[schlessera]

Closes #2024

What changed

Activity now retains a separate host turn lifecycle from acceptance through completion, including queued, refused, revoked and failed-before-frame attempts. It records admission milestones, first backend observation and terminal timing, links an actual backend run when present, and presents total turn/first-frame timing beside the unchanged backend duration. Pre-backend host decisions retain their actors without fabricating execution. Backend usage and cost still aggregate exactly once.

Why this shape

Implements the maintainer-selected enclosing lifecycle in #2024. The envelope has an independent identity and sequence namespace; existing backend span parents, timestamps, durations, sequences and legacy change-reader results keep their meaning. Missing historical timing is unknown; skipped and incomplete phases remain explicit. Boot recovery interrupts unfinished envelopes under the existing session recovery owner, and recording failures cannot fail the observed turn.

Proof

Current candidate head: ec9c8d6c463db491b952f79e47792682b018adf8; integrated base: b67b1b84e8ceacf8f0df3aee8f23f8bf32a91703. Initial implementation base: 5af945306.

• Injected-clock tests exercise the real dispatch with fixture admission/backend callbacks: total turn 1,000 ms, first observation after 700 ms, backend startup 300 ms and preserved backend duration 200 ms. Additional actual dispatch tests cover governed refusal, budget refusal, revocation and backend failure before a frame.
• The final Activity/revocation/lifecycle/client/report/citation batch passes 144 tests / 566 assertions on the final head. The client mirror also verifies independent sequencing, stale snapshot rejection and bounded envelope/sequence retention.
• Restored timing mutation: starting first-frame timing at backend invocation instead of host acceptance makes enclosing milestones retain admission and preserve backend duration and one usage rollup fail on expected 1,100 ms versus actual 400 ms.
• Restored cancellation mutation: restoring legacy pre-frame ensureRoot() makes the billing cancellation tests fail on a fabricated backend link/first frame and missing enclosing actor evidence. The restored implementation passes.
• Queued revocation drains accepted cancellation actors before releasing the lease; queued startup exceptions retain their error outcome. Real dispatch failing-first assertions QUEUED_CANCEL_ACTOR_SURVIVES_LEASE_RELEASE and QUEUED_STARTUP_EXCEPTION_HAS_ERROR_OUTCOME failed on the previous implementation. Restoring that implementation as a mutation makes both named assertions fail again; repaired dispatch passes.
• Real Chromium in the pinned offline image (original implementation receipt): four tests cover complete, refused, incomplete and historical timing, plus the actual history row at 320 px with no horizontal overflow.
• bun run typecheck, pending changeset manifest/full-plan validation and bun run check:pr --base origin/main pass. The initial full build succeeded earlier in this branch; selected hosted packaging qualifies the final emitted artifacts. The preflight includes all lint/leakage gates and 636 affected fast invariants. Complete selected hosted proof is required before merge.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria are implemented for the currently shipped surfaces; export compatibility is noted below.
• The PR and issue carry the confirmed next minor release milestone, 0.44.0; registry latest is 0.43.1.
• Minor changesets cover ui-server, ui-sdk and ui-react.
• Leakage checks pass.
• The integration contract and API reports are updated with the additive lifecycle and historical semantics.
• Moved source citations are maintained.

Anything left open

Selected hosted CI, review and exact-candidate merge reconciliation remain required. The retained evidence export in #1767 has no shipped implementation on this base; the contract explicitly requires future exports to include this separate lifecycle evidence without inventing historical timestamps or duplicating inference accounting. No export run or startup performance improvement is claimed.

Merge continuation — 2026-10-16

The maintainer explicitly authorized retaining passing test receipts and merging without full refreshes solely because main advanced. This session supersedes the verification-coordination blocker #2111 for this PR. Existing focused, runtime and mutation receipts retain their original tested identities; no fresh combined-tree hosted proof is claimed. Actual merge conflicts are reconciled with focused verification where needed, and automatic main CI supplies postmerge verification.

[schlessera]

Local implementation and behavioral proof are complete. This PR is temporarily draft while final confirmations are serialized under #1862's live-base policy: merging another candidate would invalidate a parallel confirmation's base. Initial ready run 38889808419 is deliberately cancelled for scheduling, before any observed test failure; it is incomplete evidence and is not claimed as passing. The draft keeps cheap gates active. A new ready event will request complete exact-candidate proof when this PR reaches the confirmation queue.

[schlessera]

Parent integration review found two queued admission paths that could terminate lifecycle evidence through the authorization-release fallback before saving the actual terminal facts:

• Revocation while a dequeued turn awaited billing released its queue lease before draining accepted cancellation actors. The real dispatch assertion QUEUED_CANCEL_ACTOR_SURVIVES_LEASE_RELEASE failed with an empty host-event list. It now records the actor and signed-out reason before releasing the lease.
• An exception before the inner backend/admission try block closed a queued lifecycle as generic cancellation. QUEUED_STARTUP_EXCEPTION_HAS_ERROR_OUTCOME failed with cancelled / Removed from the queue before completion instead of the injected startup error. The enclosing loop now records the active turn's terminal outcome before releasing pending work, preserving the original exception behavior.

Both cases run through actual queued dispatch, including a disconnected sender. Restoring the original PR implementation makes both named assertions fail at their intended evidence checks; restoring the repair passes. The focused dispatch/lifecycle/Activity/client-store/citation suite passes 144 tests / 566 assertions. Full workspace typecheck passes. Moved citations were updated and their checks pass. No additional contract shape or release bump is introduced beyond this PR's existing additive contract and changeset.

Head ec9c8d6c463db491b952f79e47792682b018adf8 includes main b67b1b84e8ceacf8f0df3aee8f23f8bf32a91703. Committed final preflight passes 636 tests / 3,799 assertions, including lint/leakage and changeset gates. Complete current-candidate hosted proof remains pending; the PR stays draft in the confirmation queue.

[schlessera]

Merged PR #2075 as 9b8239dcd024d2917efd192f6b89f506cb466f2d; fetched main ancestry, issue closure and release milestone 0.44.0 on both PR and issue are verified.

100 lifecycle/budget/revocation/citation tests passed after preserving lifecycle and budget imports.

The maintainer explicitly authorized this session to retain passing receipts without repeating full suites solely because main advanced. Prior receipts retain their original head/base identities; they are not relabelled as fresh hosted proof of the combined tree. Automatic main CI is queued; complete postmerge hosted success is not yet claimed.

[schlessera]

Postmerge combined server verification passed on actual main commit 3f68a364569eb0e9e9bc7f2ade5336f50ce3abc7: 192 tests, 2,189 assertions, zero failures, across eight files in 7.30 seconds. The command used bun run test with claude-usage-accounting, ws-main-model, ws-handoff, governance-roadblocks, turn-lifecycle, activity-recorder, ws-turn-budgets and decision-citations test files. This covers the merged accounting, main-model, handoff, cancellation/compound/abandoned roadblock, lifecycle and real adapter budget interactions. Prior mutation/failing-first receipts remain on the individual PRs.

Automatic main CI is queued; complete hosted success is not claimed.