fix(authority): fence controller lifecycle races

[trvon]

Summary

• fence backlog bootstrap and monitor teardown across session rebinding
• prevent stale post-fire cleanup from mutating advanced workflow state
• reserve immediate cadence budget for controller activation
• reject workflow projection into standalone task behavior

Validation

• full branch suite: 934 tests passed

Stack

5 of 6. Base: fix/notification-relevance.

[Copilot]

🔵 Needs a closer look

It changes several core lifecycle/concurrency paths (session teardown, wake buffering, and workflow fire cleanup) where subtle ordering/race regressions are hard to fully rule out without human sign-off.

Pull request overview

This PR hardens controller authority/lifecycle boundaries in pi-loop by fencing session-generation/store-identity races across backlog bootstrap, monitor/orchestration teardown, and post-fire cleanup, while also tightening workflow-vs-standalone-task separation and improving notification buffering correctness.

Changes:

• Adds generation/store/createdAt fencing to prevent stale async operations (e.g., backlog bootstrap and post-fire cleanup) from mutating or re-waking rebound/replaced controllers.
• Runs monitor shutdown and orchestration shutdown concurrently during session shutdown/switch to reduce teardown ordering hazards.
• Improves notification buffering semantics (queue sequencing + workflow wake invalidation when waiting on a monitor) and adjusts workflow inferred max-fires budgeting for startImmediately.

File summaries

File	Description
test/workflow-task-integration.test.ts	Adds RA-03 integration coverage for inferred fire budget when startImmediately is used.
test/store.test.ts	Adds RA-08 coverage ensuring workflows can’t be projected into standalone task behaviors.
test/session-runtime.test.ts	Updates teardown-order assertions and adds RA-06 coverage for concurrent monitor/orchestration shutdown behavior.
test/notification-runtime.test.ts	Adds RA-04/RA-07 coverage for buffered wake supersession and monitor-wait invalidation.
test/notification-coordinator.test.ts	Updates notification fixtures for the new queueSequence field.
test/index.test.ts	Adds RA-02/RA-05 race coverage and improves timer/mock cleanup between tests.
src/tools/workflow-tools.ts	Reserves additional inferred fire budget for startImmediately cadence activations.
src/store.ts	Rejects invalid workflow+task/orchestration combinations at normalization and creation time.
src/runtime/session-runtime.ts	Executes shutdownMonitors and shutdownOrchestrations in parallel on shutdown/switch.
src/runtime/notification-runtime.ts	Introduces queueSequence and prevents older same-key wakes from clobbering newer ones; invalidates buffered workflow wakes while waiting on a monitor.
src/notification-reducer.ts	Extends the reducer notification contract to include queueSequence.
src/index.ts	Adds store/generation/createdAt fencing for backlog bootstrap and post-fire cleanup; prevents workflow controllers from triggering autoTask behavior.

Review details

• Files reviewed: 12/12 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.