@awak-app/simy-cli 0.5.59 → 0.5.61

package/src/session-supervision/action-association-host.js

@@ -28,10 +28,11 @@ const deadlineBlocker = (record, candidate) => {
 // Association is optional metadata. Network failures never control the task's
 // work state; provider turns and their budgets remain owned by the supervisor.
 export function createActionAssociationHost({ root, sessionRoot, webOrigin, api = createActionAssociationApi({ webOrigin, sessionRoot }),
-  now = Date.now, refreshMs = 60_000, list = listRecords, read = readRecord, onChange = () => {} } = {}) {
+  now = Date.now, refreshMs = 60_000, list = listRecords, readRecords, read = readRecord, onChange = () => {} } = {}) {
   const abort = new AbortController(), views = new Map();
+  if (readRecords) list = () => readRecords();
   const ordinary = createOrdinaryAssociationStore({ root, api, webOrigin, now, onChange });
-  let auth = null, closed = false, running = null, serial = Promise.resolve();
+  let auth = null, closed = false, running = null, serial = Promise.resolve(), activeCursor = 0, historyCursor = 0;
   const enqueue = work => {
     const result = serial.then(work); serial = result.catch(() => {}); return result;
   };
@@ -44,7 +45,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
         if (!association || association.authRevision === next) continue;
         await updateRecord(root, record.provider, record.session, latest => {
           const local = latest?.run?.managed?.actionAssociation;
-          if (!local || latest.run.managed.taskId !== record.run.managed.taskId) return latest;
+          if (!local || local.authRevision === next || latest.run.managed.taskId !== record.run.managed.taskId) return latest;
           local.invalidated = true; local.binding = null; delete local.outbox; local.status = 'unavailable';
           return latest;
         });
@@ -57,6 +58,9 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     return eligible(record || {}) && record.run.managed.taskId === target.taskId ? record : null;
   };
   const valid = async expected => !closed && expected && await current() === expected;
+  // Called inside record locks: reading auth directly cannot recursively take
+  // the same lock through current()'s account-change invalidation pass.
+  const validateScope = expected => async () => !closed && await api.authRevision() === expected;
   const importEnvelope = async (record, envelope, expected, userCorrection = false) => {
     if (!await valid(expected)) throw new ActionAssociationApiError('account_changed');
     if (envelope.binding && envelope.binding.taskId !== record.run.managed.taskId) throw new ActionAssociationApiError('invalid_response');
@@ -64,9 +68,10 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     const local = record.run.managed.actionAssociation;
     // An empty remote binding must not erase a cached ambiguous/no-match result.
     if (userCorrection || envelope.binding || local?.binding || local?.namespace && local.namespace !== namespace) {
-      await importActionBinding({ root, ...identity(record), namespace, binding: envelope.binding, userCorrection, now: now() });
+      await importActionBinding({ root, ...identity(record), namespace, binding: envelope.binding, userCorrection, now: now(), validate: validateScope(expected) });
     }
-    await updateRecord(root, record.provider, record.session, latest => {
+    await updateRecord(root, record.provider, record.session, async latest => {
+      if (!await validateScope(expected)()) throw new ActionAssociationApiError('account_changed');
       const local = latest?.run?.managed?.actionAssociation;
       if (latest?.run?.managed?.taskId !== record.run.managed.taskId) return latest;
       latest.run.managed.actionAssociation = { ...local, authRevision: expected };
@@ -81,11 +86,12 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     const request = actionCandidateRequest(record);
     const contextRevision = request?.context.revision || null;
     if (!force && view?.auth === expected && view.contextRevision === contextRevision && now() < view.nextRefresh && (!association?.outbox || view.error)) {
-      if (queue && !view.error && view.snapshot && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now() });
+      if (queue && !view.error && view.snapshot && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
       return;
     }
     view = { ...view, auth: expected, contextRevision, nextRefresh: now() + refreshMs };
-    views.set(target.taskId, view);
+    views.delete(target.taskId); views.set(target.taskId, view);
+    while (views.size > 500) views.delete(views.keys().next().value);
     try {
       // Never publish an outbox from an earlier organization or login before a
       // scoped server response confirms who owns the current request.
@@ -100,23 +106,24 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
       const pending = latest.run.managed.actionAssociation?.outbox;
       if (pending && pending.namespace === namespace && latest.run.managed.actionAssociation.authRevision === expected) {
         if (snapshot.binding?.origin === 'automatic' && snapshot.binding.action?.id === pending.actionId && snapshot.binding.contextRevision === pending.contextRevision && snapshot.binding.candidateRevision === pending.candidateRevision) {
-          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: snapshot.binding, now: now() }); return;
+          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: snapshot.binding, now: now(), validate: validateScope(expected) }); return;
         }
         if (snapshot.contextRevision !== pending.contextRevision || snapshot.candidateRevision !== pending.candidateRevision) {
-          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, unavailable: true, now: now() });
+          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, unavailable: true, now: now(), validate: validateScope(expected) });
           view.nextRefresh = 0; return;
         }
         const payload = Object.fromEntries(['expectedRevision', 'contextRevision', 'candidateRevision', 'actionId', 'actionRevision', 'relation', 'coveredWork', 'reason', 'evidence'].map(key => [key, pending[key]]));
         const saved = await api.saveBinding(target.taskId, { ...payload, origin: 'automatic' }, { signal: abort.signal });
         if (!await valid(expected) || namespaceFor(webOrigin, saved.scope) !== namespace) return;
-        await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: saved.binding, now: now() });
+        await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: saved.binding, now: now(), validate: validateScope(expected) });
         return;
       }
       if (queue && request && !latest.run.managed.actionAssociation?.manualOverride && !TERMINAL.has(latest.run.state)) {
         // A read turn is queued only at the original session's safe boundary.
         // Blocked tasks retain candidates for auxiliary correction in the UI.
-        await prepareActionAssociation({ root, record: latest, snapshot, webOrigin, now: now() });
-        await updateRecord(root, latest.provider, latest.session, currentRecord => {
+        await prepareActionAssociation({ root, record: latest, snapshot, webOrigin, now: now(), validate: validateScope(expected) });
+        await updateRecord(root, latest.provider, latest.session, async currentRecord => {
+          if (!await validateScope(expected)()) throw new ActionAssociationApiError('account_changed');
           if (currentRecord?.run?.managed?.taskId === target.taskId && currentRecord.run.managed.actionAssociation) currentRecord.run.managed.actionAssociation.authRevision = expected;
           return currentRecord;
         });
@@ -131,43 +138,64 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
           const remote = await api.readBinding(target.taskId, { signal: abort.signal });
           const namespace = await importEnvelope(latest, remote, expected);
           const box = latest.run.managed.actionAssociation?.outbox;
-          if (box && remote.binding) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, binding: remote.binding, now: now() });
-          else if (box) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, unavailable: true, now: now() });
+          if (box && remote.binding) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, binding: remote.binding, now: now(), validate: validateScope(expected) });
+          else if (box) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, unavailable: true, now: now(), validate: validateScope(expected) });
           view.namespace = namespace; view.nextRefresh = 0;
         } catch { view.error = 'offline'; }
       } else if (hardFailure(error.code)) {
         view.candidates = []; view.snapshot = null;
-        await importActionBinding({ root, ...target, namespace: view.namespace || null, unavailable: true, now: now() });
+        await importActionBinding({ root, ...target, namespace: view.namespace || null, unavailable: true, now: now(), validate: validateScope(expected) });
       } else view.nextRefresh = now() + Math.min(refreshMs, 15_000);
     }
   }
+  function window(records, cursor, limit) {
+    const count = Math.min(limit, records.length);
+    return { records: Array.from({ length: count }, (_, i) => records[(cursor + i) % records.length]), cursor: records.length ? (cursor + count) % records.length : 0 };
+  }
   async function reconcile() {
-    const expected = await current(), records = (await list(root)).filter(eligible).slice(0, 30);
-    let cursor = 0;
-    await Promise.all(Array.from({ length: Math.min(3, records.length) }, async () => {
-    while (!closed && cursor < records.length) {
-      const record = records[cursor++];
+    const expected = await current(), all = (await list(root)).filter(eligible);
+    // Cancellation is a safety pass, independent of the optional network work
+    // budget. A large history must never hide an expired/paused matching job.
+    for (const record of all) {
+      if (closed) return;
       const managed = record.run.managed, job = managed.actionAssociation?.job;
       if (job && !managed.resumeLease && (!expected || TERMINAL.has(record.run.state) || ['paused', 'blocked'].includes(record.run.state) || record.run.state === 'recovery_required' && record.run.recoveryCause !== 'session_supervision' ||
           managedBudgetReason(record.run, now()) || now() >= record.run.deadline || record.run.continuations >= record.run.maxContinuations ||
           managed.understandingRevision !== job.understandingRevision || record.run.revision !== job.runRevision || managed.actionAssociation.invalidated)) {
-        await cancelActionAssociation({ root, ...identity(record), now: now() });
+        await cancelActionAssociation({ root, ...identity(record), expectedJobId: job.id, now: now() });
       }
-      if (!expected) {
-        if (managed.actionAssociation?.namespace) await importActionBinding({ root, ...identity(record), namespace: null, unavailable: true, now: now() });
-        continue;
+      if (!expected && managed.actionAssociation?.namespace && managed.actionAssociation.status !== 'unavailable') {
+        await importActionBinding({ root, ...identity(record), namespace: null, unavailable: true, now: now(), validate: validateScope(expected) });
       }
-      try { await sync(await fresh(identity(record)) || record, expected); } catch { /* Optional metadata never stops other task drives. */ }
     }
+    if (!expected) return;
+    const active = all.filter(record => !TERMINAL.has(record.run.state)), history = all.filter(record => TERMINAL.has(record.run.state));
+    // Prefer live work while reserving a small history window. Both cursors
+    // rotate so the first hash-sorted records cannot monopolize every tick.
+    const nextActive = window(active, activeCursor, history.length ? 24 : 30);
+    const nextHistory = window(history, historyCursor, 30 - nextActive.records.length);
+    activeCursor = nextActive.cursor; historyCursor = nextHistory.cursor;
+    const records = [...nextActive.records, ...nextHistory.records];
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(3, records.length) }, async () => {
+      while (!closed && cursor < records.length) {
+        const record = records[cursor++];
+        try { await sync(await fresh(identity(record)) || record, expected); } catch { /* Optional metadata never stops other task drives. */ }
+      }
     }));
   }
   return {
     // A projection is private to one desktop frame. Mutations and deadline
     // validation still reread the exact record and current authentication.
-    async beginProjection() {
-      await current();
-      const records = await list(root);
-      return { records, byKey: new Map(records.map(record => [`${record.provider}:${record.session}`, record])) };
+    async beginProjection({ records: suppliedRecords } = {}) {
+      const authRevision = await current();
+      const records = suppliedRecords || await list(root);
+      const taskIds = new Set(records.map(record => record.run?.managed?.taskId).filter(Boolean));
+      for (const taskId of views.keys()) if (!taskIds.has(taskId)) views.delete(taskId);
+      return { records, authRevision, byKey: new Map(records.map(record => [`${record.provider}:${record.session}`, record])) };
+    },
+    async validateProjection(projection) {
+      return !closed && await current() === projection.authRevision;
     },
     async decorateSessions(sessions, projection) {
       await ordinary.decorate(sessions, projection);
@@ -176,16 +204,16 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
         const record = records.get(`${item.provider}:${item.session}`);
         return { managed: true, taskId: record.run.managed.taskId, actionAssociation: record.run.managed.actionAssociation, candidate: item };
       }) };
-      await this.decorate(status);
+      await this.decorate(status, projection);
       for (const run of status.runs) run.candidate.actionAssociation = run.actionAssociation;
       return sessions;
     },
     async deadlineContext(candidate, projection) {
-      const expected = await current(), record = projection
+      const expected = projection ? projection.authRevision : await current(), record = projection
         ? projection.byKey.get(`${candidate.provider}:${candidate.session}`)
         : await read(root, candidate.provider, candidate.session);
       const local = record?.run?.managed?.actionAssociation || record?.actionAssociation;
-      if (!expected || local?.authRevision !== expected || !candidate.actionAssociation?.canCorrect) return null;
+      if (!expected || projection && auth !== expected || local?.authRevision !== expected || !(candidate.actionAssociation?.canCorrect || candidate.actionAssociation?.canReadBinding)) return null;
       const binding = candidate.actionAssociation.binding;
       const fingerprint = value => JSON.stringify([value?.revision, value?.action?.id, value?.action?.revision, value?.action?.dueAt, value?.action?.timeZone, value?.action?.status]);
       return { namespace: local.namespace, provider: candidate.provider, session: candidate.session, taskId: candidate.taskId, binding,
@@ -195,15 +223,17 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
           if (!await valid(expected)) return false;
           const latest = await read(root, candidate.provider, candidate.session);
           const scoped = latest?.run?.managed?.actionAssociation || latest?.actionAssociation;
+          if (!await valid(expected)) return false;
           return (latest?.run?.managed?.taskId || latest?.associationTaskId) === candidate.taskId && scoped?.namespace === local.namespace && scoped?.authRevision === expected && fingerprint(scoped.binding) === fingerprint(binding);
         } };
 
     },
     async prepareCached(record) {
+      const expected = await current();
       const view = views.get(record?.run?.managed?.taskId), request = actionCandidateRequest(record);
       if (closed || !auth || !view || view.auth !== auth || view.error || !view.snapshot || !request || view.contextRevision !== request.context.revision || view.snapshot.contextRevision !== request.context.revision || view.namespace !== namespaceFor(webOrigin, view.snapshot.scope)) return record;
       try {
-        const prepared = await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now() });
+        const prepared = await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
         return prepared || record;
       } catch { return record; }
     },
@@ -212,8 +242,8 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
       if (!running) running = reconcile().finally(() => { running = null; });
       return running;
     },
-    async decorate(status) {
-      const expected = await current();
+    async decorate(status, projection) {
+      const expected = projection ? projection.authRevision : await current();
       let remainingBytes = 24 * 1024;
       const perRunBytes = Math.floor(remainingBytes / Math.max(1,(status.runs || []).filter(run => run.managed).length));
       for (const run of status.runs || []) {

package/src/session-supervision/action-association.js

@@ -3,6 +3,10 @@ import { listRecords, updateRecord, TERMINAL } from '../codex-plugins/simy/hooks
 import { associationSignals, associationRevision } from '../codex-plugins/simy/hooks/action-association.mjs';
 export { associationSignals, associationRevision, associationContract, validateAssociationResult } from '../codex-plugins/simy/hooks/action-association.mjs';
 
+async function assertScope(validate) {
+  if (validate && !await validate()) throw Object.assign(new Error('Action association account changed.'), { code: 'account_changed' });
+}
+
 function stable(run) {
   return run?.managed && (run.state === 'active' || run.state === 'recovery_required' && run.recoveryCause === 'session_supervision' && run.managed.autoRecovery === true) && !TERMINAL.has(run.state) && run.managed.phase === 'active' && !run.managed.resumeLease && (!run.managed.handoff || run.managed.handoff.status === 'received') && !run.managed.pendingApproval && !run.managed.approvedAction && !run.managed.providerWarning && !run.managed.executionUncertain && (!run.managed.executionAttempt || run.managed.executionAttempt.phase === 'checkpointed');
 }
@@ -16,8 +20,9 @@ function restoreAssociationWork(run, saved) {
   }
   managed.awaitingAssociationHook = false;
 }
-export async function queueActionAssociation({ root, provider, session, taskId, expectedRevision, candidates, candidateRevision, scope, namespace = null, remoteBinding = null, now = Date.now() }) {
-  return updateRecord(root, provider, session, record => {
+export async function queueActionAssociation({ root, provider, session, taskId, expectedRevision, candidates, candidateRevision, scope, namespace = null, remoteBinding = null, now = Date.now(), validate }) {
+  return updateRecord(root, provider, session, async record => {
+    await assertScope(validate);
     const run = record?.run, managed = run?.managed;
     if (!managed || managed.taskId !== taskId || run.revision !== expectedRevision) return record;
     if (!stable(run) || now >= run.deadline || run.continuations >= run.maxContinuations) {
@@ -45,8 +50,9 @@ export async function queueActionAssociation({ root, provider, session, taskId,
     return record;
   });
 }
-export async function importActionBinding({ root, provider, session, taskId, namespace, binding = null, unavailable = false, userCorrection = false, now = Date.now() }) {
-  return updateRecord(root, provider, session, record => {
+export async function importActionBinding({ root, provider, session, taskId, namespace, binding = null, unavailable = false, userCorrection = false, now = Date.now(), validate }) {
+  return updateRecord(root, provider, session, async record => {
+    await assertScope(validate);
     const run = record?.run, managed = run?.managed;
     if (managed?.taskId !== taskId || managed.handoff && managed.handoff.status !== 'received') return record;
     const previous = managed.actionAssociation || {};
@@ -79,7 +85,7 @@ export function actionCandidateRequest(record) {
   const context = associationSignals(record?.run?.managed?.sessionUnderstanding);
   return context ? { taskId: record.run.managed.taskId, context, limit: 10 } : null;
 }
-export async function prepareActionAssociation({ root, record, snapshot, webOrigin, now = Date.now() }) {
+export async function prepareActionAssociation({ root, record, snapshot, webOrigin, now = Date.now(), validate }) {
   const request = actionCandidateRequest(record);
   if (!request || snapshot?.schemaVersion !== 1 || snapshot.taskId !== request.taskId || snapshot.contextRevision !== request.context.revision || !snapshot.scope?.organizationId || !snapshot.scope?.userId) return null;
   if (!Array.isArray(snapshot.candidates) || snapshot.candidates.length > 10 || new Set(snapshot.candidates.map(item => item.id)).size !== snapshot.candidates.length) return null;
@@ -88,10 +94,11 @@ export async function prepareActionAssociation({ root, record, snapshot, webOrig
   }
   const namespace = JSON.stringify([new URL(webOrigin).origin,snapshot.scope.organizationId,snapshot.scope.userId]);
   return queueActionAssociation({ root, provider: record.provider, session: record.session, taskId: request.taskId, expectedRevision: record.run.revision,
-    candidates: snapshot.candidates, candidateRevision: snapshot.candidateRevision, scope: snapshot.scope, namespace, remoteBinding: snapshot.binding, now });
+    candidates: snapshot.candidates, candidateRevision: snapshot.candidateRevision, scope: snapshot.scope, namespace, remoteBinding: snapshot.binding, now, validate });
 }
-export async function settleActionAssociation({ root, provider, session, taskId, outboxId, namespace, binding = null, unavailable = false, now = Date.now() }) {
-  return updateRecord(root, provider, session, record => {
+export async function settleActionAssociation({ root, provider, session, taskId, outboxId, namespace, binding = null, unavailable = false, now = Date.now(), validate }) {
+  return updateRecord(root, provider, session, async record => {
+    await assertScope(validate);
     const association = record?.run?.managed?.actionAssociation;
     if (record?.run?.managed?.taskId !== taskId || association?.outbox?.id !== outboxId || association.outbox.namespace !== namespace || record.run.managed.handoff && record.run.managed.handoff.status !== 'received') return record;
     if (binding && binding.taskId === taskId) {
@@ -102,10 +109,10 @@ export async function settleActionAssociation({ root, provider, session, taskId,
     return record;
   });
 }
-export async function cancelActionAssociation({ root, provider, session, taskId, now = Date.now() }) {
+export async function cancelActionAssociation({ root, provider, session, taskId, expectedJobId, now = Date.now() }) {
   return updateRecord(root, provider, session, record => {
     const run = record?.run, managed = run?.managed, association = managed?.actionAssociation;
-    if (managed?.taskId !== taskId || managed.resumeLease || !association?.job) return record;
+    if (managed?.taskId !== taskId || managed.resumeLease || !association?.job || expectedJobId && association.job.id !== expectedJobId) return record;
     const saved = association.job.saved;
     restoreAssociationWork(run, saved);
     managed.awaitingAssociationHook = false; association.status = 'unavailable'; delete association.job; association.updatedAt = now;

package/src/session-supervision/action-deadline.js

@@ -150,7 +150,7 @@ export function createActionDeadlineService({
     plan: context.plan ?? null,
     recommendation: deadlineRecommendation(context),
   });
-  async function reconcile(context) {
+  async function reconcile(context, { displayOnly = false } = {}) {
     const key = identity(context),
       action = context.binding?.action;
     const bindingRevision =
@@ -164,6 +164,14 @@ export function createActionDeadlineService({
       action?.status,
       terminal.has(context.taskStatus),
     ]);
+    if (displayOnly) {
+      // Host display already owns a frame-scoped record/auth snapshot and an
+      // authorization exit fence. An unchanged durable deadline needs no write
+      // transaction or per-session authorization read; project still evaluates
+      // the current time and fresh local decisions on every heartbeat.
+      const previous = await store.read(key);
+      if (previous?.fingerprint === fingerprint && previous.status !== 'unavailable') return project(previous, context);
+    }
     const state = await transact(context, (previous) => {
       if (context.online === false) return previous;
       // Tombstones retain the last authoritative revision, so old snapshots

package/src/session-supervision/association-store.js

@@ -54,7 +54,14 @@ export function createOrdinaryAssociationStore({
   const views = new Map(),
     abort = new AbortController();
   let serial = Promise.resolve(),
-    closed = false;
+    closed = false, nextBatchAt = 0, nextPriorityAt = 0, priorityTimer = null;
+  const rememberView = (taskId, view) => {
+    views.delete(taskId); views.set(taskId, view);
+    while (views.size > 500) views.delete(views.keys().next().value);
+  };
+  const presentationKey = view => JSON.stringify([view?.auth, view?.status, view?.contextRevision, view?.namespace,
+    view?.snapshot?.candidateRevision, view?.snapshot?.binding,
+    view?.snapshot?.candidates?.slice(0, 5).map(item => [item.id, item.revision, item.title])]);
   const find = candidate => readRecord(root, candidate.provider, candidate.session);
   async function ensure(candidate, known) {
     if (
@@ -106,7 +113,7 @@ export function createOrdinaryAssociationStore({
       context = sessionAssociationContext(candidate);
     let view = views.get(taskId);
     if (!auth) {
-      views.set(taskId, { auth, status: 'signed_out' });
+      rememberView(taskId, { auth, status: 'signed_out' });
       return;
     }
     if (
@@ -116,13 +123,16 @@ export function createOrdinaryAssociationStore({
       now() < view.nextRefresh
     )
       return;
+    const previous = view?.auth === auth ? view : null;
+    const sameContext = previous?.contextRevision === context.revision;
     view = {
-      auth,
-      contextRevision: context.revision,
-      status: 'loading',
-      nextRefresh: now() + 15000,
+      ...previous, auth, contextRevision: context.revision,
+      // Background renewal retains the last stable presentation. A user refresh
+      // can show progress without flashing every cached result back to loading.
+      status: force ? 'loading' : previous?.status || 'loading',
+      nextRefresh: now() + 60_000, lastAttemptAt: now(), failures: sameContext ? previous?.failures || 0 : 0,
     };
-    views.set(taskId, view);
+    rememberView(taskId, view);
     try {
       const snapshot = await api.candidates(
         { taskId, context, limit: 10 },
@@ -141,7 +151,8 @@ export function createOrdinaryAssociationStore({
         root,
         candidate.provider,
         candidate.session,
-        (latest) => {
+        async (latest) => {
+          if (closed || await api.authRevision() !== auth) throw new ActionAssociationApiError('account_changed');
           if (latest.associationTaskId !== taskId || latest.run?.managed)
             return latest;
           if (
@@ -173,6 +184,8 @@ export function createOrdinaryAssociationStore({
       Object.assign(view, {
         namespace,
         snapshot,
+        nextRefresh: now() + (snapshot.binding?.action ? 15_000 : 60_000),
+        failures: 0,
         status: snapshot.binding?.action
           ? 'bound'
           : snapshot.binding
@@ -182,6 +195,8 @@ export function createOrdinaryAssociationStore({
     } catch (error) {
       view.status = error.code || 'offline';
       view.snapshot = null;
+      view.failures = Math.min(4, view.failures + 1);
+      view.nextRefresh = now() + Math.min(120_000, 15_000 * 2 ** (view.failures - 1));
     }
   }
   return {
@@ -192,7 +207,10 @@ export function createOrdinaryAssociationStore({
           record,
         ]),
       );
-      const auth = await api.authRevision();
+      const auth = snapshot && Object.hasOwn(snapshot, 'authRevision') ? snapshot.authRevision : await api.authRevision();
+      const taskIds = new Set([...records.values()].map(record => record.run?.managed?.taskId || record.associationTaskId).filter(Boolean));
+      for (const taskId of views.keys()) if (!taskIds.has(taskId) && !inFlight.has(taskId)) views.delete(taskId);
+      const pending = [];
       for (const candidate of sessions) {
         const record = await ensure(
             candidate,
@@ -207,26 +225,29 @@ export function createOrdinaryAssociationStore({
         if (
           auth &&
           !closed &&
-          inFlight.size < 3 &&
           !inFlight.has(taskId) &&
           (!cached ||
             cached.auth !== auth ||
             cached.contextRevision !== context.revision ||
             now() >= cached.nextRefresh)
         ) {
-          const work = sync(candidate, false, record)
-            .catch(() => {})
-            .finally(() => {
-              inFlight.delete(taskId);
-              if (!closed) onChange();
-            });
-          inFlight.set(taskId, work);
+          const scopedBinding = cached?.auth === auth && cached.snapshot && record.actionAssociation?.authRevision === auth && record.actionAssociation.namespace === cached.namespace;
+          pending.push({ candidate, record, taskId, lastAttemptAt: cached?.lastAttemptAt ?? -Infinity,
+            priority: Boolean(cached?.auth === auth && cached.snapshot && cached.contextRevision !== context.revision ||
+              scopedBinding && (record.actionAssociation.binding?.action || cached.snapshot.binding?.action) && now() >= cached.nextRefresh) });
         }
         const view = views.get(taskId);
-        const snapshot = view?.auth === auth && auth ? view.snapshot : null;
-        const binding = snapshot?.binding;
+        const bindingSnapshot = view?.auth === auth && auth ? view.snapshot : null;
+        const snapshot = bindingSnapshot?.contextRevision === context.revision ? bindingSnapshot : null;
+        const local = record.actionAssociation;
+        const scoped = Boolean(bindingSnapshot && local?.authRevision === auth && local.namespace === view.namespace);
+        const newer = scoped &&
+          (local.binding?.revision || 0) > (bindingSnapshot.binding?.revision || 0);
+        // A hook/second desktop can correct or unlink a binding while the
+        // network cache remains valid. The current persisted revision wins.
+        const binding = newer ? local.binding : bindingSnapshot?.binding;
         candidate.actionAssociation = {
-          status: !auth ? 'signed_out' : view?.status || 'loading',
+          status: !auth ? 'signed_out' : newer ? local.status : view?.status || 'loading',
           binding: binding
             ? {
                 ...binding,
@@ -248,11 +269,45 @@ export function createOrdinaryAssociationStore({
             title: item.title.slice(0, 120),
           })),
           canCorrect: Boolean(snapshot),
+          canReadBinding: Boolean(scoped && binding),
           contextRevision: view?.contextRevision || null,
           candidateRevision: snapshot?.candidateRevision || null,
           truncated: (snapshot?.candidates?.length || 0) > 5,
         };
       }
+      const priority = pending.filter(item => item.priority);
+      const priorityReady = priority.length && now() >= nextPriorityAt;
+      if (pending.length && (now() >= nextBatchAt || priorityReady) && inFlight.size < 3) {
+        const onlyPriority = now() < nextBatchAt;
+        if (onlyPriority) nextPriorityAt = now() + 250;
+        else { nextBatchAt = now() + 3_000; if (priority.length) nextPriorityAt = now() + 250; }
+        // Never-checked and least-recently-checked work wins over array order,
+        // so a short retry TTL cannot indefinitely starve later conversations.
+        // Existing conversations must reflect changed user context promptly. This
+        // separately bounded lane never treats old-account or unseen history as
+        // urgent, and still shares the three workers with normal backfill.
+        const batch = (onlyPriority ? priority : pending).sort((a, b) => Number(b.priority) - Number(a.priority) || a.lastAttemptAt - b.lastAttemptAt).slice(0, 3 - inFlight.size);
+        const before = batch.map(({ taskId }) => presentationKey(views.get(taskId)));
+        const work = batch.map(({ candidate, record, taskId }) => {
+          const result = sync(candidate, false, record).catch(() => {}).finally(() => inFlight.delete(taskId));
+          inFlight.set(taskId, result);
+          return result;
+        });
+        void Promise.allSettled(work).then(() => {
+          if (!closed && batch.some(({ taskId }, index) => presentationKey(views.get(taskId)) !== before[index])) onChange();
+        });
+      }
+      const waitingPriority = priority.some(({ taskId }) => !inFlight.has(taskId));
+      if (!waitingPriority && priorityTimer) { clearTimeout(priorityTimer); priorityTimer = null; }
+      if (waitingPriority && inFlight.size < 3 && now() < nextPriorityAt && !priorityTimer) {
+        // A command may arrive between the bounded priority slots. Wake once
+        // when the slot opens rather than waiting for the 3s history heartbeat.
+        priorityTimer = setTimeout(() => { priorityTimer = null; if (!closed) onChange(); }, nextPriorityAt - now());
+        priorityTimer.unref();
+      }
+      if (!snapshot && await api.authRevision() !== auth) {
+        for (const candidate of sessions) candidate.actionAssociation = { status: 'account_changed', binding: null, candidates: [], canCorrect: false };
+      }
       return sessions;
     },
     correct(command, candidate) {
@@ -336,7 +391,8 @@ export function createOrdinaryAssociationStore({
             root,
             candidate.provider,
             candidate.session,
-            (latest) => {
+            async (latest) => {
+              if (closed || await api.authRevision() !== auth) throw new ActionAssociationApiError('account_changed');
               if (
                 latest.associationTaskId !== command.taskId ||
                 latest.run?.managed
@@ -364,6 +420,7 @@ export function createOrdinaryAssociationStore({
     },
     async close() {
       closed = true;
+      clearTimeout(priorityTimer); priorityTimer = null;
       abort.abort();
       await Promise.allSettled([serial, ...inFlight.values()]);
       views.clear();

package/src/session-supervision/automatic-continuation.js

@@ -27,6 +27,18 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
   let closed = false;
   const tick = candidates => {
     if (closed) return;
+    // Drop display/dedup state once a current observation proves it obsolete.
+    // Absence alone is insufficient: provider outages must not retry a failed
+    // enrollment with the same opt-in epoch and context when it reappears.
+    for (const candidate of candidates) {
+      const key = `${candidate.provider}:${candidate.session}`;
+      const attempt = attempted.get(key);
+      const bound = ['managed', 'pending_takeover', 'standard_loop'].includes(candidate.binding?.mode);
+      if (candidate.autoContinue !== true || bound ||
+          attempt && !attempt.startsWith(`${candidate.autoContinueEpoch}:`)) {
+        attempted.delete(key); errors.delete(key);
+      }
+    }
     for (const candidate of candidates) {
       if (pending.size >= 3) break;
       if (candidate.autoContinue !== true || !candidate.autoContinueEpoch || candidate.isRunning ||
@@ -76,6 +88,11 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
     },
     revoke(provider, session) { pending.get(`${provider}:${session}`)?.controller.abort(); },
     async whenIdle() { await Promise.allSettled([...pending.values()].map(entry => entry.job)); },
-    async close() { closed = true; for (const entry of pending.values()) entry.controller.abort(); await Promise.allSettled([...pending.values()].map(entry => entry.job)); },
+    async close() {
+      closed = true;
+      for (const entry of pending.values()) entry.controller.abort();
+      await Promise.allSettled([...pending.values()].map(entry => entry.job));
+      attempted.clear(); errors.clear();
+    },
   };
 }