@adhdev/daemon-core 1.0.28-rc.13 → 1.0.28-rc.15

package/dist/mesh/mesh-completion-synthesis.d.ts

@@ -67,4 +67,29 @@ export declare function pollAssignedTaskTerminalEvidence(components: DaemonCompo
     assignedNodeId?: string;
     assignedProviderType?: string;
     dispatchTimestamp?: string;
+}, opts?: {
+    /**
+     * TX-FSM Stage 2 (EARLY-IDLE preamble guard): when set, the selected
+     * final assistant bubble must ALSO be at least this old at poll time.
+     *
+     * Why: the early-idle caller's continuous-idle streak proves the
+     * worker's status VERDICT stayed idle — not that the transcript did.
+     * A floor-class worker reads idle in the sliver BETWEEN an assistant
+     * preamble ("코드와 로그를 병행으로 확인하겠습니다.") and the tool call
+     * it is about to fire; at that instant the preamble IS the latest
+     * user-facing assistant bubble, is dated after dispatch, and has no
+     * trailing tool activity yet, so every structural guard above passes
+     * and a turn still in flight gets promoted to a completion (ledger
+     * 84594b15, 2026-07-26: task_completed with
+     * transcriptFinalAssistantPresent:false while the worker went on to an
+     * approval modal and did the real work minutes later). No single-read
+     * structural test can separate that preamble from a genuine final
+     * answer — only TIME can: a bubble younger than the settle window is
+     * narration, not a turn end. A genuinely finished worker's bubble
+     * simply completes one streak later (the caller resets and re-arms),
+     * so this guard DELAYS the early path by at most one window, never
+     * loses it. Fail-safe direction: veto → the caller falls through to
+     * the reclaim/grace paths.
+     */
+    minFinalAssistantAgeMs?: number;
 }): Promise<AssignedTaskTerminalEvidence | null>;

package/dist/providers/busy-lease-gate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Default lease bound: 180s. Rationale:
+ *  - During genuine work the transcript keeps advancing, so every probe
+ *    RE-ISSUES the lease and the bound never limits real work (the observed
+ *    long-quiet completions — codex 363s PTY-quiet, a 4m48s hero worker, kimi
+ *    8m22s — all had continuously advancing transcripts; PTY quiet ≠ lease
+ *    expiry).
+ *  - The bound only starts mattering AFTER the transcript's last observed
+ *    advance. It must comfortably cover the final-assistant write-lag on top
+ *    of the 60s growth-quiet window (MISSING_ASSISTANT_TRANSCRIPT_GROWTH_QUIET_MS),
+ *    so 3× that window.
+ *  - It must stay short enough that a genuinely wedged/finished session is not
+ *    held busy indefinitely: 180s matches the idle stall-watchdog threshold, so
+ *    a wedge surfaces on the same cadence as before Stage 2, and it is far
+ *    below the 15-min reclaim deadline. Expiry returns the judgment to the
+ *    unchanged floor/cap logic — the lease can never create an infinite busy.
+ */
+export declare const BUSY_LEASE_BOUND_MS = 180000;
+export interface BusyLeaseGate {
+    /** True when the bounded busy lease may gate judgments for this provider. */
+    enabled: boolean;
+    /** The lease bound in effect (default or env override). */
+    boundMs: number;
+}
+export declare function resolveBusyLeaseGate(providerType: string | undefined, env?: NodeJS.ProcessEnv): BusyLeaseGate;

package/dist/providers/cli-provider-instance.d.ts

@@ -632,6 +632,15 @@ export declare class CliProviderInstance implements ProviderInstance {
      * completion-debounce retry, never on the routine 5s tick.
      */
     private probeNativeTranscriptSignals;
+    /**
+     * TX-FSM Stage 2: is the bounded busy lease enabled for THIS provider?
+     * This is the canary rollout gate (busy-lease-gate.ts) — a per-provider
+     * feature switch, NOT a classification (transcript class/timing still come
+     * from resolveTranscriptAuthorityProfile only). Resolved per call so an
+     * env-driven rollout change takes effect without rebuilding the instance;
+     * any resolver error fails closed (lease disabled → pre-Stage-2 behavior).
+     */
+    private busyLeaseGateEnabled;
     /**
      * KIMI-MESH-COMPLETION-EMIT (axis 2). Last-chance completion emit for a mesh
      * DELEGATED worker whose PTY has already exited (e.g. killed by a false stall)

package/dist/providers/transcript-signal-source.d.ts

@@ -32,11 +32,37 @@ export interface TranscriptSignalSourceOpts {
      *  completion pipeline's MISSING_ASSISTANT_TRANSCRIPT_GROWTH_QUIET_MS so
      *  the shadow signal is comparable to the existing growth-hold judgment. */
     growthQuietMs: number;
+    /** TX-FSM Stage 2: bound (ms) for the busy lease this source tracks.
+     *  Defaults to BUSY_LEASE_BOUND_MS. */
+    leaseBoundMs?: number;
+}
+/** TX-FSM Stage 2 — the bounded busy lease state derived from the sample
+ *  stream. The lease is ACTIVE while the most recent liveness-proving sample
+ *  (in_turn_progress) is younger than the bound. It is deliberately kept OFF
+ *  the SignalSnapshot envelope (the Stage-0 signal vocabulary is frozen and
+ *  pinned): consumers read it via busyLease() on the source, which is pure
+ *  memory — zero added I/O, and absent (never-issued) for any class the
+ *  envelope already fails open for. */
+export interface BusyLeaseState {
+    /** True while now < lastLiveAt + bound. False after expiry — the caller
+     *  MUST then fall back to its normal (pre-lease) judgment. */
+    active: boolean;
+    /** Wall-clock of the last liveness-proving sample; null when no live
+     *  sample has ever been observed (lease never issued). */
+    lastLiveAt: number | null;
+    /** lastLiveAt + bound; null when never issued. */
+    expiresAt: number | null;
+    /** max(0, expiresAt - now); 0 when expired or never issued. */
+    remainingMs: number;
 }
 export declare class TranscriptSignalSource {
     private readonly opts;
     /** msgCount seen at the previous update — drives in_turn_progress. */
     private prevMsgCount;
+    /** TX-FSM Stage 2: wall-clock of the most recent sample that proved the
+     *  transcript live (in_turn_progress === true — a count advance OR mtime
+     *  inside the growth-quiet window). -1 = the lease was never issued. */
+    private lastLiveSampleAt;
     /** Fingerprint of the last LOGGED snapshot, so the shadow log fires on
      *  change only (a quiet session must not spam one line per read). */
     private lastLoggedFingerprint;
@@ -51,6 +77,25 @@ export declare class TranscriptSignalSource {
     /** Pure normalization — separated from update() so tests can assert the
      *  envelope without touching the log path. */
     buildSnapshot(sample: TranscriptSignalSample, now: number): SignalSnapshot;
+    /**
+     * TX-FSM Stage 2 — the bounded busy lease, derived from the SAME sample
+     * stream that produces the envelope (zero added I/O, pure memory read).
+     *
+     * Semantics: every sample whose in_turn_progress is true (re)issues the
+     * lease at that sample's wall-clock; the lease stays ACTIVE for
+     * leaseBoundMs after the LAST such sample and then EXPIRES. The bound is
+     * the whole point: the lease extends busy across PTY-quiet stretches while
+     * the transcript is demonstrably alive, but it can never hold busy
+     * indefinitely — after expiry the consumer must resume its normal
+     * (pre-lease) judgment, so a finished-but-wedged session escapes on the
+     * bound, not on a transcript event that may never come.
+     *
+     * Fail-open by construction: a non-native-source class, an unresolved
+     * transcript, or a read error never reaches the issuance line, so the
+     * lease is simply never issued (active:false, lastLiveAt:null) — a
+     * missing lease must never wedge a session or fabricate one.
+     */
+    busyLease(now?: number): BusyLeaseState;
     /** Stage-0 shadow log: emit one line when the normalized observation
      *  CHANGES. This log is the Stage 1-3 judgment input ("which signals were
      *  actually observable, and when"), so it carries the full signal set —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.28-rc.13",
+  "version": "1.0.28-rc.15",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -49,8 +49,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.28-rc.13",
-    "@adhdev/session-host-core": "1.0.28-rc.13",
+    "@adhdev/mesh-shared": "1.0.28-rc.15",
+    "@adhdev/session-host-core": "1.0.28-rc.15",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/mesh/mesh-completion-synthesis.ts

@@ -593,6 +593,32 @@ export async function pollAssignedTaskTerminalEvidence(
     components: DaemonComponents,
     mesh: { id: string; nodes?: Array<{ id: string; daemonId?: string; workspace?: string }> },
     row: { id: string; assignedSessionId?: string; assignedNodeId?: string; assignedProviderType?: string; dispatchTimestamp?: string },
+    opts?: {
+        /**
+         * TX-FSM Stage 2 (EARLY-IDLE preamble guard): when set, the selected
+         * final assistant bubble must ALSO be at least this old at poll time.
+         *
+         * Why: the early-idle caller's continuous-idle streak proves the
+         * worker's status VERDICT stayed idle — not that the transcript did.
+         * A floor-class worker reads idle in the sliver BETWEEN an assistant
+         * preamble ("코드와 로그를 병행으로 확인하겠습니다.") and the tool call
+         * it is about to fire; at that instant the preamble IS the latest
+         * user-facing assistant bubble, is dated after dispatch, and has no
+         * trailing tool activity yet, so every structural guard above passes
+         * and a turn still in flight gets promoted to a completion (ledger
+         * 84594b15, 2026-07-26: task_completed with
+         * transcriptFinalAssistantPresent:false while the worker went on to an
+         * approval modal and did the real work minutes later). No single-read
+         * structural test can separate that preamble from a genuine final
+         * answer — only TIME can: a bubble younger than the settle window is
+         * narration, not a turn end. A genuinely finished worker's bubble
+         * simply completes one streak later (the caller resets and re-arms),
+         * so this guard DELAYS the early path by at most one window, never
+         * loses it. Fail-safe direction: veto → the caller falls through to
+         * the reclaim/grace paths.
+         */
+        minFinalAssistantAgeMs?: number;
+    },
 ): Promise<AssignedTaskTerminalEvidence | null> {
     const sessionId = readNonEmptyString(row.assignedSessionId);
     const nodeId = readNonEmptyString(row.assignedNodeId);
@@ -631,6 +657,16 @@ export async function pollAssignedTaskTerminalEvidence(
         return null;
     }
 
+    // TX-FSM Stage 2 (EARLY-IDLE preamble guard): the final assistant bubble
+    // must have SETTLED — see the opts doc above. A bubble younger than the
+    // caller's settle window is treated as in-flight narration: veto (null),
+    // exactly like the trailing-tool guard, so the streak re-accumulates and a
+    // genuine turn end completes one window later.
+    if (typeof opts?.minFinalAssistantAgeMs === 'number' && opts.minFinalAssistantAgeMs > 0
+        && Date.now() - transcriptAtMs < opts.minFinalAssistantAgeMs) {
+        return null;
+    }
+
     // Idle + a final assistant message dated after dispatch = the worker finished this turn. We
     // cannot distinguish a self-reported failure from the plain transcript tail here (that lives
     // in buildTaskCompletionEvidence's structured-result path), and the alternative — re-driving a

package/src/mesh/mesh-reconcile-loop.ts

@@ -1053,7 +1053,14 @@ async function recoverStrandedAssignedDispatches(
             if (since === undefined) {
                 assignedIdleFinalAssistantSince.set(idleTranscriptStreakKey, nowMs);
             } else if (nowMs - since >= ASSIGNED_IDLE_TRANSCRIPT_COMPLETE_MS) {
-                const terminalEvidence = await pollAssignedTaskTerminalEvidence(components, mesh, row);
+                // TX-FSM Stage 2: the poll must additionally prove the final
+                // assistant bubble has SETTLED for the full window (preamble
+                // guard — see pollAssignedTaskTerminalEvidence). A too-fresh
+                // bubble vetoes to null → the streak resets below and a genuine
+                // turn end completes one window later.
+                const terminalEvidence = await pollAssignedTaskTerminalEvidence(components, mesh, row, {
+                    minFinalAssistantAgeMs: ASSIGNED_IDLE_TRANSCRIPT_COMPLETE_MS,
+                });
                 if (terminalEvidence) {
                     assignedIdleFinalAssistantSince.delete(idleTranscriptStreakKey);
                     updateTaskStatus(meshId, row.id, terminalEvidence.outcome);

package/src/providers/busy-lease-gate.ts

@@ -0,0 +1,66 @@
+/**
+ * TX-FSM Stage 2 — bounded busy lease rollout gate.
+ *
+ * The bounded busy lease (see transcript-signal-source.ts) changes FSM/completion
+ * JUDGMENT, so it does not ship to every provider at once: it is gated per
+ * provider type behind a canary list. The default canary is the Stage-2 goal's
+ * designated pair (kimi, codex-cli); the rollout widens by env, not by code:
+ *
+ *   ADHDEV_TX_BUSY_LEASE_PROVIDERS  — comma-separated provider types the lease
+ *                                     is enabled for (REPLACES the default
+ *                                     canary when set; set to an empty value
+ *                                     like "-" to disable everywhere).
+ *   ADHDEV_TX_BUSY_LEASE_BOUND_MS   — lease bound override (field tuning;
+ *                                     defaults to BUSY_LEASE_BOUND_MS).
+ *
+ * This is a ROLLOUT gate, not a classification: transcript class/timing still
+ * go through resolveTranscriptAuthorityProfile exclusively, and the lease only
+ * ever has data to act on for a native-source class (the signal source fails
+ * open otherwise). A provider absent from the list observes ZERO behaviour
+ * change — the lease branch is skipped before any lease state is consulted.
+ */
+'use strict';
+
+/**
+ * Default lease bound: 180s. Rationale:
+ *  - During genuine work the transcript keeps advancing, so every probe
+ *    RE-ISSUES the lease and the bound never limits real work (the observed
+ *    long-quiet completions — codex 363s PTY-quiet, a 4m48s hero worker, kimi
+ *    8m22s — all had continuously advancing transcripts; PTY quiet ≠ lease
+ *    expiry).
+ *  - The bound only starts mattering AFTER the transcript's last observed
+ *    advance. It must comfortably cover the final-assistant write-lag on top
+ *    of the 60s growth-quiet window (MISSING_ASSISTANT_TRANSCRIPT_GROWTH_QUIET_MS),
+ *    so 3× that window.
+ *  - It must stay short enough that a genuinely wedged/finished session is not
+ *    held busy indefinitely: 180s matches the idle stall-watchdog threshold, so
+ *    a wedge surfaces on the same cadence as before Stage 2, and it is far
+ *    below the 15-min reclaim deadline. Expiry returns the judgment to the
+ *    unchanged floor/cap logic — the lease can never create an infinite busy.
+ */
+export const BUSY_LEASE_BOUND_MS = 180_000;
+
+/** Stage-2 goal canary: the lease ships to these provider types first. */
+const DEFAULT_CANARY_PROVIDERS = ['kimi', 'codex-cli'];
+
+export interface BusyLeaseGate {
+    /** True when the bounded busy lease may gate judgments for this provider. */
+    enabled: boolean;
+    /** The lease bound in effect (default or env override). */
+    boundMs: number;
+}
+
+export function resolveBusyLeaseGate(
+    providerType: string | undefined,
+    env: NodeJS.ProcessEnv = process.env,
+): BusyLeaseGate {
+    const boundRaw = Number(env.ADHDEV_TX_BUSY_LEASE_BOUND_MS);
+    const boundMs = Number.isFinite(boundRaw) && boundRaw > 0 ? Math.floor(boundRaw) : BUSY_LEASE_BOUND_MS;
+    const listRaw = env.ADHDEV_TX_BUSY_LEASE_PROVIDERS;
+    const list = (typeof listRaw === 'string' ? listRaw : DEFAULT_CANARY_PROVIDERS.join(','))
+        .split(',')
+        .map(s => s.trim())
+        .filter(Boolean);
+    const type = (providerType ?? '').trim();
+    return { enabled: type.length > 0 && list.includes(type), boundMs };
+}

package/src/providers/cli-provider-instance.ts

@@ -19,6 +19,7 @@ import type { CliProviderModule } from '../cli-adapters/provider-cli-adapter.js'
 import type { MeshSendKeyItem, MeshSendKeyName } from '../cli-adapters/provider-cli-shared.js';
 import { resolveTranscriptAuthorityProfile } from './transcript-evidence.js';
 import { TranscriptSignalSource } from './transcript-signal-source.js';
+import { resolveBusyLeaseGate } from './busy-lease-gate.js';
 import type { SignalSnapshot } from './spec/signal-envelope.js';
 import { createCliAdapter } from './spec/route.js';
 import type { PtyRuntimeMetadata, PtyTransportFactory } from '../cli-adapters/pty-transport.js';
@@ -1714,6 +1715,10 @@ export class CliProviderInstance implements ProviderInstance {
                     // the message scan.
                     finalAssistantPresent: (msgs, ts) => this.completionHasFinalAssistantMessage(msgs, ts),
                     growthQuietMs: MISSING_ASSISTANT_TRANSCRIPT_GROWTH_QUIET_MS,
+                    // TX-FSM Stage 2: the lease bound follows the rollout gate's
+                    // (possibly env-overridden) value; the gate's enabled flag is
+                    // consulted per judgment, not here.
+                    leaseBoundMs: resolveBusyLeaseGate(this.type).boundMs,
                 });
             }
             const snapshot = this.transcriptSignalSource.update(
@@ -2727,6 +2732,18 @@ export class CliProviderInstance implements ProviderInstance {
         return { snapshot: this.lastTranscriptSignalSnapshot, messages };
     }
 
+    /**
+     * TX-FSM Stage 2: is the bounded busy lease enabled for THIS provider?
+     * This is the canary rollout gate (busy-lease-gate.ts) — a per-provider
+     * feature switch, NOT a classification (transcript class/timing still come
+     * from resolveTranscriptAuthorityProfile only). Resolved per call so an
+     * env-driven rollout change takes effect without rebuilding the instance;
+     * any resolver error fails closed (lease disabled → pre-Stage-2 behavior).
+     */
+    private busyLeaseGateEnabled(): boolean {
+        try { return resolveBusyLeaseGate(this.type).enabled; } catch { return false; }
+    }
+
     /**
      * KIMI-MESH-COMPLETION-EMIT (axis 2). Last-chance completion emit for a mesh
      * DELEGATED worker whose PTY has already exited (e.g. killed by a false stall)
@@ -3307,6 +3324,40 @@ export class CliProviderInstance implements ProviderInstance {
                     this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
                     return;
                 }
+                // TX-FSM Stage 2 (bounded busy lease): the transcript is NOT
+                // growing right now (the branch above would have held), but a
+                // sample within the lease bound proved it live — the turn is in
+                // a PTY-quiet valley, not finished. For lease-gated providers
+                // (canary rollout, resolveBusyLeaseGate), keep HOLDING the
+                // missing_final_assistant emit until the lease EXPIRES; on
+                // expiry this branch stops engaging and the unchanged floor/cap
+                // logic below resumes — the lease extends busy, it can never
+                // create an unbounded one (the agy busy-wedge failure mode).
+                // Fail-open identically to the growth-hold: no usable snapshot,
+                // no signal source, a never-issued lease, or a non-gated
+                // provider all fall through untouched.
+                if (growthSnapshot?.available === true && this.busyLeaseGateEnabled()) {
+                    const lease = this.transcriptSignalSource?.busyLease() ?? null;
+                    if (lease?.active === true) {
+                        if (pending.loggedBlockReason !== 'busy_lease_active') {
+                            LOG.info('CLI', `[${this.type}] holding pending completed (busy_lease_active: lastLiveAt=${lease.lastLiveAt} expiresIn=${lease.remainingMs}ms) — transcript live within the lease bound, screen-idle verdict not trusted`);
+                            if (this.isMeshWorkerSession()) {
+                                traceMeshEventDrop('completion_gate_hold', this.meshTraceCtx(), `busy_lease_active lastLiveAt=${lease.lastLiveAt} expiresIn=${lease.remainingMs}ms`);
+                            }
+                            if (this.completionTraceOn()) this.recordCompletionGateTrace('hold', {
+                                blockReason: 'busy_lease_active',
+                                latestVisibleStatus,
+                                leaseLastLiveAt: lease.lastLiveAt,
+                                leaseExpiresAt: lease.expiresAt,
+                                leaseRemainingMs: lease.remainingMs,
+                                waitedMs,
+                            });
+                            pending.loggedBlockReason = 'busy_lease_active';
+                        }
+                        this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
+                        return;
+                    }
+                }
             }
             if (!isTranscriptEvidenceGate && (block.terminal || waitedMs < COMPLETED_FINALIZATION_MAX_WAIT_MS)) {
                 if (pending.loggedBlockReason !== blockReason) {

package/src/providers/transcript-signal-source.ts

@@ -34,6 +34,7 @@
 
 import { LOG } from '../logging/logger.js';
 import type { TranscriptAuthorityProfile } from './transcript-evidence.js';
+import { BUSY_LEASE_BOUND_MS } from './busy-lease-gate.js';
 import {
     SIGNAL_SNAPSHOT_KIND,
     unavailableSignalSnapshot,
@@ -69,11 +70,38 @@ export interface TranscriptSignalSourceOpts {
      *  completion pipeline's MISSING_ASSISTANT_TRANSCRIPT_GROWTH_QUIET_MS so
      *  the shadow signal is comparable to the existing growth-hold judgment. */
     growthQuietMs: number;
+    /** TX-FSM Stage 2: bound (ms) for the busy lease this source tracks.
+     *  Defaults to BUSY_LEASE_BOUND_MS. */
+    leaseBoundMs?: number;
+}
+
+/** TX-FSM Stage 2 — the bounded busy lease state derived from the sample
+ *  stream. The lease is ACTIVE while the most recent liveness-proving sample
+ *  (in_turn_progress) is younger than the bound. It is deliberately kept OFF
+ *  the SignalSnapshot envelope (the Stage-0 signal vocabulary is frozen and
+ *  pinned): consumers read it via busyLease() on the source, which is pure
+ *  memory — zero added I/O, and absent (never-issued) for any class the
+ *  envelope already fails open for. */
+export interface BusyLeaseState {
+    /** True while now < lastLiveAt + bound. False after expiry — the caller
+     *  MUST then fall back to its normal (pre-lease) judgment. */
+    active: boolean;
+    /** Wall-clock of the last liveness-proving sample; null when no live
+     *  sample has ever been observed (lease never issued). */
+    lastLiveAt: number | null;
+    /** lastLiveAt + bound; null when never issued. */
+    expiresAt: number | null;
+    /** max(0, expiresAt - now); 0 when expired or never issued. */
+    remainingMs: number;
 }
 
 export class TranscriptSignalSource {
     /** msgCount seen at the previous update — drives in_turn_progress. */
     private prevMsgCount = -1;
+    /** TX-FSM Stage 2: wall-clock of the most recent sample that proved the
+     *  transcript live (in_turn_progress === true — a count advance OR mtime
+     *  inside the growth-quiet window). -1 = the lease was never issued. */
+    private lastLiveSampleAt = -1;
     /** Fingerprint of the last LOGGED snapshot, so the shadow log fires on
      *  change only (a quiet session must not spam one line per read). */
     private lastLoggedFingerprint = '';
@@ -138,6 +166,10 @@ export class TranscriptSignalSource {
         const inTurnProgress = countAdvanced || fresh;
         const transcriptGrowing = ageMs === null ? null : fresh;
         this.prevMsgCount = msgCount;
+        // TX-FSM Stage 2: a liveness-proving sample (re)issues the busy lease.
+        // transcript_growing === true implies fresh implies in_turn_progress,
+        // so in_turn_progress alone is the issuance condition.
+        if (inTurnProgress) this.lastLiveSampleAt = now;
 
         return {
             kind: SIGNAL_SNAPSHOT_KIND,
@@ -153,6 +185,34 @@ export class TranscriptSignalSource {
         };
     }
 
+    /**
+     * TX-FSM Stage 2 — the bounded busy lease, derived from the SAME sample
+     * stream that produces the envelope (zero added I/O, pure memory read).
+     *
+     * Semantics: every sample whose in_turn_progress is true (re)issues the
+     * lease at that sample's wall-clock; the lease stays ACTIVE for
+     * leaseBoundMs after the LAST such sample and then EXPIRES. The bound is
+     * the whole point: the lease extends busy across PTY-quiet stretches while
+     * the transcript is demonstrably alive, but it can never hold busy
+     * indefinitely — after expiry the consumer must resume its normal
+     * (pre-lease) judgment, so a finished-but-wedged session escapes on the
+     * bound, not on a transcript event that may never come.
+     *
+     * Fail-open by construction: a non-native-source class, an unresolved
+     * transcript, or a read error never reaches the issuance line, so the
+     * lease is simply never issued (active:false, lastLiveAt:null) — a
+     * missing lease must never wedge a session or fabricate one.
+     */
+    busyLease(now: number = Date.now()): BusyLeaseState {
+        if (this.lastLiveSampleAt < 0) {
+            return { active: false, lastLiveAt: null, expiresAt: null, remainingMs: 0 };
+        }
+        const bound = this.opts.leaseBoundMs ?? BUSY_LEASE_BOUND_MS;
+        const expiresAt = this.lastLiveSampleAt + bound;
+        const remainingMs = Math.max(0, expiresAt - now);
+        return { active: remainingMs > 0, lastLiveAt: this.lastLiveSampleAt, expiresAt, remainingMs };
+    }
+
     /** Stage-0 shadow log: emit one line when the normalized observation
      *  CHANGES. This log is the Stage 1-3 judgment input ("which signals were
      *  actually observable, and when"), so it carries the full signal set —