPromptId: accepted.deferredPromptId,
+        }),
+      }),
+    );
+    expect(historyTexts(ctx).join('\n')).not.toContain('SECOND-DEFERRED-PROMPT');
+  });
+
+  it('cancels only the deferred user prompt while preserving a background steer', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let generateCalls = 0;
+    const generate: GenerateFn = () => {
+      generateCalls += 1;
+      return generateCalls === 1
+        ? summary
+        : Promise.resolve(textResult('Background steer handled.'));
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await ctx.rpc.beginCompaction({});
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'CANCEL-ME' }] });
+    ctx.agent.turn.steer([{ type: 'text', text: 'KEEP-BACKGROUND-STEER' }], {
+      kind: 'background_task',
+      taskId: 'task-1',
+      status: 'completed',
+      notificationId: 'notification-1',
+    });
+    await ctx.rpc.cancel({});
+
+    const ended = ctx.once('turn.ended');
+    summary.resolve(textResult('Compacted summary.'));
+    await ended;
+
+    expect(generateCalls).toBe(2);
+    expect(historyTexts(ctx).join('\n')).toContain('KEEP-BACKGROUND-STEER');
+    expect(historyTexts(ctx).join('\n')).not.toContain('CANCEL-ME');
+  });
+
+  it('steers a compaction-deferred prompt by its stable prompt correlation', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let generateCalls = 0;
+    const ctx = testAgent({
+      generate: () => {
+        generateCalls += 1;
+        return generateCalls === 1
+          ? summary
+          : Promise.resolve(textResult('Deferred prompt and steer handled.'));
+      },
+    });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await ctx.rpc.beginCompaction({});
+    await expect(
+      ctx.rpc.prompt({
+        input: [{ type: 'text', text: 'DEFERRED-OWNER' }],
+        promptId: 'prompt-deferred-owner',
+      }),
+    ).resolves.toMatchObject({ kind: 'deferred' });
+    await expect(
+      ctx.rpc.steer({
+        input: [{ type: 'text', text: 'STEER-FOR-DEFERRED-OWNER' }],
+        expectedPromptId: 'prompt-deferred-owner',
+        requireActive: true,
+      }),
+    ).resolves.toBeUndefined();
+
+    const ended = ctx.once('turn.ended');
+    summary.resolve(textResult('Compacted summary.'));
+    await ended;
+
+    const texts = historyTexts(ctx).join('\n');
+    expect(texts).toContain('DEFERRED-OWNER');
+    expect(texts).toContain('STEER-FOR-DEFERRED-OWNER');
+  });
+
+  it('replays a still-pending steer with its deferred prompt after a crash', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => summary });
+    original.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    original.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await original.rpc.beginCompaction({});
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'CRASH-DEFERRED-OWNER' }],
+      promptId: 'prompt-crash-owner',
+    });
+    await original.rpc.steer({
+      input: [{ type: 'text', text: 'CRASH-PENDING-STEER' }],
+      expectedPromptId: 'prompt-crash-owner',
+      requireActive: true,
+    });
+
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(structuredClone(persistence.records)),
+      generate: async () => textResult('Recovered deferred work.'),
+      initialConfig: {
+        providers: {
+          'test-provider': { type: 'kimi', apiKey: 'test-key' },
+        },
+        models: {
+          'kimi-code': {
+            provider: 'test-provider',
+            model: 'kimi-code',
+            maxContextSize: CAPS.max_context_tokens,
+          },
+        },
+      },
+    });
+    await resumed.agent.resume();
+    await resumed.agent.turn.waitForCurrentTurn();
+
+    const texts = historyTexts(resumed).join('\n');
+    expect(texts).toContain('CRASH-DEFERRED-OWNER');
+    expect(texts).toContain('CRASH-PENDING-STEER');
+  });
+
+  it('does not replay an activated empty deferred prompt after restart', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    let originalGenerateCalls = 0;
+    const original = testAgent({
+      persistence,
+      generate: () => {
+        originalGenerateCalls += 1;
+        return originalGenerateCalls === 1
+          ? summary
+          : Promise.resolve(textResult('Empty retry completed.'));
+      },
+    });
+    original.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    original.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await original.rpc.beginCompaction({});
+    await original.rpc.prompt({ input: [], promptId: 'empty-retry' });
+    const ended = original.once('turn.ended');
+    summary.resolve(textResult('Compacted summary.'));
+    await ended;
+
+    expect(
+      persistence.records.some((record) => record.type === 'turn.deferred_prompt_started'),
+    ).toBe(true);
+    let replayGenerateCalls = 0;
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(structuredClone(persistence.records)),
+      generate: async () => {
+        replayGenerateCalls += 1;
+        return textResult('Unexpected duplicate execution.');
+      },
+    });
+    await resumed.agent.resume();
+    await Promise.resolve();
+
+    expect(replayGenerateCalls).toBe(0);
+    expect(resumed.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('keeps cancelCompaction pending until the aborted worker has settled', async () => {
+    const summarizerStarted = createControlledPromise<void>();
+    const abortObserved = createControlledPromise<void>();
+    const releaseCleanup = createControlledPromise<void>();
+    let generateCalls = 0;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      generateCalls += 1;
+      if (generateCalls !== 1) return textResult('Follow-up completed.');
+      summarizerStarted.resolve();
+      await new Promise<void>((resolve) => {
+        const onAbort = (): void => {
+          abortObserved.resolve();
+          resolve();
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+      await releaseCleanup;
+      throw abortError();
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await ctx.rpc.beginCompaction({});
+    await summarizerStarted;
+    let cancelSettled = false;
+    const cancel = ctx.rpc.cancelCompaction({}).then(() => {
+      cancelSettled = true;
+    });
+    await abortObserved;
+    await Promise.resolve();
+    expect(cancelSettled).toBe(false);
+
+    releaseCleanup.resolve();
+    await cancel;
+    expect(
+      await ctx.rpc.prompt({ input: [{ type: 'text', text: 'FOLLOW-UP-AFTER-CANCEL' }] }),
+    ).toMatchObject({ kind: 'started' });
+    await ctx.agent.turn.waitForCurrentTurn();
+  });
+
+  it('aborts compaction before reporting a cancellation-record persistence failure', async () => {
+    const persistenceError = new Error('compaction cancel persistence failed');
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type === 'full_compaction.cancel') throw persistenceError;
+      },
+    });
+    const summarizerStarted = createControlledPromise<void>();
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      summarizerStarted.resolve();
+      await new Promise<void>((_resolve, reject) => {
+        const onAbort = (): void => {
+          reject(options?.signal?.reason ?? abortError());
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+      return textResult('Unexpected summary.');
+    };
+    const ctx = testAgent({ generate, persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await ctx.rpc.beginCompaction({});
+    await summarizerStarted;
+    await expect(ctx.rpc.cancelCompaction({})).rejects.toBe(persistenceError);
+
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+    expect(historyTexts(ctx).join('\n')).not.toContain('Unexpected summary.');
+  });
+
+  it('deduplicates compaction cancellation re-entered by its persistence observer', async () => {
+    const summarizerStarted = createControlledPromise<void>();
+    let ctx!: TestAgentContext;
+    let nestedCancellation: Promise<void> | undefined;
+    let cancelRecords = 0;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type !== 'full_compaction.cancel') return;
+        cancelRecords += 1;
+        nestedCancellation ??= ctx.agent.fullCompaction.cancel();
+      },
+    });
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      summarizerStarted.resolve();
+      await new Promise<void>((_resolve, reject) => {
+        const onAbort = (): void => {
+          reject(options?.signal?.reason ?? abortError());
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+      return textResult('Unexpected summary.');
+    };
+    ctx = testAgent({ generate, persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    await ctx.rpc.beginCompaction({});
+    await summarizerStarted;
+
+    const cancellation = ctx.agent.fullCompaction.cancel();
+    expect(nestedCancellation).toBe(cancellation);
+    await cancellation;
+
+    expect(cancelRecords).toBe(1);
+    expect(ctx.agent.fullCompaction.isCompacting).toBe(false);
+  });
+
+  it('keeps a concurrent prompt deferred until cancelled compaction cleanup finishes', async () => {
+    const summarizerStarted = createControlledPromise<void>();
+    const abortObserved = createControlledPromise<void>();
+    const releaseLateSummary = createControlledPromise<void>();
+    let generateCalls = 0;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      generateCalls += 1;
+      if (generateCalls !== 1) return textResult('Deferred prompt completed.');
+      summarizerStarted.resolve();
+      const onAbort = (): void => {
+        abortObserved.resolve();
+      };
+      if (options?.signal?.aborted === true) onAbort();
+      else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      await releaseLateSummary;
+      // Deliberately ignore the abort and return a stale summary. The runtime
+      // must discard it before applyCompaction.
+      return textResult('LATE-CANCELLED-SUMMARY');
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'ORIGINAL-USER', 'ORIGINAL-ASSISTANT', 40);
+
+    await ctx.rpc.beginCompaction({});
+    await summarizerStarted;
+    const cancel = ctx.rpc.cancelCompaction({});
+    await abortObserved;
+    const admitted = await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'PROMPT-DURING-CANCEL-CLEANUP' }],
+    });
+    expect(admitted).toMatchObject({ kind: 'deferred' });
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+
+    const ended = ctx.once('turn.ended');
+    releaseLateSummary.resolve();
+    await cancel;
+    await ended;
+
+    const texts = historyTexts(ctx).join('\n');
+    expect(texts).toContain('ORIGINAL-ASSISTANT');
+    expect(texts).toContain('PROMPT-DURING-CANCEL-CLEANUP');
+    expect(texts).not.toContain('LATE-CANCELLED-SUMMARY');
+  });
+
+  it('drops deferred work and awaits compaction settlement during shutdown', async () => {
+    const abortObserved = createControlledPromise<void>();
+    const releaseCleanup = createControlledPromise<void>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    let generateCalls = 0;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      generateCalls += 1;
+      await new Promise<void>((resolve) => {
+        const onAbort = (): void => {
+          abortObserved.resolve();
+          resolve();
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+      await releaseCleanup;
+      throw abortError();
+    };
+    const ctx = testAgent({ generate, persistence });
+    ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+
+    await ctx.rpc.beginCompaction({});
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'MUST-NOT-LAUNCH-AFTER-CLOSE' }],
+      promptId: 'prompt-closed-before-start',
+    });
+    let shutdownSettled = false;
+    const shutdown = ctx.agent.turn.shutdown(abortError('Session closed')).then(() => {
+      shutdownSettled = true;
+    });
+    await abortObserved;
+    await Promise.resolve();
+    expect(shutdownSettled).toBe(false);
+
+    releaseCleanup.resolve();
+    await shutdown;
+    expect(generateCalls).toBe(1);
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+    expect(historyTexts(ctx).join('\n')).not.toContain('MUST-NOT-LAUNCH-AFTER-CLOSE');
+    expect(
+      persistence.records.find((record) => record.type === 'turn.cancel'),
+    ).toMatchObject({ promptId: 'prompt-closed-before-start' });
+
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(structuredClone(persistence.records)),
+      generate: async () => textResult('Unexpected resurrected prompt.'),
+    });
+    await resumed.agent.resume();
+    expect(resumed.agent.turn.hasActiveTurn).toBe(false);
+    expect(historyTexts(resumed).join('\n')).not.toContain('MUST-NOT-LAUNCH-AFTER-CLOSE');
+  });
+
   it('defers a steer arriving during compaction and delivers it afterward', async () => {
     const ctx = testAgent();
     ctx.configure({ provider: PROVIDER, modelCapabilities: CAPS });
diff --git a/packages/agent-core/test/agent/compaction/full.test.ts b/packages/agent-core/test/agent/compaction/full.test.ts
index e238b6eefe..05657252b5 100644
--- a/packages/agent-core/test/agent/compaction/full.test.ts
+++ b/packages/agent-core/test/agent/compaction/full.test.ts
@@ -261,6 +261,62 @@ describe('FullCompaction', () => {
     expect(refreshSpy).toHaveBeenCalledTimes(1);
   });
 
+  it('uses a refreshed profile prompt after auto compaction without replacing turn config', async () => {
+    const ctx = testAgent({ compactionStrategy: alwaysCompactOnce });
+    ctx.configure({
+      provider: CATALOGUED_PROVIDER,
+      modelCapabilities: CATALOGUED_MODEL_CAPABILITIES,
+    });
+    let profilePrompt = 'PROMPT-BEFORE-COMPACTION';
+    ctx.agent.useProfile({
+      name: 'refreshing-profile',
+      tools: [],
+      systemPrompt: () => profilePrompt,
+    });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    profilePrompt = 'PROMPT-AFTER-COMPACTION';
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    ctx.mockNextResponse({ type: 'text', text: 'Answer with refreshed instructions.' });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue after compaction' }] });
+    await ctx.untilTurnEnd();
+
+    expect(ctx.llmCalls.map((call) => call.systemPrompt)).toEqual([
+      'PROMPT-BEFORE-COMPACTION',
+      'PROMPT-AFTER-COMPACTION',
+    ]);
+  });
+
+  it('uses the prompt captured by compaction when config changes before the next step', async () => {
+    const ctx = testAgent({ compactionStrategy: alwaysCompactOnce });
+    ctx.configure({
+      provider: CATALOGUED_PROVIDER,
+      modelCapabilities: CATALOGUED_MODEL_CAPABILITIES,
+    });
+    let profilePrompt = 'PROFILE-PROMPT-BEFORE';
+    ctx.agent.useProfile({
+      name: 'refreshing-profile',
+      tools: [],
+      systemPrompt: () => profilePrompt,
+    });
+    ctx.appendExchange(1, 'older user context', 'older assistant context', 40);
+    profilePrompt = 'PROFILE-PROMPT-AFTER';
+    ctx.emitter.once('compaction.completed', () => {
+      ctx.agent.config.update({ systemPrompt: 'ORDINARY-MID-TURN-CONFIG' });
+    });
+    ctx.mockNextResponse({ type: 'text', text: 'Compacted summary.' });
+    ctx.mockNextResponse({ type: 'text', text: 'Answer with captured instructions.' });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue after compaction' }] });
+    await ctx.untilTurnEnd();
+
+    expect(ctx.llmCalls.map((call) => call.systemPrompt)).toEqual([
+      'PROFILE-PROMPT-BEFORE',
+      'PROFILE-PROMPT-AFTER',
+    ]);
+    expect(ctx.agent.config.systemPrompt).toBe('ORDINARY-MID-TURN-CONFIG');
+  });
+
   it('does not reset active tools while refreshing the system prompt after compaction', async () => {
     const ctx = testAgent();
     ctx.configure({
@@ -511,7 +567,7 @@ describe('FullCompaction', () => {
       expect(preCompactSignal).toBeInstanceOf(AbortSignal);
     });
     const canceled = ctx.once('compaction.cancelled');
-    ctx.agent.fullCompaction.cancel();
+    void ctx.agent.fullCompaction.cancel();
     await canceled;
 
     expect(trigger).toHaveBeenCalledWith(
@@ -900,7 +956,7 @@ describe('FullCompaction', () => {
     await ctx.rpc.beginCompaction({});
     await firstAttemptFailed.promise;
 
-    ctx.agent.fullCompaction.cancel();
+    void ctx.agent.fullCompaction.cancel();
     await cancelled;
     await vi.advanceTimersByTimeAsync(10_000);
 
@@ -908,7 +964,7 @@ describe('FullCompaction', () => {
     await ctx.expectResumeMatches();
   });
 
-  it('cancels the compaction lifecycle when manual compaction generation fails', async () => {
+  it('reports manual compaction generation failure without mislabelling it as cancellation', async () => {
     const records: TelemetryRecord[] = [];
     const generate: GenerateFn = async () => {
       throw new Error('compaction exploded');
@@ -927,13 +983,10 @@ describe('FullCompaction', () => {
 
     const events = ctx.newEvents();
     expect(events).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({ type: '[wire]', event: 'full_compaction.cancel' }),
-        expect.objectContaining({ type: '[rpc]', event: 'compaction.cancelled' }),
-        expect.objectContaining({ type: '[rpc]', event: 'error' }),
-      ]),
+      expect.arrayContaining([expect.objectContaining({ type: '[rpc]', event: 'error' })]),
     );
-    expect(eventIndex(events, 'compaction.cancelled')).toBeLessThan(eventIndex(events, 'error'));
+    expect(eventIndex(events, 'full_compaction.cancel')).toBe(-1);
+    expect(eventIndex(events, 'compaction.cancelled')).toBe(-1);
     expect(ctx.compactHistory()).toEqual([
       { role: 'user', text: 'old user one' },
       { role: 'assistant', text: 'old assistant one' },
@@ -1275,9 +1328,9 @@ describe('FullCompaction', () => {
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "old user one" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "old user two" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "recent user three" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Answer after compacting" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Answer after compacting" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Answer after compacting" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Answer after compacting" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
       [wire] full_compaction.begin       { "source": "auto", "time": "<time>" }
       [emit] compaction.started          { "trigger": "auto" }
       [emit] compaction.blocked          { "turnId": 0 }
@@ -1289,13 +1342,13 @@ describe('FullCompaction', () => {
       [emit] agent.status.updated        { "model": "kimi-code", "contextTokens": 166, "maxContextTokens": 256000, "contextUsage": 0.0006484375, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "kimi-code": { "inputOther": 1173, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 1173, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [wire] full_compaction.complete    { "time": "<time>" }
       [emit] compaction.completed        { "result": { "summary": "Auto compacted summary.", "compactedCount": 7, "tokensBefore": 46, "tokensAfter": 166, "keptUserMessageCount": 4 } }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "kimi-code", "modelAlias": "kimi-code", "thinkingEffort": "off", "maxTokens": 255834, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 2, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I can answer after compaction." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I can answer after compaction." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 165, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 165, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I can answer after compaction." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 165, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 165, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "kimi-code", "usage": { "inputOther": 165, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "kimi-code", "contextTokens": 176, "maxContextTokens": 256000, "contextUsage": 0.0006875, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "kimi-code": { "inputOther": 1338, "output": 20, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 1338, "output": 20, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 165, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 0, "reason": "completed" }
@@ -2313,9 +2366,9 @@ describe('FullCompaction', () => {
     await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Trigger repeated compaction' }] });
 
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Trigger repeated compaction" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Trigger repeated compaction" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Trigger repeated compaction" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Trigger repeated compaction" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
       [wire] full_compaction.begin       { "source": "auto", "time": "<time>" }
       [emit] compaction.started          { "trigger": "auto" }
       [emit] compaction.blocked          { "turnId": 0 }
@@ -2327,21 +2380,23 @@ describe('FullCompaction', () => {
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 153, "maxContextTokens": 1000000, "contextUsage": 0.000153, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 1135, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 1135, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [wire] full_compaction.complete    { "time": "<time>" }
       [emit] compaction.completed        { "result": { "summary": "First compacted summary.", "compactedCount": 1, "tokensBefore": 8, "tokensAfter": 153, "keptUserMessageCount": 1 } }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999847, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 2, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I need a tool." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_missing", "name": "MissingTool", "argumentsPart": "{}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I need a tool." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_missing", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_missing", "name": "MissingTool", "args": {} }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I need a tool." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_missing", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_missing", "name": "MissingTool", "args": {} }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_missing", "name": "MissingTool", "args": {} }
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_missing", "toolCallId": "call_missing", "result": { "output": "Tool \\"MissingTool\\" not found", "isError": true } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_missing", "output": "Tool \\"MissingTool\\" not found", "isError": true }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 154, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 154, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 154, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 154, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 154, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 165, "maxContextTokens": 1000000, "contextUsage": 0.000165, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 1289, "output": 20, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 1289, "output": 20, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 154, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.step.interrupted       { "turnId": 0, "step": 2, "reason": "error", "message": "Compaction limit exceeded (1)" }
+      [wire] turn.outcome                { "outcomeId": "<uuid-4>", "turnId": 0, "content": "The previous turn ended before producing a final response.\\n\\nError: The request exceeded the model context limit.\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.", "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<system-reminder>\\nThe previous turn ended before producing a final response.\\n\\nError: The request exceeded the model context limit.\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.\\n</system-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "turn_outcome" } }, "materializedTurnOutcomeId": "<uuid-4>", "time": "<time>" }
       [emit] turn.ended                  { "turnId": 0, "reason": "failed", "error": { "code": "context.overflow", "message": "Compaction limit exceeded (1)", "name": "KimiError", "details": { "maxCompactions": 1, "turnId": 0 }, "retryable": true } }
     `);
     expect(ctx.newEvents()).toMatchInlineSnapshot(
diff --git a/packages/agent-core/test/agent/compaction/handoff.test.ts b/packages/agent-core/test/agent/compaction/handoff.test.ts
index a45b09c9a4..9c8c4bc8db 100644
--- a/packages/agent-core/test/agent/compaction/handoff.test.ts
+++ b/packages/agent-core/test/agent/compaction/handoff.test.ts
@@ -192,6 +192,39 @@ describe('collectCompactableUserMessages', () => {
 
     expect(collectCompactableUserMessages(messages).map(messageText)).toEqual(['u1', 'u2']);
   });
+
+  it('keeps only the latest turn outcome until a real model assistant has seen it', () => {
+    const oldOutcome = {
+      ...textMessage('user', 'old outcome'),
+      origin: { kind: 'injection' as const, variant: 'turn_outcome' },
+    };
+    const latestOutcome = {
+      ...textMessage('user', 'latest outcome'),
+      origin: { kind: 'injection' as const, variant: 'turn_outcome' },
+    };
+    const hookBlock = {
+      ...textMessage('assistant', 'blocked without a request'),
+      origin: { kind: 'hook_result' as const, event: 'UserPromptSubmit', blocked: true },
+    };
+    const messages = [
+      { ...textMessage('user', 'u1'), origin: { kind: 'user' as const } },
+      oldOutcome,
+      latestOutcome,
+      hookBlock,
+      { ...textMessage('user', 'u2'), origin: { kind: 'user' as const } },
+    ];
+
+    expect(collectCompactableUserMessages(messages).map(messageText)).toEqual([
+      'u1',
+      'latest outcome',
+      'u2',
+    ]);
+    expect(
+      collectCompactableUserMessages([...messages, textMessage('assistant', 'model reply')]).map(
+        messageText,
+      ),
+    ).toEqual(['u1', 'u2']);
+  });
 });
 
 describe('selectRecentUserMessages', () => {
@@ -343,6 +376,27 @@ describe('selectCompactionUserMessages', () => {
     expect(/^(?:😀)*$/u.test(tailText)).toBe(true);
     expect(tailText.length % 2).toBe(0);
   });
+
+  it('keeps a complete unseen turn outcome outside the budget of an oversized follow-up', () => {
+    const old = { ...textMessage('user', 'o'.repeat(1_000)), origin: { kind: 'user' as const } };
+    const outcome = {
+      ...textMessage('user', 'FULL-INTERRUPTION-REMINDER'),
+      origin: { kind: 'injection' as const, variant: 'turn_outcome' },
+    };
+    const followUp = {
+      ...textMessage('user', 'f'.repeat(10_000)),
+      origin: { kind: 'user' as const },
+    };
+    const compactable = collectCompactableUserMessages([old, outcome, followUp]);
+
+    const selection = selectCompactionUserMessages(compactable, 1_000, 100);
+    const kept = [...selection.head, ...selection.tail];
+
+    expect(kept.filter((message) => message.origin?.kind === 'injection')).toEqual([outcome]);
+    expect(messageText(kept.find((message) => message.origin?.kind === 'injection')!)).toBe(
+      'FULL-INTERRUPTION-REMINDER',
+    );
+  });
 });
 
 describe('buildCompactionElisionText', () => {
diff --git a/packages/agent-core/test/agent/config.test.ts b/packages/agent-core/test/agent/config.test.ts
index ecaed3318f..e49f83cdd8 100644
--- a/packages/agent-core/test/agent/config.test.ts
+++ b/packages/agent-core/test/agent/config.test.ts
@@ -134,16 +134,16 @@ describe('Agent config', () => {
       input: [{ type: 'text', text: 'Run Bash before config changes' }],
     });
     expect(await ctx.untilApproval(true)).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash before config changes" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash before config changes" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash before config changes" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash before config changes" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will run Bash." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf original-result\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will run Bash." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will run Bash." } }, "time": "<time>" }
       [emit] requestApproval             { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf original-result", "display": { "kind": "command", "command": "printf original-result", "cwd": "<cwd>", "language": "bash" } }
     `);
     expect(ctx.lastLlmInput()).toMatchInlineSnapshot(`
@@ -169,23 +169,23 @@ describe('Agent config', () => {
       [wire] config.update                       { "systemPrompt": "Changed system prompt.", "time": "<time>" }
       [emit] agent.status.updated                { "model": "changed-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": false, "swarmMode": false, "permission": "manual" }
       [wire] tools.set_active_tools              { "names": [], "time": "<time>" }
-      [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf original-result", "timeout": 60 }, "description": "Running: printf original-result", "display": { "kind": "command", "command": "printf original-result", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf original-result", "timeout": 60 }, "description": "Running: printf original-result", "display": { "kind": "command", "command": "printf original-result", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started                   { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf original-result", "timeout": 60 }, "description": "Running: printf original-result", "display": { "kind": "command", "command": "printf original-result", "cwd": "<cwd>", "language": "bash" } }
       [emit] tool.progress                       { "turnId": 0, "toolCallId": "call_bash", "update": { "kind": "stdout", "text": "original-result" } }
       [wire] context.append_loop_event           { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "original-result" } }, "time": "<time>" }
       [emit] tool.result                         { "turnId": 0, "toolCallId": "call_bash", "output": "original-result" }
-      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated                { "model": "changed-model", "contextTokens": 32, "maxContextTokens": 1000000, "contextUsage": 0.000032, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 9, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
       [wire] llm.tools_snapshot                  { "hash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "tools": [], "time": "<time>" }
       [wire] llm.request                         { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "changed-model", "thinkingEffort": "off", "maxTokens": 999968, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "systemPrompt": "You are a deterministic test agent.", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 3, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta                     { "turnId": 0, "delta": "Still using the original turn config." }
-      [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "Still using the original turn config." } }, "time": "<time>" }
-      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 37, "output": 13, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 37, "output": 13, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "Still using the original turn config." } }, "time": "<time>" }
+      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 37, "output": 13, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 37, "output": 13, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 37, "output": 13, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated                { "model": "changed-model", "contextTokens": 50, "maxContextTokens": 1000000, "contextUsage": 0.00005, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 46, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 46, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 46, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                          { "turnId": 0, "reason": "completed" }
@@ -206,16 +206,16 @@ describe('Agent config', () => {
     await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Start a fresh turn' }] });
 
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Start a fresh turn" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Start a fresh turn" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-6>", "turnId": 1, "time": "<time>" }
       [emit] turn.started                { "turnId": 1, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Start a fresh turn" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-5>", "turnId": "1", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 1, "step": 1, "stepId": "<uuid-5>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Start a fresh turn" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-6>", "turnId": 1 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-7>", "turnId": "1", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 1, "step": 1, "stepId": "<uuid-7>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "changed-model", "modelAlias": "changed-model", "thinkingEffort": "off", "maxTokens": 999950, "toolSelect": false, "systemPromptHash": "7617cb8b42659214c397a1d7505fce204b673b078a10de8bcccc697d88dcda56", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 5, "turnStep": "1.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 1, "delta": "Now the changed config is active." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-6>", "turnId": "1", "step": 1, "stepUuid": "<uuid-5>", "part": { "type": "text", "text": "Now the changed config is active." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-5>", "turnId": "1", "step": 1, "usage": { "inputOther": 56, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-3" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 1, "step": 1, "stepId": "<uuid-5>", "usage": { "inputOther": 56, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-8>", "turnId": "1", "step": 1, "stepUuid": "<uuid-7>", "part": { "type": "text", "text": "Now the changed config is active." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-7>", "turnId": "1", "step": 1, "usage": { "inputOther": 56, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-3" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 1, "step": 1, "stepId": "<uuid-7>", "usage": { "inputOther": 56, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "changed-model", "usage": { "inputOther": 56, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "changed-model", "contextTokens": 68, "maxContextTokens": 1000000, "contextUsage": 0.000068, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 46, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 }, "changed-model": { "inputOther": 56, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 102, "output": 48, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 56, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 1, "reason": "completed" }
diff --git a/packages/agent-core/test/agent/context.test.ts b/packages/agent-core/test/agent/context.test.ts
index 432187410a..110a405156 100644
--- a/packages/agent-core/test/agent/context.test.ts
+++ b/packages/agent-core/test/agent/context.test.ts
@@ -7,6 +7,9 @@ import { describe, expect, it, vi } from 'vitest';
 import { renderNotificationXml } from '../../src/agent/context/notification-xml';
 import { project } from '../../src/agent/context/projector';
 import type { ContextMessage } from '../../src/agent/context/types';
+import { InMemoryAgentRecordPersistence, type AgentRecord } from '../../src/agent/records';
+import { ErrorCodes } from '../../src/errors';
+import type { Logger } from '../../src/logging';
 import { buildImageCompressionCaption } from '../../src/tools/support/image-compress';
 import { estimateTokensForMessages } from '../../src/utils/tokens';
 import { createFakeKaos } from '../tools/fixtures/fake-kaos';
@@ -1335,6 +1338,79 @@ describe('Agent context', () => {
     ]);
   });
 
+  it('removes a turn outcome reminder when undo removes its user prompt', async () => {
+    const ctx = testAgent();
+    ctx.configure();
+
+    ctx.dispatch({
+      type: 'context.append_message',
+      message: userMessage('do the work', { kind: 'user' }),
+    });
+    ctx.dispatch({
+      type: 'context.append_message',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'text', text: 'partial response' }],
+        toolCalls: [],
+      },
+    });
+    ctx.dispatch({
+      type: 'context.append_message',
+      message: userMessage('The previous turn failed', {
+        kind: 'injection',
+        variant: 'turn_outcome',
+      }),
+    });
+
+    await ctx.rpc.undoHistory({ count: 1 });
+
+    expect(ctx.agent.context.history).toEqual([]);
+    expect(ctx.agent.replayBuilder.buildResult()).toEqual([]);
+  });
+
+  it('keeps an earlier turn outcome reminder when undo removes a later user prompt', async () => {
+    const ctx = testAgent();
+    ctx.configure();
+
+    ctx.dispatch({
+      type: 'context.append_message',
+      message: userMessage('unfinished request', { kind: 'user' }),
+    });
+    ctx.dispatch({
+      type: 'context.append_message',
+      message: userMessage('The previous turn failed', {
+        kind: 'injection',
+        variant: 'turn_outcome',
+      }),
+    });
+    ctx.dispatch({
+      type: 'context.append_message',
+      message: userMessage('replacement request', { kind: 'user' }),
+    });
+    ctx.dispatch({
+      type: 'context.append_message',
+      message: {
+        role: 'assistant',
+        content: [{ type: 'text', text: 'replacement response' }],
+        toolCalls: [],
+      },
+    });
+
+    await ctx.rpc.undoHistory({ count: 1 });
+
+    expect(ctx.agent.context.history).toEqual([
+      expect.objectContaining({
+        role: 'user',
+        content: [{ type: 'text', text: 'unfinished request' }],
+        origin: { kind: 'user' },
+      }),
+      expect.objectContaining({
+        role: 'user',
+        content: [{ type: 'text', text: 'The previous turn failed' }],
+        origin: { kind: 'injection', variant: 'turn_outcome' },
+      }),
+    ]);
+  });
 });
 
 describe('Agent context notification projection', () => {
@@ -1542,3 +1618,219 @@ describe('strictMessages duplicate tool call ids', () => {
     expect(textOf(strictResults[0]!)).toBe('result 1');
   });
 });
+
+describe('context persistence observer re-entry', () => {
+  function reentrantContext() {
+    let armed = false;
+    let nestedMutation: () => void = () => {};
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record: AgentRecord) => {
+        if (!armed || record.type !== 'context.append_message') return;
+        armed = false;
+        nestedMutation();
+      },
+    });
+    const ctx = testAgent({ persistence });
+    ctx.configure();
+    return {
+      ctx,
+      persistence,
+      arm(mutation: () => void) {
+        nestedMutation = mutation;
+        armed = true;
+      },
+    };
+  }
+
+  it('rejects a nested clear while preserving the accepted outer append', async () => {
+    const { ctx, persistence, arm } = reentrantContext();
+    arm(() => {
+      ctx.agent.context.clear();
+    });
+
+    ctx.agent.context.appendUserMessage([{ type: 'text', text: 'outer' }]);
+
+    expect(ctx.compactHistory()).toEqual([{ role: 'user', text: 'outer' }]);
+    expect(persistence.records.some((record) => record.type === 'context.clear')).toBe(false);
+    await ctx.expectResumeMatches();
+  });
+
+  it('rejects a nested undo while preserving both accepted appends', async () => {
+    const { ctx, persistence, arm } = reentrantContext();
+    ctx.agent.context.appendUserMessage([{ type: 'text', text: 'earlier' }]);
+    arm(() => {
+      ctx.agent.context.undo(1);
+    });
+
+    ctx.agent.context.appendUserMessage([{ type: 'text', text: 'outer' }]);
+
+    expect(ctx.compactHistory()).toEqual([
+      { role: 'user', text: 'earlier' },
+      { role: 'user', text: 'outer' },
+    ]);
+    expect(persistence.records.some((record) => record.type === 'context.undo')).toBe(false);
+    await ctx.expectResumeMatches();
+  });
+
+  it('rejects a nested compaction while preserving the accepted outer append', async () => {
+    const { ctx, persistence, arm } = reentrantContext();
+    arm(() =>
+      ctx.agent.context.applyCompaction({
+        summary: 'nested summary',
+        compactedCount: 0,
+        tokensBefore: 0,
+      }),
+    );
+
+    ctx.agent.context.appendUserMessage([{ type: 'text', text: 'outer' }]);
+
+    expect(ctx.compactHistory()).toEqual([{ role: 'user', text: 'outer' }]);
+    expect(
+      persistence.records.some((record) => record.type === 'context.apply_compaction'),
+    ).toBe(false);
+    await ctx.expectResumeMatches();
+  });
+
+  it('rejects a nested append while preserving the accepted outer append order', async () => {
+    const { ctx, persistence, arm } = reentrantContext();
+    arm(() => {
+      ctx.agent.context.appendUserMessage([{ type: 'text', text: 'nested' }]);
+    });
+
+    ctx.agent.context.appendUserMessage([{ type: 'text', text: 'outer' }]);
+
+    expect(ctx.compactHistory()).toEqual([{ role: 'user', text: 'outer' }]);
+    expect(
+      persistence.records.filter((record) => record.type === 'context.append_message'),
+    ).toHaveLength(1);
+    await ctx.expectResumeMatches();
+  });
+
+  it('rejects a swarm reminder pop inside an accepted append observer', async () => {
+    let armed = false;
+    let nestedError: unknown;
+    let ctx!: ReturnType<typeof testAgent>;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (!armed || record.type !== 'context.append_message') return;
+        armed = false;
+        try {
+          ctx.agent.swarmMode.exit();
+        } catch (error) {
+          nestedError = error;
+          throw error;
+        }
+      },
+    });
+    ctx = testAgent({ persistence });
+    ctx.configure();
+    await ctx.rpc.enterSwarm({ trigger: 'manual' });
+    armed = true;
+
+    ctx.agent.context.appendUserMessage([{ type: 'text', text: 'outer' }]);
+
+    expect(nestedError).toMatchObject({ code: ErrorCodes.SESSION_STATE_INVALID });
+    expect(ctx.agent.swarmMode.isActive).toBe(false);
+    expect(ctx.agent.context.history.map((message) => message.origin)).toEqual([
+      { kind: 'injection', variant: 'swarm_mode' },
+      { kind: 'user' },
+    ]);
+    const outerIndex = persistence.records.findIndex(
+      (record) =>
+        record.type === 'context.append_message' &&
+        record.message.origin?.kind === 'user',
+    );
+    const exitIndex = persistence.records.findIndex((record) => record.type === 'swarm_mode.exit');
+    expect(outerIndex).toBeGreaterThanOrEqual(0);
+    expect(exitIndex).toBeGreaterThan(outerIndex);
+    await ctx.expectResumeMatches();
+  });
+
+  it('keeps an accepted append successful when its diagnostic logger throws', async () => {
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type === 'context.append_message') {
+          throw new Error('observer failed after acceptance');
+        }
+      },
+    });
+    const warn = vi.fn(() => {
+      throw new Error('warning sink failed');
+    });
+    const recursiveError = vi.fn(() => {
+      throw new Error('must not recursively log');
+    });
+    let logger!: Logger;
+    logger = {
+      error: recursiveError,
+      warn,
+      info: vi.fn(),
+      debug: vi.fn(),
+      createChild: () => logger,
+    };
+    const ctx = testAgent({ persistence, log: logger });
+    ctx.configure();
+
+    expect(() => {
+      ctx.agent.context.appendUserMessage([{ type: 'text', text: 'accepted once' }]);
+    }).not.toThrow();
+
+    expect(ctx.compactHistory()).toEqual([{ role: 'user', text: 'accepted once' }]);
+    expect(
+      persistence.records.filter((record) => record.type === 'context.append_message'),
+    ).toHaveLength(1);
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(recursiveError).not.toHaveBeenCalled();
+    await ctx.expectResumeMatches();
+  });
+
+  it('closes an unresolved tool call when its diagnostic logger throws', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    let logger!: Logger;
+    logger = {
+      error: vi.fn(),
+      warn: vi.fn(() => {
+        throw new Error('warning sink failed');
+      }),
+      info: vi.fn(),
+      debug: vi.fn(),
+      createChild: () => logger,
+    };
+    const ctx = testAgent({ persistence, log: logger });
+    ctx.configure();
+    ctx.agent.context.appendLoopEvent({
+      type: 'step.begin',
+      uuid: 'dangling-step',
+      turnId: 'turn-1',
+      step: 1,
+    });
+    ctx.agent.context.appendLoopEvent({
+      type: 'tool.call',
+      uuid: 'dangling-call-event',
+      turnId: 'turn-1',
+      step: 1,
+      stepUuid: 'dangling-step',
+      toolCallId: 'dangling-call',
+      name: 'Run',
+      args: {},
+    });
+
+    expect(() => {
+      ctx.agent.context.appendLoopEvent({
+        type: 'step.begin',
+        uuid: 'next-step',
+        turnId: 'turn-1',
+        step: 2,
+      });
+    }).not.toThrow();
+
+    expect(
+      persistence.records.filter(
+        (record) =>
+          record.type === 'context.append_loop_event' && record.event.type === 'step.begin',
+      ),
+    ).toHaveLength(2);
+    expect(ctx.agent.context.history.filter((message) => message.role === 'tool')).toHaveLength(1);
+    await ctx.expectResumeMatches();
+  });
+});
diff --git a/packages/agent-core/test/agent/image-caption-injection.test.ts b/packages/agent-core/test/agent/image-caption-injection.test.ts
index 805a54861f..5870c3fad6 100644
--- a/packages/agent-core/test/agent/image-caption-injection.test.ts
+++ b/packages/agent-core/test/agent/image-caption-injection.test.ts
@@ -15,8 +15,10 @@
  *   - resume parity via expectResumeMatches (the TUI replay data source)
  */
 
-import { expect, it } from 'vitest';
+import { expect, it, vi } from 'vitest';
 
+import type { AgentRecord } from '../../src/agent';
+import { InMemoryAgentRecordPersistence } from '../../src/agent/records';
 import { buildImageCompressionCaption } from '../../src/tools/support/image-compress';
 import { testAgent } from './harness/agent';
 
@@ -170,3 +172,183 @@ it('smoke: a prompt without images is completely untouched', async () => {
 
   await ctx.expectResumeMatches();
 });
+
+it.each(['none', 'clear', 'compaction'] as const)(
+  'recovers a multi-caption prompt exactly once after its first child record (%s)',
+  async (destructiveRecord) => {
+    const pendingProvider = new Promise<never>(() => undefined);
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => pendingProvider });
+    original.configure();
+
+    await original.rpc.prompt({
+      input: [
+        { type: 'text', text: CAPTION },
+        { type: 'image_url', imageUrl: { url: IMAGE_URL } },
+        { type: 'text', text: SECOND_CAPTION },
+        { type: 'image_url', imageUrl: { url: IMAGE_URL } },
+        { type: 'text', text: 'CRASH-PREFIX-IMAGE-PROMPT' },
+      ],
+    });
+
+    const firstChildIndex = persistence.records.findIndex(
+      (record) =>
+        record.type === 'context.append_message' &&
+        record.turnInputPart?.index === 0,
+    );
+    expect(firstChildIndex).toBeGreaterThanOrEqual(0);
+    const prefix = structuredClone(persistence.records.slice(0, firstChildIndex + 1));
+    const crashed = new InMemoryAgentRecordPersistence(prefix);
+    if (destructiveRecord === 'clear') {
+      crashed.append({ type: 'context.clear', time: Date.now() });
+    } else if (destructiveRecord === 'compaction') {
+      crashed.append({
+        type: 'context.apply_compaction',
+        summary: 'CRASH-PREFIX-SUMMARY',
+        contextSummary: 'CRASH-PREFIX-SUMMARY',
+        compactedCount: 1,
+        tokensBefore: 10,
+        tokensAfter: 5,
+        keptUserMessageCount: 0,
+        droppedCount: 1,
+        time: Date.now(),
+      });
+    }
+
+    const resumed = testAgent({ persistence: crashed });
+    resumed.configure();
+    resumed.mockNextResponse({ type: 'text', text: 'Recovered image prompt.' });
+    await resumed.agent.resume();
+    await resumed.agent.turn.waitForCurrentTurn();
+
+    const texts = resumed.agent.context.history
+      .flatMap((message) => message.content)
+      .filter((part) => part.type === 'text')
+      .map((part) => part.text)
+      .join('\n');
+    expect(texts.match(/\/tmp\/originals\/shot\.png/g)).toHaveLength(1);
+    expect(texts.match(/\/tmp\/originals\/photo\.jpg/g)).toHaveLength(1);
+    expect(texts.match(/CRASH-PREFIX-IMAGE-PROMPT/g)).toHaveLength(1);
+  },
+);
+
+it('rolls back an orphan caption when cancellation is accepted from its record observer', async () => {
+  let original!: ReturnType<typeof testAgent>;
+  let cancellation: Promise<void> | undefined;
+  const persistence = new InMemoryAgentRecordPersistence([], {
+    onRecord: (record) => {
+      if (
+        cancellation === undefined &&
+        record.type === 'context.append_message' &&
+        record.turnInputPart?.index === 0
+      ) {
+        cancellation = original.agent.turn.cancel(0);
+      }
+    },
+  });
+  original = testAgent({ persistence });
+  original.configure();
+
+  await original.rpc.prompt({
+    input: [
+      { type: 'text', text: CAPTION },
+      { type: 'image_url', imageUrl: { url: IMAGE_URL } },
+      { type: 'text', text: SECOND_CAPTION },
+      { type: 'image_url', imageUrl: { url: IMAGE_URL } },
+      { type: 'text', text: 'CANCELLED-IMAGE-PROMPT' },
+    ],
+  });
+  await original.untilTurnEnd();
+  await cancellation;
+
+  const cancel = persistence.records.find(
+    (record) => record.type === 'turn.cancel' && record.cancelledTurnInputs !== undefined,
+  );
+  expect(cancel).toBeDefined();
+  const cancelIndex = persistence.records.indexOf(cancel!);
+  const generate = vi.fn();
+  const resumed = testAgent({
+    persistence: new InMemoryAgentRecordPersistence(
+      structuredClone(persistence.records.slice(0, cancelIndex + 1)),
+    ),
+    generate,
+  });
+  await resumed.agent.resume();
+
+  const texts = resumed.agent.context.history
+    .flatMap((message) => message.content)
+    .filter((part) => part.type === 'text')
+    .map((part) => part.text)
+    .join('\n');
+  expect(texts).not.toContain('/tmp/originals/shot.png');
+  expect(texts).not.toContain('/tmp/originals/photo.jpg');
+  expect(texts).not.toContain('CANCELLED-IMAGE-PROMPT');
+  expect(texts.match(/The user interrupted the previous turn/g)).toHaveLength(1);
+  expect(generate).not.toHaveBeenCalled();
+});
+
+it('keeps the whole expansion when cancellation observes its accepted final record', async () => {
+  let ctx!: ReturnType<typeof testAgent>;
+  let cancellation: Promise<void> | undefined;
+  const persistence = new InMemoryAgentRecordPersistence([], {
+    onRecord: (record) => {
+      if (
+        cancellation === undefined &&
+        record.type === 'context.append_message' &&
+        record.turnInputPart?.index === 2
+      ) {
+        cancellation = ctx.agent.turn.cancel(0);
+      }
+    },
+  });
+  ctx = testAgent({ persistence });
+  ctx.configure();
+
+  await ctx.rpc.prompt({
+    input: [
+      { type: 'text', text: CAPTION },
+      { type: 'image_url', imageUrl: { url: IMAGE_URL } },
+      { type: 'text', text: SECOND_CAPTION },
+      { type: 'image_url', imageUrl: { url: IMAGE_URL } },
+      { type: 'text', text: 'FINAL-RECORD-IMAGE-PROMPT' },
+    ],
+  });
+  await ctx.untilTurnEnd();
+  await cancellation;
+
+  const cancelRecord = persistence.records.find((record) => record.type === 'turn.cancel');
+  expect(cancelRecord?.type === 'turn.cancel' ? cancelRecord.cancelledTurnInputs : undefined).toBeUndefined();
+  const texts = ctx.agent.context.history
+    .flatMap((message) => message.content)
+    .filter((part) => part.type === 'text')
+    .map((part) => part.text)
+    .join('\n');
+  expect(texts.match(/\/tmp\/originals\/shot\.png/g)).toHaveLength(1);
+  expect(texts.match(/\/tmp\/originals\/photo\.jpg/g)).toHaveLength(1);
+  expect(texts.match(/FINAL-RECORD-IMAGE-PROMPT/g)).toHaveLength(1);
+  await ctx.expectResumeMatches();
+});
+
+it('undo removes the hidden caption children of every removed image prompt', async () => {
+  const ctx = testAgent();
+  ctx.configure();
+  for (const [prompt, response] of [
+    ['FIRST-IMAGE-PROMPT', 'first response'],
+    ['SECOND-IMAGE-PROMPT', 'second response'],
+  ] as const) {
+    ctx.mockNextResponse({ type: 'text', text: response });
+    await ctx.rpc.prompt({
+      input: [
+        { type: 'text', text: CAPTION },
+        { type: 'image_url', imageUrl: { url: IMAGE_URL } },
+        { type: 'text', text: prompt },
+      ],
+    });
+    await ctx.untilTurnEnd();
+  }
+
+  ctx.agent.context.undo(2);
+
+  expect(ctx.agent.context.history).toEqual([]);
+  await ctx.expectResumeMatches();
+});
diff --git a/packages/agent-core/test/agent/permission.test.ts b/packages/agent-core/test/agent/permission.test.ts
index a11158652f..333f1d50dd 100644
--- a/packages/agent-core/test/agent/permission.test.ts
+++ b/packages/agent-core/test/agent/permission.test.ts
@@ -47,33 +47,33 @@ describe('Agent permission', () => {
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] permission.set_mode         { "mode": "auto", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": false, "swarmMode": false, "permission": "auto" }
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash in auto mode" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash in auto mode" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash in auto mode" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash in auto mode" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<auto-mode-enter-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "permission_mode" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 2, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "Running without asking." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf permission-output\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "Running without asking." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf permission-output", "timeout": 60 }, "description": "Running: printf permission-output", "display": { "kind": "command", "command": "printf permission-output", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "Running without asking." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf permission-output", "timeout": 60 }, "description": "Running: printf permission-output", "display": { "kind": "command", "command": "printf permission-output", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf permission-output", "timeout": 60 }, "description": "Running: printf permission-output", "display": { "kind": "command", "command": "printf permission-output", "cwd": "<cwd>", "language": "bash" } }
       [emit] tool.progress               { "turnId": 0, "toolCallId": "call_bash", "update": { "kind": "stdout", "text": "auto-output" } }
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "auto-output" } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_bash", "output": "auto-output" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 172, "maxContextTokens": 1000000, "contextUsage": 0.000172, "planMode": false, "swarmMode": false, "permission": "auto", "usage": { "byModel": { "mock-model": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 147, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999828, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 4, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "The command printed auto-output." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "The command printed auto-output." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 176, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 176, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "The command printed auto-output." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 176, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 176, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 176, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 187, "maxContextTokens": 1000000, "contextUsage": 0.000187, "planMode": false, "swarmMode": false, "permission": "auto", "usage": { "byModel": { "mock-model": { "inputOther": 323, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 323, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 323, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 0, "reason": "completed" }
@@ -107,32 +107,32 @@ describe('Agent permission', () => {
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] permission.set_mode         { "mode": "yolo", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": false, "swarmMode": false, "permission": "yolo" }
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash in yolo mode" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash in yolo mode" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash in yolo mode" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash in yolo mode" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "Running in yolo mode." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf permission-output\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "Running in yolo mode." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf permission-output", "timeout": 60 }, "description": "Running: printf permission-output", "display": { "kind": "command", "command": "printf permission-output", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "Running in yolo mode." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf permission-output", "timeout": 60 }, "description": "Running: printf permission-output", "display": { "kind": "command", "command": "printf permission-output", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf permission-output", "timeout": 60 }, "description": "Running: printf permission-output", "display": { "kind": "command", "command": "printf permission-output", "cwd": "<cwd>", "language": "bash" } }
       [emit] tool.progress               { "turnId": 0, "toolCallId": "call_bash", "update": { "kind": "stdout", "text": "yolo-output" } }
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "yolo-output" } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_bash", "output": "yolo-output" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 32, "maxContextTokens": 1000000, "contextUsage": 0.000032, "planMode": false, "swarmMode": false, "permission": "yolo", "usage": { "byModel": { "mock-model": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 7, "output": 25, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999968, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 3, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "The command printed yolo-output." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "The command printed yolo-output." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 36, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 36, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "The command printed yolo-output." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 36, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 36, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 36, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 47, "maxContextTokens": 1000000, "contextUsage": 0.000047, "planMode": false, "swarmMode": false, "permission": "yolo", "usage": { "byModel": { "mock-model": { "inputOther": 43, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 43, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 43, "output": 36, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 0, "reason": "completed" }
@@ -168,17 +168,17 @@ describe('Agent permission', () => {
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] permission.set_mode         { "mode": "manual", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 152, "maxContextTokens": 1000000, "contextUsage": 0.000152, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 145, "output": 7, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 145, "output": 7, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Back to manual" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Back to manual" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-4>", "turnId": 1, "time": "<time>" }
       [emit] turn.started                { "turnId": 1, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Back to manual" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Back to manual" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-4>", "turnId": 1 }, "time": "<time>" }
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<auto-mode-exit-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "permission_mode" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "1", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 1, "step": 1, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-5>", "turnId": "1", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 1, "step": 1, "stepId": "<uuid-5>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999848, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 5, "turnStep": "1.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 1, "delta": "Manual turn done." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "1", "step": 1, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "Manual turn done." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "1", "step": 1, "usage": { "inputOther": 217, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 1, "step": 1, "stepId": "<uuid-3>", "usage": { "inputOther": 217, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-6>", "turnId": "1", "step": 1, "stepUuid": "<uuid-5>", "part": { "type": "text", "text": "Manual turn done." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-5>", "turnId": "1", "step": 1, "usage": { "inputOther": 217, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 1, "step": 1, "stepId": "<uuid-5>", "usage": { "inputOther": 217, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 217, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 225, "maxContextTokens": 1000000, "contextUsage": 0.000225, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 362, "output": 15, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 362, "output": 15, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 217, "output": 8, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 1, "reason": "completed" }
@@ -217,16 +217,16 @@ describe('Agent permission', () => {
     ctx.mockNextResponse({ type: 'text', text: 'I will try Bash.' }, bashCall);
     await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Try to run Bash' }] });
     expect(await ctx.untilApproval(false)).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Try to run Bash" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Try to run Bash" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Try to run Bash" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Try to run Bash" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will try Bash." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf should-not-run\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will try Bash." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will try Bash." } }, "time": "<time>" }
       [emit] requestApproval             { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }
     `);
     expect(ctx.lastLlmInput()).toMatchInlineSnapshot(`
@@ -239,21 +239,21 @@ describe('Agent permission', () => {
     ctx.mockNextResponse({ type: 'text', text: 'I will not run the command.' });
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] permission.record_approval_result   { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf should-not-run", "result": { "decision": "rejected", "selectedLabel": "reject" }, "time": "<time>" }
-      [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started                   { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }
       [wire] context.append_loop_event           { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "Tool \\"Bash\\" was not run because the user rejected the approval request. Do not re-attempt the exact same call — think about why it was rejected, then adjust your approach or ask the user what they would prefer.", "isError": true } }, "time": "<time>" }
       [emit] tool.result                         { "turnId": 0, "toolCallId": "call_bash", "output": "Tool \\"Bash\\" was not run because the user rejected the approval request. Do not re-attempt the exact same call — think about why it was rejected, then adjust your approach or ask the user what they would prefer.", "isError": true }
-      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated                { "model": "mock-model", "contextTokens": 27, "maxContextTokens": 1000000, "contextUsage": 0.000027, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 5, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
       [wire] llm.request                         { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999973, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 3, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta                     { "turnId": 0, "delta": "I will not run the command." }
-      [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "I will not run the command." } }, "time": "<time>" }
-      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 93, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 93, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "I will not run the command." } }, "time": "<time>" }
+      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 93, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 93, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 93, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated                { "model": "mock-model", "contextTokens": 103, "maxContextTokens": 1000000, "contextUsage": 0.000103, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 98, "output": 32, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 98, "output": 32, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 98, "output": 32, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                          { "turnId": 0, "reason": "completed" }
diff --git a/packages/agent-core/test/agent/plan.test.ts b/packages/agent-core/test/agent/plan.test.ts
index 673e35164d..0da501264b 100644
--- a/packages/agent-core/test/agent/plan.test.ts
+++ b/packages/agent-core/test/agent/plan.test.ts
@@ -437,33 +437,33 @@ describe('plan allows safe tool flow', () => {
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": false, "swarmMode": false, "permission": "yolo" }
       [wire] plan_mode.enter             { "id": "test-plan", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": true, "swarmMode": false, "permission": "yolo" }
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Inspect without mutating files" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Inspect without mutating files" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Inspect without mutating files" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Inspect without mutating files" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<plan-mode-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "plan_mode" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 2, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will inspect safely." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf plan-safe\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will inspect safely." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf plan-safe", "timeout": 60 }, "description": "Running: printf plan-safe", "display": { "kind": "command", "command": "printf plan-safe", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will inspect safely." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf plan-safe", "timeout": 60 }, "description": "Running: printf plan-safe", "display": { "kind": "command", "command": "printf plan-safe", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf plan-safe", "timeout": 60 }, "description": "Running: printf plan-safe", "display": { "kind": "command", "command": "printf plan-safe", "cwd": "<cwd>", "language": "bash" } }
       [emit] tool.progress               { "turnId": 0, "toolCallId": "call_bash", "update": { "kind": "stdout", "text": "plan-safe" } }
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "plan-safe" } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_bash", "output": "plan-safe" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 588, "maxContextTokens": 1000000, "contextUsage": 0.000588, "planMode": true, "swarmMode": false, "permission": "yolo", "usage": { "byModel": { "mock-model": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 565, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999412, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 4, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "The safe command printed plan-safe." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "The safe command printed plan-safe." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 592, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 592, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "The safe command printed plan-safe." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 592, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 592, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 592, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 604, "maxContextTokens": 1000000, "contextUsage": 0.000604, "planMode": true, "swarmMode": false, "permission": "yolo", "usage": { "byModel": { "mock-model": { "inputOther": 1157, "output": 35, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 1157, "output": 35, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 1157, "output": 35, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 0, "reason": "completed" }
@@ -494,33 +494,33 @@ describe('plan mode Bash ordinary permission behavior', () => {
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": false, "swarmMode": false, "permission": "yolo" }
       [wire] plan_mode.enter             { "id": "test-plan", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": true, "swarmMode": false, "permission": "yolo" }
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Remove forbidden.txt" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Remove forbidden.txt" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Remove forbidden.txt" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Remove forbidden.txt" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<plan-mode-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "plan_mode" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 2, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will mutate a file." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"rm forbidden.txt\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will mutate a file." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "rm forbidden.txt", "timeout": 60 }, "description": "Running: rm forbidden.txt", "display": { "kind": "command", "command": "rm forbidden.txt", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will mutate a file." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "rm forbidden.txt", "timeout": 60 }, "description": "Running: rm forbidden.txt", "display": { "kind": "command", "command": "rm forbidden.txt", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "rm forbidden.txt", "timeout": 60 }, "description": "Running: rm forbidden.txt", "display": { "kind": "command", "command": "rm forbidden.txt", "cwd": "<cwd>", "language": "bash" } }
       [emit] tool.progress               { "turnId": 0, "toolCallId": "call_bash", "update": { "kind": "stdout", "text": "removed" } }
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "removed" } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_bash", "output": "removed" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 585, "maxContextTokens": 1000000, "contextUsage": 0.000585, "planMode": true, "swarmMode": false, "permission": "yolo", "usage": { "byModel": { "mock-model": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 562, "output": 23, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999415, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 4, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "The command completed." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "The command completed." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 588, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 588, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "The command completed." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 588, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 588, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 588, "output": 9, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 597, "maxContextTokens": 1000000, "contextUsage": 0.000597, "planMode": true, "swarmMode": false, "permission": "yolo", "usage": { "byModel": { "mock-model": { "inputOther": 1150, "output": 32, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 1150, "output": 32, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 1150, "output": 32, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 0, "reason": "completed" }
diff --git a/packages/agent-core/test/agent/records/index.test.ts b/packages/agent-core/test/agent/records/index.test.ts
index 0f43deeb2e..5e09bb7ccb 100644
--- a/packages/agent-core/test/agent/records/index.test.ts
+++ b/packages/agent-core/test/agent/records/index.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
 import { buildReplay } from '../../../src';
 import {
@@ -9,6 +9,13 @@ import {
 import type { ContextMessage } from '../../../src/agent/context';
 import { testAgent } from '../harness/agent';
 
+const generateMock = vi.hoisted(() => vi.fn());
+
+vi.mock('@moonshot-ai/kosong', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@moonshot-ai/kosong')>();
+  return { ...actual, generate: generateMock };
+});
+
 describe('AgentRecords persistence metadata', () => {
   it('writes metadata before the first persisted record', async () => {
     const persistence = new InMemoryAgentRecordPersistence();
@@ -370,6 +377,35 @@ describe('AgentRecords persistence metadata', () => {
 });
 
 describe('agent replay range build', () => {
+  it('projects unconsumed prompt and steer admissions without resuming work', async () => {
+    generateMock.mockRejectedValue(new Error('projection must not generate'));
+    const persistence = new InMemoryAgentRecordPersistence([
+      { type: 'metadata', protocol_version: AGENT_WIRE_PROTOCOL_VERSION, created_at: 1 },
+      {
+        type: 'turn.prompt',
+        admissionId: 'prompt-admission',
+        turnId: 1,
+        input: [{ type: 'text', text: 'pending prompt' }],
+        origin: { kind: 'user' },
+      },
+      {
+        type: 'turn.steer',
+        admissionId: 'steer-admission',
+        turnId: 1,
+        ownerTurnId: 1,
+        input: [{ type: 'text', text: 'pending steer' }],
+        origin: { kind: 'user' },
+      },
+    ]);
+    const originalRecords = [...persistence.records];
+
+    await expect(buildReplay(persistence)).resolves.toEqual([]);
+    await new Promise<void>((resolve) => setTimeout(resolve, 0));
+
+    expect(generateMock).not.toHaveBeenCalled();
+    expect(persistence.records).toEqual(originalRecords);
+  });
+
   it('returns the complete replay when no range is requested', async () => {
     const firstMessage = userMessage('first');
     const afterClearMessage = userMessage('after-clear');
diff --git a/packages/agent-core/test/agent/records/persistence.test.ts b/packages/agent-core/test/agent/records/persistence.test.ts
index e3b5bb699d..7803cbc258 100644
--- a/packages/agent-core/test/agent/records/persistence.test.ts
+++ b/packages/agent-core/test/agent/records/persistence.test.ts
@@ -7,6 +7,7 @@ import { afterEach, describe, expect, it } from 'vitest';
 
 import {
   AGENT_WIRE_PROTOCOL_VERSION,
+  agentRecordAppendAccepted,
   BlobStore,
   FileSystemAgentRecordPersistence,
   InMemoryAgentRecordPersistence,
@@ -200,13 +201,18 @@ describe('FileSystemAgentRecordPersistence', () => {
     });
     await expect(persistence.flush()).rejects.toBeInstanceOf(Error);
 
-    expect(() => {
+    let appendError: unknown;
+    try {
       persistence.append({
         type: 'turn.prompt',
         input: [{ type: 'text', text: 'second' }],
         origin: { kind: 'user' },
       });
-    }).toThrow();
+    } catch (error) {
+      appendError = error;
+    }
+    expect(appendError).toBeInstanceOf(Error);
+    expect(agentRecordAppendAccepted(appendError)).toBe(false);
     expect(() => {
       persistence.rewrite([
         {
@@ -280,4 +286,28 @@ describe('InMemoryAgentRecordPersistence', () => {
     ]);
     expect(persistence.records).toEqual(records);
   });
+
+  it('marks an observer failure as post-accept without changing its identity', () => {
+    const observerError = new Error('observer failed after append');
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: () => {
+        throw observerError;
+      },
+    });
+    let thrown: unknown;
+
+    try {
+      persistence.append({
+        type: 'turn.prompt',
+        input: [{ type: 'text', text: 'accepted' }],
+        origin: { kind: 'user' },
+      });
+    } catch (error) {
+      thrown = error;
+    }
+
+    expect(thrown).toBe(observerError);
+    expect(agentRecordAppendAccepted(thrown)).toBe(true);
+    expect(persistence.records).toHaveLength(1);
+  });
 });
diff --git a/packages/agent-core/test/agent/tool.test.ts b/packages/agent-core/test/agent/tool.test.ts
index 13ad93cb7d..72f52a915f 100644
--- a/packages/agent-core/test/agent/tool.test.ts
+++ b/packages/agent-core/test/agent/tool.test.ts
@@ -339,18 +339,18 @@ describe('Agent tools', () => {
       [wire] permission.set_mode         { "mode": "auto", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 0, "maxContextTokens": 1000000, "contextUsage": 0, "planMode": false, "swarmMode": false, "permission": "auto" }
       [wire] tools.register_user_tool    { "name": "Lookup", "description": "Look up a short test value.", "parameters": { "type": "object", "properties": { "query": { "type": "string" } }, "required": [ "query" ], "additionalProperties": false }, "time": "<time>" }
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Look up moon" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Look up moon" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Look up moon" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Look up moon" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
       [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<auto-mode-enter-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "permission_mode" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "3bfeb22e61431247933e79f6ab94e7ca14a127f899bc87e7bbd22594ba9cdb66", "tools": [ { "name": "Lookup", "description": "Look up a short test value.", "parameters": { "type": "object", "properties": { "query": { "type": "string" } }, "required": [ "query" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "3bfeb22e61431247933e79f6ab94e7ca14a127f899bc87e7bbd22594ba9cdb66", "messageCount": 2, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will look it up." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_lookup", "name": "Lookup", "argumentsPart": "{\\"query\\":\\"moon\\"}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will look it up." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_lookup", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_lookup", "name": "Lookup", "args": { "query": "moon" } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will look it up." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_lookup", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_lookup", "name": "Lookup", "args": { "query": "moon" } }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_lookup", "name": "Lookup", "args": { "query": "moon" } }
       [emit] toolCall                    { "turnId": 0, "toolCallId": "call_lookup", "args": { "query": "moon" } }
     `);
@@ -366,17 +366,17 @@ describe('Agent tools', () => {
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_lookup", "toolCallId": "call_lookup", "result": { "output": "moon-result" } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_lookup", "output": "moon-result" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 160, "maxContextTokens": 1000000, "contextUsage": 0.00016, "planMode": false, "swarmMode": false, "permission": "auto", "usage": { "byModel": { "mock-model": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 144, "output": 16, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-4>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 2, "stepId": "<uuid-4>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999840, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "3bfeb22e61431247933e79f6ab94e7ca14a127f899bc87e7bbd22594ba9cdb66", "messageCount": 4, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "The lookup result is moon-result." }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "The lookup result is moon-result." } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 164, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 164, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "stepUuid": "<uuid-4>", "part": { "type": "text", "text": "The lookup result is moon-result." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.end", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "usage": { "inputOther": 164, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed         { "turnId": 0, "step": 2, "stepId": "<uuid-4>", "usage": { "inputOther": 164, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                { "model": "mock-model", "usage": { "inputOther": 164, "output": 12, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated        { "model": "mock-model", "contextTokens": 176, "maxContextTokens": 1000000, "contextUsage": 0.000176, "planMode": false, "swarmMode": false, "permission": "auto", "usage": { "byModel": { "mock-model": { "inputOther": 308, "output": 28, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 308, "output": 28, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 308, "output": 28, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                  { "turnId": 0, "reason": "completed" }
@@ -394,17 +394,17 @@ describe('Agent tools', () => {
 
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] tools.unregister_user_tool   { "name": "Lookup", "time": "<time>" }
-      [wire] turn.prompt                  { "input": [ { "type": "text", "text": "Can you still use Lookup?" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                  { "input": [ { "type": "text", "text": "Can you still use Lookup?" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-6>", "turnId": 1, "time": "<time>" }
       [emit] turn.started                 { "turnId": 1, "origin": { "kind": "user" } }
-      [wire] context.append_message       { "message": { "role": "user", "content": [ { "type": "text", "text": "Can you still use Lookup?" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event    { "event": { "type": "step.begin", "uuid": "<uuid-5>", "turnId": "1", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started            { "turnId": 1, "step": 1, "stepId": "<uuid-5>" }
+      [wire] context.append_message       { "message": { "role": "user", "content": [ { "type": "text", "text": "Can you still use Lookup?" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-6>", "turnId": 1 }, "time": "<time>" }
+      [wire] context.append_loop_event    { "event": { "type": "step.begin", "uuid": "<uuid-7>", "turnId": "1", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started            { "turnId": 1, "step": 1, "stepId": "<uuid-7>" }
       [wire] llm.tools_snapshot           { "hash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "tools": [], "time": "<time>" }
       [wire] llm.request                  { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999824, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 6, "turnStep": "1.1", "time": "<time>" }
       [emit] assistant.delta              { "turnId": 1, "delta": "No lookup tool is available." }
-      [wire] context.append_loop_event    { "event": { "type": "content.part", "uuid": "<uuid-6>", "turnId": "1", "step": 1, "stepUuid": "<uuid-5>", "part": { "type": "text", "text": "No lookup tool is available." } }, "time": "<time>" }
-      [wire] context.append_loop_event    { "event": { "type": "step.end", "uuid": "<uuid-5>", "turnId": "1", "step": 1, "usage": { "inputOther": 184, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-3" }, "time": "<time>" }
-      [emit] turn.step.completed          { "turnId": 1, "step": 1, "stepId": "<uuid-5>", "usage": { "inputOther": 184, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event    { "event": { "type": "content.part", "uuid": "<uuid-8>", "turnId": "1", "step": 1, "stepUuid": "<uuid-7>", "part": { "type": "text", "text": "No lookup tool is available." } }, "time": "<time>" }
+      [wire] context.append_loop_event    { "event": { "type": "step.end", "uuid": "<uuid-7>", "turnId": "1", "step": 1, "usage": { "inputOther": 184, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-3" }, "time": "<time>" }
+      [emit] turn.step.completed          { "turnId": 1, "step": 1, "stepId": "<uuid-7>", "usage": { "inputOther": 184, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                 { "model": "mock-model", "usage": { "inputOther": 184, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated         { "model": "mock-model", "contextTokens": 194, "maxContextTokens": 1000000, "contextUsage": 0.000194, "planMode": false, "swarmMode": false, "permission": "auto", "usage": { "byModel": { "mock-model": { "inputOther": 492, "output": 38, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 492, "output": 38, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 184, "output": 10, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                   { "turnId": 1, "reason": "completed" }
diff --git a/packages/agent-core/test/agent/turn.test.ts b/packages/agent-core/test/agent/turn.test.ts
index 485986e3a1..a1e95d4314 100644
--- a/packages/agent-core/test/agent/turn.test.ts
+++ b/packages/agent-core/test/agent/turn.test.ts
@@ -19,26 +19,35 @@ import {
   APIStatusError,
   APITimeoutError,
   ChatProviderError,
+  generate as generateWithProvider,
   type ChatProvider,
   type Message,
   type ModelCapability,
+  type StreamedMessage,
+  type StreamedMessagePart,
   type ToolCall,
 } from '@moonshot-ai/kosong';
 import { describe, expect, it, vi } from 'vitest';
 
 import { HookEngine } from '../../src/session/hooks';
 import { abortError } from '../../src/utils/abort';
-import type { AgentOptions, AgentRecord, AgentRecordPersistence } from '../../src/agent';
+import { Agent, type AgentOptions, type AgentRecord, type AgentRecordPersistence } from '../../src/agent';
 import { ProcessBackgroundTask } from '../../src/agent/background';
-import { InMemoryAgentRecordPersistence } from '../../src/agent/records';
+import {
+  InMemoryAgentRecordPersistence,
+  markAgentRecordAppendError,
+} from '../../src/agent/records';
 import { ErrorCodes, KimiError } from '../../src/errors';
+import type { SDKAgentRPC } from '../../src/rpc';
 import type { Logger, LogPayload } from '../../src/logging';
 import type {
   QueuedSubagentRunResult,
   QueuedSubagentTask,
   SessionSubagentHost,
 } from '../../src/session/subagent-host';
+import { buildImageCompressionCaption } from '../../src/tools/support/image-compress';
 import { recordingTelemetry, type TelemetryRecord } from '../fixtures/telemetry';
+import { testKaos } from '../fixtures/test-kaos';
 import { createFakeKaos } from '../tools/fixtures/fake-kaos';
 import {
   createCommandKaos,
@@ -73,7 +82,84 @@ function captureLogs(): { logger: Logger; entries: CapturedLogEntry[] } {
   return { logger, entries };
 }
 
+function throwingWarnLogger(): Logger {
+  const logger: Logger = {
+    error: () => undefined,
+    warn: () => {
+      throw new Error('diagnostic sink failed');
+    },
+    info: () => undefined,
+    debug: () => undefined,
+    createChild: () => logger,
+  };
+  return logger;
+}
+
+function throwingErrorLogger(): Logger {
+  const logger: Logger = {
+    error: () => {
+      throw new Error('diagnostic sink failed');
+    },
+    warn: () => undefined,
+    info: () => undefined,
+    debug: () => undefined,
+    createChild: () => logger,
+  };
+  return logger;
+}
+
 describe('Agent turn flow', () => {
+  it('isolates synchronous and asynchronous event transport failures', async () => {
+    const { logger, entries } = captureLogs();
+    let deliveryCount = 0;
+    const agent = new Agent({
+      type: 'sub',
+      kaos: testKaos,
+      log: logger,
+      rpc: {
+        emitEvent: () => {
+          deliveryCount += 1;
+          if (deliveryCount === 1) throw new Error('synchronous observer failure');
+          return Promise.reject(new Error('asynchronous observer failure'));
+        },
+      } as unknown as SDKAgentRPC,
+    });
+
+    try {
+      expect(() => {
+        agent.emitEvent({ type: 'warning', message: 'first event' });
+      }).not.toThrow();
+      expect(() => {
+        agent.emitEvent({ type: 'warning', message: 'second event' });
+      }).not.toThrow();
+      await vi.waitFor(() => {
+        expect(entries.filter((entry) => entry.message === 'agent event delivery failed')).toHaveLength(2);
+      });
+
+      const brokenLogger = {
+        ...logger,
+        warn: () => {
+          throw new Error('diagnostic sink failed');
+        },
+      } satisfies Logger;
+      const agentWithBrokenLogger = new Agent({
+        type: 'sub',
+        kaos: testKaos,
+        log: brokenLogger,
+        rpc: {
+          emitEvent: () => {
+            throw new Error('observer failed with broken logger');
+          },
+        } as unknown as SDKAgentRPC,
+      });
+      expect(() => {
+        agentWithBrokenLogger.emitEvent({ type: 'warning', message: 'isolated event' });
+      }).not.toThrow();
+    } finally {
+      await agent.cron?.stop();
+    }
+  });
+
   it('degrades older history media and retries when the provider rejects the request body as too large', async () => {
     let attempts = 0;
     const histories: Message[][] = [];
@@ -569,7 +655,7 @@ describe('Agent turn flow', () => {
     // A programmatic abort (e.g. a subagent deadline timeout) carries a plain
     // AbortError as its reason, not a UserCancellationError, so telemetry must
     // not report it as a user cancellation.
-    ctx.agent.turn.cancel(0, abortError());
+    void ctx.agent.turn.cancel(0, abortError());
     await ctx.untilTurnEnd();
 
     const interrupted = records.find((candidate) => candidate.event === 'turn_interrupted');
@@ -831,14 +917,16 @@ describe('Agent turn flow', () => {
     await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Trigger generate failure' }] });
 
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Trigger generate failure" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Trigger generate failure" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Trigger generate failure" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Trigger generate failure" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "tools": [], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
       [emit] turn.step.interrupted       { "turnId": 0, "step": 1, "reason": "error", "message": "Unexpected generate call #1" }
+      [wire] turn.outcome                { "outcomeId": "<uuid-3>", "turnId": 0, "content": "The previous turn ended before producing a final response.\\n\\nError: Unexpected generate call #1\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.", "time": "<time>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<system-reminder>\\nThe previous turn ended before producing a final response.\\n\\nError: Unexpected generate call #1\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.\\n</system-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "turn_outcome" } }, "materializedTurnOutcomeId": "<uuid-3>", "time": "<time>" }
       [emit] turn.ended                  { "turnId": 0, "reason": "failed", "error": { "code": "internal", "message": "Unexpected generate call #1", "name": "Error", "retryable": false, "details": { "turnId": 0 } } }
     `);
     expect(ctx.newEvents()).toMatchInlineSnapshot(
@@ -847,6 +935,476 @@ describe('Agent turn flow', () => {
     await ctx.expectResumeMatches();
   });
 
+  it('preserves the failed-turn boundary when the user follows up after a terminal provider error', async () => {
+    const histories: Message[][] = [];
+    let calls = 0;
+    const generate: GenerateFn = async (_provider, _system, _tools, history) => {
+      histories.push(structuredClone(history));
+      calls += 1;
+      if (calls === 1) {
+        throw new APIStatusError(
+          500,
+          '500 request req-example failed at http://internal-cache.example.test:26677',
+          'req-example-500',
+        );
+      }
+      return textResult('Continued.');
+    };
+    const ctx = testAgent({ generate, ...singleAttemptAgentOptions() });
+    ctx.configure();
+
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'Would optimization 2 increase memory usage?' }],
+    });
+    await ctx.untilTurnEnd();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await ctx.untilTurnEnd();
+
+    expect(histories[1]).toEqual([
+      {
+        role: 'user',
+        content: [{ type: 'text', text: 'Would optimization 2 increase memory usage?' }],
+        toolCalls: [],
+      },
+      {
+        role: 'user',
+        content: [
+          {
+            type: 'text',
+            text: [
+              '<system-reminder>',
+              'The previous turn ended before producing a final response.',
+              '',
+              'Error: API request failed with HTTP 500.',
+              '',
+              'The preceding user request may still be unfinished. Treat the next user message as a follow-up.',
+              '</system-reminder>',
+            ].join('\n'),
+          },
+        ],
+        toolCalls: [],
+      },
+      {
+        role: 'user',
+        content: [{ type: 'text', text: 'Continue.' }],
+        toolCalls: [],
+      },
+    ]);
+    const followUpContext = JSON.stringify(histories[1]);
+    expect(followUpContext).not.toContain('req-example');
+    expect(followUpContext).not.toContain('internal-cache.example.test');
+    await ctx.expectResumeMatches();
+  });
+
+  it('places an admitted steer before the failure reminder and later follow-up', async () => {
+    const providerStarted = createControlledPromise<void>();
+    const failProvider = createControlledPromise<never>();
+    const histories: Message[][] = [];
+    let calls = 0;
+    const generate: GenerateFn = async (_provider, _system, _tools, history) => {
+      histories.push(structuredClone(history));
+      calls += 1;
+      if (calls === 1) {
+        providerStarted.resolve();
+        return failProvider;
+      }
+      return textResult('Follow-up completed.');
+    };
+    const ctx = testAgent({ generate, ...singleAttemptAgentOptions() });
+    ctx.configure();
+
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'FAILURE-OWNER-A' }],
+      promptId: 'prompt-failure-owner-a',
+    });
+    await providerStarted;
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'FAILURE-STEER-B' }],
+      expectedPromptId: 'prompt-failure-owner-a',
+      requireActive: true,
+    });
+    failProvider.reject(new APIStatusError(500, 'provider failed', 'req-failure-owner'));
+    await ctx.untilTurnEnd();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'FAILURE-FOLLOWUP-C' }] });
+    await ctx.untilTurnEnd();
+
+    const followupText = histories[1]!
+      .flatMap((message) => message.content)
+      .filter((part) => part.type === 'text')
+      .map((part) => part.text)
+      .join('\n');
+    const steerIndex = followupText.indexOf('FAILURE-STEER-B');
+    const reminderIndex = followupText.indexOf('The previous turn ended');
+    const followupIndex = followupText.indexOf('FAILURE-FOLLOWUP-C');
+    expect(steerIndex).toBeGreaterThanOrEqual(0);
+    expect(steerIndex).toBeLessThan(reminderIndex);
+    expect(reminderIndex).toBeLessThan(followupIndex);
+  });
+
+  it('records a model-visible reminder when the user cancels an active turn', async () => {
+    const ctx = testAgent({ generate: abortableGenerate });
+    ctx.configure();
+    const stepStarted = ctx.once('turn.step.started');
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Wait for cancellation.' }] });
+    await stepStarted;
+    await ctx.rpc.cancel({ turnId: 0 });
+    await ctx.untilTurnEnd();
+
+    expect(ctx.agent.context.history.at(-1)).toMatchObject({
+      role: 'user',
+      content: [
+        {
+          type: 'text',
+          text: [
+            '<system-reminder>',
+            'The user interrupted the previous turn before it finished.',
+            '',
+            'Some operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.',
+            '</system-reminder>',
+          ].join('\n'),
+        },
+      ],
+      origin: { kind: 'injection', variant: 'turn_outcome' },
+    });
+    await ctx.expectResumeMatches();
+  });
+
+  it('returns from cancel with a reminder when provider.generate ignores abort', async () => {
+    const providerStarted = createControlledPromise<void>();
+    const provider: ChatProvider = {
+      name: 'uncooperative',
+      modelName: 'mock-model',
+      thinkingEffort: null,
+      generate: () => {
+        providerStarted.resolve();
+        return new Promise<StreamedMessage>(() => {});
+      },
+      withThinking() {
+        return this;
+      },
+    };
+    const generate: GenerateFn = (
+      _configuredProvider,
+      systemPrompt,
+      tools,
+      history,
+      callbacks,
+      options,
+    ) => {
+      return generateWithProvider(
+        provider,
+        systemPrompt,
+        tools,
+        history,
+        callbacks,
+        options,
+      );
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Wait for cancellation.' }] });
+    await providerStarted;
+    await ctx.rpc.cancel({ turnId: 0 });
+
+    expect(ctx.agent.context.history.at(-1)).toMatchObject({
+      role: 'user',
+      content: [
+        {
+          type: 'text',
+          text: expect.stringContaining('The user interrupted the previous turn'),
+        },
+      ],
+      origin: { kind: 'injection', variant: 'turn_outcome' },
+    });
+  });
+
+  it('cancels the same active worker after a goal advances to a continuation turn', async () => {
+    const continuationStarted = createControlledPromise<void>();
+    let callCount = 0;
+    let continuationSignalAborted = false;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      callCount += 1;
+      if (callCount === 1) return textResult('Finished the first slice.');
+
+      continuationStarted.resolve();
+      return new Promise((_resolve, reject) => {
+        const onAbort = (): void => {
+          continuationSignalAborted = true;
+          reject(options?.signal?.reason ?? abortError());
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure();
+    await ctx.agent.goal.createGoal({ objective: 'Complete several slices' });
+
+    const promptDispatch = ctx.rpc.prompt({ input: [{ type: 'text', text: 'Start the goal.' }] });
+    const workerSettlement = ctx.agent.turn.waitForCurrentTurn();
+    const controller = new AbortController();
+    const signalledWait = ctx.agent.turn.waitForCurrentTurn(controller.signal).then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await promptDispatch;
+    await continuationStarted;
+    expect(ctx.agent.turn.currentId).toBe(1);
+
+    controller.abort(abortError('Caller stopped waiting'));
+    const abortedCurrentContinuation = continuationSignalAborted;
+    if (!abortedCurrentContinuation) {
+      void ctx.agent.turn.cancel(undefined, abortError('Test cleanup'));
+    }
+
+    const waitResult = await signalledWait;
+    expect(waitResult.status).toBe('rejected');
+    if (waitResult.status === 'rejected') {
+      expect(waitResult.error).toMatchObject({ name: 'AbortError' });
+    }
+    await expect(workerSettlement).resolves.toMatchObject({
+      event: { type: 'turn.ended', turnId: 1, reason: 'cancelled' },
+    });
+    expect(abortedCurrentContinuation).toBe(true);
+  });
+
+  it('accepts an earlier turn id owned by the active goal worker', async () => {
+    const continuationStarted = createControlledPromise<void>();
+    const goalPauseStarted = createControlledPromise<void>();
+    const releaseGoalPause = createControlledPromise<void>();
+    let callCount = 0;
+    let continuationAborted = false;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      callCount += 1;
+      if (callCount === 1) return textResult('Finished the first slice.');
+
+      continuationStarted.resolve();
+      return new Promise((_resolve, reject) => {
+        const onAbort = (): void => {
+          continuationAborted = true;
+          reject(options?.signal?.reason ?? abortError());
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure();
+    await ctx.agent.goal.createGoal({ objective: 'Complete several slices' });
+    vi.spyOn(ctx.agent.goal, 'pauseOnInterrupt').mockImplementation(async () => {
+      goalPauseStarted.resolve();
+      await releaseGoalPause;
+      return null;
+    });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Start the goal.' }] });
+    const workerSettlement = ctx.agent.turn.waitForCurrentTurn();
+    await continuationStarted;
+    expect(ctx.agent.turn.currentId).toBe(1);
+
+    let cancelResolved = false;
+    const cancelSettlement = ctx.rpc.cancel({ turnId: 0 }).then(() => {
+      cancelResolved = true;
+    });
+    await goalPauseStarted;
+    await Promise.resolve();
+
+    expect(cancelResolved).toBe(false);
+    releaseGoalPause.resolve();
+    await cancelSettlement;
+
+    await expect(workerSettlement).resolves.toMatchObject({
+      event: { type: 'turn.ended', turnId: 1, reason: 'cancelled' },
+    });
+    expect(continuationAborted).toBe(true);
+  });
+
+  it('does not let an earlier worker turn id cancel a replacement worker', async () => {
+    const firstStarted = createControlledPromise<void>();
+    const releaseFirst = createControlledPromise<void>();
+    const replacementStarted = createControlledPromise<void>();
+    let callCount = 0;
+    let replacementAborted = false;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      callCount += 1;
+      if (callCount === 1) {
+        firstStarted.resolve();
+        await releaseFirst;
+        return textResult('First worker finished.');
+      }
+
+      replacementStarted.resolve();
+      return new Promise((_resolve, reject) => {
+        const onAbort = (): void => {
+          replacementAborted = true;
+          reject(options?.signal?.reason ?? abortError());
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Run the first worker.' }] });
+    const firstSettlement = ctx.agent.turn.waitForCurrentTurn();
+    await firstStarted;
+    releaseFirst.resolve();
+    await firstSettlement;
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Run its replacement.' }] });
+    const replacementSettlement = ctx.agent.turn.waitForCurrentTurn();
+    await replacementStarted;
+    expect(ctx.agent.turn.currentId).toBe(1);
+
+    await ctx.rpc.cancel({ turnId: 0 });
+
+    expect(replacementAborted).toBe(false);
+    void ctx.agent.turn.cancel(1, abortError('Test cleanup'));
+    await expect(replacementSettlement).resolves.toMatchObject({
+      event: { type: 'turn.ended', turnId: 1, reason: 'cancelled' },
+    });
+  });
+
+  it('excludes a late iterator result from the follow-up context after cancel resolves', async () => {
+    const histories: Message[][] = [];
+    const firstNextStarted = createControlledPromise<void>();
+    const firstNext = createControlledPromise<IteratorResult<StreamedMessagePart>>();
+    const secondNextStarted = createControlledPromise<void>();
+    const secondNext = createControlledPromise<IteratorResult<StreamedMessagePart>>();
+    const firstIterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        firstNextStarted.resolve();
+        return firstNext;
+      },
+      // Cleanup is intentionally uncooperative too: cancel must not await it.
+      return: vi.fn(() => new Promise<IteratorResult<StreamedMessagePart>>(() => {})),
+    };
+    let secondIteration = 0;
+    const secondIterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        secondIteration += 1;
+        if (secondIteration === 1) {
+          secondNextStarted.resolve();
+          return secondNext;
+        }
+        return Promise.resolve({ done: true, value: undefined });
+      },
+    };
+    let calls = 0;
+    const provider: ChatProvider = {
+      name: 'late-stream',
+      modelName: 'mock-model',
+      thinkingEffort: null,
+      generate: async (_systemPrompt, _tools, history) => {
+        histories.push(structuredClone(history));
+        calls += 1;
+        return streamFromIterator(calls === 1 ? firstIterator : secondIterator);
+      },
+      withThinking() {
+        return this;
+      },
+    };
+    const generate: GenerateFn = (
+      _configuredProvider,
+      systemPrompt,
+      tools,
+      history,
+      callbacks,
+      options,
+    ) => {
+      return generateWithProvider(provider, systemPrompt, tools, history, callbacks, options);
+    };
+    const ctx = testAgent({ generate });
+    ctx.configure();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Start work, then wait.' }] });
+    await firstNextStarted;
+    await ctx.rpc.cancel({});
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Continue.' }] });
+    await secondNextStarted;
+    const followUpEnded = ctx.once('turn.ended');
+
+    firstNext.resolve({ done: false, value: { type: 'text', text: 'late output' } });
+    await firstNext;
+    secondNext.resolve({ done: false, value: { type: 'text', text: 'Continued.' } });
+    await followUpEnded;
+
+    expect(histories[1]).toEqual([
+      {
+        role: 'user',
+        content: [{ type: 'text', text: 'Start work, then wait.' }],
+        toolCalls: [],
+      },
+      {
+        role: 'user',
+        content: [
+          {
+            type: 'text',
+            text: [
+              '<system-reminder>',
+              'The user interrupted the previous turn before it finished.',
+              '',
+              'Some operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.',
+              '</system-reminder>',
+            ].join('\n'),
+          },
+        ],
+        toolCalls: [],
+      },
+      {
+        role: 'user',
+        content: [{ type: 'text', text: 'Continue.' }],
+        toolCalls: [],
+      },
+    ]);
+    await ctx.expectResumeMatches();
+  });
+
+  it('still ends a cancelled turn after a diagnostic double fault', async () => {
+    const ctx = testAgent({ generate: abortableGenerate, log: throwingWarnLogger() });
+    ctx.configure();
+    const stepStarted = ctx.once('turn.step.started');
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Wait for cancellation.' }] });
+    await stepStarted;
+    const cancellation = ctx.agent.turn.cancel(0, cancellationReasonWithHostileMessage());
+
+    expect(await ctx.untilTurnEnd()).toContainEqual(
+      expect.objectContaining({
+        type: '[rpc]',
+        event: 'turn.ended',
+        args: expect.objectContaining({ turnId: 0, reason: 'cancelled' }),
+      }),
+    );
+    await cancellation;
+    await ctx.expectResumeMatches();
+  });
+
   it('keeps manual swarm mode active after a turn completes normally', async () => {
     const ctx = testAgent();
     ctx.configure();
@@ -1081,9 +1639,11 @@ describe('Agent turn flow', () => {
 
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] metadata                 { "protocol_version": "<protocol-version>", "created_at": "<time>" }
-      [wire] turn.prompt              { "input": [ { "type": "text", "text": "Hello without login" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt              { "input": [ { "type": "text", "text": "Hello without login" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started             { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message   { "message": { "role": "user", "content": [ { "type": "text", "text": "Hello without login" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
+      [wire] context.append_message   { "message": { "role": "user", "content": [ { "type": "text", "text": "Hello without login" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] turn.outcome             { "outcomeId": "<uuid-2>", "turnId": 0, "content": "The previous turn ended before producing a final response.\\n\\nError: No model is configured.\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.", "time": "<time>" }
+      [wire] context.append_message   { "message": { "role": "user", "content": [ { "type": "text", "text": "<system-reminder>\\nThe previous turn ended before producing a final response.\\n\\nError: No model is configured.\\n\\nThe preceding user request may still be unfinished. Treat the next user message as a follow-up.\\n</system-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "turn_outcome" } }, "materializedTurnOutcomeId": "<uuid-2>", "time": "<time>" }
       [emit] turn.ended               { "turnId": 0, "reason": "failed", "error": { "code": "model.not_configured", "message": "LLM not set, send \\"/login\\" to login", "name": "KimiError", "details": { "turnId": 0 }, "retryable": false } }
     `);
     expect(ctx.newEvents()).toMatchInlineSnapshot(
@@ -1283,30 +1843,75 @@ describe('Agent turn flow', () => {
     `);
   });
 
-  it('cancels while waiting for a UserPromptSubmit hook without appending stale output', async () => {
+  it('orders an admitted steer before a follow-up when UserPromptSubmit later blocks', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'kimi-user-prompt-steer-'));
+    const marker = join(dir, 'started');
+    const script = [
+      "const fs=require('node:fs');",
+      `if (fs.existsSync(${JSON.stringify(marker)})) process.exit(0);`,
+      `fs.writeFileSync(${JSON.stringify(marker)}, 'started');`,
+      "setTimeout(() => { process.stderr.write('blocked by hook'); process.exit(2); }, 150);",
+    ].join('');
     const hookEngine = new HookEngine([
       {
         event: 'UserPromptSubmit',
-        command: 'node -e "setTimeout(() => process.stdout.write(\\"late hook\\"), 250)"',
+        command: `node -e ${JSON.stringify(script)}`,
         timeout: 5,
       },
     ]);
     const ctx = testAgent({ hookEngine });
     ctx.configure();
 
-    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'hook will sleep' }] });
-    await ctx.rpc.cancel({ turnId: 0 });
-    const events = await ctx.untilTurnEnd();
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'HOOK-OWNER-A' }],
+      promptId: 'prompt-hook-owner-a',
+    });
+    await waitForFile(marker);
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'HOOK-STEER-B' }],
+      expectedPromptId: 'prompt-hook-owner-a',
+      requireActive: true,
+    });
+    await ctx.untilTurnEnd();
 
-    expect(events).toContainEqual(
-      expect.objectContaining({
-        event: 'turn.ended',
-        args: expect.objectContaining({ reason: 'cancelled' }),
-      }),
-    );
-    expect(events).not.toContainEqual(
-      expect.objectContaining({
-        event: 'assistant.delta',
+    ctx.mockNextResponse({ type: 'text', text: 'Follow-up handled.' });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'HOOK-FOLLOWUP-C' }] });
+    await ctx.untilTurnEnd();
+
+    const followupText = ctx.llmCalls[0]!.history
+      .flatMap((message) => message.content)
+      .filter((part) => part.type === 'text')
+      .map((part) => part.text)
+      .join('\n');
+    expect(followupText.indexOf('HOOK-STEER-B')).toBeLessThan(
+      followupText.indexOf('HOOK-FOLLOWUP-C'),
+    );
+  });
+
+  it('cancels while waiting for a UserPromptSubmit hook without appending stale output', async () => {
+    const hookEngine = new HookEngine([
+      {
+        event: 'UserPromptSubmit',
+        command: 'node -e "setTimeout(() => process.stdout.write(\\"late hook\\"), 250)"',
+        timeout: 5,
+      },
+    ]);
+    const ctx = testAgent({ hookEngine });
+    ctx.configure();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'hook will sleep' }] });
+    await ctx.rpc.cancel({ turnId: 0 });
+    const events = await ctx.untilTurnEnd();
+
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'cancelled' }),
+      }),
+    );
+    expect(events).not.toContainEqual(
+      expect.objectContaining({
+        event: 'assistant.delta',
         args: expect.objectContaining({ delta: expect.stringContaining('late hook') }),
       }),
     );
@@ -1317,9 +1922,60 @@ describe('Agent turn flow', () => {
         toolCalls: [],
         origin: { kind: 'user' },
       },
+      {
+        role: 'user',
+        content: [
+          {
+            type: 'text',
+            text: [
+              '<system-reminder>',
+              'The user interrupted the previous turn before it finished.',
+              '',
+              'Some operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.',
+              '</system-reminder>',
+            ].join('\n'),
+          },
+        ],
+        toolCalls: [],
+        origin: { kind: 'injection', variant: 'turn_outcome' },
+      },
     ]);
   });
 
+  it('keeps cancellation authoritative when a pending prompt hook rejects with a plain error', async () => {
+    const hookStarted = createControlledPromise<void>();
+    const hookResult = createControlledPromise<
+      Awaited<ReturnType<HookEngine['trigger']>>
+    >();
+    const hookEngine = new HookEngine();
+    vi.spyOn(hookEngine, 'trigger').mockImplementationOnce(() => {
+      hookStarted.resolve();
+      return hookResult;
+    });
+    const ctx = testAgent({ hookEngine });
+    ctx.configure();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'hook rejects after cancel' }] });
+    await hookStarted;
+    const ended = ctx.untilTurnEnd();
+    const cancellation = ctx.rpc.cancel({ turnId: 0 });
+    hookResult.reject(new Error('hook cleanup failed after abort'));
+
+    await cancellation;
+    expect(await ended).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'cancelled' }),
+      }),
+    );
+    expect(ctx.allEvents).not.toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'failed' }),
+      }),
+    );
+  });
+
   it('uses a Stop hook block reason as a one-shot turn continuation', async () => {
     const hookEngine = new HookEngine([
       {
@@ -1363,6 +2019,46 @@ describe('Agent turn flow', () => {
     expect(JSON.stringify(ctx.agent.context.data().history)).toContain('Second answer.');
   });
 
+  it('drains a targeted steer admitted while the Stop hook is pending', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'kimi-stop-steer-'));
+    const marker = join(dir, 'started');
+    const script = [
+      "const fs=require('node:fs');",
+      `fs.writeFileSync(${JSON.stringify(marker)}, 'started');`,
+      'setTimeout(() => process.exit(0), 150);',
+    ].join('');
+    const hookEngine = new HookEngine([
+      {
+        event: 'Stop',
+        command: `node -e ${JSON.stringify(script)}`,
+        timeout: 5,
+      },
+    ]);
+    const ctx = testAgent({ hookEngine });
+    ctx.configure();
+    ctx.mockNextResponse({ type: 'text', text: 'Answer before pending Stop hook.' });
+    ctx.mockNextResponse({ type: 'text', text: 'Answer after admitted steer.' });
+
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'STOP-OWNER-A' }],
+      promptId: 'prompt-stop-owner-a',
+    });
+    await waitForFile(marker);
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'STOP-STEER-B' }],
+      expectedPromptId: 'prompt-stop-owner-a',
+      requireActive: true,
+    });
+    await ctx.untilTurnEnd();
+
+    expect(ctx.llmCalls).toHaveLength(2);
+    expect(
+      ctx.llmCalls[1]!.history
+        .flatMap((message) => message.content)
+        .some((part) => part.type === 'text' && part.text === 'STOP-STEER-B'),
+    ).toBe(true);
+  });
+
   it('cancels while waiting for a Stop hook', async () => {
     const dir = mkdtempSync(join(tmpdir(), 'kimi-stop-hook-'));
     const marker = join(dir, 'started');
@@ -1524,7 +2220,7 @@ describe('Agent turn flow', () => {
     // A programmatic abort (e.g. a subagent deadline timeout) carries a plain
     // AbortError as its reason, not a UserCancellationError, so it must not be
     // reported as a user interrupt.
-    ctx.agent.turn.cancel(0, abortError());
+    void ctx.agent.turn.cancel(0, abortError());
     await ctx.untilTurnEnd();
 
     expect(triggered).toEqual([]);
@@ -2108,6 +2804,11 @@ describe('Agent turn flow', () => {
     expect(payloads[0]).toMatchObject({ turnStep: '0.1' });
     expect(payloads[0]).not.toHaveProperty('attempt');
     expect(payloads[1]).toMatchObject({ turnStep: '0.1', attempt: '2/10' });
+    expect(ctx.agent.context.history).not.toContainEqual(
+      expect.objectContaining({
+        origin: { kind: 'injection', variant: 'turn_outcome' },
+      }),
+    );
   });
 
   it('force-refreshes OAuth credentials on video upload 401 and surfaces the provider auth error when replay 401', async () => {
@@ -2172,16 +2873,16 @@ describe('Agent turn flow', () => {
     await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Run a command' }] });
 
     expect(await ctx.untilApprovalRequest()).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run a command" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run a command" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run a command" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run a command" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will run Bash." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf should-not-run\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will run Bash." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will run Bash." } }, "time": "<time>" }
       [emit] requestApproval             { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }
     `);
     expect(ctx.lastLlmInput()).toMatchInlineSnapshot(`
@@ -2198,12 +2899,13 @@ describe('Agent turn flow', () => {
     });
 
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
-      [wire] turn.cancel                 { "turnId": 0, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] turn.cancel                 { "turnId": 0, "ownerTurnId": 0, "outcomeId": "<uuid-4>", "outcomeTurnId": 0, "outcomeContent": "The user interrupted the previous turn before it finished.\\n\\nSome operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.", "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "The user manually interrupted \\"Bash\\" (and anything else running at the same time). This was a deliberate user action, not a system error, timeout, or capacity limit. Do not retry automatically or guess at the cause — wait for the user's next instruction.", "isError": true } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_bash", "output": "The user manually interrupted \\"Bash\\" (and anything else running at the same time). This was a deliberate user action, not a system error, timeout, or capacity limit. Do not retry automatically or guess at the cause — wait for the user's next instruction.", "isError": true }
       [emit] turn.step.interrupted       { "turnId": 0, "step": 1, "reason": "aborted" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<system-reminder>\\nThe user interrupted the previous turn before it finished.\\n\\nSome operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.\\n</system-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "turn_outcome" } }, "materializedTurnOutcomeId": "<uuid-4>", "time": "<time>" }
       [emit] turn.ended                  { "turnId": 0, "reason": "cancelled" }
     `);
     expect(records).toContainEqual({
@@ -2236,16 +2938,16 @@ describe('Agent turn flow', () => {
 
     const approval = await ctx.takeApprovalRequest();
     expect(approval.events).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash, then listen" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Run Bash, then listen" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash, then listen" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Run Bash, then listen" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will ask first." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf approved\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will ask first." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will ask first." } }, "time": "<time>" }
       [emit] requestApproval             { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf approved", "display": { "kind": "command", "command": "printf approved", "cwd": "<cwd>", "language": "bash" } }
     `);
     expect(ctx.lastLlmInput()).toMatchInlineSnapshot(`
@@ -2258,7 +2960,7 @@ describe('Agent turn flow', () => {
 
     await ctx.rpc.steer({ input: [{ type: 'text', text: 'Also mention the steer.' }] });
     expect(ctx.llmCalls).toHaveLength(1);
-    expect(ctx.newEvents()).toMatchInlineSnapshot(`[wire] turn.steer   { "input": [ { "type": "text", "text": "Also mention the steer." } ], "origin": { "kind": "user" }, "time": "<time>" }`);
+    expect(ctx.newEvents()).toMatchInlineSnapshot(`[wire] turn.steer   { "input": [ { "type": "text", "text": "Also mention the steer." } ], "origin": { "kind": "user" }, "admissionId": "<uuid-4>", "ownerTurnId": 0, "time": "<time>" }`);
 
     ctx.mockNextResponse({ type: 'text', text: 'Approved, and I saw the steer.' });
     approval.respond({
@@ -2268,23 +2970,23 @@ describe('Agent turn flow', () => {
 
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
       [wire] permission.record_approval_result   { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf approved", "result": { "decision": "approved", "selectedLabel": "approve" }, "time": "<time>" }
-      [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf approved", "timeout": 60 }, "description": "Running: printf approved", "display": { "kind": "command", "command": "printf approved", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] context.append_loop_event           { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf approved", "timeout": 60 }, "description": "Running: printf approved", "display": { "kind": "command", "command": "printf approved", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started                   { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf approved", "timeout": 60 }, "description": "Running: printf approved", "display": { "kind": "command", "command": "printf approved", "cwd": "<cwd>", "language": "bash" } }
       [emit] tool.progress                       { "turnId": 0, "toolCallId": "call_bash", "update": { "kind": "stdout", "text": "approved" } }
       [wire] context.append_loop_event           { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "approved" } }, "time": "<time>" }
       [emit] tool.result                         { "turnId": 0, "toolCallId": "call_bash", "output": "approved" }
-      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-1>", "turnId": "0", "step": 1, "usage": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
-      [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-1>", "usage": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
+      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "usage": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use", "messageId": "mock-1" }, "time": "<time>" }
+      [emit] turn.step.completed                 { "turnId": 0, "step": 1, "stepId": "<uuid-2>", "usage": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "tool_use" }
       [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated                { "model": "mock-model", "contextTokens": 29, "maxContextTokens": 1000000, "contextUsage": 0.000029, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 7, "output": 22, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
-      [wire] context.append_message              { "message": { "role": "user", "content": [ { "type": "text", "text": "Also mention the steer." } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-3>", "turnId": "0", "step": 2 }, "time": "<time>" }
-      [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-3>" }
+      [wire] context.append_message              { "message": { "role": "user", "content": [ { "type": "text", "text": "Also mention the steer." } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "steer", "id": "<uuid-4>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event           { "event": { "type": "step.begin", "uuid": "<uuid-5>", "turnId": "0", "step": 2 }, "time": "<time>" }
+      [emit] turn.step.started                   { "turnId": 0, "step": 2, "stepId": "<uuid-5>" }
       [wire] llm.request                         { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 999971, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 4, "turnStep": "0.2", "time": "<time>" }
       [emit] assistant.delta                     { "turnId": 0, "delta": "Approved, and I saw the steer." }
-      [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-4>", "turnId": "0", "step": 2, "stepUuid": "<uuid-3>", "part": { "type": "text", "text": "Approved, and I saw the steer." } }, "time": "<time>" }
-      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-3>", "turnId": "0", "step": 2, "usage": { "inputOther": 39, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
-      [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-3>", "usage": { "inputOther": 39, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
+      [wire] context.append_loop_event           { "event": { "type": "content.part", "uuid": "<uuid-6>", "turnId": "0", "step": 2, "stepUuid": "<uuid-5>", "part": { "type": "text", "text": "Approved, and I saw the steer." } }, "time": "<time>" }
+      [wire] context.append_loop_event           { "event": { "type": "step.end", "uuid": "<uuid-5>", "turnId": "0", "step": 2, "usage": { "inputOther": 39, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn", "messageId": "mock-2" }, "time": "<time>" }
+      [emit] turn.step.completed                 { "turnId": 0, "step": 2, "stepId": "<uuid-5>", "usage": { "inputOther": 39, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "finishReason": "end_turn" }
       [wire] usage.record                        { "model": "mock-model", "usage": { "inputOther": 39, "output": 11, "inputCacheRead": 0, "inputCacheCreation": 0 }, "usageScope": "turn", "time": "<time>" }
       [emit] agent.status.updated                { "model": "mock-model", "contextTokens": 50, "maxContextTokens": 1000000, "contextUsage": 0.00005, "planMode": false, "swarmMode": false, "permission": "manual", "usage": { "byModel": { "mock-model": { "inputOther": 46, "output": 33, "inputCacheRead": 0, "inputCacheCreation": 0 } }, "total": { "inputOther": 46, "output": 33, "inputCacheRead": 0, "inputCacheCreation": 0 }, "currentTurn": { "inputOther": 46, "output": 33, "inputCacheRead": 0, "inputCacheCreation": 0 } } }
       [emit] turn.ended                          { "turnId": 0, "reason": "completed" }
@@ -2300,24 +3002,25 @@ describe('Agent turn flow', () => {
     await ctx.expectResumeMatches();
   });
 
-  it('rejects a non-steer prompt while a turn is active', async () => {
-    const ctx = testAgent({ kaos: createCommandKaos('should-not-run') });
+  it('rejects an RPC prompt while a turn is active without persisting it for replay', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ kaos: createCommandKaos('should-not-run'), persistence });
     ctx.configure({ tools: ['Bash'] });
 
     ctx.mockNextResponse({ type: 'text', text: 'I will wait for approval.' }, bashCall());
     await ctx.rpc.prompt({ input: [{ type: 'text', text: 'Start the active turn' }] });
 
     expect(await ctx.untilApprovalRequest()).toMatchInlineSnapshot(`
-      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Start the active turn" } ], "origin": { "kind": "user" }, "time": "<time>" }
+      [wire] turn.prompt                 { "input": [ { "type": "text", "text": "Start the active turn" } ], "origin": { "kind": "user" }, "admissionId": "<uuid-1>", "turnId": 0, "time": "<time>" }
       [emit] turn.started                { "turnId": 0, "origin": { "kind": "user" } }
-      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Start the active turn" } ], "toolCalls": [], "origin": { "kind": "user" } }, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-1>", "turnId": "0", "step": 1 }, "time": "<time>" }
-      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-1>" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "Start the active turn" } ], "toolCalls": [], "origin": { "kind": "user" } }, "consumedTurnInput": { "kind": "prompt", "id": "<uuid-1>", "turnId": 0 }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "step.begin", "uuid": "<uuid-2>", "turnId": "0", "step": 1 }, "time": "<time>" }
+      [emit] turn.step.started           { "turnId": 0, "step": 1, "stepId": "<uuid-2>" }
       [wire] llm.tools_snapshot          { "hash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "tools": [ { "name": "Bash", "description": "Execute a \`bash\` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\\n\\n**Translate these to a dedicated tool instead:**\\n- \`cat\` / \`head\` / \`tail\` (known path) → \`Read\`\\n- \`sed\` / \`awk\` (in-place edit) → \`Edit\`\\n- \`echo > file\` / \`cat <<EOF\` → \`Write\`\\n- \`find\` / recursive \`ls\` to locate files by name pattern → \`Glob\` (plain \`ls <known-directory>\` is fine for listing a directory)\\n- \`grep\` / \`rg\` (search file contents) → \`Grep\`\\n- \`echo\` / \`printf\` (talk to the user) → just output text directly\\n\\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\\n\\n**Output:**\\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command exits non-zero, the output ends with a \`Command failed with exit code: N\` line; a command killed by its timeout or interrupted by the user ends with its own message instead.\\n\\nBackground execution is disabled for this agent. Do not set \`run_in_background=true\`.\\n\\n**Guidelines for safety and security:**\\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls. To run a command in a particular directory, pass the \`cwd\` argument (or use absolute paths) rather than relying on a \`cd\` from an earlier call.\\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running commands, set the \`timeout\` argument in seconds. The default is 60s; foreground commands allow up to 300s; a foreground command that hits its timeout is killed.\\n- Avoid using \`..\` to access files or directories outside of the working directory.\\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\\n\\n**Guidelines for efficiency:**\\n- Use \`&&\` to chain commands that genuinely depend on each other, e.g. \`npm install && npm test\`. Independent read-only commands (separate \`git show\`, \`ls\`, or status checks) should be issued as separate parallel Bash calls in one response, not chained into a single call — chaining serializes their execution and mixes their output. Do not stitch outputs together with \`echo\` separators.\\n- Use \`;\` to run commands sequentially regardless of success/failure\\n- Use \`||\` for conditional execution (run second command only if first fails)\\n- Use pipe operations (\`|\`) and redirections (\`>\`, \`>>\`) to chain input and output between commands\\n- Always quote file paths containing spaces with double quotes (e.g., cd \\"/path with spaces/\\")\\n- Compose multi-step logic in a single call with \`if\` / \`case\` / \`for\` / \`while\` control flows.\\n- Do not set \`run_in_background=true\`; background task management tools are not available.\\n\\n**Commands available:**\\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run \`which <command>\` first to confirm a command exists before relying on it.\\n- Navigation and inspection: \`ls\`, \`pwd\`, \`cd\`, \`stat\`, \`file\`, \`du\`, \`df\`, \`tree\`\\n- File and directory management: \`cp\`, \`mv\`, \`rm\`, \`mkdir\`, \`touch\`, \`ln\`, \`chmod\`, \`chown\`\\n- Text and data processing: \`wc\`, \`sort\`, \`uniq\`, \`cut\`, \`tr\`, \`diff\`, \`xargs\`\\n- Archives and compression: \`tar\`, \`gzip\`, \`gunzip\`, \`zip\`, \`unzip\`\\n- Networking and transfer: \`curl\`, \`wget\`, \`ping\`, \`ssh\`, \`scp\`\\n- Version control: \`git\`; for GitHub-hosted work (PRs, issues, CI runs, API queries) prefer the \`gh\` CLI when installed — it carries the user's GitHub auth and can return structured JSON\\n- Process and system: \`ps\`, \`kill\`, \`top\`, \`env\`, \`date\`, \`uname\`, \`whoami\`\\n- Language and package toolchains: \`node\`, \`npm\`, \`pnpm\`, \`yarn\`, \`python\`, \`pip\` (use whichever the project actually relies on)\\n", "parameters": { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "command": { "type": "string", "minLength": 1, "description": "The command to execute." }, "cwd": { "description": "The working directory in which to run the command. When omitted, the command runs in the session's working directory.", "type": "string" }, "timeout": { "default": 60, "description": "Optional timeout in seconds for the command to execute. Foreground default 60s, max 300s. Background default 600s, max 86400s. Ignored for background commands when disable_timeout=true.", "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "description": { "description": "A short description for the background task. Required when run_in_background is true.", "type": "string" }, "run_in_background": { "description": "Whether to run the command as a background task.", "type": "boolean" }, "disable_timeout": { "description": "If true, do not apply a timeout to the command. Only applies when run_in_background is true.", "type": "boolean" } }, "required": [ "command" ], "additionalProperties": false } } ], "time": "<time>" }
       [wire] llm.request                 { "kind": "loop", "provider": "kimi", "model": "mock-model", "modelAlias": "mock-model", "thinkingEffort": "off", "maxTokens": 1000000, "toolSelect": false, "systemPromptHash": "ec9c34379c88babbc468ef2f3e0e08cd2f422c8c4a910664fb8bb394d703a575", "toolsHash": "aca3041121ee711028f726fed37e7b999f7e8885c05dbece76ef97eb43e2ec1e", "messageCount": 1, "turnStep": "0.1", "time": "<time>" }
       [emit] assistant.delta             { "turnId": 0, "delta": "I will wait for approval." }
       [emit] tool.call.delta             { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "argumentsPart": "{\\"command\\":\\"printf should-not-run\\",\\"timeout\\":60}" }
-      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-2>", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "part": { "type": "text", "text": "I will wait for approval." } }, "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "content.part", "uuid": "<uuid-3>", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "part": { "type": "text", "text": "I will wait for approval." } }, "time": "<time>" }
       [emit] requestApproval             { "turnId": 0, "toolCallId": "call_bash", "toolName": "Bash", "action": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }
     `);
     expect(ctx.lastLlmInput()).toMatchInlineSnapshot(`
@@ -2326,220 +3029,1312 @@ describe('Agent turn flow', () => {
       messages:
         user: text "Start the active turn"
     `);
-    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'This should not start a new turn' }] });
+    await expect(
+      ctx.rpc.prompt({
+        input: [{ type: 'text', text: 'This should not start a new turn' }],
+      }),
+    ).rejects.toMatchObject({
+      name: 'KimiError',
+      code: ErrorCodes.TURN_AGENT_BUSY,
+      message: 'Cannot launch a new turn while another turn (ID 0) is active',
+      details: { turnId: 0 },
+    });
 
     expect(ctx.newEvents()).toMatchInlineSnapshot(`
-      [wire] turn.prompt   { "input": [ { "type": "text", "text": "This should not start a new turn" } ], "origin": { "kind": "user" }, "time": "<time>" }
-      [emit] error         { "code": "turn.agent_busy", "message": "Cannot launch a new turn while another turn (ID 0) is active", "details": { "turnId": 0 }, "retryable": true }
+      [emit] error   { "code": "turn.agent_busy", "message": "Cannot launch a new turn while another turn (ID 0) is active", "details": { "turnId": 0 }, "retryable": true }
     `);
+    expect(
+      persistence.records
+        .filter((record) => record.type === 'turn.prompt')
+        .flatMap((record) => record.input)
+        .filter((part) => part.type === 'text')
+        .map((part) => part.text),
+    ).toEqual(['Start the active turn']);
     await ctx.rpc.cancel({ turnId: 0 });
     expect(await ctx.untilTurnEnd()).toMatchInlineSnapshot(`
-      [wire] turn.cancel                 { "turnId": 0, "time": "<time>" }
-      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-1>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
+      [wire] turn.cancel                 { "turnId": 0, "ownerTurnId": 0, "outcomeId": "<uuid-4>", "outcomeTurnId": 0, "outcomeContent": "The user interrupted the previous turn before it finished.\\n\\nSome operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.", "time": "<time>" }
+      [wire] context.append_loop_event   { "event": { "type": "tool.call", "uuid": "call_bash", "turnId": "0", "step": 1, "stepUuid": "<uuid-2>", "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }, "time": "<time>" }
       [emit] tool.call.started           { "turnId": 0, "toolCallId": "call_bash", "name": "Bash", "args": { "command": "printf should-not-run", "timeout": 60 }, "description": "Running: printf should-not-run", "display": { "kind": "command", "command": "printf should-not-run", "cwd": "<cwd>", "language": "bash" } }
       [wire] context.append_loop_event   { "event": { "type": "tool.result", "parentUuid": "call_bash", "toolCallId": "call_bash", "result": { "output": "The user manually interrupted \\"Bash\\" (and anything else running at the same time). This was a deliberate user action, not a system error, timeout, or capacity limit. Do not retry automatically or guess at the cause — wait for the user's next instruction.", "isError": true } }, "time": "<time>" }
       [emit] tool.result                 { "turnId": 0, "toolCallId": "call_bash", "output": "The user manually interrupted \\"Bash\\" (and anything else running at the same time). This was a deliberate user action, not a system error, timeout, or capacity limit. Do not retry automatically or guess at the cause — wait for the user's next instruction.", "isError": true }
       [emit] turn.step.interrupted       { "turnId": 0, "step": 1, "reason": "aborted" }
+      [wire] context.append_message      { "message": { "role": "user", "content": [ { "type": "text", "text": "<system-reminder>\\nThe user interrupted the previous turn before it finished.\\n\\nSome operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.\\n</system-reminder>" } ], "toolCalls": [], "origin": { "kind": "injection", "variant": "turn_outcome" } }, "materializedTurnOutcomeId": "<uuid-4>", "time": "<time>" }
       [emit] turn.ended                  { "turnId": 0, "reason": "cancelled" }
     `);
     await ctx.expectResumeMatches();
   });
-});
 
-const abortableGenerate: GenerateFn = async (
-  _chat,
-  _systemPrompt,
-  _tools,
-  _history,
-  _callbacks,
-  options,
-) => {
-  await new Promise<void>((_resolve, reject) => {
-    const rejectAbort = () => {
-      const error = new Error('Aborted');
-      error.name = 'AbortError';
-      reject(error);
-    };
-    if (options?.signal?.aborted === true) {
-      rejectAbort();
-      return;
-    }
-    options?.signal?.addEventListener('abort', rejectAbort, { once: true });
-  });
-  throw new Error('abortableGenerate unexpectedly completed');
-};
+  it('keeps direct TurnFlow busy submissions compatible with the null return contract', async () => {
+    const ctx = testAgent({ generate: abortableGenerate });
+    ctx.configure();
 
-function eventIndex(
-  ctx: Pick<ReturnType<typeof testAgent>, 'allEvents'>,
-  type: string,
-  event: string,
-): number {
-  return ctx.allEvents.findIndex((entry) => entry.type === type && entry.event === event);
-}
+    expect(ctx.agent.turn.prompt([{ type: 'text', text: 'Start the active turn' }])).toBe(0);
+    ctx.newEvents();
 
-function bashCall(): ToolCall {
-  return bashCallWithId('call_bash', 'printf should-not-run');
-}
+    expect(
+      ctx.agent.turn.prompt([{ type: 'text', text: 'Direct caller should see null' }]),
+    ).toBeNull();
+    expect(ctx.newEvents()).toMatchInlineSnapshot(`
+      [emit] error   { "code": "turn.agent_busy", "message": "Cannot launch a new turn while another turn (ID 0) is active", "details": { "turnId": 0 }, "retryable": true }
+    `);
 
-function bashCallWithId(id: string, command: string): ToolCall {
-  return {
-    type: 'function',
-    id,
-    name: 'Bash',
-    arguments: JSON.stringify({ command, timeout: 60 }),
-  };
-}
+    await ctx.rpc.cancel({ turnId: 0 });
+    await ctx.untilTurnEnd();
+  });
 
-function agentSwarmCall(): ToolCall {
-  return {
-    type: 'function',
-    id: 'call_swarm',
-    name: 'AgentSwarm',
-    arguments: JSON.stringify({
-      description: 'Review files',
-      prompt_template: 'Review {{item}}',
-      items: ['src/a.ts', 'src/b.ts'],
-    }),
-  };
-}
+  it('reserves the active turn before a synchronous turn.started listener can re-enter prompt', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ generate: abortableGenerate, persistence });
+    ctx.configure();
+    let reentrantPrompt: ReturnType<typeof ctx.rpc.prompt> | undefined;
+    ctx.emitter.once('turn.started', () => {
+      reentrantPrompt = ctx.rpc.prompt({
+        input: [{ type: 'text', text: 'REENTRANT-PROMPT' }],
+        promptId: 'prompt-reentrant',
+      });
+    });
 
-function mockSubagentHost<T extends Partial<SessionSubagentHost>>(
-  host: T,
-): T & SessionSubagentHost {
-  return { spawn: vi.fn(), resume: vi.fn(), runQueued: vi.fn(), ...host } as unknown as T &
-    SessionSubagentHost;
-}
+    await expect(
+      ctx.rpc.prompt({
+        input: [{ type: 'text', text: 'OWNING-PROMPT' }],
+        promptId: 'prompt-owner',
+      }),
+    ).resolves.toEqual({ kind: 'started', turnId: 0 });
+    await expect(reentrantPrompt).rejects.toMatchObject({ code: ErrorCodes.TURN_AGENT_BUSY });
+    expect(ctx.allEvents).toContainEqual(
+      expect.objectContaining({
+        type: '[rpc]',
+        event: 'turn.started',
+        args: expect.objectContaining({ turnId: 0, promptId: 'prompt-owner' }),
+      }),
+    );
+    expect(
+      persistence.records.filter((record) => record.type === 'turn.prompt'),
+    ).toHaveLength(1);
 
-interface ApiErrorTelemetryCase {
-  readonly name: string;
-  readonly createError: () => Error;
-  readonly errorType: string;
-  readonly statusCode?: number;
-}
+    await ctx.rpc.cancel({ turnId: 0 });
+    await ctx.untilTurnEnd();
+  });
 
-function singleAttemptAgentOptions(): Pick<TestAgentOptions, 'initialConfig'> {
-  return {
-    initialConfig: {
-      providers: {},
-      loopControl: { maxRetriesPerStep: 1 },
-    },
-  };
-}
+  it('reserves the active turn before a synchronous persistence callback can re-enter prompt', async () => {
+    let ctx!: TestAgentContext;
+    let reentrantResult: number | null | undefined;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type !== 'turn.prompt' || reentrantResult !== undefined) return;
+        reentrantResult = ctx.agent.turn.prompt([
+          { type: 'text', text: 'PERSISTENCE-REENTRANT-PROMPT' },
+        ]);
+      },
+    });
+    ctx = testAgent({ generate: abortableGenerate, persistence });
+    ctx.configure();
 
-const MP4_HEADER = Buffer.concat([
-  Buffer.from([0x00, 0x00, 0x00, 0x18]),
-  Buffer.from('ftyp'),
-  Buffer.from('mp42'),
-  Buffer.from([0x00, 0x00, 0x00, 0x00]),
-  Buffer.from('mp42isom'),
-]);
+    expect(
+      await ctx.rpc.prompt({ input: [{ type: 'text', text: 'PERSISTENCE-OWNER-PROMPT' }] }),
+    ).toEqual({ kind: 'started', turnId: 0 });
+    expect(reentrantResult).toBeNull();
+    expect(
+      persistence.records
+        .filter((record) => record.type === 'turn.prompt')
+        .flatMap((record) => record.input)
+        .filter((part) => part.type === 'text')
+        .map((part) => part.text),
+    ).toEqual(['PERSISTENCE-OWNER-PROMPT']);
 
-const DEFAULT_MEDIA_STAT = {
-  stMode: 0o100644,
-  stIno: 0,
-  stDev: 0,
-  stNlink: 1,
-  stUid: 0,
-  stGid: 0,
-  stSize: MP4_HEADER.length,
-  stAtime: 0,
-  stMtime: 0,
-  stCtime: 0,
-};
+    await ctx.rpc.cancel({ turnId: 0 });
+    await ctx.untilTurnEnd();
+  });
 
-function createVideoKaos(): Kaos {
-  return createFakeKaos({
-    stat: vi.fn<Kaos['stat']>().mockResolvedValue(DEFAULT_MEDIA_STAT),
-    readBytes: vi.fn<Kaos['readBytes']>().mockResolvedValue(MP4_HEADER),
+  it('rejects a turn-targeted steer after its turn has already ended', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence });
+    ctx.configure();
+    ctx.mockNextResponse({ type: 'text', text: 'The owning turn is complete.' });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'OWNING-TURN' }] });
+    await ctx.agent.turn.waitForCurrentTurn();
+    await expect(
+      ctx.rpc.steer({
+        input: [{ type: 'text', text: 'STALE-TARGETED-STEER' }],
+        expectedTurnId: 0,
+        requireActive: true,
+      }),
+    ).rejects.toMatchObject({ code: ErrorCodes.TURN_AGENT_BUSY });
+
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+    expect(persistence.records.filter((record) => record.type === 'turn.steer')).toHaveLength(0);
   });
-}
 
-async function waitForFile(path: string): Promise<void> {
-  for (let i = 0; i < 100; i++) {
-    if (existsSync(path)) return;
-    await delay(10);
-  }
-  throw new Error(`Timed out waiting for ${path}`);
-}
+  it('accepts a prompt-targeted steer only for the exact logical owner', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ generate: abortableGenerate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'ACTIVE-OWNER' }],
+      promptId: 'prompt-owner',
+    });
 
-function mediaCapabilities(): ModelCapability {
-  return {
-    image_in: true,
-    video_in: true,
-    audio_in: false,
-    thinking: false,
-    tool_use: true,
-    max_context_tokens: 1_000_000,
-  };
-}
+    await expect(
+      ctx.rpc.steer({
+        input: [{ type: 'text', text: 'WRONG-TURN-STEER' }],
+        expectedPromptId: 'prompt-other',
+        requireActive: true,
+      }),
+    ).rejects.toMatchObject({ code: ErrorCodes.TURN_AGENT_BUSY });
+    await expect(
+      ctx.rpc.steer({
+        input: [{ type: 'text', text: 'MATCHING-TURN-STEER' }],
+        expectedPromptId: 'prompt-owner',
+        requireActive: true,
+      }),
+    ).resolves.toBeUndefined();
 
-function oauthAgentOptions(
-  getAccessToken: (options?: { readonly force?: boolean }) => Promise<string>,
-  capabilities?: readonly string[] | undefined,
-): Pick<TestAgentOptions, 'initialConfig' | 'providerManagerOverrides'> {
-  return {
-    initialConfig: {
-      defaultModel: 'kimi-code',
-      providers: {
-        'managed:kimi-code': {
-          type: 'vertexai',
-          baseUrl: 'https://api.example/v1',
-          oauth: { storage: 'file', key: 'oauth/kimi-code' },
+    expect(
+      persistence.records
+        .filter((record) => record.type === 'turn.steer')
+        .flatMap((record) => record.input)
+        .filter((part) => part.type === 'text')
+        .map((part) => part.text),
+    ).toEqual(['MATCHING-TURN-STEER']);
+    await ctx.rpc.cancel({ turnId: 0 });
+    await ctx.untilTurnEnd();
+  });
+
+  it('drops targeted and direct user steers on cancel while retaining an untargeted notification', async () => {
+    const firstRequestStarted = createControlledPromise<void>();
+    let generateCalls = 0;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      generateCalls += 1;
+      if (generateCalls !== 1) return textResult('FOLLOW-UP-COMPLETED');
+      firstRequestStarted.resolve();
+      await new Promise<void>((_resolve, reject) => {
+        const onAbort = (): void => {
+          reject(options?.signal?.reason ?? abortError());
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+      return textResult('UNEXPECTED-FIRST-RESPONSE');
+    };
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ generate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'OWNER-A' }],
+      promptId: 'prompt-a',
+    });
+    await firstRequestStarted;
+
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'OWNED-STEER-B' }],
+      expectedPromptId: 'prompt-a',
+      requireActive: true,
+    });
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'DIRECT-USER-STEER' }],
+    });
+    ctx.agent.turn.steer(
+      [{ type: 'text', text: 'UNTARGETED-BACKGROUND' }],
+      {
+        kind: 'background_task',
+        taskId: 'task-owner-cancel',
+        status: 'completed',
+        notificationId: 'notification-owner-cancel',
+      },
+    );
+    await ctx.rpc.cancel({ turnId: 0 });
+
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'FOLLOW-UP-C' }],
+      promptId: 'prompt-c',
+    });
+    await ctx.agent.turn.waitForCurrentTurn();
+
+    const history = ctx.agent.context.history
+      .flatMap((message) => message.content)
+      .filter((part) => part.type === 'text')
+      .map((part) => part.text)
+      .join('\n');
+    expect(history).not.toContain('OWNED-STEER-B');
+    expect(history).not.toContain('DIRECT-USER-STEER');
+    expect(history).toContain('UNTARGETED-BACKGROUND');
+    expect(history).toContain('FOLLOW-UP-C');
+    expect(
+      persistence.records.find((record) => record.type === 'turn.cancel'),
+    ).toMatchObject({ promptId: 'prompt-a' });
+    expect(
+      persistence.records.find(
+        (record) =>
+          record.type === 'turn.steer' &&
+          record.input.some((part) => part.type === 'text' && part.text === 'OWNED-STEER-B'),
+      ),
+    ).toMatchObject({ expectedPromptId: 'prompt-a' });
+    expect(
+      persistence.records.find(
+        (record) =>
+          record.type === 'turn.steer' &&
+          record.input.some(
+            (part) => part.type === 'text' && part.text === 'DIRECT-USER-STEER',
+          ),
+      ),
+    ).toMatchObject({ expectedPromptId: 'prompt-a' });
+  });
+
+  it('binds a direct user steer to the root turn when the prompt has no caller id', async () => {
+    const firstRequestStarted = createControlledPromise<void>();
+    let generateCalls = 0;
+    const generate: GenerateFn = async (
+      _provider,
+      _systemPrompt,
+      _tools,
+      _history,
+      _callbacks,
+      options,
+    ) => {
+      generateCalls += 1;
+      if (generateCalls !== 1) return textResult('FOLLOW-UP-WITHOUT-LEAK');
+      firstRequestStarted.resolve();
+      await new Promise<void>((_resolve, reject) => {
+        const onAbort = (): void => {
+          reject(options?.signal?.reason ?? abortError());
+        };
+        if (options?.signal?.aborted === true) onAbort();
+        else options?.signal?.addEventListener('abort', onAbort, { once: true });
+      });
+      return textResult('UNEXPECTED-FIRST-RESPONSE');
+    };
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ generate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'OWNER-WITHOUT-PROMPT-ID' }] });
+    await firstRequestStarted;
+    await ctx.rpc.steer({ input: [{ type: 'text', text: 'DIRECT-STEER-WITHOUT-OWNER-ID' }] });
+
+    await ctx.rpc.cancel({ turnId: 0 });
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'FOLLOW-UP-AFTER-ROOT-CANCEL' }] });
+    await ctx.agent.turn.waitForCurrentTurn();
+
+    const history = ctx.agent.context.history
+      .flatMap((message) => message.content)
+      .filter((part) => part.type === 'text')
+      .map((part) => part.text)
+      .join('\n');
+    expect(history).not.toContain('DIRECT-STEER-WITHOUT-OWNER-ID');
+    expect(history).toContain('FOLLOW-UP-AFTER-ROOT-CANCEL');
+    expect(
+      persistence.records.find(
+        (record) =>
+          record.type === 'turn.steer' &&
+          record.input.some(
+            (part) => part.type === 'text' && part.text === 'DIRECT-STEER-WITHOUT-OWNER-ID',
+          ),
+      ),
+    ).toMatchObject({ ownerTurnId: 0 });
+    expect(
+      persistence.records.find((record) => record.type === 'turn.cancel'),
+    ).toMatchObject({ ownerTurnId: 0 });
+  });
+
+  it('does not admit a steer cancelled synchronously by its persistence observer', async () => {
+    let ctx!: TestAgentContext;
+    let nestedCancellation: Promise<void> | undefined;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (
+          record.type === 'turn.steer' &&
+          record.input.some(
+            (part) => part.type === 'text' && part.text === 'REENTRANT-STEER-B',
+          )
+        ) {
+          nestedCancellation ??= ctx.agent.turn.cancel(0);
+        }
+      },
+    });
+    ctx = testAgent({ generate: abortableGenerate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'REENTRANT-OWNER-A' }],
+      promptId: 'prompt-reentrant-owner-a',
+    });
+    const worker = ctx.agent.turn.waitForCurrentTurn();
+
+    await expect(
+      ctx.rpc.steer({
+        input: [{ type: 'text', text: 'REENTRANT-STEER-B' }],
+        expectedPromptId: 'prompt-reentrant-owner-a',
+        requireActive: true,
+      }),
+    ).rejects.toMatchObject({ code: ErrorCodes.TURN_AGENT_BUSY });
+    await Promise.all([nestedCancellation, worker]);
+
+    const history = ctx.agent.context.history
+      .flatMap((message) => message.content)
+      .filter((part) => part.type === 'text')
+      .map((part) => part.text)
+      .join('\n');
+    expect(history).not.toContain('REENTRANT-STEER-B');
+  });
+
+  it('does not drop a background steer when append persistence re-enters cancellation', async () => {
+    const providerStarted = createControlledPromise<void>();
+    const providerResult = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const generate: GenerateFn = async () => {
+      providerStarted.resolve();
+      return providerResult;
+    };
+    let ctx!: TestAgentContext;
+    let nestedCancellation: Promise<void> | undefined;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (
+          record.type === 'context.append_message' &&
+          record.message.content.some(
+            (part) => part.type === 'text' && part.text === 'APPEND-STEER-B',
+          )
+        ) {
+          nestedCancellation ??= ctx.agent.turn.cancel(0);
+        }
+      },
+    });
+    ctx = testAgent({ generate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'APPEND-OWNER-A' }],
+      promptId: 'prompt-append-owner-a',
+    });
+    await providerStarted;
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'APPEND-STEER-B' }],
+      expectedPromptId: 'prompt-append-owner-a',
+      requireActive: true,
+    });
+    ctx.agent.turn.steer(
+      [{ type: 'text', text: 'APPEND-BACKGROUND-N' }],
+      {
+        kind: 'background_task',
+        taskId: 'task-append-reentry',
+        status: 'completed',
+        notificationId: 'notification-append-reentry',
+      },
+    );
+
+    providerResult.resolve(textResult('Provider response before cancellation.'));
+    await vi.waitFor(() => expect(nestedCancellation).toBeDefined());
+    await nestedCancellation;
+    const ended = await ctx.untilTurnEnd();
+    expect(ended).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'cancelled' }),
+      }),
+    );
+
+    const history = ctx.agent.context.history
+      .flatMap((message) => message.content)
+      .filter((part) => part.type === 'text')
+      .map((part) => part.text);
+    expect(history.filter((text) => text === 'APPEND-STEER-B')).toHaveLength(1);
+    expect(history.filter((text) => text === 'APPEND-BACKGROUND-N')).toHaveLength(1);
+    const terminalCancel = persistence.records.find((record) => record.type === 'turn.cancel');
+    expect(terminalCancel?.type === 'turn.cancel' ? terminalCancel.outcomeId : undefined).toBeDefined();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'FOLLOW-UP-AFTER-CANCELLED-TURN' }] });
+    await ctx.agent.turn.waitForCurrentTurn();
+    expect(contextTexts(ctx).match(/previous turn before it finished/g)).toHaveLength(1);
+  });
+
+  it('emits a terminal turn without retrying a failed terminal steer append', async () => {
+    const providerStarted = createControlledPromise<void>();
+    const failProvider = createControlledPromise<never>();
+    let steerAppendAttempts = 0;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (
+          record.type === 'context.append_message' &&
+          record.message.content.some(
+            (part) => part.type === 'text' && part.text === 'FAILED-APPEND-STEER-B',
+          )
+        ) {
+          steerAppendAttempts += 1;
+          throw new Error('terminal steer append failed');
+        }
+      },
+    });
+    const generate: GenerateFn = async () => {
+      providerStarted.resolve();
+      return failProvider;
+    };
+    const ctx = testAgent({
+      generate,
+      persistence,
+      ...singleAttemptAgentOptions(),
+    });
+    ctx.configure();
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: 'FAILED-APPEND-OWNER-A' }],
+      promptId: 'prompt-failed-append-owner-a',
+    });
+    await providerStarted;
+    await ctx.rpc.steer({
+      input: [{ type: 'text', text: 'FAILED-APPEND-STEER-B' }],
+      expectedPromptId: 'prompt-failed-append-owner-a',
+      requireActive: true,
+    });
+    failProvider.reject(new APIStatusError(500, 'provider failed', 'req-failed-append'));
+
+    const events = await ctx.untilTurnEnd();
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'failed' }),
+      }),
+    );
+    expect(steerAppendAttempts).toBe(1);
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('deduplicates a cancellation re-entered by its persistence observer', async () => {
+    let ctx!: TestAgentContext;
+    let nestedCancellation: Promise<void> | undefined;
+    let cancelRecords = 0;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type !== 'turn.cancel') return;
+        cancelRecords += 1;
+        nestedCancellation ??= ctx.agent.turn.cancel(record.turnId);
+      },
+    });
+    ctx = testAgent({ generate: abortableGenerate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'ACTIVE-BEFORE-REENTRY' }] });
+    const worker = ctx.agent.turn.waitForCurrentTurn();
+
+    const cancellation = ctx.agent.turn.cancel(0);
+    expect(nestedCancellation).toBe(cancellation);
+    await Promise.all([cancellation, worker]);
+
+    expect(cancelRecords).toBe(1);
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('finishes active-turn cancellation before reporting a turn.cancel persistence failure', async () => {
+    const persistenceError = new Error('turn.cancel persistence failed');
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type === 'turn.cancel') throw persistenceError;
+      },
+    });
+    const ctx = testAgent({ generate: abortableGenerate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'ACTIVE-BEFORE-CANCEL-FAILURE' }] });
+
+    await expect(ctx.rpc.cancel({ turnId: 0 })).rejects.toBe(persistenceError);
+
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('runs every shutdown cleanup before reporting a turn.cancel persistence failure', async () => {
+    const persistenceError = new Error('shutdown cancellation persistence failed');
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (record.type === 'turn.cancel') throw persistenceError;
+      },
+    });
+    const ctx = testAgent({ generate: abortableGenerate, persistence });
+    ctx.configure();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'ACTIVE-BEFORE-SHUTDOWN-FAILURE' }] });
+    const compactionCancel = vi.spyOn(ctx.agent.fullCompaction, 'cancel');
+
+    await expect(ctx.agent.turn.shutdown(abortError('Session closed'))).rejects.toBe(
+      persistenceError,
+    );
+
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+    expect(ctx.agent.turn.isClosed).toBe(true);
+    expect(compactionCancel).toHaveBeenCalledOnce();
+  });
+});
+
+const abortableGenerate: GenerateFn = async (
+  _chat,
+  _systemPrompt,
+  _tools,
+  _history,
+  _callbacks,
+  options,
+) => {
+  await new Promise<void>((_resolve, reject) => {
+    const rejectAbort = () => {
+      const error = new Error('Aborted');
+      error.name = 'AbortError';
+      reject(error);
+    };
+    if (options?.signal?.aborted === true) {
+      rejectAbort();
+      return;
+    }
+    options?.signal?.addEventListener('abort', rejectAbort, { once: true });
+  });
+  throw new Error('abortableGenerate unexpectedly completed');
+};
+
+function cancellationReasonWithHostileMessage(): Error {
+  const reason = new Error('hostile cancellation diagnostic');
+  Object.defineProperty(reason, 'message', {
+    configurable: true,
+    get() {
+      throw new Error('message getter failed');
+    },
+  });
+  return reason;
+}
+
+function eventIndex(
+  ctx: Pick<ReturnType<typeof testAgent>, 'allEvents'>,
+  type: string,
+  event: string,
+): number {
+  return ctx.allEvents.findIndex((entry) => entry.type === type && entry.event === event);
+}
+
+function bashCall(): ToolCall {
+  return bashCallWithId('call_bash', 'printf should-not-run');
+}
+
+function bashCallWithId(id: string, command: string): ToolCall {
+  return {
+    type: 'function',
+    id,
+    name: 'Bash',
+    arguments: JSON.stringify({ command, timeout: 60 }),
+  };
+}
+
+function agentSwarmCall(): ToolCall {
+  return {
+    type: 'function',
+    id: 'call_swarm',
+    name: 'AgentSwarm',
+    arguments: JSON.stringify({
+      description: 'Review files',
+      prompt_template: 'Review {{item}}',
+      items: ['src/a.ts', 'src/b.ts'],
+    }),
+  };
+}
+
+function mockSubagentHost<T extends Partial<SessionSubagentHost>>(
+  host: T,
+): T & SessionSubagentHost {
+  return { spawn: vi.fn(), resume: vi.fn(), runQueued: vi.fn(), ...host } as unknown as T &
+    SessionSubagentHost;
+}
+
+interface ApiErrorTelemetryCase {
+  readonly name: string;
+  readonly createError: () => Error;
+  readonly errorType: string;
+  readonly statusCode?: number;
+}
+
+function singleAttemptAgentOptions(): Pick<TestAgentOptions, 'initialConfig'> {
+  return {
+    initialConfig: {
+      providers: {},
+      loopControl: { maxRetriesPerStep: 1 },
+    },
+  };
+}
+
+const MP4_HEADER = Buffer.concat([
+  Buffer.from([0x00, 0x00, 0x00, 0x18]),
+  Buffer.from('ftyp'),
+  Buffer.from('mp42'),
+  Buffer.from([0x00, 0x00, 0x00, 0x00]),
+  Buffer.from('mp42isom'),
+]);
+
+const DEFAULT_MEDIA_STAT = {
+  stMode: 0o100644,
+  stIno: 0,
+  stDev: 0,
+  stNlink: 1,
+  stUid: 0,
+  stGid: 0,
+  stSize: MP4_HEADER.length,
+  stAtime: 0,
+  stMtime: 0,
+  stCtime: 0,
+};
+
+function createVideoKaos(): Kaos {
+  return createFakeKaos({
+    stat: vi.fn<Kaos['stat']>().mockResolvedValue(DEFAULT_MEDIA_STAT),
+    readBytes: vi.fn<Kaos['readBytes']>().mockResolvedValue(MP4_HEADER),
+  });
+}
+
+async function waitForFile(path: string): Promise<void> {
+  for (let i = 0; i < 100; i++) {
+    if (existsSync(path)) return;
+    await delay(10);
+  }
+  throw new Error(`Timed out waiting for ${path}`);
+}
+
+function mediaCapabilities(): ModelCapability {
+  return {
+    image_in: true,
+    video_in: true,
+    audio_in: false,
+    thinking: false,
+    tool_use: true,
+    max_context_tokens: 1_000_000,
+  };
+}
+
+function oauthAgentOptions(
+  getAccessToken: (options?: { readonly force?: boolean }) => Promise<string>,
+  capabilities?: readonly string[] | undefined,
+): Pick<TestAgentOptions, 'initialConfig' | 'providerManagerOverrides'> {
+  return {
+    initialConfig: {
+      defaultModel: 'kimi-code',
+      providers: {
+        'managed:kimi-code': {
+          type: 'vertexai',
+          baseUrl: 'https://api.example/v1',
+          oauth: { storage: 'file', key: 'oauth/kimi-code' },
+        },
+      },
+      models: {
+        'kimi-code': {
+          provider: 'managed:kimi-code',
+          model: 'kimi-for-coding',
+          maxContextSize: 1_000_000,
+          capabilities: capabilities === undefined ? undefined : [...capabilities],
         },
       },
-      models: {
-        'kimi-code': {
-          provider: 'managed:kimi-code',
-          model: 'kimi-for-coding',
-          maxContextSize: 1_000_000,
-          capabilities: capabilities === undefined ? undefined : [...capabilities],
-        },
+    },
+    providerManagerOverrides: {
+      resolveOAuthTokenProvider: vi.fn(() => ({ getAccessToken })),
+    },
+  };
+}
+
+function textResult(text: string): Awaited<ReturnType<GenerateFn>> {
+  return {
+    id: 'mock-oauth-retry',
+    message: {
+      role: 'assistant',
+      content: [{ type: 'text', text }],
+      toolCalls: [],
+    },
+    usage: {
+      inputOther: 1,
+      output: 1,
+      inputCacheRead: 0,
+      inputCacheCreation: 0,
+    },
+    finishReason: 'completed',
+    rawFinishReason: 'stop',
+  };
+}
+
+function streamFromIterator(iterator: AsyncIterator<StreamedMessagePart>): StreamedMessage {
+  return {
+    id: null,
+    usage: null,
+    finishReason: null,
+    rawFinishReason: null,
+    [Symbol.asyncIterator]: () => iterator,
+  };
+}
+
+describe('abandoned tool exchange teardown', () => {
+  it('closes dangling tool calls when a turn dies mid-batch so follow-up messages are not swallowed', async () => {
+    // A transcript write failure between a recorded tool.call and its paired
+    // tool.result breaks the batch's "every recorded call gets a result"
+    // invariant: the result-dispatch loop dies, the turn fails, and
+    // pendingToolResultIds stays open — stranding every later message in
+    // deferredMessages.
+    const base = new InMemoryAgentRecordPersistence();
+    let failedOnce = false;
+    const persistence: AgentRecordPersistence = {
+      read: () => base.read(),
+      append: (record: AgentRecord) => {
+        if (
+          !failedOnce &&
+          record.type === 'context.append_loop_event' &&
+          record.event.type === 'tool.result'
+        ) {
+          failedOnce = true;
+          throw new Error('transcript write failed');
+        }
+        base.append(record);
+      },
+      rewrite: (records) => {
+        base.rewrite(records);
+      },
+      flush: () => base.flush(),
+      close: () => base.close(),
+    };
+    const ctx = testAgent({ kaos: createCommandKaos('ok'), persistence });
+    ctx.configure({ tools: ['Bash'] });
+    await ctx.rpc.setPermission({ mode: 'auto' });
+
+    ctx.mockNextResponse(
+      { type: 'text', text: 'I will run both commands.' },
+      bashCallWithId('call_one', 'echo one'),
+      bashCallWithId('call_two', 'echo two'),
+    );
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'run both' }] });
+    const events = await ctx.untilTurnEnd();
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'failed' }),
+      }),
+    );
+
+    // Every recorded tool.call must still get a result: the turn teardown
+    // synthesizes an error result for each dangling call.
+    const toolMessages = ctx.agent.context.history.filter((message) => message.role === 'tool');
+    expect(toolMessages.map((message) => message.toolCallId)).toEqual(['call_one', 'call_two']);
+    for (const message of toolMessages) {
+      expect(message.isError).toBe(true);
+    }
+
+    // With the exchange closed, a follow-up message reaches the history instead
+    // of being stranded in deferredMessages forever.
+    ctx.agent.context.appendMessage({
+      role: 'user',
+      content: [{ type: 'text', text: 'follow-up after failure' }],
+      toolCalls: [],
+    });
+    expect(JSON.stringify(ctx.agent.context.history)).toContain('follow-up after failure');
+  });
+});
+
+describe('turn input crash-prefix recovery', () => {
+  it('launches a background steer admitted while a failed goal turn is finalizing', async () => {
+    const pauseStarted = createControlledPromise<void>();
+    const releasePause = createControlledPromise<void>();
+    const histories: Message[][] = [];
+    let calls = 0;
+    const ctx = testAgent({
+      generate: async (_provider, _systemPrompt, _tools, history) => {
+        histories.push(structuredClone(history));
+        calls += 1;
+        if (calls === 1) throw new Error('provider failed');
+        return textResult('background handled');
+      },
+    });
+    ctx.configure();
+    await ctx.agent.goal.createGoal({ objective: 'complete several slices' });
+    const pauseActiveGoal = ctx.agent.goal.pauseActiveGoal.bind(ctx.agent.goal);
+    vi.spyOn(ctx.agent.goal, 'pauseActiveGoal').mockImplementation(async (options) => {
+      pauseStarted.resolve();
+      await releasePause;
+      return pauseActiveGoal(options);
+    });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'start goal work' }] });
+    const firstWorker = ctx.agent.turn.waitForCurrentTurn();
+    await pauseStarted;
+    ctx.agent.turn.steer(
+      [{ type: 'text', text: 'BACKGROUND-DURING-TERMINAL-WINDOW' }],
+      {
+        kind: 'background_task',
+        taskId: 'terminal-window-task',
+        status: 'completed',
+        notificationId: 'terminal-window-notification',
+      },
+    );
+    releasePause.resolve();
+    await firstWorker;
+    if (ctx.agent.turn.hasActiveTurn) await ctx.agent.turn.waitForCurrentTurn();
+
+    expect(histories).toHaveLength(2);
+    expect(
+      histories[1]!
+        .flatMap((message) => message.content)
+        .filter((part) => part.type === 'text')
+        .map((part) => part.text)
+        .join('\n'),
+    ).toContain('BACKGROUND-DURING-TERMINAL-WINDOW');
+  });
+
+  it('replays an active-turn steer when the process stops after admission but before context commit', async () => {
+    const provider = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => provider });
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'ACTIVE-PROMPT' }],
+      promptId: 'active-prompt-id',
+    });
+    await original.rpc.steer({
+      input: [{ type: 'text', text: 'DURABLE-ACTIVE-STEER' }],
+      expectedPromptId: 'active-prompt-id',
+      requireActive: true,
+    });
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) =>
+          record.type === 'turn.steer' &&
+          record.input.some(
+            (part) => part.type === 'text' && part.text === 'DURABLE-ACTIVE-STEER',
+          ),
+      ),
+      generate: async () => textResult('recovered'),
+    });
+    await resumed.agent.resume();
+
+    expect(contextTexts(resumed)).toContain('DURABLE-ACTIVE-STEER');
+  });
+
+  it('replays a prompt admitted immediately before its context commit', async () => {
+    const provider = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => provider });
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'PROMPT-BEFORE-CONTEXT-COMMIT' }],
+      promptId: 'prompt-before-context-commit',
+    });
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'turn.prompt',
+      ),
+      generate: async () => textResult('recovered'),
+    });
+    await resumed.agent.resume();
+
+    expect(contextTexts(resumed).match(/PROMPT-BEFORE-CONTEXT-COMMIT/g)).toHaveLength(1);
+  });
+
+  it('does not replay a prompt whose context consumption was already committed', async () => {
+    const provider = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => provider });
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'PROMPT-ALREADY-COMMITTED' }],
+      promptId: 'prompt-already-committed',
+    });
+    const resumedGenerate = vi.fn(async () => textResult('must not run'));
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.message.content.some(
+            (part) => part.type === 'text' && part.text === 'PROMPT-ALREADY-COMMITTED',
+          ),
+      ),
+      generate: resumedGenerate,
+    });
+    await resumed.agent.resume();
+
+    expect(contextTexts(resumed).match(/PROMPT-ALREADY-COMMITTED/g)).toHaveLength(1);
+    expect(resumedGenerate).not.toHaveBeenCalled();
+    expect(resumed.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('durably consumes an accepted empty retry without creating a visible message', async () => {
+    const provider = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => provider });
+    original.configure();
+    expect(original.agent.turn.retry('test retry')).toBe(0);
+    const resumedGenerate = vi.fn(async () => textResult('must not run'));
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'turn.input_consumed',
+      ),
+      generate: resumedGenerate,
+    });
+    await resumed.agent.resume();
+
+    expect(resumedGenerate).not.toHaveBeenCalled();
+    expect(resumed.agent.context.history).toHaveLength(0);
+    expect(resumed.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('keeps a background steer admitted before a deferred prompt', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => summary });
+    original.appendExchange(1, 'old user', 'old assistant', 40);
+    await original.rpc.beginCompaction({});
+    original.agent.turn.steer(
+      [{ type: 'text', text: 'BACKGROUND-BEFORE-DEFERRED' }],
+      {
+        kind: 'background_task',
+        taskId: 'background-task',
+        status: 'completed',
+        notificationId: 'background-notification',
+      },
+    );
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'DEFERRED-AFTER-BACKGROUND' }],
+      promptId: 'deferred-after-background',
+    });
+
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(structuredClone(persistence.records)),
+      generate: async () => textResult('recovered'),
+    });
+    await resumed.agent.resume();
+    if (resumed.agent.turn.hasActiveTurn) await resumed.agent.turn.waitForCurrentTurn();
+
+    expect(contextTexts(resumed)).toContain('BACKGROUND-BEFORE-DEFERRED');
+  });
+
+  it('delivers a pending steer once after recovering a committed compaction', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => summary });
+    original.configure();
+    original.appendExchange(1, 'old user', 'old assistant', 40);
+    const applied = original.once('context.apply_compaction');
+    await original.rpc.beginCompaction({});
+    original.agent.turn.steer(
+      [{ type: 'text', text: 'BACKGROUND-BEHIND-RECOVERY' }],
+      {
+        kind: 'background_task',
+        taskId: 'recovery-task',
+        status: 'completed',
+        notificationId: 'recovery-notification',
+      },
+    );
+    summary.resolve(textResult('summary'));
+    await applied;
+
+    const histories: Message[][] = [];
+    let runtimeHandlesRestored = false;
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'context.apply_compaction',
+      ),
+      generate: async (_provider, _systemPrompt, _tools, history) => {
+        expect(runtimeHandlesRestored).toBe(true);
+        histories.push(structuredClone(history));
+        return textResult('recovered');
+      },
+    });
+    const ended = resumed.once('turn.ended');
+    await resumed.agent.resume({
+      beforePendingWorkResume: () => {
+        runtimeHandlesRestored = true;
+      },
+    });
+    await ended;
+
+    expect(contextTexts(resumed).match(/BACKGROUND-BEHIND-RECOVERY/g)).toHaveLength(1);
+    expect(
+      histories[0]!
+        .flatMap((message) => message.content)
+        .filter((part) => part.type === 'text' && part.text === 'BACKGROUND-BEHIND-RECOVERY'),
+    ).toHaveLength(1);
+  });
+
+  it('replays a deferred prompt after its activation record but before its context commit', async () => {
+    const summary = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => summary });
+    original.appendExchange(1, 'old user', 'old assistant', 40);
+    await original.rpc.beginCompaction({});
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'DEFERRED-ACTIVATION-PREFIX' }],
+      promptId: 'deferred-activation-prefix',
+    });
+    summary.resolve(textResult('summary'));
+    await original.once('turn.started');
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'turn.deferred_prompt_started',
+      ),
+      generate: async () => textResult('recovered'),
+    });
+    await resumed.agent.resume();
+
+    expect(contextTexts(resumed)).toContain('DEFERRED-ACTIVATION-PREFIX');
+  });
+
+  it('keeps an unowned background steer when replay stops immediately after owner cancellation', async () => {
+    const provider = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: () => provider });
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'CANCELLED-OWNER' }],
+      promptId: 'cancelled-owner',
+    });
+    original.agent.turn.steer(
+      [{ type: 'text', text: 'BACKGROUND-SURVIVES-CANCEL' }],
+      {
+        kind: 'background_task',
+        taskId: 'cancel-task',
+        status: 'completed',
+        notificationId: 'cancel-notification',
+      },
+    );
+    void original.rpc.cancel({
+      expectedPromptId: 'cancelled-owner',
+      requireActive: true,
+    });
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'turn.cancel',
+      ),
+      generate: async () => textResult('recovered'),
+    });
+    await resumed.agent.resume();
+
+    expect(contextTexts(resumed)).toContain('BACKGROUND-SURVIVES-CANCEL');
+  });
+
+  it('does not duplicate a committed steer and replays every later uncommitted steer', async () => {
+    const firstResponse = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const persistence = new InMemoryAgentRecordPersistence();
+    let calls = 0;
+    const original = testAgent({
+      persistence,
+      generate: () => {
+        calls += 1;
+        return calls === 1 ? firstResponse : Promise.resolve(textResult('follow-up complete'));
+      },
+    });
+    await original.rpc.prompt({
+      input: [{ type: 'text', text: 'MULTI-STEER-OWNER' }],
+      promptId: 'multi-steer-owner',
+    });
+    await original.rpc.steer({
+      input: [{ type: 'text', text: 'FIRST-BUFFERED-STEER' }],
+      expectedPromptId: 'multi-steer-owner',
+      requireActive: true,
+    });
+    await original.rpc.steer({
+      input: [{ type: 'text', text: 'SECOND-BUFFERED-STEER' }],
+      expectedPromptId: 'multi-steer-owner',
+      requireActive: true,
+    });
+    firstResponse.resolve(textResult('first response'));
+    await original.agent.turn.waitForCurrentTurn();
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.message.content.some(
+            (part) => part.type === 'text' && part.text === 'FIRST-BUFFERED-STEER',
+          ),
+      ),
+      generate: async () => textResult('recovered'),
+    });
+    await resumed.agent.resume();
+
+    expect(contextTexts(resumed).match(/FIRST-BUFFERED-STEER/g)).toHaveLength(1);
+    expect(contextTexts(resumed).match(/SECOND-BUFFERED-STEER/g)).toHaveLength(1);
+  });
+
+  it('materializes a user interruption after crashing immediately after turn.cancel', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: abortableGenerate });
+    original.configure();
+    const stepStarted = original.once('turn.step.started');
+    await original.rpc.prompt({ input: [{ type: 'text', text: 'WORK-BEFORE-INTERRUPT' }] });
+    await stepStarted;
+    void original.rpc.cancel({ turnId: 0 });
+
+    const histories: Message[][] = [];
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'turn.cancel' && record.outcomeId !== undefined,
+      ),
+      generate: async (_provider, _systemPrompt, _tools, history) => {
+        histories.push(structuredClone(history));
+        return textResult('continued safely');
+      },
+    });
+    await resumed.agent.resume();
+    await resumed.rpc.prompt({ input: [{ type: 'text', text: '继续' }] });
+    await resumed.agent.turn.waitForCurrentTurn();
+
+    expect(contextTexts(resumed).match(/The user interrupted the previous turn/g)).toHaveLength(1);
+    expect(
+      histories[0]!
+        .flatMap((message) => message.content)
+        .filter(
+          (part) =>
+            part.type === 'text' && part.text.includes('The user interrupted the previous turn'),
+        ),
+    ).toHaveLength(1);
+  });
+
+  it('materializes a provider failure after crashing immediately after turn.outcome', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({
+      persistence,
+      generate: async () => {
+        throw new APIStatusError(500, 'temporary provider failure', 'request-outcome-prefix');
+      },
+      ...singleAttemptAgentOptions(),
+    });
+    original.configure();
+    await original.rpc.prompt({ input: [{ type: 'text', text: 'WORK-BEFORE-500' }] });
+    await original.untilTurnEnd();
+
+    const histories: Message[][] = [];
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'turn.outcome',
+      ),
+      generate: async (_provider, _systemPrompt, _tools, history) => {
+        histories.push(structuredClone(history));
+        return textResult('continued after failure');
+      },
+    });
+    await resumed.agent.resume();
+    await resumed.rpc.prompt({ input: [{ type: 'text', text: '继续' }] });
+    await resumed.agent.turn.waitForCurrentTurn();
+
+    expect(contextTexts(resumed).match(/API request failed with HTTP 500/g)).toHaveLength(1);
+    expect(
+      histories[0]!
+        .flatMap((message) => message.content)
+        .filter(
+          (part) => part.type === 'text' && part.text.includes('API request failed with HTTP 500'),
+        ),
+    ).toHaveLength(1);
+  });
+
+  it('joins repeated cancellation and records one outcome reminder', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const ctx = testAgent({ persistence, generate: abortableGenerate });
+    ctx.configure();
+    const stepStarted = ctx.once('turn.step.started');
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'CANCEL-ONCE' }] });
+    await stepStarted;
+
+    const first = ctx.rpc.cancel({ turnId: 0 });
+    const second = ctx.rpc.cancel({ turnId: 0 });
+    await Promise.all([first, second]);
+    await ctx.untilTurnEnd();
+
+    expect(persistence.records.filter((record) => record.type === 'turn.cancel')).toHaveLength(1);
+    expect(
+      persistence.records.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.message.origin?.kind === 'injection' &&
+          record.message.origin.variant === 'turn_outcome',
+      ),
+    ).toHaveLength(1);
+  });
+
+  it('persists an active shutdown outcome in the cancellation record', async () => {
+    const persistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({ persistence, generate: abortableGenerate });
+    original.configure();
+    const stepStarted = original.once('turn.step.started');
+    await original.rpc.prompt({ input: [{ type: 'text', text: 'WORK-BEFORE-SHUTDOWN' }] });
+    await stepStarted;
+    void original.agent.turn.shutdown(abortError('Session process stopped'));
+
+    const resumed = testAgent({
+      persistence: crashPrefixThrough(
+        persistence.records,
+        (record) => record.type === 'turn.cancel' && record.outcomeId !== undefined,
+      ),
+      generate: async () => textResult('continued after restart'),
+    });
+    await resumed.agent.resume();
+
+    expect(contextTexts(resumed).match(/interrupted by the runtime/g)).toHaveLength(1);
+    expect(contextTexts(resumed)).toContain('Session process stopped');
+  });
+
+  it('does not duplicate an outcome acknowledgement accepted before its observer throws', async () => {
+    let throwOnce = true;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (
+          throwOnce &&
+          record.type === 'context.append_message' &&
+          record.materializedTurnOutcomeId !== undefined
+        ) {
+          throwOnce = false;
+          throw new Error('outcome observer failed after acceptance');
+        }
       },
-    },
-    providerManagerOverrides: {
-      resolveOAuthTokenProvider: vi.fn(() => ({ getAccessToken })),
-    },
-  };
-}
+    });
+    let generateCalls = 0;
+    const ctx = testAgent({
+      persistence,
+      generate: async () => {
+        generateCalls += 1;
+        if (generateCalls === 1) {
+          throw new APIStatusError(500, 'first request failed', 'request-accepted-outcome');
+        }
+        return textResult('follow-up complete');
+      },
+      ...singleAttemptAgentOptions(),
+    });
+    ctx.configure();
 
-function textResult(text: string): Awaited<ReturnType<GenerateFn>> {
-  return {
-    id: 'mock-oauth-retry',
-    message: {
-      role: 'assistant',
-      content: [{ type: 'text', text }],
-      toolCalls: [],
-    },
-    usage: {
-      inputOther: 1,
-      output: 1,
-      inputCacheRead: 0,
-      inputCacheCreation: 0,
-    },
-    finishReason: 'completed',
-    rawFinishReason: 'stop',
-  };
-}
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'FAIL-ONCE-FOR-OUTCOME' }] });
+    await ctx.untilTurnEnd();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'FOLLOW-UP-AFTER-OUTCOME' }] });
+    await ctx.agent.turn.waitForCurrentTurn();
 
-describe('abandoned tool exchange teardown', () => {
-  it('closes dangling tool calls when a turn dies mid-batch so follow-up messages are not swallowed', async () => {
-    // A transcript write failure between a recorded tool.call and its paired
-    // tool.result breaks the batch's "every recorded call gets a result"
-    // invariant: the result-dispatch loop dies, the turn fails, and
-    // pendingToolResultIds stays open — stranding every later message in
-    // deferredMessages.
+    expect(
+      persistence.records.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.materializedTurnOutcomeId !== undefined,
+      ),
+    ).toHaveLength(1);
+    expect(contextTexts(ctx).match(/API request failed with HTTP 500/g)).toHaveLength(1);
+    await ctx.expectResumeMatches();
+  });
+
+  it('releases the active turn when terminal persistence hits a diagnostic double fault', async () => {
     const base = new InMemoryAgentRecordPersistence();
-    let failedOnce = false;
     const persistence: AgentRecordPersistence = {
       read: () => base.read(),
-      append: (record: AgentRecord) => {
-        if (
-          !failedOnce &&
-          record.type === 'context.append_loop_event' &&
-          record.event.type === 'tool.result'
-        ) {
-          failedOnce = true;
-          throw new Error('transcript write failed');
+      append: (record) => {
+        const isOutcomeIntent = record.type === 'turn.outcome';
+        const isOutcomeReminder =
+          record.type === 'context.append_message' &&
+          record.message.origin?.kind === 'injection' &&
+          record.message.origin.variant === 'turn_outcome';
+        if (isOutcomeIntent || isOutcomeReminder) {
+          throw markAgentRecordAppendError(
+            new Error('terminal record rejected before acceptance'),
+            false,
+          );
         }
         base.append(record);
       },
@@ -2549,39 +4344,443 @@ describe('abandoned tool exchange teardown', () => {
       flush: () => base.flush(),
       close: () => base.close(),
     };
-    const ctx = testAgent({ kaos: createCommandKaos('ok'), persistence });
-    ctx.configure({ tools: ['Bash'] });
-    await ctx.rpc.setPermission({ mode: 'auto' });
+    const ctx = testAgent({
+      persistence,
+      log: throwingErrorLogger(),
+      generate: async () => ({
+        id: null,
+        message: {
+          role: 'assistant',
+          content: [{ type: 'text', text: 'filtered terminal response' }],
+          toolCalls: [],
+        },
+        usage: {
+          inputOther: 10,
+          output: 5,
+          inputCacheRead: 0,
+          inputCacheCreation: 0,
+        },
+        finishReason: 'filtered',
+        rawFinishReason: 'content_filter',
+      }),
+    });
+    ctx.configure();
 
-    ctx.mockNextResponse(
-      { type: 'text', text: 'I will run both commands.' },
-      bashCallWithId('call_one', 'echo one'),
-      bashCallWithId('call_two', 'echo two'),
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'TERMINAL-PERSISTENCE-DOUBLE-FAULT' }] });
+    const ended = await ctx.untilTurnEnd();
+
+    expect(ended).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({
+          reason: 'failed',
+          error: expect.objectContaining({ code: 'provider.filtered' }),
+        }),
+      }),
     );
-    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'run both' }] });
-    const events = await ctx.untilTurnEnd();
-    expect(events).toContainEqual(
+    expect(ctx.agent.turn.hasActiveTurn).toBe(false);
+    expect(base.records.filter((record) => record.type === 'turn.outcome')).toHaveLength(0);
+    expect(
+      base.records.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.message.origin?.kind === 'injection' &&
+          record.message.origin.variant === 'turn_outcome',
+      ),
+    ).toHaveLength(0);
+    const resumedGenerate = vi.fn(async () => textResult('must not run'));
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(structuredClone(base.records)),
+      generate: resumedGenerate,
+    });
+    await resumed.agent.resume();
+    expect(resumedGenerate).not.toHaveBeenCalled();
+    expect(contextTexts(resumed)).toBe(contextTexts(ctx));
+  });
+
+  it('still completes a turn when its initial context record observer fails after acceptance', async () => {
+    let throwOnce = true;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (
+          throwOnce &&
+          record.type === 'context.append_message' &&
+          record.consumedTurnInput?.kind === 'prompt'
+        ) {
+          throwOnce = false;
+          throw new Error('initial context observer failed after acceptance');
+        }
+      },
+    });
+    const ctx = testAgent({ persistence });
+    ctx.configure();
+    ctx.mockNextResponse({ type: 'text', text: 'completed despite observer failure' });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'POSTACCEPT-INITIAL-PROMPT' }] });
+    const ended = await ctx.untilTurnEnd();
+
+    expect(ended).toContainEqual(
       expect.objectContaining({
         event: 'turn.ended',
-        args: expect.objectContaining({ reason: 'failed' }),
+        args: expect.objectContaining({ reason: 'completed' }),
       }),
     );
+    expect(contextTexts(ctx).match(/POSTACCEPT-INITIAL-PROMPT/g)).toHaveLength(1);
+    await ctx.expectResumeMatches();
+  });
 
-    // Every recorded tool.call must still get a result: the turn teardown
-    // synthesizes an error result for each dangling call.
-    const toolMessages = ctx.agent.context.history.filter((message) => message.role === 'tool');
-    expect(toolMessages.map((message) => message.toolCallId)).toEqual(['call_one', 'call_two']);
-    for (const message of toolMessages) {
-      expect(message.isError).toBe(true);
-    }
+  it('completes a durably accepted prompt after an admission diagnostic double fault', async () => {
+    let throwOnce = true;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (throwOnce && record.type === 'turn.prompt') {
+          throwOnce = false;
+          throw new Error('prompt observer failed after acceptance');
+        }
+      },
+    });
+    const ctx = testAgent({ persistence, log: throwingWarnLogger() });
+    ctx.configure();
+    ctx.mockNextResponse({ type: 'text', text: 'completed after diagnostic double fault' });
 
-    // With the exchange closed, a follow-up message reaches the history instead
-    // of being stranded in deferredMessages forever.
-    ctx.agent.context.appendMessage({
-      role: 'user',
-      content: [{ type: 'text', text: 'follow-up after failure' }],
-      toolCalls: [],
+    await expect(
+      ctx.rpc.prompt({ input: [{ type: 'text', text: 'POSTACCEPT-PROMPT-DOUBLE-FAULT' }] }),
+    ).resolves.toEqual({ kind: 'started', turnId: 0 });
+    const ended = await ctx.untilTurnEnd();
+
+    expect(ended).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'completed' }),
+      }),
+    );
+    expect(persistence.records.filter((record) => record.type === 'turn.prompt')).toHaveLength(1);
+    expect(contextTexts(ctx).match(/POSTACCEPT-PROMPT-DOUBLE-FAULT/g)).toHaveLength(1);
+    await ctx.expectResumeMatches();
+  });
+
+  it('reserves launch while materializing an older outcome before prompt admission', async () => {
+    let ctx!: TestAgentContext;
+    let nestedPrompt: number | null | undefined;
+    let nestedCancellation: Promise<void> | undefined;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (
+          record.type !== 'context.append_message' ||
+          record.materializedTurnOutcomeId !== 'older-outcome'
+        ) {
+          return;
+        }
+        nestedPrompt = ctx.agent.turn.prompt([{ type: 'text', text: 'REENTRANT-PROMPT' }]);
+        nestedCancellation = ctx.agent.turn.cancel();
+      },
     });
-    expect(JSON.stringify(ctx.agent.context.history)).toContain('follow-up after failure');
+    ctx = testAgent({ persistence });
+    ctx.configure();
+    ctx.agent.turn.restoreOutcome(
+      'older-outcome',
+      0,
+      'OLDER-OUTCOME-MUST-PRECEDE-THE-NEW-PROMPT',
+    );
+    ctx.mockNextResponse({ type: 'text', text: 'outer completed' });
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'OUTER-PROMPT' }] });
+    await ctx.agent.turn.waitForCurrentTurn();
+    await nestedCancellation;
+
+    expect(nestedPrompt).toBeNull();
+    expect(persistence.records.filter((record) => record.type === 'turn.cancel')).toHaveLength(0);
+    expect(persistence.records.filter((record) => record.type === 'turn.prompt')).toHaveLength(1);
+    expect(
+      persistence.records.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.materializedTurnOutcomeId === 'older-outcome',
+      ),
+    ).toHaveLength(1);
+    const outcomeIndex = persistence.records.findIndex(
+      (record) =>
+        record.type === 'context.append_message' &&
+        record.materializedTurnOutcomeId === 'older-outcome',
+    );
+    const promptIndex = persistence.records.findIndex((record) => record.type === 'turn.prompt');
+    expect(outcomeIndex).toBeLessThan(promptIndex);
+    expect(contextTexts(ctx).match(/OLDER-OUTCOME-MUST-PRECEDE/g)).toHaveLength(1);
+  });
+
+  it('holds the resume reservation while materializing a recovered outcome', async () => {
+    const originalPersistence = new InMemoryAgentRecordPersistence();
+    const original = testAgent({
+      persistence: originalPersistence,
+      generate: async () => {
+        throw new APIStatusError(500, 'resume barrier failure', 'request-resume-barrier');
+      },
+      ...singleAttemptAgentOptions(),
+    });
+    original.configure();
+    await original.rpc.prompt({ input: [{ type: 'text', text: 'BEFORE-RESUME-BARRIER' }] });
+    await original.untilTurnEnd();
+    const outcomeIndex = originalPersistence.records.findIndex(
+      (record) => record.type === 'turn.outcome',
+    );
+    expect(outcomeIndex).toBeGreaterThanOrEqual(0);
+
+    let resumed!: TestAgentContext;
+    let nestedPrompt: number | null | undefined;
+    let nestedCancellation: Promise<void> | undefined;
+    const persistence = new InMemoryAgentRecordPersistence(
+      structuredClone(originalPersistence.records.slice(0, outcomeIndex + 1)),
+      {
+        onRecord: (record) => {
+          if (
+            record.type !== 'context.append_message' ||
+            record.materializedTurnOutcomeId === undefined
+          ) {
+            return;
+          }
+          nestedPrompt = resumed.agent.turn.prompt([
+            { type: 'text', text: 'REENTRANT-DURING-RESUME' },
+          ]);
+          nestedCancellation = resumed.agent.turn.cancel();
+        },
+      },
+    );
+    resumed = testAgent({ persistence, generate: async () => textResult('must not run') });
+
+    await resumed.agent.resume();
+    await nestedCancellation;
+
+    expect(nestedPrompt).toBeNull();
+    expect(resumed.agent.turn.hasActiveTurn).toBe(false);
+    expect(
+      persistence.records.filter(
+        (record) =>
+          record.type === 'context.append_message' &&
+          record.materializedTurnOutcomeId !== undefined,
+      ),
+    ).toHaveLength(1);
+    expect(contextTexts(resumed).match(/API request failed with HTTP 500/g)).toHaveLength(1);
+  });
+
+  it('keeps a partial prompt expansion running when re-entrant cancellation is rejected before acceptance', async () => {
+    const providerStarted = createControlledPromise<void>();
+    const providerResult = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let ctx!: TestAgentContext;
+    let cancellation: Promise<void> | undefined;
+    const { base, persistence } = rejectFirstTurnCancelPersistence((record) => {
+      if (record.type === 'context.append_message' && record.turnInputPart?.index === 0) {
+        cancellation = ctx.agent.turn.cancel(record.turnInputPart.consumedTurnInput.turnId);
+      }
+    });
+    ctx = testAgent({
+      persistence,
+      generate: async () => {
+        providerStarted.resolve();
+        return providerResult;
+      },
+    });
+    ctx.configure();
+    const ended = ctx.untilTurnEnd();
+    const caption = buildImageCompressionCaption({
+      original: { width: 3000, height: 2000, byteLength: 500_000, mimeType: 'image/png' },
+      final: { width: 1500, height: 1000, byteLength: 200_000, mimeType: 'image/png' },
+    });
+
+    await ctx.rpc.prompt({
+      input: [{ type: 'text', text: `KEEP-RUNNING-AFTER-REJECTED-CANCEL${caption}` }],
+    });
+    await providerStarted;
+    await expect(cancellation).rejects.toThrow('turn.cancel rejected before acceptance');
+
+    expect(ctx.agent.turn.hasActiveTurn).toBe(true);
+    expect(base.records.filter((record) => record.type === 'turn.cancel')).toHaveLength(0);
+    providerResult.resolve(textResult('completed after rejected cancellation'));
+    expect(await ended).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'completed' }),
+      }),
+    );
+    expect(contextTexts(ctx)).not.toContain('interrupted the previous turn');
+    expect(base.records.filter((record) => record.type === 'turn.outcome')).toHaveLength(0);
+    const resumedGenerate = vi.fn(async () => textResult('must not run'));
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(structuredClone(base.records)),
+      generate: resumedGenerate,
+    });
+    await resumed.agent.resume();
+    expect(resumedGenerate).not.toHaveBeenCalled();
+    expect(contextTexts(resumed)).toBe(contextTexts(ctx));
+  });
+
+  it('rolls back shutdown when its cancellation record is rejected before acceptance', async () => {
+    const providerStarted = createControlledPromise<void>();
+    const providerResult = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    const { base, persistence } = rejectFirstTurnCancelPersistence();
+    const ctx = testAgent({
+      persistence,
+      generate: async () => {
+        providerStarted.resolve();
+        return providerResult;
+      },
+    });
+    ctx.configure();
+    const ended = ctx.untilTurnEnd();
+
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'KEEP-RUNNING-AFTER-REJECTED-SHUTDOWN' }] });
+    await providerStarted;
+    await ctx.rpc.steer({ input: [{ type: 'text', text: 'PRESERVE-BUFFERED-STEER' }] });
+    await expect(ctx.agent.turn.shutdown(new Error('runtime stopped'))).rejects.toThrow(
+      'turn.cancel rejected before acceptance',
+    );
+
+    expect(ctx.agent.turn.isClosed).toBe(false);
+    expect(ctx.agent.turn.hasActiveTurn).toBe(true);
+    expect(base.records.filter((record) => record.type === 'turn.cancel')).toHaveLength(0);
+    providerResult.resolve(textResult('completed after rejected shutdown'));
+    expect(await ended).toContainEqual(
+      expect.objectContaining({
+        event: 'turn.ended',
+        args: expect.objectContaining({ reason: 'completed' }),
+      }),
+    );
+    expect(contextTexts(ctx)).not.toContain('interrupted by the runtime');
+    expect(contextTexts(ctx).match(/PRESERVE-BUFFERED-STEER/g)).toHaveLength(1);
+    expect(base.records.filter((record) => record.type === 'turn.outcome')).toHaveLength(0);
+    const resumedGenerate = vi.fn(async () => textResult('must not run'));
+    const resumed = testAgent({
+      persistence: new InMemoryAgentRecordPersistence(structuredClone(base.records)),
+      generate: resumedGenerate,
+    });
+    await resumed.agent.resume();
+    expect(resumedGenerate).not.toHaveBeenCalled();
+    expect(contextTexts(resumed)).toBe(contextTexts(ctx));
+  });
+
+  it('keeps a buffered steer after an admission diagnostic double fault', async () => {
+    const firstResponse = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let throwOnce = true;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (throwOnce && record.type === 'turn.steer') {
+          throwOnce = false;
+          throw new Error('steer observer failed after acceptance');
+        }
+      },
+    });
+    let calls = 0;
+    const ctx = testAgent({
+      persistence,
+      log: throwingWarnLogger(),
+      generate: async () => {
+        calls += 1;
+        return calls === 1 ? firstResponse : textResult('steer handled');
+      },
+    });
+    ctx.configure();
+    await ctx.rpc.prompt({ input: [{ type: 'text', text: 'STEER-OWNER' }] });
+
+    await expect(
+      ctx.rpc.steer({ input: [{ type: 'text', text: 'POSTACCEPT-BUFFERED-STEER' }] }),
+    ).resolves.toBeUndefined();
+    firstResponse.resolve(textResult('first response'));
+    await ctx.agent.turn.waitForCurrentTurn();
+
+    expect(contextTexts(ctx).match(/POSTACCEPT-BUFFERED-STEER/g)).toHaveLength(1);
+    expect(persistence.records.filter((record) => record.type === 'turn.steer')).toHaveLength(1);
+    await ctx.expectResumeMatches();
+  });
+
+  it('keeps a deferred prompt whose durable admission observer fails afterward', async () => {
+    const compactionResponse = createControlledPromise<Awaited<ReturnType<GenerateFn>>>();
+    let throwOnce = true;
+    const persistence = new InMemoryAgentRecordPersistence([], {
+      onRecord: (record) => {
+        if (
+          throwOnce &&
+          record.type === 'turn.prompt' &&
+          record.input.some(
+            (part) => part.type === 'text' && part.text === 'POSTACCEPT-DEFERRED-PROMPT',
+          )
+        ) {
+          throwOnce = false;
+          throw new Error('deferred prompt observer failed after acceptance');
+        }
+      },
+    });
+    let calls = 0;
+    const ctx = testAgent({
+      persistence,
+      generate: async () => {
+        calls += 1;
+        return calls === 1 ? compactionResponse : textResult('deferred prompt handled');
+      },
+    });
+    ctx.configure();
+    ctx.appendExchange(1, 'old user', 'old assistant', 100);
+    await ctx.rpc.beginCompaction({});
+
+    await expect(
+      ctx.rpc.prompt({ input: [{ type: 'text', text: 'POSTACCEPT-DEFERRED-PROMPT' }] }),
+    ).resolves.toMatchObject({ kind: 'deferred' });
+    const ended = ctx.once('turn.ended');
+    compactionResponse.resolve(textResult('summary'));
+    await ended;
+
+    expect(contextTexts(ctx).match(/POSTACCEPT-DEFERRED-PROMPT/g)).toHaveLength(1);
+    expect(
+      persistence.records.filter(
+        (record) =>
+          record.type === 'turn.prompt' &&
+          record.input.some(
+            (part) => part.type === 'text' && part.text === 'POSTACCEPT-DEFERRED-PROMPT',
+          ),
+      ),
+    ).toHaveLength(1);
+    await ctx.expectResumeMatches();
   });
 });
+
+function crashPrefixThrough(
+  records: readonly AgentRecord[],
+  predicate: (record: AgentRecord) => boolean,
+): InMemoryAgentRecordPersistence {
+  const index = records.findIndex(predicate);
+  if (index === -1) throw new Error('crash-prefix boundary not found');
+  return new InMemoryAgentRecordPersistence(structuredClone(records.slice(0, index + 1)));
+}
+
+function contextTexts(ctx: TestAgentContext): string {
+  return ctx.agent.context.history
+    .flatMap((message) => message.content)
+    .filter((part) => part.type === 'text')
+    .map((part) => part.text)
+    .join('\n');
+}
+
+function rejectFirstTurnCancelPersistence(
+  onRecord?: (record: AgentRecord) => void,
+): { base: InMemoryAgentRecordPersistence; persistence: AgentRecordPersistence } {
+  const base = new InMemoryAgentRecordPersistence();
+  let rejectCancel = true;
+  const persistence: AgentRecordPersistence = {
+    read: () => base.read(),
+    append: (record) => {
+      if (rejectCancel && record.type === 'turn.cancel') {
+        rejectCancel = false;
+        throw markAgentRecordAppendError(
+          new Error('turn.cancel rejected before acceptance'),
+          false,
+        );
+      }
+      base.append(record);
+      onRecord?.(record);
+    },
+    rewrite: (records) => {
+      base.rewrite(records);
+    },
+    flush: () => base.flush(),
+    close: () => base.close(),
+  };
+  return { base, persistence };
+}
diff --git a/packages/agent-core/test/harness/skill-session.test.ts b/packages/agent-core/test/harness/skill-session.test.ts
index 223fe64dcc..76208ce373 100644
--- a/packages/agent-core/test/harness/skill-session.test.ts
+++ b/packages/agent-core/test/harness/skill-session.test.ts
@@ -466,6 +466,24 @@ describe('HarnessAPI session skills', () => {
           skillSource: 'project',
         },
       },
+      {
+        role: 'user',
+        content: [
+          {
+            type: 'text',
+            text: [
+              '<system-reminder>',
+              'The previous turn ended before producing a final response.',
+              '',
+              'Error: No model is configured.',
+              '',
+              'The preceding user request may still be unfinished. Treat the next user message as a follow-up.',
+              '</system-reminder>',
+            ].join('\n'),
+          },
+        ],
+        origin: { kind: 'injection', variant: 'turn_outcome' },
+      },
     ]);
     const replay = resumed.agents['main']?.replay ?? [];
     expect(replay).toContainEqual(
diff --git a/packages/agent-core/test/loop/fixtures/helpers.ts b/packages/agent-core/test/loop/fixtures/helpers.ts
index f8c1a2036d..03830dbe3a 100644
--- a/packages/agent-core/test/loop/fixtures/helpers.ts
+++ b/packages/agent-core/test/loop/fixtures/helpers.ts
@@ -27,6 +27,7 @@ export interface RunTurnOptions {
   readonly contextOptions?: RecordingContextOptions | undefined;
   readonly sinkErrorMode?: SinkErrorMode | undefined;
   readonly recordStepUsage?: RunTurnInput['recordStepUsage'] | undefined;
+  readonly buildLlm?: NonNullable<RunTurnInput['buildLlm']>;
 }
 
 export interface RunTurnResult {
@@ -55,6 +56,7 @@ export async function runTurn(opts: RunTurnOptions): Promise<RunTurnResult> {
     turnId: opts.turnId ?? 'turn-1',
     signal: opts.signal ?? new AbortController().signal,
     llm,
+    buildLlm: opts.buildLlm,
     buildMessages: context.buildMessages,
     dispatchEvent: createLoopEventDispatcher({
       appendTranscriptRecord: context.appendTranscriptRecord,
@@ -94,6 +96,7 @@ export async function runTurnExpectingThrow(opts: RunTurnOptions): Promise<{
     turnId: opts.turnId ?? 'turn-1',
     signal: opts.signal ?? new AbortController().signal,
     llm,
+    buildLlm: opts.buildLlm,
     buildMessages: context.buildMessages,
     dispatchEvent: createLoopEventDispatcher({
       appendTranscriptRecord: context.appendTranscriptRecord,
diff --git a/packages/agent-core/test/loop/hooks.e2e.test.ts b/packages/agent-core/test/loop/hooks.e2e.test.ts
index 981d17fb96..16dfef8ca8 100644
--- a/packages/agent-core/test/loop/hooks.e2e.test.ts
+++ b/packages/agent-core/test/loop/hooks.e2e.test.ts
@@ -9,7 +9,12 @@ import { describe, expect, it, vi } from 'vitest';
 
 import type { LoopHooks, ExecutableToolResult, ToolExecution } from '../../src/loop/index';
 import { PathSecurityError } from '../../src/tools/policies/path-access';
-import { makeEndTurnResponse, makeToolCall, makeToolUseResponse } from './fixtures/fake-llm';
+import {
+  FakeLLM,
+  makeEndTurnResponse,
+  makeToolCall,
+  makeToolUseResponse,
+} from './fixtures/fake-llm';
 import { runTurn, runTurnExpectingThrow } from './fixtures/helpers';
 import { EchoTool, FailingTool, type EchoInput } from './fixtures/tools';
 
@@ -496,6 +501,28 @@ describe('runTurn — shouldContinueAfterStop hook', () => {
     expect(shouldContinueAfterStop).toHaveBeenCalledTimes(1);
   });
 
+  it('receives the LLM instance that executed the stopped step', async () => {
+    const rebuiltLlm = new FakeLLM({
+      modelName: 'rebuilt-model',
+      responses: [makeEndTurnResponse('ok')],
+    });
+    const observedLlms: unknown[] = [];
+    const { llm: initialLlm } = await runTurn({
+      responses: [makeEndTurnResponse('unused')],
+      buildLlm: () => rebuiltLlm,
+      hooks: {
+        shouldContinueAfterStop: async (ctx) => {
+          observedLlms.push(ctx.llm);
+          return { continue: false };
+        },
+      },
+    });
+
+    expect(initialLlm.callCount).toBe(0);
+    expect(rebuiltLlm.callCount).toBe(1);
+    expect(observedLlms).toEqual([rebuiltLlm]);
+  });
+
   it('continue:true allows another step after a non-tool stopReason', async () => {
     const shouldContinueAfterStop = vi
       .fn()
diff --git a/packages/agent-core/test/services/message-transcript.test.ts b/packages/agent-core/test/services/message-transcript.test.ts
index c2655bf9d1..cb3a8daa2b 100644
--- a/packages/agent-core/test/services/message-transcript.test.ts
+++ b/packages/agent-core/test/services/message-transcript.test.ts
@@ -3,9 +3,10 @@
  *
  * Coverage:
  *   - reduceWireRecords: append + loop events; compaction keeps the prefix and
- *     inserts the summary at the fold point; undo (skip injections, stop at
- *     compaction summaries and clear floors); clear resets the folded view but
- *     keeps the transcript; deferred messages during an open tool exchange;
+ *     inserts the summary at the fold point; undo (preserve state injections,
+ *     remove turn outcomes, stop at compaction summaries and clear floors);
+ *     clear resets the folded view but keeps the transcript; deferred messages
+ *     during an open tool exchange;
  *     tool.result `<system>` status wrapping
  *   - readWireRecords: tolerates a torn final line, throws on mid-file corruption
  *   - readWireTranscript: blobref → data URI rehydration from the blobs dir
@@ -296,6 +297,24 @@ describe('reduceWireRecords', () => {
     expect(foldedLength).toBe(3);
   });
 
+  it('undo removes a turn outcome reminder with its real user prompt', () => {
+    const { entries, foldedLength } = reduceWireRecords([
+      appendMessage(userMessage('u1')),
+      ...assistantStep('s1', 'a1'),
+      appendMessage(userMessage('u2')),
+      appendMessage(
+        userMessage('previous turn failed', {
+          kind: 'injection',
+          variant: 'turn_outcome',
+        }),
+      ),
+      { type: 'context.undo', count: 1 } as AgentRecord,
+    ]);
+
+    expect(entries.map((entry) => textOf(entry.message))).toEqual(['u1', 'a1']);
+    expect(foldedLength).toBe(2);
+  });
+
   it('undo stops at a compaction summary boundary', () => {
     const { entries } = reduceWireRecords([
       appendMessage(userMessage('u1')),
diff --git a/packages/agent-core/test/services/prompt-service.test.ts b/packages/agent-core/test/services/prompt-service.test.ts
index 449f28b514..119b45ea5d 100644
--- a/packages/agent-core/test/services/prompt-service.test.ts
+++ b/packages/agent-core/test/services/prompt-service.test.ts
@@ -10,16 +10,19 @@
  * Coverage:
  *   - submit returns PromptItem with status='running' or status='queued'
  *   - submit registers an active prompt → second submit enters daemon queue
+ *   - concurrent submit startup preserves one active prompt and FIFO queueing
  *   - submit translates protocol content → kosong content (text + image_url)
  *   - submit on unknown sid → SessionNotFoundError
  *   - submit on a session with an active completed/aborted prompt succeeds
  *   - bus.publish of `turn.started` captures turnId (via PromptService subscriber)
  *   - bus.publish of `turn.ended` (top-level, completed) synthesizes prompt.completed
  *   - bus.publish of `turn.ended` with reason=cancelled synthesizes prompt.aborted
+ *   - goal continuation turns retain one prompt until a verified terminal boundary
  *   - bus.publish of nested turn.ended ignored (non-top-level)
  *   - bus.publish on events for an unknown session is a no-op
  *   - abort() rejects PromptNotFoundError when no active prompt
  *   - abort() returns {aborted: true} + publishes prompt.aborted
+ *   - abort owns queue draining until cancellation settles, including failure recovery
  *   - second abort() → PromptAlreadyCompletedError (40903)
  *   - busy submit queues instead of throwing; list returns active + queued
  *   - steer removes queued prompts and dispatches core.rpc.steer
@@ -29,6 +32,7 @@
  *     reseed after session close, agent.status.updated mirrors into shadow.
  */
 
+import { createControlledPromise } from '@antfu/utils';
 import { describe, expect, it, vi } from 'vitest';
 
 import { Emitter } from '../../src';
@@ -36,6 +40,7 @@ import { Emitter } from '../../src';
 import type {
   CoreRPC,
   Event,
+  GoalToolResult,
   SessionSummary,
 } from '../../src';
 import type { PromptSubmission, Session } from '@moonshot-ai/protocol';
@@ -49,12 +54,38 @@ import {
   PromptAlreadyCompletedError,
   PromptNotFoundError,
   PromptService,
+  SessionBusyError,
   SessionNotFoundError,
 } from '../../src/services';
 
 const SID = 'sess_01PT';
 const SESSION_CREATED_AT = 1_700_000_000_000;
 
+function goalResult(status: 'active' | 'blocked' | 'paused'): GoalToolResult {
+  return {
+    goal: {
+      goalId: 'goal_1',
+      objective: 'Finish the current task',
+      status,
+      turnsUsed: 1,
+      tokensUsed: 100,
+      wallClockMs: 1_000,
+      budget: {
+        tokenBudget: null,
+        turnBudget: null,
+        wallClockBudgetMs: null,
+        remainingTokens: null,
+        remainingTurns: null,
+        remainingWallClockMs: null,
+        tokenBudgetReached: false,
+        turnBudgetReached: false,
+        wallClockBudgetReached: false,
+        overBudget: false,
+      },
+    },
+  };
+}
+
 function mkSummary(id = SID): SessionSummary {
   return {
     id,
@@ -112,6 +143,7 @@ interface RpcRecord {
   pauseGoalCalls: unknown[];
   resumeGoalCalls: unknown[];
   cancelGoalCalls: unknown[];
+  getGoalCalls: unknown[];
   getConfigCalls: number;
   getPermissionCalls: number;
   getPlanCalls: number;
@@ -124,6 +156,8 @@ interface BridgeStubOptions {
   plan?: null | { id: string; content: string; path: string };
   sessions?: SessionSummary[];
   onPrompt?: (payload: unknown) => void | Promise<void>;
+  onCancel?: (payload: unknown) => void | Promise<void>;
+  onGetGoal?: (payload: unknown) => GoalToolResult | Promise<GoalToolResult>;
 }
 
 function makeBridge(
@@ -146,6 +180,7 @@ function makeBridge(
     pauseGoalCalls: [],
     resumeGoalCalls: [],
     cancelGoalCalls: [],
+    getGoalCalls: [],
     getConfigCalls: 0,
     getPermissionCalls: 0,
     getPlanCalls: 0,
@@ -179,6 +214,11 @@ function makeBridge(
     }),
     cancel: vi.fn().mockImplementation(async (payload) => {
       record.cancelCalls.push(payload);
+      await opts.onCancel?.(payload);
+    }),
+    getGoal: vi.fn().mockImplementation(async (payload) => {
+      record.getGoalCalls.push(payload);
+      return opts.onGetGoal?.(payload) ?? { goal: null };
     }),
     getConfig: vi.fn().mockImplementation(async () => {
       record.getConfigCalls += 1;
@@ -340,6 +380,12 @@ class NoopLogService implements ILogService {
   }
 }
 
+class ThrowingWarnLogService extends NoopLogService {
+  override warn(): void {
+    throw new Error('warning sink failed');
+  }
+}
+
 function newSvc(
   bridge: ICoreProcessService,
   bus: IEventService,
@@ -491,6 +537,221 @@ describe('PromptService.submit', () => {
     expect(listed.queued.map((p) => p.prompt_id)).toEqual([second.prompt_id]);
   });
 
+  it('serializes concurrent submits while the first prompt is still starting', async () => {
+    const goalReadStarted = createControlledPromise<void>();
+    const releaseGoalRead = createControlledPromise<GoalToolResult>();
+    const { bridge, record } = makeBridge({
+      onGetGoal: () => {
+        goalReadStarted.resolve();
+        return releaseGoalRead;
+      },
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const firstResult = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    await goalReadStarted;
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+
+    expect(second.status).toBe('queued');
+    expect(record.promptCalls).toHaveLength(0);
+    releaseGoalRead.resolve({ goal: null });
+    await expect(firstResult).resolves.toMatchObject({ status: 'running' });
+    expect(record.promptCalls).toHaveLength(1);
+  });
+
+  it('keeps the earlier follower ahead when its preflight finishes after a later follower', async () => {
+    const earlierResumeStarted = createControlledPromise<void>();
+    const releaseEarlierResume = createControlledPromise<void>();
+    const earlierPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'earlier follower') earlierPromptStarted.resolve();
+      },
+    });
+    let resumeCalls = 0;
+    vi.mocked(bridge.rpc.resumeSession).mockImplementation(async () => {
+      resumeCalls += 1;
+      if (resumeCalls === 2) {
+        earlierResumeStarted.resolve();
+        await releaseEarlierResume;
+      }
+      return undefined as never;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+
+    const earlierResult = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'earlier follower' }] }),
+    );
+    await earlierResumeStarted;
+    const later = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'later follower' }] }),
+    );
+    releaseEarlierResume.resolve();
+    const earlier = await earlierResult;
+
+    expect((await impl.list(SID)).queued.map((item) => item.prompt_id)).toEqual([
+      earlier.prompt_id,
+      later.prompt_id,
+    ]);
+
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 1,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await earlierPromptStarted;
+
+    expect(record.promptCalls[1]).toEqual({
+      sessionId: SID,
+      agentId: 'main',
+      input: [{ type: 'text', text: 'earlier follower' }],
+      promptId: earlier.prompt_id,
+    });
+  });
+
+  it('starts the queued prompt when active-prompt setup fails', async () => {
+    const goalReadStarted = createControlledPromise<void>();
+    const releaseGoalRead = createControlledPromise<GoalToolResult>();
+    const nextPromptStarted = createControlledPromise<void>();
+    let goalRead = 0;
+    const { bridge } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 1) {
+          goalReadStarted.resolve();
+          return releaseGoalRead;
+        }
+        return { goal: null };
+      },
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const firstResult = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    await goalReadStarted;
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+    const firstRejected = expect(firstResult).rejects.toThrow('goal lookup failed');
+    releaseGoalRead.reject(new Error('goal lookup failed'));
+
+    await firstRejected;
+    await nextPromptStarted;
+
+    expect(second.status).toBe('queued');
+    expect((await impl.list(SID)).active?.prompt_id).toBe(second.prompt_id);
+  });
+
+  it('advances after emitting exactly one failed completion for a queued startup failure', async () => {
+    const thirdPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'fails during startup') {
+          throw new Error('queued startup failed');
+        }
+        if (text === 'third') thirdPromptStarted.resolve();
+      },
+    });
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    const failed = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'fails during startup' }] }),
+    );
+    const third = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'third' }] }),
+    );
+
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 1,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await thirdPromptStarted;
+
+    const failedCompletions = events.filter((event) => {
+      const candidate = event as unknown as {
+        type?: string;
+        promptId?: string;
+        reason?: string;
+      };
+      return candidate.type === 'prompt.completed' && candidate.promptId === failed.prompt_id;
+    });
+    expect(failedCompletions).toHaveLength(1);
+    expect(failedCompletions[0]).toMatchObject({ reason: 'failed' });
+    expect((await impl.list(SID)).active?.prompt_id).toBe(third.prompt_id);
+    expect(
+      record.promptCalls.map(
+        (payload) => (payload as { input: Array<{ text?: string }> }).input[0]?.text,
+      ),
+    ).toEqual(['active', 'fails during startup', 'third']);
+  });
+
+  it('starts an agent-scoped prompt without querying main-agent goal state', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const result = await impl.submit(
+      SID,
+      mkBodyMinimal({
+        agent_id: 'agent_btw',
+        content: [{ type: 'text', text: 'side question' }],
+      }),
+    );
+
+    expect(result.status).toBe('running');
+    expect(record.getGoalCalls).toHaveLength(0);
+    expect(record.promptCalls).toHaveLength(1);
+  });
+
   it('runs an agent-scoped prompt without queueing behind the main prompt', async () => {
     const { bridge, record } = makeBridge();
     const { bus, events } = makeBus();
@@ -511,8 +772,18 @@ describe('PromptService.submit', () => {
     expect(listed.active?.prompt_id).toBe(main.prompt_id);
     expect(listed.queued).toHaveLength(0);
     expect(record.promptCalls).toEqual([
-      { sessionId: SID, agentId: 'main', input: [{ type: 'text', text: 'main' }] },
-      { sessionId: SID, agentId: 'agent_btw', input: [{ type: 'text', text: 'side question' }] },
+      {
+        sessionId: SID,
+        agentId: 'main',
+        input: [{ type: 'text', text: 'main' }],
+        promptId: main.prompt_id,
+      },
+      {
+        sessionId: SID,
+        agentId: 'agent_btw',
+        input: [{ type: 'text', text: 'side question' }],
+        promptId: btw.prompt_id,
+      },
     ]);
     const submitted = events.filter((event) => event.type === 'prompt.submitted') as Array<{
       type: 'prompt.submitted';
@@ -548,7 +819,13 @@ describe('PromptService.submit', () => {
   });
 
   it('starts the next queued prompt after the active prompt completes', async () => {
-    const { bridge, record } = makeBridge();
+    const nextPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
     const { bus, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
     const first = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }));
@@ -568,13 +845,14 @@ describe('PromptService.submit', () => {
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    await Promise.resolve();
+    await nextPromptStarted;
 
     expect(record.promptCalls).toHaveLength(2);
     expect(record.promptCalls[1]).toEqual({
       sessionId: SID,
       agentId: 'main',
       input: [{ type: 'text', text: 'two' }],
+      promptId: second.prompt_id,
     });
     const listed = await impl.list(SID);
     expect(listed.active?.prompt_id).toBe(second.prompt_id);
@@ -610,7 +888,10 @@ describe('PromptService.submit', () => {
     await impl.submit(SID, mkBody());
     const resumeMock = bridge.rpc.resumeSession as ReturnType<typeof vi.fn>;
     const promptMock = bridge.rpc.prompt as ReturnType<typeof vi.fn>;
-    expect(resumeMock).toHaveBeenCalledWith({ sessionId: SID });
+    expect(resumeMock).toHaveBeenCalledWith(
+      { sessionId: SID },
+      { signal: expect.any(AbortSignal) },
+    );
     const resumeOrder = resumeMock.mock.invocationCallOrder[0];
     const promptOrder = promptMock.mock.invocationCallOrder[0];
     expect(resumeOrder).toBeDefined();
@@ -629,6 +910,38 @@ describe('PromptService.startBtw', () => {
 
     expect(record.startBtwCalls).toEqual([{ sessionId: SID, agentId: 'main' }]);
   });
+
+  it('rejects a late side-channel result from a closed session lifecycle', async () => {
+    const retiredStartBtwReachedCore = createControlledPromise<void>();
+    const releaseRetiredStartBtw = createControlledPromise<string>();
+    const { bridge, record } = makeBridge();
+    let startCalls = 0;
+    vi.mocked(bridge.rpc.startBtw).mockImplementation(async (payload) => {
+      startCalls += 1;
+      record.startBtwCalls.push(payload);
+      if (startCalls === 1) {
+        retiredStartBtwReachedCore.resolve();
+        return releaseRetiredStartBtw;
+      }
+      return 'agent_replacement';
+    });
+    const { bus } = makeBus();
+    const { sessionService, triggerClose } = makeSessionService();
+    const impl = new PromptService(bridge, bus, makeAuth(), sessionService, new NoopLogService());
+
+    const retiredResult = impl.startBtw(SID);
+    const retiredRejected = expect(retiredResult).rejects.toThrow('Session closed');
+    await retiredStartBtwReachedCore;
+    triggerClose(SID);
+    await expect(impl.startBtw(SID)).resolves.toBe('agent_replacement');
+    releaseRetiredStartBtw.resolve('agent_retired');
+    await retiredRejected;
+
+    expect(record.startBtwCalls).toEqual([
+      { sessionId: SID, agentId: 'main' },
+      { sessionId: SID, agentId: 'main' },
+    ]);
+  });
 });
 
 describe('PromptService lifecycle synthesis (via IEventService.onDidPublish)', () => {
@@ -647,156 +960,232 @@ describe('PromptService lifecycle synthesis (via IEventService.onDidPublish)', (
     expect(impl._activeForTest(SID)?.turnId).toBe(42);
   });
 
-  it('ignores subsequent turn.started events (treated as nested turns)', async () => {
-    const { bridge } = makeBridge();
-    const { bus, triggerSubscribers } = makeBus();
+  it('ignores unrelated turn events while prompt admission is still pending', async () => {
+    const promptReachedCore = createControlledPromise<void>();
+    const admitPrompt = createControlledPromise<{
+      readonly kind: 'started';
+      readonly turnId: number;
+    }>();
+    const { bridge, record } = makeBridge();
+    vi.mocked(bridge.rpc.prompt).mockImplementation(async (payload) => {
+      record.promptCalls.push(payload);
+      promptReachedCore.resolve();
+      return admitPrompt;
+    });
+    const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
-    await impl.submit(SID, mkBody());
+
+    const submitting = impl.submit(SID, mkBodyMinimal());
+    await promptReachedCore;
+    const promptId = (record.promptCalls[0] as { promptId: string }).promptId;
+
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 42,
+      turnId: 700,
       origin: { kind: 'user' },
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
     triggerSubscribers({
-      type: 'turn.started',
-      turnId: 99,
-      origin: { kind: 'user' },
+      type: 'turn.ended',
+      turnId: 700,
+      reason: 'completed',
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(impl._activeForTest(SID)?.turnId).toBe(42);
-  });
-
-  it('synthesizes prompt.completed on top-level turn.ended (reason=completed)', async () => {
-    const { bridge } = makeBridge();
-    const { bus, events, triggerSubscribers } = makeBus();
-    const impl = newSvc(bridge, bus);
-    const submit = await impl.submit(SID, mkBody());
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 7,
+      turnId: 701,
       origin: { kind: 'user' },
+      promptId: 'prompt_unrelated',
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    events.length = 0;
+
+    expect(impl._activeForTest(SID)?.turnId).toBeNull();
+    expect(events.some((event) => event.type === 'prompt.completed')).toBe(false);
+
     triggerSubscribers({
-      type: 'turn.ended',
-      turnId: 7,
-      reason: 'completed',
+      type: 'turn.started',
+      turnId: 42,
+      origin: { kind: 'user' },
+      promptId,
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(events).toHaveLength(1);
-    const synth = events[0] as unknown as {
-      type: string;
-      promptId: string;
-      reason: string;
-    };
-    expect(synth.type).toBe('prompt.completed');
-    expect(synth.promptId).toBe(submit.prompt_id);
-    expect(synth.reason).toBe('completed');
-    expect(impl._activeForTest(SID)).toBeUndefined();
+    expect(impl._activeForTest(SID)?.turnId).toBe(42);
+
+    admitPrompt.resolve({ kind: 'started', turnId: 42 });
+    await submitting;
   });
 
-  it('preserves blocked reason when synthesizing prompt.completed', async () => {
+  it('binds a deferred prompt only to its acknowledged deferred id', async () => {
     const { bridge } = makeBridge();
-    const { bus, events, triggerSubscribers } = makeBus();
+    vi.mocked(bridge.rpc.prompt).mockResolvedValue({
+      kind: 'deferred',
+      deferredPromptId: 'deferred_owned',
+    });
+    const { bus, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
-    const submit = await impl.submit(SID, mkBody());
+    const submitted = await impl.submit(SID, mkBodyMinimal());
+
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 7,
+      turnId: 70,
       origin: { kind: 'user' },
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    events.length = 0;
     triggerSubscribers({
-      type: 'turn.ended',
-      turnId: 7,
-      reason: 'blocked',
+      type: 'turn.started',
+      turnId: 71,
+      origin: { kind: 'user' },
+      promptId: submitted.prompt_id,
+      deferredPromptId: 'deferred_other',
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(events).toHaveLength(1);
-    const synth = events[0] as unknown as {
-      type: string;
-      promptId: string;
-      reason: string;
-    };
-    expect(synth.type).toBe('prompt.completed');
-    expect(synth.promptId).toBe(submit.prompt_id);
-    expect(synth.reason).toBe('blocked');
-    expect(impl._activeForTest(SID)).toBeUndefined();
+    expect(impl._activeForTest(SID)?.turnId).toBeNull();
+
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 72,
+      origin: { kind: 'user' },
+      promptId: submitted.prompt_id,
+      deferredPromptId: 'deferred_owned',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    expect(impl._activeForTest(SID)?.turnId).toBe(72);
   });
 
-  it('fires onDidComplete listener before bus.publish', async () => {
-    const { bridge } = makeBridge();
-    const { bus, events, triggerSubscribers } = makeBus();
+  it('aborts the current continuation turn after its turn id changes', async () => {
+    const { bridge, record } = makeBridge({
+      onGetGoal: () => goalResult('active'),
+    });
+    const { bus, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
-    const submit = await impl.submit(SID, mkBody());
+    const submitted = await impl.submit(SID, mkBody());
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 7,
+      turnId: 42,
       origin: { kind: 'user' },
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    const handlerArgs: unknown[] = [];
-    const handlerCalledBeforePublish: boolean[] = [];
-    impl.onDidComplete((e) => {
-      handlerArgs.push(e);
-      handlerCalledBeforePublish.push(
-        events.filter(
-          (ev) => (ev as unknown as { type?: string }).type === 'prompt.completed',
-        ).length === 0,
-      );
-    });
-    events.length = 0;
     triggerSubscribers({
       type: 'turn.ended',
-      turnId: 7,
+      turnId: 42,
       reason: 'completed',
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(handlerArgs).toHaveLength(1);
-    expect((handlerArgs[0] as { promptId: string }).promptId).toBe(submit.prompt_id);
-    expect(handlerCalledBeforePublish[0]).toBe(true);
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 99,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    await impl.abort(SID, submitted.prompt_id);
+
+    expect(record.cancelCalls).toEqual([
+      {
+        sessionId: SID,
+        agentId: 'main',
+        turnId: 99,
+        expectedPromptId: submitted.prompt_id,
+        requireActive: true,
+      },
+    ]);
   });
 
-  it('synthesizes prompt.aborted on top-level turn.ended (reason=cancelled)', async () => {
-    const { bridge } = makeBridge();
+  it('keeps the prompt active while a goal is between continuation turns', async () => {
+    const terminalReadStarted = createControlledPromise<void>();
+    const releaseTerminalRead = createControlledPromise<GoalToolResult>();
+    let goalRead = 0;
+    const { bridge, record } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 1) return goalResult('active');
+        terminalReadStarted.resolve();
+        return releaseTerminalRead;
+      },
+    });
     const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
-    await impl.submit(SID, mkBody());
+    const first = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+    events.length = 0;
+
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 8,
+      turnId: 1,
       origin: { kind: 'user' },
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    events.length = 0;
     triggerSubscribers({
       type: 'turn.ended',
-      turnId: 8,
-      reason: 'cancelled',
+      turnId: 1,
+      reason: 'completed',
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(events).toHaveLength(1);
-    expect((events[0] as unknown as { type: string }).type).toBe('prompt.aborted');
+    await terminalReadStarted;
+
+    const listed = await impl.list(SID);
+    expect(listed.active?.prompt_id).toBe(first.prompt_id);
+    expect(listed.queued.map((prompt) => prompt.prompt_id)).toEqual([second.prompt_id]);
+    expect(record.promptCalls).toHaveLength(1);
+    expect(events.some((event) => event.type === 'prompt.completed')).toBe(false);
+    releaseTerminalRead.resolve(goalResult('active'));
+    await releaseTerminalRead;
   });
 
-  it('ignores nested turn.ended (different turnId) so prompt stays active', async () => {
-    const { bridge } = makeBridge();
+  it('settles a terminal goal update without waiting for stale verification', async () => {
+    const terminalReadStarted = createControlledPromise<void>();
+    const releaseTerminalRead = createControlledPromise<GoalToolResult>();
+    const completed = createControlledPromise<{ reason: string }>();
+    const nextPromptStarted = createControlledPromise<void>();
+    let goalRead = 0;
+    const { bridge, record } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 1) return goalResult('active');
+        if (goalRead === 2) {
+          terminalReadStarted.resolve();
+          return releaseTerminalRead;
+        }
+        return { goal: null };
+      },
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
     const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
-    await impl.submit(SID, mkBody());
+    impl.onDidComplete((event) => {
+      completed.resolve(event);
+    });
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+    events.length = 0;
+
     triggerSubscribers({
       type: 'turn.started',
       turnId: 1,
@@ -804,22 +1193,82 @@ describe('PromptService lifecycle synthesis (via IEventService.onDidPublish)', (
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    events.length = 0;
     triggerSubscribers({
       type: 'turn.ended',
-      turnId: 99,
+      turnId: 1,
       reason: 'completed',
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(events).toEqual([]);
-    expect(impl._activeForTest(SID)?.completed).toBe(false);
+    await terminalReadStarted;
+    triggerSubscribers({
+      type: 'goal.updated',
+      snapshot: goalResult('blocked').goal,
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    await Promise.all([completed, nextPromptStarted]);
+
+    expect((await completed).reason).toBe('blocked');
+    expect((await impl.list(SID)).active?.prompt_id).toBe(second.prompt_id);
+    expect(record.promptCalls).toHaveLength(2);
+    expect(events.filter((event) => event.type === 'prompt.completed')).toHaveLength(1);
+
+    const staleVerification = (
+      bridge.rpc.getGoal as unknown as ReturnType<typeof vi.fn>
+    ).mock.results[1]?.value as Promise<GoalToolResult>;
+    releaseTerminalRead.resolve(goalResult('active'));
+    await staleVerification;
+    await Promise.resolve();
+
+    expect((await impl.list(SID)).active?.prompt_id).toBe(second.prompt_id);
+    expect(events.filter((event) => event.type === 'prompt.completed')).toHaveLength(1);
   });
 
-  it('is a no-op for events on a session with no active prompt', async () => {
-    const { bridge } = makeBridge();
+  it('settles the latest continuation when another turn ends during verification', async () => {
+    const firstTerminalReadStarted = createControlledPromise<void>();
+    const releaseFirstTerminalRead = createControlledPromise<GoalToolResult>();
+    const completed = createControlledPromise<void>();
+    const nextPromptStarted = createControlledPromise<void>();
+    let goalRead = 0;
+    const { bridge } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 1) return goalResult('active');
+        if (goalRead === 2) {
+          firstTerminalReadStarted.resolve();
+          return releaseFirstTerminalRead;
+        }
+        return { goal: null };
+      },
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
     const { bus, events, triggerSubscribers } = makeBus();
-    newSvc(bridge, bus);
+    const impl = newSvc(bridge, bus);
+    impl.onDidComplete(() => {
+      completed.resolve();
+    });
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+    events.length = 0;
+
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
     triggerSubscribers({
       type: 'turn.ended',
       turnId: 1,
@@ -827,238 +1276,1740 @@ describe('PromptService lifecycle synthesis (via IEventService.onDidPublish)', (
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(events).toEqual([]);
+    await firstTerminalReadStarted;
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 2,
+      origin: { kind: 'goal_continuation' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'goal.updated',
+      snapshot: null,
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 2,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    releaseFirstTerminalRead.resolve({ goal: null });
+
+    await Promise.all([completed, nextPromptStarted]);
+
+    expect(events.filter((event) => event.type === 'prompt.completed')).toHaveLength(1);
   });
-});
 
-describe('PromptService.abort', () => {
-  it('throws PromptNotFoundError when no active prompt for the session', async () => {
-    const { bridge } = makeBridge();
-    const { bus } = makeBus();
-    const impl = newSvc(bridge, bus);
-    await expect(impl.abort(SID, 'prompt_xyz')).rejects.toBeInstanceOf(
-      PromptNotFoundError,
+  it('completes a terminal prompt when the goal verification RPC fails', async () => {
+    let goalRead = 0;
+    const { bridge } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 1) return { goal: null };
+        throw new Error('goal lookup failed');
+      },
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(
+      bridge,
+      bus,
+      makeAuth(),
+      makeSessionService().sessionService,
+      new ThrowingWarnLogService(),
     );
+    const completed = createControlledPromise<void>();
+    impl.onDidComplete(() => {
+      completed.resolve();
+    });
+    await impl.submit(SID, mkBodyMinimal());
+
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 1,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await completed;
+
+    expect((await impl.list(SID)).active).toBeNull();
   });
 
-  it('returns {aborted: true} and publishes prompt.aborted', async () => {
-    const { bridge, record } = makeBridge();
+  it('synthesizes prompt.completed on top-level turn.ended (reason=completed)', async () => {
+    const { bridge } = makeBridge();
     const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
+    const completed = createControlledPromise<void>();
+    impl.onDidComplete(() => {
+      completed.resolve();
+    });
     const submit = await impl.submit(SID, mkBody());
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 5,
+      turnId: 7,
       origin: { kind: 'user' },
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
     events.length = 0;
-    const result = await impl.abort(SID, submit.prompt_id);
-    expect(result.aborted).toBe(true);
-    expect(record.cancelCalls).toHaveLength(1);
-    expect(record.cancelCalls[0]).toEqual({
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 7,
+      reason: 'completed',
       sessionId: SID,
       agentId: 'main',
-      turnId: 5,
-    });
+    } as unknown as Event);
+    await completed;
     expect(events).toHaveLength(1);
-    expect((events[0] as unknown as { type: string }).type).toBe('prompt.aborted');
+    const synth = events[0] as unknown as {
+      type: string;
+      promptId: string;
+      reason: string;
+    };
+    expect(synth.type).toBe('prompt.completed');
+    expect(synth.promptId).toBe(submit.prompt_id);
+    expect(synth.reason).toBe('completed');
+    expect(impl._activeForTest(SID)).toBeUndefined();
   });
 
-  it('throws PromptAlreadyCompletedError on the second abort', async () => {
+  it('preserves blocked reason when synthesizing prompt.completed', async () => {
     const { bridge } = makeBridge();
-    const { bus } = makeBus();
+    const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
+    const completed = createControlledPromise<void>();
+    impl.onDidComplete(() => {
+      completed.resolve();
+    });
     const submit = await impl.submit(SID, mkBody());
-    await impl.abort(SID, submit.prompt_id);
-    await expect(impl.abort(SID, submit.prompt_id)).rejects.toBeInstanceOf(
-      PromptAlreadyCompletedError,
-    );
-  });
-
-  it('aborts a queued prompt without calling core.rpc.cancel', async () => {
-    const { bridge, record } = makeBridge();
-    const { bus, events } = makeBus();
-    const impl = newSvc(bridge, bus);
-
-    const first = await impl.submit(SID, mkBody());
-    const second = await impl.submit(
-      SID,
-      mkBodyMinimal({ content: [{ type: 'text', text: 'queued' }] }),
-    );
-    expect(second.status).toBe('queued');
-
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 7,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
     events.length = 0;
-    const result = await impl.abort(SID, second.prompt_id);
-
-    expect(result.aborted).toBe(true);
-    expect(record.cancelCalls).toHaveLength(0);
-    const listed = await impl.list(SID);
-    expect(listed.active?.prompt_id).toBe(first.prompt_id);
-    expect(listed.queued).toHaveLength(0);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 7,
+      reason: 'blocked',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await completed;
     expect(events).toHaveLength(1);
-    const ev = events[0] as unknown as { type: string; promptId?: string };
-    expect(ev.type).toBe('prompt.aborted');
-    expect(ev.promptId).toBe(second.prompt_id);
+    const synth = events[0] as unknown as {
+      type: string;
+      promptId: string;
+      reason: string;
+    };
+    expect(synth.type).toBe('prompt.completed');
+    expect(synth.promptId).toBe(submit.prompt_id);
+    expect(synth.reason).toBe('blocked');
+    expect(impl._activeForTest(SID)).toBeUndefined();
   });
-});
 
-describe('PromptService.getCurrentPromptId', () => {
-  it('returns the active prompt id while running', async () => {
+  it('fires onDidComplete listener before bus.publish', async () => {
     const { bridge } = makeBridge();
-    const { bus } = makeBus();
+    const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
     const submit = await impl.submit(SID, mkBody());
-    expect(impl.getCurrentPromptId(SID)).toBe(submit.prompt_id);
-  });
-
-  it('returns undefined when idle', async () => {
-    const { bridge } = makeBridge();
-    const { bus } = makeBus();
-    const impl = newSvc(bridge, bus);
-    expect(impl.getCurrentPromptId(SID)).toBeUndefined();
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 7,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    const handlerArgs: unknown[] = [];
+    const handlerCalledBeforePublish: boolean[] = [];
+    impl.onDidComplete((e) => {
+      handlerArgs.push(e);
+      handlerCalledBeforePublish.push(
+        events.filter(
+          (ev) => (ev as unknown as { type?: string }).type === 'prompt.completed',
+        ).length === 0,
+      );
+    });
+    const completed = createControlledPromise<void>();
+    impl.onDidComplete(() => {
+      completed.resolve();
+    });
+    events.length = 0;
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 7,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await completed;
+    expect(handlerArgs).toHaveLength(1);
+    expect((handlerArgs[0] as { promptId: string }).promptId).toBe(submit.prompt_id);
+    expect(handlerCalledBeforePublish[0]).toBe(true);
+  });
+
+  it('synthesizes prompt.aborted on top-level turn.ended (reason=cancelled)', async () => {
+    const { bridge } = makeBridge();
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const aborted = createControlledPromise<void>();
+    impl.onDidAbort(() => {
+      aborted.resolve();
+    });
+    await impl.submit(SID, mkBody());
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 8,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    events.length = 0;
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 8,
+      reason: 'cancelled',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await aborted;
+    expect(events).toHaveLength(1);
+    expect((events[0] as unknown as { type: string }).type).toBe('prompt.aborted');
+  });
+
+  it('ignores nested turn.ended (different turnId) so prompt stays active', async () => {
+    const { bridge } = makeBridge();
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    await impl.submit(SID, mkBody());
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    events.length = 0;
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 99,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    expect(events).toEqual([]);
+    expect(impl._activeForTest(SID)?.completed).toBe(false);
+  });
+
+  it('removes every active prompt and ignores pending verification after session close', async () => {
+    const verificationStarted = createControlledPromise<void>();
+    const releaseVerification = createControlledPromise<GoalToolResult>();
+    let goalRead = 0;
+    const { bridge } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 1) return goalResult('active');
+        verificationStarted.resolve();
+        return releaseVerification;
+      },
+    });
+    const { bus, events, triggerSubscribers } = makeBus();
+    const { sessionService, triggerClose } = makeSessionService();
+    const impl = new PromptService(bridge, bus, makeAuth(), sessionService, new NoopLogService());
+    await impl.submit(SID, mkBodyMinimal());
+    await impl.submit(
+      SID,
+      mkBodyMinimal({
+        agent_id: 'agent_btw',
+        content: [{ type: 'text', text: 'side channel' }],
+      }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 7,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 7,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await verificationStarted;
+    const verificationRpc = (
+      bridge.rpc.getGoal as unknown as ReturnType<typeof vi.fn>
+    ).mock.results[1]?.value as Promise<GoalToolResult>;
+    events.length = 0;
+
+    triggerClose(SID);
+
+    expect(impl._activeForTest(SID)).toBeUndefined();
+    expect(impl._activeForTest(SID, 'agent_btw')).toBeUndefined();
+    releaseVerification.resolve({ goal: null });
+    await verificationRpc;
+    expect(events).toEqual([]);
+  });
+
+  it('is a no-op for events on a session with no active prompt', async () => {
+    const { bridge } = makeBridge();
+    const { bus, events, triggerSubscribers } = makeBus();
+    newSvc(bridge, bus);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 1,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    expect(events).toEqual([]);
+  });
+});
+
+describe('PromptService.abort', () => {
+  it('throws PromptNotFoundError when no active prompt for the session', async () => {
+    const { bridge } = makeBridge();
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+    await expect(impl.abort(SID, 'prompt_xyz')).rejects.toBeInstanceOf(
+      PromptNotFoundError,
+    );
+  });
+
+  it('returns {aborted: true} and publishes prompt.aborted', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const submit = await impl.submit(SID, mkBody());
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 5,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    events.length = 0;
+    const result = await impl.abort(SID, submit.prompt_id);
+    expect(result.aborted).toBe(true);
+    expect(record.cancelCalls).toHaveLength(1);
+    expect(record.cancelCalls[0]).toEqual({
+      sessionId: SID,
+      agentId: 'main',
+      turnId: 5,
+      expectedPromptId: submit.prompt_id,
+      requireActive: true,
+    });
+    expect(events).toHaveLength(1);
+    expect((events[0] as unknown as { type: string }).type).toBe('prompt.aborted');
+  });
+
+  it('throws PromptAlreadyCompletedError on the second abort', async () => {
+    const { bridge } = makeBridge();
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const submit = await impl.submit(SID, mkBody());
+    await impl.abort(SID, submit.prompt_id);
+    await expect(impl.abort(SID, submit.prompt_id)).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+  });
+
+  it('remembers more than one completed prompt for idempotent aborts', async () => {
+    const firstCompleted = createControlledPromise<void>();
+    const secondCompleted = createControlledPromise<void>();
+    const { bridge } = makeBridge();
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    let completionCount = 0;
+    impl.onDidComplete(() => {
+      completionCount += 1;
+      if (completionCount === 1) firstCompleted.resolve();
+      if (completionCount === 2) secondCompleted.resolve();
+    });
+
+    const first = await impl.submit(SID, mkBodyMinimal());
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 1,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await firstCompleted;
+
+    const second = await impl.submit(SID, mkBodyMinimal());
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 2,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 2,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await secondCompleted;
+
+    await expect(impl.abort(SID, first.prompt_id)).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    await expect(impl.abort(SID, second.prompt_id)).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+  });
+
+  it('does not publish a retired abort after the session closes', async () => {
+    const cancelReachedCore = createControlledPromise<void>();
+    const releaseCancel = createControlledPromise<void>();
+    const { bridge } = makeBridge({
+      onCancel: async () => {
+        cancelReachedCore.resolve();
+        await releaseCancel;
+      },
+    });
+    const { bus, events } = makeBus();
+    const { sessionService, triggerClose } = makeSessionService();
+    const impl = new PromptService(bridge, bus, makeAuth(), sessionService, new NoopLogService());
+    const retired = await impl.submit(SID, mkBodyMinimal());
+
+    const abortResult = impl.abort(SID, retired.prompt_id);
+    const abortRejected = expect(abortResult).rejects.toThrow('Session closed');
+    await cancelReachedCore;
+    triggerClose(SID);
+    const replacement = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'replacement' }] }),
+    );
+    await abortRejected;
+    releaseCancel.resolve();
+    const coreCancel = vi.mocked(bridge.rpc.cancel).mock.results[0]?.value as Promise<void>;
+    await coreCancel;
+
+    expect(
+      events.some((event) => {
+        const payload = event as unknown as { type?: string; promptId?: string };
+        return payload.type === 'prompt.aborted' && payload.promptId === retired.prompt_id;
+      }),
+    ).toBe(false);
+    expect((await impl.list(SID)).active?.prompt_id).toBe(replacement.prompt_id);
+  });
+
+  it('does not dispatch a delayed abort into a replacement session', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus } = makeBus();
+    const { sessionService, triggerClose } = makeSessionService();
+    const impl = new PromptService(bridge, bus, makeAuth(), sessionService, new NoopLogService());
+    const retired = await impl.submit(SID, mkBodyMinimal());
+
+    const abortResult = impl.abort(SID, retired.prompt_id);
+    const abortRejected = expect(abortResult).rejects.toThrow('Session closed');
+    triggerClose(SID);
+    const replacement = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'replacement' }] }),
+    );
+    await abortRejected;
+    await Promise.resolve();
+
+    expect(record.cancelCalls).toHaveLength(0);
+    expect((await impl.list(SID)).active?.prompt_id).toBe(replacement.prompt_id);
+  });
+
+  it('keeps new submissions queued until an in-flight abort finishes', async () => {
+    const cancelStarted = createControlledPromise<void>();
+    const releaseCancel = createControlledPromise<void>();
+    const nextPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onCancel: async () => {
+        cancelStarted.resolve();
+        await releaseCancel;
+      },
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const first = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 5,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    events.length = 0;
+
+    const abortResult = impl.abort(SID, first.prompt_id);
+    await cancelStarted;
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 5,
+      reason: 'cancelled',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    const third = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'three' }] }),
+    );
+
+    const whileCancelling = await impl.list(SID);
+    expect(third.status).toBe('queued');
+    expect(whileCancelling.active?.prompt_id).toBe(first.prompt_id);
+    expect(whileCancelling.queued.map((prompt) => prompt.prompt_id)).toEqual([
+      second.prompt_id,
+      third.prompt_id,
+    ]);
+    expect(record.promptCalls).toHaveLength(1);
+    expect(events.filter((event) => event.type === 'prompt.aborted')).toHaveLength(0);
+
+    releaseCancel.resolve();
+    await abortResult;
+    await nextPromptStarted;
+
+    const afterCancel = await impl.list(SID);
+    expect(afterCancel.active?.prompt_id).toBe(second.prompt_id);
+    expect(afterCancel.queued.map((prompt) => prompt.prompt_id)).toEqual([
+      third.prompt_id,
+    ]);
+    expect(events.filter((event) => event.type === 'prompt.aborted')).toHaveLength(1);
+  });
+
+  it('settles an observed terminal turn when the cancel RPC rejects', async () => {
+    const cancelStarted = createControlledPromise<void>();
+    const releaseCancel = createControlledPromise<void>();
+    const nextGoalReadStarted = createControlledPromise<void>();
+    const releaseNextGoalRead = createControlledPromise<GoalToolResult>();
+    const aborted = createControlledPromise<void>();
+    const nextPromptStarted = createControlledPromise<void>();
+    let goalRead = 0;
+    const { bridge } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 1) return goalResult('active');
+        if (goalRead === 2) {
+          nextGoalReadStarted.resolve();
+          return releaseNextGoalRead;
+        }
+        return { goal: null };
+      },
+      onCancel: async () => {
+        cancelStarted.resolve();
+        await releaseCancel;
+        throw new Error('cancel failed');
+      },
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    impl.onDidAbort(() => {
+      aborted.resolve();
+    });
+    const first = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 5,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    const abortResult = expect(impl.abort(SID, first.prompt_id)).rejects.toThrow(
+      'cancel failed',
+    );
+    await cancelStarted;
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 5,
+      reason: 'cancelled',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'goal.updated',
+      snapshot: goalResult('paused').goal,
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    releaseCancel.resolve();
+
+    await abortResult;
+    await nextGoalReadStarted;
+
+    const listed = await impl.list(SID);
+    expect(listed.active?.prompt_id).toBe(second.prompt_id);
+    expect(listed.queued).toHaveLength(0);
+
+    await aborted;
+    releaseNextGoalRead.resolve({ goal: null });
+    await nextPromptStarted;
+  });
+
+  it('aborts a queued prompt without calling core.rpc.cancel', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus, events } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const first = await impl.submit(SID, mkBody());
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'queued' }] }),
+    );
+    expect(second.status).toBe('queued');
+
+    events.length = 0;
+    const result = await impl.abort(SID, second.prompt_id);
+
+    expect(result.aborted).toBe(true);
+    expect(record.cancelCalls).toHaveLength(0);
+    const listed = await impl.list(SID);
+    expect(listed.active?.prompt_id).toBe(first.prompt_id);
+    expect(listed.queued).toHaveLength(0);
+    expect(events).toHaveLength(1);
+    const ev = events[0] as unknown as { type: string; promptId?: string };
+    expect(ev.type).toBe('prompt.aborted');
+    expect(ev.promptId).toBe(second.prompt_id);
+  });
+});
+
+describe('PromptService.getCurrentPromptId', () => {
+  it('returns the active prompt id while running', async () => {
+    const { bridge } = makeBridge();
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const submit = await impl.submit(SID, mkBody());
+    expect(impl.getCurrentPromptId(SID)).toBe(submit.prompt_id);
+  });
+
+  it('returns undefined when idle', async () => {
+    const { bridge } = makeBridge();
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+    expect(impl.getCurrentPromptId(SID)).toBeUndefined();
+  });
+
+  it('returns undefined after the prompt completes', async () => {
+    const { bridge } = makeBridge();
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const completed = createControlledPromise<void>();
+    impl.onDidComplete(() => {
+      completed.resolve();
+    });
+    const submit = await impl.submit(SID, mkBody());
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 1,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await completed;
+    expect(impl.getCurrentPromptId(SID)).toBeUndefined();
+  });
+});
+
+describe('PromptService.abortBySession', () => {
+  it('prevents dispatch when abort wins during prompt startup', async () => {
+    const goalReadStarted = createControlledPromise<void>();
+    const releaseGoalRead = createControlledPromise<GoalToolResult>();
+    const { bridge, record } = makeBridge({
+      onGetGoal: () => {
+        goalReadStarted.resolve();
+        return releaseGoalRead;
+      },
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const submitResult = impl.submit(SID, mkBodyMinimal());
+    await goalReadStarted;
+    const submitRejected = expect(submitResult).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+
+    await expect(impl.abortBySession(SID)).resolves.toEqual({ aborted: true });
+    releaseGoalRead.resolve({ goal: null });
+    await submitRejected;
+
+    expect(record.promptCalls).toHaveLength(0);
+    expect((await impl.list(SID)).active).toBeNull();
+  });
+
+  it('reserves authority before preflight so abort cannot be lost', async () => {
+    const resumeStarted = createControlledPromise<void>();
+    const releaseResume = createControlledPromise<void>();
+    const nextPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
+    let resumeCalls = 0;
+    vi.mocked(bridge.rpc.resumeSession).mockImplementation(async () => {
+      resumeCalls += 1;
+      if (resumeCalls === 1) {
+        resumeStarted.resolve();
+        await releaseResume;
+      }
+      return undefined as never;
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const firstSubmit = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'one' }] }),
+    );
+    const firstRejected = expect(firstSubmit).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    await resumeStarted;
+
+    await expect(impl.abortBySession(SID)).resolves.toEqual({ aborted: true });
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'two' }] }),
+    );
+
+    expect(second.status).toBe('queued');
+    expect((await impl.list(SID)).active).toBeNull();
+    expect((await impl.list(SID)).queued.map((item) => item.prompt_id)).toEqual([
+      second.prompt_id,
+    ]);
+    expect(record.promptCalls).toHaveLength(0);
+
+    releaseResume.resolve();
+    await firstRejected;
+    await nextPromptStarted;
+
+    expect((await impl.list(SID)).active?.prompt_id).toBe(second.prompt_id);
+    expect(record.promptCalls).toHaveLength(1);
+  });
+
+  it('prevents a promoted follower from dispatching when stop arrives during its preflight', async () => {
+    const followerResumeStarted = createControlledPromise<void>();
+    const releaseFollowerResume = createControlledPromise<void>();
+    const activeCompleted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge();
+    let resumeCalls = 0;
+    vi.mocked(bridge.rpc.resumeSession).mockImplementation(async () => {
+      resumeCalls += 1;
+      if (resumeCalls === 2) {
+        followerResumeStarted.resolve();
+        await releaseFollowerResume;
+      }
+      return undefined as never;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const active = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    impl.onDidComplete((event) => {
+      if (event.promptId === active.prompt_id) activeCompleted.resolve();
+    });
+    const followerResult = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'pending follower' }] }),
+    );
+    const followerRejected = expect(followerResult).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    await followerResumeStarted;
+
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 1,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 1,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await activeCompleted;
+
+    await expect(impl.abortBySession(SID)).resolves.toEqual({ aborted: true });
+    await followerRejected;
+    releaseFollowerResume.resolve();
+    const rawResume = vi.mocked(bridge.rpc.resumeSession).mock.results[1]?.value as Promise<void>;
+    await rawResume;
+
+    expect(record.promptCalls).toHaveLength(1);
+    expect(await impl.list(SID)).toMatchObject({ active: null, queued: [] });
+  });
+
+  it('records a cancelled startup mutation before compensating for the next prompt', async () => {
+    const setterStarted = createControlledPromise<void>();
+    const releaseSetter = createControlledPromise<void>();
+    const nextPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'two') nextPromptStarted.resolve();
+      },
+    });
+    vi.mocked(bridge.rpc.setModel).mockImplementation(async (payload) => {
+      record.setModelCalls.push(payload);
+      setterStarted.resolve();
+      await releaseSetter;
+      return { model: (payload as { model: string }).model };
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const firstSubmit = impl.submit(
+      SID,
+      mkBody({
+        content: [{ type: 'text', text: 'one' }],
+        model: 'kimi-code/k1',
+        thinking: 'high',
+        permission_mode: 'yolo',
+        goal_objective: 'Do not create this after cancellation',
+      }),
+    );
+    const firstRejected = expect(firstSubmit).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    await setterStarted;
+
+    await expect(impl.abortBySession(SID)).resolves.toEqual({ aborted: true });
+    const second = await impl.submit(
+      SID,
+      mkBody({
+        content: [{ type: 'text', text: 'two' }],
+        model: 'kimi-code/k2',
+      }),
+    );
+    expect(second.status).toBe('queued');
+    expect(record.promptCalls).toHaveLength(0);
+
+    releaseSetter.resolve();
+    await firstRejected;
+    await nextPromptStarted;
+
+    expect(record.setModelCalls).toEqual([
+      { sessionId: SID, agentId: 'main', model: 'kimi-code/k1' },
+      { sessionId: SID, agentId: 'main', model: 'kimi-code/k2' },
+    ]);
+    expect(record.setThinkingCalls).toHaveLength(0);
+    expect(record.setPermissionCalls).toHaveLength(0);
+    expect(record.createGoalCalls).toHaveLength(0);
+    expect(impl._dispatchLogForTest(SID)?.map((entry) => entry.kind)).toEqual([
+      'setModel',
+      'setModel',
+    ]);
+    expect(impl.getAgentStateSnapshot(SID)?.model).toBe('kimi-code/k2');
+    expect((await impl.list(SID)).active?.prompt_id).toBe(second.prompt_id);
+  });
+
+  it('joins concurrent stops onto one rejected cancel operation', async () => {
+    const cancelStarted = createControlledPromise<void>();
+    const releaseCancel = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onCancel: async () => {
+        cancelStarted.resolve();
+        await releaseCancel;
+      },
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+    await impl.submit(SID, mkBodyMinimal());
+
+    const firstStop = impl.abortBySession(SID);
+    await cancelStarted;
+    const secondStop = impl.abortBySession(SID);
+    releaseCancel.reject(new Error('shared cancel failed'));
+    const outcomes = await Promise.allSettled([firstStop, secondStop]);
+
+    expect(outcomes).toEqual([
+      { status: 'rejected', reason: expect.objectContaining({ message: 'shared cancel failed' }) },
+      { status: 'rejected', reason: expect.objectContaining({ message: 'shared cancel failed' }) },
+    ]);
+    expect(record.cancelCalls).toHaveLength(1);
+  });
+
+  it('retires a failed active prompt when prompt rejection precedes cancel rejection', async () => {
+    const activePromptStarted = createControlledPromise<void>();
+    const rejectActivePrompt = createControlledPromise<void>();
+    const cancelStarted = createControlledPromise<void>();
+    const rejectCancel = createControlledPromise<void>();
+    const followerPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: async (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'active') {
+          activePromptStarted.resolve();
+          await rejectActivePrompt;
+        }
+        if (text === 'follower') followerPromptStarted.resolve();
+      },
+      onCancel: async () => {
+        cancelStarted.resolve();
+        await rejectCancel;
+      },
+    });
+    const { bus, events } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const activeResult = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    await activePromptStarted;
+    const activeId = events.find((event) => event.type === 'prompt.submitted') as
+      | { promptId: string }
+      | undefined;
+    const follower = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'follower' }] }),
+    );
+
+    const stopResult = impl.abortBySession(SID);
+    const activeRejected = expect(activeResult).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    const stopRejected = expect(stopResult).rejects.toThrow('cancel failed after prompt failed');
+    await cancelStarted;
+    const corePromptRequest = vi.mocked(bridge.rpc.prompt).mock.results[0]?.value as Promise<void>;
+    const corePromptRejected = expect(corePromptRequest).rejects.toThrow('prompt failed first');
+    rejectActivePrompt.reject(new Error('prompt failed first'));
+    await corePromptRejected;
+    rejectCancel.reject(new Error('cancel failed after prompt failed'));
+
+    await Promise.all([activeRejected, stopRejected, followerPromptStarted]);
+
+    expect((await impl.list(SID)).active?.prompt_id).toBe(follower.prompt_id);
+    expect(
+      events.filter((event) => {
+        const candidate = event as unknown as {
+          type?: string;
+          promptId?: string;
+          reason?: string;
+        };
+        return (
+          candidate.type === 'prompt.completed' &&
+          candidate.promptId === activeId?.promptId &&
+          candidate.reason === 'failed'
+        );
+      }),
+    ).toHaveLength(1);
+    expect(record.promptCalls).toHaveLength(2);
+  });
+
+  it('promotes the queue when cancel succeeds before any turn event or prompt acknowledgement', async () => {
+    const activePromptStarted = createControlledPromise<void>();
+    const neverAcknowledgeActive = createControlledPromise<void>();
+    const followerPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: async (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'active') {
+          activePromptStarted.resolve();
+          await neverAcknowledgeActive;
+        }
+        if (text === 'follower') followerPromptStarted.resolve();
+      },
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const activeResult = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    await activePromptStarted;
+    const follower = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'follower' }] }),
+    );
+    const activeRejected = expect(activeResult).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    const activePromptId = impl.getCurrentPromptId(SID);
+
+    await expect(impl.abortBySession(SID)).resolves.toEqual({ aborted: true });
+    await Promise.all([activeRejected, followerPromptStarted]);
+
+    expect((await impl.list(SID)).active?.prompt_id).toBe(follower.prompt_id);
+    expect(record.cancelCalls).toEqual([
+      {
+        sessionId: SID,
+        agentId: 'main',
+        expectedPromptId: activePromptId,
+        requireActive: true,
+      },
+    ]);
+    expect(record.promptCalls).toHaveLength(2);
+  });
+
+  it('delegates to abort when a daemon prompt is active', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const submit = await impl.submit(SID, mkBody());
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 7,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    events.length = 0;
+
+    const result = await impl.abortBySession(SID);
+
+    expect(result.aborted).toBe(true);
+    expect(record.cancelCalls).toHaveLength(1);
+    expect(record.cancelCalls[0]).toEqual({
+      sessionId: SID,
+      agentId: 'main',
+      turnId: 7,
+      expectedPromptId: submit.prompt_id,
+      requireActive: true,
+    });
+    expect(events).toHaveLength(1);
+    expect((events[0] as unknown as { type: string }).type).toBe('prompt.aborted');
+  });
+
+  it('calls core.rpc.cancel without turnId when no daemon prompt is active', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const result = await impl.abortBySession(SID);
+
+    expect(result.aborted).toBe(true);
+    expect(record.cancelCalls).toHaveLength(1);
+    expect(record.cancelCalls[0]).toEqual({
+      sessionId: SID,
+      agentId: 'main',
+    });
+  });
+
+  it('does not let an idle stop cross into a replacement session lifecycle', async () => {
+    const firstListReachedCore = createControlledPromise<void>();
+    const releaseFirstList = createControlledPromise<SessionSummary[]>();
+    const { bridge, record } = makeBridge();
+    let listCalls = 0;
+    vi.mocked(bridge.rpc.listSessions).mockImplementation(async () => {
+      listCalls += 1;
+      if (listCalls === 1) {
+        firstListReachedCore.resolve();
+        return releaseFirstList;
+      }
+      return [mkSummary()];
+    });
+    const { bus } = makeBus();
+    const { sessionService, triggerClose } = makeSessionService();
+    const impl = new PromptService(bridge, bus, makeAuth(), sessionService, new NoopLogService());
+
+    const stopping = impl.abortBySession(SID);
+    const stopRejected = expect(stopping).rejects.toThrow('Session closed');
+    await firstListReachedCore;
+    triggerClose(SID);
+    const replacement = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'replacement' }] }),
+    );
+    await stopRejected;
+    releaseFirstList.resolve([mkSummary()]);
+    const retiredList = vi.mocked(bridge.rpc.listSessions).mock.results[0]
+      ?.value as Promise<SessionSummary[]>;
+    await retiredList;
+
+    expect(record.cancelCalls).toHaveLength(0);
+    expect((await impl.list(SID)).active?.prompt_id).toBe(replacement.prompt_id);
+  });
+});
+
+describe('PromptService queue steer', () => {
+  it('does not steer a queued prompt before the active turn is admitted', async () => {
+    const goalReadStarted = createControlledPromise<void>();
+    const releaseGoalRead = createControlledPromise<GoalToolResult>();
+    const { bridge, record } = makeBridge({
+      onGetGoal: () => {
+        goalReadStarted.resolve();
+        return releaseGoalRead;
+      },
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const activeResult = impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    await goalReadStarted;
+    const queued = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'queued' }] }),
+    );
+
+    await expect(impl.steer(SID, [queued.prompt_id])).rejects.toBeInstanceOf(
+      SessionBusyError,
+    );
+    expect(record.steerCalls).toHaveLength(0);
+    expect((await impl.list(SID)).queued.map((prompt) => prompt.prompt_id)).toEqual([
+      queued.prompt_id,
+    ]);
+
+    releaseGoalRead.resolve({ goal: null });
+    await activeResult;
+  });
+
+  it('steers a queued prompt into the active turn without starting a new prompt', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const active = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }));
+    const queued = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'queued' }] }));
+    let reentrantAbort: Promise<unknown> | undefined;
+    bus.onDidPublish((event) => {
+      if (event.type !== 'prompt.steered' || reentrantAbort !== undefined) return;
+      reentrantAbort = impl.abort(SID, queued.prompt_id);
+      void reentrantAbort.catch(() => undefined);
+    });
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 11,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    const result = await impl.steer(SID, [queued.prompt_id]);
+
+    expect(result).toEqual({ steered: true, prompt_ids: [queued.prompt_id] });
+    await expect(reentrantAbort).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    expect(record.promptCalls).toHaveLength(1);
+    expect(record.cancelCalls).toHaveLength(0);
+    expect(record.steerCalls).toEqual([
+      {
+        sessionId: SID,
+        agentId: 'main',
+        input: [{ type: 'text', text: 'queued' }],
+        expectedPromptId: active.prompt_id,
+        requireActive: true,
+      },
+    ]);
+    expect((await impl.list(SID)).queued).toHaveLength(0);
+    expect(
+      events.some((event) => {
+        const payload = event as unknown as {
+          type?: string;
+          activePromptId?: string;
+          promptIds?: readonly string[];
+        };
+        return (
+          payload.type === 'prompt.steered' &&
+          payload.activePromptId === active.prompt_id &&
+          payload.promptIds?.[0] === queued.prompt_id
+        );
+      }),
+    ).toBe(true);
+  });
+
+  it('joins multiple queued prompts in admission order', async () => {
+    const { bridge, record } = makeBridge();
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const active = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }));
+    const first = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'first' }] }));
+    const second = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'second' }] }));
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 12,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    const result = await impl.steer(SID, [second.prompt_id, first.prompt_id]);
+
+    expect(result.prompt_ids).toEqual([first.prompt_id, second.prompt_id]);
+    expect(record.steerCalls).toEqual([
+      {
+        sessionId: SID,
+        agentId: 'main',
+        input: [{ type: 'text', text: 'first\n\nsecond' }],
+        expectedPromptId: active.prompt_id,
+        requireActive: true,
+      },
+    ]);
+    expect((await impl.list(SID)).queued).toHaveLength(0);
+  });
+
+  it('keeps queued prompts when core steer fails', async () => {
+    const { bridge } = makeBridge();
+    const { bus, triggerSubscribers } = makeBus();
+    vi.mocked(bridge.rpc.steer).mockRejectedValueOnce(new Error('steer failed'));
+    const impl = newSvc(bridge, bus);
+    await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }));
+    const queued = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'queued' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 13,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    await expect(impl.steer(SID, [queued.prompt_id])).rejects.toThrow('steer failed');
+
+    expect((await impl.list(SID)).queued.map((prompt) => prompt.prompt_id)).toEqual([
+      queued.prompt_id,
+    ]);
+  });
+
+  it('retains a failed deduplicated steer in admission order', async () => {
+    const steerReachedCore = createControlledPromise<void>();
+    const rejectSteer = createControlledPromise<void>();
+    const { bridge, record } = makeBridge();
+    vi.mocked(bridge.rpc.steer).mockImplementation(async (payload) => {
+      record.steerCalls.push(payload);
+      steerReachedCore.resolve();
+      await rejectSteer;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const active = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    const first = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'first' }] }),
+    );
+    const selected = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'selected' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 14,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    const steering = impl.steer(SID, [selected.prompt_id, selected.prompt_id]);
+    const steerRejected = expect(steering).rejects.toThrow('steer failed');
+    await steerReachedCore;
+    const later = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'later' }] }),
+    );
+    rejectSteer.reject(new Error('steer failed'));
+    await steerRejected;
+
+    expect(record.steerCalls).toEqual([
+      {
+        sessionId: SID,
+        agentId: 'main',
+        input: [{ type: 'text', text: 'selected' }],
+        expectedPromptId: active.prompt_id,
+        requireActive: true,
+      },
+    ]);
+    expect((await impl.list(SID)).queued.map((prompt) => prompt.prompt_id)).toEqual([
+      first.prompt_id,
+      selected.prompt_id,
+      later.prompt_id,
+    ]);
+  });
+
+  it('does not promote a later prompt past a pending failed steer', async () => {
+    const steerReachedCore = createControlledPromise<void>();
+    const rejectSteer = createControlledPromise<void>();
+    const activeCompleted = createControlledPromise<void>();
+    const selectedPromptStarted = createControlledPromise<void>();
+    let completedWhileSteering = false;
+    const { bridge, record } = makeBridge({
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'selected') selectedPromptStarted.resolve();
+      },
+    });
+    vi.mocked(bridge.rpc.steer).mockImplementation(async (payload) => {
+      record.steerCalls.push(payload);
+      steerReachedCore.resolve();
+      await rejectSteer;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    impl.onDidComplete(() => {
+      completedWhileSteering = true;
+      activeCompleted.resolve();
+    });
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    const selected = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'selected' }] }),
+    );
+    const later = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'later' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 16,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    const steering = impl.steer(SID, [selected.prompt_id]);
+    const steerRejected = expect(steering).rejects.toThrow('steer failed');
+    await steerReachedCore;
+    triggerSubscribers({
+      type: 'turn.ended',
+      turnId: 16,
+      reason: 'completed',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(record.promptCalls).toHaveLength(1);
+    expect(completedWhileSteering).toBe(false);
+    rejectSteer.reject(new Error('steer failed'));
+    await Promise.all([steerRejected, activeCompleted, selectedPromptStarted]);
+
+    expect((await impl.list(SID)).active?.prompt_id).toBe(selected.prompt_id);
+    expect((await impl.list(SID)).queued.map((prompt) => prompt.prompt_id)).toEqual([
+      later.prompt_id,
+    ]);
+    expect(
+      record.promptCalls.map(
+        (payload) => (payload as { input: Array<{ text?: string }> }).input[0]?.text,
+      ),
+    ).toEqual(['active', 'selected']);
+  });
+
+  it('stops the active transaction when abort targets a pending steer selection', async () => {
+    const steerReachedCore = createControlledPromise<void>();
+    const releaseSteer = createControlledPromise<void>();
+    const followerPromptStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'follower') followerPromptStarted.resolve();
+      },
+    });
+    vi.mocked(bridge.rpc.steer).mockImplementation(async () => {
+      steerReachedCore.resolve();
+      await releaseSteer;
+    });
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    let reentrantSelectedAbort: Promise<unknown> | undefined;
+    const active = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    const selected = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'selected' }] }),
+    );
+    impl.onDidAbort((event) => {
+      if (event.promptId !== selected.prompt_id || reentrantSelectedAbort !== undefined) {
+        return;
+      }
+      reentrantSelectedAbort = impl.abort(SID, selected.prompt_id);
+      void reentrantSelectedAbort.catch(() => undefined);
+    });
+    const follower = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'follower' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 17,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    events.length = 0;
+
+    const steering = impl.steer(SID, [selected.prompt_id]);
+    const steerRejected = expect(steering).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    await steerReachedCore;
+    await expect(impl.abort(SID, selected.prompt_id)).resolves.toEqual({ aborted: true });
+    await Promise.all([steerRejected, followerPromptStarted]);
+    await expect(reentrantSelectedAbort).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+
+    releaseSteer.resolve();
+    await Promise.resolve();
+    expect(events.some((event) => event.type === 'prompt.steered')).toBe(false);
+    expect(
+      events
+        .filter((event) => event.type === 'prompt.aborted')
+        .map((event) => (event as unknown as { promptId: string }).promptId),
+    ).toEqual([selected.prompt_id, active.prompt_id]);
+    expect((await impl.list(SID)).active?.prompt_id).toBe(follower.prompt_id);
+    expect(
+      record.promptCalls.map(
+        (payload) =>
+          (payload as { input: Array<{ text?: string }> }).input[0]?.text,
+      ),
+    ).toEqual(['active', 'follower']);
+  });
+
+  it('reports a second steer as busy while the first steer is pending', async () => {
+    const steerReachedCore = createControlledPromise<void>();
+    const releaseSteer = createControlledPromise<void>();
+    const { bridge } = makeBridge();
+    vi.mocked(bridge.rpc.steer).mockImplementation(async () => {
+      steerReachedCore.resolve();
+      await releaseSteer;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    await impl.submit(SID, mkBodyMinimal());
+    const first = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'first' }] }),
+    );
+    const second = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'second' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 18,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+
+    const steering = impl.steer(SID, [first.prompt_id]);
+    await steerReachedCore;
+    await expect(impl.steer(SID, [second.prompt_id])).rejects.toBeInstanceOf(
+      SessionBusyError,
+    );
+
+    releaseSteer.resolve();
+    await steering;
+  });
+
+  it('cancels an active prompt without waiting for a hung steer acknowledgement', async () => {
+    const steerReachedCore = createControlledPromise<void>();
+    const releaseSteer = createControlledPromise<void>();
+    const cancelReachedCore = createControlledPromise<void>();
+    const followerPromptStarted = createControlledPromise<void>();
+    let cancelCalled = false;
+    const { bridge, record } = makeBridge({
+      onCancel: () => {
+        cancelCalled = true;
+        cancelReachedCore.resolve();
+      },
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'follower') followerPromptStarted.resolve();
+      },
+    });
+    vi.mocked(bridge.rpc.steer).mockImplementation(async () => {
+      steerReachedCore.resolve();
+      await releaseSteer;
+    });
+    const { bus, events, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    const active = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    const selected = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'selected' }] }),
+    );
+    const follower = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'follower' }] }),
+    );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 19,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    events.length = 0;
+
+    const steering = impl.steer(SID, [selected.prompt_id]);
+    const steerRejected = expect(steering).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    await steerReachedCore;
+    const aborting = impl.abort(SID, active.prompt_id);
+    await cancelReachedCore;
+    expect(cancelCalled).toBe(true);
+
+    await Promise.all([steerRejected, aborting, followerPromptStarted]);
+
+    // The transport mock deliberately ignores its signal. Resolving it later
+    // must not publish a late steer or consume the selected queue item.
+    releaseSteer.resolve();
+    await Promise.resolve();
+
+    expect(events.some((event) => event.type === 'prompt.steered')).toBe(false);
+    expect(
+      events
+        .filter((event) => event.type === 'prompt.aborted')
+        .map((event) => (event as unknown as { promptId: string }).promptId),
+    ).toEqual([selected.prompt_id, active.prompt_id]);
+    expect((await impl.list(SID)).active?.prompt_id).toBe(follower.prompt_id);
+    expect((await impl.list(SID)).queued).toHaveLength(0);
+    expect(
+      record.promptCalls.map(
+        (payload) =>
+          (payload as { input: Array<{ text?: string }> }).input[0]?.text,
+      ),
+    ).toEqual(['active', 'follower']);
   });
 
-  it('returns undefined after the prompt completes', async () => {
-    const { bridge } = makeBridge();
-    const { bus, triggerSubscribers } = makeBus();
+  it('publishes a successful steer before terminal completion without re-reading goal state', async () => {
+    const steerReachedCore = createControlledPromise<void>();
+    const releaseSteer = createControlledPromise<void>();
+    const terminalGoalRead = createControlledPromise<void>();
+    const completed = createControlledPromise<void>();
+    const followerPromptStarted = createControlledPromise<void>();
+    let goalRead = 0;
+    const { bridge, record } = makeBridge({
+      onGetGoal: () => {
+        goalRead += 1;
+        if (goalRead === 2) terminalGoalRead.resolve();
+        // A redundant third read would observe an unrelated newly-created
+        // goal and incorrectly pin the already-terminal active prompt.
+        return goalRead >= 3 ? goalResult('active') : { goal: null };
+      },
+      onPrompt: (payload) => {
+        const text = (payload as { input: Array<{ text?: string }> }).input[0]?.text;
+        if (text === 'follower') followerPromptStarted.resolve();
+      },
+    });
+    vi.mocked(bridge.rpc.steer).mockImplementation(async (payload) => {
+      record.steerCalls.push(payload);
+      steerReachedCore.resolve();
+      await releaseSteer;
+    });
+    const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
-    const submit = await impl.submit(SID, mkBody());
+    let getGoalCallsAtCompletion = -1;
+    impl.onDidComplete(() => {
+      getGoalCallsAtCompletion = record.getGoalCalls.length;
+      completed.resolve();
+    });
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    const selected = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'selected' }] }),
+    );
+    const follower = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'follower' }] }),
+    );
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 1,
+      turnId: 20,
       origin: { kind: 'user' },
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
+    events.length = 0;
+
+    const steering = impl.steer(SID, [selected.prompt_id]);
+    await steerReachedCore;
     triggerSubscribers({
       type: 'turn.ended',
-      turnId: 1,
+      turnId: 20,
       reason: 'completed',
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(impl.getCurrentPromptId(SID)).toBeUndefined();
+    await terminalGoalRead;
+    await Promise.resolve();
+    expect(events.some((event) => event.type === 'prompt.completed')).toBe(false);
+
+    releaseSteer.resolve();
+    await Promise.all([steering, completed, followerPromptStarted]);
+
+    expect(
+      events
+        .map((event) => event.type)
+        .filter((type) => type === 'prompt.steered' || type === 'prompt.completed'),
+    ).toEqual(['prompt.steered', 'prompt.completed']);
+    expect(getGoalCallsAtCompletion).toBe(2);
+    expect((await impl.list(SID)).active?.prompt_id).toBe(follower.prompt_id);
   });
-});
 
-describe('PromptService.abortBySession', () => {
-  it('delegates to abort when a daemon prompt is active', async () => {
+  it('does not resurrect a pending steer after service disposal', async () => {
+    const steerReachedCore = createControlledPromise<void>();
+    const releaseSteer = createControlledPromise<void>();
     const { bridge, record } = makeBridge();
+    vi.mocked(bridge.rpc.steer).mockImplementation(async (payload) => {
+      record.steerCalls.push(payload);
+      steerReachedCore.resolve();
+      await releaseSteer;
+    });
     const { bus, events, triggerSubscribers } = makeBus();
     const impl = newSvc(bridge, bus);
-    const submit = await impl.submit(SID, mkBody());
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }),
+    );
+    const selected = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'selected' }] }),
+    );
+    await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'follower' }] }),
+    );
     triggerSubscribers({
       type: 'turn.started',
-      turnId: 7,
+      turnId: 21,
       origin: { kind: 'user' },
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
     events.length = 0;
 
-    const result = await impl.abortBySession(SID);
-
-    expect(result.aborted).toBe(true);
-    expect(record.cancelCalls).toHaveLength(1);
-    expect(record.cancelCalls[0]).toEqual({
-      sessionId: SID,
-      agentId: 'main',
-      turnId: 7,
-    });
-    expect(events).toHaveLength(1);
-    expect((events[0] as unknown as { type: string }).type).toBe('prompt.aborted');
-  });
-
-  it('calls core.rpc.cancel without turnId when no daemon prompt is active', async () => {
-    const { bridge, record } = makeBridge();
-    const { bus } = makeBus();
-    const impl = newSvc(bridge, bus);
-
-    const result = await impl.abortBySession(SID);
-
-    expect(result.aborted).toBe(true);
-    expect(record.cancelCalls).toHaveLength(1);
-    expect(record.cancelCalls[0]).toEqual({
-      sessionId: SID,
-      agentId: 'main',
+    const steering = impl.steer(SID, [selected.prompt_id]);
+    const steerRejected = expect(steering).rejects.toMatchObject({
+      name: 'AbortError',
     });
-  });
-});
-
-describe('PromptService queue steer', () => {
-  it('steers a queued prompt into the active turn without starting a new prompt', async () => {
-    const { bridge, record } = makeBridge();
-    const { bus, events } = makeBus();
-    const impl = newSvc(bridge, bus);
-    const active = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }));
-    const queued = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'queued' }] }));
+    await steerReachedCore;
+    impl.dispose();
+    await steerRejected;
 
-    const result = await impl.steer(SID, [queued.prompt_id]);
-
-    expect(result).toEqual({ steered: true, prompt_ids: [queued.prompt_id] });
+    releaseSteer.resolve();
+    await Promise.resolve();
+    await Promise.resolve();
     expect(record.promptCalls).toHaveLength(1);
-    expect(record.steerCalls).toEqual([
-      {
-        sessionId: SID,
-        agentId: 'main',
-        input: [{ type: 'text', text: 'queued' }],
-      },
-    ]);
-    expect((await impl.list(SID)).queued).toHaveLength(0);
-    expect(
-      events.some((event) => {
-        const payload = event as unknown as {
-          type?: string;
-          activePromptId?: string;
-          promptIds?: readonly string[];
-        };
-        return (
-          payload.type === 'prompt.steered' &&
-          payload.activePromptId === active.prompt_id &&
-          payload.promptIds?.[0] === queued.prompt_id
-        );
-      }),
-    ).toBe(true);
+    expect(events.some((event) => event.type === 'prompt.steered')).toBe(false);
   });
 
-  it('joins multiple queued text prompts with blank lines when steering', async () => {
+  it('does not restore a failed steer into a replacement session lifecycle', async () => {
+    const steerStarted = createControlledPromise<void>();
+    const rejectSteer = createControlledPromise<void>();
     const { bridge, record } = makeBridge();
-    const { bus } = makeBus();
-    const impl = newSvc(bridge, bus);
-    await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }));
-    const first = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'first' }] }));
-    const second = await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'second' }] }));
-
-    await impl.steer(SID, [first.prompt_id, second.prompt_id]);
-
-    expect(record.steerCalls).toEqual([
-      {
-        sessionId: SID,
-        agentId: 'main',
-        input: [{ type: 'text', text: 'first\n\nsecond' }],
-      },
-    ]);
-    expect((await impl.list(SID)).queued).toHaveLength(0);
-  });
-
-  it('keeps queued prompts when core steer fails', async () => {
-    const { bridge } = makeBridge();
-    const { bus } = makeBus();
-    vi.mocked(bridge.rpc.steer).mockRejectedValueOnce(new Error('steer failed'));
-    const impl = newSvc(bridge, bus);
-    await impl.submit(SID, mkBodyMinimal({ content: [{ type: 'text', text: 'active' }] }));
-    const queued = await impl.submit(
+    vi.mocked(bridge.rpc.steer).mockImplementation(async (payload) => {
+      record.steerCalls.push(payload);
+      steerStarted.resolve();
+      await rejectSteer;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const { sessionService, triggerClose } = makeSessionService();
+    const impl = new PromptService(bridge, bus, makeAuth(), sessionService, new NoopLogService());
+    await impl.submit(
       SID,
-      mkBodyMinimal({ content: [{ type: 'text', text: 'queued' }] }),
+      mkBodyMinimal({ content: [{ type: 'text', text: 'retired active' }] }),
+    );
+    const retiredQueued = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'retired queued' }] }),
     );
+    triggerSubscribers({
+      type: 'turn.started',
+      turnId: 15,
+      origin: { kind: 'user' },
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
 
-    await expect(impl.steer(SID, [queued.prompt_id])).rejects.toThrow('steer failed');
+    const steerResult = impl.steer(SID, [retiredQueued.prompt_id]);
+    const steerRejected = expect(steerResult).rejects.toThrow('Session closed');
+    await steerStarted;
+    triggerClose(SID);
+    const replacement = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'replacement' }] }),
+    );
+    rejectSteer.reject(new Error('retired steer failed'));
+    await steerRejected;
 
-    expect((await impl.list(SID)).queued.map((prompt) => prompt.prompt_id)).toEqual([
-      queued.prompt_id,
-    ]);
+    expect(await impl.list(SID)).toMatchObject({
+      active: { prompt_id: replacement.prompt_id },
+      queued: [],
+    });
+    expect(
+      record.promptCalls.map(
+        (payload) => (payload as { input: Array<{ text?: string }> }).input[0]?.text,
+      ),
+    ).toEqual(['retired active', 'replacement']);
   });
 
   it('throws PromptNotFoundError when steering a prompt that is not queued', async () => {
@@ -1167,6 +3118,48 @@ describe('PromptService stateless controls — bootstrap + shadow', () => {
     expect(record.getPermissionCalls).toBe(2);
     expect(record.getPlanCalls).toBe(2);
   });
+
+  it('does not revive a closed session from a late bootstrap result', async () => {
+    const bootstrapStarted = createControlledPromise<void>();
+    const releaseConfig = createControlledPromise<
+      Awaited<ReturnType<CoreRPC['getConfig']>>
+    >();
+    const { bridge, record } = makeBridge();
+    vi.mocked(bridge.rpc.getConfig).mockImplementation(async () => {
+      record.getConfigCalls += 1;
+      bootstrapStarted.resolve();
+      return releaseConfig;
+    });
+    const { bus } = makeBus();
+    const { sessionService, triggerClose } = makeSessionService();
+    const impl = new PromptService(bridge, bus, makeAuth(), sessionService, new NoopLogService());
+
+    const retiredSubmit = impl.submit(SID, mkBody({ model: 'kimi-code/k1' }));
+    const retiredRejection = expect(retiredSubmit).rejects.toBeInstanceOf(
+      PromptAlreadyCompletedError,
+    );
+    await bootstrapStarted;
+    triggerClose(SID);
+
+    const replacement = await impl.submit(
+      SID,
+      mkBodyMinimal({ content: [{ type: 'text', text: 'replacement' }] }),
+    );
+    releaseConfig.resolve({
+      cwd: '/tmp/ws',
+      modelCapabilities: {} as never,
+      thinkingEffort: 'off',
+      systemPrompt: '',
+      modelAlias: 'kimi-code/k2',
+    });
+    await retiredRejection;
+
+    expect(impl._agentStateForTest(SID)).toBeUndefined();
+    expect(impl._dispatchLogForTest(SID)).toBeUndefined();
+    expect(record.setModelCalls).toHaveLength(0);
+    expect(record.promptCalls).toHaveLength(1);
+    expect((await impl.list(SID)).active?.prompt_id).toBe(replacement.prompt_id);
+  });
 });
 
 describe('PromptService stateless controls — diff dispatch', () => {
@@ -1325,15 +3318,44 @@ describe('PromptService stateless controls — live shadow updates', () => {
     triggerSubscribers({
       type: 'agent.status.updated',
       model: 'kimi-code/k1',
+      thinkingEffort: 'high',
       permission: 'yolo',
       planMode: true,
+      swarmMode: true,
       sessionId: SID,
       agentId: 'main',
     } as unknown as Event);
-    expect(impl._agentStateForTest(SID)).toMatchObject({
+    expect(impl.getAgentStateSnapshot(SID)).toMatchObject({
       model: 'kimi-code/k1',
+      thinking: 'high',
       permissionMode: 'yolo',
       planMode: true,
+      swarmMode: true,
+    });
+  });
+
+  it('ignores side-channel status updates when maintaining the main-agent shadow', async () => {
+    const { bridge } = makeBridge();
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+    await impl.submit(SID, mkBody());
+    triggerSubscribers({
+      type: 'agent.status.updated',
+      model: 'side-channel/model',
+      thinkingEffort: 'max',
+      permission: 'yolo',
+      planMode: true,
+      swarmMode: true,
+      sessionId: SID,
+      agentId: 'agent_btw',
+    } as unknown as Event);
+
+    expect(impl.getAgentStateSnapshot(SID)).toEqual({
+      model: 'kimi-code/k2',
+      thinking: 'off',
+      permissionMode: 'manual',
+      planMode: false,
+      swarmMode: false,
     });
   });
 
@@ -1381,6 +3403,83 @@ describe('PromptService stateless controls — live shadow updates', () => {
     } as unknown as Event);
     expect(impl._agentStateForTest(SID)).toBeUndefined();
   });
+
+  it('does not let a late setter acknowledgement overwrite a newer status event', async () => {
+    const setterReachedCore = createControlledPromise<void>();
+    const releaseSetter = createControlledPromise<{
+      readonly model: string;
+      readonly providerName?: string;
+    }>();
+    const { bridge, record } = makeBridge({
+      config: { modelAlias: 'kimi-code/k2' },
+    });
+    vi.mocked(bridge.rpc.setModel).mockImplementation(async (payload) => {
+      record.setModelCalls.push(payload);
+      setterReachedCore.resolve();
+      return releaseSetter;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const applying = impl.applyAgentState(
+      SID,
+      { model: 'kimi-code/k1' },
+      'meta',
+    );
+    await setterReachedCore;
+    triggerSubscribers({
+      type: 'agent.status.updated',
+      model: 'kimi-code/k3',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    releaseSetter.resolve({ model: 'kimi-code/k1' });
+    await applying;
+
+    expect(impl.getAgentStateSnapshot(SID)?.model).toBe('kimi-code/k3');
+    expect(record.setModelCalls).toEqual([
+      { sessionId: SID, agentId: 'main', model: 'kimi-code/k1' },
+    ]);
+  });
+
+  it('overlays status events that arrive during initial shadow bootstrap', async () => {
+    const configReadStarted = createControlledPromise<void>();
+    const releaseConfig = createControlledPromise<
+      Awaited<ReturnType<CoreRPC['getConfig']>>
+    >();
+    const { bridge, record } = makeBridge();
+    vi.mocked(bridge.rpc.getConfig).mockImplementation(async () => {
+      record.getConfigCalls += 1;
+      configReadStarted.resolve();
+      return releaseConfig;
+    });
+    const { bus, triggerSubscribers } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const applying = impl.applyAgentState(
+      SID,
+      { model: 'kimi-code/live' },
+      'meta',
+    );
+    await configReadStarted;
+    triggerSubscribers({
+      type: 'agent.status.updated',
+      model: 'kimi-code/live',
+      sessionId: SID,
+      agentId: 'main',
+    } as unknown as Event);
+    releaseConfig.resolve({
+      cwd: '/tmp/ws',
+      modelCapabilities: {} as never,
+      thinkingEffort: 'off',
+      systemPrompt: '',
+      modelAlias: 'kimi-code/k2',
+    });
+    await applying;
+
+    expect(record.setModelCalls).toHaveLength(0);
+    expect(impl.getAgentStateSnapshot(SID)?.model).toBe('kimi-code/live');
+  });
 });
 
 describe('PromptService stateless controls — dispatch log', () => {
@@ -1706,4 +3805,51 @@ describe('PromptService.applyAgentState (POST /sessions/{sid}/profile path)', ()
       permissionMode: 'yolo',
     });
   });
+
+  it('serializes concurrent setters so the later profile patch owns the final shadow', async () => {
+    const firstSetterStarted = createControlledPromise<void>();
+    const releaseFirstSetter = createControlledPromise<void>();
+    const secondSetterStarted = createControlledPromise<void>();
+    const { bridge, record } = makeBridge({
+      config: { modelAlias: 'kimi-code/k2' },
+    });
+    let setterCalls = 0;
+    vi.mocked(bridge.rpc.setModel).mockImplementation(async (payload) => {
+      setterCalls += 1;
+      record.setModelCalls.push(payload);
+      if (setterCalls === 1) {
+        firstSetterStarted.resolve();
+        await releaseFirstSetter;
+      } else {
+        secondSetterStarted.resolve();
+      }
+      return { model: (payload as { model: string }).model };
+    });
+    const { bus } = makeBus();
+    const impl = newSvc(bridge, bus);
+
+    const earlier = impl.applyAgentState(
+      SID,
+      { model: 'kimi-code/k1' },
+      'meta',
+    );
+    await firstSetterStarted;
+    const later = impl.applyAgentState(
+      SID,
+      { model: 'kimi-code/k3' },
+      'meta',
+    );
+
+    expect(record.setModelCalls).toEqual([
+      { sessionId: SID, agentId: 'main', model: 'kimi-code/k1' },
+    ]);
+    releaseFirstSetter.resolve();
+    await Promise.all([earlier, later, secondSetterStarted]);
+
+    expect(record.setModelCalls).toEqual([
+      { sessionId: SID, agentId: 'main', model: 'kimi-code/k1' },
+      { sessionId: SID, agentId: 'main', model: 'kimi-code/k3' },
+    ]);
+    expect(impl.getAgentStateSnapshot(SID)?.model).toBe('kimi-code/k3');
+  });
 });
diff --git a/packages/agent-core/test/session/lifecycle-hooks.test.ts b/packages/agent-core/test/session/lifecycle-hooks.test.ts
index 2993fc90eb..93bea8a324 100644
--- a/packages/agent-core/test/session/lifecycle-hooks.test.ts
+++ b/packages/agent-core/test/session/lifecycle-hooks.test.ts
@@ -1,3 +1,9 @@
+/**
+ * Session lifecycle and hook contracts through real session/agent workers.
+ * Filesystem, process, and provider behavior are controlled test boundaries.
+ * Run: pnpm --dir packages/agent-core exec vitest run test/session/lifecycle-hooks.test.ts
+ */
+
 import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'pathe';
@@ -10,7 +16,9 @@ import { testKaos } from '../fixtures/test-kaos';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
 import type { SDKSessionRPC } from '../../src/rpc';
+import { Agent } from '../../src/agent';
 import { Session } from '../../src/session';
+import { SessionAPIImpl } from '../../src/session/rpc';
 import { ProcessBackgroundTask } from '../../src/agent/background';
 import { agentTask } from '../agent/background/helpers';
 
@@ -111,6 +119,140 @@ describe('Session lifecycle hooks', () => {
     await expect(session.close()).resolves.toBeUndefined();
   });
 
+  it('does not let a synchronous metadata-event observer reject a prompt', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const observerError = new Error('metadata observer failed synchronously');
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>((event): Promise<void> => {
+      if (event.type === 'session.meta.updated') throw observerError;
+      return Promise.resolve();
+    });
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-meta-sync-observer',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    await session.createMain();
+    const warn = vi.spyOn(session.log, 'warn').mockImplementation(() => {});
+
+    await expect(
+      new SessionAPIImpl(session).prompt({
+        agentId: 'main',
+        input: [{ type: 'text', text: 'prompt survives sync observer failure' }],
+      }),
+    ).resolves.toMatchObject({ kind: 'started' });
+    expect(warn).toHaveBeenCalledWith('session event delivery failed', {
+      eventType: 'session.meta.updated',
+      error: observerError,
+    });
+
+    await session.close();
+  });
+
+  it('does not let an asynchronously rejected metadata event reject a prompt', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const observerError = new Error('metadata observer rejected asynchronously');
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>((event) =>
+      event.type === 'session.meta.updated' ? Promise.reject(observerError) : Promise.resolve(),
+    );
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-meta-async-observer',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    await session.createMain();
+    const warn = vi.spyOn(session.log, 'warn').mockImplementation(() => {});
+
+    await expect(
+      new SessionAPIImpl(session).prompt({
+        agentId: 'main',
+        input: [{ type: 'text', text: 'prompt survives async observer failure' }],
+      }),
+    ).resolves.toMatchObject({ kind: 'started' });
+    await vi.waitFor(() => {
+      expect(warn).toHaveBeenCalledWith('session event delivery failed', {
+        eventType: 'session.meta.updated',
+        error: observerError,
+      });
+    });
+
+    await session.close();
+  });
+
+  it('isolates a synchronous MCP status-event observer failure', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const observerError = new Error('MCP status observer failed synchronously');
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>((event): Promise<void> => {
+      if (event.type === 'mcp.server.status') throw observerError;
+      return Promise.resolve();
+    });
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-mcp-sync-observer',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const warn = vi.spyOn(session.log, 'warn').mockImplementation(() => {});
+    const emitters = session as unknown as {
+      onMcpServerStatusChange(entry: {
+        name: string;
+        transport: 'stdio';
+        status: 'failed';
+        toolCount: number;
+        error: string;
+      }): void;
+    };
+
+    expect(() => {
+      emitters.onMcpServerStatusChange({
+        name: 'example',
+        transport: 'stdio',
+        status: 'failed',
+        toolCount: 0,
+        error: 'connection failed',
+      });
+    }).not.toThrow();
+    expect(warn).toHaveBeenCalledWith('session event delivery failed', {
+      eventType: 'mcp.server.status',
+      error: observerError,
+    });
+
+    await session.close();
+  });
+
+  it('consumes an asynchronously rejected initial MCP error event', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const observerError = new Error('MCP error observer rejected asynchronously');
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>((event) =>
+      event.type === 'error' ? Promise.reject(observerError) : Promise.resolve(),
+    );
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-mcp-async-observer',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const warn = vi.spyOn(session.log, 'warn').mockImplementation(() => {});
+    const emitters = session as unknown as {
+      emitInitialMcpLoadError(error: unknown): void;
+    };
+
+    emitters.emitInitialMcpLoadError(new Error('initial MCP load failed'));
+    await vi.waitFor(() => {
+      expect(warn).toHaveBeenCalledWith('session event delivery failed', {
+        eventType: 'error',
+        error: observerError,
+      });
+    });
+
+    await session.close();
+  });
+
   it('stops background tasks on close by default', async () => {
     const { sessionDir, workDir } = await hookFixture();
     const session = new Session({
@@ -199,6 +341,7 @@ describe('Session lifecycle hooks', () => {
       .mockImplementation(() => turnSettled.promise as never);
     const cancelSpy = vi.spyOn(child.turn, 'cancel').mockImplementation(() => {
       turnSettled.resolve();
+      return Promise.resolve();
     });
     vi.spyOn(child.turn, 'hasActiveTurn', 'get').mockReturnValue(true);
     const abortController = new AbortController();
@@ -581,7 +724,7 @@ describe('Session lifecycle hooks', () => {
     await session.close();
   });
 
-  it('cancels an active foreground turn before closing', async () => {
+  it('awaits foreground agent shutdown before closing', async () => {
     const { sessionDir, workDir } = await hookFixture();
     const session = new Session({
       kaos: testKaos.withCwd(workDir),
@@ -591,22 +734,24 @@ describe('Session lifecycle hooks', () => {
       skills: { explicitDirs: [join(workDir, 'missing-skills')] },
     });
     const agent = await session.createMain();
-    const turnSettled = createDeferred<void>();
-    const waitSpy = vi
-      .spyOn(agent.turn, 'waitForCurrentTurn')
-      .mockImplementation(() => turnSettled.promise as never);
-    const cancelSpy = vi.spyOn(agent.turn, 'cancel').mockImplementation(() => {
-      turnSettled.resolve();
+    const shutdownSettled = createDeferred<void>();
+    const shutdownSpy = vi.spyOn(agent.turn, 'shutdown').mockImplementation(async () => {
+      await shutdownSettled.promise;
     });
-    vi.spyOn(agent.turn, 'hasActiveTurn', 'get').mockReturnValue(true);
 
-    await session.close();
+    let closeSettled = false;
+    const close = session.close().then(() => {
+      closeSettled = true;
+    });
+    await Promise.resolve();
+    expect(closeSettled).toBe(false);
 
-    expect(cancelSpy).toHaveBeenCalledWith(undefined, expect.any(Error));
-    expect(waitSpy).toHaveBeenCalledOnce();
+    shutdownSettled.resolve();
+    await close;
+    expect(shutdownSpy).toHaveBeenCalledWith(expect.any(Error));
   });
 
-  it('records session-close cancellation during UserPromptSubmit hooks as cancelled', async () => {
+  it('does not emit a terminal turn event after session shutdown begins', async () => {
     const { sessionDir, workDir } = await hookFixture();
     const hookStartedPath = join(workDir, 'hook-started');
     const hookScriptPath = join(workDir, 'blocking-user-prompt-hook.cjs');
@@ -642,18 +787,7 @@ describe('Session lifecycle hooks', () => {
     await session.close();
 
     const events = emitEvent.mock.calls.map(([event]) => event);
-    expect(events).toContainEqual(
-      expect.objectContaining({
-        type: 'turn.ended',
-        reason: 'cancelled',
-      }),
-    );
-    expect(events).not.toContainEqual(
-      expect.objectContaining({
-        type: 'turn.ended',
-        reason: 'failed',
-      }),
-    );
+    expect(events).not.toContainEqual(expect.objectContaining({ type: 'turn.ended' }));
   });
 
   it('keeps background tasks alive and skips SessionEnd hooks when closing for reload', async () => {
@@ -691,6 +825,279 @@ describe('Session lifecycle hooks', () => {
       },
     ]);
   });
+
+  it('awaits foreground agent shutdown when closing for reload', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-reload-shutdown',
+      homedir: sessionDir,
+      rpc: createSessionRpc(),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const agent = await session.createMain();
+    const shutdownSettled = createDeferred<void>();
+    const shutdownSpy = vi.spyOn(agent.turn, 'shutdown').mockImplementation(async () => {
+      await shutdownSettled.promise;
+    });
+
+    let reloadCloseSettled = false;
+    const reloadClose = session.closeForReload().then(() => {
+      reloadCloseSettled = true;
+    });
+    await Promise.resolve();
+    expect(reloadCloseSettled).toBe(false);
+
+    shutdownSettled.resolve();
+    await reloadClose;
+    expect(shutdownSpy).toHaveBeenCalledWith(expect.any(Error));
+  });
+
+  it('suppresses a delayed agent event after close returns', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>(async () => {});
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-close-late-event',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const agent = await session.createMain();
+    const releaseLateSetter = createDeferred<void>();
+    const lateSetter = releaseLateSetter.promise.then(() => {
+      agent.emitEvent({ type: 'warning', message: 'late setter event' });
+    });
+
+    await session.close();
+    emitEvent.mockClear();
+    releaseLateSetter.resolve();
+    await lateSetter;
+
+    expect(emitEvent).not.toHaveBeenCalled();
+  });
+
+  it('suppresses a delayed agent event after closeForReload returns', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>(async () => {});
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-reload-late-event',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const agent = await session.createMain();
+    const releaseLateSetter = createDeferred<void>();
+    const lateSetter = releaseLateSetter.promise.then(() => {
+      agent.emitEvent({ type: 'warning', message: 'late reload setter event' });
+    });
+
+    await session.closeForReload();
+    emitEvent.mockClear();
+    releaseLateSetter.resolve();
+    await lateSetter;
+
+    expect(emitEvent).not.toHaveBeenCalled();
+  });
+
+  it('waits for a pending agent creation and prevents it from committing after close', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>(async () => {});
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-close-pending-create',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const bootstrapStarted = createDeferred<void>();
+    const releaseBootstrap = createDeferred<void>();
+    vi.spyOn(
+      session as unknown as {
+        bootstrapAgentProfile(agent: Agent, profile: unknown): Promise<void>;
+      },
+      'bootstrapAgentProfile',
+    ).mockImplementation(async (agent) => {
+      bootstrapStarted.resolve();
+      await releaseBootstrap.promise;
+      agent.emitEvent({ type: 'warning', message: 'late create event' });
+    });
+
+    const creating = session.createMain();
+    await bootstrapStarted.promise;
+    let closeSettled = false;
+    const close = session.close().then(() => {
+      closeSettled = true;
+    });
+    await Promise.resolve();
+    expect(closeSettled).toBe(false);
+
+    emitEvent.mockClear();
+    releaseBootstrap.resolve();
+    await expect(creating).rejects.toMatchObject({ code: 'session.closed' });
+    await close;
+
+    expect(session.getReadyAgent('main')).toBeUndefined();
+    expect(emitEvent).not.toHaveBeenCalled();
+  });
+
+  it('waits for a pending agent resume and prevents it from committing after reload close', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    await writeFile(
+      join(sessionDir, 'state.json'),
+      JSON.stringify({
+        createdAt: '2026-01-01T00:00:00.000Z',
+        updatedAt: '2026-01-01T00:00:00.000Z',
+        title: 'Pending Resume',
+        isCustomTitle: false,
+        agents: { main: { type: 'main' } },
+        custom: {},
+      }),
+      'utf-8',
+    );
+    const emitEvent = vi.fn<SDKSessionRPC['emitEvent']>(async () => {});
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-reload-pending-resume',
+      homedir: sessionDir,
+      rpc: createSessionRpc({ emitEvent }),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const resumeStarted = createDeferred<void>();
+    const releaseResume = createDeferred<void>();
+    const resumeSpy = vi.spyOn(Agent.prototype, 'resume').mockImplementation(async function (
+      this: Agent,
+    ) {
+      resumeStarted.resolve();
+      await releaseResume.promise;
+      this.emitEvent({ type: 'warning', message: 'late resume event' });
+      return {};
+    });
+
+    try {
+      const resuming = session.resume();
+      await resumeStarted.promise;
+      let closeSettled = false;
+      const close = session.closeForReload().then(() => {
+        closeSettled = true;
+      });
+      await Promise.resolve();
+      expect(closeSettled).toBe(false);
+
+      emitEvent.mockClear();
+      releaseResume.resolve();
+      await expect(resuming).rejects.toMatchObject({ code: 'session.closed' });
+      await close;
+
+      expect(session.getReadyAgent('main')).toBeUndefined();
+      expect(emitEvent).not.toHaveBeenCalled();
+    } finally {
+      resumeSpy.mockRestore();
+    }
+  });
+
+  it('aborts and joins an in-flight startup SessionStart before firing SessionEnd', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-close-during-startup-hook',
+      homedir: sessionDir,
+      rpc: createSessionRpc(),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const startEntered = createDeferred<void>();
+    const releaseStart = createDeferred<void>();
+    const order: string[] = [];
+    let startSignal: AbortSignal | undefined;
+    vi.spyOn(session.hookEngine, 'trigger').mockImplementation((event, args = {}) => {
+      if (event === 'SessionStart') {
+        startSignal = args.signal;
+        order.push('SessionStart.begin');
+        startEntered.resolve();
+        return releaseStart.promise.then(() => {
+          order.push('SessionStart.end');
+          return [];
+        });
+      }
+      if (event === 'SessionEnd') order.push('SessionEnd');
+      return Promise.resolve([]);
+    });
+    vi.spyOn(
+      session as unknown as { flushMetadata(): Promise<void> },
+      'flushMetadata',
+    ).mockResolvedValue();
+
+    const creating = session.createMain();
+    await startEntered.promise;
+    const closing = session.close();
+    await new Promise<void>((resolve) => setImmediate(resolve));
+
+    expect(startSignal?.aborted).toBe(true);
+    expect(order).toEqual(['SessionStart.begin']);
+
+    releaseStart.resolve();
+    await expect(creating).rejects.toMatchObject({ code: 'session.closed' });
+    await closing;
+    expect(order).toEqual(['SessionStart.begin', 'SessionStart.end', 'SessionEnd']);
+  });
+
+  it('aborts and joins an in-flight resume SessionStart before firing SessionEnd', async () => {
+    const { sessionDir, workDir } = await hookFixture();
+    await writeFile(
+      join(sessionDir, 'state.json'),
+      JSON.stringify({
+        createdAt: '2026-01-01T00:00:00.000Z',
+        updatedAt: '2026-01-01T00:00:00.000Z',
+        title: 'Resume Hook Race',
+        isCustomTitle: false,
+        agents: {},
+        custom: {},
+      }),
+      'utf-8',
+    );
+    const session = new Session({
+      kaos: testKaos.withCwd(workDir),
+      id: 'session-close-during-resume-hook',
+      homedir: sessionDir,
+      rpc: createSessionRpc(),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const startEntered = createDeferred<void>();
+    const releaseStart = createDeferred<void>();
+    const order: string[] = [];
+    let startSignal: AbortSignal | undefined;
+    vi.spyOn(session.hookEngine, 'trigger').mockImplementation((event, args = {}) => {
+      if (event === 'SessionStart') {
+        startSignal = args.signal;
+        order.push('SessionStart.begin');
+        startEntered.resolve();
+        return releaseStart.promise.then(() => {
+          order.push('SessionStart.end');
+          return [];
+        });
+      }
+      if (event === 'SessionEnd') order.push('SessionEnd');
+      return Promise.resolve([]);
+    });
+    vi.spyOn(
+      session as unknown as { flushMetadata(): Promise<void> },
+      'flushMetadata',
+    ).mockResolvedValue();
+
+    const resuming = session.resume();
+    await startEntered.promise;
+    const closing = session.close();
+    await new Promise<void>((resolve) => setImmediate(resolve));
+
+    expect(startSignal?.aborted).toBe(true);
+    expect(order).toEqual(['SessionStart.begin']);
+
+    releaseStart.resolve();
+    await expect(resuming).rejects.toMatchObject({ code: 'session.closed' });
+    await closing;
+    expect(order).toEqual(['SessionStart.begin', 'SessionStart.end', 'SessionEnd']);
+  });
 });
 
 async function hookFixture(): Promise<{
diff --git a/packages/agent-core/test/session/subagent-host.test.ts b/packages/agent-core/test/session/subagent-host.test.ts
index 5aa36b9f73..72d0b720cb 100644
--- a/packages/agent-core/test/session/subagent-host.test.ts
+++ b/packages/agent-core/test/session/subagent-host.test.ts
@@ -1,8 +1,16 @@
+/**
+ * Foreground and background subagent lifecycle contracts through
+ * SessionSubagentHost. Real Agent turn workers are used; model generation,
+ * git context, tools, and hooks are controlled boundaries.
+ * Run with: pnpm --dir packages/agent-core exec vitest run test/session/subagent-host.test.ts
+ */
+
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'pathe';
 
 import { testKaos } from '../fixtures/test-kaos';
+import { createControlledPromise, type ControlledPromise } from '@antfu/utils';
 import { APIStatusError, type Message, type ToolCall } from '@moonshot-ai/kosong';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
@@ -522,6 +530,160 @@ describe('SessionSubagentHost', () => {
     expect(createAgent).not.toHaveBeenCalled();
   });
 
+  it('rejects spawn on cancellation while child creation ignores the signal', async () => {
+    const parent = testAgent();
+    parent.configure();
+    const child = testAgent();
+    const creationStarted = createControlledPromise<void>();
+    const releaseCreation = createControlledPromise<{ readonly id: string; readonly agent: Agent }>();
+    const session = fakeSession(parent.agent, child.agent);
+    vi.mocked(session.createAgent).mockImplementation(async () => {
+      creationStarted.resolve();
+      return releaseCreation;
+    });
+    const host = new SessionSubagentHost(session, 'main');
+    const controller = new AbortController();
+
+    const launch = host.spawn({
+      profileName: 'coder',
+      parentToolCallId: 'call_agent',
+      prompt: 'Implement the fix',
+      description: 'Fix bug',
+      runInBackground: false,
+      signal: controller.signal,
+    });
+    const launchResult = launch.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await creationStarted;
+
+    controller.abort(abortError('Cancelled during child creation'));
+
+    const result = await launchResult;
+    expect(result.status).toBe('rejected');
+    if (result.status === 'rejected') {
+      expect(result.error).toMatchObject({ name: 'AbortError' });
+    }
+
+    releaseCreation.resolve({ id: 'agent-0', agent: child.agent });
+    await releaseCreation;
+    await Promise.resolve();
+    expect(child.llmCalls).toHaveLength(0);
+    expect(parent.allEvents).not.toContainEqual(
+      expect.objectContaining({
+        type: '[rpc]',
+        event: 'subagent.spawned',
+      }),
+    );
+  });
+
+  it('rejects resume on cancellation while restoring the child ignores the signal', async () => {
+    const parent = testAgent();
+    parent.configure();
+    const child = testAgent();
+    child.configure();
+    child.agent.useProfile(
+      profile({ name: 'coder', tools: [], systemPrompt: 'coder prompt' }),
+    );
+    const childRestoreStarted = createControlledPromise<void>();
+    const releaseChildRestore = createControlledPromise<Agent>();
+    const session = fakeSession(parent.agent, child.agent, {
+      'agent-0': {
+        homedir: '/tmp/kimi-session/agents/agent-0',
+        type: 'sub',
+        parentAgentId: 'main',
+      },
+    });
+    vi.mocked(session.ensureAgentResumed).mockImplementation(async (agentId) => {
+      if (agentId === 'main') return parent.agent;
+      childRestoreStarted.resolve();
+      return releaseChildRestore;
+    });
+    const host = new SessionSubagentHost(session, 'main');
+    const controller = new AbortController();
+
+    const launch = host.resume('agent-0', {
+      parentToolCallId: 'call_agent',
+      prompt: 'Continue the fix',
+      description: 'Continue work',
+      runInBackground: false,
+      signal: controller.signal,
+    });
+    const launchResult = launch.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await childRestoreStarted;
+
+    controller.abort(abortError('Cancelled during child restore'));
+
+    const result = await launchResult;
+    expect(result.status).toBe('rejected');
+    if (result.status === 'rejected') {
+      expect(result.error).toMatchObject({ name: 'AbortError' });
+    }
+
+    releaseChildRestore.resolve(child.agent);
+    await releaseChildRestore;
+    await Promise.resolve();
+    expect(child.llmCalls).toHaveLength(0);
+    expect(parent.allEvents).not.toContainEqual(
+      expect.objectContaining({
+        type: '[rpc]',
+        event: 'subagent.spawned',
+      }),
+    );
+  });
+
+  it('settles cancellation while child system context preparation ignores the signal', async () => {
+    const contextStarted = createControlledPromise<void>();
+    const releaseContext = createControlledPromise<boolean>();
+    const contextKaos = createFakeKaos({
+      iterdir: async function* () {
+        contextStarted.resolve();
+        if (await releaseContext) yield '/workspace/late-entry';
+      },
+      stat: vi.fn(async () => {
+        throw new Error('Not found');
+      }),
+    });
+    const parent = testAgent();
+    parent.configure();
+    const child = testAgent();
+    const session = fakeSession(parent.agent, child.agent);
+    vi.mocked(session.systemContextKaos).mockReturnValue(contextKaos);
+    const host = new SessionSubagentHost(session, 'main');
+
+    const handle = await host.spawn({
+      profileName: 'coder',
+      parentToolCallId: 'call_agent',
+      prompt: 'Implement the fix',
+      description: 'Fix bug',
+      runInBackground: false,
+      signal,
+    });
+    const completion = handle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await contextStarted;
+
+    const cancellation = host.cancelAll(abortError('Cancelled during context preparation'));
+
+    await expect(cancellation).resolves.toBeUndefined();
+    const result = await completion;
+    expect(result.status).toBe('rejected');
+    if (result.status === 'rejected') {
+      expect(result.error).toMatchObject({ name: 'AbortError' });
+    }
+
+    releaseContext.resolve(false);
+    await releaseContext;
+    await Promise.resolve();
+    expect(child.llmCalls).toHaveLength(0);
+  });
+
   it('cancels the child turn when the caller signal aborts', async () => {
     const parent = testAgent();
     parent.configure();
@@ -550,7 +712,6 @@ describe('SessionSubagentHost', () => {
       expect.objectContaining({
         type: '[wire]',
         event: 'turn.cancel',
-        args: expect.objectContaining({ turnId: 0 }),
       }),
     );
     expect(parent.allEvents).toContainEqual(
@@ -565,13 +726,44 @@ describe('SessionSubagentHost', () => {
     );
   });
 
-  it('cancelAll aborts foreground children', async () => {
+  it('cancels the captured turn worker when its wait signal is already aborted', async () => {
+    const controlled = delayedAbortGenerate();
+    const child = testAgent({ generate: controlled.generate });
+    child.configure();
+
+    await child.rpc.prompt({ input: [{ type: 'text', text: 'Keep working' }] });
+    await controlled.started;
+    const turnSettlement = child.agent.turn.waitForCurrentTurn();
+    const controller = new AbortController();
+    controller.abort(abortError('Deadline reached'));
+
+    expect(() => child.agent.turn.waitForCurrentTurn(controller.signal)).toThrow(
+      'Deadline reached',
+    );
+    const cancelledByPreAbortedWait = child.allEvents.some(
+      (event) => event.type === '[wire]' && event.event === 'turn.cancel',
+    );
+    if (!cancelledByPreAbortedWait) {
+      // Keep the regression test self-cleaning against the old behavior: it
+      // records the failed contract above, then explicitly releases the turn.
+      void child.agent.turn.cancel(undefined, abortError('Test cleanup'));
+    }
+    await controlled.abortObserved;
+
+    controlled.release.resolve();
+    await expect(turnSettlement).resolves.toMatchObject({
+      event: { type: 'turn.ended', reason: 'cancelled' },
+    });
+    expect(cancelledByPreAbortedWait).toBe(true);
+  });
+
+  it('cancelAll waits for a foreground child turn to settle after abort', async () => {
     const parent = testAgent();
     parent.configure();
     parent.newEvents();
 
-    const child = testAgent();
-    child.mockNextResponse({ type: 'text', text: 'I will run Bash.' }, bashCall());
+    const controlled = delayedAbortGenerate();
+    const child = testAgent({ generate: controlled.generate });
     const session = fakeSession(parent.agent, child.agent);
     const host = new SessionSubagentHost(session, 'main');
 
@@ -583,20 +775,248 @@ describe('SessionSubagentHost', () => {
       runInBackground: false,
       signal,
     });
+    const completion = handle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
 
-    await child.untilApprovalRequest();
-    host.cancelAll();
+    await controlled.started;
+    const cancellation = host.cancelAll();
+    await controlled.abortObserved;
 
-    await expect(handle.completion).rejects.toThrow('Aborted');
+    expect(await settlesByNextMicrotask(cancellation)).toBe(false);
+    expect(await settlesByNextMicrotask(completion)).toBe(false);
+
+    controlled.release.resolve();
+    await cancellation;
+
+    const result = await completion;
+    expect(result.status).toBe('rejected');
+    if (result.status === 'rejected') expect(result.error).toMatchObject({ name: 'AbortError' });
+    expect(child.agent.turn.hasActiveTurn).toBe(false);
     expect(child.allEvents).toContainEqual(
       expect.objectContaining({
         type: '[wire]',
         event: 'turn.cancel',
-        args: expect.objectContaining({ turnId: 0 }),
       }),
     );
   });
 
+  it('RPC cancel waits for a foreground child while the main agent is idle', async () => {
+    const parent = testAgent();
+    parent.configure();
+    const controlled = delayedAbortGenerate();
+    const child = testAgent({ generate: controlled.generate });
+    const session = fakeSession(parent.agent, child.agent);
+    const host = new SessionSubagentHost(session, 'main');
+    Object.defineProperty(parent.agent, 'subagentHost', { value: host });
+
+    const handle = await host.spawn({
+      profileName: 'explore',
+      parentToolCallId: 'call_agent',
+      prompt: 'Keep working',
+      description: 'Long task',
+      runInBackground: false,
+      signal,
+    });
+    const completion = handle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await controlled.started;
+
+    const cancellation = parent.rpc.cancel({});
+    await controlled.abortObserved;
+    expect(parent.agent.turn.hasActiveTurn).toBe(false);
+    expect(await settlesByNextMicrotask(cancellation)).toBe(false);
+
+    controlled.release.resolve();
+    await cancellation;
+
+    expect((await completion).status).toBe('rejected');
+    expect(child.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('waits for foreground descendants when the caller signal cancels a child turn', async () => {
+    const parent = testAgent();
+    parent.configure();
+    const childControl = delayedAbortGenerate();
+    const child = testAgent({ generate: childControl.generate });
+    const grandchildControl = delayedAbortGenerate();
+    const grandchild = testAgent({ generate: grandchildControl.generate });
+    const childHost = new SessionSubagentHost(fakeSession(child.agent, grandchild.agent), 'main');
+    Object.defineProperty(child.agent, 'subagentHost', { value: childHost });
+    const parentHost = new SessionSubagentHost(fakeSession(parent.agent, child.agent), 'main');
+    const controller = new AbortController();
+
+    const childHandle = await parentHost.spawn({
+      profileName: 'coder',
+      parentToolCallId: 'call_child',
+      prompt: 'Implement the parent slice',
+      description: 'Implement parent slice',
+      runInBackground: false,
+      signal: controller.signal,
+    });
+    const childCompletion = childHandle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await childControl.started;
+
+    const grandchildHandle = await childHost.spawn({
+      profileName: 'coder',
+      parentToolCallId: 'call_grandchild',
+      prompt: 'Implement the nested slice',
+      description: 'Implement nested slice',
+      runInBackground: false,
+      signal,
+    });
+    const grandchildCompletion = grandchildHandle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await grandchildControl.started;
+
+    controller.abort(abortError('Caller stopped the child'));
+    await childControl.abortObserved;
+    await grandchildControl.abortObserved;
+    childControl.release.resolve();
+
+    expect(await settlesByNextMicrotask(childCompletion)).toBe(false);
+
+    grandchildControl.release.resolve();
+    const childResult = await childCompletion;
+    expect(childResult.status).toBe('rejected');
+    if (childResult.status === 'rejected') {
+      expect(childResult.error).toMatchObject({ name: 'AbortError' });
+    }
+    expect((await grandchildCompletion).status).toBe('rejected');
+  });
+
+  it('recursively waits for a foreground grandchild when its parent has not started a turn', async () => {
+    const collectStarted = createControlledPromise<void>();
+    const releaseCollection = createControlledPromise<string>();
+    vi.mocked(collectGitContext).mockImplementationOnce(async () => {
+      collectStarted.resolve();
+      return releaseCollection;
+    });
+    const parent = testAgent();
+    parent.configure();
+    const child = testAgent();
+    const grandchildControl = delayedAbortGenerate();
+    const grandchild = testAgent({ generate: grandchildControl.generate });
+    const childHost = new SessionSubagentHost(fakeSession(child.agent, grandchild.agent), 'main');
+    Object.defineProperty(child.agent, 'subagentHost', { value: childHost });
+    const parentHost = new SessionSubagentHost(fakeSession(parent.agent, child.agent), 'main');
+    Object.defineProperty(parent.agent, 'subagentHost', { value: parentHost });
+
+    const childHandle = await parentHost.spawn({
+      profileName: 'explore',
+      parentToolCallId: 'call_child',
+      prompt: 'Inspect the repository',
+      description: 'Inspect repository',
+      runInBackground: false,
+      signal,
+    });
+    const childCompletion = childHandle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await collectStarted;
+
+    const grandchildHandle = await childHost.spawn({
+      profileName: 'coder',
+      parentToolCallId: 'call_grandchild',
+      prompt: 'Implement the nested task',
+      description: 'Implement nested task',
+      runInBackground: false,
+      signal,
+    });
+    const grandchildCompletion = grandchildHandle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await grandchildControl.started;
+
+    const cancellation = parent.rpc.cancel({});
+    await grandchildControl.abortObserved;
+    releaseCollection.resolve('');
+    expect(await settlesByNextMicrotask(cancellation)).toBe(false);
+
+    grandchildControl.release.resolve();
+    await cancellation;
+
+    expect((await childCompletion).status).toBe('rejected');
+    expect((await grandchildCompletion).status).toBe('rejected');
+    expect(grandchild.agent.turn.hasActiveTurn).toBe(false);
+  });
+
+  it('leaves a background grandchild running when cancelling its foreground parent', async () => {
+    const collectStarted = createControlledPromise<void>();
+    const releaseCollection = createControlledPromise<string>();
+    vi.mocked(collectGitContext).mockImplementationOnce(async () => {
+      collectStarted.resolve();
+      return releaseCollection;
+    });
+    const parent = testAgent();
+    parent.configure();
+    const child = testAgent();
+    const grandchildControl = delayedAbortGenerate();
+    const grandchild = testAgent({ generate: grandchildControl.generate });
+    const childHost = new SessionSubagentHost(fakeSession(child.agent, grandchild.agent), 'main');
+    Object.defineProperty(child.agent, 'subagentHost', { value: childHost });
+    const parentHost = new SessionSubagentHost(fakeSession(parent.agent, child.agent), 'main');
+    Object.defineProperty(parent.agent, 'subagentHost', { value: parentHost });
+
+    const childHandle = await parentHost.spawn({
+      profileName: 'explore',
+      parentToolCallId: 'call_child',
+      prompt: 'Inspect the repository',
+      description: 'Inspect repository',
+      runInBackground: false,
+      signal,
+    });
+    const childCompletion = childHandle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await collectStarted;
+
+    const backgroundController = new AbortController();
+    const grandchildHandle = await childHost.spawn({
+      profileName: 'coder',
+      parentToolCallId: 'call_grandchild',
+      prompt: 'Keep monitoring in the background',
+      description: 'Monitor in background',
+      runInBackground: true,
+      signal: backgroundController.signal,
+    });
+    const grandchildCompletion = grandchildHandle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await grandchildControl.started;
+
+    const cancellation = parent.rpc.cancel({});
+    releaseCollection.resolve('');
+    await cancellation;
+
+    expect((await childCompletion).status).toBe('rejected');
+    expect(grandchild.agent.turn.hasActiveTurn).toBe(true);
+    expect(await settlesByNextMicrotask(grandchildCompletion)).toBe(false);
+    expect(grandchild.allEvents).not.toContainEqual(
+      expect.objectContaining({
+        type: '[wire]',
+        event: 'turn.cancel',
+      }),
+    );
+
+    backgroundController.abort(abortError('Test cleanup'));
+    await grandchildControl.abortObserved;
+    grandchildControl.release.resolve();
+    expect((await grandchildCompletion).status).toBe('rejected');
+  });
+
   it("tells a cancelled subagent's in-flight tools the user interrupted them", async () => {
     const parent = testAgent();
     parent.configure();
@@ -683,15 +1103,13 @@ describe('SessionSubagentHost', () => {
     });
 
     await child.untilApprovalRequest();
-    host.cancelAll();
-    await new Promise((resolve) => setTimeout(resolve, 20));
+    await host.cancelAll();
 
     expect(child.agent.turn.hasActiveTurn).toBe(true);
     expect(child.allEvents).not.toContainEqual(
       expect.objectContaining({
         type: '[wire]',
         event: 'turn.cancel',
-        args: expect.objectContaining({ turnId: 0 }),
       }),
     );
 
@@ -702,7 +1120,6 @@ describe('SessionSubagentHost', () => {
       expect.objectContaining({
         type: '[wire]',
         event: 'turn.cancel',
-        args: expect.objectContaining({ turnId: 0 }),
       }),
     );
   });
@@ -845,6 +1262,49 @@ describe('SessionSubagentHost', () => {
     });
   });
 
+  it('does not start an explore turn after cancellation during git context collection', async () => {
+    const collectStarted = createControlledPromise<void>();
+    const releaseCollection = createControlledPromise<string>();
+    vi.mocked(collectGitContext).mockImplementationOnce(async () => {
+      collectStarted.resolve();
+      return releaseCollection;
+    });
+    const parent = testAgent();
+    parent.configure();
+    const child = testAgent();
+    child.mockNextResponse({ type: 'text', text: 'This turn must not start.' });
+    const session = fakeSession(parent.agent, child.agent);
+    const host = new SessionSubagentHost(session, 'main');
+
+    const handle = await host.spawn({
+      profileName: 'explore',
+      parentToolCallId: 'call_agent',
+      prompt: 'Find the cause',
+      description: 'Find cause',
+      runInBackground: false,
+      signal,
+    });
+    const completion = handle.completion.then(
+      () => ({ status: 'fulfilled' as const }),
+      (error: unknown) => ({ status: 'rejected' as const, error }),
+    );
+    await collectStarted;
+
+    const cancellation = host.cancelAll(abortError('Cancelled during context collection'));
+
+    await expect(cancellation).resolves.toBeUndefined();
+    const result = await completion;
+    expect(result.status).toBe('rejected');
+    if (result.status === 'rejected') {
+      expect(result.error).toMatchObject({ name: 'AbortError' });
+    }
+
+    releaseCollection.resolve('<git-context>late context</git-context>');
+    await releaseCollection;
+    await Promise.resolve();
+    expect(child.llmCalls).toHaveLength(0);
+  });
+
   it('does not prepend git context for non-explore subagents', async () => {
     const parent = testAgent();
     parent.configure();
@@ -1113,7 +1573,18 @@ describe('SessionSubagentHost', () => {
 
     await expect(retryHandle.completion).resolves.toMatchObject({ result: summary.trim() });
     expect(generateCalls).toBe(2);
-    expect(userTextMessages(histories[1] ?? [])).toEqual(['Implement the retry-safe change']);
+    expect(userTextMessages(histories[1] ?? [])).toEqual([
+      'Implement the retry-safe change',
+      [
+        '<system-reminder>',
+        'The previous turn ended before producing a final response.',
+        '',
+        'Error: The model provider rate-limited the request.',
+        '',
+        'The preceding user request may still be unfinished. Treat the next user message as a follow-up.',
+        '</system-reminder>',
+      ].join('\n'),
+    ]);
   });
 
   it('realigns a resumed subagent to the parent agent current model', async () => {
@@ -1618,6 +2089,54 @@ function fakeSession(
   } as unknown as Session;
 }
 
+function delayedAbortGenerate(): {
+  readonly generate: GenerateFn;
+  readonly started: Promise<void>;
+  readonly abortObserved: Promise<void>;
+  readonly release: ControlledPromise;
+} {
+  const started = createControlledPromise<void>();
+  const abortObserved = createControlledPromise<void>();
+  const release = createControlledPromise<void>();
+  const generate: GenerateFn = async (
+    _provider,
+    _systemPrompt,
+    _tools,
+    _history,
+    _callbacks,
+    options,
+  ) => {
+    started.resolve();
+    options?.signal?.addEventListener(
+      'abort',
+      () => {
+        abortObserved.resolve();
+      },
+      { once: true },
+    );
+    await abortObserved;
+    await release;
+    throw abortError();
+  };
+  return { generate, started, abortObserved, release };
+}
+
+async function settlesByNextMicrotask(promise: Promise<unknown>): Promise<boolean> {
+  let settled = false;
+  void promise.then(
+    () => {
+      settled = true;
+    },
+    () => {
+      settled = true;
+    },
+  );
+  await new Promise<void>((resolve) => {
+    queueMicrotask(resolve);
+  });
+  return settled;
+}
+
 function contextProfile(): ResolvedAgentProfile {
   return {
     name: 'context-profile',
diff --git a/packages/kosong/src/generate.ts b/packages/kosong/src/generate.ts
index 5d6a906086..492a05fbcc 100644
--- a/packages/kosong/src/generate.ts
+++ b/packages/kosong/src/generate.ts
@@ -112,12 +112,19 @@ export async function generate(
     : tools;
 
   options?.onRequestStart?.();
-  const stream = await provider.generate(systemPrompt, wireTools, history, options);
+  const providerRequest = provider.generate(systemPrompt, wireTools, history, options);
+  const stream = await waitForAbort(providerRequest, options?.signal, {
+    // A provider may ignore AbortSignal and resolve after the caller has
+    // already moved on. Retire that late stream without ever iterating it.
+    onLateResolve: (lateStream) => {
+      requestCancellation(lateStream);
+    },
+  });
 
   // Post-await abort check: `provider.generate()` may have resolved before
   // noticing a mid-flight abort. Reject immediately rather than draining
   // the stream.
-  await throwIfAborted(options?.signal, stream);
+  throwIfAborted(options?.signal, stream);
 
   // Decode-phase accounting. We split the window from the first streamed part
   // to stream end into time spent awaiting the next part (server + network) vs.
@@ -131,7 +138,7 @@ export async function generate(
   let firstPartAt: number | undefined;
   let lastResumeAt = 0;
 
-  for await (const part of stream) {
+  for await (const part of iterateWithAbort(stream, options?.signal)) {
     const arrivedAt = Date.now();
     if (firstPartAt === undefined) {
       firstPartAt = arrivedAt;
@@ -140,12 +147,14 @@ export async function generate(
     }
 
     try {
-      await throwIfAborted(options?.signal, stream);
+      // The abort-aware iterator owns stream cleanup while its yielded part is
+      // being consumed. Let closing the iterator request cancellation once.
+      throwIfAborted(options?.signal);
 
       // Notify raw part callback (deep copy to avoid aliasing mutations).
       if (callbacks?.onMessagePart !== undefined) {
-        await callbacks.onMessagePart(deepCopyPart(part));
-        await throwIfAborted(options?.signal, stream);
+        await waitForAbort(callbacks.onMessagePart(deepCopyPart(part)), options?.signal);
+        throwIfAborted(options?.signal);
       }
 
       // Index-based routing for parallel tool call argument deltas.
@@ -188,7 +197,7 @@ export async function generate(
     }
   }
 
-  await throwIfAborted(options?.signal, stream);
+  throwIfAborted(options?.signal, stream);
   if (firstPartAt !== undefined) {
     // Tail wait: from the last processed part to the stream's done signal.
     serverDecodeMs += Date.now() - lastResumeAt;
@@ -234,9 +243,9 @@ export async function generate(
   }
 
   // Fire onToolCall for every fully-assembled tool call, in final order.
-  if (callbacks?.onToolCall !== undefined) {
+  if (callbacks?.onToolCall !== undefined && message.toolCalls.length > 0) {
+    throwIfAborted(options?.signal, stream);
     for (const toolCall of message.toolCalls) {
-      await throwIfAborted(options?.signal, stream);
       await callbacks.onToolCall(toolCall);
     }
   }
@@ -250,34 +259,165 @@ export async function generate(
   };
 }
 
-type CancelableStream = StreamedMessage & {
+type CancelableTarget = {
   cancel?: () => unknown;
   return?: () => unknown;
 };
 
 function throwAbortError(): never {
-  throw new DOMException('The operation was aborted.', 'AbortError');
+  throw createAbortError();
 }
 
-async function cancelStream(stream: StreamedMessage): Promise<void> {
-  const cancelable = stream as CancelableStream;
+/**
+ * Ask provider-owned resources to stop without making caller cancellation
+ * depend on provider cooperation. Both synchronous throws and eventual
+ * rejections are contained: cancellation is best-effort cleanup, never a new
+ * reason for the turn worker to remain pending.
+ */
+function requestCancellation(...targets: unknown[]): void {
+  const seen = new Set<unknown>();
+  for (const target of targets) {
+    if (
+      target === null ||
+      (typeof target !== 'object' && typeof target !== 'function') ||
+      seen.has(target)
+    ) {
+      continue;
+    }
+    seen.add(target);
+    const cancelable = target as CancelableTarget;
+    invokeCancellation(cancelable, 'cancel');
+    invokeCancellation(cancelable, 'return');
+  }
+}
 
+function invokeCancellation(target: CancelableTarget, method: keyof CancelableTarget): void {
   try {
-    await cancelable.cancel?.();
+    const cleanup = target[method]?.();
+    // Attaching a rejection handler also prevents a provider that rejects its
+    // cleanup promise later from producing an unhandled rejection.
+    void Promise.resolve(cleanup).catch(() => {});
   } catch {}
+}
+
+interface AbortWaitOptions<T> {
+  readonly onAbort?: () => void;
+  readonly onLateResolve?: (value: T) => void;
+}
+
+/**
+ * Wait for an external operation while making AbortSignal authoritative even
+ * when that operation ignores it. The original promise always keeps handlers
+ * attached, so a late resolution/rejection is observed but cannot re-enter
+ * the caller after cancellation.
+ */
+function waitForAbort<T>(
+  value: T | PromiseLike<T>,
+  signal?: AbortSignal,
+  options?: AbortWaitOptions<T>,
+): Promise<T> {
+  const promise = Promise.resolve(value);
+  if (signal === undefined) return promise;
+
+  return new Promise<T>((resolve, reject) => {
+    let settled = false;
+    const removeAbortListener = (): void => {
+      signal.removeEventListener('abort', onAbort);
+    };
+    const onAbort = (): void => {
+      if (settled) return;
+      settled = true;
+      removeAbortListener();
+      try {
+        options?.onAbort?.();
+      } catch {}
+      reject(createAbortError());
+    };
+
+    if (signal.aborted) {
+      onAbort();
+    } else {
+      signal.addEventListener('abort', onAbort, { once: true });
+    }
+
+    void promise.then(
+      (result) => {
+        if (settled) {
+          try {
+            options?.onLateResolve?.(result);
+          } catch {}
+          return;
+        }
+        settled = true;
+        removeAbortListener();
+        resolve(result);
+      },
+      (error: unknown) => {
+        if (settled) return;
+        settled = true;
+        removeAbortListener();
+        reject(error);
+      },
+    );
+  });
+}
+
+/**
+ * Abort-aware adapter around an arbitrary provider iterator. In particular,
+ * `next()` is raced independently for every chunk: a provider that stops
+ * answering after an abort cannot pin the generate call forever. Late iterator
+ * results remain consumed by `waitForAbort` and are never yielded to callbacks.
+ */
+async function* iterateWithAbort(
+  stream: StreamedMessage,
+  signal?: AbortSignal,
+): AsyncGenerator<StreamedMessagePart> {
+  const iterator = stream[Symbol.asyncIterator]();
+  let completed = false;
+  let cancellationRequested = false;
+  const cancel = (): void => {
+    if (cancellationRequested) return;
+    cancellationRequested = true;
+    // The stream owns transport cancellation; the iterator owns iteration
+    // teardown. Avoid also calling stream.return / iterator.cancel, which can
+    // close the same provider resource twice through wrapper aliases.
+    invokeCancellation(stream as CancelableTarget, 'cancel');
+    invokeCancellation(iterator as CancelableTarget, 'return');
+  };
 
   try {
-    await cancelable.return?.();
-  } catch {}
+    while (true) {
+      if (signal?.aborted) {
+        cancel();
+        throwAbortError();
+      }
+      const next = await waitForAbort(iterator.next(), signal, { onAbort: cancel });
+      if (signal?.aborted) {
+        cancel();
+        throwAbortError();
+      }
+      if (next.done === true) {
+        completed = true;
+        return;
+      }
+      yield next.value;
+    }
+  } finally {
+    if (!completed) cancel();
+  }
+}
+
+function createAbortError(): DOMException {
+  return new DOMException('The operation was aborted.', 'AbortError');
 }
 
-async function throwIfAborted(signal?: AbortSignal, stream?: StreamedMessage): Promise<void> {
+function throwIfAborted(signal?: AbortSignal, stream?: StreamedMessage): void {
   if (!signal?.aborted) {
     return;
   }
 
   if (stream !== undefined) {
-    await cancelStream(stream);
+    requestCancellation(stream);
   }
 
   throwAbortError();
diff --git a/packages/kosong/src/provider.ts b/packages/kosong/src/provider.ts
index ddcc30f87d..6fbdd96029 100644
--- a/packages/kosong/src/provider.ts
+++ b/packages/kosong/src/provider.ts
@@ -92,6 +92,11 @@ export type FinishReason =
  */
 export interface StreamedMessage {
   [Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart>;
+  /**
+   * Requests best-effort cancellation of provider-owned transport resources.
+   * Implementations must return promptly and must not wait for stream cleanup.
+   */
+  cancel?(): void;
   /** Provider-assigned response identifier, or `null` if not available. */
   readonly id: string | null;
   /** Token usage statistics, populated after the stream completes. */
@@ -127,8 +132,9 @@ export interface GenerateOptions {
    * An {@link AbortSignal} that, when aborted, requests cancellation of the
    * in-flight generate call. Providers that accept a signal will forward it
    * to their underlying HTTP client; the generate loop in
-   * {@link generate | generate()} also checks the signal between streamed
-   * parts.
+   * {@link generate | generate()} also makes the signal authoritative while
+   * waiting for the provider request, each streamed `next()`, and
+   * `onMessagePart` callbacks.
    */
   signal?: AbortSignal;
   /**
diff --git a/packages/kosong/src/providers/anthropic.ts b/packages/kosong/src/providers/anthropic.ts
index d538d11ac5..61315f1f05 100644
--- a/packages/kosong/src/providers/anthropic.ts
+++ b/packages/kosong/src/providers/anthropic.ts
@@ -48,6 +48,7 @@ import {
   sanitizeToolCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 
 /**
  * Normalize an Anthropic `stop_reason` string to the unified
@@ -679,8 +680,10 @@ class AnthropicStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(response: unknown, isStream: boolean) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(response as AsyncIterable<MessageStreamEvent>);
     } else {
@@ -725,6 +728,10 @@ class AnthropicStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/kosong/src/providers/google-genai.ts b/packages/kosong/src/providers/google-genai.ts
index ad69fc0c59..9644275e7c 100644
--- a/packages/kosong/src/providers/google-genai.ts
+++ b/packages/kosong/src/providers/google-genai.ts
@@ -21,6 +21,7 @@ import { ApiError as GoogleApiError, GoogleGenAI as GenAIClient } from '@google/
 import { mergeConsecutiveUserMessages } from './merge-user-messages';
 
 import { requireProviderApiKey, resolveAuthBackedClient } from './request-auth';
+import { cancelNativeStream } from './stream-cancellation';
 
 /**
  * Normalize a Google GenAI (Gemini) `finishReason` value to the unified
@@ -220,24 +221,13 @@ function createAbortError(): DOMException {
   return new DOMException('The operation was aborted.', 'AbortError');
 }
 
-async function abortPromise(signal: AbortSignal | undefined): Promise<never> {
-  if (signal === undefined) {
-    return new Promise(() => {
-      // Intentionally never settles when no signal is provided.
-    });
-  }
-  if (signal.aborted) {
-    throw createAbortError();
-  }
-  return new Promise((_, reject) => {
-    signal.addEventListener(
-      'abort',
-      () => {
-        reject(createAbortError());
-      },
-      { once: true },
-    );
-  });
+function mergeAbortSignals(
+  ...signals: Array<AbortSignal | null | undefined>
+): AbortSignal {
+  const definedSignals = signals.filter(
+    (signal): signal is AbortSignal => signal !== null && signal !== undefined,
+  );
+  return AbortSignal.any(definedSignals);
 }
 
 function messageToGoogleGenAI(message: Message): GoogleContent {
@@ -503,12 +493,15 @@ export class GoogleGenAIStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(
     response: AsyncIterable<Record<string, unknown>> | Record<string, unknown>,
     isStream: boolean,
     signal?: AbortSignal,
+    private readonly _transportController?: AbortController,
   ) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(
         response as AsyncIterable<Record<string, unknown>>,
@@ -535,6 +528,13 @@ export class GoogleGenAIStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    try {
+      this._transportController?.abort();
+    } catch {}
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
@@ -665,9 +665,8 @@ export class GoogleGenAIStreamedMessage implements StreamedMessage {
   ): AsyncGenerator<StreamedMessagePart> {
     try {
       for await (const chunk of response) {
-        // Check abort at each chunk boundary so users who pass an
-        // AbortSignal see cancellation honored promptly even though the
-        // Google GenAI SDK does not forward it to the underlying fetch.
+        // Keep a provider-boundary check in addition to the signal forwarded
+        // to the SDK so a late chunk can never be converted after cancellation.
         this._throwIfAborted(signal);
         this._extractUsage(chunk);
         this._extractId(chunk);
@@ -832,17 +831,29 @@ export class GoogleGenAIChatProvider implements ChatProvider {
     history: Message[],
     options?: GenerateOptions,
   ): Promise<StreamedMessage> {
-    // Short-circuit if the caller has already aborted — the Google GenAI
-    // SDK will not honor the signal natively, so we must check manually.
     if (options?.signal?.aborted === true) {
       throw createAbortError();
     }
 
     const contents = messagesToGoogleGenAIContents(history);
+    const transportController = new AbortController();
+    const configuredSignal = this._generationKwargs['abortSignal'] as
+      | AbortSignal
+      | null
+      | undefined;
+    const requestSignal = mergeAbortSignals(
+      configuredSignal,
+      options?.signal,
+      transportController.signal,
+    );
+    if (requestSignal.aborted) {
+      throw createAbortError();
+    }
 
     const config: Record<string, unknown> = {
       ...this._generationKwargs,
       systemInstruction: systemPrompt,
+      abortSignal: requestSignal,
       ...(tools.length > 0 ? { tools: tools.map((t) => toolToGoogleGenAI(t)) } : {}),
     };
     applyResponseFormat(config, options?.responseFormat);
@@ -856,31 +867,23 @@ export class GoogleGenAIChatProvider implements ChatProvider {
 
       const params = { model: this._model, contents, config };
 
-      // The Google GenAI SDK does not accept an AbortSignal, so we must race
-      // the initial SDK request against the caller's abort signal ourselves.
-      // Once we have a response/stream object, the wrapper below continues to
-      // check the signal at each chunk boundary.
       options?.onRequestSent?.();
       if (this._stream) {
-        const stream = await Promise.race([
-          models.generateContentStream(params),
-          abortPromise(options?.signal),
-        ]);
+        const stream = await models.generateContentStream(params);
         return new GoogleGenAIStreamedMessage(
           stream as AsyncIterable<Record<string, unknown>>,
           true,
-          options?.signal,
+          requestSignal,
+          transportController,
         );
       }
 
-      const response = await Promise.race([
-        models.generateContent(params),
-        abortPromise(options?.signal),
-      ]);
+      const response = await models.generateContent(params);
       return new GoogleGenAIStreamedMessage(
         response as Record<string, unknown>,
         false,
-        options?.signal,
+        requestSignal,
+        transportController,
       );
     } catch (error: unknown) {
       if (error instanceof DOMException && error.name === 'AbortError') {
diff --git a/packages/kosong/src/providers/kimi.ts b/packages/kosong/src/providers/kimi.ts
index d114201958..a9884397e5 100644
--- a/packages/kosong/src/providers/kimi.ts
+++ b/packages/kosong/src/providers/kimi.ts
@@ -40,6 +40,7 @@ import {
   sanitizeToolCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 export interface KimiOptions {
   apiKey?: string | undefined;
   baseUrl?: string | undefined;
@@ -251,11 +252,13 @@ class KimiStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(
     response: OpenAI.Chat.ChatCompletion | AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
     isStream: boolean,
   ) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(
         response as AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
@@ -281,6 +284,10 @@ class KimiStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/kosong/src/providers/openai-legacy.ts b/packages/kosong/src/providers/openai-legacy.ts
index 98e109e891..721e1a44b7 100644
--- a/packages/kosong/src/providers/openai-legacy.ts
+++ b/packages/kosong/src/providers/openai-legacy.ts
@@ -41,6 +41,7 @@ import {
   sanitizeToolCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 
 // Inbound: scan in priority order; first string value wins. Outbound: the first
 // entry doubles as the default field we serialize ThinkPart back into. Both
@@ -325,12 +326,14 @@ export class OpenAILegacyStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(
     response: OpenAI.Chat.ChatCompletion | AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
     isStream: boolean,
     reasoningKey: string | undefined,
   ) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(
         response as AsyncIterable<OpenAI.Chat.ChatCompletionChunk>,
@@ -360,6 +363,10 @@ export class OpenAILegacyStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/kosong/src/providers/openai-responses.ts b/packages/kosong/src/providers/openai-responses.ts
index baf8666abe..c1997be4b2 100644
--- a/packages/kosong/src/providers/openai-responses.ts
+++ b/packages/kosong/src/providers/openai-responses.ts
@@ -37,6 +37,7 @@ import {
   sanitizeOpenAIResponsesCallId,
   type ToolCallIdPolicy,
 } from './tool-call-id';
+import { cancelNativeStream } from './stream-cancellation';
 
 /**
  * Normalize the Responses API status / incomplete_details into the unified
@@ -660,8 +661,10 @@ export class OpenAIResponsesStreamedMessage implements StreamedMessage {
   private _finishReason: FinishReason | null = null;
   private _rawFinishReason: string | null = null;
   private readonly _iter: AsyncGenerator<StreamedMessagePart>;
+  private readonly _nativeStream: unknown;
 
   constructor(response: unknown, isStream: boolean) {
+    this._nativeStream = isStream ? response : undefined;
     if (isStream) {
       this._iter = this._convertStreamResponse(response as AsyncIterable<RawObject>);
     } else {
@@ -685,6 +688,10 @@ export class OpenAIResponsesStreamedMessage implements StreamedMessage {
     return this._rawFinishReason;
   }
 
+  cancel(): void {
+    cancelNativeStream(this._nativeStream);
+  }
+
   async *[Symbol.asyncIterator](): AsyncIterator<StreamedMessagePart> {
     yield* this._iter;
   }
diff --git a/packages/kosong/src/providers/stream-cancellation.ts b/packages/kosong/src/providers/stream-cancellation.ts
new file mode 100644
index 0000000000..03c88b04c3
--- /dev/null
+++ b/packages/kosong/src/providers/stream-cancellation.ts
@@ -0,0 +1,21 @@
+type NativeCancelableStream = {
+  abort?: () => unknown;
+  controller?: {
+    abort(): unknown;
+  };
+};
+
+export function cancelNativeStream(stream: unknown): void {
+  if (stream === null || (typeof stream !== 'object' && typeof stream !== 'function')) {
+    return;
+  }
+
+  const cancelable = stream as NativeCancelableStream;
+  try {
+    if (typeof cancelable.abort === 'function') {
+      void Promise.resolve(cancelable.abort()).catch(() => {});
+      return;
+    }
+    void Promise.resolve(cancelable.controller?.abort()).catch(() => {});
+  } catch {}
+}
diff --git a/packages/kosong/test/generate.test.ts b/packages/kosong/test/generate.test.ts
index 152a89f6aa..f60bf3111c 100644
--- a/packages/kosong/test/generate.test.ts
+++ b/packages/kosong/test/generate.test.ts
@@ -1,3 +1,9 @@
+/**
+ * Streaming generation contracts with a provider as the only stubbed external
+ * boundary. Covers message assembly, callbacks, diagnostics, and cancellation.
+ * Run with: pnpm --filter @moonshot-ai/kosong exec vitest run test/generate.test.ts
+ */
+
 import { APIEmptyResponseError } from '#/errors';
 import { generate } from '#/generate';
 import type { Message, StreamedMessagePart, ToolCall } from '#/message';
@@ -745,6 +751,127 @@ describe('generate()', () => {
     expect(calledGenerate).toBe(false);
   });
 
+  it('rejects on abort when provider.generate never settles', async () => {
+    const controller = new AbortController();
+    let providerCalled = false;
+    const provider: ChatProvider = {
+      name: 'mock',
+      modelName: 'mock-model',
+      thinkingEffort: null,
+      generate: () => {
+        providerCalled = true;
+        return new Promise<StreamedMessage>(() => {});
+      },
+      withThinking(_effort: ThinkingEffort): ChatProvider {
+        return this;
+      },
+    };
+
+    const result = generate(provider, '', [], [], undefined, { signal: controller.signal });
+    expect(providerCalled).toBe(true);
+
+    controller.abort();
+
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+  });
+
+  it('cancels a stream that provider.generate resolves after abort', async () => {
+    const controller = new AbortController();
+    let resolveProvider!: (stream: StreamedMessage) => void;
+    const providerResult = new Promise<StreamedMessage>((resolve) => {
+      resolveProvider = resolve;
+    });
+    const provider: ChatProvider = {
+      name: 'mock',
+      modelName: 'mock-model',
+      thinkingEffort: null,
+      generate: () => providerResult,
+      withThinking(_effort: ThinkingEffort): ChatProvider {
+        return this;
+      },
+    };
+    const cancel = vi.fn<() => void>();
+    const lateStream = Object.assign(createMockStream([]), { cancel });
+    const result = generate(provider, '', [], [], undefined, { signal: controller.signal });
+
+    controller.abort();
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+
+    resolveProvider(lateStream);
+    await providerResult;
+    expect(cancel).toHaveBeenCalledOnce();
+  });
+
+  it('ignores a late iterator result after abort while stream cleanup remains pending', async () => {
+    const controller = new AbortController();
+    let markNextStarted!: () => void;
+    const nextStarted = new Promise<void>((resolve) => {
+      markNextStarted = resolve;
+    });
+    let resolveNext!: (result: IteratorResult<StreamedMessagePart>) => void;
+    const pendingNext = new Promise<IteratorResult<StreamedMessagePart>>((resolve) => {
+      resolveNext = resolve;
+    });
+    const iterator: AsyncIterator<StreamedMessagePart> = {
+      next: () => {
+        markNextStarted();
+        return pendingNext;
+      },
+      return: vi.fn(() => new Promise<IteratorResult<StreamedMessagePart>>(() => {})),
+    };
+    const stream: StreamedMessage = {
+      id: null,
+      usage: null,
+      finishReason: null,
+      rawFinishReason: null,
+      [Symbol.asyncIterator]: () => iterator,
+    };
+    const onMessagePart = vi.fn<(part: StreamedMessagePart) => void>();
+    const result = generate(
+      createMockProvider(stream),
+      '',
+      [],
+      [],
+      { onMessagePart },
+      { signal: controller.signal },
+    );
+    await nextStarted;
+
+    controller.abort();
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+
+    resolveNext({ done: false, value: { type: 'text', text: 'late output' } });
+    await pendingNext;
+    expect(onMessagePart).not.toHaveBeenCalled();
+    expect(iterator.return).toHaveBeenCalledOnce();
+  });
+
+  it('rejects on abort when an asynchronous message callback never settles', async () => {
+    const controller = new AbortController();
+    let markCallbackStarted!: () => void;
+    const callbackStarted = new Promise<void>((resolve) => {
+      markCallbackStarted = resolve;
+    });
+    const result = generate(
+      createMockProvider(createMockStream([{ type: 'text', text: 'partial' }])),
+      '',
+      [],
+      [],
+      {
+        onMessagePart: () => {
+          markCallbackStarted();
+          return new Promise<void>(() => {});
+        },
+      },
+      { signal: controller.signal },
+    );
+    await callbackStarted;
+
+    controller.abort();
+
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+  });
+
   it('signal aborted between provider.generate() and stream iteration is honored', async () => {
     const controller = new AbortController();
     let observedParts = 0;
@@ -827,9 +954,9 @@ describe('generate()', () => {
     expect(onToolCall).not.toHaveBeenCalled();
   });
 
-  it('post-await abort cancels the acquired stream before throwing AbortError', async () => {
+  it('rejects after requesting stream cancellation without waiting for cleanup', async () => {
     const controller = new AbortController();
-    const cancel = vi.fn<() => Promise<void>>().mockResolvedValue(undefined);
+    const cancel = vi.fn<() => Promise<void>>(() => new Promise<void>(() => {}));
 
     const stream: StreamedMessage & { cancel(): Promise<void> } = {
       cancel,
@@ -895,6 +1022,34 @@ describe('generate()', () => {
     expect(received).toEqual(['first', 'second']);
   });
 
+  it('dispatches every completed tool call when the first post-stream callback aborts', async () => {
+    const controller = new AbortController();
+    const stream = createMockStream([
+      { type: 'function', id: 'first', name: 'f', arguments: '{}' },
+      { type: 'function', id: 'second', name: 'g', arguments: '{}' },
+    ]);
+    const received: string[] = [];
+
+    const result = await generate(
+      createMockProvider(stream),
+      '',
+      [],
+      [],
+      {
+        onToolCall(toolCall): void {
+          received.push(toolCall.id);
+          if (toolCall.id === 'first') {
+            controller.abort();
+          }
+        },
+      },
+      { signal: controller.signal },
+    );
+
+    expect(received).toEqual(['first', 'second']);
+    expect(result.message.toolCalls.map((toolCall) => toolCall.id)).toEqual(['first', 'second']);
+  });
+
   describe('finishReason propagation', () => {
     function streamWithFinish(
       parts: StreamedMessagePart[],
diff --git a/packages/kosong/test/google-genai.test.ts b/packages/kosong/test/google-genai.test.ts
index b8a2468dd9..06a0accad7 100644
--- a/packages/kosong/test/google-genai.test.ts
+++ b/packages/kosong/test/google-genai.test.ts
@@ -1,3 +1,11 @@
+/**
+ * Google GenAI provider scenarios — covers request/response translation,
+ * streaming metadata, errors, and cancellation with the SDK client as the
+ * stubbed external boundary.
+ *
+ * Run: pnpm --filter @moonshot-ai/kosong exec vitest run test/google-genai.test.ts
+ */
+
 import {
   APIConnectionError,
   APIContextOverflowError,
@@ -6,6 +14,7 @@ import {
   APITimeoutError,
   ChatProviderError,
 } from '#/errors';
+import { generate } from '#/generate';
 import type { Message, StreamedMessagePart, ToolCall } from '#/message';
 import {
   convertGoogleGenAIError,
@@ -1560,7 +1569,7 @@ describe('GoogleGenAIChatProvider', () => {
       expect(streamFn).not.toHaveBeenCalled();
     });
 
-    it('rejects promptly if the signal aborts before the first stream response resolves', async () => {
+    it('outer generation rejects when cancellation precedes the first Google response', async () => {
       const provider = createProvider({ stream: true });
       const mockModels = (provider as unknown as { _client: { models: Record<string, unknown> } })
         ._client.models;
@@ -1574,32 +1583,18 @@ describe('GoogleGenAIChatProvider', () => {
           }),
       );
 
-      const pending = provider.generate(
+      const pending = generate(
+        provider,
         '',
         [],
         [{ role: 'user', content: [{ type: 'text', text: 'Hi' }], toolCalls: [] }],
+        undefined,
         { signal: controller.signal },
       );
 
       controller.abort();
 
-      const result = await Promise.race([
-        pending.then(
-          () => ({ settled: 'resolved' as const }),
-          (error: unknown) => ({ settled: 'rejected' as const, error }),
-        ),
-        new Promise<{ settled: 'timeout' }>((resolve) =>
-          setTimeout(() => {
-            resolve({ settled: 'timeout' });
-          }, 100),
-        ),
-      ]);
-
-      expect(result.settled).toBe('rejected');
-      if (result.settled === 'rejected') {
-        expect(result.error).toBeInstanceOf(DOMException);
-        expect((result.error as DOMException).name).toBe('AbortError');
-      }
+      await expect(pending).rejects.toMatchObject({ name: 'AbortError' });
     });
 
     it('throws AbortError at the next chunk boundary when aborted mid-stream', async () => {
diff --git a/packages/kosong/test/provider-stream-cancellation.test.ts b/packages/kosong/test/provider-stream-cancellation.test.ts
new file mode 100644
index 0000000000..cbe6f84fbb
--- /dev/null
+++ b/packages/kosong/test/provider-stream-cancellation.test.ts
@@ -0,0 +1,194 @@
+/**
+ * Built-in provider stream cancellation scenarios — verifies that the public
+ * `StreamedMessage.cancel()` contract reaches each SDK-owned transport, that
+ * Google composes request/config signals, and that late native streams are
+ * retired. Each SDK client is the only stubbed external boundary.
+ *
+ * Run: pnpm --filter @moonshot-ai/kosong exec vitest run test/provider-stream-cancellation.test.ts
+ */
+
+import { generate } from '#/generate';
+import { AnthropicChatProvider } from '#/providers/anthropic';
+import { GoogleGenAIChatProvider } from '#/providers/google-genai';
+import { KimiChatProvider } from '#/providers/kimi';
+import { OpenAILegacyChatProvider } from '#/providers/openai-legacy';
+import { OpenAIResponsesChatProvider } from '#/providers/openai-responses';
+import type { StreamedMessage } from '#/provider';
+import { describe, expect, it, vi } from 'vitest';
+
+const HISTORY = [
+  { role: 'user' as const, content: [{ type: 'text' as const, text: 'Hello' }], toolCalls: [] },
+];
+
+interface Deferred<T> {
+  readonly promise: Promise<T>;
+  readonly resolve: (value: T) => void;
+}
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise;
+  });
+  return { promise, resolve };
+}
+
+function nativeStream(abort: () => void): AsyncIterable<never> & {
+  readonly controller: { abort(): void };
+} {
+  return {
+    controller: { abort },
+    [Symbol.asyncIterator]: () => ({
+      next: () => new Promise<IteratorResult<never>>(() => {}),
+    }),
+  };
+}
+
+function cancel(stream: StreamedMessage): void {
+  stream.cancel?.();
+}
+
+describe('built-in provider stream cancellation', () => {
+  it('aborts the Kimi SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new KimiChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ chat: { completions: { create } } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the OpenAI chat SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new OpenAILegacyChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ chat: { completions: { create } } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the OpenAI responses SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new OpenAIResponsesChatProvider({
+      model: 'test-model',
+      clientFactory: () => ({ responses: { create } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the Anthropic SDK transport when a returned stream is cancelled', async () => {
+    const abort = vi.fn<() => void>();
+    const create = vi.fn().mockResolvedValue(nativeStream(abort));
+    const provider = new AnthropicChatProvider({
+      model: 'test-model',
+      stream: true,
+      defaultMaxTokens: 1024,
+      clientFactory: () => ({ messages: { create } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+
+  it('aborts the Google SDK request signal when a returned stream is cancelled', async () => {
+    let transportSignal: AbortSignal | undefined;
+    const generateContentStream = vi.fn((params: Record<string, unknown>) => {
+      transportSignal = (params['config'] as Record<string, unknown>)['abortSignal'] as AbortSignal;
+      return Promise.resolve(nativeStream(() => {}));
+    });
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    });
+    const stream = await provider.generate('', [], HISTORY);
+
+    cancel(stream);
+
+    expect(transportSignal?.aborted).toBe(true);
+  });
+
+  it('aborts the Google SDK request signal when the caller signal aborts', async () => {
+    let transportSignal: AbortSignal | undefined;
+    const generateContentStream = vi.fn((params: Record<string, unknown>) => {
+      transportSignal = (params['config'] as Record<string, unknown>)['abortSignal'] as AbortSignal;
+      return Promise.resolve(nativeStream(() => {}));
+    });
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    });
+    const controller = new AbortController();
+    const stream = await provider.generate('', [], HISTORY, { signal: controller.signal });
+
+    controller.abort();
+
+    expect(transportSignal?.aborted).toBe(true);
+    cancel(stream);
+  });
+
+  it('includes the configured signal when a per-request Google signal is also present', async () => {
+    let transportSignal: AbortSignal | undefined;
+    const generateContentStream = vi.fn((params: Record<string, unknown>) => {
+      transportSignal = (params['config'] as Record<string, unknown>)['abortSignal'] as AbortSignal;
+      return Promise.resolve(nativeStream(() => {}));
+    });
+    const configuredController = new AbortController();
+    const requestController = new AbortController();
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    }).withGenerationKwargs({ abortSignal: configuredController.signal });
+    const stream = await provider.generate('', [], HISTORY, { signal: requestController.signal });
+
+    configuredController.abort();
+
+    expect(transportSignal?.aborted).toBe(true);
+    expect(requestController.signal.aborted).toBe(false);
+    cancel(stream);
+  });
+
+  it('cancels a Google native stream that resolves after generate cancellation', async () => {
+    const request = deferred<ReturnType<typeof nativeStream>>();
+    const transportCancelled = deferred<void>();
+    const abort = vi.fn(() => {
+      transportCancelled.resolve(undefined);
+    });
+    const generateContentStream = vi.fn(() => request.promise);
+    const provider = new GoogleGenAIChatProvider({
+      model: 'test-model',
+      stream: true,
+      clientFactory: () => ({ models: { generateContentStream } }) as never,
+    });
+    const controller = new AbortController();
+    const result = generate(provider, '', [], HISTORY, undefined, { signal: controller.signal });
+
+    controller.abort();
+    await expect(result).rejects.toMatchObject({ name: 'AbortError' });
+    request.resolve(nativeStream(abort));
+    await transportCancelled.promise;
+
+    expect(abort).toHaveBeenCalledOnce();
+  });
+});
diff --git a/packages/node-sdk/src/index.ts b/packages/node-sdk/src/index.ts
index f58e060751..ed73113f0c 100644
--- a/packages/node-sdk/src/index.ts
+++ b/packages/node-sdk/src/index.ts
@@ -79,6 +79,7 @@ export {
   buildUnsupportedImageNotice,
   compressImageForModel,
   compressBase64ForModel,
+  extractImageCompressionCaptions,
   gateImageFormatParts,
   isModelAcceptedImageMime,
   normalizeImageMime,
diff --git a/packages/node-sdk/src/rpc.ts b/packages/node-sdk/src/rpc.ts
index 9b1b83554c..8ba33c7195 100644
--- a/packages/node-sdk/src/rpc.ts
+++ b/packages/node-sdk/src/rpc.ts
@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 
 import {
   ErrorCodes,
+  log,
   makeErrorPayload,
   type AgentContextData,
   type ApprovalRequest,
@@ -116,7 +117,7 @@ type ResolvedCoreAPI = RPCMethods<CoreAPI>;
 
 export abstract class SDKRpcClientBase {
   private readonly interactiveAgentScope = new AsyncLocalStorage<string>();
-  private readonly eventListeners = new Set<(event: Event) => void>();
+  private readonly eventListeners = new Set<(event: Event) => unknown>();
   private readonly approvalHandlers = new Map<string, ApprovalHandler>();
   private readonly questionHandlers = new Map<string, QuestionHandler>();
 
@@ -238,7 +239,7 @@ export abstract class SDKRpcClientBase {
   async prompt(input: SessionPromptRpcInput): Promise<void> {
     const agentId = this.interactiveAgentId;
     const rpc = await this.getRpc();
-    return rpc.prompt({
+    await rpc.prompt({
       sessionId: input.sessionId,
       agentId,
       input: input.input,
@@ -672,7 +673,7 @@ export abstract class SDKRpcClientBase {
     });
   }
 
-  onEvent(listener: (event: Event) => void): Unsubscribe {
+  onEvent(listener: (event: Event) => unknown): Unsubscribe {
     this.eventListeners.add(listener);
     return () => {
       this.eventListeners.delete(listener);
@@ -681,7 +682,25 @@ export abstract class SDKRpcClientBase {
 
   receiveEvent(event: Event): void {
     for (const listener of this.eventListeners) {
-      listener(event);
+      try {
+        const delivery = listener(event);
+        if (delivery !== undefined) {
+          void Promise.resolve(delivery).catch((error: unknown) => {
+            this.reportEventListenerFailure(error);
+          });
+        }
+      } catch (error) {
+        this.reportEventListenerFailure(error);
+      }
+    }
+  }
+
+  private reportEventListenerFailure(error: unknown): void {
+    try {
+      log.warn('SDK event listener failed', { error });
+    } catch {
+      // Listener failures are isolated from event dispatch even when a host
+      // provides a throwing diagnostic sink.
     }
   }
 
diff --git a/packages/node-sdk/test/session-cancel.test.ts b/packages/node-sdk/test/session-cancel.test.ts
index 49bc3dcee5..2f39939bc5 100644
--- a/packages/node-sdk/test/session-cancel.test.ts
+++ b/packages/node-sdk/test/session-cancel.test.ts
@@ -1,14 +1,31 @@
+// Scenario: public session cancellation across the SDK, core turn worker, and provider stream.
+// Responsibilities: cancellation settlement, model-visible outcome context, and clean follow-up history.
+// Wiring: real SDK/core/generation stack with only the remote model provider boundary stubbed.
+// Run: pnpm --dir packages/node-sdk exec vitest run test/session-cancel.test.ts
+
 import { writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
+import type {
+  ChatProvider,
+  GenerateOptions,
+  Message,
+  StreamedMessage,
+  StreamedMessagePart,
+  Tool,
+} from '@moonshot-ai/kosong';
 import type * as KosongModule from '@moonshot-ai/kosong';
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { createKimiHarness, type KimiError, type Event } from '#/index';
 
 import { makeTempDir, removeTempDirs, waitForSDKEvent } from './session-runtime-helpers';
 import { TEST_IDENTITY } from './test-identity';
 
+const fakeProviderState = vi.hoisted(() => ({
+  generate: undefined as ChatProvider['generate'] | undefined,
+}));
+
 vi.mock('@moonshot-ai/kosong', async (importOriginal) => {
   const actual = await importOriginal<typeof KosongModule>();
   return {
@@ -18,11 +35,14 @@ vi.mock('@moonshot-ai/kosong', async (importOriginal) => {
       modelName: 'fake-model',
       thinkingEffort: null,
       async generate(
-        _systemPrompt: string,
-        _tools: unknown,
-        _history: unknown,
-        options?: { readonly signal?: AbortSignal },
+        systemPrompt: string,
+        tools: Tool[],
+        history: Message[],
+        options?: GenerateOptions,
       ) {
+        if (fakeProviderState.generate !== undefined) {
+          return fakeProviderState.generate(systemPrompt, tools, history, options);
+        }
         await waitForAbort(options?.signal);
         throwAbortError();
       },
@@ -35,7 +55,12 @@ vi.mock('@moonshot-ai/kosong', async (importOriginal) => {
 
 const tempDirs: string[] = [];
 
+beforeEach(() => {
+  fakeProviderState.generate = undefined;
+});
+
 afterEach(async () => {
+  fakeProviderState.generate = undefined;
   await removeTempDirs(tempDirs);
 });
 
@@ -78,6 +103,105 @@ describe('Session.cancel', () => {
     }
   });
 
+  it('establishes a clean follow-up boundary when provider stream cleanup never settles', async () => {
+    const homeDir = await makeTempDir(tempDirs, 'kimi-sdk-cancel-boundary-home-');
+    const workDir = await makeTempDir(tempDirs, 'kimi-sdk-cancel-boundary-work-');
+    await writeFakeModelConfig(homeDir);
+    const provider = installUncooperativeStreamProvider();
+    const harness = createKimiHarness({ homeDir, identity: TEST_IDENTITY });
+    let cancel: Promise<void> | undefined;
+    let unsubscribe: (() => void) | undefined;
+    let unsubscribeFollowUp: (() => void) | undefined;
+
+    try {
+      const session = await harness.createSession({ id: 'ses_cancel_clean_boundary', workDir });
+      const events: Event[] = [];
+      unsubscribe = session.onEvent((event) => {
+        events.push(event);
+      });
+
+      await session.prompt('Start work, then wait.');
+      await provider.firstNextStarted;
+      cancel = session.cancel();
+      await provider.abortObserved;
+
+      expect(provider.cleanupRequested).toBe(true);
+      expect(provider.cleanupRequestCount).toBe(1);
+      await cancel;
+      expect(provider.cleanupReleased).toBe(false);
+      expect(events).toContainEqual(
+        expect.objectContaining({
+          type: 'turn.ended',
+          sessionId: session.id,
+          reason: 'cancelled',
+        }),
+      );
+      expect((await session.getContext()).history.at(-1)).toMatchObject({
+        role: 'user',
+        content: [
+          {
+            type: 'text',
+            text: expect.stringContaining('The user interrupted the previous turn'),
+          },
+        ],
+        origin: { kind: 'injection', variant: 'turn_outcome' },
+      });
+
+      const followUpEnded = createDeferred<void>();
+      unsubscribeFollowUp = session.onEvent((event) => {
+        if (event.type === 'turn.ended' && event.reason === 'completed') {
+          followUpEnded.resolve(undefined);
+        }
+      });
+      await session.prompt('Continue.');
+      await provider.followUpNextStarted;
+      await provider.releaseLateOutput();
+      provider.completeFollowUp();
+      await followUpEnded.promise;
+      unsubscribeFollowUp();
+      unsubscribeFollowUp = undefined;
+
+      expect(provider.histories[1]?.slice(-3)).toEqual([
+        {
+          role: 'user',
+          content: [{ type: 'text', text: 'Start work, then wait.' }],
+          toolCalls: [],
+        },
+        {
+          role: 'user',
+          content: [
+            {
+              type: 'text',
+              text: [
+                '<system-reminder>',
+                'The user interrupted the previous turn before it finished.',
+                '',
+                'Some operations may already have taken effect. Treat the next user message as a follow-up, and check existing state before repeating operations.',
+                '</system-reminder>',
+              ].join('\n'),
+            },
+          ],
+          toolCalls: [],
+        },
+        {
+          role: 'user',
+          content: [{ type: 'text', text: 'Continue.' }],
+          toolCalls: [],
+        },
+      ]);
+      expect(JSON.stringify(provider.histories[1])).not.toContain('late output');
+      expect(JSON.stringify((await session.getContext()).history)).not.toContain('late output');
+    } finally {
+      unsubscribe?.();
+      unsubscribeFollowUp?.();
+      provider.completeFollowUp();
+      await provider.releaseLateOutput();
+      provider.releaseCleanup();
+      await cancel?.catch(() => undefined);
+      await harness.close();
+    }
+  });
+
   it('rejects manual compaction on an empty session with compaction.unable', async () => {
     const homeDir = await makeTempDir(tempDirs, 'kimi-sdk-cancel-compact-home-');
     const workDir = await makeTempDir(tempDirs, 'kimi-sdk-cancel-compact-work-');
@@ -191,3 +315,130 @@ function waitForAbort(signal: AbortSignal | undefined): Promise<void> {
 function throwAbortError(): never {
   throw new DOMException('The operation was aborted.', 'AbortError');
 }
+
+interface Deferred<T> {
+  readonly promise: Promise<T>;
+  readonly resolve: (value: T | PromiseLike<T>) => void;
+}
+
+interface UncooperativeStreamProvider {
+  readonly firstNextStarted: Promise<void>;
+  readonly abortObserved: Promise<void>;
+  readonly followUpNextStarted: Promise<void>;
+  readonly histories: readonly Message[][];
+  readonly cleanupRequested: boolean;
+  readonly cleanupRequestCount: number;
+  readonly cleanupReleased: boolean;
+  readonly completeFollowUp: () => void;
+  readonly releaseLateOutput: () => Promise<void>;
+  readonly releaseCleanup: () => void;
+}
+
+function installUncooperativeStreamProvider(): UncooperativeStreamProvider {
+  const firstNextStarted = createDeferred<void>();
+  const abortObserved = createDeferred<void>();
+  const firstNext = createDeferred<IteratorResult<StreamedMessagePart>>();
+  const followUpNextStarted = createDeferred<void>();
+  const followUpNext = createDeferred<IteratorResult<StreamedMessagePart>>();
+  const cleanupRelease = createDeferred<void>();
+  const histories: Message[][] = [];
+  let cleanupRequests = 0;
+  let cleanupReleased = false;
+  let calls = 0;
+  let followUpIterations = 0;
+
+  const requestCleanup = async (): Promise<IteratorResult<StreamedMessagePart>> => {
+    cleanupRequests += 1;
+    await cleanupRelease.promise;
+    return { done: true, value: undefined };
+  };
+  const firstIterator: AsyncIterator<StreamedMessagePart> = {
+    next: () => {
+      firstNextStarted.resolve(undefined);
+      return firstNext.promise;
+    },
+    return: requestCleanup,
+  };
+  const firstStream: StreamedMessage & {
+    return: () => Promise<IteratorResult<StreamedMessagePart>>;
+  } = {
+    ...streamFromIterator(firstIterator),
+    return: requestCleanup,
+  };
+  const followUpIterator: AsyncIterator<StreamedMessagePart> = {
+    next: () => {
+      followUpIterations += 1;
+      if (followUpIterations === 1) {
+        followUpNextStarted.resolve(undefined);
+        return followUpNext.promise;
+      }
+      return Promise.resolve({ done: true, value: undefined });
+    },
+  };
+
+  fakeProviderState.generate = async (_systemPrompt, _tools, history, options) => {
+    histories.push(structuredClone(history));
+    calls += 1;
+    if (calls === 1) {
+      if (options?.signal?.aborted === true) {
+        abortObserved.resolve(undefined);
+      } else {
+        options?.signal?.addEventListener(
+          'abort',
+          () => {
+            abortObserved.resolve(undefined);
+          },
+          { once: true },
+        );
+      }
+      return firstStream;
+    }
+    return streamFromIterator(followUpIterator);
+  };
+
+  return {
+    firstNextStarted: firstNextStarted.promise,
+    abortObserved: abortObserved.promise,
+    followUpNextStarted: followUpNextStarted.promise,
+    histories,
+    get cleanupRequested() {
+      return cleanupRequests > 0;
+    },
+    get cleanupRequestCount() {
+      return cleanupRequests;
+    },
+    get cleanupReleased() {
+      return cleanupReleased;
+    },
+    completeFollowUp: () => {
+      followUpNext.resolve({ done: false, value: { type: 'text', text: 'Continued.' } });
+    },
+    releaseLateOutput: async () => {
+      const observed = firstNext.promise.then(() => undefined);
+      firstNext.resolve({ done: false, value: { type: 'text', text: 'late output' } });
+      await observed;
+    },
+    releaseCleanup: () => {
+      cleanupReleased = true;
+      cleanupRelease.resolve(undefined);
+    },
+  };
+}
+
+function streamFromIterator(iterator: AsyncIterator<StreamedMessagePart>): StreamedMessage {
+  return {
+    id: null,
+    usage: null,
+    finishReason: null,
+    rawFinishReason: null,
+    [Symbol.asyncIterator]: () => iterator,
+  };
+}
+
+function createDeferred<T>(): Deferred<T> {
+  let resolve!: Deferred<T>['resolve'];
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise;
+  });
+  return { promise, resolve };
+}
diff --git a/packages/node-sdk/test/session-prompt-input.test.ts b/packages/node-sdk/test/session-prompt-input.test.ts
index f88c710009..4260f93e1e 100644
--- a/packages/node-sdk/test/session-prompt-input.test.ts
+++ b/packages/node-sdk/test/session-prompt-input.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import type { CoreAPI, RPCMethods } from '@moonshot-ai/agent-core';
+import { log, type CoreAPI, type Event, type RPCMethods } from '@moonshot-ai/agent-core';
 
 import { SDKRpcClientBase } from '../src/rpc';
 import { Session } from '../src/session';
@@ -60,6 +60,37 @@ class CapturingRpc extends SDKRpcClientBase {
   }
 }
 
+it('isolates synchronous and asynchronous listener failures so later listeners still receive the event', async () => {
+  const rpc = new CapturingRpc();
+  const received: Event[] = [];
+  const event = {
+    type: 'warning',
+    sessionId: 'session-listener-isolation',
+    agentId: 'main',
+    message: 'test warning',
+  } satisfies Event;
+  const logWarn = vi.spyOn(log, 'warn').mockImplementation(() => {});
+  rpc.onEvent(() => {
+    throw new Error('listener failed');
+  });
+  rpc.onEvent(async () => {
+    throw new Error('async listener failed');
+  });
+  rpc.onEvent((input) => received.push(input));
+
+  try {
+    expect(() => {
+      rpc.receiveEvent(event);
+    }).not.toThrow();
+    expect(received).toEqual([event]);
+    await vi.waitFor(() => {
+      expect(logWarn).toHaveBeenCalledTimes(2);
+    });
+  } finally {
+    logWarn.mockRestore();
+  }
+});
+
 describe('Session.prompt input normalization', () => {
   it('passes multimodal prompt parts through to the core RPC client', async () => {
     const prompt = vi.fn(async () => {});
diff --git a/packages/protocol/src/events.ts b/packages/protocol/src/events.ts
index 9700783e61..b2af8360c1 100644
--- a/packages/protocol/src/events.ts
+++ b/packages/protocol/src/events.ts
@@ -584,6 +584,10 @@ export interface TurnStartedEvent {
   readonly type: 'turn.started';
   readonly turnId: number;
   readonly origin: PromptOrigin;
+  /** Caller-supplied prompt correlation echoed by the turn that owns it. */
+  readonly promptId?: string;
+  /** Internal durable correlation for a prompt admitted during compaction. */
+  readonly deferredPromptId?: string;
 }
 
 export interface TurnEndedEvent {
@@ -1448,6 +1452,8 @@ export const turnStartedEventSchema = z.object({
   type: z.literal('turn.started'),
   turnId: z.number(),
   origin: promptOriginSchema,
+  promptId: z.string().optional(),
+  deferredPromptId: z.string().optional(),
 }) satisfies z.ZodType<TurnStartedEvent>;
 
 export const turnEndedEventSchema = z.object({