[Bacongineer]

Problem

An exit_comfyui_idle session can keep its lease after a fast first job has already finished. If the initial history read fails during server startup, the first successful read can absorb the completed job into the baseline. The same problem occurs when that job finishes before the detector's first history snapshot. The queue can remain empty throughout, so no observed busy-to-idle transition rescues the session.

Change

• Capture the session boundary after lease admission and before starting the child, rather than when the background detector first runs.
• Track history initialization independently from that boundary, preserving it across refused attempts.
• Keep timestamped terminal records from the current session out of both initial and recovered baselines. Recognize execution_success, execution_error and execution_interrupted.
• Keep prior, undated, malformed and future-dated history conservative. A readable busy queue still keeps its lease.

This uses the existing bounded history API and shared drain path. It adds no configuration or dependencies and changes no ordinary daemon-requested drain or parking policy.

Regression coverage

TestComfySessionRecoversCompletedJobFromUnavailableBaseline reproduces startup history refusal, completion before the first successful history read, failed/interrupted jobs, prior/future/undated history, a nonterminal event and a busy queue.

The test fails on upstream 75c0b708cc6e7186ddc39be19da60f2b16ad4fa4 in the four terminal startup cases before the production patch is applied. The unchanged regression passes with this patch, including repeated execution.

Validation

The committed contribution passes:

go build ./...
test -z "$(gofmt -l .)"
go vet ./...
go test -timeout 0 -count=1 -json ./...
go test -timeout 0 -race -count=3 -json ./internal/runner ./internal/comfy
GOOS=windows GOARCH=amd64 go build ./...
GOOS=windows GOARCH=amd64 go vet ./...
go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 run ./...

The focused regression also passes with -count=3. The tests use a short TMPDIR to stay within Unix socket pathname limits. Review and secret scanning cover the complete introduced commit, metadata, exported patch and this PR body; the exported patch replays to the exact committed tree.

Current-base verification is CPU-only. Windows validation here is cross-build/vet; native Windows execution belongs to CI. This PR does not claim GPU/image-model quality or a clean full host-acceptance campaign.

Follow-up to #87.